Identification and Protection of Confidential Information Article 1, section 24, of the Florida Constitution, guarantees every person access to public records, and section 119.011, F.S., provides a broad definition of “public record.” As such, records submitted to the Department (or any other State agency) are public records and are subject to disclosure unless exempt from disclosure by law. If the Contractor considers any portion of a record it provides to the Department (or any other State agency) to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), the Contractor shall mark as “confidential” each page of a document or specific portion of a document containing Confidential Information and simultaneously provide the Department (or other State agency) with a separate, redacted copy of the record. The Contractor shall state the basis of the exemption that the Contractor contends is applicable to each portion of the record redacted, including the specific statutory citation for such exemption. The Contractor shall only redact portions of records that it claims contains Confidential Information. If the Contractor fails to mark a record it claims contains Confidential Information as “confidential,” or fails to submit a redacted copy in accordance with this section of a record it claims contains Confidential Information, the Department (or other State agency) shall have no liability for release of such record. The foregoing will apply to every instance in which the Contractor fails to both mark a record “confidential” and redact it in accordance with this section, regardless of whether the Contractor may have properly marked and redacted the same or similar Confidential Information in another instance or record submitted to the Department (or any other State agency). In the event of a public records request, to which records the Contractor marked as “confidential” are responsive to the request, the Department shall provide the Contractor- redacted copy to the requestor. If the Contractor has marked a record as “confidential” but failed to provide a Contractor-redacted copy to the Department, the Customer may notify the Contractor of the request and the Contractor may have up to ten (10) Business Days from the date of the notice to provide a Contractor-redacted copy, or else the Department may release the unredacted record to the requestor without liability. If the Department provides a Contractor- redacted copy of the documents and the requestor asserts a right to the Contractor-redacted Confidential Information, the Department shall promptly notify the Contractor such an assertion has been made. The notice will provide that if the Contractor seeks to protect the Contractor-redacted Confidential Information from release it must, within thirty (30) days after the date of the notice and at its own expense, file a cause of action seeking a declaratory judgment that the information in question is exempt from section 119.07(1), F.S., or other applicable law and an order prohibiting the Department from publicly disclosing the information. The Contractor shall provide written notice to the Department of any cause of action filed. If the Contractor fails to file a cause of action within thirty (30) days the Department may release the unredacted copy of the record to the requestor without liability. If the Department is requested or compelled in any legal proceeding to disclose documents that are marked as “confidential” (whether by oral questions, interrogatories, requests for information or documents, subpoena, or similar process), unless otherwise prohibited by law, the Department shall give the Contractor prompt written notice of the demand or request prior to disclosing any Confidential Information to allow the Contractor to seek a protective order or other appropriate relief at the Contractor’s sole discretion and expense. If the Contractor fails to take appropriate and timely action to protect the Confidential Information contained within documents it has marked as “confidential” or fails to provide a redacted copy that may be disclosed, the Department may provide the unredacted records in response to the demand without liability. The Contractor shall protect, defend, and indemnify the Department for all claims, costs, fines, settlement fees, and attorneys’ fees, at both the trial and appellate levels, arising from or relating to the Contractor’s determination that its records contain Confidential Information. In the event of a third-party claim brought against the Department for failure to release the Contractor’s redacted Confidential Information, the Contractor shall assume, at its sole expense, the defense or settlement of such claim, including attorney’s fees and costs at both the trial and appellate levels. If the Contractor fails to continuously undertake the defense or settlement of such claim or if the Contractor and Department mutually agree that the Department is best suited to undertake the defense or settlement, the Department will have the right, but not the obligation, to undertake the defense or settlement of such claim, at its discretion. The Contractor shall be bound by any defense or settlement the Department may make as to such claim, and the Contractor agrees to reimburse the Department for the expense, including reasonable attorney’s fees and costs at both the trial and appellate levels associated with any defense or settlement that the Department may undertake to defend Contractor’s Confidential Information. The Department will also be entitled to join the Contractor in any third-party claim for the purpose of enforcing any right of indemnity under this section. If at any point the Department is reasonably advised by its counsel that disclosure of the Confidential Information is required by law, including but not limited to Florida’s public records laws, the Department may disclose such Confidential Information without liability hereunder.
Protection of Data The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section 8 Data Disposition, may be deferred until the disks are retired, replaced, or otherwise taken out of the Secure Area. c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be Stored in a Secure Area. Workstations which access DSHS Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by DSHS on optical discs which will be attached to network servers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism.