Common use of Physical Security Clause in Contracts

Physical Security. Contractor shall ensure that Medi-Cal PII is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- working hours. Contractor agrees to safeguard Medi-Cal PII from loss, theft or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor facilities where personnel assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PII. The Contractor shall ensure that these secure areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Ensure that there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 days a week at Contractor facilities and leased facilities where a large volume of Medi-Cal PII is stored. C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (meaning that there are personnel other than contractor personnel using common areas that are not securely segregated from each other.) The contractor shall have policies which indicate that Contractor and their personnel are not to leave records with Medi-Cal PII unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlines. E. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor shall ensure that Medi-Cal PII is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- working hours. Contractor agrees to safeguard Medi-Cal PII from loss, theft or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor facilities where personnel assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PII. The Contractor shall ensure that these secure areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Ensure that there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 days a week at Contractor facilities and leased facilities where a large volume of Medi-Cal PII is stored.store C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (meaning that there are personnel other than contractor personnel using common areas that are not securely segregated from each other.) The contractor shall have policies which indicate that Contractor and their personnel are not to leave records with Medi-Cal PII unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlines. E. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor shall ensure that Medi-Cal PII is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- non-working hours. Contractor agrees to safeguard Medi-Cal PII from loss, theft or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor facilities where personnel assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PII. The Contractor shall ensure that these secure areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Ensure that there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 days a week at Contractor facilities and leased facilities where a large volume of Medi-Cal PII is stored. C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (meaning that there are personnel other than contractor personnel using common areas that are not securely segregated from each other.) The contractor shall have policies which indicate that Contractor and their personnel are not to leave records with Medi-Cal PII unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlines. E. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor The County Department shall ensure that Medi-Cal PII Pll is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- working hours. Contractor The County Department agrees to safeguard Medi-Cal PII Pll from loss, theft theft, or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor the County Department facilities where personnel County Workers assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PIIPll. The Contractor County Department shall ensure that these secure secured areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Issue County Workers, who assist in the administration of Medi-Cal identification badges and require County Workers to wear these badges at the County Department facilities where Medi-Cal Pll is stored or used. C. Ensure each physical location, where Medi-Cal PII is used or stored, has procedures and controls that ensure an individual, who is terminated from access to the facility is promptly escorted from the facility by an authorized employee and access is revoked. D. Ensure there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 seven days a week at Contractor the County Department facilities and leased facilities where a large volume of Medi- Cal Pll is stored. E. Ensure data centers with servers, data storage devices, and critical network infrastructure involved in the use or storage of Medi-Cal PII is storedhave perimeter security and access controls that limit access to only authorized Information Technology (IT) staff. Visitors to the data center area must be escorted by authorized IT staff at all times. C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. F. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (use, meaning that there are personnel other than contractor personnel using common County Department and non-County Department functions in one building in work areas that are not securely segregated from each other.) . The contractor County Department shall have policies which that indicate that Contractor and their personnel County Workers are not to leave records with Medi-Medi- Cal PII Pll unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlinesairplanes. E. G. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor The County Department shall ensure that Medi-Cal PII Pll is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- non-working hours. Contractor The County Department agrees to safeguard Medi-Cal PII Pll from loss, theft theft, or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor the County Department facilities where personnel County Workers assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PIIPll. The Contractor County Department shall ensure that these secure secured areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Issue County Workers, who assist in the administration of Medi-Cal identification badges and require County Workers to wear these badges at the County Department facilities where Medi-Cal Pll is stored or used. C. Ensure each physical location, where Medi-Cal PII is used or stored, has procedures and controls that ensure an individual, who is terminated from access to the facility is promptly escorted from the facility by an authorized employee and access is revoked. D. Ensure there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 seven days a week at Contractor the County Department facilities and leased facilities where a large volume of Medi- Cal Pll is stored. E. Ensure data centers with servers, data storage devices, and critical network infrastructure involved in the use or storage of Medi-Cal PII is storedhave perimeter security and access controls that limit access to only authorized Information Technology (IT) staff. Visitors to the data center area must be escorted by authorized IT staff at all times. C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. F. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (use, meaning that there are personnel other than contractor personnel using common County Department and non-County Department functions in one building in work areas that are not securely segregated from each other.) . The contractor County Department shall have policies which that indicate that Contractor and their personnel County Workers are not to leave records with Medi-Medi- Cal PII Pll unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlinesairplanes. E. G. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor shall ensure that Medi-Cal PII is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- working hours. Contractor agrees to safeguard Medi-Cal PII from loss, theft or inadvertent disclosure and, therefore, agrees to:: Addendum A – page 3 A. Secure all areas of Contractor facilities where personnel assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PII. The Contractor shall ensure that these secure areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Ensure that there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 days a week at Contractor facilities and leased facilities where a large volume of Medi-Cal PII is stored. C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (meaning that there are personnel other than contractor personnel using common areas that are not securely segregated from each other.) The contractor shall have policies which indicate that Contractor and their personnel are not to leave records with Medi-Cal PII unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlines. E. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.

Physical Security. Contractor shall ensure that Medi-Cal PII is used and stored in an area that is physically safe from access by unauthorized persons during working hours and non- non-working hours. Contractor agrees to safeguard Medi-Cal PII from loss, theft or inadvertent disclosure and, therefore, agrees to: A. Secure all areas of Contractor facilities where personnel assist in the administration of the Medi-Cal program and use or disclose Medi-Cal PII. The Contractor shall ensure that these secure areas are only accessed by authorized individuals with properly coded key cards, authorized door keys or access authorization; and access to premises is by official identification. B. Ensure that there are security guards or a monitored alarm system with or without security cameras 24 hours a day, 7 days a week at Contractor facilities and leased facilities where a large volume of Medi-Cal PII is stored.store C. Issue Contractor personnel who assist in the administration of the Medi-Cal program identification badges and require County Workers to wear the identification badges at facilities where Medi-Cal PII is stored or used. D. Store paper records with Medi-Cal PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks or locked offices in facilities which are multi-use (meaning that there are personnel other than contractor personnel using common areas that are not securely segregated from each other.) The contractor shall have policies which indicate that Contractor and their personnel are not to leave records with Medi-Cal PII unattended at any time in vehicles or airplanes and not to check such records in baggage on commercial airlines. E. Use all reasonable measures to prevent non-authorized personnel and visitors from having access to, control of, or viewing Medi-Cal PII.