Fort Walton Beach Resolution — 2026-09 Accepting Funding FL Department of Managed Services-Cybersecurity Software — reading text

internal administrative and other costs incurred in identifying the affected individuals and their mailing information. 4. In the event of a Data Breach, including the privacy or security of the Covered Data, while in the custody or control of the Grantee, if the Grantee must provide notice as a result of the requirements contained in section 501. 171, F. S., or other Applicable Law, the Grantee shall submit a draft of the notice to FL[ DS] for prior review and approval of the contents of the notice, prior to disseminating the notice. Such approval shall not be unreasonably delayed or withheld. B. If Grantee experiences a breach of the security of its systems that results in a breach of the security of FL[ DS]' s systems (" FL[ DS] Breach"), Grantee shall be responsible for all costs related to the FL[ DS] Breach including FL[ DS]' s costs of complying with all legal requirements, including any costs for data breach notification under section 501. 171, F. S., or Applicable Law, as well as defending any claims, actions, or lawsuits against the FL[ DS] related thereto. Grantee, at its own expense, shall cooperate fully with FL[ DS] in the investigation, eradication, remediation, and recovery from the FL[ DS] Breach. C. If FL[ DS] experiences a breach of the security of its systems that results in a breach of the security of Grantee' s systems (" Grantee Breach"), FL[ DS] shall be responsible for all costs related to the Grantee Breach including Grantee' s costs of complying with all legal requirements, including the requirements for data breach notification under section 501. 171, F. S., or Applicable Law, as well as defending any claims, actions or lawsuits related thereto. FL[ DS], at its own expense, shall Page 27 of 37  cooperate fully with Grantee in the investigation, eradication, remediation, and recovery from the Grantee Breach. D. If either FL[ DS] or Grantee is obligated under this Section to pay costs incurred by the other Party, the Party required to pay such costs shall submit a draft of the legal notifications and other public communications to the other Party for prompt review and approval of the contents prior to disseminating the notification or communication. Such approval shall not be unreasonably delayed or withheld. E. The Parties understand and agree the provisions of this DSA relating to the protection and security of the Covered Data constitute a material condition of this DSA. This Article V. Unauthorized Disclosure/ Data Breach is subject to Sections Q. and R. of the Agreement. II. Additional Terms Applicable to Certain Circumstances. A. Grantee is responsible for their Covered Data and entering into any required additional agreements related thereto. Grantee shall provide the FL[ DS] DSA Coordinator with written notice prior to granting Access to any of the data types listed in subsections B- E, below, to FL[ DS] or Software Entitlements. In the event of a conflict between the terms and conditions of this Article VI and the remainder of the DSA, the terms and conditions of Article VI shall control. Moreover, a Project may include the use of information described in more than one ( 1) of the provisions set forth in this Article VI, or it may include the use of information not described in this Article VI. In the event of a conflict between or among the terms and conditions of Subsections B, C, D or E of this Article VI, the more restrictive terms and conditions shall apply unless otherwise provided by Applicable Law or guidance by the applicable regulatory enforcement agencies or bodies. B. CJIS. The terms and conditions of this Article VI. B. apply when Covered Data involved in a Project includes criminal justice information. CJIS Covered Data. Covered Data may also include, but shall not be limited to, CJIS Covered Data. For purposes of this DSA, CJIS Covered Data shall mean criminal justice information that is provided by the Federal Bureau of Investigation ( FBI) Criminal Justice Information Services ( CJIS) system and that is necessary for law enforcement and civil agencies to perform their missions, including, but not limited to, biometric, identity history, biographic, property, and case/incident history data. 2. Disclosure of CJIS Covered Data. The disclosure of CJIS Covered Data under the DSA, as modified by this section, is governed by the CJIS Security Policy, available at https:// www.fbi. gov/services/ ciis/ ciis-security- policv- resource- center. In accordance with the CJIS Security Policy and 28 CFR Part 20, use of the CJIS system under the DSA is restricted to: detection, apprehension, detention, pretrial release, post -trial release, prosecution, adjudication, correctional supervision, rehabilitation of accused persons or criminal offenders, and other legally authorized purposes. 3. Training. The Parties agree to work together to provide Authorized Users with confidentiality, privacy, and security training regarding access, use, and disclosure requirements for the CJIS Covered Data under the CJIS Security Policy. 4. Access Requirements. Unique authorization is required for Access to the CJIS Covered Data and must be properly authenticated and recorded for audit purposes, including CJIS security and other applicable audit requirements. Page 28 of 37  ATTACHMENT C GRANTEE DATA SHARING AGREEMENT A. HIPAA and State Protected Health Information. The terms and conditions of this Article VI. C. apply when Covered Data involved in a Project includes protected health information ( PHI) and such other sensitive health information, the disclosure of which may be limited or restricted by law, including, but not limited to, mental health and drug and alcohol related information. PHI Covered Data. Covered Data may also include, but shall not be limited to, PHI Covered Data. For purposes of this DSA, "PHI Covered Data" shall mean " protected health information" or " PHI," as such term is defined by HIPAA. PHI shall include, but shall not be limited to, any other medical or health- related information that is afforded greater protection under more restrictive federal or state law, including, but not limited to, the Substance Abuse and Mental Health Services Act ( SAMSHA), located at 42 C. F. R. Part 2, the Florida Mental Health Act the Baker Act), located at Fla. Stat. § 394.451 — 394. 47892, and the Hal S. Marchman Alcohol and Other Drug Services Act, located at Fla. Stat. § 397.301 et seq. 2. Disclosure of PHI Covered Data. The disclosure of PHI Covered Data under the DSA, as modified by this Article C, is governed by HIPAA and more restrictive federal or state law, as applicable. Accordingly, the disclosure of PHI Covered Data under the DSA is permitted only with the consent of the individual who is the subject of the PHI Covered Data, by court order that meets the requirements of applicable law, and for other purposes as permitted by Applicable Law. 3. Business Associate Agreement. To the extent that FADS] is a " Business Associate" of Grantee, as such term is defined under HIPAA, the Parties agree to enter into a mutually agreeable Business Associate Agreement. 4. Training. The Parties agree to work together to provide Authorized Users with confidentiality, privacy, and security training regarding access, use, and disclosure requirements for the PHI Covered Data under HIPAA and more restrictive federal or state law, to the extent applicable. 5. Access Requirements. Unique authorization is required for Access and must be properly authenticated and recorded for audit purposes, including HIPAA audit requirements and other audit requirements under more restrictive federal or state law, to the extent applicable. B. FERPA. The terms and conditions of this Article VI. D. apply when Covered Data includes student education records as defined by the Family Educational Rights and Privacy Act, 20 USC § 1232g, and its implementing regulations set forth at 34 CFR Part 99 ( collectively, " FERPA"). 1. FERPA Covered Data. Covered Data may also include, but shall not be limited to, FERPA Covered Data. For purposes of this DSA, " FERPA Covered Data" shall mean student education records as defined by FERPA. 2. Disclosure of FERPA Covered Data. The disclosure of FERPA Covered Data under the DSA, as modified by this section, is governed by FERPA. Accordingly, the disclosure of FERPA Covered Data under the DSA is permitted with parent or eligible student consent and, without such consent, in the following circumstances: ( i) to school officials with legitimate educational interest; (ii) to other schools to which a student is transferring; ( iii) to specified officials for audit or evaluation purposes; ( iv) to appropriate parties in connection with financial aid to a student; v) to organizations conducting certain studies for or on behalf of the school; ( vi) to accrediting organizations; ( vii) to comply with a judicial order or lawfully issued subpoena; ( viii) to appropriate officials in cases of health and safety emergencies; ( ix) to state and local authorities, within a juvenile justice system, pursuant to specific state law; and (x) as otherwise provided by FERPA. Page 29 of 37  3. Training. The Parties agree to work together to provide Authorized Users with confidentiality, privacy, and security training regarding access, use, and disclosure requirements for the FERPA Covered Data under FERPA. 4. Access Requirements. Unique authorization is required for Access and must be properly authenticated and recorded for audit purposes, including FERPA and any other applicable audit requirements. C. DPPA. The terms and conditions of this Article VI. E. apply when Covered Data includes motor vehicle record information. 1. DPPA Covered Data. For purposes of the DSA, Covered Data may include, but shall not be limited to, DPPA Covered Data. For purposes of this DSA, " DPPA Covered Data" shall mean motor vehicle information as set forth in the Driver Privacy Protection Act, 18 U. S. C. § 2721 DPPA"). 2. Disclosure of DPPA Covered Data. The disclosure of DPPA Covered Data under the DSA, as modified by this section, is governed by DPPA. DPPA prohibits the disclosure of personal information, as defined in 18 U. S. C. § 2725( 3), that is contained in motor vehicle records, but such information