Page 13

13 | P a g e

or hazards to the security or integrity of the State Data; (c) protect against unauthorized disclosure, access to, or use of the State Data; (d) ensure the proper disposal of State Data; and (e) ensure that all employees, agents, and subcontractors of Grantee, if any, comply with all of the foregoing. In no case will the safeguards of Grantee’s data privacy and information security program be less stringent than the safeguards used by the State, and Grantee must at all times comply with all applicable State IT policies and standards, which are available to Grantee upon request. 2.4.1 DATA BREACH/LOSS OF DATA In the event of any act, error or omission, negligence, misconduct, or breach that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Grantee that relate to the protection of the security, confidentiality, or integrity of State Data, Grantee must: 1) Notify the State (Michigan Public Service Commission) as soon as practical but no later than 24 hours of becoming aware of such occurrence. 2) Cooperate with the State (MPSC and DHHS) in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State. 3) In the case of PII or PHI, at the State’s sole election, a. Notify the affected individuals as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within five (5) calendar days of the occurrence. b. Notify non-affected individuals and households of the data breach. c. Reimburse the State for any costs in notifying the affected individuals. 4) In the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than 24 months following the date of notification to such individuals. 5) Perform or take any other actions required to comply with applicable law as a result of the occurrence. 6) Without limiting Grantee’s obligations of indemnification as further described in the Grant Agreement, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence. 7) Be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State. 8) Provide to the State a detailed plan within 10 calendar days of the occurrence describing the measures Grantee will undertake to prevent a future occurrence. a. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, and contain, at a minimum: name and contact information of Grantee’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Grantee has taken to protect the affected