Page 14

14 | P a g e

individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Grantee. Definitions: Personally Identifiable Information (PII) - information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Protected Health Information (PHI) - any information about health status, provision of healthcare or payment for healthcare. 2.4.2 DATA SECURITY INTERNAL AUDIT No less than annually, Grantee must conduct a comprehensive independent third-party audit of its data privacy and information security program and provide such audit findings to the State. 2.4.3 DATA SECURITY AUDIT BY STATE/MPSC Without limiting any other audit rights of the State, the State has the right to review Grantee’s data privacy and information security program prior to the commencement of grant activities and from time to time during the term of the Grant Agreement. During the grant term and without notice, the State at its own expense, is entitled to perform, or to have performed, an on-site audit of Grantee’s data privacy and information security program. In lieu of an on-site audit, upon request by the State, Grantee agrees to complete, within 45 calendar days of receipt, an audit questionnaire provided by the State regarding Grantee’s data privacy and information security program. 2.4.4 TERMINATION DUE TO DATA SECURITY DEFICIENCIES The Grantee must implement any required safeguards as identified by the State or by any audit of Grantee’s data privacy and information security program. The State reserves the right, at its sole election, to immediately terminate the Grant Agreement or a Statement of Work without limitation and without liability if the State determines that Grantee fails or has failed to meet its obligations. 2.4.5 EMPLOYEE BACKGROUND CHECKS The Grantee must perform background checks on all employees and subcontractors and its employees prior to their assignment. The Michigan State Police provides the Internet Criminal History Access Tool, or ICHAT, which allows you to instantaneously access the criminal history records of individuals who have been convicted of a crime in Michigan, as well as for individuals who have pending criminal cases. ICHAT is an easy way to access this information, and the fee is waived for government agencies screening employees and volunteers.