LEXIS NEXIS CLAIMS SOLUTIONS INC.

Home Browse Search

EXHIBIT A - SECURITY AND NOTIFICATION REQUMNIENTS 1. Data Protection. Agency shall take appropriate measures to protect against the misuse and unauthorized access through or to Agency's (i) credentials ("Account TDs") used to access the Services; or (ii) corresponding passwords, whether by Agency of any third party; or (iii) the Services and/or information derived therefrom. Agency shall manage identification, use, and access control to all Account IDs in an appropriately secure manner and shall promptly deactivate any Account IDs when no longer needed or where access presents a securityrisk. Agency shall implement its own appropriate program for Account ID management and shall use commercially reasonable efforts to follow the policies and procedures for account maintenance as may be communicated to Agency by Provider from time to time in writing. 2. Agency's Information Security Program. Agency shall implement and document appropriate, policies and procedures covering the administrative, physical and technical safeguards in place and relevant to the access, use, storage, destruction, and controt of information which are measured against objective standards and controls ("Agency's Information Security Program"). Agency's Information Security Program shall: (t) account for known and reasonably anticipated throats and Agency shall monitor for new threats on an oagoing basis; and (2) meet or exceed industry best practices. Agency will promptly remediate any deficiencies identified in Agency's Information Security Program. Agency shall not allow the transfer of any personally identifiable information received from Provider across any national borders outside the United States without the prior written consent of Provider. 3. Agency Security Event. In the event Agency learns or has reason to believe that Account IDs, the Services, or any information related thereto have been misused, disclosed, or accessed in an unauthorized manner or by an unauthorized person (an "Agency Security Event") Agency shalt: (1) provide immediate written notice to: a) the Information Security and Compliance Organization at 1000 Alderman Drive, Alpharetta, Georgia 30005; or b) via email to (security.investigations®lexisnexis.com); or e) by phone at (1-888-872-5375) with a written notification to follow within twenty four (24) hours; and (Il) promptly investigate the situation; and (111) obtain written consent from Provider, not to be unreasonably withheld, prior to disclosing Provider or the Services to any third party in connection with the Agency Security Event; and (Iv) if required by law, or in Provider' discretion, Agency shall: a) notify the individuals wbose information was disclosed that an Agency Security Event has occurred; and b) be responsible for all legal and regulatory obligations including any associated costs which may arise in connection with the Agency Security Event; and (v) remain solely liable for all costa and claims that may arise from the Agency Security Event, including, but not limited to: litigation (including anomey'a fees); reimbursement sought by individuals (including costs for credit monitoring and other losses alleged to be in connection with such Agency Security Event); and (vi) provide all proposed third party notification materials to Provider for review and approval prior to distribution. In the event of an Agency Security Event, Provider may, in its sole discretion, take immediate action, including suspension ortermination of Agency's account, without further obligation or liability of any kind.