premise: CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT (Rev 10/20/16)
  BETWEEN _________________ AND THE KANSAS DEPARTMENT OF LABOR (KDOL) FOR ____insert name of project
  This Confidentiality and Non-Disclosure Agreement is entered into the date and year last appearing below, by and between ___________________ (hereinafter "Authorized Person") and KDOL for the purpose of allowing Authorized Person access to confidential information for the purpose of insert a description of the project_.
  Access to any confidential information is specifically conditioned upon compliance with the following:
  Use of Confidential Information
  The term “confidential information” shall include: any information or data maintained by KDOL that has been obtained pursuant to the administration of the Employment Security Law, and includes personally identifiable information (PII) maintained by KDOL such as:
  • The name of a person
  • His or her mailing address
  • His or her taxpayer identification number
  • Email addresses
  • Telephone numbers
  • Social Security Numbers
  • Bank account numbers
  • Date and place of birth
  • Mother’s maiden name
  • Biometric data (e.g., height, weight, eye color, fingerprints)
  • The name or identity of an employing unit
  • Records described in K.A.R. 50-2-2
  • Any combination of the preceding
  Officials, employees and agents of Authorized Person having access to any confidential information obtained pursuant to this agreement shall be subject to all federal and state laws, and regulations, and will comply with limitations on use, treatment, and safeguarding of data under the following laws, regulations and agreements: K.S.A. 44-714(e), and amendments thereto; the Privacy Act of 1974 (5 U.S.C. 552a), as amended by the Computer Matching and Privacy Protection Act of 1988, related Office of Management and Budget guidelines, the Federal Information Security Management Act of 2002 (44 U.S.C. § 3541, et seq.), and related National Institute of Standards and Technology guidelines; SSA’s “Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with the Social Security Administration” (TSSR v7); the US Department of Health and Human Services requirements relating to National Directory of New Hires data; and the Information Exchange Agreement between the Social Security Administration and the State of Kansas Department of Labor. For any tax return data, officials, employees and agents of Authorized Person will also comply with the “Tax Information Security Guidelines for Federal, State and Local Agencies,” Publication 1075, published by the Secretary of the Treasury. All of which said laws, regulations and agreements involve the requirement to maintain confidentiality of any information, reports, returns and other documentation obtained pursuant to this agreement.
  Officials, employees and agents of Authorized Person will provide to KDOL a current list upon request of the officials, employees and agents of Authorized Person who have access to confidential information disclosed under this agreement. The list shall include each person’s full name, date of birth, social security number and states of residence of each individual.
  This agreement does not grant or authorize the Authorized Person to have unescorted direct access to KDOL systems. Additionally, execution of this agreement alone does not fulfill all requirements to permit Authorized Person access to confidential information. Additional requirements must also be satisfied, including but not limited to the requirements found in Section 5.11 of the SSA TSSR v.7; requirements of the Information Exchange Agreement between the Social Security Administration and the State of Kansas Department of Labor; and the terms and conditions set forth in the Computer Matching and Privacy Protection Act Agreement (“CMPPA Agreement”) between SSA and the State of Kansas, governing the State Agency’s use of the data disclosed from SSA’s Privacy Act System of Records.
  Confidential information provided hereunder, or identifiable information derived therefrom, shall not be disclosed to any individual(s) that is/are not subject to this agreement. Information provided hereunder, or identifiable information derived therefrom, shall not be copied, downloaded or otherwise placed in any format, including working papers, which may become a public record pursuant to the Kansas Open Records Act (KORA). Authorized Person agrees that they will not provide or allow access of the information obtained hereunder to any agent, third party, contractor, subcontractor, or any other public agency, unless authorized in writing by KDOL, and then conditioned upon said agent, third party, contractor, subcontractor, or any other public agency agreeing in writing to be bound by the use and confidentiality terms and conditions of this Confidentiality Agreement. A copy of any such agreement shall be available for inspection upon request by the KDOL and will not be subject to disclosure to third parties by anyone other than KDOL.
  Authorized Person agrees that any confidential information or reports generated from such confidential information shall be in aggregate form, and shall not in any way contain personally identifiable information or information which alone, or in combination with other information, is linked, or is linkable, to a specific individual, and which would thereby allow a reasonable person in the community, who does not have personal knowledge of the relevant circumstances, to identify the individual with reasonable certainty. Additionally, Authorized Person agrees that the Authorized Person will use confidential information or reports generated from such confidential information only for the purpose stated in the first paragraph of this agreement.
  Any information maintained by KDOL that has been obtained pursuant to the administration of the Employment Security Law, shall be held confidential and shall not be published or be open to public inspection, other than to public employees in the performance of their public duties, in any manner revealing an individual’s or employing unit’s identity.
  Authorized Person agrees to comply with all data storage requirements in IRS Publication 1075 for all information systems used for receiving, processing, storing, or transmitting confidential information obtained pursuant to this agreement.
  Both parties shall exercise reasonable and prudent security procedures to protect such information, reports, returns and other documentation in their possession, including electronic versions thereof, from any unauthorized access and/or disclosure. Access to the information covered by this agreement shall be limited to the minimum number of individuals necessary to achieve the stated purpose of the agreement.
  Notwithstanding any provisions of this agreement, any breach of the confidentiality or non-disclosure provisions above shall be grounds for immediate termination of this agreement without notice, and legal action may be immediately commenced.
  Disposal of Confidential Information
  Once confidential information or data obtained hereunder is no longer useful for the purposes described herein, Authorized Person agrees to immediately destroy all such confidential information or data maintained on any information system platform or any form of storage media subject to any schedule of retention established by the Kansas Records Board, in the following manner:
  Confidential information obtained pursuant to this agreement, and any paper material generated therefrom, such as copies, photo impressions, computer printouts, notes, and work papers, must be destroyed by burning or shredding. Printed material to be burned must be burned in an incinerator that produces enough heat to burn the entire bundle, or the bundle must be separated to ensure that all pages are incinerated. Printed material to be shredded must be shredded in the following manner: The paper must be inserted so that lines of print are perpendicular to the cutting line; The paper must be shredded to effect 5/16-inch-wide or smaller strips. Consideration should be given to the use of cross-cut shredders; If shredding deviates from the 5/16-inch specification, Confidential information must be safeguarded until it reaches the stage where it is rendered unreadable through additional means, such as burning or pulping.
  Confidential information obtained pursuant to this agreement that is stored in electronic format must be destroyed in the following manner: Electronic media (e.g., hard drives, tapes, CDs, and flash media) must be destroyed according to IRS Publication 1075 guidance in Section 9.3.10.6, Media Sanitization (MP-6), and Section 9.4.7, Media Sanitization. Electronic media containing confidential information must not be made available for reuse by other offices or released for destruction without first being subjected to electromagnetic erasing. If reuse is not intended, the tape must be destroyed by cutting into lengths of 18 inches or less or by burning to effect complete incineration.
  Microfilm and microfiche must be shredded to effect 1/35-inch by 3/8-inch strips.
  Authorized Person agrees to permit KDOL to audit and inspect all Authorized Person’s compliance with these requirements.
  Modification of Agreement
  No modification to this agreement shall be effective unless reduced to writing and signed by the parties hereto.
  AUTHORIZED PERSON KANSAS DEPARTMENT OF LABOR
  By: ______________________ By: ________________________
  Print name Print Name
  Signature: ______________________ Signature: ________________________
  Date: _______________ Date: _______________
  