...
12 LIMITATION AND EXCLUSION OF LIABILITY
12.1 Each Party’s liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence) or otherwise shall be limited costs incurred by the other parties as a direct result of negligence of the Party, including failure to comply with this Agreement
12.1 Each Party is responsible for the cost of remedying any non-compliance with Data Protection Laws determined the responsibility of that Party by this Arrangement. Liability under this Arrangement for each Party is limited to that which arises from a breach of Data Protection Laws.
12.3 Any liability arising from processing activity undertaken under this Arrangement shall be determined by the roles and responsibilities of each Party in line with Article 82 of GDPR.
13 TERMINATION
13.1 Without affecting any other right or remedy available to it, either Party may terminate this Agreement with immediate effect by giving written notice to the other Party:
13.1.1 if the other Party commits a material breach of this Agreement which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of ninety (90) days after being notified in writing to do so;
13.1.2 if the other Party repeatedly breaches any of the terms of this Agreement in such a manner as to reasonably justify the opinion that its conduct is inconsistent with it having the intention or ability to give effect to the terms of this Agreement;
13.1.3 if the other Party is subject to an Insolvency Event;
13.1.4 if there is a change of control of the other Party excluding any intra-group reorganisation (or similar) of such other Party; or
13.1.5 in accordance with clause 21.
13.2 If the Commissioning Contract terminates for any reason this Agreement shall terminate automatically at the same time as the effective date of termination of the Commissioning Contract without any further action required by either Party.
13.3 Each Party’s rights to terminate this Agreement set out in this clause 13 shall not affect any other right or remedy available to it including those arising under this Agreement prior to termination.
14 CONSEQUENCES OF TERMINATION
Upon termination or expiry of this Agreement:
14.1 PKB will permanently delete Patient Record data which has not been accessed by the Organisation
14.2 Return to the Organisation a copy of Patient Record data which has been accessed by the Organisation, after which it will be permanently deleted
14.3 For the absence of doubt, Patient Accounts will be retained by PKB in accordance with their role and responsibilities as a Controller termination or expiry of this Agreement shall not affect any rights, remedies, obligations or liabilities of the Parties that have accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of this Agreement which existed at or before the date of termination or expiry.
15 FORCE MAJEURE
15.1 Non-performance or delay of either Party will be excused to the extent that performance is caused by any circumstance beyond Party’s reasonable control, including strike, fire, natural disaster, governmental acts, orders or restrictions, failure of suppliers or subcontractors. In such circumstances the affected Party shall be entitled to a reasonable extension of time for performance. If the period of non-performance or delay continues for ninety (90) days, the Party not affected may terminate this Agreement immediately on written notice to the affected Party.
16 ASSIGNMENT AND OTHER DEALINGS
16.1 Neither Party may assign or otherwise transfer any of its rights or obligations under this Agreement without the prior written approval of the other Party, except as expressly permitted by clause 16.2.
16.2 A Party may, upon written notice to the other Party and subject to the prior written approval of the other Party (such approval not to be unreasonably withheld or delayed), assign or otherwise transfer this Agreement to any of its affiliates or in connection with a change of control transaction (whether by merger, consolidation, sale of equity interests, sale of all or substantially all assets, or otherwise). For clarity, where such assignment or transfer would give rise to a breach of obligations in relation to Data Protection Law or other Applicable Law or would not be expected in accordance with the common law duty of confidentiality, such grounds shall amongst other matters be considered reasonable for refusing approval to such assignment or transfer. Any assignment or other transfer in violation of this clause will be void.
16.3 This Agreement will be binding upon and inure to the benefit of the Parties hereto and their permitted successors and assigns.
17 VARIATION
17.1 No variation of this Agreement shall be effective unless it is in writing and signed by the Parties.
18 NOTICES
18.1 All notices required or permitted under this Agreement and all requests for approvals, consents and waivers must be delivered by a method providing for proof of delivery. Any notice or request will be deemed to have been given on the date of delivery. Notices and requests must be delivered to the Parties at the addresses on the first page of this Agreement until a different address has been designated by notice to the other Party.
19 SEVERANCE
19.1 If any provision of this Agreement is found to be unenforceable, such provision will be deemed to be deleted or narrowly construed to such extent as is necessary to make it enforceable and this Agreement will otherwise remain in full force and effect.
20 RELATIONSHIP OF THE PARTIES
20.1 The Parties are and will be independent contractors and neither Party has any right, power, or authority to act or create any obligation on behalf of the other Party.
21 RIGHTS AND REMEDIES
21.1 The rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.
22 WAIVER
22.1 No term or provision of this Agreement will be deemed waived and no breach will be deemed excused, unless such waiver is in writing and signed by the Party claimed to have waived.
23 COUNTERPARTS
23.1 This Agreement may be executed in counterparts (which may be exchanged by facsimile or .pdf copies), each of which will be deemed an original, but all of which together will constitute the same Agreement.
24 THIRD PARTY RIGHTS
24.1 This Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
25 FURTHER ASSURANCE
25.1 Each Party shall use reasonable endeavours to procure that any necessary third party shall, promptly execute and deliver such documents and perform such acts as may reasonably be required for the purpose of giving full effect to this Agreement.
26 COSTS
26.1 Each Party shall pay its own costs incurred in connection with the negotiation, preparation, and execution of this Agreement.
27 ENTIRE AGREEMENT
27.1 This Agreement constitutes the entire Data Processing Agreement between the Parties and supersedes and extinguishes all previous drafts, agreements, arrangements, and understandings between them, whether written or oral, relating to its subject matter.
27.2 Each Party acknowledges that in entering into this Agreement it does not rely upon, and shall have no remedies in respect of, any representation or warranty (whether made innocently or negligently) that is not set out in this Agreement. No Party shall have any claim for innocent or negligent misrepresentation based on any statement in this Agreement.
28 GOVERNING LAW AND DISPUTE RESOLUTION
28.1 Governing law
28.1.1 This Agreement and all matters arising out of or in connection with it, including any Dispute and any dispute resolution procedure provided for in this Agreement, shall be governed by, and construed in accordance with, the law of England and Wales.
28.2 Dispute resolution:
28.2.1 The Parties shall resolve any Disputes in accordance with the Commissioning Contract terms
SCHEDULES
29
...
SCHEDULE 1: DATA PROCESSING PARTICULARS
29.1 PERSONAL DATA TO BE PROCESSED
29.1.1 This Schedule describes the types of PKB Data that may be Processed under this Agreement. The Parties may agree to amend the descriptions in this clause at any time with the approval of the Parties.
29.1.2 For clarity, PKB Data Processed under this Agreement shall be subject to the data minimisation measures described in clause 8, including:
29.2 The Organisation applying data minimisation measures prior to sharing any data with PKB; and
29.3 The Parties continuing to review the data minimisation measures to ensure the minimisation of Personal Data within PKB Data as may be required by Data Protection Law.
29.3.1 PKB Data to be Processed under this Agreement may include data from the following sources:
Organisations Electronic Patient Record |
Patient Inputted Data |
Third Party Partners and Integrations (for purposes of care provision) |
29.4 The inclusion of personal data of any natural person under the age of 13 should be considered on a case by case basis.
30
...
SCHEDULE 2: PROCESSING OPERATIONS
2A PROCESSING OPERATION A
Processing Operation: Maintaining Patient Account
...
Lawful Bases for Processing:- Article 6(1)(f) and Article 9(2)(h)
...
PKB implements strong technical and organisational controls to maintain the integrity and confidentiality of this processing, including annual penetration testing, adherence to the Data Security and Protection Toolkit and a role-based training programme for all employees.
2B PROCESSING OPERATION B
Processing Operation: Service Evaluation and Improvement
...
Lawful Bases for Processing: PKB - Article 6(1)(f)
Specific Responsibilities for Parties:
...
PKB implements strong technical and organisational controls to maintain the integrity and confidentiality of this processing, including annual penetration testing, adherence to the Data Security and Protection Toolkit and a role-based training programme for all employees.
2C PROCESSING OPERATION C
Processing Operation: Maintaining Patient Record (where data originates from Organisation)
...
Description | Details |
Identity of Controller for each Category of Personal Data | Organisation is the Controller for all Personal Data categories. |
Duration of the Processing | Duration of the Data Processing Contract |
Nature and purposes of the Processing | PKB provides a software solution to allow Organisations to share patients records between themselves. PKB are considered a Processor for Organisation inputted data within the Patient Record For this personal data, PKB will only process this personal data in order to provide the service of the PKB platform. |
Type of Personal Data |
|
Categories of Data Subject | Controller’s patients Controller’s staff using PKB platform |
Plan for return and destruction of the data once the Processing is complete UNLESS requirement under Union or Member State law to preserve that type of data | At the end of the Agreement, all personal data will be destroyed or returned to the Controller, at the choice of the Controller |
Transfers of data outside the UK | There will be no transfers of personal data outside the UK |
31
...
SCHEDULE 3: SECURITY CONTROLS
31.1 SECURITY RESPONSIBILITIES
31.1.1 PKB shall maintain appropriate information security arrangements for all forms of Data held in any format and expressed or relayed in any communication (oral or written) in a manner consistent with the principles of the most current version of the NHS Data Security and Protection Toolkit (DSPT) and ISO 27002 - Code of Practice for Information Security Management (with the principles of the DSPT prevailing in case of any conflict). In particular:
31.1.2 PKB shall have management arrangements in place for the management of information security;
31.1.3 PKB shall comply with the DSPT assessment, reporting and audit requirements relevant to its organisation type; and
31.1.4 PKB shall have appropriate operational risk assessment and management processes in place for the identification, mitigation and management of operational security risks.
31.1.5 PKB shall ensure an appropriate level of protection for data at rest commensurate with the risks to rights and freedoms, including encryption to the latest available industry standard.
31.1.6 PKB shall comply with the requirements of Article 32 of GDPR and ensure that all data is held and processed according to the risk attached to the category of data processed
31.1.7 The Parties shall agree, and PKB shall have in place, an information security policy that is supported by appropriate organisational, security and technical security standards (the “Security Policy”).
31.1.8 PKB shall propose changes to the Security Policy on an on-going basis to reflect good industry practice or changes necessitated by any changes in applicable law. Material changes to the management of information relating to the Controller's business shall be agreed in writing by both parties, and the requirement for all such changes shall be promptly notified to the other party.
31.1.9 PKB shall create, design, establish, provide, implement, manage and maintain safeguards (including security architecture) that reflect the Security Policy and shall ensure that any changes to the Security Policy from time to time are reflected in the secure environment provided to Controller as soon as practicable.
31.1.10 PKB shall be equally responsible for managing information security risk should the Data, or access to the Data, be made available to any third parties or Processors (as may be permitted elsewhere). Such engagements will be preceded by a satisfactory due diligence process, contractual documentation being signed, and the establishment of monitoring, auditing and incident handling procedures so that the Data is no less secure under the third party’s management.
31.1.11 PKB shall ensure that all transfers of the Data undertaken by it or on its behalf will be in accordance with Secure File Transfer Protocols within the Health and Social Care Network (HSCN) and/or in accordance with the NHS Digital Good Practice Guidelines (which are, as of the date of this Contract, published at www.digital.nhs.uk).
31.2 SECURITY MANAGEMENT
31.2.1 PKB shall plan, determine, create, implement, manage, review and maintain security control over the technology and physical storage infrastructure, and respond appropriately to security events. This includes the implementation of secure technical infrastructures, technologies and physical controls (including firewalls, encryption, authentication services and swipe access) appropriate to the UK public health sector.
31.2.2 PKB shall implement control, technologies and procedures to limit the risk of unauthorised access to the environment used to provide the Services (the "Services Environment") appropriate to the UK health and social care sector.
31.2.3 PKB shall inform and make recommendations to the Organisation if it becomes aware of any products, methods or services that would result in required improvements to the security procedures in operation.
31.2.4 PKB shall create, acquire, provide, install, implement, manage and maintain any such improvements reasonably requested by the Organisation that reflect Good Industry Practice.
31.3 SECURITY ADMINISTRATION
31.3.1 PKB shall track, co-ordinate, implement, manage and maintain all security changes across the Services.
31.3.2 PKB shall limit the risk of unauthorised access to the Services Environment including content filtering to prevent objectionable material, virus protection, password controls and physical security. PKB shall have regard to the confidentiality and sensitivity contained within the Services Environment and shall ensure that measures applicable to the UK health and social care sector are in place to prevent unauthorised access.
31.4 SECURITY AUDIT
31.4.1 PKB shall provide to the Organisation any information that the Organisation reasonably requires for the purpose of allowing the Organisation to have assurance with PKB’s compliance with the provisions of this Clause 31 within a reasonable time from the Organisation’s request. PKB shall provide this information in such format as the Organisation may reasonably require.
31.5 NON-COMPLIANCE REPORTING
31.5.1 PKB shall monitor, on an ongoing basis, computer and network security configurations.
31.5.2 PKB shall create and issue reports to the Organisation on incidents of non-compliance with the Security Policy according to their severity within a reasonable time after such incidents occur.
31.6 SYSTEM ACCESS CONTROL
31.6.1 PKB shall administer the provision of access to the Services Environment (by both the Organisation’s Personnel and PKB's Personnel), Data and any other applicable data in accordance with Good Industry Practice.
31.6.2 PKB shall restrict access to the Services Environment to appropriately identified authenticated and authorised personnel and shall keep records of which personnel have access to the Services Environment and the reasons for such personnel being given such access. PKB shall also keep records of which personnel have accessed the Services Environment (including details of login and logout times).
31.6.3 PKB shall restrict user access to information and data held on external networks.
31.7 CRYPTOGRAPHY
...
MANAGEMENT
31.7.1 PKB shall ensure that Data is encrypted as appropriate in accordance with Good Industry Practice and the most current version of the Data Security and Protection Toolkit and ISO 27002 - Code of Practice for Information Security Management (with the principles of the Data Security and Protection Toolkit prevailing in case of any conflict).
31.7.2 PKB shall manage all processes and procedures pertaining to the administration of the encryption keys, including secure key storage, periodic changing of keys, destruction of old keys, and registration of keys with the appropriate authorities.
31.8 ASSET PROTECTION
31.8.1 PKB shall acquire, create, provide, manage and maintain mechanisms to prevent or mitigate destruction, loss, alteration, disclosure or misuse of equipment used within the Services Environment, Data and Organisations assets, having regard to Good Industry Practice. This includes annual Penetration testing and the satisfactory completion of remedial actions identified following that testing.
31.8.2 All Data shall be appropriately backed up and stored in a secure facility which in line with industry practice would be off site.
31.8.3 PKB will ensure adequate business continuity services and disaster recovery services are in place and regularly tested. Evidence of this testing may be required as part of the Organisation’s due diligence.
31.8.4 PKB shall ensure that no-one, other than properly authorised Processor Personnel, has physical access to any servers in scope under this Contract or used to deliver the Services, including any servers located at PKB's facilities without formal documented approval from the Organisation.
31.8.5 In relation to PKB’s facilities, PKB shall, at a minimum, acquire, create, provide, manage and maintain mechanisms to prevent or mitigate destruction, loss, alteration, disclosure or misuse of Data, having regard to Good Industry Practice.
31.8.6 PKB will fully and regularly assess the physical security risk for all premises and ensure reasonable controls are in place to prevent inappropriate access as would be expected for the National Health Service.
31.8.7 Implement National Cyber Security Centre (NCSC) guidelines (e.g. Cyber Essentials) as agreed with the Controller so that assets are protected.
31.9 SECURITY AWARENESS
PKB shall ensure that all its Personnel working on the Organisations account are screened and security checked to an appropriate standard, trained in the Security Policy and any other requirements of this Contract, undertake annual training and are deemed competent to undertake processing activities and are individually accountable for their actions. All PKB Personnel shall, as at the commencement of the Services, be deemed to be appropriately screened and trained to a level befitting the UK health and care sector.
31.10 DOCUMENTATION AND RECORD PRESERVATION
31.10.1 PKB shall protect all Data held by its employees, agents or Processors in a physical form by adopting a “clear desk” policy in respect of such Data and disposing of such information securely by treating it as confidential waste.
31.10.2 PKB shall ensure that any documentation or records relating to the Services being disposed of by or on behalf of PKB are treated in an appropriate manner having regard to their confidentiality including, where appropriate, being securely destroyed or shredded prior to disposal.
31.10.3 PKB will classify the security of documentation and information to limit distribution and to ensure adequate controls are in place to protect more sensitive content.
32. SCHEDULE 4: SIGNATORIES
...
Executed by:
...
Mohammad Al-Ubaydli
Director
Ian Bastow
Director
____________________________
...