2-Exhibit C-UH Cybersecurity TC Amendment - 7Jun2023.pdf
PDF 126 KB Posted
- Attached to
- On Call Solution & Schedule Management System State and local contract opportunity
- Solicitation number
- RFP-225-08-044-SVC
- Issued by
- Bexar County, Texas
About this file
This document is a Cybersecurity Standard Terms and Conditions Amendment issued by the Bexar County Hospital District, doing business as University Health. The amendment establishes comprehensive cybersecurity requirements for vendors and sellers providing products or services to the organization. The document outlines specific standards for product security, including the right of University Health to scan products for vulnerabilities, requiring sellers to comply with established security guidelines from organizations like ISO, IEC, AAMI, OWASP, and NIST.
The amendment mandates that sellers provide detailed security assurances, including warranty of FDA premarket and postmarket cybersecurity compliance, guarantees of malware-free products, provision of a Manufacturers Disclosure Statement for Medical Device Security (MDS2), and a SOC type II report with the latest risk assessment. Sellers must also commit to providing security updates throughout the product's useful life at no additional cost, avoid using offshore assets to work on buyer's data, and understand that failure to meet these terms constitutes a material breach that could result in immediate contract termination. The document was revised on 06/07/2023 and is signed by the Executive Director of Supply Chain Services for University Health.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| 1-Exhibit D- UH Hosted Cybersecurity TC Amendment - 7Jun2023.pdf | ||
| 5-Exhibit E- IT Security Questionnaire V16.docx | DOCX document | |
| 4-EXhibit B- Terms and Conditions State-County Law Amendment 5-15-24.pdf | ||
| 6-RFP-225-08-044-SVC Master Solicitation Document.pdf | ||
| 3-Exhibit A- Standard Purchase Terms and Conditions 072825.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Revised 06/07/2023 1
CYBERSECURITY STANDARD TERMS AND CONDITIONS AMENDMENT
The provisions set forth in this Amendment are being added to the Agreement to comply with the Bexar
County Hospital District d/b/a University Health (“Buyer”) in its status as the County Hospital. This
Amendment shall apply and shall supersede any provisions in the Agreement (which includes any document referenced therein or subsequent agreements or subsequent amendments) to the contrary. For purposes of this
Amendment, "Seller" shall mean any bidder, offeror, vendor, service provider or other person or entity responding to this procurement opportunity or has entered into an agreement with Buyer.
1. CYBERSECURITY:
a. Buyer reserves the right to scan Seller’s products (both software and hardware) for security vulnerabilities. Buyer, at its sole discretion, will provide a report of its finding to Seller who shall address and fix any vulnerabilities at Seller’s sole cost.
b. Seller shall comply with all reasonable security practices required by the provider that are consistent with current network and device security guidelines and best practices including those developed and implemented by the provider or as published by standards bodies such as the International
Organization for Standardization (ISO) and the International Electrotechnical Commission(IEC) (
ISO/IEC), the Association for the Advancement of Medical Instrumentation (AAMI), the Open
Web Application Security Project( OWASP), The SANS Institute, the Center for Internet Security and the National Institute of Standards and Technology (NIST). at its own cost.
c. Seller shall warrant their compliance with FDA premarket and post market guidance relative to cybersecurity risks throughout their product’s lifecycle.
d. Product shall be assessed and warranted to be free of known malicious code or other vulnerabilities at the time of delivery and/or implementation.
e. Seller will provide the expected useful life of the device or service and security updates to the software and all supporting software components should be made available for the stated useful life at no additional cost to the provider. This is to include monitoring, upgrading, and patching in a manner consistent with the provider’s protocols.
f. Buyer shall provide remote access for Seller to perform necessary maintenance and upgrades to products. Seller shall not use or create its own remote access or other alternative remote access methods to perform maintenance or upgrades to products unless authorized in writing by the
University Health’s Chief Information Officer or his designee.
g. A Manufacturers Disclosure Statement for Medical Device Security (MDS2) will be provided for any device that maintains or transmits data.
h. For hosted services or products, Seller shall provide a SOC type II report including the latest date of an externally performed Risk Assessment. NOTE: Seller shall not employ offshore assets to work on buyer’s data. Seller shall not send buyer’s data offshore.
i. Failure to abide by the above terms shall constitute a material breach that shall give the University
Health the right to terminate this Contract immediately.
Vendor Signature Date Horacio Vasquez, MHA, CMRP Date
Executive Director of Supply Chain Services
University Health
File details come from the government source that posted it. Updated .