6-A04 ISPA 07.pdf

This Certification being submitted in lieu of a completed ISPA.

Respectfully submitted

(Name of Proposer Authorized Representative)

UTHSA prefers Proposers to submit a completed Service Organization Control (SOC) 2, Type II audit with their proposal. If Proposer does not have a completed SOC 2, Type II, then Proposer will be required to complete and submit APPENDIX FOUR, Information Security Initial Security Posture Assessment (ISPA). The SOC 2, Type II or APPENDIX FOUR will establish specifications, representations, warranties, and agreements related to the EIR that Proposer is offering to provide to University. Responses to APPENDIX FOUR will be incorporated into the Agreement and will be binding on Contractor.

has an active SOC 2, Type II Certification (Name of Proposer)

APPENDIX FOUR

Information Security Initial Security Posture Assessment

(ISPA)

Systems WITH Sensitive Information

(Authorized Signature)

** NOTICE TO VENDORS **

(Email address of Authorized Representative) (Date Signed)

11.20.2024

Information Security Initial Security Posture Assessment

1. Provider legal name

2. Number of employees, at ALL locations, in Provider's Workforce "Workforce" includes all employees, volunteers, trainees, and other persons whose conduct is under the direct control of Provider, whether or not they are paid by Provider. If Provider is a sole proprietor, the workforce may be only one employee

Total Size of Workforce

3. Number of Subcontractors.

This is the number of subcontractors, NOT the size of the subcontractor's workforces. If no subcontractors will be used, enter "0"

City State

Zip Code Telephone Number

Email Address of Point of Contact

Corporate Name

Street Address

Company Website

Total Subcontractors e-mail: BUSCONTRACTS@uthscsa.edu

This initial assessment is intended to evaluate a potential vendor’s or contractor’s (Provider’s) readiness to perform services for and/or provide products to UT Health San Antonio (University), while protecting the security and privacy of any University information, sensitive or non-sensitive. For the purposes of this assessment, “University-sensitive information” includes, protected health information, student information, personally-identifiable information, Social Security numbers, credit card information, and sensitive research. Activity and actions related to University information includes access, storage, process, and transmission. Data must be protected to appropriate standards based on sensitivity while at rest, during processing, and in motion.

This assessment is for systems that handle sensitive University data.

Any “No” responses in Sections B and C must be corrected prior the final bid date to be considered for award.

For additional information regarding this assessment, e-mail GRC@uthscsa.edu.

Section A: PROVIDER INFORMATION (To be completed by Provider)

Street Address

City State

Zip Code Telephone Number

Name of Security Official

Street Address

Name of Privacy Official

Is the Privacy and Security Official the same person?

(Yes or No)

Telephone Number

City State

Zip Code Telephone Number

210-562-6203

Purchasing Department

5. Health Science Center Contact Information

Requesting Department

Point of Contact (POC) Name

POC Email Address

POC Telephone Number

Department Name

Requesting Department

4. Name of Provider's Information Technology Security and Privacy Officials Security and Privacy Official may be the same person. If so, Answer "Yes". If not -provide requested information

Email Address of Privacy Official

Contract Manager Senior Manager Sourcing &

Contracts Teresa Crum Arguello

Email Address BUSCONTRACTS@uthscsa.edu

Email Address of Security Official

SECURITY OFFICIAL

PRIVACY OFFICIAL

mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu mailto:BUSCONTRACTS@uthscsa.edu

Name of Insurance Company:

Point of Contact Name: __

Telephone Number: _ Email Address: _____

If "Yes" ~ provide proof of insurance or a contact to your Insurance Provider

b. Will Provider obtain written approval from a University Agency BEFORE entering into any agreement(s) with Subcontractors to handle University-Sensitive Information on behalf of the Provider? (Yes or No)

10. Does Provider have any Optional Insurance currently in place?

Optional Insurance can include coverages for ~ network security; privacy; data breach; loss of data; loss of use or delay/suspension in business; denial of service with e-Business, the Internet, networks, and information assets; loss of intellectual property; virus transmission; extortion; sabotage; multimedia and media liability;

crime/theft; advertising injury and personal injury liability; crisis management and notification expense coverage; and/or errors and omissions.

9. Subcontractors - If the Provider responded "0" to Question #3 (indicating no subcontracts), select "N/A" for BOTH a. and b. below

a. Will Provider require Subcontractors to execute the appropriate data use agreement

b. Does Provider have a Privacy Notice prominently displayed on a web page or a Public Office of Provider's business open to or that service the public?

(This is a HIPAA requirement)

8. HIPAA Business Associate Agreement - Answer Yes or No to each question

7. Number of individual Provider reasonable expects to handle University-Sensitive Information during a one-year period:

This number should include FULL-TIME , PART-TIME, Contractors, Vendors, etc.

a. 499 or Less

b. 500 to 999

c. 1,000 - 9,999

d. 10,000 - 99,999

e. 100,000 or More

a. Workstations - Number of desktops, laptops, tablets, and storage devices, including mobile devices.

b. Servers - Number of servers outside a data center and NOT being used for cloud services.

6. Number of storage devices to be used for University-Sensitive Information Cloud Services - Involve using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server, personal computer, or data center.

Data Center - is a centralized repository, either physical OR virtual, for the storage, management, and dissemination of data and information, organized around a particular body of knowledge to a particular business.

Total Number of Systems

( Sum A through D )

c. Cloud Services - Number of cloud services in use.

d. Data Centers - Number of data centers in use.

a. Will Provider use, disclose, create, receive, transmit, or maintain protected health information on behalf of a University department for HIPAA-covered function?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

c. Does Provider have a current written Privacy and Security Policies and Procedures that limit use OR disclosure of University-Sensitive Information to the minimum necessary to fulfill authorized purposes?

b. Does Provider have a current written Privacy and Security Policies and Procedures that required Provider and its workforce to comply with the appliable provisions of HIPAA and other laws described in the Data Use Agreement ~ relating to creation, receipt, maintenance, use, disclosure, access or transmission of University-Sensitive Information on behalf of a University Agency?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

1. Written Policies & Procedures. Does Provider have a current written privacy and security policies and procedures that, at a minimum:

a. Does Provider have a current written privacy and security policies and procedures that identify authorized users and authorized purpose relating to creation, receipt, maintenance, use, disclosure, access, or transmission of University-Sensitive Information?

Section B: PRIVACY RISK ANALYSIS & ASSESSMENT To be completed by Provider - Answer Yes or No to each question

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

Compliance Date

f. Does Provider have a current written Privacy and Security Policies and Procedures that permit or deny individual rights of access, and, when appropriate, amend or correct those rights?

e. Does Provider have a current written Privacy and Security Policies and Procedures that initial and annual workforce training is performed, and training deficiencies are monitored for and corrected?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

d. Does Provider have a current Written Privacy and Security Policies and Procedures that respond to an actual and/or suspected breach of University Sensitive Information ~ to include ( at a minimum ) if any response is "NO" then answer to entire question is "NO":

i. Immediate breach notification to the University Agency, Regulatory Authorities, and other required individuals and/or authorities, in accordance with Data Use Agreement;

ii. Following a documented breach response plan, in accordance with the Data Use Agreement and Applicable Law; and

iii. Notifying individuals and reporting authorities whose University Sensitive Information has been breached, as directed by the University Agency?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

Compliance Date

i. Does Provider have a current written Privacy and Security Policies and Procedures that requires updates to policies, procedures, and plans following major changes with use and/or disclosure of University Sensitive Information with 60 Days of identification of a need for update?

h. Does Provider have a current written Privacy and Security Policies and Procedures that establish, implement and maintain proof of appropriate sanctions against any Workforce or Subcontractor members who fail to comply with an authorized purpose OR who is NOT an Authorized User, and used or disclosed University-Sensitive Information in violation of the Data Use Agreement, the Base Contract and/or Applicable Law?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

g. Does Provider have a current written Privacy and Security Policies and Procedures that permit ONLY Authorized Users with up-to-date privacy AND security training, and with a reasonable and demonstrable need to use, disclose, create, receive, maintain, access or transmit University Sensitive Information, to carry out an obligation under the Data Use Agreement for an authorized purpose, unless otherwise approved IN WRITING by a University Agency?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission)

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

Compliance Date

l. Does Provider have a current written Privacy and Security Policies and Procedures that require cooperation with University Agencies' and/or Federal Regulatory Inspections, Audits and/or Investigations related to compliance with the Data Use Agreement or Applicable Laws?

k. Does Provider have a current written Privacy and Security Policies and Procedures that prohibit offshoring, or the use, disclosure, creation, maintenance and/or transmission of University Sensitive Information OUTSIDE of the United States of America, WITHOUT express WRITTEN PERMISSION from the University Agency

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

j. Does Provider have a current written Privacy and Security Policies and Procedures that restricts permissions and/or attempts to re-identify or further identify De-Identified University Sensitive Information, or attempt to contact ANY individuals whose records are contained in the University Sensitive Information, expect for an Authorized Purpose, without express WRITTEN AUTHORIZATION from a University Agency and/or as expressly permitted by the Base Contract?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission)

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

Compliance Date

2. Does Provider have a current Workforce Training Program?

Training of Workforce MUST occur at least once every year, and within 30 days of date of hiring a new Workforce member who will handle University Sensitive Information. Training MUST include:

(1) Privacy and Security Policies, Procedures, Plans and Appliable Requirements for handling University Sensitive Information;

(2) A requirement to complete training BEFORE access is given to University Sensitive Information, and;

(3) Written proof of training and a procedure for monitoring timely completion of training.

n. Does Provider have a current written Privacy and Security Policies and Procedures that prohibit disclosure of Provider's work product done on behalf of the University ~ pursuant to the Data Use Agreement, or to publish University Sensitive Information WITHOUT express PRIOR APPROVAL of the University Agency?

If "YES" ~ provide a link to the Policies & Procedures (or submit a copy with your submission) Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

m. Does Provider have a current written Privacy and Security Policies and Procedures that require appropriate standards and methods to destroy and/or dispose of University Sensitive Information?

5. Does Provider and ALL Subcontracts (if applicable) report changes to the Authorized Users List to the University Information Security Office wit 48 Hours?

If "NO" ~ describe the rational for NOT doing so

4. Does Provider and ALL Subcontracts (if applicable) maintain a current list of Authorized Users who have access to University Sensitive Information, whether oral, written of electronic?

If "YES" ~ provide a link to the Representative Samples (or submit a copy with your submission).

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

If "YES" ~ provide a link to the Representative Samples IF a copy of your AICPA SOC 2 (Type 1 and 2) is available submit copies with your submission or provide link

3. Does Provider have Privacy Safeguards to protect University Sensitive Information in oral, paper, and/or electronic form?

"Privacy Safeguard" means protection of University Sensitive Information by establishing, implementing, and maintaining required Administrative, Physical and Technical Policies, Procedures, Processes and Controls, required by the Data Use Agreement; HIPAA (45 CFR 164.530); Social Security Administration;

Medicaid; and Laws, Rules or Regulations, as applicable.

"Administrative Safeguards" include ~ Administrative Protections, Policies and Procedures for matters such as Training, Provision of Access, Termination, and Review of Safeguards, Incident Management, Disaster Recovery Plan, and Contract Provisions.

"Technical Safeguards" include ~ Technical Protections, Policies and Procedures - such as Passwords, Logging, Emergencies, how paper is faxed and/or mailed, Electronic protections such as Encryption of Data.

"Physical Safeguards" include ~ Physical Protections, Policies and Procedures - such as Locks, Keys, Physical Access, Physical Storage and Trash.

4. Does Provider utilize an IT Security-Knowledgeable person and/or company to maintain or oversee the configurations of Provider's computing systems and devices?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

A. If no report is available, WHEN will the next assessment be performed?

3. Does Provider ensure there are NO offshore (Outside of the United States) services that access, create, disclose, receive, transmit and/or maintain University Sensitive Information?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

1. Provide a diagram showing interconnectivity of proposed products and/or services, including designating Provider-Owned and University-Provided EIR.

A. Include any and ALL third-party service providers the Provider intends to use in conjunction with this contract.

B. Identify whether ANY links are encrypted and - is so, what product(s) and/or service(s) is being/to be used.

C. If possible, identify by manufacturer, model, serial number, and operating system (ALL systems to be used by the Provider for this contract. If specific systems cannot be identified, list system by type, use, and operating system(s).

2. If the Provider will be employing one (1) or more Data Centers OR Cloud Services (Section A, #6), provide a copy of the MOST recent Third-Party Risk Assessment (AICPA SOC 2) report available.

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Section C: PRIVACY RISK ANALYSIS & ASSESSMENT (To be completed by Provider)

This section is about your Electronic Systems. If your business does NOT store, access, or transmits University Sensitive Information in Electronic Systems (i.e., Laptops, Desktops, Other Workstations, Mobile Devices, Database, Servers, etc.) , enter "N/A" for questions in this section

Electronic Systems

6. Does Provider and ALL Subcontracts (if applicable) monitor for AND remove terminated employees (or those no longer authorized) to handle University Sensitive Information from the list of Authorized Users?

8. Does Provider have a system for changing default passwords, requiring user password changes at least every 90 days, and prohibiting the creation of weak passwords for ALL computer systems that access and/or store University Sensitive Information (i.e., require a minimum of eight (8) characters with a combination of upper and lowercase, special characters, and numerals where possible)?

9. Does Provider lock the account after a certain number of failed login attempts and AFTER 15 minutes of user inactivity in ALL computing devices that access and/or store University Sensitive Information?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

7. Does each member of Provider's Workforce - who will use, disclose, create, receive, transmit and/or maintain University Sensitive Information have a unique user name (Account) and private password?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

6. Does Provider monitor and manage access to University Sensitive Information (i.e., Access is limited to Authorized Users, Formal Processes exists for granting access AND validating need for remote access to Authorized Users - a Formal Process exists to validate the need of an Authorized User's Remote Access to University Sensitive Information)?

Provide Description Below (If you need additional room, please submit with your submission)

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

5. Describe Providers' Identity and Access Management Procedures, including but not limited to

A. Accounts Management B. Role-Based Access Management C. Termination Procedures

If "YES" list or describe technologies and/or products used.

12. Does Provider secure physical access to computer, paper, and/or other systems containing University Sensitive Information from unauthorized personnel and/or theft (i.e., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.)?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

13. Does Provider use encryption products to protect University Sensitive Information that is transmitted over a public network (i.e., the Internet, Wi-Fi, etc.) or that is stored on a computer system that is physically and/or electronically accessible to the public?

11. Does Provider implement computer security configurations and/or setting for ALL computers and systems that access and/or store University Sensitive Information (i.e., Nonessential features and/or services have been removed and/or disabled to reduce the threat of a breach and to limit exploitation opportunities or hackers and/or intruders, etc.)?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

10. Does Provider secure, manage and encrypt remote access to computer systems containing University Sensitive Information - including wireless access, (i.e., access is limited to Authorized Users, a form process exists for granting access to Authorized Users, a formal process exists to validate the need of an Authorized User's remote access to University Sensitive Information, etc.)?

Compliance Date

17. Does Provider prohibit the storage and/or creation of University Sensitive Information on free and/or public Cloud Services and/or Social Media Sites - unless there is a University-Approved Subcontractor Agreement; including an encryption-at-rest requirement with the services and/or site?

If "YES" ~ AND University Sensitive Information IS stored with an approved Subcontractor, provide a link to a copy of the Subcontractor Agreement (or submit a copy with your submission).

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

If "YES" ~ provide a link to a representative sample of a screen shot and/or a system report (submit a copy with your submission).

15. Is Provider willing to perform and/or submit to a Criminal Background check of Authorized Users?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

16. Does Provider store University Sensitive Information on encrypted end-user electronic devices (i.e., laptops, USB and/or other flash media, tablets, smartphones, external hard drives, desktops, etc.) and can Provider produce evidence of the encryption?

If "YES" ~ provide a link to those Rules and Responsibilities (or submit a copy with your submission).

Link:

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

14. Does Provider require Workforce member to formally acknowledge rules outlining their responsibilities for protecting University Sensitive Information and/or associated systems containing University Sensitive Information BEFORE their access is provided?

If "YES", describe/list the types of logs collected and the techniques and/or products used for review.

Also, reference the review period

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

Describe procedures below

21. Does the Provider review system security logs on computing systems that access and/or store University Sensitive Information for abnormal activity and/or security concerns on a regular basis?

20. Backup Procedures

A. Describe backup plans, including the backup process, schedule, storage, transportation, and recovery B. Are backups encrypted?

19. Do Provider's computing systems that use, disclose, access, create, transmit, maintain and/or store University Sensitive Information contain up-to-date anti-malware protection?

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

If "YES", describe/list the anti-malware products being used

If "YES" ~ describe the techniques and/ enterprise product used for update/patch management (or submit a copy with your submission).

If "NO" ~ describe the action plan to meet compliance (or submit a copy with your submission)

Compliance Date

18. Does Provider keep current on security updates/patches (including firmware, software and applications) for computing systems that use, disclose, access, create, transmit, maintain and/or store University Sensitive Information?

24. Vulnerability Scanning

A. Provide results of most recent external AND internal vulnerability scans, both of systems and web portals.

B. Provide results of MOST recent penetration test(s).

C. Will Provider agree to an external vulnerability scan by the University?

If "NO" ~ describe the Action Plan to meet compliance (or submit a copy with your submission)

Compliance Date

23. Notwithstanding records retention requirements - do Provider's disposal process for University Sensitive Information ensure that University Sensitive Information is destroyed so that it is unreadable and/or undecipherable, and CANNOT be returned to a useable state?

If "YES" ~ describe the techniques and/or processes used for destruction of hardcopies of University Sensitive Information, as well as any form of media used to store University Sensitive Information.

(Media includes, but not limited to, hard disks drives, solid state drivers, flash media - in ANY form, and tapes.

Compliance Date

If "NO" ~ describe ANY compensating controls used to reduce loss and/or corruption of data.

(or submit a copy with your submission)

22. Does Provider implement Integrity Controls in ALL systems accessing, storing, processing and/or transmitting University Data?

Integrity Controls include - but not limited to - Access Logs, Network Traffic Logs, Systems Logs, File Change (AKA Tripwire) Reports, etc.

If "YES" ~ provide a link to a representative sample of EACH type of report (or submit a copy with you submission)

Provide description here (or submit a copy with your submission)

If "YES", detail the Third-Party services and product and provide a representative sample of the report

27. Describe Provider's Incident/Breach response and reporting process:

A. Describe the Internal Detection process.

B. Describe how potentially compromised system(s) are isolated.

C. In the event of a breach of (ANY) Sensitive Information, describe how Provider will notify University personnel and/or other affected institutions.

D. Provide timetables for ALL aspects of the breach response and reporting process.

If "NO", detail the compensating control(s) in use instead of monitoring

26. Does Provider employ ANY Third-Party incident/breach monitoring services?

25. Does Provider use an Internal Incident/Breach Monitoring product (IDS/IPS, SITEM, etc.)?

If "YES", detail the product and provide a representative sample of the monitoring

Alpha No. Yes No A

B

C

D

30. Are there ANY additional considerations the Provider would like to be taken into account regarding their Information Security program not already covered in this assessment?

If "YES" attach those consideration as a narrative to this assessment.

TO BE COMPLETED BY UNIVERSITY PERSONNEL

29. Have any regulatory and/or legal actions been taken against Provider regarding Security and/or Policy Violations, Incident, and/or Breaches in the last FIVE (5) Years?

If "YES" provide description the actions and their outcomes

28. Describe Provider's perimeter defense system, INCLUDING - but not limited to:

A. Firewall

B. IDS/IPS

C. VPN

D. Border Routers

Provide description here (or submit a copy with your submission)

Provider service to be performed (Select ALL that apply):

Item PHI On Externally Hosted Service

Application and/or Service Accessed by Mobile Device

Persistent Network Connection to PHI ON University Servers

None of the Above

Date Returned to University:

Received By: (Information Security)

(Purchasing)

INSTRUCTIONS FOR COMPLETING THE INITIAL SECURITY POSTURE ASSESSMENT (ISPA)

Below are instructions for prospective Providers to the UT Health San Antonio requiring the ISPA, or for the renewal of existing contracts. Instruction item numbers below correspond to sections on the ISPA form.

If you are a bidder for a new procurement/contract, in order to participate in the bidding process, you must have corrected any "No" responses in sections B and C prior to the contract award date. If you are an applicant for an open enrollment, you must have corrected any "No" answers in Sections B and C below prior to performing any work on behalf of any University agency.

For existing contracts or renewals with "No" responses, there must be an action plan for remediation of Section B and C within 30 days for HIPAA related contracts and 90 days for others.

SECTION A. APPLICANT /BIDDER INFORMATION

Item #1. Entity or Provider Legal Name. Provide the legal name of the business (the name used for legal purposes, such as filing a Federal or State tax form on behalf of the business, and is not a trade or assumed named "dba"), the address of the corporate or main branch of the business, the telephone number where the business can be contacted regarding questions related to the information on this form and the website of the business, if a website exists.

Item #2. Number of Employees, at all locations, in Provider’s workforce. Provide the total number of individuals, including volunteers, subcontractors, trainees, and other persons who work for the business. If you are the only employee, please answer "1."

Item #3. Number of Subcontractors. Provide the total number of subcontractors working for the business. If you have none, please answer "0" (zero).

Item #4. Name of Information Technology Security Official and Name of Privacy Official for Provider. As with all other fields on the ISPA, this is a required field. This may be the same person and the owner of the business if such person has the security and privacy knowledge that is required to implement the requirements of the data use agreement and respond to questions related to the ISPA. In 4.A provide the name, address, telephone number, and email address of the person whom you have designated to answer any security questions found in Section C, and in 4.B. provide this information for the person whom you have designated as the person to answer any privacy questions found in Section B. The business may contract out for this expertise; however, designated individual(s) must have knowledge of the business's devices, systems, and methods for use, disclosure, creation, receipt, transmission, and maintenance of sensitive information and be willing to be the point of contact for privacy and security questions.

Item #5. University Agency Information.

Item 5a. Purchasing Department. The information for the Purchasing Contract Manager’s name, email, and phone number is provided.

Item 5b. Requesting Department. Provide the details of the University Agency Requesting Department if known.

i. Name of Requesting Dept. Provide the University Agency Requesting Department responsible for the Purchase Order or Contract.

ii. Point of Contact (POC) of Requesting Dept. Provide the University Agency Requesting Department’s point of contact.

iii. POC Email Address. Provide the point of contact email address.

iv POC Telephone # Provide the point of contact telephone number

Item #6. Number of storage devices for sensitive information. The total number of devices calculated from the fields in lines a - d.

Item 6a. Workstations. Provide the number of computers, devices, and drives (including mobile devices, laptops, USB drives, and external drives) on which your business stores or will store sensitive information.

Item 6b. Servers. Provide the number of servers not housed in a data center or "in the cloud," on which sensitive data is stored or will be stored. A server is a dedicated computer that provides data or services to other computers.

It may provide services or data to systems on a local area network (LAN) or a wide area network (WAN) over the Internet. If none, answer "0" (zero).

Item 6c. Cloud Services. Provide the number of cloud services to which sensitive information is stored. Cloud Services involve using a network of remote servers hosted on the Internet to store, manage, and process data, rather than on a local server or an individual computer. If none, answer "0" (zero.)

Item 6d. Data Centers. Provide the number of data centers in which you store sensitive information. A Data Center is a centralized repository, either physical or virtual, for the storage, management, and dissemination of data and information organized around a particular body of knowledge or pertaining to a particular business. If none, answer "0" (zero)

Item #7. Number of individuals for whom Provider reasonably expects to handle sensitive information during one year. Select the option that corresponds with the number of personnel for whom you expect to handle sensitive information during a year. Only count personnel once, no matter how many direct services the client receives during a year.

Item #8. HIPAA Business Associate Agreement.

Item #8a. Answer "yes" if your business will use, disclose, create, receive, transmit, or store information relating to a client/consumer's healthcare on behalf of the University for treatment, payment, or operation of Medicaid or Medicaid clients. If your contract does not include HIPAA covered information, respond "no."

Item #8b. Answer "yes" if your business has a notice of privacy practices (a document that explains how you protect and use a client/consumer's healthcare information) displayed either on a website (if one exists for your business) or in your place of business (if that location is open to clients/consumers or the public). If your contract does not include HIPAA covered information, respond "N/A."

Item #9. Subcontractors. If your business responded "0" to question 3 (number of subcontractors), Answer "N/A" to Items 9a and 9b to indicate not applicable.

Item #9b. Answer "yes" if your business obtains University approval before permitting subcontractors to handle sensitive information on your business's behalf.

Item #10. Optional Insurance. Answer "yes" if applicant has optional insurance in place to provide coverage for a Breach or any other situations listed in this question. If you do not have this optional coverage, answer "no."

SECTION B. PRIVACY RISK ANALYSIS AND ASSESSMENT

Reasonable and appropriate written Privacy and Security policies and procedures are required, even for sole proprietors who are the only employee, to demonstrate how your business will safeguard sensitive information and respond in the event of a Breach of sensitive information. To ensure that your business is prepared, all of the items below must be addressed in your written Privacy and Security policies and procedures.

For any question Section B or Section C question that is answered "no", an explanation of how compliance will be corrected and a date when compliance will be complete in the designated areas below the question.

Item #1. Answer "yes" if you have written policies in place for each of the areas (a-o).

Item #1a. Answer "yes" if your business has written policies and procedures that identify everyone, including subcontractors, who are authorized to use sensitive information. The policies and procedures should also identify the reason these Authorized Users need to access the sensitive information and this reason must align with the Authorized Purpose described in the Scope of Work or description of services in the Base Contract with the University agency.

Item #1b. Answer "yes" if your business has written policies and procedures that require your employees (including yourself), your volunteers, your trainees, and any other persons whose work you direct, to comply with the requirements of HIPAA, if applicable, and other confidentiality laws as they relate to your handling of sensitive information. Refer to the laws and rules that apply, including those referenced in the DUA and Scope of Work or description of services in the Base Contract.

Item #1c. Answer "yes" if your business has written policies and procedures that limit the sensitive information you disclose to the minimum necessary for your workforce and subcontractors (if applicable) to perform the obligations described in the Scope of Work or service description in the Base Contract. (e.g., if a client/consumer's Social Security Number is not required for a workforce member to perform the obligations described in the Scope of Work or service description in the Base Contract, then the Social Security Number will not be given to them.) If you are the only employee for your business, policies and procedures must not include a request for, or use of, sensitive information that is not required for performance of the services.

Item #1d. Answer "yes" if your business has written policies and procedures that explain how your business would respond to an actual or a suspected breach of sensitive information. The written policies and procedures, at a minimum, must include the three items below. If any response to the three items below are no, answer "no."

Item #1di. Answer "yes" if your business has written policies and procedures that require your business to immediately notify University, the University Agency, regulatory authorities, or other required Individuals or Authorities of a Breach as described in Article 4, Section 4 of the DUA.

Refer to Article 4, Section 4.01:

Initial Notice of Breach must be provided in accordance with University and DUA requirements with as much information as possible about the Event/Breach and a name and contact who will serve as the single point of contact with University both on and off business hours. Time frames related to Initial Notice include:

- within one hour of Discovery of an Event or Breach of Federal Tax Information, Social Security Administration Data, or Medicaid Client Information

- within 24 hours of all other types of sensitive information

- 48-hour Formal Notice must be provided no later than 48 hours after Discovery for protected health information, sensitive personal information or other non-public information and must include applicable information as referenced in Section 4.01 (C) 2. of the DUA.

Item #1dii. Answer yes, if your business has written policies and procedures require you to have and follow a written breach response plan as described in Article 4 Section 4 02 of the DUA

Item #1e. Answer "yes", if your business has written policies and procedures requiring annual training of your entire workforce on matters related to confidentiality, privacy, and security, stressing the importance of promptly reporting any Event or Breach, outlines the process that you will use to require attendance and track completion for employees who failed to complete annual training.

Item #1f. Answer "yes", if your business has written policies and procedures requiring you to allow individuals (clients/consumers) to access their individual record of sensitive information, and allow them to amend or correct that information, if applicable.

Item #1g. Answer "yes", if your business has written policies and procedures restricting access to sensitive information to only persons who have been authorized and trained on how to handle sensitive information

Item #1h. Answer "yes", if your business has written policies and procedures requiring sanctioning of any subcontractor, employee, trainee, volunteer, or anyone whose work you direct when they have accessed sensitive information but are not authorized to do so, and that you have a method of proving that you have sanctioned such individuals. If you are the only employee, you must demonstrate how you will document the noncompliance, update policies and procedures if needed, and seek additional training or education to prevent future occurrences.

Item #1i. Answer "yes", if your business has written policies and procedures requiring you to update your policies within 60 days after you have made changes to how you use or disclose sensitive information.

Item #1j. Answer "yes" if your business has written policies and procedures requiring you to restrict attempts to take de-identified data and re-identify it or restrict any subcontractor, employee, trainee, volunteer, or anyone whose work you direct, from contacting any individuals for whom you have sensitive information except to perform obligations under the contract, or with written permission from University.

Item #1k. Answer "yes" if your business has written policies and procedures prohibiting you from using, disclosing, creating, maintaining, storing, or transmitting sensitive information outside of the United States.

Item #1l. Answer "yes", if your business has written policies and procedures requiring your business to cooperate with University agencies or federal regulatory entities for inspections, audits, or investigations related to compliance with the DUA or applicable law.

Item #1m. Answer "yes" if your business has written policies and procedures requiring your business to use appropriate standards and methods to destroy or dispose of sensitive information. Policies and procedures should comply with University requirements for retention of records and methods of disposal.

Item #1n. Answer "yes" if your business has written policies and procedures prohibiting the publication of the work you created or performed on behalf of University pursuant to the data use agreement, or other sensitive information, without express prior written approval of the University agency.

The questions below relate to implementation of the Privacy and Security policies and procedures referenced above in Section 1.

Item #2. Answer "yes" if your business has a current training program that meets the requirements specified in the ISPA for you, your employees, your subcontractors, your volunteers, your trainees, and any other persons under you direct supervision.

Item #3. Answer "yes" if your business has privacy safeguards to protect sensitive information as described in the

ISPA.

Item #4. Answer "yes" if your business maintains current lists of persons in your workforce, including subcontractors (if applicable), who are authorized to access sensitive information. If you are the only person with access to sensitive information, please answer "yes."

Item #5. Answer "yes", if your business and subcontractors (if applicable) will report changes to the Authorized Users list within 48 hours.

Item #6. Answer "yes", if your business and subcontractors (if applicable) monitor for and remove from the list of Authorized Users members of the workforce who are terminated or are no longer authorized to handle sensitive

SECTION C. SECURITY RISK ANALYSIS AND ASSESSMENT

This section is about your electronic systems. If you DO NOT store sensitive information in electronic systems (e.g., laptop, personal computer, mobile device, database, server, etc.), select the "No Electronic Systems" box and respond "N/A" for all questions in this section.

Item #1. Provide a network diagram showing how University and Provider systems will interconnect, including third parties. Provide as much detail as possible in sections 1.A, 1.B, and 1.C.

Item #2. Provide the most recent third party assessment of any data centers or cloud services.

Item #3. Answer "yes" if your business does not "offshore" or use, disclose, create, receive, transmit, or maintain sensitive information outside of the United States. If you are not certain, contact your provider of technology services (application, cloud, data center, network, etc.) and request confirmation that they do not offshore their data.

Item #4. Answer "yes" if your business uses a person or company who is knowledgeable in IT security to maintain or oversee the configurations of your business's computing systems and devices. You may be that person, or you may hire someone who can provide that service for you.

Item #5. Describe in detail how user accounts are provisioned for those users accessing University sensitive information.

Item #6. Answer "yes" if your business monitors and manages access to sensitive information (i.e., reviews systems to ensure that access is limited to Authorized Users; has formal processes for granting, validating, and reviews the need for remote access to Authorized Users to sensitive information, etc.). If you are the only employee, answer "yes" if you have implemented a process to periodically evaluate the need for accessing sensitive information to fulfill your Authorized Purposes.

Item #7. Answer "yes" if your business assigns a unique user name and private password to each of your employees, your subcontractors, your volunteers, your trainees, and any other persons under your direct control who will use disclose create receive transmit or maintain sensitive information

Item #8. Answer "yes" if your business has implemented a system for changing the password a system initially assigns to the user (also known as the default password), and requires users to change their passwords at least every 90 days, and prohibits the creation of weak passwords for all computer systems that access or store sensitive information (e.g., a strong password has a minimum of 8 characters with a combination of uppercase, lowercase, special characters, and numbers, where possible). If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example:

http://windows.microsoft.com/en-us/windows/change-password-policy- settings#1TC=windows-7

Item #9. Answer "yes" if your business locks the access after a certain number of failed attempts to login and after 15 minutes of user inactivity on all computing devices that access or store sensitive information. If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example:

http://windows.microsoft.com/en-us/windows/change-password-policy- settings#1TC=windows-7

Item #10. Answer "yes", if your business secures, manages, and encrypts remote access, such as: using Virtual Private Network (VPN) software on your home computer to access sensitive information that resides on a computer system at a business location or, if you use wireless, ensuring that the wireless is secured using a password code. If you do not access systems remotely or over wireless, answer "N/A".

Item #11. Answer "yes" if your business updates the computer security settings for all your computers and electronic systems that access or store sensitive information to prevent hacking or breaches (e.g., non- essential features or services have been removed or disabled to reduce the threat of breach and to limit opportunities for hackers or intruders to access your system). For example, Microsoft's Windows security checklist:

http://windows.microsoft.com/en-us/windows7/Security-checklist-for-Windows-7

Item #12. Answer "yes" if your business secures physical access to computer, paper, or other systems containing sensitive information from unauthorized personnel and theft (e.g., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.). If you are the only employee and use these practices for your business, answer "yes."

Item #13. Answer "yes" if your business uses encryption products to protect sensitive information that is transmitted over a public network (e.g., the Internet, WIFI, etc.) or that is stored on a computer system that is physically or electronically accessible to the public (FIPS 140-2 encryption preferred. For more information regarding FIPS 140-2 encryption products, please refer to: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm).

Item #14. Answer "yes" if your business requires employees, volunteers, trainees and other workforce members to sign a document that clearly outlines their responsibilities for protecting sensitive information and associated systems containing sensitive information before they can obtain access. If you are the only employee answer "yes" if you have signed or are willing to sign the DUA, acknowledging your adherence to requirements and responsibilities.

Item #15. Answer "yes" if your business is willing to perform a criminal background check on employees, subcontractors, volunteers, or trainees who access sensitive information. If you are the only employee, answer "yes" if you are willing to submit to a background check.

Item #16. Answer "yes" if your business stores sensitive information on encrypted end-user electronic devices (e.g., laptops, USBs, tablets, smartphones, external hard drives, desktops, etc.) and can produce evidence of the encryption, such as, a screen shot or a system report (FIPS 140-2 encryption preferred. For more information regarding FIPS 140-2 encryption products, please refer to:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm). If you do not utilize end-user electronic devices for storing sensitive information, answer "N/A".

Item #23. Answer "yes" if your business disposal processes for sensitive information ensure that sensitive information is destroyed so that it is unreadable or undecipherable. Simply deleting data or formatting the hard drive is not enough; ensure you use products that perform a secure disk wipe. A Google search can provide information on what tools can do this.

Item #24. A. Provide sample results from the most recent vulnerability scans performed on your systems that will be used to use, disclose, access, create, transmit, maintain, or store sensitive information. B.