6. SFDPH Third Party Computer System Access Agreement (11-20-2023)_1.pdf

SFDPH SAA 11-20-2023

SAN FRANCISCO DEPARTMENT OF PUBLIC HEALTH

THIRD PARTY COMPUTER SYSTEM ACCESS AGREEMENT

(SAA)

Version – 11/20/2023

TABLE OF CONTENTS

SECTION 1 - “THIRD PARTY” CATEGORIES

SECTION 2 - DEFINITIONS

SECTION 3 – GENERAL REQUIREMENTS

SECTION 4 – ADDITIONAL REQUIREMENTS FOR TREATMENT PROVIDERS

SECTION 5 – ADDITIONAL REQUIREMENTS FOR EDUCATION/TEACHING INSTITUTIONS

SECTION 6 – ADDITIONAL REQUIREMENTS FOR HEALTH INSURERS

SECTION 7 - DEPARTMENT’S RIGHTS

SECTION 8 - DATA BREACH; LOSS OF CITY DATA

Attachment 1 to SAA

TERMS AND CONDITIONS

The following terms and conditions govern Third Party access to San Francisco Department of Public Health (“Department” and/or “City”) Computer Systems. Third Party access to Department Computer Systems and Department Confidential Information is predicated on compliance with the terms and conditions set forth herein.

SECTION 1 - “THIRD PARTY” CATEGORIES

1. Third Party In General: means an entity seeking to access a Department Computer System. Third Party includes, but is not limited to, Contractors (including but not limited to Contractor’s employees, agents, subcontractors), Researchers, and Grantees, as further defined below. Category-specific terms for Treatment Providers, Education Institutions, and Health Insurers are set forth Sections 4 through 6, herein.

2. Treatment Provider: means an entity seeking access to Department Computer Systems in order to obtain patient information necessary to provide patient treatment, billing, and healthcare operations, including access for Physician Practices, Hospitals, Long Term Care Facilities, and Nursing Homes.

3. Education Institution: means an entity seeking access to Department Computer Systems to support the training of its students while performing education activities at Department facilities.

4. Health Insurer: means an entity seeking access to provide health insurance or managed care services for Department patients.

SECTION 2 - DEFINITIONS

1. “Agreement” means an Agreement between the Third Party and Department that necessitates Third Party’s access to Department Computer System. Agreement includes, but is not limited to, clinical trial agreements, accreditation agreements, affiliation agreements, professional services agreements, no-cost memoranda of understanding, and insurance network agreements.

2. “Department Computer System” means an information technology system used to gather and store information, including Department Confidential Information, for the delivery of services to the Department.

3. “Department Confidential Information” means information contained in a Department Computer System, including identifiable protected health information (“PHI”) or personally identifiable information (“PII”) of Department patients.

4. “Third Party” and/or “Contractor” means a Third Party Treatment Provider, Education Institution, and/or Health Insurer, under contract with the City.

5. “User” means an individual who is being provided access to a Department Computer Systems on behalf of Third Party. Third Party Users include, but are not limited to, Third Party’s employees, students/trainees, agents, and subcontractors.

SECTION 3 – GENERAL REQUIREMENTS

1. Third Party Staff Responsibility. Third Party is responsible for its work force and each Third Party User’s compliance with these Third Party System Access Terms and Conditions.

2. Limitations on Access. User’s access shall be based on the specific roles assigned by Department to ensure that access to Department Computer Systems and Department Confidential Information is limited to the minimum necessary to perform under the Agreement.

3. Qualified Personnel. Third Party and Department (i.e., training and onboarding) shall ensure that Third Party Users are qualified to access a Department Computer System.

4. Remote Access/Multifactor Authentication. Department may permit Third Party Users to access a Department Computer System remotely. Third Party User shall use Department’s multifactor authentication solution when accessing Department systems remotely or whenever prompted.

5. Issuance of Unique Accounts. Department will issue a unique user account for each User of a Department Computer System. Third Party User is permitted neither to share such credentials nor use another user’s account.

6. Appropriate Use. Third Party is responsible for the appropriate use and safeguarding of credentials for Department Computer System access issued to Third Party Users. Third Party shall take the appropriate steps to ensure that their employees, agents, and subcontractors will not intentionally seek out, download, transfer, read, use, or disclose Department Confidential Information other than for the use category described in Section 1 – “Third Party” Categories.

7. Notification of Change in Account Requirements. Third Party shall promptly notify Department via Third Party’s Report for DPH Service Desk (dph.helpdesk@sfdph.org) in the event that Third Party or a Third Party User no longer has a need to use Department Computer Systems(s), or if the Third Party User access requirements change. Such notification shall be made no later than one (1) business day after determination that use is no longer needed or that access requirements have changed.

8. Assistance to Administer Accounts. The Parties shall provide all reasonable assistance and information necessary for the other Party to administer the Third Party User accounts.

9. Security Controls. Third Party shall appropriately secure Third Party’s computing infrastructure, including but not limited to computer equipment, mobile devices, software applications, and networks, using industry standard tools to reduce the threat that an unauthorized individual could use Third Party’s computing infrastructure to gain unauthorized access to a Department Computer System. Third Party shall also take commercially reasonable measures to protect its computing infrastructure against intrusions, viruses, worms, ransomware, or other disabling codes. General security controls include, but are not limited to:

a Password Policy. Third Party must maintain a password policy based on information security best practices for password length, complexity, and reuse. Third Party credentials used to access Third Party networks and systems must be configured for a password change no greater than every 90 calendar days.

b Workstation/Laptop Encryption. All Third Party-owned or managed workstations, laptops, tablets, smart phones, and similar devices that access a Department Computer System must be configured with full disk encryption using a FIPS 140-2 certified algorithm.

c Endpoint Protection Tools. All Third Party-owned or managed workstations, laptops, tablets, smart phones, and similar devices that access a Department Computer System must maintain a current installation of comprehensive anti-virus, anti-malware, anti-ransomware, desktop firewall, and intrusion prevention software with automatic updates scheduled at least daily.

d Patch Management. To correct known security vulnerabilities, Third Party shall install security patches and updates in a timely manner on all Third Party-owned workstations, laptops, tablets, smart phones, and similar devices that access Department Computer Systems based on Third Party’s risk assessment of such patches and updates, the technical requirements of Third Party’s computer systems, and the vendor's written recommendations. If patches and updates cannot be applied in a timely manner due to hardware or software constraints, mitigating controls must be implemented based upon the results of a risk assessment.

e Mobile Device Management. Third Party shall ensure both corporate-owned and personally owned mobile devices have Mobile Device Management (MDM) installed. Given the prevalence of restricted data in Third Party’s environment, all mobile devices used for Third Party’s business must be encrypted. This applies to both corporate-owned and privately-owned mobile devices. At a minimum, the MDM should: Enforce an entity’s security policies and perform real-time compliance checking and reporting; Enforce strong passwords/passcodes for access to mobile devices; Perform on-demand remote wipe if a mobile device is lost or stolen;

Mandate device encryption.

10. Auditing Accounts Issued. Department reserves the right to audit the issuance and use of Third Party User accounts. To the extent that Department provides Third Party with access to tools or reports to audit what Department Confidential Information a Third Party User has accessed on a Department Computer System, Third Party must perform audits on a regular basis to determine if a Third Party User has inappropriately accessed Department Confidential Information.

11. Assistance with Investigations. Third Party must provide all assistance and information reasonably necessary for Department to investigate any suspected inappropriate use of a Department Computer Systems or access to Department Confidential Information. The Department may terminate a Third Party’ User’s access to a Department Computer System following a determination of inappropriate use of a Department Computer System.

12. Inappropriate Access, Failure to Comply. If Third Party suspects that a Third Party User has inappropriately accessed a Department Computer System or Department Confidential Information, Third Party must immediately, and within no more than one (1) business day, notify Department.

13. Policies and Training. Third Party must develop and implement appropriate policies and procedures to comply with applicable privacy, security and compliance rules and regulations. Third Party shall provide appropriate training to Third Party Users on such policies. Access will only be provided to Third Party Users once all required training is completed.

14. Third Party Data User Confidentiality Agreement. Before Department Computer System access is granted, as part of Department’s compliance, privacy, and security training, each Third Party User must complete Department’s individual user confidentiality, data security and electronic signature agreement form. The agreement must be renewed annually.

15. Corrective Action. Third Party shall take corrective action upon determining that a Third Party User may have violated these Third Party System Access Terms and Conditions.

16. No Technical or Administrative Support. Except as provided herein or otherwise agreed, the Department will provide no technical or administrative support to Third Party or Third Party User(s) for Department Computer System access; provided, however, that the foregoing does not apply to technical or administrative support necessary to fulfill Third Party’s contractual and/or legal obligations, or as required to comply with the terms of this Agreement.

SECTION 4 – ADDITIONAL REQUIREMENTS FOR TREATMENT PROVIDERS

1. Permitted Access, Use and Disclosure. Treatment Providers and Treatment Provider Users shall access Department Confidential Information of a patient/client in accordance with applicable privacy rules and data protection laws. Requests to obtain data for research purposes require approval from an Institutional Review Board (IRB).

2. Redisclosure Prohibition. Treatment Providers may not redisclose Department Confidential Information, except as otherwise permitted by law.

3. HIPAA Security Rule. Under the HIPAA Security Rule, Treatment Providers must implement safeguards to ensure appropriate protection of protected/electronic health information (PHI/EHI), including but not limited to the following:

a) Ensure the confidentiality, integrity, and security of all PHI/EHI they create, receive, maintain or transmit when using Department Computer Systems;

b) Identify and protect against reasonably anticipated threats to the security or integrity of the information;

c) Protect against reasonably anticipated, impermissible uses or disclosures; and

d) Ensure compliance by their workforce.

SECTION 5 – ADDITIONAL REQUIREMENTS FOR EDUCATION/TEACHING INSTITUTIONS

1. Education Institution is Responsible for its Users. Education Institutions shall inform Education Institution Users (including students, staff, and faculty) of their duty to comply with the terms and conditions herein. Department shall ensure that all Education Institution Users granted access to a Department Computer System shall first successfully complete Department’s standard staff training for privacy and compliance, information security and awareness, and software-application specific training before being provided User accounts and access to Department Computer Systems.

2. Tracking of Training and Agreements. Department shall maintain evidence of all Education Institution Users (including students, staff, and faculty) having successfully completed Department’s standard staff training for privacy and compliance and information security and awareness.

Such evidence shall be maintained for a period of five (5) years from the date of graduation or termination of the Third Party User’s access.

SECTION 6 – ADDITIONAL REQUIREMENTS FOR HEALTH INSURERS

1. Permitted Access, Use and Disclosure. Health Insurers and Health Insurer Users may access Department Confidential Information only as necessary for payment processing and audits, including but not limited to quality assurance activities, wellness activities, care planning activities, and scheduling.

2. Member / Patient Authorization. Before accessing, using, or further disclosing Department Confidential Information, Health Insurers must secure all necessary written authorizations from the patient / member or such individuals who have medical decision-making authority for the patient / member.

SECTION 7 - DEPARTMENT’S RIGHTS

1. Periodic Reviews. Department reserves the right to perform regular audits to determine if a Third Party’s access to Department Computer Systems complies with these terms and conditions.

2. Revocation of Accounts for Lack of Use. Department may revoke any account if it is not used for a period of ninety (90) days.

3. Revocation of Access for Cause. Department and Third Party reserves the right to suspend or terminate a Third Party User’s access to Department Computer Systems at any time for cause, i.e., the Parties determined that a Third-Party User has violated the terms of this Agreement and/or Applicable law.

4. Third Party Responsibility for Cost. Each Third Party is responsible for its own costs incurred in connection with this Agreement or accessing Department Computer Systems.

SECTION 8 - DATA BREACH; LOSS OF CITY DATA.

1. Data Breach Discovery. Following Third Party’s discovery of a breach of City Data disclosed to Third Party pursuant to this Agreement, Third Party shall notify City in accordance with applicable laws. Third Party shall:

i. mitigate, to the extent practicable, any risks or damages involved with the breach or security incident and to protect the operating environment; and

ii. comply with any requirements of federal and state laws as applicable to Third Party pertaining to the breach of City Data.

2. Investigation of Breach and Security Incidents. To the extent a breach or security system is identified within Third Party’s System that involves City Data provided under this Agreement, Third Party shall investigate such breach or security incident. For the avoidance of doubt, City shall investigate any breach or security incident identified within the City’s Data System To the extent of Third Party discovery of information that relates to the breach or security incident of City Data, Third Party User shall inform the City of:

i. the City Data believed to have been the subject of breach;

ii. a description of the unauthorized persons known or reasonably believed to have improperly used, accessed or acquired the City Data;

iii. to the extent known, a description of where the City Data is believed to have been improperly used or disclosed; and

iv. to the extent known, a description of the probable and proximate causes of the breach or security incident;

3. Written Report. To the extent a breach is identified within Third Party’s System, Third Party shall provide a written report of the investigation to the City as soon as practicable; provided, however, that the report shall not include any information protected under the attorney-client privileged, attorney-work product, peer review laws, and/or other applicable privileges. The report shall include, but not be limited to, the information specified above, as well as information on measures to mitigate the breach or security incident.

4. Notification to Individuals. If notification to individuals whose information was breached is required under state or federal law, Third Party shall cooperate with and assist City in its notification (including substitute notification) to the individuals affected by the breach

5. Sample Notification to Individuals. If notification to individuals is required, Third Party shall cooperate with and assist City in its submission of a sample copy of the notification to the Attorney General.

6. Media Communications. The Parties shall together determine any communications related to a Data Breach.

7. Protected Health Information. Third Party and its subcontractors, agents, and employees shall comply with all federal and state laws regarding the transmission, storage and protection of all PHI disclosed to Third Party by City. In the event that City pays a regulatory fine, and/or is assessed civil penalties or damages through private rights of action, based on an impermissible use or disclosure of PHI given to Third Party by City, Third Party shall indemnify City for the amount of such fine or penalties or damages, including costs of notification, but only in proportion to and to the extent that such fine, penalty or damages are caused by or result from the impermissible acts or omissions of Third Party. This section does not apply to the extent fines or penalties or damages were caused by the City or its officers, agents, subcontractors or employees.

Attachment 1 to SAA

System Specific Requirements

I. For Access to Department Epic through Care Link the following terms shall apply:

A. Department Care Link Requirements:

1. Connectivity.

a) Third Party must obtain and maintain an Internet connection and equipment in accordance with specifications provided by Epic and/or Department. Technical equipment and software specifications for accessing Department Care Link may change over time. Third Party is responsible for all associated costs. Third Party shall ensure that Third Party Data Users access the System only through equipment owned or leased and maintained by Third Party.

2. Compliance with Epic Terms and Conditions.

a) Third Party will at all times access and use the System strictly in accordance with the Epic Terms and Conditions. The following Epic Care Link Terms and Conditions are embedded within the Department Care Link application, and each Data User will need to agree to them electronically upon first sign-in before accessing Department Care Link:

3. Epic-Provided Terms and Conditions

a) Some short, basic rules apply to you when you use your EpicCare Link account. Please read them carefully. The Epic customer providing you access to EpicCare Link may require you to accept additional terms, but these are the rules that apply between you and Epic.

b) Epic is providing you access to EpicCare Link, so that you can do useful things with data from an Epic customer's system. This includes using the information accessed through your account to help facilitate care to patients shared with an Epic customer, tracking your referral data, or otherwise using your account to further your business interests in connection with data from an Epic customer's system. However, you are not permitted to use your access to EpicCare Link to help you or another organization develop software that is similar to EpicCare Link. Additionally, you agree not to share your account information with anyone outside of your organization.

II. For Access to Department Epic through Epic Hyperspace the following terms shall apply:

A. Department Epic Hyperspace:

1. Connectivity.

a) Third Party must obtain and maintain an Internet connection and required equipment in accordance with specifications provided by Epic and Department. Technical equipment and software specifications for accessing Department Epic Hyperspace will change over time.

You may request a copy of required browser, system, and connection requirements from the Department IT division. Third Party is responsible for all associated costs. Third Party shall ensure that Third Party Data Users access the System in accordance with the terms of this agreement.

2. Application For Access and Compliance with Epic Terms and Conditions.

a) Prior to entering into agreement with Department to access Department Epic Hyperspace, Third Party must first complete an Application For Access with Epic Systems Corporation of Verona, WI. The Application For Access is found at:

https://userweb.epic.com/Forms/AccessApplication. Epic Systems Corporation notifies Department, in writing, of Third Party’s permissions to access Department Epic Hyperspace prior to completing this agreement. Third Party will at all times access and use the system strictly in accordance with the Epic Terms and Conditions.

III. For Access to Department myAvatar the following terms shall apply:

A. Department myAvatar

1. Connectivity.

a. Third Party must obtain an Internet connection and required equipment in accordance with specifications provided by Department. Technical equipment and software specifications for accessing Department myAvatar will change over time. You may request a copy of required browser, system, and connection requirements from the Department IT division. Third Party is responsible for all associated costs. Third Party shall ensure that Third Party Data Users access the System only through equipment owned or leased and maintained by Third Party.

2. Information Technology (IT) Support.

a. Third Party must have qualified and professional IT support who will participate in quarterly CBO Technical Workgroups.

3. Access Control.

a. Access to the BHS Electronic Heath Record is granted based on clinical and business requirements in accordance with the Behavioral Health Services EHR Access Control Policy (6.00-06). The Access Control Policy is found at:

https://www.sfdph.org/dph/files/CBHSPolProcMnl/6.00-06.pdf

b. Applicants must complete the myAvatar Account Request Form found at https://www.sfdph.org/dph/files/CBHSdocs/BHISdocs/UserDoc/Avatar_Account_Request_ Form.pdf

c. All licensed, waivered, registered and/or certified providers must complete the Department credentialing process in accordance with the DHCS MHSUDS Information Notice #18-019.