Attachment B DMCA_091925.docx

DATA MANAGEMENT AND CONFIDENTIALITY AGREEMENT

This Data Management and Confidentiality Agreement (this “DMCA” is made by and between the Executive Office of Technology Services and Security (“EOTSS”) and (the “Contractor”). EOTSS and the Contractor are sometimes referred to herein individually as a “Party” and together as the “Parties.”

SECTION 1. BACKGROUND, SCOPE AND DEFINITIONS

Section 1.1 Background/Scope

Pursuant to M.G.L. c. 7D, as subsequently amended pursuant to Article 87, EOTSS is responsible for supervising the information technology (“IT”) services of all agencies within the executive department, including the Executive Office of Health and Human Services (“EOHHS”) and its Constituent Agencies, as defined herein. In furtherance of such responsibility, EOTSS is authorized to, among other things, conduct, oversee and supervise the initiation of IT projects for such agencies, procure IT resources for them, provide centralized IT services on a chargeback basis, and, if authorized, enter into, manage and administer agreements or contracts in connection with such procurement on their behalf. For purposes of this DMCA, the term “Constituent Agency” or “Agency” is used to refer to any of such departments, commissions, offices, boards, divisions, institutions and other entities within EOHHS, as set forth in Appendix B.

In performing such work, EOTSS is the Business Associate of EOHHS and certain EOHHS Constituent Agencies under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-91 and the rules and regulations promulgated thereunder (as amended from time-to-time including, without limitation, the amendments enacted under Title XIII of the American Recovery and Reinvestment Act of 2009 and titled as the Health Information Technology for Economic and Clinical Health Act (“HITECH”) (collectively “HIPAA”), and has additional obligations regarding the privacy, security and management of PI to which it may have access.

EOTSS has entered into a contract with the Contractor pursuant to which the Contractor shall provide services to EOTSS (the “Contract”).

The Parties are entering into this DMCA to establish the privacy, security and other requirements applicable to the Contractor performing and/or providing the Activities identified in the Contract for or to the Commonwealth.

Section 1.2 Definitions

When used in this DMCA, the following capitalized terms shall have the meanings ascribed to them below:

“Activities” shall mean the activities, functions and/or services to be performed or provided by the Contractor for, on behalf of and/or to the Commonwealth under the Contract.

“Applicable Law” shall mean M.G.L. c. 66A (FIPA), 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, the Health Insurance Portability and Accountability Act (HIPAA) Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, Subpart F and 42 CFR 434.6(a)(8) (Medicaid Confidentiality Rule), 42 CFR Part 2, 45 CFR § 155.260, MARS-E and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality, or security of PI.

“EOTSS” shall mean the Massachusetts Executive Office of Technology Services and Security.

“Event” shall mean the following, either individually or collectively: 1) any use or disclosure of PI not permitted under this DMCA; 2) any Security Incident; or 3) any other event that would trigger notification obligations under the Breach Notification Rule, M.G.L. c. 93H, other similar Applicable Law, or Third Party Agreement (defined below) requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of PI.

“HIPAA Rules” shall mean 45 CFR Parts 160, 162, and 164, inclusive of the Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), the Security Rule (45 CFR Part 160 and Part 164, Subparts A and C), the Breach Notification Rule (45 CFR Part 164, Subpart D) and the Enforcement Rule (45 CFR Part 160, Subparts C, D, and E).

“Individual” shall mean the person to whom the PI refers and shall include a person or organization who qualifies as a personal representative in accord with 45 CFR § 164.502(g).

“MARS-E” shall mean the suite of documents published by Centers for Medicare and Medicaid Services (“CMS”) entitled “Minimum Acceptable Risk Standards for Exchanges,” as it may be amended, restated or superseded from time to time, which provides guidance and requirements related to implementing the privacy and security standards with which EOHHS must comply pursuant to the Computer Matching Agreements between CMS and EOHHS and 45 CFR § 155.260.

“Online Tracking Technology” means any technologies that are used to collect and analyze information about how users interact with websites or mobile applications maintained by or on behalf of EOTSS, EOHHS, or a Constituent Agency.

“PI” shall mean any Protected Health Information, any “personal data” as defined in M.G.L. c. 66A, any “patient identifying information” as used in 42 CFR Part 2, any “personally identifiable information” as used in 45 CFR § 155.260, “personal information” as defined in M.G.L. c. 93H, and Third Party Data (defined below in Section 2.1.B) and any other individually identifiable information that is treated as confidential under Applicable Law or agreement (including, for example, any state and federal tax return information) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its performance of the Activities. Information, including aggregate information, is considered PI if it is not fully de-identified in accord with 45 CFR §§ 164.514(a)-(c).

“System” shall mean any Commonwealth system, database, application, or other information technology resource.

When used in this DMCA, the following terms shall have the same meaning as those terms have in the HIPAA Rules: Business Associate, Minimum Necessary, Notice of Privacy Practices, Personal Representative, Protected Health Information, Required by Law, Secretary, Security Incident and Workforce.

All other capitalized terms used in this DMCA, but not otherwise defined herein, or elsewhere in this DMCA, shall be construed in a manner consistent with the HIPAA Rules, M.G.L. c. 66A and all other Applicable Laws.

SECTION 2. DATA MANAGEMENT AND CONFIDENTIALITY

Section 2.1 Data Management and Confidentiality Obligations of the Contractor

A. Compliance with Applicable Laws. The Contractor must comply with all Applicable Laws in performing the Activities including any use and disclosure of PI. Without limiting the generality of the foregoing, the Contractor acknowledges and agrees as follows:

l. Business Associate under HIPAA. In performing the Activities, the Contractor acknowledges and agrees that it is acting as EOTSS’ Business Associate. The Contractor shall comply with all requirements of the HIPAA Rules applicable to a Business Associate. This DMCA shall serve as the Business Associate Agreement between the Contractor and EOTSS. Workforce members with access to unencrypted PI or an encryption key used to secure such PI must sign the Confidentiality Acknowledgement attached hereto as Appendix A prior to being granted such access.

2. Medicaid Confidentiality Rule. In performing the Activities, if the Contractor will create, receive, use, disclose, maintain, transmit or otherwise obtain information concerning Medicaid applicants and beneficiaries, the Contractor agrees to comply with the Medicaid Confidentiality Rule at 42 CFR 431 Subpart F and 42 CFR 434.6(a)(8). Consistent with these obligations, the Contractor shall restrict its use and disclosure of information concerning Medicaid applicants and beneficiaries to purposes directly connected with the administration of the Medicaid plan. 42 CFR 431.302 defines purposes directly related to Medicaid Plan administration to include: (1) establishing eligibility, (2) determining the amount of medical assistance, (3) providing services for beneficiaries; and (4) conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the administration of the Medicaid plan.

3. 42 CFR Part 2. The Contractor acknowledges and agrees that with respect to any substance use information that the Contractor receives, stores, processes, uses, creates or transmits that was obtained by a Part 2 Program, Lawful Holder, or EOTSS (as such terms are used in 42 CFR Part 2), it is bound by 42 CFR Part 2 and shall not use or disclose information except as permitted under 42 CFR Part 2.

4. M.G.L. c. 66A. The Contractor acknowledges that in performing the Activities it will create, receive, use, disclose, maintain, transmit or otherwise obtain “personal data” (as defined in M.G.L. c. 66A) and that, in so doing, it becomes a “holder” of such data for purposes of M.G.L. c. 66A and shall comply with the same.

5. CORI Regulations. The Contractor shall, pursuant to and in accordance with 101 CMR 15.03(1)(b), require and consider the criminal history information pertaining to all Workforce members of the Contractor who will be given access or potential access to PI, and all applicants for employment with the Contractor where the position applied for entails access or potential access to PI. The Contractor shall otherwise comply with all applicable terms of 101 CMR 15.00 in connection with the review and consideration of employee and applicant criminal records.

6. Additional Requirements. EOTSS reserves the right to add any requirement for EOTSS, EOHHS, and/or its Constituent Agencies to comply with any applicable state or federal law or regulation, or any contractual obligation to which EOTSS, EOHHS, and/or its Constituent Agencies are subject, relating to privacy and/or security, and the Contractor agrees to negotiate in good faith to promptly execute and comply with any necessary amendment or additional agreement.

B. Compliance with Third Party Agreements. The Contractor acknowledges that EOHHS and its Constituent Agencies receive PI from regulated third parties including but not limited to the Social Security Administration, the Centers for Medicare and Medicaid Services, the Internal Revenue Service, the Department of Homeland Security, the Federal Data Services Hub and Massachusetts Department of Revenue (any such PI, “Third Party Data”). The use, disclosure, receipt, storage, transmission and maintenance of such Third Party Data is governed by agreements between EOHHS or its Constituent Agencies and the third party data sources (any such agreement, a “Third Party Agreement”). The Contractor agrees that it shall comply with all Third Party Agreements identified in Appendix C, including all conditions for disclosure under such Third Party Agreements such as third party source approval, background checks and training.

C. Ownership and Control of Data. The Contractor may use and disclose PI only as permitted by this DMCA. The Contractor does not possess any independent rights of ownership to such data. EOHHS and/or its Constituent Agencies are the lawful owner, holder, or licensee of all PI used, maintained, disclosed, received, created, transmitted or otherwise obtained in connection with this DMCA. Any PI is provided “as is” and EOTSS hereby disclaims all warranties, whether express, implied, statutory, or otherwise. EOTSS specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or practice. EOTSS makes no warranty of any kind that the PI will be secure, accurate, complete, free of harmful code, or error free. In no event will EOTSS, EOHHS, or the Constituent Agencies be liable under or in connection with this DMCA under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

D. Sanctions for Improper Access, Use or Disclosure of PI. The Contractor acknowledges that the Contractor and its subcontractors, agents, and Workforce members may be subject to civil and criminal penalties under state and federal law for accessing, using or disclosing PI in violation of this DMCA or Applicable Law.

E. Requirements Applicable to Subcontractors.

1. Generally. The Contractor shall enter into written agreements with each of its subcontractors and agents that will have access to PI (each, a “Subcontract”) and shall maintain such Subcontracts. All such Subcontracts must contain the terms of this DMCA and the Contract (including the Commonwealth Terms and Conditions) related to the privacy and security of PI, and otherwise must be consistent with all such terms and conditions. Without limiting the generality of the foregoing, the Contractor shall ensure that any such Subcontract satisfies all applicable requirements under the Privacy and Security Rules for a contract or other arrangement with a Business Associate. If a Subcontract deviates from the terms of this DMCA, Contractor must receive written approval from EOHHS prior to allowing subcontractors or agents access to any PI.

The Contractor must inform its subcontractors or agents of the civil and criminal penalties for misuse or unauthorized disclosure of PI under Applicable law.

The Contractor is fully responsible for any subcontractor’s or agent’s performance and for meeting all terms and requirements of this DMCA. The Contractor will not be relieved of any legal obligation under this DMCA, regardless of whether the Contractor subcontracts for performance of any Contract responsibility or whether PI or other information was in the hands of a subcontractor or agent.

2. Third Party Data. The Contractor shall require that any subcontractor or agent that needs access to Third Party Data or a System containing such Third Party Data or through which it may be accessed to comply with any privacy and/or security obligation that may be required under a Third Party Agreement. The Contractor shall ensure that any such subcontractor or agent has satisfied all such obligations prior to being granted access to the Third Party Data or System. The Contractor shall work with EOTSS to ensure that all such obligations are satisfied.

F. Data Security.

1. Administrative, Physical and Technical Safeguards. As of the Contract effective date, the Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PI and that prevent use or disclosure of such PI other than as provided for by this DMCA. All such safeguards must meet, at a minimum, and the Contractor shall otherwise comply with, all standards set forth in the Contract, Privacy and Security Rules, as applicable to a Business Associate, and the EOTSS Enterprise Information Security Policies and Standards(found online at Mass.gov[footnoteRef:1]) the EOHHS Acceptable Use Policy (found online at Mass.gov[footnoteRef:2]), MARS-E, and any standards contained in any applicable Third Party Agreement (collectively, the “Standards”). Contractor shall comply with any new or updated Standards issued by federal, state, or other issuing agency or entity. [1: EOTSS, Enterprise Information Security Policies and Standards, https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards. ] [2: EOHHS Acceptable User Policy, https://www.mass.gov/doc/eohhs-acceptable-use-policy/download. ]

The Contractor shall notify EOTSS of any change in its administrative, technical, or operational environments that impacts the confidentiality, integrity, or availability of PI or any changes to the Contractor’s information controls which alters its conformance with the Standards.

EOTSS and/or EOHHS may terminate the Contractor’s access to EOHHS Systems if in their sole discretion, either EOTSS and/or EOHHS determine that the Contractor has not complied with the requirements of this DMCA.

2. System Access. When accessing any System to perform the Activities, the Contractor shall comply with the Standards, and any System specific policies, mechanisms and processes adopted by EOHHS or EOTSS. The Contractor shall give EOHHS System owner prompt notice of any change in personnel whenever the change requires a termination or modification of any such password, user ID or other security mechanism or code, to maintain the confidentiality and integrity of the System.

3. Periodic Review. The Contractor shall monitor and periodically assess its compliance with the Standards. In the event Contractor is not compliant with some aspect of the Standards, Contractor agrees to notify EOTSS and to remediate such gap(s) in compliance within a reasonable timeframe. If Contractor cannot remediate such gap(s) within a reasonable timeframe, EOTSS reserves the right to implement a pro-rated modification of payments to the Contractor until compliance is reached.

4. Written Information Security Program. The Contractor shall ensure that it maintains a written information security Program (“WISP”) in compliance with the terms of this DMCA and Applicable Law, including, but not limited to M.G.L. c. 93H and 201 CMR 17.00.

5. Inventory of Systems/PI. The Contractor shall maintain an accurate and updated list of electronic and paper databases and other Systems containing PI, together with a description of the type(s) of PI contained in such databases and Systems and the various uses of the databases and Systems.

6. No Offshore Access. Pursuant to Section 7.5.8 of the EOHHS Acceptable Use Policy, the Contractor and its subcontractors, agents, and Workforce members shall not access or store any PI or access any System outside of the United States without prior written authorization. In addition, any remote connection to Commonwealth networks shall be in accordance with ISP.003 of the EOTSS Enterprise Information Security Policies and Standards.

7. Online Tracking Technology. The Contractor shall only use Online Tracking Technology in a manner that would not result in impermissible disclosures of PI as defined in this DMCA or any other violation of the MassHealth Notice of Privacy Practices or the Applicable Law.

G. Obligations upon a Non-Permitted Use or Disclosure of PI or other Event.

1. Mitigation and Other Activities. Immediately upon becoming aware of an Event, the Contractor shall:

a. retrieve any PI involved in the Event;

b. mitigate any known or likely harmful effect of the Event; and

c. take such other action(s) as may be requested by EOTSS or required to comply with any Applicable Law.

Any actions to address harmful effects of such Event undertaken by the Contractor on its own initiative or pursuant to EOTSS’ request shall not relieve the Contractor of its obligations to report such Event or otherwise comply with this Section 2.1G, any other provisions of this DMCA or the Contract or Applicable Law.

2. Notification and Reporting Activities. As soon as possible, but no later than twenty-four (24) hours after Contractor becomes aware of the Event, the Contractor shall verbally report the Event to EOTSS and EOHHS with as much of the details listed below as possible, and shall follow such verbal report within three (3) business days with a written report outlining the Event with the following information:

a. The date of the Event or the estimated date (if date unknown);

b. The date of the discovery of the Event;

c. The nature of the Event, including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events);

d. The nature of the PI involved in the Event (e.g., the types of identifiers and other information involved), together with samples of any forms or documents that were involved in the Event to illustrate the type of PI involved (with personal identifiers removed or redacted);

e. The exact number of individuals whose PI was involved in the Event if known or, if unknown, a reasonable estimate based on known facts (categorized according to the type of PI involved, if different types of PI was involved for different individuals), together with a description of how the number of individuals was determined;

f. A summary of the nature and scope of the Contractor’s investigation into the Event;

g. The known or likely harmful effects of the Event, all actions the Contractor has taken or plans to take to mitigate such effects, and the results of all mitigation actions already taken;

h. A summary of steps taken to prevent such Event in the future, including copies of revised policies and procedures, changes in business processes and staff training; and

i. Any additional information and/or documentation that the Contractor is required to provide to EOTSS under 45 CFR § 164.410, M.G.L. c. 93H, § 3(a) or other similar Applicable Law.

If an Event is the result of a Security Incident, such as hacking, ransomware, or other related Event, the Contractor shall prepare and provide a written forensics report to EOTSS and EOHHS that shall, at a minimum, describe the attack, security vulnerabilities, and any other information EOTSS and EOHHS deem necessary.

To the extent that any such information is not available at the time of the report, the Contractor shall provide such information to EOTSS and EOHHS as such information becomes available in one or more subsequent written reports. The Contractor shall provide EOTSS and EOHHS with such additional information regarding the Event as EOTSS and EOHHS may reasonably request, which additional information may include a written risk analysis rebutting any presumption that the Event constituted a breach for purposes of the Breach Notification Rule.

3. Obligations under Consumer Notification Laws. If EOTSS and/or EOHHS determine, in their respective sole discretion, that it, EOHHS or a Constituent Agency is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement as a result of the Event, the Contractor shall, at EOTSS’ and/or EOHHS’ request, assist EOTSS and/or EOHHS in drafting such notices for EOTSS’ and/or EOHHS’ review and approval, and shall take such other action(s) as EOTSS and/or EOHHS may reasonably request in connection with EOTSS’, EOHHS’ or Constituent Agency’s compliance with the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement, but in no event shall the Contractor have the authority to give any such notifications on EOTSS’, EOHHS’, or Constituent Agency’s behalf unless EOTSS and/or EOHHS authorizes and directs the Contractor to do so in writing. Additionally, at EOTSS’ and/or EOHHS’ direction, the Contractor shall provide credit monitoring services to affected Individuals as required under M.G.L. c. 93H, § 3A or other Applicable Law.

H. Response to Legal Process. The Contractor shall report to EOTSS and/or EOHHS, both verbally and in writing, any instance where PI or any other data obtained in connection with this DMCA is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under Massachusetts law). The Contractor shall provide such report to EOTSS and/or EOHHS as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. In response to such legal process, and in accordance with instructions from EOTSS and/or EOHHS, the Contractor shall take all reasonable steps, including objecting to the request when appropriate, to comply with M.G.L.

c. 66A § 2(k), 42 CFR § 431.306(f), 42 CFR Part 2, 45 CFR § 164.502(5)(iii), 45 CFR § 164.509, and any other Applicable Law. If EOTSS, EOHHS or a Constituent Agency determines that it shall respond directly, the Contractor shall cooperate and assist EOTSS, EOHHS or such Constituent Agency in its response.

I. Individual’s Privacy Rule Rights. With respect to any relevant PI in the Contractor’s possession, the Contractor shall take such action as may be requested by EOTSS and/or EOHHS to meet their obligations under 45 CFR §§ 164.524, 164.526 or 164.528 or other Applicable Law pertaining to an Individual’s right to access, amend or obtain an accounting of uses and/or disclosures of its PI, in sufficient time and manner for EOTSS and/or EOHHS to meet their obligations under such Privacy Rule provisions or other Applicable Law. If an Individual or Personal Representative contacts the Contractor with respect to exercising any rights the Individual may have under 45 CFR §§ 164.524, 164.526 or 164.528 or similar Applicable Law with respect to PI in the Contractor’s possession, the Contractor shall notify EOHHS’ Privacy Officer within two (2) business days of the Individual’s request and cooperate with EOHHS to meet any of its obligations with respect to such request.

With respect to an Individual’s right to an accounting under 45 CFR § 164.528, the Contractor shall document all disclosures of, and access to, PI as would be necessary for EOTSS to respond to a request by an Individual for an accounting in accord with 45 CFR § 164.528. The Contractor shall also document uses and disclosures of PI and other data access activities to the extent required under M.G.L. c. 66A, § 2(f).

J. Record Access. The Contractor shall make its internal practices, books and records, including policies and procedures, relating to the protection, security, use and disclosure of PI obtained under this DMCA, and the security and integrity of Systems containing PI or through which it may be accessed, available to EOTSS, EOHHS, and the Secretary, in a time and manner designated by the requesting party, for purposes of enabling EOTSS and EOHHS to determine compliance with this DMCA or for purposes of enabling the Secretary to determine compliance with the HIPAA Rules. If the Contractor is subject to a Third Party Agreement which requires access to Contractor’s facilities, upon reasonable notice, the Contractor agrees to allow EOTSS representatives, EOHHS representatives, Third Party representatives, and/or other data owners access to premises where PI is stored (including Contractor’s premises or its hosting facility) for the purpose of inspecting privacy and physical security arrangements implemented by the Contractor to protect such PI, compliance with Applicable Law or compliance with Federal grant requirements.

K. Privacy Officer. Consistent with the HIPAA Rules, the Contractor shall designate a Privacy Officer, who shall be responsible for overseeing the Contractor’s compliance with this DMCA.

L. Destruction of PI during Contract Term. The Contractor shall retain PI during the course of the Contract in accordance with the terms of this DMCA and all applicable state and federal retention laws and regulations. If, in accordance with such requirements, Contractor determines that, during the course of the Contract, it is appropriate to destroy PI, it shall do so only after obtaining EOTSS’ and/or EOHHS’ written permission. In the event destruction is permitted, Contractor shall ensure that PI are destroyed, purged, and rendered unrecoverable in accordance with all Applicable Laws and all applicable retention laws and regulations, and all data security policies issued by EOHHS and EOTSS. Within five (5) days of destroying PI in accordance with the requirements of this paragraph, Contractor shall provide EOTSS with a written certification that destruction has been completed in accord with the required standards set forth herein.

Section 2.2 Permitted Uses and Disclosures of PI by the Contractor

Except as otherwise limited in this DMCA, including in this Section 2.2, the Contractor may use or disclose PI only as follows:

A. Activities. The Contractor may use or disclose PI to perform the Activities or as otherwise required by, and in accordance with, the provisions of this DMCA; provided, that such use or disclosure would not violate:

1. the Privacy Rule or other Applicable Law, including the Medicaid Confidentiality Rule at 42 CFR 431, Subpart F, if done by EOTSS, EOHHS or a Constituent Agency;

2. the EOHHS’ or Constituent Agency’s policies and procedures that are known to the Contractor or that EOTSS advises the Contractor of; or

3. conflict with statements in the MassHealth Notice of Privacy Practices.

EOHHS makes available the most recent MassHealth Notice of Privacy Practices online at https://www.mass.gov/doc/masshealth-notice-of-privacy-practices/download.

When using or disclosing PI or when requesting PI from EOTSS, EOHHS, a Constituent Agency, or another party in performing the Activities, the Contractor represents that it shall make reasonable efforts to limit the amount of PI used, disclosed or requested to the minimum necessary to accomplish or perform the particular Activity for which the PI is being used, disclosed or requested.

B. Restriction on Contacting Individual. The Contractor shall not use PI to contact or to attempt to contact an Individual unless such contact is a permitted Activity, or made in accordance with EOTSS’ written instructions.

C. De-Identified PI. Unless the Contractor has obtained EOTSS’ and/or EOHHS written consent, the Contractor shall not use or share PI in any manner other than those permitted in Section 2.2A, including but not limited to publication, statistical tabulation, research, or report, regardless of whether or not the PI can be linked to a specific individual or has otherwise been de-identified in accord with the standards set forth in 45 CFR § 164.514.

SECTION 3. TERM, TERMINATION AND EFFECT OF TERMINATION

Section 3.1 Term and Termination.

A. This DMCA shall be effective upon execution by each party and shall terminate upon the termination or expiration of the Contract, unless earlier terminated by EOTSS in accordance with subsection B, below.

B. If EOTSS and/or EOHHS determine, in their respective sole discretion, that the Contractor has violated any material term of this DMCA or the Contract pertaining to the privacy or security of PI, EOTSS and/or EOHHS may terminate this DMCA and the Contract immediately upon written notice to the Contractor.

Section 3.2 Effect of Termination

A. Except as provided in subsection B immediately below, upon termination of this DMCA for any reason whatsoever (including expiration), the Contractor shall, at EOTSS’ and/or EOHHS’ direction, either return or destroy all PI, and the Contractor shall not retain any copies of such PI in any form. In no event shall the Contractor destroy any PI without first obtaining EOTSS’ and/or EOHHS’ approval. In the event destruction is permitted, the Contractor shall ensure that PI are destroyed, purged, and rendered unrecoverable in accordance with all Applicable Laws and applicable retention laws and regulations, and all data security policies issued by EOHHS and EOTSS. This provision shall apply to all PI in the possession of the Contractor’s subcontractors, and the Contractor shall require that all such information in the possession of its subcontractors and agents be returned or destroyed and that no subcontractor or agent shall be permitted to retain any copies of such information in any form, in accordance with EOTSS’ instructions. The Contractor shall, within three (3) business days of the return or destruction of PI, certify to EOTSS and/or EOHHS in writing that all PI has been returned or destroyed in accordance with this Section 3.2 and neither the Contractor nor any of its subcontractors or agents retains any PI.

B. If the Contractor determines that returning or destroying PI is not feasible, the Contractor shall provide EOTSS and/or EOHHS written notification of the conditions that make return or destruction not feasible. If, based on the Contractor’s representations, EOTSS and/or EOHHS concur that return or destruction is not feasible, the Contractor shall extend all protections pertaining to PI set forth in this DMCA to all such information and shall limit further uses and disclosures of such information to those purposes that make its return or destruction not feasible, for as long as the Contractor (or any of its subcontractors or agents) maintains any PI.

SECTION 4. ADDITIONAL TERMS AND CONDITIONS

Section 4.1 Notices. Unless otherwise specified herein, all notices, reports, requests, consents, claims, demands, waivers and other communications provided under this DMCA (each, a “Notice”) shall be in writing and shall be deemed to have been given to a Party: (i) when delivered by hand; (ii) on the date sent by e-mail if sent during normal business hours of the Party, and on the next business day if sent after normal business hours of the Party; or (iii) on the third day after the date deposited in the U.S. Mail, first class, postage pre-paid, provided, that, in each case, the Notice is delivered or addressed to the Party’s contact person(s) at the address(es) identified in the Contract, as well as any contact person identified below, (or to such other contact person(s) at such other address(es) as the recipient may from time to time specify in a notice given in accordance with this Section:

EOTSS:

Thomas B. Myers General Counsel & Chief Privacy Officer One Ashburton Place, 8th Floor, Boston, MA 02108 Thomas.b.myers2@mass.gov

Contractor:

Section 4.2 Amendment. This DMCA may be amended by the Parties at any time; provided, that any amendment must be in writing and must be signed by each Party. The Contractor shall promptly execute and comply with any amendment to this DMCA that EOTSS determines is necessary to ensure compliance with all applicable statutes, orders, and regulations promulgated by any federal, state, municipal, Third Party DMCAs, or other governmental authority pertaining to the privacy or security of PI, including any Applicable Law. Such requisite amendment may cover all activities and PI collected under the original Contract. The Contractor’s failure to amend this DMCA in accordance with the foregoing sentence shall be considered a breach of a material provision for purposes of Section 3.1.B. The Parties agree to negotiate in good faith to cure any omissions, ambiguities, or manifest errors herein.

Section 4.3 Survival. Notwithstanding any other provision concerning the term of this DMCA or the Contract, all protections and other obligations of the Contractor pertaining to PI set forth herein and in the Contract shall survive the termination of this DMCA and shall continue to apply until such time as all such information is returned or destroyed in accordance with Section 3.2 or, if later, until any outstanding obligation of the Contractor with respect to such information has been satisfied.

Section 4.4 Interpretation.

A. Any ambiguity in this DMCA shall be resolved to permit EOTSS to comply with the HIPAA Rules, M.G.L.

c. 66A, 42 CFR Part 431, Subpart F, and any other Applicable Law.

B. For purposes of this DMCA, (i) the words “include,” “includes” and “including” shall be deemed to be followed by the words “without limitation”; (ii) the word “or” is not exclusive; and (iii) the words “herein,” “hereof,” “hereby,” “hereto” and “hereunder” refer to this DMCA as a whole. The definitions given for any defined terms in this DMCA shall apply equally to both the singular and plural forms of the terms defined. Whenever the context may require, any pronoun shall include the corresponding masculine, feminine and neuter forms.

C. Unless the context otherwise requires, references herein to: (i) Sections, Attachments and Appendices mean the Sections of, and Attachments and Appendices attached to, this DMCA; (ii) an DMCA, instrument or other document means such DMCA, instrument or other document as amended, amended and restated, supplemented and modified from time to time to the extent permitted by the provisions thereof; and (iii) a statute or regulation, including an Applicable Law, refers to that law or regulation as in effect or as amended from time to time and includes any successor legislation or regulation.

D. The Attachments and Appendices referred to herein shall be construed with, and as an integral part of, this DMCA to the same extent as if they were set forth verbatim herein.

Section 4.5 Effective Date. This DMCA shall be effective upon the Effective Date indicated in the Standard Contract Form, the Effective Date of the Contract, or any other means by which the Contract is designated as effective in the Contract.

IN WITNESS THEREOF, the Parties have caused their duly authorized representatives to execute this Data Confidentiality and Management Agreement as of the date(s) written below.

EOTSS:

EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY

By: Name: Title: Date:

CONTRACTOR:

By: Name: Title: Date:

APPENDIX A

ACKNOWLEDGMENT REGARDING CONFIDENTIALITY OF PROTECTED INFORMATION

I, the undersigned, understand that in the course of my work for � (name or organization) relating to a contract with the EOTSS, I may have access to protected information- (“PI”)-including protected health information, other personally identifiable information or security information--either provided by EOHHS and/or its Constituent Agencies or created or obtained on behalf of EOHHS and/or its Constituent Agencies.

I understand that PI is confidential and access to, use of and disclosure of PI is regulated by federal and state law including, without limitation, the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and M.G.L. c. 66A, and the terms of the EOHHS contract.

I recognize that the unauthorized access, use or disclosure of PI may cause serious harm to individuals. Unauthorized access, use or disclosure of PI may also violate the terms of the EOHHS contract and/or federal or state law, which may result in civil or criminal penalty including, without limitation, fines and imprisonment.

Acknowledged and agreed:

Protected Information User’s name (printed or typed):

Protected Information User’s Signature:

Date:

Contractor:

NOTE: Appendix A need not be submitted to EOTSS. Appendix A must be retained by the Contractor and made available EOTSS upon request.

APPENDIX B

EOHHS and its Constituent Agencies that are Covered Entities or Hybrid Entities For purposes of this DMCA, EOHHS, consists of:

· Office of the Secretary of Health and Human Services

· EOHHS administrative offices, including:

· Office of Administration Services;

· Office of the General Counsel;

· Office of Financial Management;

· Office of Human Resources; and

· Office of Leasing and State Owned Property; and

· Office of Medicaid/MassHealth (“MassHealth”); and

· the following Constituent Agencies:

· Executive Office of Elder Affairs (“ELD”)

· Department of Public Health (“DPH”)

· Department of Mental Health (“DMH”)

· Department of Developmental Services (“DDS”)

APPENDIX C

Third Party Agreements

None included.