Attachment B to the RFR DPH Confidentiality Agreement FINAL.docx

ATTACHMENT B

To the RFR DPH Confidentiality Agreement

MASSACHUSETTS DEPARTMENT OF PUBLIC HEALTH

CONFIDENTIALITY AGREEMENT

(For Workstream #1 Only)

I. GENERAL PROVISIONS

This Confidentiality Agreement is made by and between the Commonwealth Health Insurance Connector Authority (the “Health Connector”), on its own behalf and on behalf of the Commonwealth’s Department of Public Health (“DPH” or “the Department”) and [Full name of Contractor] (the “Contractor”). The Health Connector, DPH, and the Contractor are sometimes referred to herein individually as a “Party” and together as the “Parties.” The Health Connector and/or DPH are sometimes referred to herein as “the Commonwealth”.

The Health Connector, on behalf of DPH, and the Contractor are parties to a Master Services Agreement (MSA) to which this Confidentiality Agreement is attached as Attachment B. In accordance with the Master Services Agreement, Contractor has agreed to certain privacy and security requirements in connection with its performance of the Services.

The Department of Public Health is a hybrid entity under the Health Insurance Portability and Accountability Act (HIPAA). The parties agree that neither the Department nor Contractor will need to execute a Business Associate Agreement for the purposes of the HIPAA as the Services being provided are not covered components. The Department and the Health Connector are subject to the Fair Information Practices Act ((MGL ch. 66A, “FIPA”). Since the Department is authorizing the Contractor, under the Contract, to process and store Personal Data, the Contractor in its performance of its duties under the Master Services Agreement is a holder of Personal Data. The Health Connector and DPH agree that Contractor personnel will, under Workstream #1 of the Request for Responses under which the Agreement is entered, pilot exposure notification technology. In that regard, Contractor may use, process, transmit and store Personal Data that is obtained through the use of one or more exposure notification applications and voluntarily disclosed to the Contractor by data subjects using those applications (one or more collections of such data are referred to herein collectively as the “Databases”).

Section 2. The Confidentiality Agreement terms and conditions are intended to protect the privacy and security of all Confidential Information that the Contractor may access, or receive from and/or create in the performance of its duties and responsibilities under the Master Services Agreement, and to ensure that the Health Connector and the Department through Contractor comply with FIPA, as well as all other applicable state or federal laws governing the privacy or security of any data accessed, received or created under the contract.

II. DEFINITIONS FOR USE IN THIS AGREEMENT

All terms used, but not otherwise defined herein, shall be construed in a manner consistent with FIPA and other applicable state or federal privacy or confidentiality laws.

“Data Subject” means an individual to whom Personal Data or Protected Health Information refers.

“Electronic Media” means:

· Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card, whether on premises or in the cloud; or

· Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

“Holder” (referenced herein as Contractor) means any person or entity which contracts or has an arrangement with an agency (DPH) whereby it holds personal data as part or as a result of performing a governmental or public function or purpose.

“Personal Data” (PD) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual, provided that the information is not contained in a public record and shall not include intelligence information, evaluative information or criminal offender record information as defined in G.L. c. 6, § 167. Protected Health Information, as defined below, constitutes a subset of personal data.

“Protected Health Information” (PHI) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual that the Contractor receives, creates or uses under the Agreement. The term PHI applies to the original data and to any data derived or extracted from the original data.

“Security Incident(s)” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PD or interference with system operations in an information system. Security Incidents do not include the thousands of routine attempts made annually to infiltrate systems automatically to which secure networks are continually subject.

III. OBLIGATIONS OF THE CONTRACTOR

Section 1. Compliance with State and Federal Law. The Contractor .acknowledges that in the performance of this Contract, it may receive Personal Data (PD) from or about the human subjects of the pilot. The Contractor acknowledges that by accepting the PD, it becomes a “holder” of the “Personal Data” within the meaning of Mass. Gen. Laws. c. 66A, FIPA, and will comply with the requirements of that law as well as all other applicable state or federal laws governing the privacy or security of any PD received or created under the Contract.

Section 2. Agreements with Third Parties. If the Health Connector or the Department authorizes the Contractor in advance to engage a subcontractor or an agent, and such subcontractor or agent receives PD from or creates or receives PD on behalf of the Contractor or the Health Connector or the Department, the Contractor shall obtain and maintain a written agreement with each agent or subcontractor. The agreement shall provide that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Contractor pursuant to this Confidentiality Agreement with respect to such PD, including but not limited to, implementing reasonable safeguards to protect the PD. All provisions of the Contract apply to all such PD, whether in the possession of the Contractor or any agent or subcontractor. The Contractor is responsible for ensuring each agent’s and subcontractor’s compliance with all applicable provisions of the Contract. Upon request, the Contractor shall provide the Department with a copy of the written terms between the Contractor and the subcontractor or agent.

Contractor shall vigorously enforce all privacy and security terms contained in its agreements with third parties who are classified in the Master Services Agreement as “Contractor Third Party Vendors”.

Section 3. Security: Appropriate Safeguards. The Contractor agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the PD residing in or on Contractor’s (or its subcontractor’s) internal environments (i.e., facilities, systems, equipment, applications, networks, Contractor-owned and managed applications, operating systems, and infrastructure (“ Contractor Managed Services”) and similar environments, managed applications, operating systems and infrastructure supporting services provided to the Commonwealth by the Contractor but owned by third parties (“Contractor Third Party Vendor Services”).

Such safeguards shall meet, at a minimum, ISO 27001 and specific standards for privacy and security established by the Department and the Commonwealth. Appropriate safeguards shall include, at a minimum:

· Providing appropriate privacy and security training for each of its employees, agents, or subcontractors who will have access to the Department’s PD.

· Requiring each of its employees, agents, or subcontractors having any access to or use of the PD to comply with applicable laws and regulations relating to confidentiality, privacy, and security of the PD.

· Protecting the physical and electronic security of the PD, including any data created, accessed, stored, or transmitted by electronic media.

· Taking steps to prevent unauthorized access to the PD, including preventing unauthorized access through the use of individual user accounts which are password protected and can be audited by Contractor for authorized and unauthorized access to the Contractor owned and managed applications, operating systems and infrastructure, and, to the extent that Contractor has access and control thereto, to any other third party systems which Contractor is required use in connection with its services delivered under the MSA (acknowledging that Contractor may not be able to audit all such third party systems).

· Data Backup – If applicable to the services to be provided under the MSA, the Contractor shall backup PD as is necessary to provide for the integrity and availability of all information required to perform Contractor’s obligations under the Contract. The Contractor shall ensure the security of all backup tapes and storage media. For purposes of clarification, any PD stored on Contractor shared IT backup media shall not be returned to the Health Connector but instead shall be erased within 90 days.

· If the Department’s PD is stored in a manner in which it cannot be segregated from other data maintained by the Contractor due to the choice of backup media and system, the Contractor shall continue to ensure the privacy and security of the Department’s PD so long as the backup media is needed based on Contractor’s policies. All protections pertaining to any PD covered by the Agreement shall remain in force for so long as the Contractor maintains such PD. To the extent feasible a separate back-up tape should be utilized for the PD under this contract.

· Upon request, the Contractor shall furnish the Department with a description of the steps it has taken to prevent use or disclosure of the PD not authorized by this Contract.

In addition to the foregoing, with respect to third party cloud services on which the Contractor Managed Services and Contractor Third Party Vendor Services are based, Contractor has entered contractual terms materially consistent with the foregoing privacy and security requirements.

For the avoidance of doubt, nothing in this Confidentiality Agreement is intended to or shall be interpreted to replace the privacy or security provisions set forth in the MSA or alter those requirements in a manner that would lessen the protection of PD. In the event of a conflict of privacy or security terms among the documents comprising the MSA the more protective standard shall control.

Section 4. Non-Secure Transmissions Prohibited. The Contractor agrees that it will not transmit the PD over any unsecured network.

· Transmissions of PD over the Internet are limited to secure transmission protocols approved in writing by the Department\

· All PD hosted by the Contractor, and accessible remotely, including via the Internet, must be secured through the use of firewalls and other perimeter security technologies and must be approved in writing by the Department.

Section 5. Reporting of Disclosures or Security Incidents. The Contractor agrees that it will notify the Department under this Contract both orally and in writing no later than (2) business day following discovery or notice of:

· any use or disclosure of PD not allowed by this Contract,

· any security incident involving or potentially involving the PD of an individual subject of the pilot.

Section 6. Mitigation. The Contractor shall promptly, upon becoming aware of any misuse or disclosure of PD in violation of the Contract or any security breach, take all reasonable and appropriate action necessary to: a) retrieve, to the extent practicable, any PD; b) mitigate, to the extent practicable, any harmful effect known to the Contractor; c) take such other action(s) as may be required in connection with the event to comply with any Applicable Law.

The Contractor shall also perform a root cause analysis, prepare a corrective action plan, and shall deliver a resolution report to the Department including root cause, and actions taken to resolve the event and prevent its recurrence.

Upon request, the Contractor shall take such further actions as the Department may reasonably request to, or shall take such additional action to assist the Department to further mitigate any harmful effect of the Event. Any actions to mitigate harmful effects of such event undertaken by the Contractor on its own initiative or pursuant to the Department’s request shall not relieve the Contractor of its obligations to report such event or otherwise comply with this Section, any other provisions of this Agreement or the Contract or Applicable Law.

Section 7. Notice of Request for Data. The Contractor agrees to notify the Health Connector and the Department within five (5) days of the Contractor’s receipt of any legal request, court order, or subpoena for PD. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Contractor agrees to cooperate fully with the Department in such challenge.

Section 8. Access to Records. The Contractor shall make available to the Department its internal practices, books, and records including policies and procedures relating to the use and disclosure of the PD received from the Department or created or received by the Contractor on behalf of the Department as well as security procedures. The Department shall determine the time and manner for making such material available.

IV. PERMITTED USES AND DISCLOSURES BY THE CONTRACTOR.

Section 1. Section 1. Uses and Disclosures of PD. The Contractor agrees to use or disclose PD that it receives from and/or creates or receives on behalf of the Department only as specified in this Section IV. for purposes of fulfilling its obligations under the Agreement.

Section 2. Minimum Necessary. The Contractor agrees to take reasonable steps to limit the amount of PD used and/or disclosed pursuant to Section 1 of this subsection to the minimum necessary to achieve the purpose of the use and disclosure.

V. TERMINATION OF CONTRACT WITH THE CONTRACTOR

Section 1. Termination of Contract. Upon termination of the Contract for any reason, including breach of its obligations regarding PD, pilot subject records shall be handled by the Contractor in accordance with Section 6 of the Commonwealth’s Terms and Conditions for Information Technology Contracts.

Section 2. Survives the Termination of the Contract. Notwithstanding any other provision concerning the term of the Contract, all obligations of the Contractor and protections pertaining to the privacy and security of PD under this Agreement shall continue so long as the Contractor retains any PD covered under this agreement.

VI. MISCELLANEOUS PROVISIONS

Section 1. Remedies. Nothing in this Agreement shall be construed to waive or limit any of the Department’s legal rights or remedies that may arise from the Contractor’s unauthorized use or disclosure of Personal Data or security breach. The Department’s exercise or non-exercise of any authority under the Agreement including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Contractor of any obligations as set forth herein nor be construed as a waiver of any of the Contractor’s obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the Contractor.

Section 2. Interpretation. Any ambiguity in this contract shall be resolved to permit the Department to comply with M.G.L. c. 66A, and any other law pertaining to the privacy or security of Personal Data.

The Contractor has caused its duly authorized representative to execute this Agreement.

(Insert Name of the Contractor)

By _________________________________

Title _________________________________

Date ______________________________ image1.png