Attachment D - City Security Compliance Standard Summary

This document is a security compliance standard attachment issued by the City of Houston, applicable to the Pharmacy Benefits Management Services contract. The standard establishes mandatory security requirements and compliance protocols that the selected PBM contractor must implement and maintain throughout the five-year initial contract term, plus any exercised renewal options extending to seven years maximum. The compliance standard serves as a binding exhibit to the RFP and defines the baseline security controls, data protection measures, and operational standards required to safeguard the City's self-funded medical plan information, employee health records, and related sensitive data. Contractors must demonstrate their ability to meet or exceed these security benchmarks during the proposal evaluation process and maintain continuous compliance throughout contract performance.

The security compliance standard outlines specific technical, administrative, and physical security requirements that the PBM contractor must implement to protect protected health information (PHI) and ensure regulatory compliance with applicable federal and state privacy laws. These requirements address areas including information technology security controls, access management, data encryption, audit trails, incident response procedures, business continuity planning, and employee training protocols. The standard serves as a prerequisite to contract award and establishes the compliance framework that will be monitored and verified throughout the contract period through regular audits, assessments, and performance reviews by the City of Houston.