Attachment E_Third Party Privacy Questionnaire.docx

ATTACHMENT E: THIRD PARTY PRIVACY QUESTIONNAIRE

REQUIRED – MUST SUBMIT WITH APPLICATION

Third Party Privacy Questionnaire Please fill in your company information below. Your company must have one person with responsibility for the privacy of information and day-to-day privacy management to act as, or to provide a designee to act as, the primary privacy contact for the University of Massachusetts Chan Medical School and/or ForHealth Consulting, a division of the University of Massachusetts Chan Medical School (“UMass Chan”).

General

1. Describe the services that your company expects to provide to UMass Chan as it relates to Protected Health Information (PHI) or Personal Information (PI).

2. List the number of full-time employees and part-time employees by location for your company.

a. Are your employees required to sign confidentiality agreements?

b. Does your company maintain its own privacy and security policies and procedures?

c. Do you perform criminal background checks on your employees?

d. Do you perform any other regulatory checks (OIG/GSA, SAM, LEIE, etc.) on your employees?

3. Will your company (including any subcontractors, cloud storage subcontractors, etc.) use, transmit, maintain or store information outside of the United States? If yes, please provide a description of the UMass Chan information, the location of where it will be used, transmitted, maintained or stored, and the purpose of the use, transmission, maintenance or storage of the information.

4. Do you use independent contractors or temporary employees? If so, please provide the number and location of contractors or temporary employees.

a. Do you have written contracts in place with your contractors and/or temporary employees?

b. Are criminal background checks performed on independent contractors and temporary employees?

c. Are other regulatory checks (OIG/GSA, SAM, LEIE, etc.) performed on independent contractors or temporary employees? If yes, please provide a list of regulatory checks performed and the frequency.

d. Who is responsible for ensuring the background checks and regulatory checks are completed?

e. Are independent contractors and/or temporary employees required to sign confidentiality agreements?

f. Are independent contractors and temporary employees required to comply with your company’s policies and procedures, including the ones related to privacy and security? Please describe the frequency and method used to ensure compliance.

5. Will your company subcontract any work that involves the use or disclosure of UMass Chan’s information? If yes, provide their name(s), location(s), a description of the services the subcontractor will perform and the UMass Chan information to which they will have access.

a. Do you have Business Associate contracts in place with your subcontractor(s)?

b. Does your Business Associate Agreement push down all terms and conditions included in the Business Associate Agreement with UMass Chan? If no, when will you amend the agreement to include these terms?

c. Will the subcontractor(s) (including, without limitation, any cloud storage subcontractors) use, transmit, maintain or store information outside the United States? If yes, please provide a description of the UMass Chan information, the location of where it will be used, transmitted, maintained or stored, and the purpose of the use, transmission, maintenance or storage of the information.

6. Has your company previously provided services as a HIPAA Business Associate?

7. Protected Health Information or Personal Information:

a. What personal information or protected health information will be involved with the contract?

b. What will be done with the data?

c. How many staff will have access (physical/and or logical) access to the data under the contract?

8. Does your company have cyber-liability insurance that covers security incidents? If yes, please provide coverage limits.

Training

1. Do you provide training on compliance, privacy, fraud, waste and abuse, and conflicts of interest upon hire and at least annually? Please provide a summary of the training provided, including a list of topics covered and the source of the training (for example, internally developed, outsourced training vendor, CMS, etc.)

a. Is the training required for all employees? How often?

b. Is the training required for all subcontractors? If not, do you certify with their employer or agency that they have received substantially similar training at least annually?

c. Who is responsible for ensuring the delivery of training for subcontractors?

d. How do you track and document that the training is complete?

Breach Response

1. Please provide your company’s policy and procedure for responding to a breach and for notifying UMass Chan of a breach or potential breach of its information.

2. Has your company had a breach of personal or protected health information (unauthorized acquisition, access, use or disclosure of protected health information, which compromises the security of privacy of the information) during the past three (3) years? If yes, provide information on the breach, including the method of identification, the steps involved in the resolution of the breach, and corrective actions taken to prevent a similar breach.

3. Has your company been subject to any enforcement actions, investigations, or litigation related to privacy or information security issues? If so, describe the circumstances.

4. Does your company have insurance coverage for data breaches?

Privacy

1. Does your company have policies and procedures in place that address the collection, use, disclosure and retention of PHI/PII? If so, please provide the applicable policies.

a. Is there a process for annual review and approval? Please describe the process and list the individuals with approval rights.

b. Are your employees trained on these policies and procedures?

c. Are your subcontractors required to comply with these policies and procedures?

d. Does your company deliver these policies to all employees? To subcontractors?

2. Please outline the steps involved when employees or subcontractors violate your privacy policies and procedures. Please provide your written policy for employee violations.

3. In performing the services on behalf of UMass Chan, will your company have direct contact with UMass Chan clients, providers, patients or other UMass Chan subcontractors? If yes, please explain the type of contact.

4. Will you disclose UMass Chan information to any third parties that are not your subcontractors (either at UMass Chan’s direction or as part of the work being proposed)? If yes, explain to whom disclosure will be made, what will be disclosed and the business purpose of the disclosure.

5. Does your company have a privacy officer who is responsible for oversight of your organization’s information handling practices?

6. Does your company have any concerns executing the Business Associate Agreement provided to you as written?

7. Does your company have a policy for handling subpoenas or other external requests for the personal information of your clients? If so, provide a copy.

8. Will personal information collected or used for your work with UMass Chan be used exclusively for the identified purposes in the contract? Identify the privacy controls in place to ensure this.

9. Has your company had an independent privacy review or audit by a third party or external agency in the last 12 months? If yes, please provide the name of the entity, the type of audit performed, and a summary of the results.

VENDOR ATTESTATION and SIGNATURE The vendor organization attests that the responses provided in this questionnaire are correct to the best of the signatory’s knowledge, and that the signatory is authorized to execute this questionnaire on behalf of the vendor.

Organization Name:

Authorized Signatory Name:

Authorized Signatory Title:

Signature:

Date:

image1.jpeg