Attachment F - DMCA~1.docx

Request for Quotes for MassHealth Printing, Mailing, Warehousing, and Fulfillment Services

ATTACHMENT F

DATA MANAGEMENT AND CONFIDENTIALITY AGREEMENT

This Data Management and Confidentiality Agreement (this “Agreement”) is made by and between the Executive Office of Health and Human Services, Office of Medicaid (“EOHHS”), and the [Contractor Name] (the “Contractor”). EOHHS and the Contractor are sometimes referred to herein individually as a “Party” and together as the “Parties.”

BACKGROUND, SCOPE AND definitions Background/Scope Pursuant to the Executive Office of Health and Human Services’ (EOHHS) Request for Quotes (RFQ) for Printing, Mailing, Warehousing, and Fulfilment Services, and on or about the date hereof, EOHHS and the Contractor entered into the MassHealth Printing, Mailing, Warehousing, and Fulfillment, and Mailing Services Task Order (“the Contract”) on [Date], to provide printing, mailing, warehousing, and fulfillment services for, or on behalf of, EOHHS;

The Parties are entering into this Agreement to establish certain privacy, security and related obligations of the Contractor with respect to PI and Commonwealth Security Information (each as defined below) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its provision of a service to, and/or its performance of a function or activity for or on behalf of, EOHHS under the Contract.

Definitions When used in this Agreement, the following capitalized terms shall have the meanings ascribed to them below:

“Activities” shall mean the activities, functions and/or services to be performed or provided by the Contractor for, on behalf of and/or to EOHHS under the Contract.

“Applicable Law” shall mean M.G.L. c. 66A, 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, the Health Insurance Portability and Accountability Act (HIPAA) Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, Subpart F (Medicaid Confidentiality Rule), 42 CFR Part 2, 45 CFR § 155.260 and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality, or security of PI or Commonwealth Security Information.

“Breach Notification Rule” shall mean the Breach Notification Rule at 45 CFR Part 164, Subpart D.

“Commonwealth Security Information” shall mean all data that pertains to the security of the Commonwealth’s information technology, specifically, information pertaining to the manner in which the Commonwealth protects its information technology systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users, or the provision of service to unauthorized users, including those measures necessary to detect, document and counter such threats.

“Enforcement Rule” shall mean the HIPAA Enforcement Rule at 45 CFR Part 160, Subparts C, D and E.

“EOTSS” shall mean the Massachusetts Executive Office of Technology Services and Security.

“Event” shall mean the following, either individually or collectively: 1) any use or disclosure of PI or Commonwealth Security Information not permitted under this Agreement; 2) any Security Incident; or 3) any other event that would trigger notification obligations under the Breach Notification Rule, M.G.L. c. 93H, other similar Applicable Law, or Third Party Agreement (defined below) requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of PI or Commonwealth Security Information.

“HIPAA Rules” shall mean 45 CFR Parts 160, 162, and 164, inclusive of the Privacy Rule, the Security Rule, the Breach Notification Rule and the Enforcement Rule.

“Individual” shall mean the person to whom the PI refers and shall include a person or organization who qualifies as a personal representative in accord with 45 CFR § 164.502(g).

“Online Tracking Technology” means any technologies that are used to collect and analyze information about how users interact with websites or mobile applications maintained by or on behalf of EOHHS.

“Privacy Rule” shall mean the Standards of Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

“PI” shall mean any Protected Health Information, any “personal data” as defined in M.G.L. c. 66A, any “patient identifying information” as used in 42 CFR Part 2, any “personally identifiable information” as used in 45 CFR §155.260, “personal information” as defined in M.GL. c. 93H, and Third Party Data (defined below in Section 2.1.B) and any other individually identifiable information that is treated as confidential under Applicable Law or agreement (including, for example, any state and federal tax return information) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its performance of the Activities. Information, including aggregate information, is considered PI if it is not fully de-identified in accord with 45 CFR §§164.514(a)-(c).

“Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.

“System” shall mean any EOHHS system, database, application or other information technology resource.

When used in this Agreement, the following terms shall have the same meaning as those terms have in the HIPAA Rules: Business Associate, Limited Data Set, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident and Workforce.

All other capitalized terms used in this Agreement, but not otherwise defined herein, or elsewhere in this Agreement, shall be construed in a manner consistent with the HIPAA Rules, M.G.L. c. 66A and all other Applicable Laws.

DATA MANAGEMENT AND CONFIDENTIALITY

Data Management and Confidentiality Obligations of the Contractor Compliance with Applicable Laws. The Contractor must comply with all Applicable Laws that may be in effect upon execution of, or as may be effective during the course of, this Agreement, including, but not limited to, the Privacy and Security Rules, 42 CFR 431, Subpart F, 42 CFR Part 2, and M.G.L. c. 66A. Without limiting the generality of the foregoing, the Contractor acknowledges and agrees as follows:

Obligations under M.G.L. c. 66A. The Contractor acknowledges that in performing the Activities it will create, receive, use, disclose, maintain, transmit or otherwise obtain “personal data” (as defined in M.G.L. c. 66A) and that, in so doing, it becomes a “holder” of such data for purposes of M.G.L. c. 66A. The Contractor agrees that in performing the Activities and otherwise complying with this Agreement it shall, in a manner consistent with the Privacy and Security Rules and other Applicable Laws, comply with M.G.L. c. 66A.

Business Associate. In performing the Activities, the Contractor acknowledges and agrees that it is acting as EOHHS’ Business Associate and agrees to comply with all requirements of the HIPAA Rules applicable to a Business Associate. To the extent that the Contractor carries out an obligation of EOHHS under the Privacy Rule pursuant to this Agreement or the Contract, the Contractor agrees that it shall comply with the requirements of such Rule that apply to the Contractor as EOHHS’ Business Associate in the performance of such obligation. This Agreement shall serve as the Business Associate Agreement between the Contractor and EOHHS.

Medicaid Confidentiality Rule. In performing the Activities, the Contractor acknowledges and agrees that to the extent the Contractor creates, receives, uses, discloses, maintains, transmits or otherwise obtains information concerning Medicaid applicants and beneficiaries, the Contractor agrees to do so and to otherwise perform the Contract in compliance with the Medicaid Confidentiality Rule at 42 CFR 431 Part F including but not limited to the requirement that the Contractor shall restrict the use or disclosure of information concerning Medicaid applicants and beneficiaries to purposes directly connected with the administration of the Medicaid State plan as described at 42 CFR 431.302.

42 CFR Part 2. The Contractor agrees that with respect to drug or alcohol abuse information that the Contractor receives, stores, processes, uses, creates or transmits that was obtained by a Part 2 Program, Lawful Holder, or EOHHS (as such terms are used in 42 CFR Part 2), it is bound by 42 CFR Part 2 and shall not use or disclose information except as permitted under 42 CFR Part 2 by a contractor receiving such information under 42 CFR §2.33(b). For example, the Contractor shall not use such information for the purposes of treatment, care coordination, or case management, or further redisclosure of such information to law enforcement, unless authorized under 42 CFR Part 2.

Telephonic Laws. To the extent the Activities involve outreach to or other contact with consumers (including Individuals), such contact shall be compliant with all applicable federal and state laws and regulations, including the Telephonic Consumer Protection Act of 1991 (47 U.S.C. §227) and its attendant regulations. To the extent the Activities involve call recording activities, the Contractor shall comply with all federal and state wiretapping and recording laws and regulations, including M.G.L. c. 272 §99.

Compliance with Third Party Agreements. The Contractor agrees that it shall comply (and shall cause its employees and other workforce members to comply) with any other privacy and security obligation that is required as the result of EOHHS (or EOTSS or another third party, on EOHHS’ behalf) having entered into an agreement (any such agreement, a “Third Party Agreement”) with a third party to obtain or to access PI from a third party (any such PI, “Third Party Data”) or to access any System containing Third Party Data or through which Third Party Data could be accessed, including, by way of illustration and not limitation, signing a written compliance acknowledgment or confidentiality agreement, undergoing a background check or completing training. The Parties acknowledge and agree that Third Party Data includes, without limitation, all data that EOHHS receives or obtains from Massachusetts Department of Revenue, the Social Security Administration, the Internal Revenue Service, the Department of Homeland Security or through the Federal Data Services Hub and, notwithstanding anything herein to the contrary, the Contractor may not access any such Third Party Data unless disclosure of such data to the Contractor is permitted under the applicable Third Party Agreement(s), all conditions for disclosure under such Agreement(s) have been satisfied and the Contractor’s access to such data is otherwise permitted under the terms of this Agreement.

Ownership and Control of Data. EOHHS is the lawful owner, lawful holder or license holder of all PI and Commonwealth Security Information (each as defined herein) provided to the Contractor in connection with the Contractor’s performance of the Services contemplated under the Contract and has the right to permit the Contractor access to or use of the PI and Commonwealth Security Information in connection with its performance of the Services, subject to the Contractor’s obligations under this the Contract (including this Agreement). The Contractor acknowledges that its access to, receipt, creation, use, disclosure, transmission and maintenance of any PI, and any data derived or extracted from such PI, arises from and is defined by the Contractor’s obligations under the Contract, and that the Contractor does not possess any independent rights of ownership to such data. Any PI and Commonwealth Security Information is provided “as is” and EOHHS hereby disclaims all warranties, whether express, implied, statutory, or otherwise. EOHHS specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or practice. EOHHS makes no warranty of any kind that the PI and Commonwealth Security Information, will be secure, accurate, complete, free of harmful code, or error free. In no event will EOHHS be liable under or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

Sanctions for Improper Access, Use or Disclosure of PI. The Contractor acknowledges that PI subject to this Agreement is highly regulated and the Contractor and its subcontractors, agents, employees and other workforce members may be subject to civil and criminal penalties under state and federal law for accessing, using or disclosing PI in violation of this Agreement or Applicable Law.

Requirements Applicable to Subcontractors, Agents, Employees and other Workforce Members.

Generally. Access to PI (including potential access) must be limited to subcontractors and agents approved by EOHHS, and employees and other workforce members who have been approved by the Contractor. Such individuals are only permitted to access PI if they require access to such data for purposes of carrying out the Activities. Subcontractors, agents, employees and other workforce members with access to PI must receive appropriate privacy and security training, must be informed of the confidential nature of PI, must agree to comply with limitations of this Agreement and other applicable terms required under the Contract and must be informed of the civil and criminal penalties for misuse or unauthorized disclosure of PI under Applicable Law. Without limiting the generality of the foregoing, all subcontractors, agents, employees and other workforce members with access to unencrypted PI or an encryption key used to secure such PI must sign the Confidentiality Acknowledgement attached hereto as Appendix A prior to being granted such access.

CORI Regulations. The Contractor shall, pursuant to and in accordance with 101 CMR 15.03(1)(B), require and consider the criminal history information pertaining to all employees and workforce members of the Contractor who will be given access or potential access to PI, and all applicants for employment with the Contractor where the position applied for entails access or potential access to PI. The Contractor shall otherwise comply with all applicable terms of 101 CMR 15.00 in connection with the review and consideration of employee and applicant criminal records.

Additional Requirements for Subcontractors and Agents.

The Contractor shall hire subcontractors and agents only with EOHHS’ prior written approval. The Contractor shall enter into written agreements memorializing the requisite terms of the Agreement with each subcontractor and agent that will have access to PI (each, a “Subcontract”) and shall maintain such Subcontracts.

All such Subcontracts must contain all requisite terms of this Agreement and the Contract (including the Commonwealth Terms and Conditions) related to the privacy and security of PI, and otherwise must be consistent with all such terms and conditions. Without limiting the generality of the foregoing, the Contractor shall ensure that any such Subcontract satisfies all applicable requirements under the Privacy and Security Rules for a contract or other arrangement with a Business Associate.

The Contractor shall require that any subcontractor or agent that needs access to Third Party Data or a System containing such Third Party Data or through which it may be accessed to comply (and to cause its employees and other workforce members to comply) with any privacy and/or security obligation that may be required under a Third Party Agreement. The Contractor shall ensure that any such subcontractor or agent has satisfied all such obligations prior to being granted access to the Third Party Data or System. The Contractor shall work with EOHHS to ensure that all such obligations are satisfied.

The Contractor is fully responsible for any subcontractor’s or agent’s performance and for meeting all terms and requirements of this Agreement. The Contractor will not be relieved of any legal obligation under this Agreement, regardless of whether the Contractor subcontracts for performance of any Agreement responsibility or whether PI or other information was in the hands of a subcontractor or agent.

Assignment. The Contractor shall not assign any of its rights or delegate any of its obligations under this Agreement without the prior written consent of EOHHS. Any purported assignment or delegation in violation of this Section is null and void. No assignment or delegation relieves Contractor of any of its obligations under this Agreement.

Data Security.

Administrative, Physical and Technical Safeguards. As of the Contract effective date, the Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PI and that prevent use or disclosure of such PI other than as provided for by this Agreement. All such safeguards must meet, at a minimum, and the Contractor shall otherwise comply with, all standards set forth in the Contract, Privacy and Security Rules, as applicable to a Business Associate, and all applicable EOHHS, EOTSS, other Commonwealth security and information technology resource policies, processes and mechanisms, including the EOHHS Acceptable Use Policy (found online at Mass.gov[footnoteRef:2]) and the EOTSS Enterprise Information Security Policies and Standards (found online at Mass.gov[footnoteRef:3]), and any standards contained in any applicable Third Party Agreement (collectively, the “Standards”). Contractor shall comply with any new or updated Standards issued by federal, state, or other issuing agency or entity. [2: EOHHS Acceptable User Policy, https://www.mass.gov/doc/eohhs-acceptable-use-policy/download#:~:text=applicable%20contractual%20obligations.-,EOHHS%20prohibits%20Users%20from%20using%20EOHHS%20Information%20Resources%20in%20a,EOTSS%20policies%2C%20standards%20or%20processes. ] [3: EOTSS, Enterprise Information Security Policies and Standards, https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards (last visited July 1, 2021). ]

The Contractor shall notify EOHHS of any change in its administrative, technical, or operational environments that compromise or otherwise impact the confidentiality, integrity, or availability of PI or any changes to the Contractor’s information controls which alters its conformance with the Standards.

Access to Facilities, Books, and Records. If the Contractor is subject to a Third Party Agreement which requires access to Contractor’s facilities, upon reasonable notice, the Contractor agrees to allow EOHHS representatives, Third Party Data representatives, and/or other data owners access to premises where PI is stored (including Contractor’s premises or its hosting facility) for the purpose of inspecting privacy and physical security arrangements implemented by the Contractor to protect such PI, compliance with Applicable Law or compliance with Federal grant requirements. EOHHS reserves the right to audit the performance of information security and privacy systems implemented by the Contractor. EOHHS retains the right to further inspect the Contractor’s books and records, including without limitation, Contractor’s information security plan, business continuity plan, disaster recovery plan, or other documentation required to be maintained pursuant to the Standards or otherwise in this Agreement.

System Access. When accessing any System to perform the Activities, the Contractor shall comply with all applicable EOHHS, EOTSS, and other Commonwealth security and information technology resource policies, processes and mechanisms regarding access to PI, and any specific security mechanisms and processes adopted by EOHHS or EOTSS for access to the System. The Contractor shall protect from inappropriate use or disclosure any password, user ID or other mechanism or code permitting access to any System containing PI or through which PI may be accessed. The Contractor shall not permit the sharing of login or access credentials between its personnel. The Contractor shall give the EOHHS System owner prompt notice of any change in personnel whenever the change requires a termination or modification of any such password, user ID or other security mechanism or code, to maintain the confidentiality and integrity of the System.

Contractor System Development. If the Contractor is developing a System, the Contractor must adhere to the requirements outlined in the most current revision of the EOTSS Enterprise Information Security Standards. In the event Contractor is engaging in any management or maintenance of the System, that work must adhere at all times and at a minimum to the requirements outlined in the most current revision of the EOTSS Enterprise Information Security Standards. If any of those requirements are undefined or require implementation by a System team, then vendor must seek such requirements during the requirements gathering phase of the Project. The work effort outlined hereunder will not be deemed “complete” or “accepted” without complete documented implementation to all EOTSS Enterprise Information Security Standards accepted in writing by the EOHHS Chief Information Security Officer or its designee.

5. Periodic Review. The Contractor shall monitor, periodically assess, and update its security controls and related system risks to ensure the continued effectiveness of those controls. Contractor must represent its conformance to the Standards by conducting an internal review of its compliance with the Standards on an annual basis. Such internal review will include an industry-standard vulnerability of the Contractor’s environment. Such internal review will also include attestation to and a demonstrable validation review of the ongoing functionality of the controls. In the event Contractor is not compliant with some aspect of the Standards, Contractor agrees to remediate such gap(s) in compliance within a reasonable timeframe. If Contractor cannot remediate such gap(s) within a reasonable timeframe, EOHHS reserves the right to implement a pro-rated modification of payments to the Contractor until compliance is reached.

6. Contractor Responsibilities. Contractor understands that it is solely responsible for meeting the Standards, as applicable, and for managing its information security program.

0. Commonwealth Security Information. If the Contractor obtains access to any Commonwealth Security Information in connection with this Agreement, the Contractor may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Contractor shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Contractor shall not release or disclose such information except in accord with EOHHS’ express written instructions, unless such disclosure is Required by Law and then only in accordance with this Agreement (including Section 2.2B hereof). While in possession of such information, the Contractor shall apply all applicable privacy and security requirements set forth in this Agreement to maintain the confidentiality, security, integrity and availability of such information. Notwithstanding any other provision in this Agreement regarding termination, the Contractor may not retain any Commonwealth Security Information upon termination of this Agreement unless such information is expressly identified in any retention permission granted in accord with Section 3.2B. If retention is expressly permitted, all data protections stated herein survive termination of this Agreement and shall apply for as long as the Contractor retains the information.

8. Written Information Security Program. The Contractor shall ensure that it maintains a written information security Program (WISP) in compliance with the terms of this Agreement, including, but not limited to, M.G.L. c. 93H.

9. The Contractor shall not access or store any PI or access any System outside of the United States. In addition, any remote connection to Commonwealth networks shall be in accordance with IS.006 of the EOTSS Enterprise Information Security Policies and Standards.

10. The Contractor shall not use Online Tracking Technology in a manner that would result in impermissible disclosures of PI as defined in this agreement or any other violation of the MassHealth Notice of Privacy Practices or the Applicable Law.

Obligations upon a Non-Permitted Use or Disclosure of PI or other Event.

Mitigation and Other Activities. Immediately upon becoming aware of an Event, the Contractor shall take all reasonable and appropriate action necessary to:

retrieve, to the extent practicable, any PI or Commonwealth Security Information involved in the Event;

mitigate, to the extent practicable, any harmful effect of the Event known to the Contractor; and take such other action(s) as may be required in connection with the Event to comply with any Applicable Law.

Upon request, the Contractor shall take such further actions as EOHHS may reasonably request, or shall take such reasonable additional action to assist EOHHS, to further mitigate any harmful effect of the Event. Any actions to mitigate harmful effects of such Event undertaken by the Contractor on its own initiative or pursuant to EOHHS’ request shall not relieve the Contractor of its obligations to report such Event or otherwise comply with this Section 2.1G, any other provisions of this Agreement or the Contract or Applicable Law.

Notification and Reporting Activities. As soon as possible, but no later than twenty-four (24) hours after Contractor becomes aware of the Event, the Contractor shall verbally report the Event to EOHHS with as much of the details listed below as possible, and shall follow such verbal report within three (3) business days with a written report outlining the Event with the following information:

The date of the Event or the estimated date (if date unknown);

The date of the discovery of the Event;

The nature of the Event, including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events);

The nature of the PI or Commonwealth Security Information involved in the Event (e.g., the types of identifiers and other information involved), together with samples of any forms or documents that were involved in the Event to illustrate the type of PI involved (with personal identifiers removed or redacted);

The exact number of individuals whose PI was involved in the Event if known or, if unknown, a reasonable estimate based on known facts (categorized according to the type of PI involved, if different types of PI was involved for different individuals), together with a description of how the number of individuals was determined;

A summary of the nature and scope of the Contractor’s investigation into the Event;

The harmful effects of the Event known to the Contractor, all actions the Contractor has taken or plans to take to mitigate such effects, and the results of all mitigation actions already taken;

A summary of steps taken to prevent such Event in the future, including copies of revised policies and procedures, changes in business processes and staff training; and Any additional information and/or documentation that the Contractor is required to provide to EOHHS under 45 CFR §164.410, M.G.L. c. 93H, §3(a) or other similar Applicable Law.

If an Event is the result of a Security Incident, such as hacking, ransomware, or other related Event, the Contractor shall prepare and provide a written forensics report to EOHHS that shall, at a minimum, describes the attack, security vulnerabilities, and any other information EOHHS deems necessary. Such information, documents, and deliverables shall not be redacted or withheld by the Contractor.

To the extent that any such information is not available at the time of the report, the Contractor shall provide such information to EOHHS as such information becomes available in one or more subsequent written reports. The Contractor shall provide EOHHS with such additional information regarding the Event as EOHHS may reasonably request, which additional information may include a written risk analysis rebutting any presumption that the Event constituted a breach for purposes of the Breach Notification Rule. Notwithstanding the foregoing, any Event involving “return information” (as defined in 26 U.S.C. §6103(b)(2)) must be reported to EOHHS within one (1) hour of discovery.

Obligations under Consumer Notification Laws. If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement as a result of the Event, the Contractor shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement, but in no event shall the Contractor have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Contractor to do so in writing. Additionally, at EOHHS’ direction, the Contractor shall provide credit monitoring services to affected Individuals as required under M.G.L. c. 93H, §3A or other Applicable Law.

Reimbursement for Costs. The Contractor shall reimburse and indemnify, defend and hold harmless EOHHS for all costs incurred or sustained by EOHHS in responding to, and mitigating damages caused by, any Event or third party claims or causes of action brought or asserted against EOHHS involving:

the Contractor’s failure to meet its responsibilities under, or in violation of, any provision of this Agreement or the Contract;

the Contractor’s violation of Applicable Law;

the Contractor’s negligence;

the Contractor’s failure to protect data under its control with encryption or other security measures that constitute an explicit safe-harbor or exception to any requirement to give notice under Applicable Law; or any activity or omission of the Contractor resulting in or contributing to an Event.

Such costs may include, for example and without limitation, losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees and the costs associated with any notification required under subsection 3, above, including staffing and materials costs. Alternatively, at EOHHS’ direction, in lieu of reimbursing EOHHS for such any such costs the Contractor shall, at Contractor’s expense, conduct any such notification or other mitigation related activity on EOHHS’ behalf. This provision shall apply in addition and separate to any generally applicable indemnification provision applicable to the Contractor.

Response to Legal Process. The Contractor shall report to EOHHS, both verbally and in writing, any instance where PI or any other data obtained in connection with this Agreement is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under Massachusetts law). The Contractor shall provide such report to EOHHS as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. In response to such legal process, and in accordance with instructions from EOHHS, the Contractor shall take all reasonable steps, including objecting to the request when appropriate, to comply with M.G.L. c. 66A § 2(k), 42 CFR § 431.306(f), 42 CFR Part 2 and any other Applicable Law. If EOHHS determines that it shall respond directly, the Contractor shall cooperate and assist EOHHS in its response.

Individual’s Privacy Rule Rights. With respect to any relevant PI in the Contractor’s possession, the Contractor shall take such action as may be requested by EOHHS to meet EOHHS’ obligations under 45 CFR §§ 164.524, 164.526 or 164.528 or other Applicable Law pertaining to an Individual’s right to access, amend or obtain an accounting of uses and/or disclosures of its PI, in sufficient time and manner for EOHHS to meet its obligations under such Privacy Rule provisions or other Applicable Law. If an Individual contacts the Contractor with respect to exercising any rights the Individual may have under 45 CFR §§ 164.524, 164.526 or 164.528 or similar Applicable Law with respect to PI in the Contractor’s possession, the Contractor shall notify EOHHS’ Privacy Officer within two business days of the Individual’s request and cooperate with EOHHS to meet any of its obligations with respect to such request.

With respect to an Individual’s right to an accounting under 45 CFR § 164.528, the Contractor shall document all disclosures of, and access to, PI as would be necessary for EOHHS to respond to a request by an Individual for an accounting in accord with 45 CFR § 164.528. The Contractor shall also document uses and disclosures of PI and other data access activities to the extent required under M.G.L. c. 66A, § 2(f).

Individual’s Direct Authorization to Disclose PI to Third Party. In the event Contractor receives a request from the Individual or from a third party to release PI to a third party pursuant to a consent, authorization, or other written document, Contractor shall, within three business days of receipt of such consent, authorization, or other written document, notify EOHHS and shall cooperate with EOHHS in confirming the validity and sufficiency of such document before releasing any PI to the third party.

Record Access. The Contractor shall make its internal practices, books and records, including policies and procedures, relating to the protection, security, use and disclosure of PI and Commonwealth Security Information obtained under this Agreement, and the security and integrity of Systems containing PI or Commonwealth Security Information or through which it may be accessed, available to EOHHS and the Secretary, in a time and manner designated by the requesting party, for purposes of enabling EOHHS to determine compliance with this Agreement or for purposes of enabling the Secretary to determine compliance with the HIPAA Rules.

Inventory of Systems/PI. The Contractor shall maintain an accurate and updated list of electronic and paper databases and other Systems containing PI, together with a description of the type(s) of PI contained in such databases and Systems and the various uses of the databases and Systems. If Contractor is a Recipient of Third Party Data, such list will also include the individuals who have access to that Third Party Data.

Compliance Officer. The Contractor shall designate a Compliance Officer, who shall be responsible for overseeing the Contractor’s compliance with this Agreement. Such designation shall be provided to EOHHS on the effective date of the Contract and may be changed during the period of this Agreement only by written notice.

Destruction of PI and Commonwealth Security Information during Contract Term. The Contractor shall retain PI and Commonwealth Security Information during the course of the Contract in accordance with the terms of this Contract and all applicable state and federal retention laws and regulations. If, in accordance with such requirements, Contractor determines that, during the course of the Contract, it is appropriate to destroy PI or Commonwealth Security Information, it shall do so only after obtaining EOHHS’ written permission. In the event destruction is permitted, Contractor shall destroy PI in accord with standards set forth in NIST Special Publication 800-88, Guidelines for Media Sanitization, M.G.L. c. 93I and other Applicable Laws relating to the destruction of confidential information, including PI, all applicable state and federal retention laws and regulations, and all state data security policies including policies issued by EOHHS and EOTSS. Within five (5) days of destroying PI or Commonwealth Security Information in accordance with the requirements of this paragraph, Contractor shall provide EOHHS with a written certification that destruction has been completed in accord with the required standards set forth herein.

Permitted Uses and Disclosures of PI by the Contractor Except as otherwise limited in this Agreement, including in this Section 2.2, the Contractor may use or disclose PI only as follows:

Activities. The Contractor may use or disclose PI to perform the Activities or as otherwise required by, and in accordance with, the provisions of this Agreement; provided, that such use or disclosure would not: (i) violate the Privacy Rule or other Applicable Law including the Medicaid Confidentiality Rule at 42 CFR 431, Subpart F if done by EOHHS; (ii) violate the EOHHS’ policies and procedures that are known to the Contractor or that EOHHS advises the Contractor of; or (iii) conflict with statements in the MassHealth Notice of Privacy Practices.

When using or disclosing PI or when requesting PI from EOHHS or another party in performing the Activities, the Contractor represents that it shall make reasonable efforts to limit the amount of PI used, disclosed or requested to the minimum necessary to accomplish or perform the particular Activity for which the PI is being used, disclosed or requested.

Required by Law. The Contractor may use or disclose PI as Required by Law, consistent with the restrictions of the HIPAA Rules, 42 CFR Part 431, Subpart F, 42 CFR Part 2, M.G.L. c. 66A, any other Applicable Law, or applicable Third Party Agreement.

Restriction on Contacting Individual. The Contractor shall not use PI to contact or to attempt to contact an Individual unless such contact is a permitted Activity, or made in accordance with EOHHS’ written instructions.

Publication and Research Restriction. The Contractor shall not use PI for any publication, statistical tabulation, research, report or similar purpose, regardless of whether or not the PI can be linked to a specific individual or has otherwise been de-identified in accord with the standards set forth in 45 CFR §164.514, unless the Contractor has obtained EOHHS’ prior written consent and the Contractor provides EOHHS a license to such information. In no event shall any resulting publication, report, or other material contain PI unless the publication, report, or other material is made available only to EOHHS or the Contractor has obtained the specific written approval of EOHHS’ Privacy Officer.

Data Management and Confidentiality Obligations of EOHHS Notice of Privacy Practices. EOHHS shall make the MassHealth Notice of Privacy Practices is available online at: https://www.mass.gov/service-details/masshealth-brochures-and-pamphlets. EOHHS may notify the Contractor in writing of any change in the MassHealth Notice of Privacy Practices to the extent that such change may affect the Contractor’s use or disclosure of PI under this Agreement.

Notification of Changes in Authorizations to Use or Disclose PI. EOHHS shall notify the Contractor in writing of any change in, or revocation of, permission by an Individual to use or disclose PI that is known to EOHHS, to the extent that such change may affect the Contractor’s use or disclosure of PI under this Agreement.

Notification of Restrictions. EOHHS shall notify the Contractor in writing of any restriction to the use or disclosure of PI that EOHHS has agreed to in accord with 45 CFR §164.522, to the extent that such restriction may affect the Contractor’s use or disclosure of PI under this Agreement.

Requests to Use or Disclose PI. EOHHS shall not request that the Contractor use or disclose PI in a manner that would violate the Privacy Rule or other Applicable Law if done by EOHHS.

TERM, TERMINATION AND EFFECT OF TERMINATION

Term and Termination.

This Agreement shall be effective upon execution by each party and shall terminate upon the termination or expiration of the Contract, unless earlier terminated by EOHHS in accordance with subsection B, below.

If EOHHS determines, in its sole discretion, that the Contractor has violated any material term of this Agreement or the Contract pertaining to the privacy or security of PI, EOHHS may terminate this Agreement and the Contract immediately upon written notice to the Contractor.

Effect of Termination Except as provided in subsection B immediately below, upon termination of this Agreement for any reason whatsoever (including expiration), the Contractor shall, at EOHHS’ direction, either return or destroy all PI and Commonwealth Security Information, and the Contractor shall not retain any copies of such PI or Commonwealth Security Information in any form. In no event shall the Contractor destroy any PI or Commonwealth Security Information without first obtaining EOHHS’ approval. In the event destruction is permitted, the Contractor shall destroy PI and Commonwealth Security Information in accord with standards set forth in NIST Special Publication 800-88, Guidelines for Media Sanitization, all Applicable Laws and applicable retention laws and regulations and all data security policies including policies issued by EOHHS and EOTSS. This provision shall apply to all PI and Commonwealth Security Information in the possession of the Contractor’s subcontractors, and the Contractor shall require that all such information in the possession of its subcontractors and agents be returned or destroyed and that no subcontractor or agent shall be permitted to retain any copies of such information in any form, in accord with EOHHS’ instructions. The Contractor shall, within three (3) business days of the return or destruction of PI and Commonwealth Security Information, certify to EOHHS in writing that all PI and Commonwealth Security Information has been returned or destroyed in accordance with this Section 3.2 and neither the Contractor nor any of its subcontractors or agents retains any PI or Commonwealth Security Information.

If the Contractor determines that returning or destroying PI or Commonwealth Security Information is not feasible, the Contractor shall provide EOHHS written notification of the conditions that make return or destruction not feasible. If, based on the Contractor’s representations, EOHHS concurs that return or destruction is not feasible, the Contractor shall extend all protections pertaining to PI and/or Commonwealth Security Information set forth in this Agreement to all such information and shall limit further uses and disclosures of such information to those purposes that make its return or destruction not feasible, for as long as the Contractor (or any of its subcontractors) maintains any PI or Commonwealth Security Information.

ADDITIONAL TERMS AND CONDITIONS

Notices. Unless otherwise specified herein, all notices, reports, requests, consents, claims, demands, waivers and other communications provided under this Agreement (each, a “Notice”) shall be in writing and shall be deemed to have been given to a Part: (i) when delivered by hand; (ii) on the date sent by facsimile or by e-mail if sent during normal business hours of the Party, and on the next business day if sent after normal business hours of the Party; or (iii) on the third day after the date deposited in the U.S. Mail, first class, postage pre-paid, provided, that, in each case, the Notice is delivered or addressed to the Party’s contact person(s) at the address(es) identified below (or to such other contact person(s) at such other address(es) as the recipient may from time to time specify in a notice given in accordance with this Section 4.1):

EOHHS:

The General Counsel’s Office Executive Office of Health and Human Services 1 Ashburton Place, Floor 11 Boston, MA 02108 privacy.officer@mass.gov

Contractor:

Amendment. This Agreement may be amended by the Parties at any time; provided, that any amendment must be in writing and must be signed by each Party. The Contractor shall promptly execute and comply with any amendment to this Agreement that EOHHS determines is necessary to ensure compliance with all applicable statutes, orders, and regulations promulgated by any federal, state, municipal, Third Party Agreements, or other governmental authority pertaining to the privacy or security of PI, including any Applicable Law. Such requisite amendment may cover all activities and PI collected under the original Contract. The Contractor’s failure to amend this Agreement in accordance with the foregoing sentence shall be considered a breach of a material provision for purposes of Section 3.1B. The Parties agree to negotiate in good faith to cure any omissions, ambiguities, or manifest errors herein.

Survival. Notwithstanding any other provision concerning the term of this Agreement or the Contract, all protections and other obligations of the Contractor pertaining to PI and/or Commonwealth Security Information set forth herein and in the Contract shall survive the termination of this Agreement and shall continue to apply until such time as all such information is returned or destroyed in accordance with Section 3.2 or, if later, until any outstanding obligation of the Contractor with respect to such information has been satisfied.

Interpretation.

Any ambiguity in this Agreement shall be resolved to permit EOHHS to comply with the HIPAA Rules, 42 CFR Part 431, Subpart F, M.G.L. c. 66A and any other Applicable Law.

For purposes of this Agreement, (i) the words “include,” “includes” and “including” shall be deemed to be followed by the words “without limitation”; (ii) the word “or” is not exclusive; and (iii) the words “herein,” “hereof,” “hereby,” “hereto” and “hereunder” refer to this Agreement as a whole. The definitions given for any defined terms in this Agreement shall apply equally to both the singular and plural forms of the terms defined. Whenever the context may require, any pronoun shall include the corresponding masculine, feminine and neuter forms.

Unless the context otherwise requires, references herein to: (i) Sections, Attachments and Appendices mean the Sections of, and Attachments and Appendices attached to, this Agreement; (ii) an agreement, instrument or other document means such agreement, instrument or other document as amended, amended and restated, supplemented and modified from time to time to the extent permitted by the provisions thereof; and (iii) a statute or regulation, including an Applicable Law, refers to that law or regulation as in effect or as amended from time to time and includes any successor legislation or regulation.

The Attachments and Appendices referred to herein shall be construed with, and as an integral part of, this Agreement to the same extent as if they were set forth verbatim herein.

Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, but all of which together shall be deemed to be one and the same agreement. A signed copy of this Agreement delivered by email, facsimile or other means of electronic transmission shall be deemed to have the same legal effect as delivery of an original signed copy of this Agreement.

[INTENTIONALLY LEFT BLANK, SIGNATURE PAGE FOLLOWS]

IN WITNESS THEREOF, the Parties have caused their duly authorized representatives to execute this Data Confidentiality and Management Agreement as of the date(s) written below.

EOHHS:

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES,

OFFICE OF MEDICAID

By:

Date:

CONTRACTOR:

By:

Name:

Title:

Date:

APPENDIX A

ACKNOWLEDGMENT REGARDING CONFIDENTIALITY OF PROTECTED INFORMATION

I, the undersigned, understand that in the course of my work for ___________________, (name or organization) relating to a contract with the Executive Office of Health and Human Services (EOHHS), I may have access to protected information- (“PI”)-including protected health information, other personally identifiable information or security information--either provided by EOHHS or created or obtained on its behalf.

I understand that PI is confidential and access to, use of and disclosure of PI is regulated by federal and state law including, without limitation, the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and M.G.L. c. 66A, and the terms of the EOHHS contract.

I recognize that the unauthorized access, use or disclosure of PI may cause serious harm to individuals. Unauthorized access, use or disclosure of PI may also violate the terms of the EOHHS contract and/or federal or state law, which may result in civil or criminal penalty including, without limitation, fines and imprisonment.

Acknowledged and agreed:

Protected Information User’s name (printed or typed):

Protected Information User’s Signature:

Date:

Contractor:

NOTE: Appendix A need not be submitted to EOHHS. Appendix A must be retained by the Contractor and made available EOHHS upon request.