Attachment F Scope of Service

APCD Data Collection Module eRFP – Attachment F

STATE OF GEORGIA

OFFICE OF HEALTH STRATEGY AND COORDINATION

APCD - SCOPE OF SERVICES

eRFP Attachment F – Scope of Services

(For Reference Only)

The Supplier is responsible for providing the systems and services associated with the APCD Data Collection Module. Services are to include project management, stakeholder engagement, launch of a submitter portal, design and implementation of a Data Submission Guide, support for payer/submitter data submission issues, ingestion and mapping of submitter data, design of a limited dataset, and exports of such dataset.

In addition, Supplier is responsible for maintaining the security of the environment in which the data is stored and for operating that environment in a manner which complies with appropriate k frameworks.

The following subsections describe State Entity’s minimum basic requirements.

A. Initial Launch

The State Entity requires the Supplier to deliver a system and services to meet initial launch technical requirements for a functional APCD Data Collection Module that will ingest and hold Medicaid, State Health Benefit Plan (SHBP), and commercial health plan data that has been validated for data quality and is available for analysis. Supplier requirements shall include the following :

1. Implement a process by which APCD data submitters can register and transmit monthly claim files

2. Provide an APCD Data Collection Module capable of receiving and successfully processing (editing, cleansing, rejecting, updating, etc.) claims from Medicaid, the State Health Benefit Plan (SHBP), and commercial health plans

3. Aggregate and link claims data using Master Member and Provider indices to accurately link patients across different providers and payers, and longitudinally over time

4. Implement a secure data submission portal including:

a. Accept historical data from January 2018 onward

b. Accommodate variations in reporting file format for specific payer types

c. Provide reports to GTRI-CHAI summarizing portal performance and identifying potential issues in regards to the submission process

d. Accept and process monthly data submissions

5. Supplier collection and processing of data from submitters, which shall include but not be limited to:

a. Securely collecting data via a Submitter Portal

b. Quality assurance testing, based on specifications to be developed by

Supplier, approved by GTRI-CHAI, and shared with submitters

c. Acceptance or rejection of submissions, ensuring compliance with reporting specifications, and providing feedback on required data submissions

d. Providing feedback to APCD data submitters about all failed submissions within five (5) business days of receipt

e. Identifying the need for, accept, and process replacement submissions

f. Maintaining a system to allow test submissions from submitters

g. Providing State Entity with original data set backup copies to satisfy

Business Continuity Plan controls

h. Retaining archival copies of all accepted submissions.

6. Applies robust deidentification algorithms allow data to be aggregated and linked

7. Applies Master Index IDs to all patients and providers. The IDs should permit linking to support mission critical data analytics, such as longitudinal analysis.

a. Data matching of patients and providers will be performed across all

APCD submissions.

8. Supplier development of a Data Quality Assurance Plan and processes, including:

a. Development, documentation, execution, and maintenance of processes for discovery, documentation, and mitigation of data quality issues identified throughout the data lifecycle, including source data intake, Extract, Transform, and Load (ETL) processing, and integration and creation of data extracts

b. Methods of validation for field level data validity and completeness in comparison to relevant national and regional benchmarks

c. Reporting to State Entity and GTRI-CHAI on data quality activities and providing information necessary for data quality oversight

d. Details of processes and resources (e.g. information and personnel) provisioned for data quality oversight

e. Mechanisms for communication with submitters during the process of data intake including:

i. Scope and content of data intake validation and reasonableness checks for submitter’s data quality and completeness

ii. Technical assistance

iii. Customizing data quality checks based on submitter requirements and approved changes or exceptions from GTRI-CHAI

iv. Obtaining and using reference data

f. Development of a plan for remediation of data quality issues discovered post-data intake, including:

i. Quality problem identification methods

ii. Problem resolution resources and processes

iii. Documentation and reporting to submitters and GTRI-CHAI/State

Entity with examples of report content

9. Development of a Data Integration Plan, to include:

a. Implementation of data validation and system coding, in collaboration with submitters, to accurately reflect multiple eligibility and program participation categories (e.g., benefit structures and “local” program service designations) and to map those categories into a common taxonomy

b. Documentation, execution, and maintenance of processes to support use of master unique identifiers across persons and providers to support linking claims for longitudinal analyses and identification of all services provided to a person

c. Development, documentation, execution, and maintenance of processes for claims versioning to ensure the most recent version of a claim is the one present in a current Limited Data Set

d. Development, documentation, execution, and maintenance of processes for identifying Coordination of Benefits (COB) claims and combining them to reflect a total paid amount across multiple payers

e. Overall standards for software development work, such as coding conventions, use of Application Program Interfaces (API), and database and field naming conventions and methods and considerations for adjusting if necessary to comply with GTA and GTRI-CHAI standards and policies

10. The Data Collection Module provided by Supplier may be hosted either by the Supplier or in a State of Georgia AWS cloud. Regardless of hosting provider:

a. Web services shall be used to interface with the APCD data

b. Any licenses, client software, or plug-in downloads necessary will be provided to State Entity/GTRI-CHAI

c. Controls for data storage, data encryption, data destruction, data location, and data handling shall be employed.

11. Development and implementation of a plan for creation and transmission of data extracts, including:

a. Creation of a database with clean, integrated, and deidentified data, the

“limited data set” (LDS), updated with newly collected data, using data formats and structures as required by GTRI-CHAI

b. Creation of processes to define, create, and securely transmit to GTRI- CHAI data extracts of the LDS

c. Documentation of data extract processes and tools, including data dictionaries for each LDS generation and technical support resources that will be provided for extracts

12. Development of a data submission guide including:

a. The process for working with GTRI-CHAI and data submission advisory workgroups to finalize processes and content of data submission

b. A detailed description of content in data submission guide

13. Development and documentation of architecture and design that complies with CMS Conditions and Standards (C&S) to ensure enhanced Federal funding.

Georgia APCD Data Collection Module Initial Launch Timeline

Table 1 lists the key milestones for implementation of Initial Launch of the APCD Data Collection Module, with an assumption of contract execution in June, 2022. These milestones are included to provide Suppliers responding to this eRFP context and timing for the overall implementation of the APCD Data Collection Module. Please note that these dates reflect the plan as of publication of this eRFP and are subject to change.

Table 1: Milestones for implementation of APCD Data Collection Module

Data Collection Module APCD Milestones Date State Entity - Data collection Supplier contract executed June 2022

State Entity/GTRI-CHAI/Supplier - Data submission rules finalized July 2022 Supplier - Legal agreement for data submission approved for execution and education on data submission format and requirements August 2022

Supplier - Data submission portal is ready to begin accepting commercial pilot group test data and Medicaid/SHBP data October 2022

GTRI-CHAI/Supplier - Audit of Supplier data submission quality assurance processes completed satisfactorily January 2023

Supplier - First LDS release provided to GTRI-CHAI January 2023

B. Ongoing Operations

After initial launch, the State Entity requires the Supplier to provide ongoing operations of the APCD Data Collection Module, including but not limited to:

1. Hosting/Software License

a. Providing websites and services to allow submission of files as well as access to the LDS in a US-based hosting center

b. Providing any licenses, client software, or plug-in downloads required to access and operate the Data Collection Module

c. Maintaining controls for data storage, data encryption, data destruction, data location, and data handling

d. Security incident and data breach notification, as described in Data

Location and Security

e. Patching and upgrades

a. Change control and maintenance.

2. Providing registration, onboarding, and training of submitters including:

a. Development of an onboarding plan and regular status reporting of registration and onboarding efforts

b. Tools and processes for outreach, registration, education, training, and onboarding, and providing support to ensure timely problem-solving

c. Practices that document support functions, report patterns of issues, and alerts for GTRI-CHAI to engage with Supplier and submitter in problem solving

d. Collecting and maintaining current information for each submitter

e. Continued registration and onboarding of payers

f. Registration and onboarding of voluntary submitters.

3. Provide submitters with a data submission guide including:

a. The process for working with GTRI-CHAI and data submission advisory work groups to finalize processes and content of data submission

b. A detailed description of content in data submission guide

c. Working with submitters and GTRI-CHAI to update the data submission guide based on experience and changing needs

d. Performing annual registration of submitters

e. Providing data submitters with a complete list of all validation checks that will be run against their data. This list should include all data validation and “reasonableness” checks beyond just the DSG element thresholds (e.g. non-United States/Canadian addresses and dates that are in the future)

4. Adopt and implement updated versions of data submission standards as they become available:

a. Develop an implementation plan, in collaboration with GTRI-CHAI, to transition submitters to revised data layout and data fields.

b. Work with submitters to understand new requirements, naming conventions, fields etc.

c. Develop version crosswalk to facilitate the transition to new data submission requirements, provide GTRI-CHAI with a dictionary of new/modified fields

d. Provide quality, submitter compliance and implementation status reports to GTRI-CHAI

5. Following up with submitters on data issues and responding to questions and comments from submitters.

6. Receiving and successfully processing (editing, cleansing, rejecting, updating, etc.) commercial insurance plan claims, including individual, small group, and large group commercial claims as well as Medicare, Medicaid, pharmaceutical, Workers Compensation claims, Department of Corrections claims, and other data described in legislation. This will include receiving and successfully processing claims from voluntary submitters, including plans subject to ERISA regulations.

7. Maintaining a secure environment, as described in the Data Location and Security section of this eRFP throughout the life of the Contract.

8. Quarterly, and as needed, providing data sets to State Entity and GTRI-CHAI in agreed upon format, including replacements of any prior time periods for data that has changed.

9. Providing public use data sets, updated quarterly to GTRI-CHAI for publication to a website

10. Providing custom data sets to researchers and other parties, within 10 business days of approval by GTRI-CHAI

11. Producing, maintaining, and publishing complete documentation of the data sets including logic used to transform data and create derived data elements

12. Tracking and communicating to State Entity and GTRI-CHAI overdue and otherwise non-compliant submitters, and providing insight to State Entity and GTRI-CHAI on whether enforcement actions are warranted.

13. Integration of Medicare data including, but not limited to:

a. Development of a work plan

b. Participation in interactions with federal partners at Medicare in the

Centers for Medicare and Medicaid Services (CMS)

c. Meeting the CMS requirements to serve as the Custodian of Medicare files containing Protected Health Information (PHI)

d. Supporting State Entity in their requests for newly available Medicare data via the CMS State Agency Request Program

e. Performing ongoing validation and normalization of Medicare data for integration with submitted data sets from other sources

f. Developing a data submission format crosswalk, as needed, to integrate submission format of Medicare data

g. Inclusion of Medicare data in the Data Quality Improvement Program and reporting as described in the following requirement

14. In addition to the Data Quality Assurance Plan described in Initial Launch

Requirements above, development of an ongoing Data Quality Improvement Program, including, but not limited to:

a. Regular assessment of the quality and completeness of data in the APCD

b. Regular reporting of the findings and any inconsistencies in the assessment

c. Regular development and maintenance of on-line quality assurance and improvement reports for view and use by State Entity, GTRI-CHAI, and the public

d. Regular facilitation of systemic data quality improvement through performing ongoing data quality analysis and collaboration with submitters and GTRI-CHAI.

15. Development and delivery of operational reports and/or dashboards for State Entity and GTRI-CHAI program staff that provide up-to-date status of APCD Data Collection Module activities and processes including, but not limited to:

a. Status of submitter registration and training

b. Status of the data collection process for each type of file by payer, line of business, and time period; including summary statistics

c. Acceptance/resubmission status, and variances.

d. Status of submitter compliance with due dates and data intake edits

e. Status of submitters’ data quality remediation

f. Status of Extract, Transform, and Load (ETL), enhancement, and database update processes

g. Status of LDS data sets creation

h. Other reports of value on changes, status, risks, and mitigation approaches.

16. Implementation and maintenance of Compliance and Audit processes including, but not limited to:

a. Development of a Supplier Compliance work plan

b. Implementation of a process for Supplier’s internal auditing of all aspects of this program’s federal and state regulatory compliance, data collection and hosting best practices and certifications compliance, and compliance with the contract

c. Providing access to Supplier’s site for the State Entity, with five (5) days’ notice, for onsite audit of any and all aspects of the APCD Data Collection Module operations, including information about its development, testing, and operations

17. Maintain and staff a State-approved help desk support function that enables user support to be requested through a variety of methods. The help desk shall operate at a minimum on all State business days, 9am-5pm ET.

C. Supplier Deliverables

Implementation of the Data Collection Module includes meeting all requirements described in this Scope of Work. In addition, Supplier shall be responsible for the following Deliverables:

1. Work Plan and Schedule Due: Ten (10) business days after contract execution The Supplier shall create the Work Plan and Schedule and align it with the State Entity’s project timeline. The Supplier shall update the Work Plan and Schedule as needed to identify all tasks, subtasks, and milestones, and the assigned Supplier resource(s) required to complete the scope of services.

At a minimum, the plan must include detailed descriptions of:

a. Method and implementation strategy for providing a web-based portal with a secure and encrypted upload interface for data submitters to transmit data to the APCD Data Collection Module. The web portal must be capable of providing feedback on data quality and volume trending back to submitters.

b. A protocol for testing and verifying the performance of the data intake process prior to the first submission of data.

2. Communication Plan Due: within one month of contract execution The Communication Plan identifies individuals on the Supplier’s team responsible for maintaining regular and ongoing communications with State Entity, GTRI-CHAI, Submitters, and other stakeholders. Although GTRI-CHAI will take the lead on communications with external stakeholders, the plan shall also describe communication strategies to communicate data quality status and improvement plans to submitters, GTRI-CHAI, and other stakeholders.

3. Solution Architecture Document Due: within three months of contract execution The Solution Architecture Document shall accurately reflect the “as-built” architecture, including, at a minimum, diagrams and descriptions of hardware and software, hosting environment(s), architecture diagrams, network, connectivity method to/from GTRI-CHAI, environmental monitoring systems, system management and monitoring, maintenance, and interfaces with other components of the APCD System.

The Solution Architecture Document shall include five views:

a. Logical View: describes the functionality of the system in terms of its static structure and dynamic behavior.

b. Development View: describes the system from a programmer’s perspective and is concerned with the organization of physical code, its main modules, and their dependencies.

c. Process View: focuses on the runtime behavior of the system and the elements of the system that relate to process performance. It includes aspects important to scalability, throughput, and process response times.

d. Physical View: shows the system from a system engineer's point-of-view. It is concerned with the deployment of software components across the physical architecture, including computers and devices, as well as communication between these components.

e. Use Case View: describes the system from the perspective of external users.

3. Data Security/Business Continuity/Disaster Recovery Plan Due: within four months of contract execution The Data Security Plan describes how the Supplier keeps APCD Program data secure and segregated from other data throughout the project implementation and ongoing use of the system. The Data Security Plan shall include:

d. A protocol to implement and maintain encryption methods in accordance with all state of Georgia and federal requirements in accordance with HIPAA, the HITECH Act, and HHS guidance, including:

i. Methods that allow data submitters to encrypt transmitted files

ii. Methods that allow data files to be encrypted for storage, backup, and transfer

iii. Methods that allow encryption of data during transmission using

FIPS 140-2 compliant cryptographic controls in accordance with NIST Special Publication 800- 52

iv. Methods that allow encryption of data at rest in accordance with NIST Special Publication 800-111

e. A process by which data submitters can get technical assistance to resolve encryption issues

f. A process for periodically assessing and, in consultation with GTRI-CHAI, updating encryption methods to ensure that they meet the highest industry standards.

The Business Continuity/Disaster Recovery Plan includes a detailed strategy for data back-up, disaster recovery, system failure response/recovery times, and secure data disposal. It shall include:

a. The processes and techniques used to help Supplier and the State Entity recover from a disaster

b. A specific testing plan/schedule for bringing systems back to operational status, in order for the systems to continue and/or resume routine business operations

c. Alignment to federal Emergency Management Agency (FEMA), NIST CP- 2 and NIST 800-53 standards, MARS-E-2-0 standards, and meet all Federal (CMS Standard and the associated Risk Management Handbook Procedures; CMS-CISO-2014-vIII-std4.4 or its replacement) and State standards

d. The BC/CR/DR plans must at a minimum conform to ISO/IEC 27031:2011 and ISO 20071:2013, and sufficiently address the challenges represented within a multi-Supplier, integrated systems solution. The BC/CIR/DR is subject to State review and approval.

e. Original data set backups, in the format and frequency to be determined by GTRI-CHAI and State Entity.

4. Data Quality Plan Due: within five months of contract execution The Data Quality Plan, in alignment with the Communications Plan, will include processes for documenting and communicating all data quality rules and any known data quality deficiencies. The Data Quality Plan describes all data quality validation and improvement processes at every stage in the data lifecycle, including:

a. Data Intake – to establish that payer data file submissions are accurate, complete and in the correct format

b. Data Conversion and Processing

i. To verify that files contain expected values consistent with historical trends observed in previous submissions

ii. To assess the distribution of diagnosis, procedure, and other codes for reasonableness and alignment with expectations

iii. To establish that the Extract, Transform, and Load (ETL) and application of value-added processing produced reasonable results and did not inadvertently introduce errors.

c. Analysis and Reporting – to establish the data’s “fitness for use” so that analysis generates results that are as accurate, valid, and reliable as possible.

i. Checking the collected data against trends and benchmarks to verify the data’s validity and identify outlier data which requires closer examination.

d. Describes how the Supplier will collaborate with the State Entity and

GTRI-CHAI to effectively manage and resolve identified data quality issues.

i. The development and schedule for delivery of reports containing information on the quality, completeness, reliability, robustness, and limitations of the data received; the reports shall include a summary of open issues per submitter and proposed solutions for those open issues

ii. Process by which Supplier will provide State Entity and GTRI- CHAI access to the APCD Data Collection Module in order to research and review quality issues that emerge in downstream analysis

iii. Plan for collecting and reviewing user feedback to support proposed changes in design, processing, and data quality improvement.

5. Business Rules Document

Due: within five months of contract execution State Entity requires complete transparency of the APCD Data Collection Module business processing rules. The Business Rules Document shall give detailed explanations of methods, processes, and tools to:

i. Register submitters and collect their data

ii. Gather IDs from the Master Index and apply to Module records

iii. Maintain eligibility records and eligibility spans for all covered members

iv. Identify and manage payer-specific data elements and codes

v. Perform claims versioning

vi. Identify and integrate Coordination of Benefits (COB) claims

vii. Ensure the APCD Data Collection Module meets privacy standards including processes for deidentification of key PHI

viii. Establish provider affiliations

ix. Implement and maintain data masking or other capabilities as may be necessary to meet State Entity, State of Georgia, or other standards and guidelines, including, but not limited to the Department of Justice/Federal Trade Commission antitrust and other guidelines.

x. Implement new releases of the data layout and submission elements, including working with submitters to ease the transition to the new format, supplying updated data dictionaries, create version crosswalks as necessary to facilitate the transition.

6. Submitter Portal: Registration

The Supplier shall demonstrate registration of mandatory and voluntary submitters on the Submitter Portal website. This includes:

i. Corresponding with mandatory and voluntary submitters to the Submitter Portal

ii. Providing submitters instructions and training for how to use the portal and register to submit data to the APCD Data Collection Module

iii. Building, operating, and maintaining the Submitter Portal

iv. Generating and applying submitter IDs that correctly identify each combination of parent company, plan, product, and line of business.

7. Submitter Portal: Pilot Data Collection

The Supplier shall demonstrate collection of submitter data through the Submitter Portal. This includes:

i. Supplying a mechanism that submitters can use to securely upload their data files

ii. Supplying a dashboard that submitters can use to track and trace their data files through the data quality validation and acceptance process

iii. Performing intake data quality checks to prevent unusable data from entering the system

iv. Providing the State Entity with copies of all accepted data files collected via the Portal.

8. State User Acceptance Test of APCD Data Collection Module Platform Functions Due: January 2023 (or six months after contract execution, whichever is later) The Supplier shall complete testing and confirm stable operation of the Data Collection Module. The Supplier shall deliver test summary results to the State Entity and GTRI-CHAI.

9. Data Extract Process Due: January 2023(or six months after contract execution, whichever is later) The Supplier shall demonstrate the mechanisms to define, create, and transmit data extracts. This includes:

a. Providing the State Entity and GTRI-CHAI documentation of the processes following to use the extract definition, creation, and transmission mechanisms

b. Storing extract definitions in the APCD Data Collection Module and creating those extracts on a timeframe determined by the State Entity

c. Successfully transmitting functional LDS extracts to GTRI-CHAI.

10. APCD Data Collection Module Ongoing Operations Plan

Due: within 12 months of contract execution The APCD Data Collection Module Ongoing Operations Plan augments, not replicates, contents of the earlier design deliverables (e.g., Business Rules Document, Solution Architecture Document). The APCD Ongoing Operations Plan will identify the following:

a. Production operations schedule and procedures (e.g., data intake, data quality assessment, data processing reports, error reports, quarterly database build, data extracts, reports)

b. Role and use of specific applications, databases, and technical tools

c. Roles, responsibilities, and staffing levels of personnel

d. Solution upgrade and change management procedures

e. Schedules and procedures for application, database, and tool maintenance

f. Customer support model, procedures, and service levels

g. Processes for tracking and cross-referencing requirements with deliverables, architecture, system components, and test procedures

h. Timeline and methods for securing all required payer data on a schedule to be agreed upon with the State Entity

i. Maintaining user roles and permissions consistent with the privacy standards

j. Capacity Management procedures

k. Backup and disaster recovery procedures.

11. Transition Plan Due: Jan 1, 2023 (or six months after contract execution, whichever is later) The Transition Plan shall document how the Supplier will support transition of the APCD Data Collection Module services to the State Entity or the State Entity's designee upon completion or termination of the contract. The Transition Plan shall contain, at a minimum, detail for the following activities:

a. Develop and provide an inventory of information assets, including source and integrated data

b. Analyze and report on the electronic storage requirements for the data

c. Deliver complete archival information assets to the State Entity or the

State’s designee

d. Provide other technical assistance as requested by the State Entity to facilitate, without interruption of services, the orderly transition of services

e. If the Supplier is providing any services at the time of such transition utilizing software or software license from a third-party supplier, provide documentation and instructions to the State Entity for obtaining or transferring of such licenses

f. Continue to provide APCD Data Collection Module, at an agreed upon service level, until a transition to the State Entity or the State’s designee has been successfully completed

12. System Security Plan (SSP) Due: four months after contract execution The System Security Plan shall address:

a. A description of privacy, security, and access management approach, controls, frameworks, and structure for all systems, facilities, networks, applications, personnel/contractors, and business services under the scope of this eRFP, in a manner which complies with the requirements of

CMS MARS-E 2.0.

b. Detail on the roles and responsibilities of all assigned privacy officials and staff engaged to implement and maintain the SSP for the solution.

c. Approach and schedule for completing required system security testing, assessments, and regular system monitoring activities such as:

i. Information system audits and activity reviews

ii. Access reporting

iii. Security testing (e.g., penetration testing)

iv. Service and Organization Controls (SOC) 2 report

v. Third party assessments (e.g., Security and Privacy Controls

Assessment, Security Controls Review, Security Controls Review, Vulnerability Scans)

vi. Plan of Action and Milestones (POA&M) plan for tracking, planning, and implementing required corrections/security protocols to resolve information security weaknesses

d. Additional CMS/Federal and/or State security assessments – testing -audits as required by the State Entity and/or CMS. The SSP is subject to State Entity review and approval. All CMS and Agency of Human Services (AHS) required testing, assessments, and monitoring reports, letters, and results must be provided upon State Entity request.

D. Data Location and Security

1. Services provided to the State and its end users solely from data centers within the United States

2. Storage, processing and transmission of State Data shall be restricted to information technology systems within the United States.

3. The Supplier shall not allow its personnel or sub-contractors to store State Data on portable devices, including personal computers, unless express prior written consent is obtained from State Entity’s designated Information Security Officer.

4. Supplier shall designate a single individual to serve as the Privacy and Security Officer, accountable for the implementation of all privacy measures, for auditing security and encryption processes, and for ensuring that HIPAA and other applicable security frameworks are followed at all times

5. The Supplier will protect and secure data at rest and in transit in accordance with the requirements of Section H.4 Data Security Plan

6. Regular audits by Supplier to ensure data security and privacy standards compliance

7. Compliance with all state of Georgia standards for information technology and guidelines, available at http://gta.ga.gov/psg, with additional references for security at http://gta.ga.gov/psg/article/enterprise-information-security-charter

8. Security Incident Responsibilities: Supplier shall maintain a Security Incident Response plan. The Supplier must inform the State Entity of any security incident or data breach within one hour of discovery of the incident.

i. Incident Response: The supplier may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries, and seeking external expertise as mutually agreed upon, defined by law, or contained in the Contract.

9. Breach Responsibilities: This section only applies when a data breach occurs with respect to personally identifiable information within the possession or control of Supplier.

i. Breach Reporting Requirements: If Supplier has actual knowledge of a confirmed data breach that effects the security of any State Entity/public jurisdiction content that is subject to applicable data breach notification law, Supplier shall (1) promptly notify the appropriate public jurisdiction identified contact within one hour; and (2) take commercially reasonable measures to address the data breach in a timely manner.

ii. Supplier, unless stipulated otherwise, shall promptly notify the State Entity/appropriate public jurisdiction identified contact within 24 hours or sooner by telephone unless a shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been, a data breach. Supplier shall (1) cooperate with the public jurisdiction as reasonably requested, to investigate and resolve the data breach; (2) promptly implement necessary remedial measures, if necessary; and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

10. Supplier will develop a System Security Plan (SSP) that formally and strategically documents how the Supplier will comply with state and federal privacy mandates/laws as they relate to the APCD Data Collection Module in accordance with the requirements of Section H.19 System Security Plan.

11. Supplier will develop a Business Continuity, Cyber Incident Response, and Disaster Recovery Plan (BC/CIR/DR) to in accordance with Section H.4 http://gta.ga.gov/psg http://gta.ga.gov/psg/article/enterprise-information-security-charter

E. Contract End-of-Life Transition Services

1. If applicable, upon termination or expiration of the Contract, Supplier shall cooperate in good faith to effectuate a smooth, secure transition of the Services from the Supplier to State Entity and, if applicable, the new supplier engaged by State Entity to assume the Service previously performed by Supplier. Contract end-of-life services shall be provided at no additional cost.

2. Ninety (90) days prior to the end of the contract or unless otherwise specified by State Entity, the Supplier shall begin working with State Entity and GTRI-CHAI and, if applicable, the new supplier to develop a Data Transition Plan (DTP).

State Entity shall provide the DTP template to Supplier.

3. The Supplier shall use reasonable efforts to assist the new supplier, in connection with the transition from the performance of Services by the Supplier and its Affiliates to the performance of such Services by any new supplier. This may include assistance with the secure transfer of records (electronic and hard copy), transition of historical data (electronic and hard copy), the transition of any such Service from the hardware, software, network and telecommunications equipment and internet-related information technology infrastructure (“Internal IT Systems”) of Supplier to the Internal IT Systems of a new supplier and cooperation with and assistance to any third-party consultants engaged by any new supplier in connection with the Transition Services.

4. Should the data transition extend beyond the end of the Contract, the Supplier shall agree that Information Security Requirements, and if applicable, State Entity’s Business Associate Agreement’s terms and conditions remain in effect until the Data Transition is accepted as complete by State Entity.