AttC_PrivacyAndSecurity_MSC 0785 Form.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Page of MSC 0785 (7/2018) Agreement #: Org name:

.\Links\OHA-black3.png

SHARED SERVICES

Information Security and Privacy Office

SHARED SERVICES

Information Security and Privacy Office

SHARED SERVICES

Information Security and Privacy Office .\Links\DHS-black-stacked-hires.tif Third Party Information System Access Request An DHS or OHA program completes this form to request access for a third-party entity* (organization or individual) to data within an DHS or OHA information system or network.

*Please note that each entity only needs one form.

Hover over blue text for more information.

Section 1. Third party information This section defines the third party needing access to DHS/OHA network and information system(s). A third party is any individual or entity that is not part of the DHS/OHA workforce. Workforce means employees, volunteers, trainees and other individuals whose DHS or OHA work is under that agency’s direct control. This applies to paid and unpaid workforce members.

Third-party agreement administrator contact information Third-party agreement administrator: The individual employed by or representing the third-party entity that is responsible for signing contracts.

This individual signs the contracts for the third party. (This is NOT a DHS/OHA employee.)

Organization/entity name:

Contact name (first, last):

b. Contact name (first, last):

Position/title:

Work street address:

City, State, ZIP:

Phone:

Email:

Website address (optional):

Additional contact for third party This individual will be the contact for setting up or terminating users for the third party. (This is not a DHS/OHA employee.)

Contact name (first, last):

Position/title:

Phone:

Email:

Role:

Section 2. Governing contract details A DHS/OHA employee fills out this section. If a governing contract applies, please complete all applicable fields, below.

Does a governing contract establish a need for access?

Governing contract type Contract information:

Contract information:

Contract number Expiration date:

Contract:

Data use agreement:

Memorandum of understanding:

Other contract (if applicable):

Background checks Please ensure all applicable required background checks are completed. DHS and OHA systems containing or accessing regulated data may require additional background check requirements beyond the pre-employment background checks. Regulated data sets requiring additional background checks include but are not limited to:

Criminal Justice Information (CJI) in the Criminal Justice Information Services (CJIS) policy, 5.12.1 Personnel Security Policy and ProceduresFederal tax information (FTI) as documented in Internal Revenue Service (IRS) Publication 1075, 5.1.1 Background Investigation Minimum Requirements.Direct questions related to the background check process to BCU.Info@state.or.us or 503-378-5470 or 1-888-272-5545.

Section 3. Access description Reason for access Describe in detail the business need for access:

Method of access Check all methods the third party will use to access DHS/OHA information systems.

Will only use DHS/OHA supplied PC, laptop or workstation:

Will only use DHS/OHA supplied PC, laptop or workstation:

Will only use DHS/OHA supplied PC, laptop or workstation:

Access and information flow will occur from:

Scope of access List all system names the third party needs to access. (This form authorizes access for the third-party organization as a whole. A partner number [P#] and a network login are needed to access the following information systems. The system-specific individual user access request forms must be used to request access for individual third-party employees using the system.)

System Information type Will information being shared or accessed be identifiable (i.e., names, DOB, address, etc.)?

If yes, what protected information will be shared or accessed? (Check all that apply.)

Information owner review (internal use only) Access determination:

Check all methods the third party will use to access DHS/OHA information systems.

Section 4. Program sponsor The program sponsor is the DHS or OHA manager who sponsors the requested access. That person must monitor and ensure the third party complies with the terms and conditions of the access agreement. (Note that the program sponsor is usually the contract administrator of the governing contract authorizing the access.)

Verification of need to know:

Name (first, last):

Position/title:

Office:

Program:

District name:

Work street address:

City, State, ZIP:

Phone (include ext.):

Email:

Section 5. Program requestor The program requestor is the DHS or OHA staff person who works with the third party on a day-to-day basis. That person requests the access agreement for the third party. The requestor can be the same person as the program sponsor or contract administrator. However, a program can list separate requestors/contract administrators. This will ensure all relevant parties receive contract communication and expiration notices.

The requestor is the DHS or OHA staff person who works with the third party on a day-to-day basis. That person requests the access agreement for the third party. The requestor can be the same person as the program sponsor or contract administrator. However, a program can list separate requestors/contract administrators. This will ensure all relevant parties receive contract communication and expiration notices.

The requestor is the DHS or OHA staff person who works with the third party on a day-to-day basis. That person requests the access agreement for the third party. The requestor can be the same person as the program sponsor or contract administrator. However, a program can list separate requestors/contract administrators. This will ensure all relevant parties receive contract communication and expiration notices.

Name (first, last):

Position/title:

Office:

Program:

District name:

Work street address:

City, State, ZIP:

Phone (include ext.):

Email:

Submission Click the submit button below to submit electronically, or email this completed form to the Information Exchange (InfoEx) Program within the Information Security and Privacy Office at DHSOHA.InfoEx@dhsoha.state.or.us. You can also email this address if you need more help.

Policy reference: https://apps.state.or.us/Forms/Served/de090-003.pdf Send the completed form to the Information Exchange (InfoEx) Program within the Information Security and Privacy Office: DHSOHA.InfoEx@state.or.us.

If you need more help, email: dhoha.infoex@state.or.us.

Policy reference: https://apps.state.or.us/Forms/Served/de090-003.pdf.

Send the completed form to the Information Exchange (InfoEx) Program within the Information Security and Privacy Office: DHSOHA.InfoEx@state.or.us.

If you need more help, email: dhoha.infoex@state.or.us.

Policy reference: https://apps.state.or.us/Forms/Served/de090-003.pdf.

DHS/OHA Information Security and Privacy Office use only

MSC 0785 (7/2018)

7/2018 Shared Services, Information Security and Privacy Office Oregon DHS/OHA Third Party Information System Access Request (MSC 0785) 7/2018

MSC 0785 (7/2018)

Any person or entity not part of the DHS/OHA workforce and contracted to provide and/or exchange services and/or products with DHS/OHA where an information exchange is required.:

The individual employed by or representing the third-party entity that is responsible for signing contracts.:

An individual who is responsible for managing, overseeing and maintaining computer systems for an organization.: 0 Technical contact:

An individual who is responsible for providing hardware or software assistance.: 0

Third-party entity (e.g., secretary of state) needs to access Child Welfare systems (OR-Kids, DHS Mainframe and ViewDirect) and OHA systems (MMIS) to perform audit. Follow with a short paragraph detailing why the third party needs access to a DHS/OHA information system.:

A date in the future when the third-party entity needs to have access.:

VPN:

Virtual private network that extends a private network across a public network, allowing users to send and receive data.: 0 Remote access via Citrix.

Citrix:

Application affording users the secure delivery of applications and data to any device on any network.: 0 Access to folder on Secure File Transfer Protocol (SFTP) server.

Secure File Transfer Protocol (SFTP):

SFTP, also called SSH File Transfer Protocol, is a network protocol for securely accessing, transferring and managing files between two remote information systems.: 0

• MSC 0786 Microsoft servers, Outlook SharePoint, Secure File Transfer Protocol, CAPI, COREMETS, Oregon Eligibility (ONE), CITRIX or to establish P or OR number

• DHS 0780NM Non-Medicaid EDMS

• DHS 0783SSP Self Sufficiency Programs

• DHS 0783CW Child Welfare Programs

• DHS 0784 APD (Oregon Access)

• DHS 0787 MMIS:

Individually identifiable health information that is a subset of health information. PHI includes demographic information collected from an individual. It is created or received by a health care provider, health plan or employer and relates to the past, present or future physical or mental health or condition of an individual. It identifies that individual or there is a reasonable basis to believe the information can be used to identify that individual.: 0 Financial information:

Any information that relates to monetary facts about an individual such as income, benefit amount(s), assets, liabilities, credit or account numbers and balances.: 0 Criminal justice information (CJI):

FBI and law enforcement data including but not limited to biometric, identity history, biographic, property and case/incident history data.: 0 Source/reference:

U.S. Social Security Administration (federal); SSA TSSR-Version 7.0, Electronic Information Exchange Security Requirements and Procedures For State and Local Agencies Exchanging Electronic Information With The Social Security Administration

Definition:

The term “SSA data/information” is sometimes used interchangeably with “SSA-provided data/information.” It denotes information under the control of SSA provided to an external entity under the terms of an information exchange agreement with SSA.

The term “SSA data/information” also includes information provided to the electronic information exchange partners (EIEPs) by a source other than SSA, but which the EIEP attests to that SSA verified it, or the EIEP couples the information with data from SSA as to certify the accuracy of the information. The following are examples of SSA information:

• SSA’s response to a request from an EIEP for information from SSA (e.g., date of death)

• SSA’s response to a query from an EIEP for verification of an SSN

• Display by the EIEP of SSA’s response to a query for verification of an SSN and the associated SSN provided by SSA

• Display by the EIEP of SSA’s response to a query for verification of an SSN and the associated SSN provided to the EIEP by a source other than SSA

• Electronic records that contain only SSA’s response to a query for verification of an SSN and the associated SSN whether provided to the EIEP by SSA or a source other than SSA.: 0

Information that can be used to distinguish or trace an individual’s identity, such as the person’s name, Social Security number or biometric records, alone or when combined with other personal or identifying information, such as a date and place of birth or mother’s maiden name, linked or linkable to a specific individual (OMBM-07-16).: 0 Federal tax information (FTI):

Any information created by an individual that is derived from the federal tax return or return information received from the IRS or obtained through a secondary source. Examples of secondary sources include the Social Security Administration, Child Support Enforcement Office, Bureau of the Fiscal Service, Centers for Medicare and Medicaid Services, or another entity acting on behalf of the IRS.: 0 Payment card information (PCI):

Any information pertaining to benefits received, distributed or spent on a state-issued benefit payment card.: 0

The DHS or OHA manager responsible for sponsoring the request to grant access to a third-party entity and for monitoring the entity’s use to ensure compliance.:

The DHS or OHA representative responsible for coordinating the day-to-day activities of the third-party entity accessing the system.: