AttC_SampleGroupBenefitsContract_PrivacyAndSecurity.pdf

OEBB Contract No. #______ Sample Group Benefits Contract Employee Assistance Program Services Exhibit E, Privacy and Security Requirements

EXHBIT E

PRIVACY AND SECURITY REQUIREMENTS

Contractor’s obligations under this Contract include the requirements of this Exhibit.

1. PURPOSE. The terms and conditions of this Exhibit E Privacy and Security Requirements address:

1.1. Contractor’s Use of OEBB Data;

1.2. Contractor’s Access to OEBB’s Information Assets and Systems; and

1.3. The periodic exchange of Data between OEBB’s and Contractor’s systems via electronic means.

2. DEFINITIONS. The following definitions apply to this Exhibit E Privacy and Security

Requirements:

2.1. “Access” means the ability or the means necessary to read, communicate, or otherwise use OEBB or State Data, Network and Information Systems, and Information Assets

2.2. “Breach” means the acquisition, access, exposure, use, or disclosure of Data or an Information Asset in a manner not in compliance with applicable law, rule, or policy, or Data loss, misuse, or compromise.

2.3. “Client Records” includes any client, applicant, or participant information regardless of the media or source, collected by Contractor in the course of completing the Work, provided through the Network and Information Systems to Contractor, or otherwise exchanged between the parties.

2.4. “Data” means information created, transmitted, or stored through the Network and Information Systems, including metadata, personal information, and Client Records.

2.5. “Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of any Network and Information System or Information Asset. An Incident is an observable, measurable occurrence that is a deviation from expected operations or activities. An Incident may be a Breach, failure to protect a User’s identification (ID), or theft of computer equipment that uses or stores any Information Asset.

2.6. “Individual Access Request (IAR)” refers to the State of Oregon form used to authorize a User, identify the User’s job assignment, and the required access to Network and Information System(s). It generates a unique alpha/numeric code used to access the OEBB Network and Information Systems.

2.7. “Information Asset(s)” refers to all information provided through OEBB, regardless of the source, which requires measures for security and privacy. Includes Data.

2.8. “Network and Information System(s)” means OEBB’S and the State of Oregon’s computer infrastructure which provides personal communications; Data such as

Client Records; Access to other Information Assets, regional, wide area, and local networks; and the internetworking of various types of networks.

2.9. “User” means any individual authorized to access Network and Information Systems and who has an been assigned a unique log-on identifier.

3. THIRD PARTY INFORMATION SYSTEM ACCESS Contractor may be requested to submit a Third Party Information System Access Request (Form MSC 0785), that will be attached as Exhibit E-1.

3.1. Point of Contact Changes. Each party will provide notification to the other of any change of its respective point(s) of contact noted in any Exhibit E-1, including any technical lead, and name an interim or replacement person in any such notice. Exhibit E-1 will be deemed amended to include the updated information.

3.2. Administrative Changes. Contractor may request updates to Exhibit E-1 that are administrative in nature and do not modify the mode of Access or type of data by submitting a written request to OEBB. Upon written acceptance by OEBB, Exhibit E- 1 will be deemed amended to include the updated information.

4. NOTIFICATIONS.

4.1. Breach Notification. In the event Contractor or its subcontractors or agents discover or are notified of a suspected or confirmed Incident or Breach, including a failure to comply with Contractor’s confidentiality obligations under this Contract, Contractor shall immediately notify the data administrator or manager of OEBB’s MyOEBB eligibility and enrollment system of the Incident or Breach. If OEBB determines that an Incident or Breach requires notification of OEBB clients, or other notification required by law, OEBB will have sole control over the notification content, timing, and method, subject to Contractor’s obligations under applicable law.

4.2. Requests for Data. In the event Contractor receives a third-party request for Data, including any electronic discovery, litigation hold, or discovery searches, Contractor shall first give OEBB notice and provide such information as may be reasonably necessary to enable OEBB to protect its interests.

4.3. Changes in Law. Each party will provide notice to the other of any change in law, or any other legal development, which may significantly affect its ability to perform its obligations.

5. GRANT OF LICENSE. Subject to Contractor’s compliance with the Contract, Contractor is hereby granted a non-exclusive, non-transferable, and revocable authorization to Access and use Information Assets only in accordance with this Exhibit E and applicable laws, rules, and policies. Contractor and its employees, contractors, and agents shall not manipulate any URL or modify, publish, transmit, reverse engineer, participate in any unauthorized transfer or sale of, create derivative works of, or in any way exploit the content or software comprising this Access, or Information Assets made available through this Access.

6. DATA PRIVACY. In addition to Contractor’s obligations under Exhibit A, Section 18 regarding Confidential Information:

6.1. Generally. Contractor shall hold all Client Records, and other information as to personal facts and circumstances obtained by Contractor on OEBB clients, as confidential, using the highest standard of care applicable to the Client Records, and shall not divulge any Client Records without the written consent of the client, the client’s attorney, the responsible parent of a minor child, or the minor child’s guardian except as required by other terms of this Exhibit E or applicable law.

6.2. Limited Purposes. Contractor shall limit the use or disclosure of Data concerning clients to persons directly connected with the administration of this Exhibit E or the Contract. Confidentiality policies apply to all requests from outside sources.

6.3. Privacy Protections. Data may include information, such as Client Records, subject to specified confidentiality protections under state or federal law. Contractor shall comply with laws, regulations, and policies applicable to the information described in Exhibit E-1, including as specified in this Contract.

6.4. Training. Contractor’s employees, subcontractors, and agents who will Access Data have received training on the privacy and security obligations relating to the Data, including Client Records. Contractor shall provide periodic privacy and security training to its employees, subcontractors, and agents.

7. SECURITY REQUIREMENTS.

7.1. Compliance with Laws, Regulations, and Policies. Contractor and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of Data (including Client Records) and Access to Information Assets, including as those laws, regulations, and policies may be updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

7.1.1. DHS and OHA Information Security and Privacy Policies:

https://www.oregon.gov/oha/FOD/OIS-ISPO/Pages/Policies.aspx

7.1.2. DHS and OHA Privacy and Confidentiality administrative rules, OAR

Chapter 407, Division 14, and OAR Chapter 943, Division 14 to the extent applicable.

7.1.3. The Health Insurance Portability and Accountability Act (HIPAA), including as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5 (“ARRA”), and its implementing Privacy Rule and Security Rule, 45 CFR Parts 160 and 164 to the extent Contractor receives Protected Health Information (as defined in HIPAA) in connection with this Exhibit E.

7.1.4. The Oregon Consumer Information Protection Act, ORS 646A.600 through 646A.628, to the extent applicable.

7.1.5. Oregon’s Statewide Information and Cyber Security Standards:

https://www.oregon.gov/eis/cyber-security-services/Documents/2019StatewideInformationAndCyberSecurityStandardsV 1.0.pdf

7.1.6. Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx.

https://www.oregon.gov/eis/cyber-security-services/Documents/2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx

7.1.7. Oregon’s Statewide IT Policies:

https://www.oregon.gov/das/Pages/policies.aspx#IT.

7.2. Responsible for Compliance. Contractor is responsible for the compliance of its employees, agents, and subcontractors with this Exhibit E and with any third-party licenses to which Access is subject.

7.3. Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security and privacy of Data, including Client Records, all Information Assets, regardless of the media, and all Network and Information Systems. Contractor shall monitor, periodically assess, and update its security controls and risk to ensure continued effectiveness of those controls.

7.4. Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required in accordance with this Exhibit E Privacy and Security Requirements is documented in a security risk management plan. Contractor shall make its security risk management plan available to OEBB for review upon request.

7.5. Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Exhibit E, and provide OEBB, the Oregon Secretary of State, the federal government, and their duly authorized representatives access to Contractor’s officers, agents, contractors, subcontractors, employees, facilities and records for OEBB to:

7.5.1. Determine Contractor’s compliance with this Exhibit E Privacy and Security

Requirements,

7.5.2. Validate Contractor’s written security risk management plan, or

7.5.3. Gather or verify any additional information OEBB may require to meet any state or federal laws, rules, or orders regarding Information Assets.

7.5.4. Access to facilities, systems, and records under this section will be granted following reasonable notice to Contractor. Records include paper or electronic form, system security logs, and related system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

8. ACCESS TO OEBB SYSTEMS.

8.1. OEBB Review of User Requests. If required for Access, OEBB will review requests, including forms such as the IAR, and will:

8.1.1. Notify Contractor of the approval or denial of its request for each User for whom Access has been requested;

8.1.2. Provide any unique log-on identifier required for authorized Access;

8.1.3. Provide updates to approved inquiry processes and instructions to Contractor.

8.2. Contractor’s Responsibilities for User Accounts. Contractor shall facilitate completion of any forms (such as the IAR) for each person for whom Access is requested.

https://www.oregon.gov/das/Pages/policies.aspx#IT

8.2.1. Contractor is responsible for all activities that occur through its Access, including for any acts related to a lost or stolen User ID or password.

8.2.2. Contractor is responsible for ensuring information provided by its Users is accurate, complete, and up to date.

8.2.3. Contractor shall immediately notify OEBB when a User, group of Users, or Contractor, no longer requires Access whether due to changes in duties or due to changes in Contractor’s programs related to this Contract.

8.3. Security and Disposal. Contractor shall maintain security of equipment, and ensure the proper handling, storage and disposal of all Information Assets accessed, obtained, or reproduced by Contractor and its Users to prevent inadvertent destruction or loss. Contractor shall ensure proper disposal of equipment and Information Assets when authorized use ends, consistent with Contractor’s record retention obligations and obligations regarding Information Assets under this Contract.

8.4. Prevention of Unauthorized Access. Contractor shall prevent any Access to State of Oregon Network and Information Systems by its Users that is not authorized in accordance with this Contract and applicable law, and shall implement and maintain safeguards to prevent unauthorized access.

8.5. Access from Outside the US and its Territories. Contractor Access to the state network from outside the US and its territories is prohibited unless approved through the Geofencing Exception Request Process, ODHS|OHA 090-009-05.

8.5.1. Contractor shall not allow use of any Information Asset in any country or territory in any manner prohibited by governing applicable law, rule, or policy.

8.6. Authorized Access and Use Only. No User may Access or use Data for any purpose other than those specifically authorized through this Contract.

8.6.1. Users shall not use Access to obtain or attempt to obtain any Data or

Information Assets not authorized or intentionally made available.

8.6.2. The use and disclosure of any Information Asset is strictly limited to the minimum information necessary to the exchange of Data between the parties described in Exhibit E-1.

8.6.3. Except as otherwise specified or approved by OEBB, neither Contractor nor its Users may modify, alter, delete, or destroy any Information Asset.

8.7. Revocation or Termination of Access. Breach, or wrongful use or disclosure of Information Assets by Contractor or its Users, may cause the immediate revocation of the Access granted, in the sole discretion of OEBB, or OEBB may specify a reasonable opportunity for Contractor to cure the unauthorized use or disclosure and end the violation, and terminate the Access if Contractor does not do so within the time specified by OEBB. Legal actions also may be taken for violations of applicable regulations and laws.

8.8. No Unauthorized Distribution. Contractor shall not sell, make available, or provide Information Assets in any form to any other persons or organizations, and shall not https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me090-009-05.pdf use the Information Assets for any purposes other than as allowed under this Contract and applicable law.

8.9. No Impairment. Contractor shall not use this Access in any manner which could damage, disable, overburden, or impair Network and Information Systems or interfere with any other entity’s use or benefit of Network and Information Systems.

8.10. Prohibition on Data Mining. Contractor shall not capture, maintain, scan, index, share or use Data stored or transmitted by virtue of this interconnection, or otherwise use any data-mining technology, for any non-authorized activity. For purposes of this requirement, “non-authorized activity” means the data mining or processing of data, stored or transmitted through the Network and Information Systems, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in this Exhibit E.

8.11. Incidents and Breaches. Contractor shall comply, and shall cause its subcontractors to comply, with any requirements for identifying and addressing an Incident or Breach. This requirement applies regardless of whether the Incident or Breach was accidental or otherwise.

9. SUSPENSION OR TERMINATION.

9.1. OEBB may immediately revoke the Access granted Contractor for Contractor’s failure to comply with the requirements of this Exhibit E Privacy and Security Requirements. In such event, OEBB will provide subsequent written notice to Contractor’s point of contact. OEBB may, to the extent it determines it is reasonable and able to do so, provide advance notice to Contractor to cure any deficiency.

9.2. Either party may terminate access under this Exhibit E Privacy and Security Requirements, and OEBB may modify access, upon written notice if there are changes to or revised interpretations of federal or state laws, rules, or regulations, or if either party has changes in policies that require such action.

10. RETURN OF INFORMATION ASSETS. Upon expiration or termination of the Contract for any reason whatsoever, Contractor shall immediately deliver to OEBB all of OEBB’s Information Assets, including Data and Client Records, that are in the possession or under the control of Contractor in whatever stage and form of recordation such property is expressed or embodied at that time.

10.1. Except as necessary to meet obligations under Exhibit A, Section 12, Records

Maintenance and Access, Contractor shall not retain any copies of Information Assets. Contractor shall notify OEBB of any conditions that make returning all OEBB Information Assets not feasible. Upon OEBB’s written acknowledgement that returning all Information Assets is not feasible, Contractor shall purge or destroy retained Data in all its forms in accordance with the most current version of NIST SP 800-88 (or other agreed-upon standard) and on request provide OEBB with written certification of sanitization.

10.2. Contractor shall maintain protections required by law or the Contract for any retained State of Oregon Information Asset for so long as Contractor (including through any subcontractor) retains it.

11. COSTS. Each party will bear its own costs related to the acquisition of all equipment, software, data lines or connections necessary for Access, unless otherwise agreed to by written agreement between the parties. Each party is responsible for securing compatible hardware, equipment, and software, and network connections. Each party is responsible for complying with the licenses for third party products, including software and services that allow Access.

12. INTERPRETATION. Any ambiguity in this Exhibit E Privacy and Security Requirements will be resolved to permit OEBB to comply with applicable privacy and security laws and State of Oregon and OEBB policies interpreting those laws.

13. SUBCONTRACTORS. Contractor shall ensure all subcontractors providing services related to this Exhibit E Privacy and Security Requirements are held to the same requirements as Contractor.

EXHIBIT E-1

THIRD PARTY INFORMATION SYSTEM ACCESS REQUEST (FORM MSC 0785)