BAA Policy Inadvertent Access Exhibit 10 20.pdf

This is a Business Associate Agreement (BAA) Policy document related to inadvertent access procedures for the State of California's Department of General Services software maintenance renewal contract for the Komprise data management and analytics platform. The document establishes mandatory protocols and procedures that vendors must follow when inadvertent access to protected health information (PHI) occurs during the provision of software maintenance services. The scope of work requires bidders to implement and maintain comprehensive incident response procedures, documentation protocols, and safeguarding mechanisms to address any unintended exposure of sensitive health data. The contract term aligns with the annual maintenance renewal cycle, with the proposal submission deadline set for May 18, 2026, and the BAA policies must be integrated into the vendor's operational framework throughout the contract period.

The BAA Policy document specifies technical and administrative requirements for managing inadvertent access incidents, including mandatory notification procedures, incident investigation protocols, and remediation measures to protect PHI in accordance with California privacy laws and federal standards. Vendors must establish documented procedures for identifying, reporting, and responding to any inadvertent access events, with particular emphasis on encryption standards, audit logging capabilities, and regular security assessments. The document serves as a critical compliance requirement for all bidders, as adherence to these BAA policies is mandatory for contract award. Funding for the maintenance renewal and associated security compliance measures is sourced from the Department of General Services' operating budget allocated for software licensing and support services, with all security and privacy safeguarding costs incorporated into the vendor's service delivery obligations.