CDR RFA Attachment C Contractor Certification Form.docx

COMMONWEALTH OF MASSACHUSETTS

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

MASSHEALTH PROGRAM CDR HOSPITAL RFA

ATTACHMENT C: Contractor Certification Form

HOSPITAL LEGAL NAME:

For all Contracts involving the Contractor’s access to personal information, as defined in M.G.L. c. 93H, and personal data, as defined in M.G.L. c. 66A, owned or controlled by Executive Department agencies, or access to agency systems containing such information or data (herein collectively “personal information”), Contractor certifies under the pains and penalties of perjury that the Contractor agrees to protect any and all personal information; and (2) has reviewed all of the Commonwealth of Massachusetts Enterprise Information Security Policies and Standards.

Notwithstanding any contractual provision to the contrary, in connection with the Contractor’s performance under this Contract, for all state agencies in the Executive Department, including all executive offices, boards, commissions, agencies, departments, divisions, councils, bureaus, and offices, now existing and hereafter established, the Contractor shall:

(1) obtain a copy, review, and comply with the contracting agency’s Information Security Program (ISP) and any pertinent security guidelines, standards and policies; (2) comply with all of the Commonwealth of Massachusetts Enterprise Information Security Policy (“Security Policies”) available at Enterprise Information Security Policies and Standards | Mass.gov under Policies and Standards;

(2) communicate and enforce the contracting agency’s ISP and such Security Policies against all employees (whether such employees are direct or contracted) and subcontractors;

(3) implement and maintain any other reasonable appropriate security procedures and practices necessary to protect personal information to which the Contractor is given access by the contracting agency from the unauthorized access, destruction, use, modification, disclosure or loss;

(4) be responsible for the full or partial breach of any of these terms by its employees (whether such employees are direct or contracted) or subcontractors during or after the term of this Contract, and any breach of these terms may be regarded as a material breach of this Contract;

(5) in the event of any unauthorized access, destruction, use, modification, disclosure or loss of the personal information (collectively referred to as the “unauthorized use”): (a) immediately notify the contracting agency if the Contractor becomes aware of the unauthorized use; (b) provide full cooperation and access to information necessary for the contracting agency to determine the scope of the unauthorized use; and (c) provide full cooperation and access to information necessary for the contracting agency and the Contractor to fulfill any notification requirements.

Breach of these terms may be regarded as a material breach of this Contract, such that the Commonwealth may exercise any and all contractual rights and remedies, including without limitation indemnification under Section 11 of the Commonwealth’s Terms and Conditions, withholding of payments, contract suspension, or termination. In addition, the Contractor may be subject to applicable statutory or regulatory penalties, including and without limitation, those imposed pursuant to M.G.L. c. 93H and under M.G.L. c. 214, § 3B for violations under M.G.L. c. 66A.