ESBD_408498_1744229998275_Exhibit B-1 - Attachment 2 - Security Privacy Inquiry (SPI).pdf

Texas HHS System - Data Use Agreement ‐ Attachment 2

SECURITY AND PRIVACY INQUIRY (SPI)

If you are a bidder for a new procurement/contract, in order to participate in the bidding process, you must have corrected any "No" responses (except A9a) prior to the contract award date. If you are an applicant for an open enrollment, you must have corrected any "No" answers (except A9a and A11) prior to performing any work on behalf of any Texas HHS agency.

For any questions answered "No" (except A9a and A11), an Acti on Plan for Compli ance with a Timeline must be documented in the designated area below the question. The ti meline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed. Compliance with requirements related to other types of

Confidential Information must be confirmed within 90 calendar days from the date the form is signed.

SECTION A: APPLICANT/BIDDER INFORMATION (To be completed by Applicant/Bidder)

1. Does the applicant/bidder access, create, disclose, receive, transmit, maintain, or store Texas

HHS Confidential Information in electronic systems (e.g., laptop, personal use computer, mobile device, database, server, etc.)? IF NO, STOP. THE SPI FORM IS NOT REQUIRED.

Yes No

2. Entity or Applicant/Bidder Legal Name Legal Name:

Legal Entity Tax Identification Number (TIN) (Last Four Numbers Only):

Procurement/Contract#:

Address:

City: State: ZIP:

Telephone #:

Email Address:

3. Number of Employees, at all locations, in

Applicant/Bidder's Workforce "Workforce" means all employees, volunteers, trainees, and other Persons whose conduct is under the direct control of Applicant/Bidder, whether or not they are paid by Applicant/ Bidder. If Applicant/Bidder is a sole proprietor, the workforce may be only one employee.

Total Employees:

4. Number of Subcontractors (if Applicant/Bidder will not use subcontractors, enter “0”)

Total Subcontractors:

5. Name of Information Technology Security Official and Name of Privacy Official for Applicant/Bidder (Privacy and Security Official may be the same person.)

A. Security Official:

Legal Name:

Address:

City: State: ZIP:

Telephone #:

Email Address:

B. Privacy Official:

Legal Name:

Address:

City: State: ZIP:

Telephone #:

Email Address:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 1 of 18

6. Type(s) of Texas HHS Confidential Information the Applicant/Bidder will create, receive, maintain, use, disclose or have access to: (Check all that apply)

• Health Insurance Portability and Accountability Act (HIPAA) data

• Criminal Justice Information Services (CJIS) data

• Internal Revenue Service Federal Tax Information (IRS FTI) data

• Centers for Medicare & Medicaid Services (CMS)

• Social Security Administration (SSA)

• Personally Identifiable Information (PII)

HIPAA CJIS IRS FTI CMS SSA PII

Other (Please List)

7. Number of Storage Devices for Texas HHS Confidential Information (as defined in the Texas HHS System Data Use Agreement (DUA)) Cloud Services involve using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server or a personal computer.

A Data Center is a centralized repository, either physical or virtual, for the storage, management, and dissemination of data and information organized around a particular body of knowledge or pertaining to a particular business.

Total # (Sum a‐d)

a. Devices. Number of personal user computers, devices or drives, including mobile devices and mobile drives.

b. Servers. Number of Servers that are not in a data center or using Cloud Services.

c. Cloud Services. Number of Cloud Services in use.

d. Data Centers. Number of Data Centers in use.

8. Number of unduplicated individuals for whom Applicant/Bidder reasonably expects to handle Texas HHS Confidential Information during one year:

Select Option (a‐d)

a. 499 individuals or less

b. 500 to 999 individuals

c. 1,000 to 99,999 individuals

d. 100,000 individuals or more a.

b.

c.

d.

9. HIPAA Business Associate Agreement

a. Will Applicant/Bidder use, disclose, create, receive, transmit or maintain protected health information on behalf of a HIPAA‐covered Texas HHS agency for a HIPAA‐ covered function?

Yes No

b. Does Applicant/Bidder have a Privacy Notice prominently displayed on a Webpage or a Public Office of Applicant/Bidder's business open to or that serves the public? (This is a HIPAA requirement. Answer "N/A" if not applicable, such as for agencies not covered by HIPAA.)

Yes No N/A

Action Plan for Compliance with a Timeline: Compliance Date:

10. Subcontractors. If the Applicant/Bidder responded "0" to Question 4 (indicating no subcontractors), check "N/A" for both 'a.' and 'b.'

a. Does Applicant/Bidder require subcontractors to execute the DUA Attachment 1 Subcontractor Agreement Form?

Yes No N/A

Action Plan for Compliance with a Timeline: Compliance Date:

SPI Version 2.1 (06/2018) Texas HHS System - Data Use Agreement - Attachment 2: Page 2 of 18

b. Will Applicant/Bidder agree to require subcontractors who will access Confidential Information to comply with the terms of the DUA, not disclose any Confidential Information to them until they have agreed in writing to the same safeguards and to discontinue their access to the Confidential Information if they fail to comply?

Yes No N/A

Action Plan for Compliance with a Timeline: Compliance Date:

11. Does Applicant/Bidder have any Optional Insurance currently in place?

Optional Insurance provides coverage for: (1) Network Security and Privacy; (2) Data Breach; (3) Cyber Liability (lost data, lost use or delay/suspension in business, denial of service with e‐business, the Internet, networks and informational assets, such as privacy, intellectual property, virus transmission, extortion, sabotage or web activities); (4) Electronic Media Liability; (5) Crime/Theft; (6) Advertising Injury and Personal Injury Liability; and (7) Crisis Management and Notification Expense Coverage.

Yes No N/A

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 3 of 18

SECTION B: PRIVACY RISK ANALYSIS AND ASSESSMENT (To be completed by Applicant/Bidder)

For any questions answered "No," an Action Plan for Compliance with a Timeline must be documented in the designated area below the question. The timeline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed.

Compliance with requirements related to other types of Confidential Information must be confirmed within 90 calendar days from the date the form is signed.

1. Written Policies & Procedures. Does Applicant/Bidder have current written privacy and security policies and procedures that, at a minimum:

Yes or No

a. Does Applicant/Bidder have current written privacy and security policies and procedures that identify Authorized Users and Authorized Purposes (as defined in the DUA) relating to creation, receipt, maintenance, use, disclosure, access or transmission of Texas HHS Confidential Information?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

b. Does Applicant/Bidder have current written privacy and security policies and procedures that require Applicant/Bidder and its Workforce to comply with the applicable provisions of HIPAA and other laws referenced in the DUA, relating to creation, receipt, maintenance, use, disclosure, access or transmission of Texas HHS Confidential Information on behalf of a Texas HHS agency?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

c. Does Applicant/Bidder have current written privacy and security policies and procedures that limit use or disclosure of Texas HHS Confidential Information to the minimum that is necessary to fulfill the Authorized Purposes?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

d. Does Applicant/Bidder have current written privacy and security policies and procedures that respond to an actual or suspected breach of Texas HHS Confidential Information, to include at a minimum (if any responses are “No” check “No” for all three):

i. Immediate breach notification to the Texas HHS agency, regulatory authorities, and other required Individuals or Authorities, in accordance with Article 4 of the DUA;

ii. Following a documented breach response plan, in accordance with the DUA and applicable law; &

iii. Notifying Individuals and Reporting Authorities whose Texas HHS Confidential Information has been breached, as directed by the Texas HHS agency?

Yes

No

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 4 of 18

Action Plan for Compliance with a Timeline: Compliance Date:

e. Does Applicant/Bidder have current written privacy and security policies and procedures that conduct annual workforce training and monitoring for and correction of any training delinquencies?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

f. Does Applicant/Bidder have current written privacy and security policies and procedures that permit or deny individual rights of access, and amendment or correction, when appropriate?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

g. Does Applicant/Bidder have current written privacy and security policies and procedures that permit only Authorized Users with up‐to‐date privacy and security training, and with a reasonable and demonstrable need to use, disclose, create, receive, maintain, access or transmit the Texas HHS Confidential Information, to carry out an obligation under the DUA for an Authorized Purpose, unless otherwise approved in writing by a Texas HHS agency?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

h. Does Applicant/Bidder have current written privacy and security policies and procedures that establish, implement and maintain proof of appropriate sanctions against any Workforce or Subcontractors who fail to comply with an Authorized Purpose or who is not an Authorized User, and used or disclosed Texas HHS Confidential Information in violation of the DUA, the Base Contract or applicable law?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

i. Does Applicant/Bidder have current written privacy and security policies and procedures that require updates to policies, procedures and plans following major changes with use or disclosure of Texas HHS Confidential Information within 60 days of identification of a need for update?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 5 of 18

j. Does Applicant/Bidder have current written privacy and security policies and procedures that restrict permissions or attempts to re‐identify or further identify de‐identified Texas HHS Confidential Information, or attempt to contact any Individuals whose records are contained in the Texas HHS Confidential Information, except for an Authorized Purpose, without express written authorization from a Texas HHS agency or as expressly permitted by the Base Contract?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

k. If Applicant/Bidder intends to use, disclose, create, maintain, store or transmit Texas HHS Confidential Information outside of the United States, will Applicant/Bidder obtain the express prior written permission from the Texas HHS agency and comply with the Texas HHS agency conditions for safeguarding offshore Texas HHS Confidential Information?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

l. Does Applicant/Bidder have current written privacy and security policies and procedures that require cooperation with Texas HHS agencies' or federal regulatory inspections, audits or investigations related to compliance with the DUA or applicable law?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

m. Does Applicant/Bidder have current written privacy and security policies and procedures that require appropriate standards and methods to destroy or dispose of Texas HHS Confidential Information?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

n. Does Applicant/Bidder have current written privacy and security policies and procedures that prohibit disclosure of Applicant/Bidder's work product done on behalf of Texas HHS pursuant to the DUA, or to publish Texas HHS Confidential Information without express prior approval of the Texas HHS agency?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

2. Does Applicant/Bidder have a current Workforce training program?

Training of Workforce must occur at least once every year, and within 30 days of date of hiring a new Workforce member who will handle Texas HHS Confidential Information. Training must include: (1) privacy and security policies, procedures, plans and applicable requirements for handling Texas HHS Confidential Information, (2) a requirement to complete training before access is given to Texas HHS Confidential Information, and (3) written proof of training and a procedure for monitoring timely completion of training.

Yes No

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 6 of 18

Action Plan for Compliance with a Timeline: Compliance Date:

3. Does Applicant/Bidder have Privacy Safeguards to protect Texas HHS Confidential Information in oral, paper and/or electronic form?

"Privacy Safeguards" means protection of Texas HHS Confidential Information by establishing, implementing and maintaining required Administrative, Physical and Technical policies, procedures, processes and controls, required by the DUA, HIPAA (45 CFR 164.530), Social Security Administration, Medicaid and laws, rules or regulations, as applicable. Administrative safeguards include administrative protections, policies and procedures for matters such as training, provision of access, termination, and review of safeguards, incident management, disaster recovery plans, and contract provisions. Technical safeguards include technical protections, policies and procedures, such as passwords, logging, emergencies, how paper is faxed or mailed, and electronic protections such as encryption of data. Physical safeguards include physical protections, policies and procedures, such as locks, keys, physical access, physical storage and trash.

Yes No

Action Plan for Compliance with a Timeline: Compliance Date:

4. Does Applicant/Bidder and all subcontractors (if applicable) maintain a current list of Authorized Users who have access to Texas HHS Confidential Information, whether oral, written or electronic?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

5. Does Applicant/Bidder and all subcontractors (if applicable) monitor for and remove terminated employees or those no longer authorized to handle Texas HHS Confidential Information from the list of Authorized Users?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 7 of 18

SECTION C: SECURITY RISK ANALYSIS AND ASSESSMENT (to be completed by Applicant/Bidder) This section is about your electronic system. If your business DOES NOT store, access, or transmit Texas HHS Confidential Information in electronic systems (e.g., laptop, personal use computer, mobile device, database, server, etc.) select the box to the right, and "YES" will be entered for all questions in this section.

No Electronic Systems

For any questions answered "No," an Action Plan for Compliance with a Timeline must be documented in the designated area below the question. The timeline for compliance with HIPAA-related items is 30 calendar days, PII-related items is 90 calendar days.

1. Does the Applicant/Bidder ensure that services which access, create, disclose, receive, transmit, maintain, or store Texas HHS Confidential Information are maintained IN the United States (no offshoring) unless ALL of the following requirements are met?

a. The data is encrypted with FIPS 140‐2 validated encryption

b. The offshore provider does not have access to the encryption keys

c. The Applicant/Bidder maintains the encryption key within the United States

d. The Application/Bidder has obtained the express prior written permission of the

Texas HHS agency

For more information regarding FIPS 140‐2 encryption products, please refer to:

http://csrc.nist.gov/publications/fips

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

2. Does Applicant/Bidder utilize an IT security‐knowledgeable person or company to maintain or oversee the configurations of Applicant/Bidder's computing systems and devices?

Yes No

Action Plan for Compliance with a Timeline: Compliance Date:

3. Does Applicant/Bidder monitor and manage access to Texas HHS Confidential Information (e.g., a formal process exists for granting access and validating the need for users to access Texas HHS Confidential Information, and access is limited to Authorized Users)?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

4. Does Applicant/Bidder a) have a system for changing default passwords, b) require user password changes at least every 90 calendar days, and c) prohibit the creation of weak passwords (e.g., require a minimum of 8 characters with a combination of uppercase, lowercase, special characters, and numerals, where possible) for all computer systems that access or store Texas HHS Confidential Information.

If yes, upon request must provide evidence such as a screen shot or a system report.

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 8 of 18 http://csrc.nist.gov/publications/fips

5. Does each member of Applicant/Bidder's Workforce who will use, disclose, create, receive, transmit or maintain Texas HHS Confidential Information have a unique user name (account) and private password?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

6. Does Applicant/Bidder lock the password after a certain number of failed attempts and after 15 minutes of user inactivity in all computing devices that access or store Texas HHS Confidential Information?

Yes No

Action Plan for Compliance with a Timeline: Compliance Date:

7. Does Applicant/Bidder secure, manage and encrypt remote access (including wireless access) to computer systems containing Texas HHS Confidential Information? (e.g., a formal process exists for granting access and validating the need for users to remotely access Texas HHS Confidential Information, and remote access is limited to Authorized Users).

Encryption is required for all Texas HHS Confidential Information. Additionally, FIPS 140‐2 validated encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data.

For more information regarding FIPS 140‐2 encryption products, please refer to:

http://csrc.nist.gov/publications/fips

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

8. Does Applicant/Bidder implement computer security configurations or settings for all computers and systems that access or store Texas HHS Confidential Information?

(e.g., non‐essential features or services have been removed or disabled to reduce the threat of breach and to limit exploitation opportunities for hackers or intruders, etc.)

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

9. Does Applicant/Bidder secure physical access to computer, paper, or other systems containing Texas HHS Confidential Information from unauthorized personnel and theft (e.g., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.)?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 9 of 18

10. Does Applicant/Bidder use encryption products to protect Texas HHS Confidential Information that is transmitted over a public network (e.g., the Internet, WiFi, etc.)?

If yes, upon request must provide evidence such as a screen shot or a system report.

Encryption is required for all HHS Confidential Information. Additionally, FIPS 140‐2 validated encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data.

For more information regarding FIPS 140‐2 encryption products, please refer to:

http://csrc.nist.gov/publications/fips

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

11. Does Applicant/Bidder use encryption products to protect Texas HHS Confidential Information stored on end user devices (e.g., laptops, USBs, tablets, smartphones, external hard drives, desktops, etc.)?

If yes, upon request must provide evidence such as a screen shot or a system report.

Encryption is required for all Texas HHS Confidential Information. Additionally, FIPS 140‐2 validated encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data.

For more information regarding FIPS 140‐2 encryption products, please refer to:

http://csrc.nist.gov/publications/fips

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

12. Does Applicant/Bidder require Workforce members to formally acknowledge rules outlining their responsibilities for protecting Texas HHS Confidential Information and associated systems containing HHS Confidential Information before their access is provided?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

13. Is Applicant/Bidder willing to perform or submit to a criminal background check on Authorized Users?

Yes No

Action Plan for Compliance with a Timeline: Compliance Date:

14. Does Applicant/Bidder prohibit the access, creation, disclosure, reception, transmission, maintenance, and storage of Texas HHS Confidential Information with a subcontractor (e.g., cloud services, social media, etc.) unless Texas HHS has approved the subcontractor agreement which must include compliance and liability clauses with the same requirements as the Applicant/Bidder?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 10 of 18

15. Does Applicant/Bidder keep current on security updates/patches (including firmware, software and applications) for computing systems that use, disclose, access, create, transmit, maintain or store Texas HHS Confidential Information?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

16. Do Applicant/Bidder's computing systems that use, disclose, access, create, transmit, maintain or store Texas HHS Confidential Information contain up‐to‐date anti‐ malware and antivirus protection?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

17. Does the Applicant/Bidder review system security logs on computing systems that access or store Texas HHS Confidential Information for abnormal activity or security concerns on a regular basis?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

18. Notwithstanding records retention requirements, does Applicant/Bidder's disposal processes for Texas HHS Confidential Information ensure that Texas HHS Confidential Information is destroyed so that it is unreadable or undecipherable?

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

19. Does the Applicant/Bidder ensure that all public facing websites and mobile applications containing Texas HHS Confidential Information meet security testing standards set forth within the Texas Government Code (TGC), Section 2054.516;

including requirements for implementing vulnerability and penetration testing and addressing identified vulnerabilities?

For more information regarding TGC, Section 2054.516 DATA SECURITY PLAN FOR ONLINE AND MOBILE APPLICATIONS, please refer to: https://legiscan.com/TX/text/HB8/2017

Yes

No

Action Plan for Compliance with a Timeline: Compliance Date:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 11 of 18 https://legiscan.com/TX/text/HB8/2017

Requesting Department(s):

Legal Entity Tax Identification Number (TIN) (Last four Only): PO/Contract(s) #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

SECTION D: SIGNATURE AND SUBMISSION (to be completed by Applicant/Bidder)

Please sign the form digitally, if possible. If you can't, provide a handwritten signature.

1. I certify that all of the information provided in this form is truthful and correct to the best of my knowledge.

f I learn that any such information was not correct, I agree to notify Texas HHS of this immediately. I

2. Signature 3. Title 4. Date:

To submit the completed, signed form:

• Email the form as an attachment to the appropriate Texas HHS Contract Manager(s).

HHSC: DFPS: DSHS:

Section E: To Be Completed by Texas HHS Agency Staff:

Agency(s):

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Email Address: Contract Manager Telephone #:

Contract Manager: Contract Manager Telephone #: Contract Manager Email Address:

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 12 of 18

INSTRUCTIONS FOR COMPLETING THE SECURITY AND PRIVACY INQUIRY (SPI)

Below are instructions for Applicants, Bidders and Contractors for Texas Health and Human Services requiring the Attachment 2, Security and Privacy Inquiry (SPI) to the Data Use Agreement (DUA). Instructi on item numbers below correspond to sections on the SPI form.

If you are a bidder for a new procurement/contract, in order to participate in the bidding process, you must have corrected any "No" responses (except A9a) prior to the contract award date. If you are an applicant for an open enrollment, you must have corrected any "No" answers (except A9a and A11) prior to performing any work on behalf of any Texas HHS agency.

For any questions answered "No" (except A9a and A11), an Action Plan for Compliance with a Timeline must be documented in the designated area below the question. The timeline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed. Compliance with requirements related to other types of Confidential Information must be confirmed within 90 calendar days from the date the form is signed.

SECTION A. APPLICANT /BIDDER INFORMATION

Item #1. Only contractors that access, transmit, store, and/or maintain Texas HHS Confidential Information will complete and email thi s form as an attachment to the appropriate Texas HHS Contract Manager.

Item #2. Entity or Applicant/Bidder Legal Name. Provide the legal name of the business (the name used for legal purposes, like filing a federal or state tax form on behalf of the business, and is not a trade or assumed named "dba"), the legal tax identification number (last four numbers only) of the entity or applicant/bidder, the address of the corporate or main branch of the business, the telephone number where the business can be contacted regarding questions related to the information on this form and the website of the business, if a website exists.

Item #3. Number of Employees, at all locations, in Applicant/Bidder's workforce. Provide the total number of individuals, including volunteers, subcontractors, trainees, and other persons who work for the business. If you are the only employee, please answer "1."

Item #4. Number of Subcontractors. Provide the total number of subcontractors working for the business. If you have none, please answer "0" zero.

Item #5. Number of unduplicated individuals for whom Applicant/Bidder reasonably expects to handle HHS Confidential Information during one year. Select the radio button that corresponds with the number of clients/consumers for whom you expect to handle Texas HHS Confidential Information during a year. Only count clients/consumers once, no matter how many direct services the client receives during a year.

Item #5. Name of Information Technology Security Official and Name of Privacy Official for Applicant/Bidder. As with all other fields on the SPI, this is a required field. This may be the same person and the owner of the business if such person has the security and privacy knowledge that is required to implement the requirements of the DUA and respond to questions related to the SPI. In 4.A. provide the name, address, telephone number, and email address of the person whom you have designated to answer any security questions found in Section C and in 4.B. provide this information for the person whom you have designated as the person to answer any privacy questions found in Section B. The business may contract out for this expertise; however, designated individual(s) must have knowledge of the business's devices, systems and methods for use, disclosure, creation, receipt, transmission and maintenance of Texas HHS Confidential Information and be willing to be the point of contact for privacy and security questions.

Item #6. Type(s) of HHS Confidential Information the Entity or Applicant/Bidder Will Create, Receive, Maintain, Use, Disclose or Have Access to: Provide a complete listing of all Texas HHS Confidential Information that the Contractor will create, receive, maintain, use, disclose or have access to. The DUA section Article 2, Definitions, defines Texas HHS Confidential Information as:

“Confidential Information” means any communication or record (whether oral, written, electronically stored or transmitted, or in any other form) provided to or made available to CONTRACTOR or that CONTRACTOR may create, receive, maintain, use, disclose or have access to on behalf of Texas HHS that consists of or includes any or all of the following:

(1) Client Information;

(2) Protected Health Information in any form including without limitation, Electronic Protected Health Information or Unsecured Protected Health Information;

(3) Sensitive Personal Information defined by Texas Business and Commerce Code Ch. 521;

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 13 of 18

(4) Federal Tax Information;

(5) Personally Identifiable Information;

(6) Social Security Administration Data, including, without limitation, Medicaid information;

(7) All privileged work product;

(8) All information designated as confidential under the constitution and laws of the State of Texas and of the United States, including the Texas Health & Safety Code and the Texas Public Information Act, Texas Government Code, Chapter 552.

Definitions for the following types of confidential information can be found the following sites:

• Health Insurance Portability and Accountability Act (HIPAA) ‐ http://www.hhs.gov/hipaa/index.html

• Criminal Justice Information Services (CJIS) ‐ https://www.fbi.gov/services/cjis/cjis‐security‐policy‐resource‐center

• Internal Revenue Service Federal Tax Information (IRS FTI) ‐ https://www.irs.gov/pub/irs‐pdf/p1075.pdf

• Centers for Medicare & Medicaid Services (CMS) ‐ https://www.cms.gov/Regulations‐and‐Guidance/Regulations‐and-

Guidance.html

• Social Security Administration (SSA) ‐ https://www.ssa.gov/regulations/

• Personally Identifiable Information (PII) ‐ http://csrc.nist.gov/publications/nistpubs/800‐122/sp800‐122.pdf

Item #7. Number of Storage devices for Texas HHS Confidential Information. The total number of devices is automatically calculated by exiting the fields in lines a ‐ d. Use the <Tab> key when exiting the field to prompt calculation, if it doesn't otherwise sum correctly.

• Item 7a. Devices. Provide the number of personal user computers, devices, and drives (including mobile devices, laptops, USB drives, and external drives) on which your business stores or will store Texas HHS Confidential Information.

• Item 7b. Servers. Provide the number of servers not housed in a data center or "in the cloud," on which Texas HHS Confidential Information is stored or will be stored. A server is a dedicated computer that provides data or services to other computers. It may provide services or data to systems on a local area network (LAN) or a wide area network (WAN) over the Internet. If none, answer "0" (zero).

• Item 7c. Cloud Services. Provide the number of cloud services to which Texas HHS Confidential Information is stored. Cloud Services involve using a network of remote servers hosted on the Internet to store, manage, and process data, rather than on a local server or a personal computer. If none, answer "0" (zero.)

• Item 7d. Data Centers. Provide the number of data centers in which you store Texas HHS Confidential Information. A Data Center is a centralized repository, either physical or virtual, for the storage, management, and dissemination of data and information organized around a particular body of knowledge or pertaining to a particular business. If none, answer "0" (zero).

Item #8. Number of unduplicated individuals for whom the Applicant/Bidder reasonably expects to handle Texas HHS Confidential Information during one year. Select the radio button that corresponds with the number of clients/consumers for whom you expect to handle Confidential Information during a year. Only count clients/consumers once, no matter how many direct services the client receives during a year.

Item #9. HIPAA Business Associate Agreement.

• Item #9a. Answer "Yes" if your business will use, disclose, create, receive, transmit, or store information relating to a client/consumer's healthcare on behalf of the Department of State Health Services, the Department of Disability and Aging Services, or the Health and Human Services Commission for treatment, payment, or operation of Medicaid or Medicaid clients. If your contract does not include HIPAA covered information, respond "no." If "no," a compliance plan is not required.

• Item #9b. Answer "Yes" if your business has a notice of privacy practices (a document that explains how you protect and use a client/consumer's healthcare information) displayed either on a website (if one exists for your business) or in your place of business (if that location is open to clients/consumers or the public). If your contract does not include HIPAA covered information, respond "N/A."

Item #10. Subcontractors. If your business responded "0" to question 4 (number of subcontractors), Answer "N/A" to Items 10a and 10b to indicate not applicable.

• Item #10a. Answer "Yes" if your business requires that all subcontractors sign Attachment 1 of the DUA.

• Item #10b. Answer "Yes" if your business obtains Texas HHS approval before permitting subcontractors to handle Texas HHS Confidential Information on your business's behalf.

Item #11. Optional Insurance. Answer "yes" if applicant has optional insurance in place to provide coverage for a Breach or any

Texas HHS System - Data Use Agreement - Attachment 2: Page 14 of 18 SECURITY AND PRIVACY INQUIRY (SPI) SPI Version 2.1 (06/2018) http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf https://www.ssa.gov/regulations https://www.cms.gov/Regulations-and-Guidance/Regulations-and-guidance.html https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center http://www.hhs.gov/hipaa/index.html other situations listed in this question. If you are not required to have this optional coverage, answer "N/A" A compliance plan is not required.

SECTION B. PRIVACY RISK ANALYSIS AND ASSESSMENT

Reasonable and appropriate written Privacy and Security policies and procedures are required, even for sole proprietors who are the only employee, to demonstrate how your business will safeguard Texas HHS Confidential Information and respond in the event of a Breach of Texas HHS Confidential Information. To ensure that your business is prepared, all of the items below must be addressed in your written Privacy and Security policies and procedures.

Item #1. Answer "Yes" if you have written policies in place for each of the areas (a‐o).

• Item #1a. Answer "yes" if your business has written policies and procedures that identify everyone, including subcontractors, who are authorized to use Texas HHS Confidential Information. The policies and procedures should also identify the reason why these Authorized Users need to access the Texas HHS Confidential Information and this reason must align with the Authorized Purpose described in the Scope of Work or description of services in the Base Contract with the Texas HHS agency.

• Item #1b. Answer "Yes" if your business has written policies and procedures that require your employees (including yourself), your volunteers, your trainees, and any other persons whose work you direct, to comply with the requirements of HIPAA, if applicable, and other confidentiality laws as they relate to your handling of Texas HHS Confidential Information. Refer to the laws and rules that apply, including those referenced in the DUA and Scope of Work or description of services in the Base Contract.

• Item #1c. Answer "Yes" if your business has written policies and procedures that limit the Texas HHS Confidential Information you disclose to the minimum necessary for your workforce and subcontractors (if applicable) to perform the obligations described in the Scope of Work or service description in the Base Contract. (e.g., if a client/consumer's Social Security Number is not required for a workforce member to perform the obligations described in the Scope of Work or service description in the Base Contract, then the Social Security Number will not be given to them.) If you are the only employee for your business, policies and procedures must not include a request for, or use of, Texas HHS Confidential Information that is not required for performance of the services.

• Item #1d. Answer "Yes" if your business has written policies and procedures that explain how your business would respond to an actual or suspected breach of Texas HHS Confidential Information. The written policies and procedures, at a minimum, must include the three items below. If any response to the three items below are no, answer "no."

○ Item #1di. Answer "Yes" if your business has written policies and procedures that require your business to immediately notify Texas HHS, the Texas HHS Agency, regulatory authorities, or other required Individuals or Authorities of a Breach as described in Article 4, Section 4 of the DUA.

Refer to Article 4, Section 4.01:

Initial Notice of Breach must be provided in accordance with Texas HHS and DUA requirements with as much information as possible about the Event/Breach and a name and contact who will serve as the single point of contact with HHS both on and off business hours. Time frames related to Initial Notice include:

• within one hour of Discovery of an Event or Breach of Federal Tax Information, Social Security Administration Data, or Medicaid Client Information

• within 24 hours of all other types of Texas HHS Confidential Information 48‐hour Formal Notice must be provided no later than 48 hours after Discovery for protected health information, sensitive personal information or other non‐public information and must include applicable information as referenced in Section 4.01 (C) 2. of the DUA.

○ Item #1dii. Answer "Yes" if your business has written policies and procedures require you to have and follow a written breach response plan as described in Article 4 Section 4.02 of the DUA.

○ Item #1diii. Answer "Yes" if your business has written policies and procedures require you to notify Reporting Authorities and Individuals whose Texas HHS Confidential Information has been breached as described in Article 4 Section 4.03 of the DUA.

• Item #1e. Answer "Yes" if your business has written policies and procedures requiring annual training of your entire workforce on matters related to confidentiality, privacy, and security, stressing the importance of promptly reporting any Event or Breach, outlines the process that you will use to require attendance and track completion for employees who failed to complete annual training.

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 15 of 18

• Item #1f. Answer "Yes" if your business has written policies and procedures requiring you to allow individuals (clients/consumers) to access their individual record of Texas HHS Confidential Information, and allow them to amend or correct that information, if applicable.

• Item #1g. Answer "Yes" if your business has written policies and procedures restricting access to Texas HHS Confidential Information to only persons who have been authorized and trained on how to handle Texas HHS Confidential Information

• Item #1h. Answer "Yes" if your business has written policies and procedures requiring sanctioning of any subcontractor, employee, trainee, volunteer, or anyone whose work you direct when they have accessed Texas HHS Confidential Information but are not authorized to do so, and that you have a method of proving that you have sanctioned such an individuals. If you are the only employee, you must demonstrate how you will document the noncompliance, update policies and procedures if needed, and seek additional training or education to prevent future occurrences.

• Item #1i. Answer "Yes" if your business has written policies and procedures requiring you to update your policies within 60 days after you have made changes to how you use or disclose Texas HHS Confidential Information.

• Item #1j. Answer "Yes" if your business has written policies and procedures requiring you to restrict attempts to take de‐identified data and re‐identify it or restrict any subcontractor, employee, trainee, volunteer, or anyone whose work you direct, from contacting any individuals for whom you have Texas HHS Confidential Information except to perform obligations under the contract, or with written permission from Texas HHS.

• Item #1k. Answer "Yes" if your business has written policies and procedures prohibiting you from using, disclosing, creating, maintaining, storing or transmitting Texas HHS Confidential Information outside of the United States.

• Item #1l. Answer "Yes" if your business has written policies and procedures requiring your business to cooperate with HHS agencies or federal regulatory entities for inspections, audits, or investigations related to compliance with the DUA or applicable law.

• Item #1m. Answer "Yes" if your business has written policies and procedures requiring your business to use appropriate standards and methods to destroy or dispose of Texas HHS Confidential Information. Policies and procedures should comply with Texas HHS requirements for retention of records and methods of disposal.

• Item #1n. Answer "Yes" if your business has written policies and procedures prohibiting the publication of the work you created or performed on behalf of Texas HHS pursuant to the DUA, or other Texas HHS Confidential Information, without express prior written approval of the HHS agency.

Item #2. Answer "Yes" if your business has a current training program that meets the requirements specified in the SPI for you, your employees, your subcontractors, your volunteers, your trainees, and any other persons under you direct supervision.

Item #3. Answer "Yes" if your business has privacy safeguards to protect Texas HHS Confidential Information as described in the SPI.

Item #4. Answer "Yes" if your business maintains current lists of persons in your workforce, including subcontractors (if applicable), who are authorized to access Texas HHS Confidential Information. If you are the only person with access to Texas HHS Confidential Information, please answer "yes."

Item #5. Answer "Yes" if your business and subcontractors (if applicable) monitor for and remove from the list of Authorized Users, members of the workforce who are terminated or are no longer authorized to handle Texas HHS Confidential Information. If you are the only one with access to Texas HHS Confidential Information, please answer "Yes."

SECTION C. SECURITY RISK ANALYSIS AND ASSESSMENT

This section is about your electronic systems. If you DO NOT store Texas HHS Confidential Information in electronic systems (e.g., laptop, personal computer, mobile device, database, server, etc.), select the "No Electronic Systems" box and respond "Yes" for all questions in this section.

Item #1. Answer "Yes" if your business does not "offshore" or use, disclose, create, receive, transmit or maintain Texas HHS Confidential Information outside of the United States. If you are not certain, contact your provider of technology services (application, cloud, data center, network, etc.) and request confirmation that they do not off‐ shore their data.

Texas HHS System - Data Use Agreement - Attachment 2: SPI Version 2.1 (06/2018) Page 16 of 18

Item #2. Answer "Yes" if your business uses a person or company who is knowledgeable in IT security to maintain or oversee the configurations of your business's computing systems and devices. You may be that person, or you may hire someone who can provide that service for you.

Item #3. Answer "Yes" if your business monitors and manages access to Texas HHS Confidential Information (i.e., reviews systems to ensure that access is limited to Authorized Users; has formal processes for granting, validating, and reviews the need for remote access to Authorized Users to Texas HHS Confidential Information, etc.). If you are the only employee, answer "Yes" if you have implemented a process to periodically evaluate the need for accessing Texas HHS Confidential Information to fulfill your Authorized Purposes.

Item #4. Answer "Yes" if your business has implemented a system for changing the password a system initially assigns to the user (also known as the default password), and requires users to change their passwords at least every 90 days, and prohibits the creation of weak passwords for all computer systems that access or store Texas HHS Confidential Information (e.g., a strong password has a minimum of 8 characters with a combination of uppercase, lowercase, special characters, and numbers, where possible). If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-policy

Item #5. Answer "Yes" if your business assigns a unique user name and private password to each of your employees, your subcontractors, your volunteers, your trainees and any other persons under your direct control who will use, disclose, create, receive, transmit or maintain Texas HHS Confidential Information.

Item #6. Answer "Yes" if your business locks the access after a certain number of failed attempts to login and after 15 minutes of user inactivity on all computing devices that access or store Texas H H S Confidential Information. If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-policy

Item #7. Answer "Yes" if your business secures, manages, and encrypts remote access, such as: using Virtual Private Network (VPN) software on your home computer to access Texas HHS Confidential Information that resides on a computer system at a business location or, if you use wireless, ensuring that the wireless is secured using a password code. If you do not access systems remotely or over wireless, answer "Yes."

Item #8. Answer "Yes" if your business updates the computer security settings for all your computers and electronic systems that access or store Texas HHS Confidential Information to prevent hacking or breaches (e.g., non‐essential features or services have been removed or disabled to reduce the threat of breach and to limit opportunities for hackers or intruders to access your system). For example, Microsoft's Windows security checklist:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings

Item #9. Answer "Yes" if your business secures physical access to computer, paper, or other systems containing Texas HHS Confidential Information from unauthorized personnel and theft (e.g., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.). If you are the only employee and use these practices for your business, answer "Yes."

Item #10. Answer "Yes" if your business uses encryption products to protect Texas HHS Confidential Information that is transmitted over a public network (e.g., the Internet, WIFI, etc.) or that is stored on a computer system that is physically or electronically accessible to the public (FIPS 140‐2 validated encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data.) For more information regarding FIPS 140‐2 encryption products, please refer to: http://csrc.nist.gov/publications/fips).

Item #11. Answer "Yes" if your business stores Texas HHS Confidential Information on encrypted end‐user electronic…