Exhibit C - Draft Data Share Agreement.docx

EXHIBIT C – DRAFT DATA SHARE AGREEMENT

Definitions (specific to this Attachment) “Receiving Party” means the entity that is identified on the cover page of this DSA and is a party to this DSA, and includes the entity’s owners, members, officers, directors, partners, trustees, employees, and Subcontractors and their owners, members, officers, directors, partners, trustees, and employees.

“Security Awareness Program” or “SAP” means a formal program with the goal of training users on how to recognize potential security vulnerabilities, exploits and threats to an organization’s information technology infrastructure, along with how to avoid situations that may put an organization’s Data at risk.

“Use” includes the sharing, employment, application, utilization, examination, or analysis, of PHI within an entity that maintains such information.

Description of Data to be Shared / Data Licensing Statements Data Licensing Statements are the written statements that determine the following issues, at a minimum:

Identification of the purpose of the file;

Identification of costs (if any);

Identification of transmission method; and Identification of the file layout.

There must be at least one Data Licensing Statement attached hereto, but more than one Data Licensing Statement may be included or incorporated into this Contract at different times. Each Data Licensing Statement is incorporated into this Contract by using the same Attachment reference letter (A) and then further marking it with sequential identifying numbers (A1, A2, A3).

HCA System Access Requirements and Process Use for System Access Contracts only – otherwise delete The Contractor may request access to the [system] for up to [#] Authorized Users under this Contract.

The Contractor Contract Manager, identified in Section 3.4 must send the request to the HCA Security Help Desk at HCAITSecurity@hca.wa.gov.

The Contractor must access the system(s) through the State Governmental Network (SGN), or SecureAccessWashington (SAW), or through another method of secure access approved by HCA in writing.

Contractor Point of Contact. The Contractor Point of Contact will be the single source of access requests and the person HCA will contact for any follow-up information or to initiate an audit under this Contract. Contractor Point of Contact may be changed by written notice to the HCA Security Help Desk, email acceptable, with a copy to the HCA Contract Manager and HCA Office of Contracts and Procurements at contracts@hca.wa.gov.

HCA will grant the appropriate access permissions to Contractor Authorized Users within 30 calendar days from the date of receipt of a complete and accurate request form. HCA will respond within 5 business days of receipt of request form if there is a need for clarification or revisions to any inaccurate or incomplete request form(s).

HCA does not allow shared User IDs and passwords for use with Confidential Information or to access systems that contain Confidential Information. Contractor must ensure that only Authorized Users access and use the system(s) in this Contract, use only their own User ID and password to access the system(s), and do not allow employees or others who are not authorized to borrow a User ID or password to access any system(s).

Contractor must notify HCA within 5 business days whenever an Authorized User who has access to the Data is no longer employed by the Receiving Part or whenever an Authorized User’s duties change such that the user no longer requires access to the Data.

Contractor’s access to the systems may be continuously tracked and monitored. HCA reserves the right, at any time, to terminate Data access for an individual, conduct audits of system(s) access and use, and to investigate possible violations of this Contract and/or violations of federal and state laws and regulations governing access to PHI.

Data Classification The State classifies data into categories based on the sensitivity of the data pursuant to the security policies and standards promulgated by Washington Technology Solutions (WaTech). See the WaTech Data Classification Standard at: https://watech.wa.gov/sites/default/files/2023-12/Data%20Classification%20Standard_Approved_2023.pdf, and which is hereby incorporated by reference.

The Data that is the subject of this Contract is classified as indicated below:

☐ Category 1 – Public Information Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure but does need integrity and availability protection controls.

☐ Category 2 – Sensitive Information Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested.

☐ Category 3 – Confidential Information Confidential information is information that is specifically protected from disclosure by law. It may include but is not limited to:

Personal Information about individuals, regardless of how that information is obtained;

Information concerning employee personnel records;

Information regarding IT infrastructure and security of computer and telecommunications systems;

☐ Category 4 – Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which:

0. Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements;

Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions.

Constraints on Use of Data/Limited License Subject to the Terms and Conditions of this Contract, HCA hereby grants Contractor a limited license for the access and Permissible Use of Data. This grant of access may not be deemed as providing Contractor with ownership rights to the Data. The Data being shared/accessed is owned and belongs to HCA.

[Use for Limited Data Sets] Contractor agrees to not attempt to re-identify individuals in the Data shared or attempt to contact said individuals.

[Use for Part 2 (SUD/MH) Data] If Data shared under this Contract includes data protected by 42 C.F.R. Part 2. In accordance with 42 C.F.R. § 2.32, this Data has been disclosed from records protected by federal confidentiality rules (42 C.F.R. Part 2). The federal rules prohibit Contractor from making any further disclosure(s) of the Data that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (42 C.F.R. § 2.31). The federal rules restrict any use of the SUD data to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at 42 C.F.R. §§ 2.12(c)(5) and 2.65.

This Contract does not constitute a release of the Data for the Contractor’s discretionary use. Contractor must use the Data received or accessed under this Contract only to carry out the purpose and justification of this Contract as set out in the Data Licensing Statement(s). Any Use or reporting (including of artificial intelligence tools) that is not within the Purpose of this DSA is not permitted without HCA’s prior written consent.

This Contract does not constitute a release for Contractor to share the Data with any third parties, including Subcontractors, even if for authorized use(s) under this Contract, without the third party release being approved in advance by HCA and identified in the Data Licensing Statement(s).

Derivative Data Product Review and Release Process.

All reports derived from Data shared under this Contract, produced by Contractor that are created with the intention of being published for or shared with external customers (Data Product(s)) must be sent to HCA for review of usability, data sensitivity, data accuracy, completeness, and consistency with HCA standards prior to disclosure. This review will be conducted, and response of suggestions, concerns, approval, or notification of additional review time needed provided to Receiving Party within 10 business days. HCA reserves the right to extend the review period as needed for approval or denial.

Small Numbers. Contractor will adhere to HCA Small Numbers Standards, Attachment C. HCA and Contractor may agree to individual Permissible Use exceptions to the Small Numbers Standards, in writing (email acceptable).

Any disclosure of Data contrary to this Contract is unauthorized and is subject to penalties identified in law.

If Contractor is not a Business Associate, include section 4.8 below. If Contractor is a Business Associate remove section 4.8.

The Receiving Party must comply with the Minimum Necessary Standard, which means that Receiving Party will use the least amount of PHI necessary to accomplish the Purpose of sharing as described in the attached Attachment A(s): Data Licensing Statement(s).

Receiving Party must identify:

Those persons or classes of persons in its workforce who need access to PHI to carry out their duties; and For each such person or class of persons, the category or categories of PHI to which access is needed and any conditions appropriate to such access.

Receiving Party must implement policies and procedures that limit the PHI disclosed to such persons or classes of persons to the amount reasonably necessary to achieve the purpose of the disclosure, in accordance with the attached Data Licensing Statement(s).

Data Modification(s) Any modification to the Purpose, Justification, Description of Data to be Shared/Data Licensing Statement(s), and Permissible Use, is required to be approved through HCA’s Data Request Process. Contractor must notify HCA’s Contract Manager of any requested changes to the Data elements, use, records linking needs, research needs, and any other changes from this Contract, immediately to start the review process. Approved changes will be documented in an Amendment to the Contract.

Security of Data Security Awareness Program The Receiving Party must have a Security Awareness Program. This program must:

Be issued biennially, or more frequently, for all Receiving Party’s employees or Subcontractors whose roles are associated with the Data contemplated in this DSA; and At HCA’s request, Receiving Party will provide documentation demonstrating its Security Awareness Program and associated training.

Data Protection The Contractor must protect and maintain all Confidential Information gained by reason of this Contract against unauthorized use, access, disclosure, modification, or loss. This duty requires the Contractor to employ reasonable security measures, which include restricting access to the Confidential Information by:

Allowing access only to staff that have an authorized business requirement to view the Confidential Information.

Physically securing any computers, documents, or other media containing the Confidential Information.

Data Security Standards Receiving Party must comply with the Data Security Requirements set out in Exhibit A and all WaTech Security Policies and Standards. See WaTech Security Policies and Standards at: https://watech.wa.gov/sites/default/files/2023-12/141.10_SecuringITAssets_2023_12_Parts_Rescinded.pdf. All WaTech Security Policies and Standards are hereby incorporated by reference into this DSA.

The Contractor must have a policy regarding monitoring and enforcement of the Data protection requirements specific in this DSA.

Data Disposition and Retention Contractor will dispose of HCA Data in accordance with this section.

Upon request by HCA, or at the end of the Contract term, or when no longer needed, Confidential Information/Data must be disposed of as set out in Attachment B, Data Security Requirements, Section 5 Data Disposition, except as required to be maintained for compliance or accounting purposes. Contractor will provide written certification to HCA of disposition using Attachment D, Certification of Destruction/Disposition of Confidential Information.

[Medicaid Claims Data] For the purpose of this section, “fiscal year” means the 12-month period of July 1 to June 30. Claims Data will not be kept or maintained beyond 10 years after the end of the fiscal year in which the claim is dated. Client Data, not including Claims Data, will not be kept or maintained beyond 10 years from the date received from HCA. Any other Data will not be kept or maintained beyond 10 years from the date received from HCA. At that time Data and derivative Data Products must be disposed of in accordance with subsection B.

Data Confidentiality and Non-Disclosure Data Confidentiality.

The Contractor will not use, publish, transfer, sell, or otherwise disclose any Confidential Information gained by reason of this Contract for any purpose that is not directly connected with the purpose, justification, and Permissible Use of this Contract, as set out in the attached Data Licensing Statement(s), except: (a) as provided by law; or (b) with the prior written consent of the person or personal representative of the person who is the subject of the Data.

Non-Disclosure of Data The Contractor must ensure that all that all Authorized Users, including employees or Subcontractors who will have access to the Data described in this Contract (including both employees who will use the Data and IT support staff) are instructed and made aware of the use restrictions and protection requirements of this Contract before gaining access to the Data identified herein. For avoidance of doubt, the Contractor must also instruct and make any new employee aware of the use restrictions and protection requirements of this DSA before they gain access to the Data.

The Contractor must ensure that each Authorized User who will access the Data adheres to confidentiality and non-disclosure obligations at least as restrictive as those contained in this agreement. The Contractor must retain a signed copy of its confidentiality and non-disclosure obligations for a minimum of six years from the date the Authorized User’s access to the Data ends. The documentation must be available to HCA upon request.

Penalties for Unauthorized Disclosure of Data Check for applicability and accuracy of these laws and rules regarding Purpose, Justification, and Permissible Use. Add/remove as applicable.

State laws (including RCW 74.04.060 and RCW 70.02.020) and federal regulations (including HIPAA Privacy and Security Rules, 45 C.F.R. Part 160 and Part 164; Confidentiality of Alcohol and Drug Abuse Patient Records, 42 C.F.R., Part 2; and Safeguarding Information on Applicants and Beneficiaries, 42 C.F.R. Part 431, Subpart F) prohibit unauthorized access, use, or disclosure of Confidential Information. Violation of these laws may result in criminal or civil penalties or fines.

The Contractor accepts full responsibility and liability for any noncompliance by itself, its employees, and its Subcontractors with these laws and any violations of the Contract.

Data Shared with Subcontractors If Data access is to be provided to a Subcontractor under this Contract it will only be for the Permissible Use authorized by HCA and the Contractor must include all of the Data security terms, conditions and requirements set forth in this Attachment in any such Subcontract. In no event will the existence of the Subcontract operate to release or reduce the liability of the Contractor to HCA for any Data Breach in the performance of the Contractor’s responsibilities.

Audit At HCA’s request or in accordance with WaTech Security Policies and Standards, Receiving Party shall obtain audits covering Data Security and Permissible Use. Receiving Party may cover both the Permissible Use and the Data Security Requirements under the same audit, or under separate audits. The term, “independent third-party” as referenced in this section means an outside auditor that is an independent auditing firm.

Data Security audits must demonstrate compliance with Data Security standards adopted by WaTech, and as set forth in Exhibit A, Data Security Requirements. At a minimum, audit(s) must determine whether Data Security policies, procedures, and controls are in place to ensure compliance with all Data Security Requirements set forth herein and as required by state and federal law..

Permissible Use Audits must demonstrate compliance with Permissible Use standards as set forth in this Contract and each Attachment A. Audit(s) must determine whether Permissible Use policies, procedures, and controls are in place to ensure compliance with all Permissible Use requirements in this Contract.

HCA may monitor, investigate, and audit the use of Personal Information received by Contractor through this Contract. The monitoring and investigating may include the act of introducing data containing unique but false information (commonly referred to as “salting” or “seeding”) that can be used later to identify inappropriate use or disclosure of Data.

During the term of this Contract and for six (6) years following termination or expiration of this Contract, HCA will have the right at reasonable times and upon no less than five (5) business days prior written notice to access the Contractor’s records and place of business for the purpose of auditing and evaluating the Contractor’s compliance with this Contract and applicable laws and regulations.

Data Breach Notification and Obligations The Data Breach or potential compromise of Data shared under this Contract must be reported to the HCA Privacy Officer at PrivacyOfficer@hca.wa.gov within one (1) business day of discovery.

If the Data Breach or potential compromise of Data includes PHI, and the Contractor does not have full details, it will report what information it has and provide full details within 15 business days of discovery. To the extent possible, these reports must include the following:

The identification of each individual whose PHI has been or may have been improperly accessed, acquired, used, or disclosed;

The nature of the unauthorized use or disclosure, including a brief description of what happened, the date of the event(s), and the date of discovery;

A description of the types of PHI involved;

The investigative and remedial actions the Contractor or its Subcontractor took or will take to prevent and mitigate harmful effects and protect against recurrence;

Any details necessary for a determination of the potential harm to Clients whose PHI is believed to have been used or disclosed and the steps those Clients should take to protect themselves; and Any other information HCA reasonably requests.

The Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or HCA including but not limited to 45 C.F.R. Part 164 Subpart D; RCW 42.56.590; RCW 19.255.010; or WAC 284-04-625.

If notification must, in the sole judgement of HCA, must be made Contractor will further cooperate and facilitate notification to necessary individuals, to the U.S. Department of Health and Human Services (DHHS) Secretary, and to the media. At HCA’s discretion, Contractor may be required to directly perform notification requirements, or if HCA elects to perform the notifications, Contractor must reimburse HCA for all costs associated with notification(s).

Contractor is responsible for all costs incurred in connection with a security incident, Data Breach, or potential compromise of Data, including:

The reasonable costs of notification to individuals, media, and governmental agencies and of other actions HCA reasonably considers appropriate to protect HCA clients.

Computer forensics assistance to assess the impact of a Data Breach, determine root cause, and help determine whether and the extent to which notification must be provided to comply with Data Breach notification laws;

Notification and call center services, and other appropriate services (as determined exclusively by HCA) for individuals affected by a security incident or Data Breach, including fraud prevention, credit monitoring, and identify theft assistance; and Regulatory defense, fines, and penalties from any claim in the form of a regulatory proceeding resulting from a violation of any applicable privacy or security law(s) or regulation(s).

Compensation to HCA clients for harms caused to them by any Data Breach or possible Data Breach.

Any Breach of this section may result in termination of the Contract and the demand for return or disposition, as described in Section 7.4, of all HCA Data.

Contractor’s obligations regarding Data Breach notification survive the termination of this Contract and continue for as long as Contractor maintains the Data and for any Data Breach or potential compromise, at any time.

HIPAA Compliance There are 3 options for language in this section. Read the instructional language below and select the 1 option that applies and delete the rest.

Use the following language if Contractor is a Business Associate and does not have a stand-alone Business Associate Agreement:

This section of the Attachment is the Business Associate Agreement required by HIPAA. The Contractor is a “Business Associate” of HCA as defined by HIPAA.

HIPAA Point of Contact. The point of contact for the Contractor for all required HIPAA-related reporting and notification communications from this Section 12, HIPAA Compliance, and all required Data Breach notification communications from Section 11, Data Breach Notification and Obligations, is:

HCA Privacy Officer Washington State Health Care Authority 626 8th Avenue SE Olympia, WA 98504-2700 Telephone: (360) 725-1116 E-mail: PrivacyOfficer@hca.wa.gov Compliance. Business Associate must perform all Contract duties, activities, and tasks in compliance with HIPAA, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Office for Civil Rights, as applicable.

Use and Disclosure of PHI. Business Associate is limited to the following permitted and required uses or disclosures of PHI:

Duty to Protect PHI. Business Associate must protect PHI from, and will use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164, Security Standards for the Protection of Electronic Protected Health Information, with respect to ePHI, to prevent the unauthorized use or disclosure of PHI for as long as the PHI is within its possession and control, even after the termination or expiration of this Contract.

Minimum Necessary Standard. Business Associate will apply the HIPAA Minimum Necessary standard to any use or disclosure of PHI necessary to achieve the purposes of this Contract (45 C.F.R. § 164.514(d)(2) through (d)(5)).

Disclosure as Part of the Provision of Services. Business Associate will only use or disclose PHI as necessary to perform the services specified in this Contract or as required by law and will not use or disclose such PHI in any manner that would violate Subpart E of 45 C.F.R. 164, Privacy of Individually Identifiable Health Information, if done by Covered Entity, except for the specific uses and disclosures set forth below.

Use for Proper Management and Administration. Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

Disclosure for Proper Management and Administration. Business Associate may disclose PHI for the proper management and administration of Business Associate, subject to HCA approval, or to carry out the legal responsibilities of Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

Impermissible use or Disclosure of PHI. Business Associate must report to the contact identified in subsection 12.1, in writing, all uses or disclosures of PHI not provided for by this Contract within one business day of becoming aware of the unauthorized use or disclosure of PHI, including Data Breaches of unsecured PHI as required at 45 C.F.R. § 164.410, Notification by a Business Associate, as well as any Security Incident of which it becomes aware. Upon request by HCA, Business Associate will mitigate, to the extent practicable, any harmful effect resulting from the impermissible use or disclosure.

Failure to Cure. If HCA learns of a pattern or practice of Business Associate that constitutes a violation of the Business Associate’s obligations under the terms of this Contract and reasonable steps by the Business Associate do not end the violation, HCA may terminate this Contract, if feasible. In addition, if Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate’s obligations under the terms of their contract and reasonable steps by Business Associate do not end the violation, Business Associate must terminate the Subcontract, if feasible.

Termination for Cause. Business Associate authorizes immediate termination of this Contract by HCA, if HCA determines that Business Associate has violated a material term of this Business Associate Agreement. HCA may, at their sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause.

Consent to Audit. Business Associate must give reasonable access to PHI, its internal practices, records, books, documents, electronic data, and all other business information received from, or created or received by Business Associate on behalf of, HCA to the Secretary of DHHS and/or to HCA for use in determining compliance with HIPAA privacy requirements.

Obligations of Business Associate Upon Expiration or Termination. Upon expiration or termination of this Contract for any reason, with respect to PHI received from HCA, or created, maintained, or received by Business Associate or any Subcontractors on behalf of HCA, Business Associate must:

Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

Return to HCA or destroy the remaining PHI that the Business Associate or any Subcontractors still maintain in any form;

Continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164, Security Standards for the Protection of Electronic Protected Health Information, with respect to ePHI to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI.

Not use or disclose the PHI retained by the Business Associate or any Subcontractors other than for the purposes for which such PHI was retained and subject to the same conditions set out in subsection 12.1, Use and Disclosure of PHI, that applied prior to termination; and Return to HCA or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

Survival. The obligations of Business Associate under this section will survive the termination or expiration of this Contract.

Individual Rights Accounting of Disclosures Business Associate will document all disclosures, except those disclosures that are exempt under 45 C.F.R. § 164.528, of PHI and information related to such disclosures.

Within ten business days of a request from HCA, Business Associate will make available to HCA the information in Business Associate’s possession that is necessary for HCA to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate (45 C.F.R. §§ 164.504(e)(2)(ii)(G) and 164.528(b)(1)).

At the request of HCA or in response to a request made directly to the Business Associate by an Individual, Business Associate will respond, in a timely manner and in accordance with HIPAA, to requests by Individuals for an accounting of disclosures of PHI.

Business Associate record keeping procedures will be sufficient to respond to a request for an accounting under this section for the six years prior to the date on which the accounting was requested.

Access Business Associate will make available PHI that it holds that is part of a Designated Record Set when requested by HCA or the Individual as necessary to satisfy HCA’s obligations under 45 C.F.R. § 164.524, Access of Individuals to Protected Health Information.

When the request is made by the Individual to the Business Associate or if HCA asks the Business Associate to respond to a request, the Business Associate must comply with the requirements in 45 C.F.R. § 164.524, Access of Individuals to Protected Health Information, on form, time, and manner of access. When the request is made by HCA, the Business Associate will provide the records to HCA within ten business days.

Amendment If HCA amends, in whole or in part, a record or PHI contained in an Individual’s Designated Record Set and HCA has previously provided the PHI or record that is the subject of the amendment to Business Associate, then HCA will inform Business Associate of the amendment pursuant to 45 C.F.R. § 164.526(c)(3), Amendment of Protected Health Information.

Business Associate will make any amendments to PHI in a Designated Record Set as directed by HCA or as necessary to satisfy HCA’s obligations under 45 C.F.R. § 164.526, Amendment of Protected Health Information.

Subcontracts and other Third Party Agreements. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii), 164.504(e)(1)(i), and 164.308(b)(2), Business Associate must ensure that any agents, Subcontractors, independent contractors, or other third parties that create, receive, maintain, or transmit PHI on Business Associate’s behalf, enter into a written contract that contains the same terms, restrictions, requirements, and conditions as the HIPAA compliance provisions in this Contract with respect to such PHI. The same provisions must also be included in any contracts by a Business Associate’s Subcontractor with its own business associates as required by 45 C.F.R. §§ 164.314(a)(2)(i)(B) and 164.504(e)(5).

Obligations. To the extent the Business Associate is to carry out one or more of HCA’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Privacy of Individually Identifiable Health Information, Business Associate must comply with all requirements that would apply to HCA in the performance of such obligation(s).

Liability. Within ten business days, Business Associate must notify the contact identified in subsection 12.1 of any complaint, enforcement, or compliance action initiated by the Office for Civil Rights based on an allegation of violation of HIPAA and must inform HCA of the outcome of that action. Business Associate bears all responsibility for any penalties, fines, or sanctions imposed against the Business Associate for violations of HIPAA and for any imposed against its Subcontractors or agents for which it is found liable.

Data Breach Notification. Data Breach Notification and Obligations are detailed in Section 11.

Miscellaneous Provisions Regulatory References. A reference in this Attachment to a section of HIPAA means the section as in effect or as amended.

Interpretation. Any ambiguity in this Attachment will be interpreted to permit compliance with the HIPAA.

Use the following language if Contractor has a separate stand-alone Business Associate Agreement:

The parties to this Contract have entered into a Business Associate Agreement dated [date] (HCA Contract Number [Kxxxx]) that sets out Contractor’s obligations for compliance with HIPAA, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Office for Civil Rights, as applicable.

Use the following language if Contractor is not a Business Associate:

Contractor must perform all of its duties, activities, and tasks under this Attachment in compliance with HIPAA, and all applicable regulations as promulgated by the U.S. Department of Health and Human Services, Office for Civil Rights, as applicable.

Within ten (10) Business Days, Contractor must notify the HCA Privacy Officer at PrivacyOfficer@hca.wa.gov of any complaint, enforcement, or compliance action initiated by the Office for Civil Rights based on an allegation of violation of HIPAA and must inform HCA of the outcome of that action. Contractor bears all responsibility for any penalties, fines, or sanctions imposed against Contractor for violations of HIPAA and for any sanction imposed against its Subcontractors or agents for which it is found liable.

Data Breach Response Insurance Requirements For the term of this Contract and 3 years following its termination or expiration, Contractor must maintain insurance to cover costs incurred in connection with a security incident, Data Breach, or potential compromise of Data, including:

Computer forensics assistance to assess the impact of a Data Breach, determine root cause, and help determine whether and the extent to which notification must be provided to comply with Data Breach notification laws;

Notification and call center services for individuals affected by a security incident, or Data Breach;

Data Breach resolution and mitigation services for individuals affected by a security incident or Data Breach, including fraud prevention, credit monitoring, and identity theft assistance; and Regulatory defense, fines, and penalties from any claim in the form of a regulatory proceeding resulting from a violation of any applicable privacy or security law(s) or regulation(s).

Survival Clauses Check after drafting for completeness and accuracy The terms and conditions contained in this Attachment that by their sense and context are intended to survive the expiration or other termination of this Attachment must survive. Surviving terms include but are not limited to: Constraints on Use of Data / Limited License, Security of Data, Data Confidentiality and Non-Disclosure, Audit, HIPAA Compliance, Data Breach Notification and Obligations and Data Breach Response Coverage Requirements.

Attachment A1: Data Licensing Statement

1. Background Optional Explain the context for sharing the data – who’s who and how we got here.

Justification and Authority for Data Sharing The Data to be shared under this Contract are necessary to comply with Explain the justification for the data sharing and provide the statutory or rule authority allowing or requiring for the data to be shared. This should include the “reason” HCA is sharing it (RCW, C.F.R., WAC, Executive Order, other directive, or DUC reasoning for sharing the data and how it aligns with RCW 41.05).

Purpose / Use / Description of Data The purpose of this Attachment is to provide terms and conditions under which HCA will allow the restricted use of its Data to the Contractor, and under which the Contractor may receive and use the Data. This Attachment ensures that HCA Data is provided, protected, and used only for purposes authorized by state and federal law governing such Data use.

The scope of this Attachment only provides the Contractor with access and Permissible Use of Data; it does not establish an agency relationship or independent contractor relationship between HCA and the Contractor.

Explain the data to be shared, and the Use of the data, flow of the data, etc.

Permissible Use: Contractor may only use the Data for the purposes of [Permissible Use] [Pull information from DUC/subDUC DRST, this is information provided under Information Access, “What are the types of employee duties that will access this information?”] Authorized Users: The following is a comprehensive list of Receiving Party’s Authorized Users for the Data contemplated in this DSA.

i. Title/Category of Authorized User (not individual name)

ii. Title/Category of Authorized User (not individual name) Title/Category of Authorized User (not individual name) File Layout: The Parties will exchange Data using the mutually agreed upon file layouts below. The Parties may edit and/or change the File Layout as considered necessary.

Method of Access/Transfer: Once an established Secure Data Transfer connection with the host computer at Contractor’s location is confirmed, HCA will provide Data listed in File Layout list below, to Contractor.

Delivery Method: Secure File Transfer Frequency of Data Delivery: HCA will transmit Data [Frequency].

Costs: [(This will likely be N/A)] Example below – use what is received in Technical Design Specification.

Attachment B: Data Security Requirements

1. Definitions In addition to the definitions set out in the Data Use, Security, and Confidentiality Attachment, the definitions below apply to this Attachment.

“Hardened Password” means a string of characters containing at least three of the following character classes: upper case letters; lower case letters; numerals; and special characters, such as an asterisk, ampersand or exclamation point.

Passwords for external authentication must be a minimum of 10 characters long.

Passwords for internal authentication must be a minimum of 8 characters long.

Passwords used for system service or service accounts must be a minimum of 20 characters long.

“Portable/Removable Media” means any data storage device that can be detached or removed from a computer and transported, including but not limited to: optical media (e.g. CDs, DVDs); USB drives; or flash media (e.g. CompactFlash, SD, MMC).

“Portable/Removable Devices” means any small computing device that can be transported, including but not limited to: handhelds/PDAs/Smartphones; Ultramobile PCs, flash memory devices (e.g. USB flash drives, personal media players); and laptop/notebook/tablet computers. If used to store Confidential Information, devices should be Federal Information Processing Standards (FIPS) Level 2 compliant.

“Secured Area” means an area to which only Authorized Users have access. Secured Areas may include buildings, rooms, or locked storage containers (such as a filing cabinet) within a room, as long as access to the Confidential Information is not available to unauthorized personnel.

“Transmitting” means the transferring of data electronically, such as via email, SFTP, webservices, AWS Snowball, etc.

“Trusted System(s)” means the following methods of physical delivery: (1) hand-delivery by a person authorized to have access to the Confidential Information with written acknowledgement of receipt; (2) United States Postal Service (“USPS”) first class mail, or USPS delivery services that include Tracking, such as Certified Mail, Express Mail, or Registered Mail; (3) commercial delivery services (e.g. FedEx, UPS, DHL) which offer tracking and receipt confirmation; and (4) the Washington State Campus mail system. For electronic transmission, the Washington State Governmental Network (SGN) is a Trusted System for communications within that Network.

“Unique User ID” means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase, or other mechanism, authenticates a user to an information system.

Data Transmission When transmitting HCA’s Confidential Information electronically, including via email, the Data must be encrypted using NIST 800-series approved algorithms (http://csrc.nist.gov/publications/PubsSPs.html). This includes transmission over the public internet.

When transmitting HCA’s Confidential Information via paper documents, the Contractor must use a Trusted System and must be physically kept in possession of an authorized person.

Protection of Data The Contractor agrees to store and protect Confidential Information as described:

Data at Rest:

Data will be encrypted with NIST 800-series approved algorithms. Encryption keys will be stored and protected independently of the data. Access to the Data will be restricted to Authorized Users through the use of access control lists, a Unique User ID, and a Hardened Password, or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Systems which contain or provide access to Confidential Information must be located in an area that is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism.

Data stored on Portable/Removable Media or Devices:

Confidential Information provided by HCA on Removable Media will be encrypted with NIST 800-series approved algorithms. Encryption keys will be stored and protected independently of the Data.

HCA’s data must not be stored by the Contractor on Portable Devices or Media unless specifically authorized within the Contract. If so authorized, the Contractor must protect the Data by:

Encrypting with NIST 800-series approved algorithms. Encryption keys will be stored and protected independently of the data;

Control access to the devices with a Unique User ID and Hardened Password or stronger authentication method such as a physical token or biometrics;

Keeping devices in locked storage when not in use;

Using check-in/check-out procedures when devices are shared;

Maintain an inventory of devices; and Ensure that when being transported outside of a Secured Area, all devices with Data are under the physical control of an Authorized User.

Paper documents. Any paper records containing Confidential Information must be protected by storing the records in a Secured Area that is accessible only to authorized personnel. When not in use, such records must be stored in a locked container, such as a file cabinet, locking drawer, or safe, to which only authorized persons have access.

Data Segregation HCA’s Data received under this Contract must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach.

HCA’s Data must be kept in one of the following ways:

on media (e.g. hard disk, optical disc, tape, etc.) which will contain only HCA Data; or in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; or in a database that will contain only HCA Data; or within a database and will be distinguishable from non-HCA Data by the value of a specific field or fields within database records; or when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container.

When it is not feasible or practical to segregate HCA’s Data from non-HCA data, then both HCA’s Data and the non-HCA data with which it is commingled must be protected as described in this Attachment.

Contractor must designate and be able to identify all computing equipment on which they store, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Disposition Consistent with Chapter 40.14 RCW, Contractor shall erase, destroy, and render unrecoverable all HCA Confidential Data and certify in writing that these actions have been completed within thirty (30) days of the disposition requirement or termination of this Contract, whichever is earlier. At a minimum, media sanitization is to be performed according to the standards enumerated by NIST SP 800-88r1 Guidelines for Media Sanitization.

For HCA’s Confidential Information stored on network disks, deleting unneeded Data is sufficient as long as the disks remain in a Secured Area and otherwise meet the requirements listed in Section 3, above. Destruction of the Data as outlined in this section of this Attachment may be deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area.

Network Security Contractor’s network security must include the following:

Network firewall provisioning;

Intrusion detection;

Quarterly vulnerability assessments; and Annual penetration tests.

Application Security Contractor must maintain and support its software and subsequent upgrades, updates, patches, and bug fixes such that the software is, and remains secure from known vulnerabilities.

Computer Security Contractor shall maintain computers that access Data by ensuring the operating system and software are updated and patched monthly, such that they remain secure from known vulnerabilities. Contractor computer device(s) must also be installed with an Anti-Malware solution and signatures updated no less than monthly.

Offshoring Contractor must maintain all hardcopies containing Confidential Information only from locations in the United States.

Contractor may not directly or indirectly (including through Subcontractors) transport any Data, hardcopy or electronic, outside the United States unless it has advance written approval from HCA.

Attachment C: HCA Small Numbers Standard

1. Why do we need a Small Numbers Standard?

It is the Washington State Health Care Authority’s (HCA) legal and ethical responsibility to protect the privacy of its clients and members. However, HCA also supports open data and recognizes the ability of information to be used to further HCA’s mission and vision. As HCA continues down the path of Data Governance maturity, establishing standards such as this is key in helping HCA analysts and management meet the needs of external data requestors while maintaining the trust of our clients and members and complying with agency, state and federal laws and policies.

Publishing data products that include small numbers creates two concerns. As a reported number gets smaller, the risk of re-identifying an HCA client or member increases. This is especially true when a combination of variables are included in the data product to arrive at the small number (e.g. location, race/ethnicity, age, or other demographic information).

Small numbers can also create questions around statistical relevance. When it comes to publicly posting data products on HCA’s internet site, or sharing outside the agency, the need to know the exact value in a cell that is less than 11 must be questioned.

As the agency moves away from traditional, static reports to a dynamic reporting environment (e.g. Tableau visualizations), it is easier for external data consumers to arrive at small numbers. Further, those external consumers have an increasing amount of their own data that could be used to re-identify individuals. As a result, more rigor and a consistent approach needs to be in place to protect the privacy of HCA’s clients and members. Until now, some HCA data teams have elected to follow small numbers guidelines established by the Department of Health, which include examples of suppression methods for working with small numbers. HCA is now establishing its own standard, but is planning to work with DOH and other agencies dealing with healthcare data to try and develop a consistent small numbers methodology at a statewide level.

Scope HCA often uses Category 4 data to create summary data products for public consumption. This Standard is intended to define one of the requirements for a summary data product to be considered Category 1. Specifically, it is intended to define the level of suppression that must be applied to an aggregated data product derived from Category 4 data for the data product to qualify as Category 1. Category 1 products are data products that are shared external to the agency, in large part those products that are posted on HCA’s Internet website (www.hca.wa.gov). The primary scope of this Standard is for those data products posted publicly (e.g. on the website), or, shared as public information.

The following are examples of when this Standard does not apply to data products are:

Those shared directly with an external entity outside HCA, the Standard suppression of small numbers would not be required. However, you should notify the recipient that the data products contain sensitive information and should not be shared or published.

Those exchanged under a data share agreement (DSA) that will not be posted or shared outside the Contractor.

Those created for HCA-only internal use.

This standard does not supersede any federal and state laws and regulation.

Approach In 2017, an impromptu workgroup was formed to tackle the issue of small numbers and determine what the general approach for handling data products that contain them would be. This initial effort was led by the agency’s Analytics, Interoperability and Measurement (AIM) team who had an immediate need for guidance in handling and sharing of data products containing small numbers. The result of that work was a set of Interim Small Numbers Guidelines, which required suppression of cells containing values of less than 10. In addition, data products that contain small numbers are considered Category 2 under HCA’s Data Classification Guidelines.

In…