Exhibit G_Data Sharing Agreement.docx

The DATA SHARING AGREEMENT between the

STATE OF WASHINGTON

Department of Transportation and BIDDER Exhibit G (KXXXX)

This Data Sharing Agreement (DSA) is entered into by and between the Washington State Department of Transportation, hereinafter referred to as “WSDOT”, and the BIDDER, hereinafter referred to as “BIDDER”, pursuant to the authority granted by Chapter 39.34 RCW.

RECITALS

WHEREAS, BIDDER desires to access Health Insurance Claim Invoicing Data from FTP site Database for Medical Invoicing Review Services, hereinafter referred to as “WSDOT data”; and

WHEREAS, the parties agree that an exchange of information, subject to the confidentiality laws of Washington State and Federal HIPAA regulations, would be in the public interest, NOW, THEREFORE, in consideration of the terms, conditions, covenants, and performances contained herein or attached and made a part hereof, WSDOT and BIDDER mutually agree as follows:

1. PURPOSE OF THE DSA

The purpose of this DSA is to securely, and in conformance with Washington State Law, share data with BIDDER containing the Health Insurance Claim invoices, or similar, to provide Medical Invoice Review Services for WSDOT's medical invoices for WSDOT's Medical Invoice Negotiating and Repricing Services.

2. PARTY INFORMATION

A. AGENCY PROVIDING DATA: WSDOT

Technical Administrator:

Title:

Division:

Address:

Phone:

E-mail:

B. ORGANIZATION RECEIVING DATA: BIDDER

Title:

Division:

Address:

Phone:

E-mail:

3. DEFINITIONS

“Agreement” means this Data Sharing Agreement, including all documents attached or incorporated by reference.

“Authorized User” means an individual or individuals with an authorized business need to access Data under this Agreement.

“Data Access” refers to rights granted to BIDDER employees to directly connect to WSDOT systems, networks and /or applications via the State Governmental Network (SGN) combined with required information needed to implement these rights.

“Data Backup” refers to the duplication or archiving of data for the purpose of being able to restore them in case of data loss.

“Data Transmission” refers to the methods and technologies to be used to move a copy of the data between WSDOT systems and BIDDER systems, networks and/or employee workstations.

“Data Storage” refers to the state data is in when at rest. Data shall be stored on secured environments.

“Data Encryption” refers to ciphers, algorithms or other encoding mechanisms that will encode data to protect its confidentiality. Data encryption can be required during data transmission or data storage depending on the level of protection required for this data.

“Data Transmission” refers to the methods and technologies to be used to move a copy of WSDOT Data between systems, networks, and/or workstations.

“Disclosure” means to permit access to or release, transfer, or other communication of WSDOT Data provided under this Agreement by any means including oral, written, or electronic means, to any party except the Recipient and its authorized users.

“HIPPA” means the Health Insurance Portability and Accountability Act

“Personal Information” means information identifiable to any person, including, but not limited to, information that relates to a person’s name, health, finances, education, business, use or receipt of governmental services or other activities, addresses, telephone numbers, social security numbers, driver’s license numbers, credit card numbers, any other identifying numbers, and any financial identifiers.

“RCW” means the Revised Code of Washington.

4. AUTHORITY and REASON FOR DATA SHARING The signatories to this Agreement represent that they have the authority to enter into and bind their respective organizations to this Agreement so they can use this information in the research and development of the WSDOT Medical Invoice Negotiating and Repricing Services, and nothing else.

5. DESCRIPTION OF DATA TO BE SHARED

The following WSDOT Data will be shared with the Recipient under the terms of this Agreement and found under Exhibit _ - Scope of Work.

A. WSDOT will provide a Microsoft Excel Spreadsheet listing each claim as well as a .pdf file containing all billings (normally on Health Insurance Claim Forms, or similar). The shared date could include, but not limited to, Social Security Numbers, birth dates, full names of claimants, claim numbers, medical conditions, treatments performed, and associated costs.

6. DATA OWNERSHIP AND USE

WSDOT Data is and shall remain the sole and exclusive property of WSDOT. BIDDER can access and use WSDOT Data solely for performing its obligations under this Agreement. BIDDER shall: (a) keep and maintain WSDOT Data in strict confidence and as further described in this Agreement and applicable law to avoid unauthorized access, use, disclosure, or loss; and, (b) not use, sell, rent, transfer, distribute, or otherwise disclose or make available WSDOT Data for BIDDER’s own purposes or for the benefit of anyone other than WSDOT without WSDOT’ prior written consent.

7. DATA ACCESS & TRANSMISSION

The access method(s) for the WSDOT Data is:

Secure FTP – Authorized Recipient staff will access and view data through a password protected File Transfer Protocol (FTP) hosted on WSDOT servers.

8. AUTHORIZED USERS

The Recipient’s authorized users of WSDOT data provided under this agreement are:

BIDDER staff listed in Appendix A (Created after negotiations). This DSA does not constitute a release for the BIDDER to share WSDOT Data with any third parties, including Contractors, even if for authorized use(s) under this DSA, without the third-party release being approved by WSDOT and identified in Appendix A of this DSA.

Access to WSDOT Data may only be shared with the authorized users listed in Appendix A. The Recipient will ensure that all authorized users are familiar with and comply with the terms of this Agreement.

9. DATA STORAGE, DISPOSAL, AND HANDLING REQUIREMENTS

The data and information being shared between WSDOT and Bidder shall meet all requirements of the HIPAA Security Rule.

Listed below are the required elements of the security standards general rule:

· Ensure the confidentiality, integrity, and availability of ePHI (electronic protected health information)

· Protect against reasonably anticipated threats to ePHI and vulnerabilities

· Implement controls to prevent uses and disclosures of ePHi not permitted by the HIPAA Privacy rule

· Ensure the entire workforce complies with policies and procedures covering Security Rule compliance

A. STORAGE:

Data stored for backup purposes. Data may be stored on portable media or non-portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of Bidder’s existing, documented backup process for business continuity or disaster recovery purposes. Data must be protected and disposed of as required by this agreement, per HIPAA laws.

Any data backups conducted by the Recipient of WSDOT Data are subject to the requirements to protect WSDOT Data as detailed in Section 13, SECURITY OF DATA.

B. HANDLING:

Only Authorized Recipient staff will access and download data through their individual secured TRANSMISSION METHOD, adhering to HIPAA laws

Secure password – The Recipient will protect downloaded electronic data with a secure password or similar method to prevent unintended or inadvertent disclosure.

C. DISPOSAL:

All data provided by WSDOT will be stored in an encrypted form on a server with limited access to the least number of staff needed to complete the contract’s Scope of Work.

At the end of the contract, or when WSDOT data is no longer needed, data shall be returned to WSDOT or destroyed via an authorized method per HIPPA laws.

10. INTENDED USE OF DATA

The Recipient will use and access WSDOT Data provided under this Agreement only for the limited purposes of carrying out activities pursuant to this Agreement as described herein.

The Recipient will access and view the data, as needed, using available information.

The Recipient will download data to be stored in a secure area accessible only by authorized staff.

The Recipient will not share any WSDOT Data provided to a third party without the prior written permission of WSDOT Technical Administrator.

The Recipient will not use or share this information in any other research or spatial analysis efforts outside of the WSDOT's Medical Invoice Negotiating and Repricing Services.

11. CONSTRAINTS ON USE OF DATA

This Agreement does not constitute a release of the data for BIDDER’s discretionary use, but may be accessed only to carry out the responsibilities specified in for the purposes described herein. Any ad hoc analyses or other use of the data, not specified in this Agreement, is not permitted without the prior written agreement of WSDOT.

12. CLASSIFICATION OF DATA

The State classifies data into categories based on the sensitivity of the data pursuant to the Security policy and standards of Washington Technology Solutions (WaTech) located at WaTech’s policies and standards

The Data that is the subject of this DSA is classified as indicated below:

☒ Category 3 – Confidential Information Confidential information is information that is specifically protected from release or disclosure by law. It may include but is not limited to:

• Personal Information about individuals, regardless of how that information is obtained;

• Information concerning employee personnel records;

• Information regarding IT infrastructure and security of computer and telecommunications systems;

☒ Category 4 – Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which:

• Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements;

• Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions.

Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested.

13. SECURITY OF DATA

A. Data Protection

The BIDDER will take due care to protect WSDOT Data from unauthorized physical and electronic access as described in this Agreement; and to ensure the Recipient is in compliance with all appropriate federal laws and applicable provisions of Washington Technology Solutions (WaTech) located at WaTech’s policies and standards

B. Data Security Technology Standards

WSDOT will be responsible for providing data security technology standards that will ensure acceptable levels of data security to BIDDER. These data security technology standards will include clear definitions outlining when and where data should be encrypted and by what technologies.

WSDOT requires BIDDER to use the methods detailed in Section 7 to provide acceptable levels of data security to BIDDER.

14. NON-DISCLOSURE OF DATA

Before receiving the data identified above, the BIDDER shall notify all staff who will have access to the data of the following requirements. A copy of this notification shall be provided to WSDOT at the same time it is provided to relevant BIDDER staff.

A. Non-Disclosure of Data

1. BIDDER staff shall not disclose, in whole or in part, the data provided by WSDOT to any individual or agency, unless this Agreement specifically authorizes the disclosure. Data may be disclosed only to persons and entities that have the need to use the data to achieve the stated purposes of this Agreement.

2. BIDDER shall not access or use the data for any commercial or personal purpose.

3. Any exceptions to these limitations must be approved in writing by WSDOT.

B. Penalties for Unauthorized Disclosure of Information In the event the BIDDER fails to comply with any terms of this Agreement, WSDOT shall have the right to take such action as it deems appropriate. The exercise of remedies pursuant to this paragraph shall be in addition to all sanctions provided by law, and to legal remedies available to parties injured by unauthorized disclosure.

The BIDDER accepts full responsibility and liability for any violations of the Agreement.

C. Employee Awareness of Use/Non-Disclosure Requirements

The BIDDER shall ensure that all staff with access to the data described in this Agreement are aware of the use and disclosure requirements of this Agreement and will advise new staff of the provisions of this Agreement.

The BIDDER will provide an annual reminder to staff of these requirements.

15. DATA CONFIDENTIALITY

A. Regulations Governing Confidentiality of Data

1. BIDDER acknowledges the confidential nature of the information and agrees that BIDDER personnel with access shall comply with all laws, regulations and policies that apply to protection of the confidentiality of the data.

2. This data is confidential should be secured following general HIPPA rules. Access and use of this information will be limited only to persons whose staff function requires such access.

B. Limited Access to Data

Only Individuals who are listed in Appendix A – Authorized Personnel will access data for the purpose of this Agreement.

16. OVERSIGHT

BIDDER agrees that WSDOT will have the right, at any time, to monitor, audit, and review activities and methods in implementing this Agreement in order to assure compliance therewith, within the limits of BIDDER technical capabilities.

17. INCIDENT RESPONSE

The BIDDER Agreement Administrator will provide prompt notice to WSDOT of any incident that may be a breach that requires notice to affected individuals under RCW 42.56.590, RCW 19.255.010, or any other applicable breach notification law or rule.

Upon discovery or reasonable belief of any access, destruction, loss, theft, use or disclosure of WSDOT Data by an unauthorized party (“Data Breach”), BIDDER shall notify WSDOT by the fastest means available and in writing. BIDDER shall provide such notification within forty-eight (48) hours after BIDDER reasonably believes there has been such a Data Breach. BIDDER’s notification shall identify: (a) the nature of the Data Breach; (b) the WSDOT Data accessed, used or disclosed; (c) the person(s) who accessed, used, disclosed and/or received WSDOT Data (if known); (d) what Contractor has done or will do to quarantine and mitigate the Data Breach; and (e) what corrective action BIDDER has taken or will take to prevent future Data Breaches.

18. AMENDMENTS AND ALTERATIONS TO THIS AGREEMENT

With mutual consent, WSDOT and BIDDER may amend this Agreement at any time, provided that the amendment is in writing and signed by authorized staff.

19. ASSIGNMENT

BIDDER shall not assign or otherwise transfer authorization without the prior written consent of WSDOT.

20. TERMINATION

In case of termination, any and all WSDOT Data provided under this Agreement shall either be immediately returned to WSDOT or immediately destroyed by the Recipient as described Section 9. DATA STORAGE, DISPOSAL, AND HANDLING REQUIREMENTS. The Recipient accepts full responsibility and liability for any violations of this Agreement by the Recipient or any officer, employee, or agent of the Recipient; and any such violation shall result in immediate termination by WSDOT of this Agreement and immediate forfeiture to WSDOT of WSDOT Data in any form held by the Recipient or any officer, employee, or agent of the Recipient. In such event, the Recipient shall be liable for damages as authorized by law.

21. WAIVER

No term or condition of this Agreement shall be held to be waived, modified, or deleted, and no breach excused, except by a written instrument signed by the parties hereto. Waiver of any breach of any term or condition of this Agreement shall not be deemed a waiver of any prior or subsequent breach.

22. WARRANTIES

WSDOT makes no warranties as to accuracy of WSDOT Data and is not responsible for any loss or damage to Recipient resulting from receiving WSDOT Data under this Agreement. By entering into this Agreement, the Recipient hereby waives any and all claims against WSDOT for any losses or damages arising out of this Agreement. Additionally, the Recipient acknowledges that WSDOT is not providing WSDOT Data under this Agreement as a response to a public record request by the Recipient under the Public Records Act.

23. GOVERNANCE

A. The provisions of this Data Sharing Agreement are severable. If any provision of this Agreement is held invalid by any court that invalidity shall not affect the other provisions of this Data Sharing Agreement and the invalid provision shall be considered modified to conform to the existing law.

B. In the event of a lawsuit involving this Data Sharing Agreement, venue shall be proper only in Thurston County, Washington.

24. INDEMNIFICATION

BIDDER shall defend, indemnify, and hold WSDOT harmless from and against any claims, including reasonable attorneys’ fees resulting from such claims, by third parties for any or all injuries to persons or damage to property of such third parties arising from intentional, willful or negligent acts or omissions of their officers, employees, or agents.

25. SEVERABILITY

If any term or condition of this Data Sharing Agreement or the application thereof is held invalid, such invalidity shall not affect other terms, conditions, or applications which can be given effect without the invalid term, condition, or application; to this end the terms and conditions of this Agreement are declared severable.

26. AUTHORITY TO BIND

The signatories to this Data Sharing Agreement represent that they have the authority to bind their respective organizations to this Agreement.

27. COUNTERPARTS

This Agreement may be executed in counterparts or in duplicate originals. Each counterpart or each duplicate shall be deemed an original copy of this Data Sharing Agreement signed by each party, for all purposes. Only those persons with authority to bind the parties may sign the Agreement.

28. ELECTRONIC SIGNATURES

A signed copy of this Contract or any other ancillary agreement transmitted by facsimile, email, or other means of electronic transmission shall be deemed to have the same legal effect as delivery of an original executed copy of this Contract or such other ancillary agreement for all purposes.

In Witness Whereof, the parties hereto, having read this Contract in its entirety, including all attachments, do agree in each and every particular and have thus set their hands hereunto.

EXECUTED and EFFECTIVE as of the MONTH DAY, YEAR regardless of last date of signature.

Washington State Department of Transportation

BIDDER

Signature

Signature

Print Name & Title

Print Name & Title

Date

Date

WSDOT – Medical Invoicing Review Services Data Sharing Agreement