Combined Federal IT Requirements

Center for Medicare and Medicaid Services (CMS) Contractor Language

In performance of this contract, the Contractor of the VW Departments of Health (DH), Health Facilities (DHF), and Human Services (DoHS) agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

1. Safeguards

A. The Service Provider shall comply with all applicable regulations regarding the privacy and security of Pll (see, e.g., § 1411(g) of the PPACA, 45 CFR § 155.260) and all applicable regulations regarding the privacy and security of PII, including provisions of the HIPAA Privacy and Security Rules at 45 CFR Parts 160 and 164, that govern protections for individually identifiable health information.

B. The Service Provider must comply with the most current version of the suite of documents entitled "Acceptable Risk Controls for Affordable Care Act (ACA), Medicaid, and Partner Entities" (ARC-AMPE), or any subsequent CMS standard or equivalent governing security and privacy control implementation. These documents outline the privacy and security requirements the Service Provider is obligated to follow. Further, the Service Provider also agrees to adhere to all applicable and current guidance, including any updates to ARC-AMPE (or its CMS successor or equivalent), as well as all relevant laws and regulations issued on this subject as they are published and become effective.

C. The Service Provider must ensure that its employees, contractors, and agents implement the appropriate administrative, physical and technical safeguards to protect matching data furnished by CMS under the State Based Administering Entity's Computer Matching Agreement (CMA) and Interconnection Security Agreement (ISA) (including matching data which constitutes PIO from loss, theft or inadvertent disclosure.

• The Service Provider will advise all users who will have access to the matching data (including but not limited to matched and to any data derived from the match) of the confidential nature of the data, the safeguards required to protect the data, and the civil and criminal sanctions for noncompliance contained in applicable Federal laws.

• Physical Security/Storage: The Service Provider will store the matching data and any data derived from the match in an area that is physically and technologically secure from access by unauthorized persons during duty hours, as well as non-duty hours or when not in use (e.g., door locks, card keys, biometric identifiers, etc.). Only authorized personnel will transport the matching data and any data derived from the match. The Service Provider will establish appropriate safeguards for such data, as determined by a risk-based assessment of the circumstances involved.

• Technical Safeguards: The Service Provider agrees that the data exchanged with CMS will be processed under the immediate supervision and control of authorized personnel to protect the confidentiality of the data in such a way that unauthorized persons cannot retrieve any such data by means of computer, remote terminal, or other means. The Service Provider will strictly limit authorization to those electronic data areas necessary for authorized persons to perform his or her official duties.

• The Service Provider shall ensure that its employees, contractors, and agents understand that they are responsible for safeguarding this information at all times, regardless of whether the employee, contractor, or agent is at his or her regular duty station.

• The Service Provider shall ensure that its employees', contractors', and agents' laptops and other electronic devices/media containing matching data that constitutes Pll are encrypted and/or password protected.

• The Service Provider shall ensure that its employees, contractors, and agents transmit e-mails containing matching data that qualifies as Pll only when the information is encrypted and sent to, and received by, individuals who are authorized to access such information.

• The Service Provider shall ensure that its employees, contractors, and agents restrict access to the matching data to only those authorized AE employees, contractors, and agents who need such data to perform their official duties in connection with purposes identified in the CMA; such restrictions shall include, at a minimum, role- based access that limits access to those individuals who need it to perform their official duties in connection with the uses of data authorized in the CMA ("authorized users").

• The Service Provider shall advise all users who will have access to the data provided under the CMA and to any data derived from the data matching contemplated by the CMA of the confidential nature of the data, the safeguards required to protect the data, and the civil and criminal sanctions for noncompliance contained in the applicable

Federal laws. The Service Provider shall require its contractors, agents, and all employees of such contractors or agents with authorized access to the data disclosed under the CMA to comply with the terms and conditions set forth in the CMA, and not to duplicate, disseminate, or disclose such data unless authorized under the CMA.

2. Incident Handling and Reporting

A. The Service Provider shall follow the Departments' policies and procedures and must establish its own formal, written policies and procedures for responding to privacy and security incidents. These policies must comply with applicable state and federal law, ARC- AMPE (or the most current CMS standard or equivalent for security and privacy control implementation), and all relevant CMS guidance. Service Providers shall handle and report incidents in accordance with the Departments and its organization's documented incident handling and breach notification procedures. These policies and procedures should include the scope, roles, responsibilities and how to:

• Identify Incidents involving matching data that constitute PII.

• Report all suspected or confirmed incidents involving matching data that constitute PII. This requirement applies to all system environments.

• Identify and convene a core response group within the organization who will determine the risk level of incidents involving matching data that constitute PII and determine risk-based responses to such incidents.

• Ensure the incident response plan, as required by ARC-AMPE (or most current CMS standard or equivalent for security & privacy control implementation) contains up-to-date contact information for personnel handling interconnection security-related incidents.

• Determine whether breach notification is required, and, if so, identify appropriate breach notification methods, timing, source, and contents from among different options, and bear costs associated with the notice as well as any mitigation.

• Limit the disclosure of information about individuals whose information may have been compromised, misused, or changed without proper authorization, and the persons who improperly disclosed matching data that constitute PII, to authorized federal, state, or local law enforcement investigators in connection with efforts to investigate and mitigate the consequences of any such incidents. Inform the affected federal partner agency(s) in a timely manner and facilitate a coordinated federal response.

B. CMS reserves the right to terminate the service provider's interconnection to the federal data services Hub to mitigate or avoid any immediate or recurring risks to the security of its systems. In addition, upon discovery of a security or privacy incident, participating federal agencies may direct CMS to terminate the connection with the affected organization.

C. Maintain audit trail records that contain sufficient detail, as described in ARC-AMPE (or most current CMS standard or equivalent for security & privacy control implementation) to facilitate the reconstruction of events if compromise or malfunction is confirmed or suspected.

D. Review audit records as specified in the WV DoHS System Security and Privacy Plan (SSPP).

3. Records Usage, Duplication, and Redisclosure Restrictions

A. The Service Provider will only use, duplicate, and disclose the electronic files and data provided by CMS as permitted or required by the CMA or as required by applicable Federal law.

B. The Service Provider will not use the matching data to extract information concerning individuals therein for any purpose not specified by the CMA or allowed by applicable SORN or Federal law.

C. The Service Provider will restrict access to data solely to its officers, employees, and contractors.

1. The Service Provider will restrict access to the matching data to Applicants, Enrollees, Application Filers, and Authorized Representatives of such persons. The Service Provider shall execute with each individual or entity such as agents or brokers that (1) gain access from the Service Provider to Pll submitted to an Exchange or (2) collect, use, or disclose Pll gathered directly from Applicants, or Enrollees while that individual or entity is performing the functions outlined in its agreement with the WV DH, DHF, and DoHS, a written contract or agreement that includes (1) a provision describing the functions to be performed by the individual or entity and strictly limiting the use and disclosure of Pll to those functions; (2) a provision(s) binding the individual or entity to comply with the same privacy and security standards and obligations that are made applicable to the Pll under the CMA, as appropriate, and specifically listing or incorporating those privacy and security standards and obligations; (3) a provision requiring the individual or entity to monitor, periodically assess, and update its security controls and related system risks to ensure the continued effectiveness of those controls; (4) a provision requiring the individual or entity to inform the WV DH, DHF, and DoHS of any change in its administrative, technical, or operational environments defined as material within the contract; (5) a provision that requires the individual or entity to bind any downstream entities to the same privacy and security standards and obligations to which the individual or entity has agreed in its contract or agreement with the Departments.

The Service Provider must assure that it will provide safeguards which restrict the use or disclosure of information concerning Applicants and recipients to purposes directly connected with the administration of all DH, DHF, and DoHS programs. This includes the disclosure of electronic data used to make an Eligibility Determination. 42 CFR § 431, subpart F, including §§ 431.301, 431.302, 431.303, 431.305, 435.945, and 42 CFR § 457.1110.

2. Any officer or employee of the Service Provider who receives information from an Exchange or via the Hub in connection with an eligibility determination for enrollment in an applicable State health subsidy program and who knowingly and willfully uses or discloses information obtained pursuant to the CMA in a manner or for a purpose not authorized by 45 CFR §

155.260 and § 1411(g) of the PPACA is potentially subject to the civil penalty provisions of Section 1411(h)(2) of the PPACA and 45 CFR § 155.285, which carries a fine of up to $25,000.

Social Security Administration (SSA) IT Contract Language

Compliance with NIST SP 800-53 Requirements

The Service Provider shall comply with all applicable security and privacy controls as outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53, latest revision (currently Revision 5), including any updates or successor publications, as applicable to the information system’s categorization under the Federal Information Security Modernization Act (FISMA).

The Service Provider shall implement, document, and maintain security and privacy controls aligned with the applicable control baselines (Low, Moderate, or High) as defined in NIST SP 800-53 for all systems, services, and components involved in the performance of this contract.

The Service Provider shall provide, upon request, documentation demonstrating compliance with NIST SP 800-53 controls, including but not limited to a System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and any continuous monitoring reports.

The Government (or Customer) reserves the right to audit or assess the Service Provider’s compliance with these requirements at any time during the period of performance.

Safeguarding Contract Language

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI.

Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving

FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action.

These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C.

552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

(5) III. INSPECTION The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

State of West Virginia

By: ____________________________

Printed Name:____________________

Title: ___________________________

Date: ___________________________

Vendor Name:

By: ________________________________

Printed Name: _______________________

Title: ______________________________

Date: ______________________________