Form 2 - MSA Template for IT Project Health Assessments Consulting Project Management and Application Development Services.docx

Form 2 – Attachment F

MASTER SERVICES AGREEMENT

BETWEEN

THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY

AND

[ENTER VENDOR NAME]

This Master Services Agreement (“MSA”) is effective as of the last date of signature (the “Effective Date”) and is entered into by and between the Executive Office of Technology Services and Security (“EOTSS”), on its own behalf and on behalf of the Commonwealth of Massachusetts, and [Enter Vendor Name]. (“Contractor”). This MSA governs Contractor’s provision of [Information Technology Project Health Assessments, Consulting, Project Management and Application Development] Services (“Services”). The entire agreement (“Agreement”) between Contractor and EOTSS consists of the following documents, in the following order of precedence. If any terms in the following documents conflict, the document of higher precedence shall govern.

1. The Commonwealth Terms and Conditions for Information Technology Contracts;

2. The Commonwealth Standard Contract Form;

3. Request for Response ITS81 (“RFR”);

4. Contractor’s Response to the RFR;

5. RFQ-XXXXXXXXXXXX) (including all amendments, EOTSS’ answers to related Bidder questions and clarifications thereto);

6. This MSA and any Amendments hereto, including:

a. Attachment A – Pub. 1075, Exhibit 7

b. Attachment B – Data Management and Confidentiality Agreement

c. Attachment C – CJIS Memorandum of Understanding

d. Attachment D – All Inclusive Hourly Rates

e. Attachment E – Fixed Price SOW Template

f. Attachment F – Time and Materials SOW Template

7. Appendix A to this MSA;

8. Statements of Work Quotes, and other documents agreed to by Contractor and the Ordering Entity;

9. Contractor’s response to the RFQ (including all amendments, clarifications, and best and final offers).

1. Definitions

“Access” means access or potential access.

“Business Days” means all days except for weekends and Commonwealth holidays. A list of Commonwealth holidays is available at https://www.sec.state.ma.us/divisions/cis/holiday-info.htm.

“Commonwealth Data” means all information, data, materials, and content provided by, or originating from, the Commonwealth. Commonwealth Data may include information which is protected under applicable data laws, regulations, and policies, including without limitation, the Health Insurance Portability and Accountability Act of 1996, IRS Publication 1075, the FBI CJIS Security Policy, M.G.L. c. 66a, and M.G.L. c. 93H.

“Deliverable” means any work product that Contractor delivers for the purposes of fulfilling its obligations to an Ordering Entity.

“Key Personnel” means Contractor personnel directly responsible for management of the SOW or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the SOW.

“Ordering Entity” or “Customer” means the Executive Office of Technology Services and Security or another Commonwealth entity with EOTSS’ prior written authorization. This MSA is made available to (1) the Executive Branch, consisting of Secretariats, Agencies, departments, and offices, and (2) other government entities within the Commonwealth as authorized by EOTSS.

“Statement of Work” (“SOW") means a written agreement between an Ordering Entity and Contractor, subject to this MSA, for the purchase of Services from the Contractor.

“Task” means a material activity engaged in by Contractor for the purpose of fulfilling its obligations to an Ordering Entity.

2. Term

Unless earlier terminated in accordance with the Agreement, this MSA will terminate three (3) years (“the “Term”) from the Effective Date (the “Termination Date”). Any SOWs entered into during the Term may extend for a period beyond the Termination Date, as agreed to in the SOW, and the MSA will continue to govern such SOW for such period. The Term of this MSA may be renewed upon written agreement of EOTSS and Contractor, subject to the statewide contract ITS81. Notwithstanding the foregoing, the terms pertaining to protection of Commonwealth Data (MSA, section 4), as well as intellectual property rights and Contractor warranties provided under executed SOWs shall survive the termination of this MSA.

3. Services

Contractor shall [describe services or product]

4. Billing, Payment, and Price List

Contractor will provide to Ordering Entities pricing no greater than the prices provided in the Contractor’s Price Response attached hereto as Attachment D (All Inclusive Hourly Rates). The Ordering Entity and Contractor may agree to further discounts or reduced rates from those listed in Attachment D in a specific SOW or other written agreement subject to this MSA.

Contractor may provide additional discounts or reduced rates dependent on the Ordering Entity’s upfront commitment, size of purchase, or other circumstances of the sale. All SOWs will be subject to the Commonwealth’s bill paying policy and the terms of ITS81.

5. Amendments

EOTSS and Contractor may amend this MSA and an Ordering Entity and Contractor may amend any SOW prior to the Termination Date, each upon mutual written agreement. The Project Manager (“PM”) who would like to request a change will provide the suggested amendment in writing to the other Party’s PM. The PMs will jointly determine whether the change impacts any terms contained within the Agreement. The Parties may mutually agree to the change through a written signed amendment to the MSA or SOW.

6. Statements of Work

a. Time and Materials SOWs

All SOWs for Time and Materials Services will describe the general Tasks and Deliverables to be completed by the Contractor. A Task or Deliverable will be considered “complete” when all the acceptance criteria set forth in the SOW have been met. All written work product shall be delivered in a format specified by the Ordering Entity. All meetings shall be held on-premises at the address of the Ordering Entity, unless agreed to otherwise by the Project Managers.

Contractor shall provide Named Resources and complete the work described in the SOW, and as scheduled through regular planning meetings. Contractor will submit weekly reports to the Ordering Entity detailing the hours worked by each Named Resource. The weekly reporting must show actual resource hours worked against assigned Tasks and/or Deliverables and a description of completed Tasks or progress toward completion. Contractor will also report weekly to the Ordering Entity its expected work effort the forthcoming week, showing each Named Resource’s expected level of effort. Prior review and authorization of each report by the Ordering Entity is required to authorize any work by the Named Resource.

The Ordering Entity will review each weekly report and approve these reports based on satisfactory work performance by each Named Resource, satisfactory completion of Tasks listed in the SOW, and fulfillment of metrics of acceptance in the Agreement.

Within five (5) Business Days of each weekly report, the Ordering Entity will notify the Contractor, in writing, of acceptance or rejection. A rejection will include a written description of any relevant defects or issues. If the Ordering Entity does not respond with acceptance or rejection within five (5) Business Days of receipt, the Contractor shall provide a reminder notice to the Ordering Entity If the Ordering Entity fails to respond after the receipt of the reminder notice, Contractor must notify the Ordering Entity and the parties must agree to a new deadline for acceptance or rejection. Upon receipt of rejection, Contractor will act diligently to correct the specified defects or issues.

Contractor shall provide a bi-weekly invoice to the Ordering Entity for the actual hours worked per week of the Named Resource identified in the SOW. Each invoice must include resource names, dates of service, the hours worked and approved, and the relevant Task/Deliverable Name(s) as specified in the SOW for each date of service. The Ordering Entity will review and approve these invoices based on satisfactory work performance by each Named Resource, satisfactory completion of Tasks listed in the SOW, and fulfillment of the metrics of acceptance in the Agreement. Approved invoices will be payable by the Ordering Entity in accordance with the Commonwealth’s bill-paying policies. The Ordering Entity reserves the right to reject an invoice submitted more than thirty (30) Business Days after the Services were rendered. Each SOW will identify a total not-to-exceed amount payable.

b. Firm Fixed Price SOWs

All SOWs for Firm Fixed Price Services will describe the Tasks to be completed by the Contractor, the Deliverables to be provided by the Contractor, and a timeline for delivery. A Task or Deliverable will be considered “complete” when all the acceptance criteria set forth in the SOW have been met. All written Deliverables shall be delivered in a format specified by the Ordering Entity. All meetings shall be held on-premises at the address of the Ordering Entity, unless agreed to otherwise by the Project Managers.

Contractor shall perform Tasks and deliver Deliverables in conformance with the description and metrics of acceptance indicated in the SOW on or before the Due Dates set forth in the SOW. Upon acceptance by the Ordering Entity of the Deliverables or Tasks, the amounts specified in the SOW associated with each Deliverable or Task shall be payable to Contractor.

The Ordering Entity will review each Deliverable and determine whether it has met in all material respects the criteria established in the Agreement. Within ten (10) Business Days of receipt of each Deliverable, the Ordering Entity will notify the Contractor, in writing, of acceptance or rejection. A rejection will include a written description of the defects of the Deliverable. If the Ordering Entity does not respond with acceptance or rejection within ten (10) Business Days of receipt, the Contractor shall provide a reminder notice to the Ordering Entity. If the Ordering Entity fails to respond after the receipt of the reminder notice, Contractor must notify the Ordering Entity and the parties must agree to a new deadline for acceptance or rejection of the Deliverable. Upon receipt of rejection of a Deliverable, Contractor will act diligently to correct the specified defects and deliver an updated version of the Deliverable to the Ordering Entity Acceptance or rejection of the updated version of the Deliverable will be subject to the process described in this paragraph.

Following any acceptance of a Deliverable which requires additional work to be entirely compliant with the pertinent specifications, and until the next delivery, Contractor will use reasonable efforts to provide a prompt correction or workaround.

A Deliverable or Task will be considered “completed” when the Ordering Entity has accepted the Deliverable or Task in accordance with the SOW. Contractor shall issue invoices to the Ordering Entity for the Deliverables or Tasks that are completed (each, a “Valid Invoice”) within thirty (30) Business Days of the acceptance of the Deliverable or Task. Valid invoices shall be payable by the Ordering Entity in accordance with the Commonwealth’s bill-paying policies. Each SOW will identify a total amount payable.

c. Appendix A to the MSA

Appendix A to this MSA shall apply to all SOWs entered into by the Ordering Entities under this MSA.

7. Protection of Commonwealth Data

Contractor will comply, and ensure any subcontractor’s compliance, with all applicable State and Federal law in the provision of services under this MSA. Prior to completing any SOW under this Agreement, Contractor and the Ordering Entity will identify the data types which will be accessed by Contractor, and the applicable laws, regulations, and obligations of Contractor. To the extent that additional terms are required by the Ordering Entity, Contractor will engage in good faith negotiation to incorporate such additional terms in the applicable SOW. Omission of references to applicable State or Federal law in no way waives its applicability or the obligations of Contractor or the Ordering Entity to comply.

Contractor will Access Commonwealth Data solely as instructed by the Commonwealth and only to the extent necessary to fulfill its obligations to the Commonwealth under this MSA. Contractor will implement safeguards to ensure the security, confidentiality, and integrity of Commonwealth Data and protect such Commonwealth Data from disclosure to any third parties. In the event of any unauthorized disclosure of Commonwealth Data, Contractor shall notify EOTSS and (if different) the Ordering Entity, in writing immediately upon becoming aware of such disclosure, to retrieve any copies, to the extent practicable, of such Commonwealth Data.

In the event that Contractor will Access any Federal Tax Information subject to the Internal Revenue Service Publication 1075, Contractor will comply with the terms of Attachment A.

If Contractor’s Services are to be used in connection with the creation, receipt, maintenance or transmission of personally identifiable information (“PI”) as defined in this paragraph, Contractor will comply with the Data Management and Confidentiality Agreement (Attachment B) to satisfy the legal and contractual obligations of EOHHS and its Constituent Agencies. Contractor and the Commonwealth acknowledge and agree that pursuant to M.G.L. c. 7D, as subsequently amended pursuant to Article 87, EOTSS is responsible for supervising the information technology (“IT”) services of all agencies within the executive department, including the Executive Office of Health and Human Services (“EOHHS”) and its Constituent Agencies. In furtherance of such responsibility, EOTSS is authorized to, among other things, conduct, oversee and supervise the initiation of IT projects for such agencies, procure IT resources for them, provide centralized IT services on a chargeback basis, and, if authorized, enter into, manage and administer agreements or contracts in connection with such procurements on their behalf. In performing such work, EOTSS is the Business Associate of EOHHS and certain EOHHS Constituent Agencies under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 and the rules and regulations promulgated thereunder (as amended from time-to-time including, without limitation, the amendments enacted under Title XIII of the American Recovery and Reinvestment Act of 2009 and titled as the Health Information Technology for Economic and Clinical Health Act (HITECH)) (collectively “HIPAA”), and has additional obligations regarding the privacy, security and management of PI to which it may have access. In addition to HIPAA, EOHHS, certain Constituent Agencies and EOTSS as their Business Associate are subject to other privacy and security obligations. For example, MassHealth, the state’s Medicaid program administered by EOHHS is subject to, in addition to HIPAA, M.G.L. c. 66A, 801 CMR 3.00, M.G.L. c. 93H, 42 CFR Part 431, Subpart F, 42 CFR Part 2, third party agreements with other federal and state agencies such as the Social Security Administration, the Centers for Medicare and Medicaid Services and the Massachusetts Department of Revenue, and other applicable federal or state law, regulation, or agreement pertaining to the use, disclosure, maintenance, of personally identifiable information (including Protected Health Information, as defined in 45 CFR 164.103, Personal Data, as defined in M.G.L. c. 66A, Patient Identifying Information, as defined in 42 CFR Part 2).

In addition, to the extent that Contractor will Access any Criminal Justice Information, Contractor and the Commonwealth will first enter into a Memorandum of Understanding (Attachment C) governing Contractor’s Access and use of such Criminal Justice Information. In connection with its access to Criminal Justice Information, Contractor will undergo any required background checks and provide additional certifications, if requested by Ordering Entity.

Contractor shall comply with the Commonwealth’s Enterprise Information Security Policies and Standards (available at https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards) and with the obligations and requirements set forth in the Accessibility for IT Solutions Contract Language (available at https://www.mass.gov/service-details/accessibility-for-it-solutions-contract-language).

8. Prior Approval and Reporting

Contractor shall request EOTSS’ prior written approval before negotiating or entering into a Statement of Work with an Ordering Entity. EOTSS reserves the right to review and approve the final draft of the Statement of Work between the Contractor and the Ordering Entity.

Contractor will provide EOTSS with access to monthly reports, or more frequent reports upon EOTSS’ request, identifying all purchases made under this MSA, the Ordering Entity of each purchase, costs, quantities, term lengths, discounts provided, and any other information as reasonably requested by EOTSS.

Contractor will meet with EOTSS monthly, or more frequently upon EOTSS’ request, to review reports, planned purchases, and other contract management topics identified by EOTSS.

9. Contacts

Contractor will provide the following contacts to EOTSS for any inquiries related to this MSA. In addition, EOTSS may, in its discretion, escalate issues to the following individuals:

[Vendor name] Contact: XXXXXXXXX [Vendor name] Escalation Contacts: XXXXXX and XXXXXX

Contractor may contact EOTSS using the following email address for any inquiries related to this MSA:

itcontracts@mass.gov.

Contractor will send notices of security incidents to eotss-soc@mass.gov.

Either party may modify the contacts and email addresses listed above with prior written notice to the other party.

10. Signing Authority

This MSA may be signed in counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. The undersigned hereby represent that they are duly authorized to execute this agreement on behalf of their respective organizations.

Executive Office of Technology Services and [Enter Contractor Name] Security

Signature: ______________________________ Signature: ______________________________

Name: _________________________________ Name: ________________________________

Title: _________________________________ Title: ________________________________

Date: __________________________________ Date: _________________________________

Form 2 - MSA

ATTACHMENT A

INTERNAL REVENUE SERVICE PUBLICATION 1075 ADDENDUM

This Internal Revenue Service Publication 1075 Addendum (“Addendum”) is for the use of Contractor’s and its subcontractor services by state and local government agencies of the Commonwealth of Massachusetts and is entered into by Contractor, with offices [enter address], MA 02110 ("Contractor") and the Executive Office of Technology Services and Security (“Customer”). Together with the Master Services Agreement, this Addendum will govern each party’s respective obligations regarding the protection of Federal Tax Information as that term is defined in Internal Revenue Service Publication 1075, effective June 10, 2022. Customer agrees that the terms of the Master Services Agreement apply to the provision and use of the Contractor services.

Exhibit 7 Safeguarding Contract Language

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and t hat further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

Form 2 – Attachment A

ATTACHMENT B

DATA MANAGEMENT AND CONFIDENTIALITY AGREEMENT

This Data Management and Confidentiality Agreement (this “DMCA” is made by and between the Executive Office of Technology Services and Security (“EOTSS”) and (the “Contractor”). EOTSS and the Contractor are sometimes referred to herein individually as a “Party” and together as the “Parties.”

SECTION 1. BACKGROUND, SCOPE AND DEFINITIONS

Section 1.1 Background/Scope

Pursuant to M.G.L. c. 7D, as subsequently amended pursuant to Article 87, EOTSS is responsible for supervising the information technology (“IT”) services of all agencies within the executive department, including the Executive Office of Health and Human Services (“EOHHS”) and its Constituent Agencies, as defined herein. In furtherance of such responsibility, EOTSS is authorized to, among other things, conduct, oversee and supervise the initiation of IT projects for such agencies, procure IT resources for them, provide centralized IT services on a chargeback basis, and, if authorized, enter into, manage and administer agreements or contracts in connection with such procurement on their behalf. For purposes of this DMCA, the term “Constituent Agency” or “Agency” is used to refer to any of such departments, commissions, offices, boards, divisions, institutions and other entities within EOHHS, as set forth in Appendix B.

In performing such work, EOTSS is the Business Associate of EOHHS and certain EOHHS Constituent Agencies under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-91 and the rules and regulations promulgated thereunder (as amended from time-to-time including, without limitation, the amendments enacted under Title XIII of the American Recovery and Reinvestment Act of 2009 and titled as the Health Information Technology for Economic and Clinical Health Act (“HITECH”) (collectively “HIPAA”), and has additional obligations regarding the privacy, security and management of PI to which it may have access.

EOTSS has entered into a contract with the Contractor pursuant to which the Contractor shall provide services to EOTSS (the “Contract”).

The Parties are entering into this DMCA to establish the privacy, security and other requirements applicable to the Contractor performing and/or providing the Activities identified in the Contract for or to the Commonwealth.

Section 1.2 Definitions

When used in this DMCA, the following capitalized terms shall have the meanings ascribed to them below:

“Activities” shall mean the activities, functions and/or services to be performed or provided by the Contractor for, on behalf of and/or to the Commonwealth under the Contract.

“Applicable Law” shall mean M.G.L. c. 66A (FIPA), 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, the Health Insurance Portability and Accountability Act (HIPAA) Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, Subpart F and 42 CFR 434.6(a)(8) (Medicaid Confidentiality Rule), 42 CFR Part 2, 45 CFR § 155.260, MARS-E and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality, or security of PI.

“EOTSS” shall mean the Massachusetts Executive Office of Technology Services and Security.

“Event” shall mean the following, either individually or collectively: 1) any use or disclosure of PI not permitted under this DMCA; 2) any Security Incident; or 3) any other event that would trigger notification obligations under the Breach Notification Rule, M.G.L. c. 93H, other similar Applicable Law, or Third Party Agreement (defined below) requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of PI.

“HIPAA Rules” shall mean 45 CFR Parts 160, 162, and 164, inclusive of the Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), the Security Rule (45 CFR Part 160 and Part 164, Subparts A and C), the Breach Notification Rule (45 CFR Part 164, Subpart D) and the Enforcement Rule (45 CFR Part 160, Subparts C, D, and E).

“Individual” shall mean the person to whom the PI refers and shall include a person or organization who qualifies as a personal representative in accord with 45 CFR § 164.502(g).

“MARS-E” shall mean the suite of documents published by Centers for Medicare and Medicaid Services (“CMS”) entitled “Minimum Acceptable Risk Standards for Exchanges,” as it may be amended, restated or superseded from time to time, which provides guidance and requirements related to implementing the privacy and security standards with which EOHHS must comply pursuant to the Computer Matching Agreements between CMS and EOHHS and 45 CFR § 155.260.

“Online Tracking Technology” means any technologies that are used to collect and analyze information about how users interact with websites or mobile applications maintained by or on behalf of EOTSS, EOHHS, or a Constituent Agency.

“PI” shall mean any Protected Health Information, any “personal data” as defined in M.G.L. c. 66A, any “patient identifying information” as used in 42 CFR Part 2, any “personally identifiable information” as used in 45 CFR § 155.260, “personal information” as defined in M.G.L. c. 93H, and Third Party Data (defined below in Section 2.1.B) and any other individually identifiable information that is treated as confidential under Applicable Law or agreement (including, for example, any state and federal tax return information) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its performance of the Activities. Information, including aggregate information, is considered PI if it is not fully de-identified in accord with 45 CFR §§ 164.514(a)-(c).

“System” shall mean any Commonwealth system, database, application, or other information technology resource.

When used in this DMCA, the following terms shall have the same meaning as those terms have in the HIPAA Rules: Business Associate, Minimum Necessary, Notice of Privacy Practices, Personal Representative, Protected Health Information, Required by Law, Secretary, Security Incident and Workforce.

All other capitalized terms used in this DMCA, but not otherwise defined herein, or elsewhere in this DMCA, shall be construed in a manner consistent with the HIPAA Rules, M.G.L. c. 66A and all other Applicable Laws.

SECTION 2. DATA MANAGEMENT AND CONFIDENTIALITY

Section 2.1 Data Management and Confidentiality Obligations of the Contractor

A. Compliance with Applicable Laws. The Contractor must comply with all Applicable Laws in performing the Activities including any use and disclosure of PI. Without limiting the generality of the foregoing, the Contractor acknowledges and agrees as follows:

l. Business Associate under HIPAA. In performing the Activities, the Contractor acknowledges and agrees that it is acting as EOTSS’ Business Associate. The Contractor shall comply with all requirements of the HIPAA Rules applicable to a Business Associate. This DMCA shall serve as the Business Associate Agreement between the Contractor and EOTSS. Workforce members with access to unencrypted PI or an encryption key used to secure such PI must sign the Confidentiality Acknowledgement attached hereto as Appendix A prior to being granted such access.

2. Medicaid Confidentiality Rule. In performing the Activities, if the Contractor will create, receive, use, disclose, maintain, transmit or otherwise obtain information concerning Medicaid applicants and beneficiaries, the Contractor agrees to comply with the Medicaid Confidentiality Rule at 42 CFR 431 Subpart F and 42 CFR 434.6(a)(8). Consistent with these obligations, the Contractor shall restrict its use and disclosure of information concerning Medicaid applicants and beneficiaries to purposes directly connected with the administration of the Medicaid plan. 42 CFR 431.302 defines purposes directly related to Medicaid Plan administration to include: (1) establishing eligibility, (2) determining the amount of medical assistance, (3) providing services for beneficiaries; and (4) conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the administration of the Medicaid plan.

3. 42 CFR Part 2. The Contractor acknowledges and agrees that with respect to any substance use information that the Contractor receives, stores, processes, uses, creates or transmits that was obtained by a Part 2 Program, Lawful Holder, or EOTSS (as such terms are used in 42 CFR Part 2), it is bound by 42 CFR Part 2 and shall not use or disclose information except as permitted under 42 CFR Part 2.

4. M.G.L. c. 66A. The Contractor acknowledges that in performing the Activities it will create, receive, use, disclose, maintain, transmit or otherwise obtain “personal data” (as defined in M.G.L. c. 66A) and that, in so doing, it becomes a “holder” of such data for purposes of M.G.L. c. 66A and shall comply with the same.

5. CORI Regulations. The Contractor shall, pursuant to and in accordance with 101 CMR 15.03(1)(b), require and consider the criminal history information pertaining to all Workforce members of the Contractor who will be given access or potential access to PI, and all applicants for employment with the Contractor where the position applied for entails access or potential access to PI. The Contractor shall otherwise comply with all applicable terms of 101 CMR 15.00 in connection with the review and consideration of employee and applicant criminal records.

6. Additional Requirements. EOTSS reserves the right to add any requirement for EOTSS, EOHHS, and/or its Constituent Agencies to comply with any applicable state or federal law or regulation, or any contractual obligation to which EOTSS, EOHHS, and/or its Constituent Agencies are subject, relating to privacy and/or security, and the Contractor agrees to negotiate in good faith to promptly execute and comply with any necessary amendment or additional agreement.

B. Compliance with Third Party Agreements. The Contractor acknowledges that EOHHS and its Constituent Agencies receive PI from regulated third parties including but not limited to the Social Security Administration, the Centers for Medicare and Medicaid Services, the Internal Revenue Service, the Department of Homeland Security, the Federal Data Services Hub and Massachusetts Department of Revenue (any such PI, “Third Party Data”). The use, disclosure, receipt, storage, transmission and maintenance of such Third Party Data is governed by agreements between EOHHS or its Constituent Agencies and the third party data sources (any such agreement, a “Third Party Agreement”). The Contractor agrees that it shall comply with all Third Party Agreements identified in Appendix C, including all conditions for disclosure under such Third Party Agreements such as third party source approval, background checks and training.

C. Ownership and Control of Data. The Contractor may use and disclose PI only as permitted by this DMCA. The Contractor does not possess any independent rights of ownership to such data. EOHHS and/or its Constituent Agencies are the lawful owner, holder, or licensee of all PI used, maintained, disclosed, received, created, transmitted or otherwise obtained in connection with this DMCA. Any PI is provided “as is” and EOTSS hereby disclaims all warranties, whether express, implied, statutory, or otherwise. EOTSS specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or practice. EOTSS makes no warranty of any kind that the PI will be secure, accurate, complete, free of harmful code, or error free. In no event will EOTSS, EOHHS, or the Constituent Agencies be liable under or in connection with this DMCA under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

D. Sanctions for Improper Access, Use or Disclosure of PI. The Contractor acknowledges that the Contractor and its subcontractors, agents, and Workforce members may be subject to civil and criminal penalties under state and federal law for accessing, using or disclosing PI in violation of this DMCA or Applicable Law.

E. Requirements Applicable to Subcontractors.

1. Generally. The Contractor shall enter into written agreements with each of its subcontractors and agents that will have access to PI (each, a “Subcontract”) and shall maintain such Subcontracts. All such Subcontracts must contain the terms of this DMCA and the Contract (including the Commonwealth Terms and Conditions) related to the privacy and security of PI, and otherwise must be consistent with all such terms and conditions. Without limiting the generality of the foregoing, the Contractor shall ensure that any such Subcontract satisfies all applicable requirements under the Privacy and Security Rules for a contract or other arrangement with a Business Associate. If a Subcontract deviates from the terms of this DMCA, Contractor must receive written approval from EOHHS prior to allowing subcontractors or agents access to any PI.

The Contractor must inform its subcontractors or agents of the civil and criminal penalties for misuse or unauthorized disclosure of PI under Applicable law.

The Contractor is fully responsible for any subcontractor’s or agent’s performance and for meeting all terms and requirements of this DMCA. The Contractor will not be relieved of any legal obligation under this DMCA, regardless of whether the Contractor subcontracts for performance of any Contract responsibility or whether PI or other information was in the hands of a subcontractor or agent.

2. Third Party Data. The Contractor shall require that any subcontractor or agent that needs access to Third Party Data or a System containing such Third Party Data or through which it may be accessed to comply with any privacy and/or security obligation that may be required under a Third Party Agreement. The Contractor shall ensure that any such subcontractor or agent has satisfied all such obligations prior to being granted access to the Third Party Data or System. The Contractor shall work with EOTSS to ensure that all such obligations are satisfied.

F. Data Security.

1. Administrative, Physical and Technical Safeguards. As of the Contract effective date, the Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PI and that prevent use or disclosure of such PI other than as provided for by this DMCA. All such safeguards must meet, at a minimum, and the Contractor shall otherwise comply with, all standards set forth in the Contract, Privacy and Security Rules, as applicable to a Business Associate, and the EOTSS Enterprise Information Security Policies and Standards(found online at Mass.gov[footnoteRef:1]) the EOHHS Acceptable Use Policy (found online at Mass.gov[footnoteRef:2]), MARS-E, and any standards contained in any applicable Third Party Agreement (collectively, the “Standards”). Contractor shall comply with any new or updated Standards issued by federal, state, or other issuing agency or entity. [1: EOTSS, Enterprise Information Security Policies and Standards, https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards. ] [2: EOHHS Acceptable User Policy, https://www.mass.gov/doc/eohhs-acceptable-use-policy/download. ]

The Contractor shall notify EOTSS of any change in its administrative, technical, or operational environments that impacts the confidentiality, integrity, or availability of PI or any changes to the Contractor’s information controls which alters its conformance with the Standards.

EOTSS and/or EOHHS may terminate the Contractor’s access to EOHHS Systems if in their sole discretion, either EOTSS and/or EOHHS determine that the Contractor has not complied with the requirements of this DMCA.

2. System Access. When accessing any System to perform the Activities, the Contractor shall comply with the Standards, and any System specific policies, mechanisms and processes adopted by EOHHS or EOTSS. The Contractor shall give EOHHS System owner prompt notice of any change in personnel whenever the change requires a termination or modification of any such password, user ID or other security mechanism or code, to maintain the confidentiality and integrity of the System.

3. Periodic Review. The Contractor shall monitor and periodically assess its compliance with the Standards. In the event Contractor is not compliant with some aspect of the Standards, Contractor agrees to notify EOTSS and to remediate such gap(s) in compliance within a reasonable timeframe. If Contractor cannot remediate such gap(s) within a reasonable timeframe, EOTSS reserves the right to implement a pro-rated modification of payments to the Contractor until compliance is reached.

4. Written Information Security Program. The Contractor shall ensure that it maintains a written information security Program (“WISP”) in compliance with the terms of this DMCA and Applicable Law, including, but not limited to M.G.L. c. 93H and 201 CMR 17.00.

5. Inventory of Systems/PI. The Contractor shall maintain an accurate and updated list of electronic and paper databases and other Systems containing PI, together with a description of the type(s) of PI contained in such databases and Systems and the various uses of the databases and Systems.

6. No Offshore Access. Pursuant to Section 7.5.8 of the EOHHS Acceptable Use Policy, the Contractor and its subcontractors, agents, and Workforce members shall not access or store any PI or access any System outside of the United States without prior written authorization. In addition, any remote connection to Commonwealth networks shall be in accordance with ISP.003 of the EOTSS Enterprise Information Security Policies and Standards.

7. Online Tracking Technology. The Contractor shall only use Online Tracking Technology in a manner that would not result in impermissible disclosures of PI as defined in this DMCA or any other violation of the MassHealth Notice of Privacy Practices or the Applicable Law.

G. Obligations upon a Non-Permitted Use or Disclosure of PI or other Event.

1. Mitigation and Other Activities. Immediately upon becoming aware of an Event, the Contractor shall:

a. retrieve any PI involved in the Event;

b. mitigate any known or likely harmful effect of the Event; and

c. take such other action(s) as may be requested by EOTSS or required to comply with any Applicable Law.

Any actions to address harmful effects of such Event undertaken by the Contractor on its own initiative or pursuant to EOTSS’ request shall not relieve the Contractor of its obligations to report such Event or otherwise comply with this Section 2.1G, any other provisions of this DMCA or the Contract or Applicable Law.

2. Notification and Reporting Activities. As soon as possible, but no later than twenty-four (24) hours after Contractor becomes aware of the Event, the Contractor shall verbally report the Event to EOTSS and EOHHS with as much of the details listed below as possible, and shall follow such verbal report within three (3) business days with a written report outlining the Event with the following information:

a. The date of the Event or the estimated date (if date unknown);

b. The date of the discovery of the Event;

c. The nature of the Event, including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events);

d. The nature of the PI involved in the Event (e.g., the types of identifiers and other information involved), together with samples of any forms or documents that were involved in the Event to illustrate the type of PI involved (with personal identifiers removed or redacted);

e. The exact number of individuals whose PI was involved in the Event if known or, if unknown, a reasonable estimate based on known facts (categorized according to the type of PI involved, if different types of PI was involved for different individuals), together with a description of how the number of individuals was determined;

f. A summary of the nature and scope of the Contractor’s investigation into the Event;

g. The known or likely harmful effects of the Event, all actions the Contractor has taken or plans to take to mitigate such effects, and the results of all mitigation actions already taken;

h. A summary of steps taken to prevent such Event in the future, including copies of revised policies and procedures, changes in business processes and staff training; and

i. Any additional information and/or documentation that the Contractor is required to provide to EOTSS under 45 CFR § 164.410, M.G.L. c. 93H, § 3(a) or other similar Applicable Law.

If an Event is the result of a Security Incident, such as hacking, ransomware, or other related Event, the Contractor shall prepare and provide a written forensics report to EOTSS and EOHHS that shall, at a minimum, describe the attack, security vulnerabilities, and any other information EOTSS and EOHHS deem necessary.

To the extent that any such information is not available at the time of the report, the Contractor shall provide such information to EOTSS and EOHHS as such information becomes available in one or more subsequent written reports. The Contractor shall provide EOTSS and EOHHS with such additional information regarding the Event as EOTSS and EOHHS may reasonably request, which additional information may include a written risk analysis rebutting any presumption that the Event constituted a breach for purposes of the Breach Notification Rule.

3. Obligations under Consumer Notification Laws. If EOTSS and/or EOHHS determine, in their respective sole discretion, that it, EOHHS or a Constituent Agency is required to provide notifications to consumers or state or federal agencies under…