HPC CNDA template.docx

EXHIBIT A

Confidentiality and Non-Disclosure Agreement

This Confidentiality and Non-Disclosure Agreement (“Agreement”) is between the Health Policy Commission, a Massachusetts state agency established by M.G.L. c. 6D (“HPC”), and [CONTRACTOR] (“Contractor”). The Agreement shall become effective when signed by the parties to it. Capitalized terms not defined herein are defined in the Statement of Work.

WHEREAS, in the course of providing services to the HPC, Contractor will have access to or create confidential, proprietary, or otherwise sensitive information that is not generally known by or disseminated to the public as a matter of course;

NOW THEREFORE, in consideration of Contractor’s engagement to work for the HPC, the access Contractor will have to certain nonpublic information (“Confidential Information”), as hereinafter defined, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. Contractor hereby acknowledges that it may be provided access to, become aware of, or create certain nonpublic information as a result of Contractor’s contract with the HPC, including without limitation, Personal Data as defined by M.G.L. c. 66A and Personal Information as defined by M.G.L. c. 93H; confidential, sensitive, or proprietary information subject to M.G.L. c. 6D, §§ 2A, 8A, or 13(c), other state or federal law, or the terms of a data use or license agreement; and other HPC records or information including but not limited to HPC’s public records, documents, files, software, equipment or systems, (collectively “Confidential Information”).

2. Contractor shall comply with the terms of this Agreement and with the Commonwealth Standard Contract Form, which incorporates by reference the Standard Contract Form Instructions, Contractor Certifications, and Commonwealth Terms and Conditions (collectively “Standard Contract Form”), including provisions applicable to Confidential Information: Contractor Certifications Protection of Commonwealth Data, Personal Data and Information and Commonwealth Terms and Conditions Section 6. Confidentiality.

3. Contractor acknowledges that it is Contractor’s sole responsibility to ensure compliance with all local, state, and federal laws, regulations, and/or data use or license agreement terms applicable to the Confidential Information, including without limitation M.G.L. c. 66A, M.G.L. c. 93H, and M.G.L. c. 93I, and M.G.L. c. 6D, §§ 2A, 8A and 13(c).

4. Contractor shall at all times recognize the HPC as the owner of the Confidential Information. As owner of the Confidential Information, the HPC shall at all times have reasonable control over the access, use, disclosure, and disposition of the Confidential Information, including as described in the Contract and this Agreement. Contractor shall provide the HPC with access to or copies of any Confidential Information that it maintains pursuant to the Contract. Contractor shall grant reasonable access to its facilities, personnel, and the Confidential Information to authorized representatives of the HPC for the purpose of confirming compliance with the terms of this Agreement.

5. Contractor agrees that it will not disclose any Confidential Information or any data derived or extracted from the Confidential Information, except solely to its employees, or agents as may be authorized by the HPC, on a need-to-know, minimum necessary basis. Contractor further agrees that it shall only disclose Confidential Information to Contractor’s employees, or Contractor’s agents as may be authorized by the HPC, who are bound by obligations of confidentiality at least as restrictive as those set forth in this Agreement, and Contractor shall remain liable for its employees’ and agents’ compliance with such obligations.

6. Contractor shall use the Confidential Information solely for the purposes of performing services for the HPC pursuant to this Contract. Contractor shall not use, retain, release, publish, refer to, transfer, or disclose to any third party the Confidential Information, or any data derived or extracted from the Confidential Information, for any other purpose, unless approved in advance by the HPC, except where such information is publicly available or where Contractor has acquired such information through a source completely independent from Contractor’s engagement or contract with the HPC.

7. Contractor agrees to retain any Confidential Information only for the time period needed to perform services for the HPC. Contractor shall return or destroy all Confidential Information within ten (10) business days of receiving a request from the HPC or the conclusion of Contractor’s engagement with the HPC. Contractor shall comply with M.G.L. c. 93I for the proper destruction of all paper and electronic media, backups, or systems containing Personal Data or Personal Information. Following the return or destruction of Confidential Information, Contractor shall promptly submit a Certificate of Destruction (see Appendix) to the HPC.

8. Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Confidential Information and that prevent a Security Breach of such data (as defined in Section 11); at a minimum, for Personal Data and Personal Information, such safeguards must comply with the Enterprise Information Security Policies and Standards published by the Executive Office for Technology, Services, and Security (“EOTSS”) as specified in the Standard Contract Form, or any comparable policies or standards specified by the HPC.

9. Contractor shall periodically complete a risk assessment of its information systems and security measures that is sufficiently comprehensive given the nature and volume of confidential information and data in Contractor’s possession, including Confidential Information pursuant to this Contract. Contractor shall provide information regarding the assessment to the HPC upon request.

10. Contractor shall ensure that any Personal Data or Personal Information transmitted electronically or through a portable device is properly encrypted using (at a minimum) the Commonwealth’s “Cryptographic Management Standard” set forth in the Enterprise Information Security Policies and Standards published by EOTSS, or any comparable standard specified by the HPC. For all other Confidential Information, Contractor shall comply with the transmission standard that may be specified by the HPC.

11. In the event Contractor becomes aware of any unauthorized access, acquisition, use, modification, disclosure, destruction, or loss of any Confidential Information (collectively referred to as a “Security Breach”), Contractor shall: (a) immediately notify the HPC; (b) provide full cooperation and access to information necessary for the HPC to determine the scope of the Security Breach; and (c) provide full cooperation and access to information necessary for the HPC and Contractor to fulfill any notification requirements.

12. Contractor shall take all reasonable and appropriate action necessary, including as may be specified by the HPC, to: (a) retrieve any Confidential Information; (b) mitigate, to the extent practicable, any harmful effect known to the Contractor; and (c) take such further action as may be required by the HPC. Contractor shall provide the HPC with a written report that: (a) describes the Security Breach; and (b) describes the steps Contractor has taken to prevent a further Security Breach. Any actions to mitigate harmful effects of any Security Breach undertaken by Contractor on its own initiative shall not relieve Contractor of the reporting requirements described herein. Contractor shall bear the sole cost and liability for all costs related to the Security Breach of the Confidential Information and shall reimburse the HPC for its reasonable costs and expenses in complying with any applicable state or federal laws regarding notification of any data breach, including costs of mitigating the harm to subjects of the Confidential Information.

13. Contractor shall promptly notify the HPC in the event that Confidential Information is subpoenaed or becomes the subject of a court or administrative order or other legal process. Contractor shall consult with the HPC prior to responding to any such request or demand and provide the HPC with reasonable opportunity to assert to the requestor, court, or administrative agency any objections to disclosure as may be legally available to the HPC. Until the HPC responds to the Contractor’s notice of legal process given in accordance with this provision, Contractor shall assert objections to disclosure of such Confidential Information on grounds as may be legally available to the Contractor.

14. Contractor acknowledges that its obligations under this Agreement shall survive the termination of any engagement or contract with the HPC regardless of the manner of or reasons for such termination, and the terms of this Agreement shall remain effective and binding. Contractor’s obligations under this Agreement shall be binding upon its assignees, successors, and representatives.

15. Contractor agrees that any breach of this Agreement will cause immediate and irreparable harm to the HPC not compensable by monetary damages and that the HPC will be entitled to obtain injunctive relief, in addition to all other available relief, in any court of competent jurisdiction to enforce the terms of this Agreement, without having to prove or show any actual damage to the HPC. Contractor agrees that if it fails to comply with any of requirements of this Agreement, or any applicable state or federal regulation or law regarding data confidentiality, privacy or security, HPC may terminate the Contract and/or demand immediate return or destruction of all Confidential Information. Contractor understands that any violations of this Agreement, M.G.L. c. 93H (regarding data breaches), M.G.L. c. 93I (regarding data destruction), and other laws applicable to the privacy and security of the Confidential Information may subject Contractor to criminal or civil liability.

16. This Agreement shall be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts without regard to any choice of law principle. Contractor agrees to be subject to the jurisdiction of the Massachusetts Superior Court for purposes of enforcement of this Agreement.

17. If any provision of this Agreement, for any reason, is held to violate any applicable law or is otherwise held to be unenforceable, such provision shall be reformed only to the extent necessary to render such provision legal and enforceable.

HEALTH POLICY COMMISSION

<INSERT NAME>

Signature

Name

Title

Signature

Name

Title

Date

Date

Remainder of page left intentionally blank.

APPENDIX

HEALTH POLICY COMMISSION

CERTIFICATE OF DESTRUCTION

The undersigned hereby certifies that this Certification of Destruction applies to the following Confidential Information received by Contractor from the HPC under the terms of a Contract with a termination date of [DATE]:

Description of Confidential Information (e.g., APCD v8.0 commercial analytic file):

Data destroyed: ______________ OR Data returned to HPC: ________

Date(s) of destruction and/or return to HPC: _____________________________

Destroyed or returned by (name): ______________________________________

The undersigned certifies that Contractor has destroyed all copies of the Confidential Information specified above, in any and all formats including hardcopy and electronic media. The Confidential Information has been destroyed so that it cannot be recovered from hardcopy or electronic storage media, including but not limited to hard drives and other storage media. Acceptable methods include the use of file wiping software implementing at a minimum DoD.5200.28-STD (7) disk wiping, and the degaussing of backup tapes. Electronic storage media such as floppy disks, CDs, and DVDs used to store Confidential Information have been made unusable by physical destruction. All data destruction complies with the requirements of M.G.L. c. 93I.

Signature

Title

Date

Please submit completed certificate to Rebecca Mashni, HPC Associate Counsel (rebecca.mashni2@mass.gov).

Last updated March 2023