MSA Exhibit K - Remote Work Requirements~1.docx

MSA EXHIBIT K – REMOTE WORK REQUIREMENTS

Work From Home Requirements

Notwithstanding any applicable restrictions under the MSA to the contrary, the Health Connector consents to Contractor’s personnel working remotely from their homes while using either Contractor-provided computing equipment or Contractor’s virtual desktop environment (such work referred to herein as “work from home”, “telecommuting” or “working remotely”).

While working remotely, Contractor personnel will continue to comply with Contractor’s security and privacy standards and, to the extent practicable given the remote working environment, existing security and privacy obligations in the MSA. In accordance with Contractor’s policies and procedures, Contractor will continue its current practice of providing regular, periodic training of its employees who are working at home in the security and privacy standards set forth in or referenced in Contractor’s [name employer’s work from home and privacy and security policies], a copy of which is attached hereto as Exhibit 1. and will also request each such employee to sign the Telecommuter Agreement attached hereto as Exhibit 2.

For purposes of clarification, the authorization set forth in this letter applies to Contractor employees who work at the services locations identified in MSA Section 3.2.1 “Location”.

EXHIBIT 1 to Attachment 10 to the MSA Contractor Internal Telecommuting Policy

[Vendor to provide]

EXHIBIT 2 to Attachment 10 to the MSA

MANDATORY TELECOMMUTING AGREEMENT AND ACKNOWLEDGMENTS

THIS MANDATORY TELECOMMUTING AGREEMENT AND ACKNOWLEDGMENTS (this "Telecommuting Agreement") is entered into by and between Contractor and [Name of telecommuting CSR] ("I” or “Employee") having an address at [enter home address].

1. Mandatory Telecommuting Arrangement I acknowledge that under my Employer’s telecommuting policy I may be requested or allowed to work from home so that I may continue to perform my duties to Employer. The Employer may, at any time, change any or all of the conditions under which I am requested or allowed to telecommute.

2. Security and Privacy Policies, Standards and Training All security and privacy policies, standards and training that I have received from the Employer, including but not limited to those contained and/or referenced in Employer’s [Contractor to provide name of its business conduct and/or privacy and security policy], or from the Commonwealth’s Health Insurance Connector Authority (the “Health Connector”), apply to me when I am telecommuting.

3. Contact Methods and Home Office Location During scheduled telecommuting times, I can be reached via my work email address and through Employer’s enterprise collaboration tools, such as Microsoft Teams and [Vendor to list additional collaboration tools]. The home office from which I will be telecommuting is located at [insert address] (my “home office”). I will notify the Employer promptly before changing my residence and therefore the location of my home office. I understand that I am expected to work only at my home office on days scheduled for telecommuting. When I am working on telecommuting days, I must be in my home and cannot be located in a publicly accessible location such as a library or co-workspace (e.g. “We Work”).

4. Effective Date and Term.

The effective date (“Effective Date”) of this Telecommuting Agreement is the date that I sign it [fill in date] and its termination date (the “Termination Date”) is a date that my Employer will communicate to me in writing (which may include via email) in the future. I am not authorized to Telecommute past the Termination Date, unless otherwise authorized in writing by my Employer.

5. Personal Information, Privacy and Security The Employer’s [Vendor to provide name of their data security and privacy standard] defines Personal Information. All Personal Information that I receive or create while telecommuting is the property of the Employer’s customer, the “Health Connector”. While telecommuting, except as required to fulfill my job duties on behalf of the Health Connector, I will never directly or indirectly, or otherwise use, disseminate or disclose Personal Information.

I agree that, while telecommuting, I will protect the privacy and security of Personal Information.

I understand that the Employer has a right to conduct a reasonable investigation of my home office workplace to ensure that I am protecting the privacy and security of the Personal Information that I use in connection with my work.

While telecommuting, I will:

· Ensure that the screen of any laptop, personal computer or other device that I use in my home office to telecommute is not visible to anyone else.

· Not engage in telephone conversations while telecommuting during which I discuss Confidential Information from a location at which I can be overheard by anyone else. For purposes of this provision, the definition of ‘Confidential Information’ may be found in Employer’s [ Change if vendor’s policy uses “personal information” or some other locution].

· Never directly or indirectly, or otherwise use, either during or subsequent to my employment, disseminate or disclose Personal Information without having first obtained written permission from my Employer to do so.

· Ensure the protection of Personal Information and to safeguard all documents and data in any form whatsoever (paper or digital) and devices that contain personal Information.

· Not remove any Personal Information from my employer’s offices, except training materials, without the prior approval of my Manager or transport such information between their employer’s premises and the employee’s home office. Not process, view, or use any Personal Information while Telecommuting in any place other than their home office.

· Not create, while telecommuting, any paper documents containing Personal Information.

· Not download any Personal Information on a personal device.

6. Workplace Security

I agree that:

· I am responsible for employing appropriate telecommuting security measures and protecting Health Connector data and systems. I will not use employer laptops, PCs or phones to access insecure websites.

· My employer has the right to inspect their home office workplace during work hours upon reasonable notice.

a. I will protect Personal Information with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use or disclosure.

b. I will immediately report any suspected incidents concerning possible compromise of Employer or Health Connector data, including but not limited to Personal Information, to the individual identified by my Employer [vendor to provide name of individual to whom report is to be made; typically a privacy officer or security officer] and their supervisor.

c. I will exercise extra vigilance in protecting all devices used by them to telecommute such as PCs, laptops and cellphones, and not allow family or friends to use any employer-provided devices for personal use.

d. I will use only approved options for connecting to Employer electronic files and information.

e. I will use only my official work email account to conduct their Employer’s business.

f. I will not share passwords or store them in a visible location.

g. I will lock and password-protect all devices used to telecommute when the employee is away from them (including desktops, laptops, tablets, and cell phones).

7. Home Office Equipment and Services

I will ensure that I have voice and data service that will enable me to access information and systems that I need to perform my job.

In addition, I agree that I will:

· Not use public or free Wi-Fi hotspots, or unsecure networks, when telecommuting.

8. Users of Virtual Private Network or “VPN”.

If I use a virtual private network (“VPN”) for remote access when Telecommuting while using my personal device to Telecommute, I understand that I must:

a. run, and keep active, commercially available antivirus software on that device. I understand that antivirus software used on my personal device must be up to date with respect to both software version and virus definitions.

b. if I use a personal PC or laptop to Telecommute, I must install and properly configure a PC firewall and accept regular firewall updates from the publisher.

c. when using VPN through a laptop issued and configured by their employer, I must refrain from installing any software, hardware or plug-ins without the express written permission of my Employer, except for a printer, printer drivers, external monitor, keyboard, and/or a mouse.

d. safeguard my VPN password. If I have reason to believe that their password has been compromised, I will immediately report this to [Name person at vendor organization to whom incidents must be reported]

Agreement Acknowledged: