OFF48 PCA ID Card Data Management and Confidentiality Agreement~1.docx

DATA MANAGEMENT AND CONFIDENTIALITY AGREEMENT

This Data Management and Confidentiality Agreement (this “Agreement”) is made by and between the Executive Office of Health and Human Services, Office of Medicaid (“EOHHS”), and [ ] (the “Contractor”). EOHHS and the Contractor are sometimes referred to herein individually as a “Party” and together as the “Parties.”

BACKGROUND, SCOPE AND definitions Background/Scope On or about the date hereof, EOHHS entered into a contract with the Contractor to [ ] and to otherwise provide services to, or perform functions or activities for or on behalf of, EOHHS (the “Contract”).

The Parties are entering into this Agreement to establish certain privacy, security and related obligations of the Contractor with respect to PI (as defined below) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its provision of a service to, and/or its performance of a function or activity for or on behalf of, EOHHS under the Contract.

Definitions When used in this Agreement, the following capitalized terms shall have the meanings ascribed to them below:

“Activities” shall mean the activities, functions and/or services to be performed or provided by the Contractor for, on behalf of and/or to EOHHS under the Contract and this Agreement.

“Applicable Law” shall mean M.G.L. c. 66A (FIPA), 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, the Health Insurance Portability and Accountability Act (HIPAA) Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, Subpart F and 42 CFR 434.6(a)(8) (Medicaid Confidentiality Rule), 42 CFR Part 2, 45 CFR § 155.260 and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality, or security of PI.

“EOTSS” shall mean the Massachusetts Executive Office of Technology Services and Security.

“Event” shall mean the following, either individually or collectively: 1) any use or disclosure of PI not permitted under this Agreement; 2) any Security Incident; or 3) any other event that would trigger notification obligations under the Breach Notification Rule, M.G.L. c. 93H, other similar Applicable Law, or Third Party Agreement (defined below) requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of PI.

“HIPAA Rules” shall mean 45 CFR Parts 160, 162, and 164, inclusive of the Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), the Security Rule (45 CFR Part 160 and Part 164, Subparts A and C), the Breach Notification Rule (45 CFR Part 164, Subpart D) and the Enforcement Rule (45 CFR Part 160, Subparts C, D and E).

“Individual” shall mean the person to whom the PI refers and shall include a person or organization who qualifies as a personal representative in accord with 45 CFR § 164.502(g).

“Online Tracking Technology” means any technologies that are used to collect and analyze information about how users interact with websites or mobile applications maintained by or on behalf of EOHHS.

“PI” shall mean any Protected Health Information, any “personal data” as defined in M.G.L. c. 66A, any “patient identifying information” as used in 42 CFR Part 2, any “personally identifiable information” as used in 45 CFR § 155.260, “personal information” as defined in M.G.L. c. 93H, and Third Party Data (defined below in Section 2.1.B) and any other individually identifiable information that is treated as confidential under Applicable Law or agreement (including, for example, any state and federal tax return information) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its performance of the Activities. Information, including aggregate information, is considered PI if it is not fully de-identified in accord with 45 CFR §§164.514(a)-(c).

“System” shall mean any EOHHS system, database, application or other information technology resource.

When used in this Agreement, the following terms shall have the same meaning as those terms have in the HIPAA Rules: Business Associate, Minimum Necessary, Notice of Privacy Practices, Personal Representative, Protected Health Information, Required by Law, Secretary, Security Incident and Workforce.

All other capitalized terms used in this Agreement, but not otherwise defined herein, or elsewhere in this Agreement, shall be construed in a manner consistent with the HIPAA Rules, M.G.L. c. 66A and all other Applicable Laws.

DATA MANAGEMENT AND CONFIDENTIALITY

Data Management and Confidentiality Obligations of the Contractor Compliance with Applicable Laws. The Contractor must comply with all Applicable Laws in performing the Activities including any use and disclosure of PI. Without limiting the generality of the foregoing, the Contractor acknowledges and agrees as follows:

Business Associate under HIPAA. In performing the Activities, the Contractor acknowledges and agrees that it is acting as EOHHS’ Business Associate. Contractor shall comply with all requirements of the HIPAA Rules applicable to a Business Associate. This Agreement shall serve as the Business Associate Agreement between the Contractor and EOHHS. Workforce members with access to unencrypted PI or an encryption key used to secure such PI must sign the Confidentiality Acknowledgement attached hereto as Appendix A prior to being granted such access.

Medicaid Confidentiality Rule. The Contractor acknowledges and agrees that, in performing the Activities, it will create, receive, use, disclose, maintain, transmit or otherwise obtain information concerning Medicaid applicants and beneficiaries and that, in doing so, the Contractor agrees to comply with the Medicaid Confidentiality Rule at 42 CFR 431 Subpart F and 42 CFR 434.6(a)(8). Consistent with these obligations, the Contractor shall restrict its use and disclosure of information concerning Medicaid applicants and beneficiaries to purposes directly connected with the administration of the Medicaid plan. 42 CFR 431.302 defines purposes directly related to Medicaid Plan administration to include: (1) establishing eligibility, (2) determining the amount of medical assistance, (3) providing services for beneficiaries; and (4) conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the administration of the Medicaid plan.

42 CFR Part 2. The Contractor acknowledges and agrees that with respect to any substance use information that the Contractor receives, stores, processes, uses, creates, or transmits that was obtained by a Part 2 Program, Lawful Holder, or EOHHS (as such terms are used in 42 CFR Part 2), it is bound by 42 CFR Part 2 and shall not use or disclose information except as permitted under 42 CFR Part 2.

M.G.L. c. 66A. The Contractor acknowledges that in performing the Activities it will create, receive, use, disclose, maintain, transmit or otherwise obtain “personal data” (as defined in M.G.L. c. 66A) and that, in so doing, it becomes a “holder” of such data for purposes of M.G.L. c. 66A and shall comply with the same.

CORI Regulations. The Contractor shall, pursuant to and in accordance with 101 CMR 15.03(1)(b), require and consider the criminal history information pertaining to all Workforce members of the Contractor who will be given access or potential access to PI, and all applicants for employment with the Contractor where the position applied for entails access or potential access to PI. The Contractor shall otherwise comply with all applicable terms of 101 CMR 15.00 in connection with the review and consideration of employee and applicant criminal records.

Compliance with Third Party Agreements. The Contractor acknowledges that EOHHS receives PI from regulated third parties including but not limited to the Social Security Administration, the Centers for Medicare and Medicaid Services, the Internal Revenue Service, the Department of Homeland Security, the Federal Data Services Hub and Massachusetts Department of Revenue (any such PI, “Third Party Data”). The use, disclosure, receipt, storage, transmission and maintenance of such Third Party Data is governed by agreements between EOHHS and the third party data sources (any such agreement, a “Third Party Agreement”). The Contractor may not access any such Third Party Data unless disclosure of such data to the Contractor is permitted under the applicable Third Party Agreement(s), all conditions for disclosure under such Agreement(s) such as third party source approval, background checks and training have been satisfied and the Contractor’s access to such data is otherwise permitted under the terms of this Agreement. If the Contractor requires Third Party Data to perform the Activities, the Contractor shall comply with all applicable Third Party Agreements. For the purposes of this Agreement, no Third Party Agreement is applicable.

Ownership and Control of Data. The Contractor may use and disclose PI only as permitted by this Agreement. The Contractor does not possess any independent rights of ownership to such data. EOHHS is the lawful owner, holder, or licensee of all PI used, maintained, disclosed, received, created, transmitted or otherwise obtained in connection with this Agreement. Any PI is provided “as is” and EOHHS hereby disclaims all warranties, whether express, implied, statutory, or otherwise. EOHHS specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or practice. EOHHS makes no warranty of any kind that the PI will be secure, accurate, complete, free of harmful code, or error free. In no event will EOHHS be liable under or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

Sanctions for Improper Access, Use or Disclosure of PI. The Contractor acknowledges that the Contractor and its subcontractors, agents, and Workforce members may be subject to civil and criminal penalties under state and federal law for accessing, using or disclosing PI in violation of this Agreement or Applicable Law.

Requirements Applicable to Subcontractors.

Generally. The Contractor shall enter into written agreements with each of its subcontractors and agents that will have access to PI (each, a “Subcontract”) and shall maintain such Subcontracts. All such Subcontracts must contain the terms of this Agreement and the Contract (including the Commonwealth Terms and Conditions) related to the privacy and security of PI, and otherwise must be consistent with all such terms and conditions. Without limiting the generality of the foregoing, the Contractor shall ensure that any such Subcontract satisfies all applicable requirements under the Privacy and Security Rules for a contract or other arrangement with a Business Associate. If a Subcontract deviates from the terms of this Agreement, Contractor must receive written approval from EOHHS prior to allowing subcontractors or agents access to any PI.

The Contractor must inform its subcontractors or agents of the civil and criminal penalties for misuse or unauthorized disclosure of PI under Applicable law.

The Contractor is fully responsible for any subcontractor’s or agent’s performance and for meeting all terms and requirements of this Agreement. The Contractor will not be relieved of any legal obligation under this Agreement, regardless of whether the Contractor subcontracts for performance of any Agreement responsibility or whether PI or other information was in the hands of a subcontractor or agent.

Third Party Data. The Contractor shall require that any subcontractor or agent that needs access to Third Party Data or a System containing such Third Party Data or through which it may be accessed to comply with any privacy and/or security obligation that may be required under a Third Party Agreement. The Contractor shall ensure that any such subcontractor or agent has satisfied all such obligations prior to being granted access to the Third Party Data or System. The Contractor shall work with EOHHS to ensure that all such obligations are satisfied.

Data Security.

Administrative, Physical and Technical Safeguards. As of the Contract effective date, the Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PI and that prevent use or disclosure of such PI other than as provided for by this Agreement. All such safeguards must meet, at a minimum, and the Contractor shall otherwise comply with, all standards set forth in the Contract, Privacy and Security Rules, as applicable to a Business Associate, and the EOHHS Acceptable Use Policy (found online at Mass.gov[footnoteRef:2]) and the EOTSS Enterprise Information Security Policies and Standards (found online at Mass.gov[footnoteRef:3]), and any standards contained in any applicable Third Party Agreement (collectively, the “Standards”). The Contractor shall comply with any new or updated Standards issued by federal, state, or other issuing agency or entity. [2: EOHHS Acceptable User Policy, download (mass.gov) (last visited July 26, 2024).] [3: EOTSS, Enterprise Information Security Policies and Standards, https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards (last visited July 26, 2024). ]

The Contractor shall notify EOHHS of any change in its administrative, technical, or operational environments that impacts the confidentiality, integrity, or availability of PI or any changes to the Contractor’s information controls which alters its conformance with the Standards.

EOHHS may terminate the Contractor’s access to EOHHS Systems if it determines, in its sole discretion, that the Contractor has not complied with the requirements of this Agreement.

System Access. When accessing any System to perform the Activities, the Contractor shall comply with the Standards, and any System specific policies, mechanisms and processes adopted by EOHHS or EOTSS. The Contractor shall give EOHHS System owner prompt notice of any change in personnel whenever the change requires a termination or modification of any such password, user ID or other security mechanism or code, to maintain the confidentiality and integrity of the System.

Periodic Review. The Contractor shall monitor and periodically assess its compliance with the Standards. In the event Contractor is not compliant with some aspect of the Standards, Contractor agrees to notify EOHHS and to remediate such gap(s) in compliance within a reasonable timeframe. If Contractor cannot remediate such gap(s) within a reasonable timeframe, EOHHS reserves the right to implement a pro-rated modification of payments to the Contractor until compliance is reached.

Written Information Security Program. The Contractor shall ensure that it maintains a written information security Program (WISP) in compliance with the terms of this Agreement, including, but not limited to, M.G.L. c. 93H and 201 CMR 17.00.

Inventory of Systems/PI. The Contractor shall maintain an accurate and updated list of electronic and paper databases and other Systems containing PI, together with a description of the type(s) of PI contained in such databases and Systems and the various uses of the databases and Systems.

No Offshore Access. Pursuant to Section 7.5.8 of the EOHHS Acceptable Use Policy, the Contractor and its subcontractors, agents, and Workforce members shall not access or store any PI or access any System outside of the United States without prior written authorization. In addition, any remote connection to Commonwealth networks shall be in accordance with IS.006 of the EOTSS Enterprise Information Security Policies and Standards.

Online Tracking Technology. The Contractor shall only use Online Tracking Technology in a manner that would not result in impermissible disclosures of PI as defined in this Agreement or any other violation of the MassHealth Notice of Privacy Practices or the Applicable Law.

Obligations upon a Non-Permitted Use or Disclosure of PI or other Event.

1. Mitigation and Other Activities. Immediately upon becoming aware of an Event, the Contractor shall:

a. retrieve any PI involved in the Event;

b. mitigate any known or likely harmful effect of the Event; and

c. take such other action(s) as may be requested by EOHHS or required to comply with any Applicable Law.

Any actions to address harmful effects of such Event undertaken by the Contractor on its own initiative or pursuant to EOHHS’ request shall not relieve the Contractor of its obligations to report such Event or otherwise comply with this Section 2.1.G, any other provisions of this Agreement or the Contract or Applicable Law.

2. Notification and Reporting Activities. As soon as possible, but no later than twenty-four (24) hours after Contractor becomes aware of the Event, the Contractor shall verbally report the Event to EOHHS with as much of the details listed below as possible, and shall follow such verbal report within three (3) business days with a written report outlining the Event with the following information:

a. The date of the Event or the estimated date (if date unknown);

b. The date of the discovery of the Event;

c. The nature of the Event, including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events);

d. The nature of the PI involved in the Event (e.g., the types of identifiers and other information involved), together with samples of any forms or documents that were involved in the Event to illustrate the type of PI involved (with personal identifiers removed or redacted);

e. The exact number of individuals whose PI was involved in the Event if known or, if unknown, a reasonable estimate based on known facts (categorized according to the type of PI involved, if different types of PI was involved for different individuals), together with a description of how the number of individuals was determined;

f. A summary of the nature and scope of the Contractor’s investigation into the Event;

g. The known or likely harmful effects of the Event, all actions the Contractor has taken or plans to take to mitigate such effects, and the results of all mitigation actions already taken;

h. A summary of steps taken to prevent such Event in the future, including copies of revised policies and procedures, changes in business processes and staff training; and

i. Any additional information and/or documentation that the Contractor is required to provide to EOHHS under 45 CFR § 164.410, M.G.L. c. 93H, § 3 or other similar Applicable Law.

If an Event is the result of a Security Incident, such as hacking, ransomware, or other related Event, the Contractor shall prepare and provide a written forensics report to EOHHS that shall, at a minimum, describes the attack, security vulnerabilities, and any other information EOHHS deems necessary.

To the extent that any such information is not available at the time of the report, the Contractor shall provide such information to EOHHS as such information becomes available in one or more subsequent written reports. The Contractor shall provide EOHHS with such additional information regarding the Event as EOHHS may reasonably request, which additional information may include a written risk analysis rebutting any presumption that the Event constituted a breach for purposes of the Breach Notification Rule.

3. Obligations under Consumer Notification Laws. If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement as a result of the Event, the Contractor shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement, but in no event shall the Contractor have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Contractor to do so in writing. Additionally, at EOHHS’ direction, the Contractor shall provide credit monitoring services to affected Individuals as required under M.G.L. c. 93H, § 3A or other Applicable Law.

Response to Legal Process. The Contractor shall report to EOHHS, both verbally and in writing, any instance where PI or any other data obtained in connection with this Agreement is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under Massachusetts law). The Contractor shall provide such report to EOHHS as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. In response to such legal process, and in accordance with instructions from EOHHS, the Contractor shall take all reasonable steps, including objecting to the request when appropriate, to comply with M.G.L. c. 66A § 2(k), 42 CFR § 431.306(f), 42 CFR Part 2 and any other Applicable Law. If EOHHS determines that it shall respond directly, the Contractor shall cooperate and assist EOHHS in its response.

Individual’s Privacy Rule Rights. With respect to any relevant PI in the Contractor’s possession, the Contractor shall take such action as may be requested by EOHHS to meet EOHHS’ obligations under 45 CFR §§ 164.524, 164.526 or 164.528 or other Applicable Law pertaining to an Individual’s right to access, amend or obtain an accounting of uses and/or disclosures of its PI, in sufficient time and manner for EOHHS to meet its obligations under such Privacy Rule provisions or other Applicable Law. If an Individual or Personal Representative contacts the Contractor with respect to exercising any rights the Individual may have under 45 CFR §§ 164.524, 164.526 or 164.528 or similar Applicable Law with respect to PI in the Contractor’s possession, the Contractor shall notify EOHHS’ Privacy Officer within two (2) business days of the Individual’s request and cooperate with EOHHS to meet any of its obligations with respect to such request.

With respect to an Individual’s right to an accounting under 45 CFR § 164.528, the Contractor shall document all disclosures of, and access to, PI as would be necessary for EOHHS to respond to a request by an Individual for an accounting in accord with 45 CFR § 164.528. The Contractor shall also document uses and disclosures of PI and other data access activities to the extent required under M.G.L. c. 66A, § 2(f).

Record Access. The Contractor shall make its internal practices, books and records, including policies and procedures, relating to the protection, security, use and disclosure of PI obtained under this Agreement, and the security and integrity of Systems containing PI or through which it may be accessed, available to EOHHS and the Secretary, in a time and manner designated by the requesting party, for purposes of enabling EOHHS to determine compliance with this Agreement or for purposes of enabling the Secretary to determine compliance with the HIPAA Rules. If the Contractor is subject to a Third Party Agreement which requires access to Contractor’s facilities, upon reasonable notice, the Contractor agrees to allow EOHHS representatives, Third Party Data representatives, and/or other data owners access to premises where PI is stored (including Contractor’s premises or its hosting facility) for the purpose of inspecting privacy and physical security arrangements implemented by the Contractor to protect such PI, compliance with Applicable Law or compliance with Federal grant requirements.

Privacy Officer. Consistent with the HIPAA Rules, the Contractor shall designate a Privacy Officer who shall be responsible for overseeing the Contractor’s compliance with this Agreement.

Destruction of PI during Contract Term. The Contractor shall retain PI during the course of the Contract in accordance with the terms of this Agreement and all applicable state and federal retention laws and regulations. If, in accordance with such requirements, Contractor determines that, during the course of the Contract, it is appropriate to destroy PI, it shall do so only after obtaining EOHHS’ written permission. In the event destruction is permitted, the Contractor shall ensure that PI are destroyed, purged and rendered unrecoverable, in accordance with all Applicable Laws and applicable retention laws and regulations, and all data security policies issued by EOHHS and EOTSS. Within five (5) days of destroying PI in accordance with the requirements of this paragraph, Contractor shall provide EOHHS with a written certification that destruction has been completed in accord with the required standards set forth herein.

Permitted Uses and Disclosures of PI by the Contractor Except as otherwise limited in this Agreement, including in this Section 2.2, the Contractor may use or disclose PI only as follows:

Activities. The Contractor may use or disclose PI to perform the Activities or as otherwise required by, and in accordance with, the provisions of this Agreement; provided, that such use or disclosure would not violate:

the Privacy Rule or other Applicable Law including the Medicaid Confidentiality Rule at 42 CFR 431, Subpart F if done by EOHHS;

violate the EOHHS’ policies and procedures that are known to the Contractor or that EOHHS advises the Contractor of; or conflict with statements in the MassHealth Notice of Privacy Practices.

EOHHS makes available the most recent MassHealth Notice of Privacy Practices online at: https://www.mass.gov/service-details/masshealth-brochures-and-pamphlets.

When using or disclosing PI or when requesting PI from EOHHS or another party in performing the Activities, the Contractor represents that it shall make reasonable efforts to limit the amount of PI used, disclosed or requested to the minimum necessary to accomplish or perform the particular Activity for which the PI is being used, disclosed or requested.

Restriction on Contacting Individual. The Contractor shall not use PI to contact or to attempt to contact an Individual unless such contact is a permitted Activity, or made in accordance with EOHHS’ written instructions.

De-Identified PI. Unless the Contractor has obtained EOHHS' written consent, the Contractor shall not use or share PI in any manner other than those permitted in Section 2.2.A, including but not limited to publication, statistical tabulation, research, or report, regardless of whether or not the PI can be linked to a specific individual or has otherwise been de-identified in accord with the standards set forth in 45 CFR § 164.514.

TERM, TERMINATION AND EFFECT OF TERMINATION

Term and Termination.

This Agreement shall be effective upon execution by each party and shall terminate upon the termination or expiration of the Contract, unless earlier terminated by EOHHS in accordance with subsection B, below.

If EOHHS determines, in its sole discretion, that the Contractor has violated any material term of this Agreement or the Contract pertaining to the privacy or security of PI, EOHHS may terminate this Agreement and the Contract immediately upon written notice to the Contractor.

Effect of Termination Except as provided in subsection B immediately below, upon termination of this Agreement for any reason whatsoever (including expiration), the Contractor shall, at EOHHS’ direction, either return or destroy all PI, and the Contractor shall not retain any copies of such PI in any form. In no event shall the Contractor destroy any PI without first obtaining EOHHS’ approval. In the event destruction is permitted, the Contractor shall ensure that PI are destroyed, purged and rendered unrecoverable, in accordance with all Applicable Laws and applicable retention laws and regulations, and all data security policies issued by EOHHS and EOTSS. This provision shall apply to all PI in the possession of the Contractor’s subcontractors, and the Contractor shall require that all such information in the possession of its subcontractors and agents be returned or destroyed and that no subcontractor or agent shall be permitted to retain any copies of such information in any form, in accord with EOHHS’ instructions. The Contractor shall, within three (3) business days of the return or destruction of PI, certify to EOHHS in writing that all PI has been returned or destroyed in accordance with this Section 3.2 and neither the Contractor nor any of its subcontractors or agents retains any PI.

If the Contractor determines that returning or destroying PI is not feasible, the Contractor shall provide EOHHS written notification of the conditions that make return or destruction not feasible. If, based on the Contractor’s representations, EOHHS concurs that return or destruction is not feasible, the Contractor shall extend all protections pertaining to PI set forth in this Agreement to all such information and shall limit further uses and disclosures of such information to those purposes that make its return or destruction not feasible, for as long as the Contractor (or any of its subcontractors or agents) maintains any PI.

ADDITIONAL TERMS AND CONDITIONS

Notices.

Unless otherwise specified herein, all notices, reports, requests, consents, claims, demands, waivers and other communications provided under this Agreement (each, a “Notice”) shall be in writing and shall be deemed to have been given to a Party: (i) when delivered by hand; (ii) on the date sent by e-mail if sent during normal business hours of the Party, and on the next business day if sent after normal business hours of the Party; or (iii) on the third day after the date deposited in the U.S. Mail, first class, postage pre-paid, provided, that, in each case, the Notice is delivered or addressed to the Party’s contact person(s) at the address(es) identified below (or to such other contact person(s) at such other address(es) as the recipient may from time to time specify in a notice given in accordance with this Section 4.1):

EOHHS:

The General Counsel’s Office Executive Office of Health and Human Services 1 Ashburton Place, Floor 11 Boston, MA 02108 privacy.officer@mass.gov

Contractor:

Amendment.

This Agreement may be amended by the Parties at any time; provided, that any amendment must be in writing and must be signed by each Party. The Contractor shall promptly execute and comply with any amendment to this Agreement that EOHHS determines is necessary to ensure compliance with all applicable statutes, orders, and regulations promulgated by any federal, state, municipal, Third Party Agreements, or other governmental authority pertaining to the privacy or security of PI, including any Applicable Law. Such requisite amendment may cover all activities and PI collected under the original Contract. The Contractor’s failure to amend this Agreement in accordance with the foregoing sentence shall be considered a breach of a material provision for purposes of Section 3.1.B. The Parties agree to negotiate in good faith to cure any omissions, ambiguities, or manifest errors herein.

Survival.

Notwithstanding any other provision concerning the term of this Agreement or the Contract, all protections and other obligations of the Contractor pertaining to PI set forth herein and in the Contract shall survive the termination of this Agreement and shall continue to apply until such time as all such information is returned or destroyed in accordance with Section 3.2 or, if later, until any outstanding obligation of the Contractor with respect to such information has been satisfied.

Interpretation.

Any ambiguity in this Agreement shall be resolved to permit EOHHS to comply with the HIPAA Rules, 42 CFR Part 431, Subpart F, M.G.L. c. 66A and any other Applicable Law.

For purposes of this Agreement, (i) the words “include,” “includes” and “including” shall be deemed to be followed by the words “without limitation”; (ii) the word “or” is not exclusive; and (iii) the words “herein,” “hereof,” “hereby,” “hereto” and “hereunder” refer to this Agreement as a whole. The definitions given for any defined terms in this Agreement shall apply equally to both the singular and plural forms of the terms defined. Whenever the context may require, any pronoun shall include the corresponding masculine, feminine and neuter forms.

Unless the context otherwise requires, references herein to: (i) Sections, Attachments and Appendices mean the Sections of, and Attachments and Appendices attached to, this Agreement; (ii) an agreement, instrument or other document means such agreement, instrument or other document as amended, amended and restated, supplemented and modified from time to time to the extent permitted by the provisions thereof; and (iii) a statute or regulation, including an Applicable Law, refers to that law or regulation as in effect or as amended from time to time and includes any successor legislation or regulation.

The Attachments and Appendices referred to herein shall be construed with, and as an integral part of, this Agreement to the same extent as if they were set forth verbatim herein.

Effective Date.

This Agreement shall be effective upon the Effective Date of the Contract, or any other means by which the Contract is designated as effective in the Contract.

[INTENTIONALLY LEFT BLANK, SIGNATURE PAGE FOLLOWS]

IN WITNESS THEREOF, the Parties have caused their duly authorized representatives to execute this Data Confidentiality and Management Agreement as of the date(s) written below.

EOHHS:

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES,

OFFICE OF MEDICAID

By:

Name:

Title:

Date:

CONTRACTOR:

By:

Name:

Title:

Date: ]

APPENDIX A

ACKNOWLEDGMENT REGARDING CONFIDENTIALITY OF PROTECTED INFORMATION

I, the undersigned, understand that in the course of my work for ___________________, (name or organization) relating to a contract with the Executive Office of Health and Human Services (“EOHHS”), I may have access to protected information- (“PI”)-including protected health information, other personally identifiable information or security information--either provided by EOHHS or created or obtained on its behalf.

I understand that PI is confidential and access to, use of and disclosure of PI is regulated by federal and state law including, without limitation, the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and M.G.L. c. 66A, and the terms of the EOHHS contract.

I recognize that the unauthorized access, use or disclosure of PI may cause serious harm to individuals. Unauthorized access, use or disclosure of PI may also violate the terms of the EOHHS contract and/or federal or state law, which may result in civil or criminal penalty including, without limitation, fines and imprisonment.

Acknowledged and agreed:

Protected Information User’s name (printed or typed):

Protected Information User’s Signature:

Date:

Contractor:

NOTE: Appendix A need not be submitted to EOHHS. Appendix A must be retained by the Contractor and made available EOHHS upon request.