REQ Confidentiality Agreement Standard~38.doc

CONFIDENTIALITY AGREEMENT

STANDARD TERMS AND CONDITIONS

RFR _________

I. GENERAL PROVISIONS

Section 1. The Department of Public Health (Department) is a hybrid entity under the Health Insurance Portability and Accountability Act (HIPAA). The Program is a non-covered component and therefore not subject to the HIPAA Privacy or Security Rules. The Department is subject to the Fair Information Practices Act (FIPA) and since the Department is providing to the Vendor and/or the Vendor may receive or create Confidential Information on behalf of the Department, a confidentiality agreement is included as part of this contract. The Vendor __________________ in the performance of its duties under the contract(s) awarded pursuant to this procurement (the RFR and all attachments to it are referred to collectively as the Contract) is a holder of Confidential Information.

Section 2. The Confidentiality Agreement terms and conditions are intended to protect the privacy and security of all Confidential Information that the Vendor may receive from and/or create on behalf of the Department in the performance of its duties and responsibilities under the contract, and to ensure that the Department through its Vendor complies with FIPA as well as all other applicable state or federal laws governing the privacy or security of any data received or created under the contract.

II. DEFINITIONS FOR USE IN THIS AGREEMENT

All terms used, but not otherwise defined herein, shall be construed in a manner consistent with FIPA and other applicable state or federal privacy or confidentiality laws.

“Confidential Information” (CI) includes:

· Personal Data

· Protected Health Information

· Security Information

· Other information that the data owner determines requires protection from unauthorized access.

Hereinafter, this agreement shall use “CI” to refer to all Confidential Information, unless only a subset is appropriate.

"Data Subject" means an individual to whom Personal Data or Protected Health Information refers.

"Electronic Media" means:

· Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

· Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

"Holder" (referenced herein as Vendor) means any person or entity which contracts or has an arrangement with an agency (DPH) whereby it holds Personal Data as part or as a result of performing a governmental or public function or purpose.

“Information system” means the interconnected set of information resources under the direct control of the Department, as well as those used by the Department under the control of other entities, including the Commonwealth’s Information Technology Division, and the Executive Office of Health and Human Services. The information resources comprising an information system include any equipment, software, devices, or interconnected system or subsystems of software and equipment that are used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data.

"Personal Data" (PD) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual, provided that the information is not contained in a public record and shall not include intelligence information, evaluative information or criminal offender record information as defined in G.L. c. 6, § 167. Protected Health Information, as defined below, constitutes a subset of Personal Data.

"Protected Health Information" (PHI) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual that the Vendor receives, creates or uses under the Agreement. The term PHI applies to the original data and to any data derived or extracted from the original data. PHI is a subset of PD.

“Security Incident(s)” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

“Security Information” means information related to the Department’s Information Systems, the disclosure of which would expose the information systems to external threats, and could lead to the unauthorized disclosure of personal data. Security Information includes, but is not limited to, network diagrams, system schematic drawings, security policies and procedures, user account information and passwords, threat or vulnerability assessments, or any other records relating to the security of the Department’s information systems.

III. OBLIGATIONS OF THE VENDOR

Section 1. Compliance with State and Federal Law. The Vendor acknowledges that in the performance of this Contract, it may receive CI. The Vendor acknowledges that by accepting the CI, it becomes a "holder" of the "Confidential Information" within the meaning of M.G.L. c. 66A, FIPA, and will comply with the requirements of that law as well as all other applicable state or federal laws governing the privacy or security of any data received or created under the Contract.

Section 2. Ownership of CI. The Vendor shall at all times recognize the Department as sole owner of the CI. As owner of the CI, the Department shall at all times have complete control over the access, use, disclosure and disposition of the CI, including, if relevant, editorial control over the output.

Section 3. Agreements by Third Parties. If the Department authorizes the Vendor in advance to engage a subcontractor or an agent, and such subcontractor or agent receives CI from or creates or receives CI on behalf of the Vendor or Department, the Vendor shall obtain and maintain a written agreement with each agent or subcontractor. The agreement shall provide that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Vendor pursuant to this Contract with respect to such CI including, but not limited to, implementing reasonable safeguards to protect the information. All provisions of the Contract apply to all such CI, whether in the possession of the Vendor or any agent or subcontractor. The Vendor is responsible for ensuring each agent's and subcontractor's compliance with all applicable provisions of the Contract. Upon request, the Vendor shall provide the Department with a copy of the written terms between the Vendor and the subcontractor or agent.

Section 4. Security: Appropriate Safeguards. The Vendor agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the CI. Such safeguards shall meet, at a minimum, industry best practices standards and specific standards for privacy and security established by the Department and the Commonwealth. Appropriate safeguards shall include, at a minimum:

· Providing appropriate privacy and security training for each of its employees, agents, or subcontractors who will have access to the Department's CI.

· Requiring each of its employees, agents, or subcontractors having any access to or use of CI to comply with applicable laws and regulations relating to confidentiality, privacy, and security of the CI.

· To the extent that the Vendor's employees physically work on site at the Department, they shall be subject to the Department's Confidentiality and Security Policies and Procedures.

· Not removing any CI from Commonwealth premises, unless authorized under the contract.

· Protecting the physical and electronic security of the CI, including any data created, accessed, stored, or transmitted by electronic media.

· Taking steps to prevent unauthorized access to the CI, including preventing unauthorized access through the use of individual user accounts which are password protected and can be audited.

· Laptop security – When a laptop maintaining CI is not in use, the CI must be secured as encrypted files, or in an encrypted volume on the hard drive or a CD. (Example: PGP Disk File and Disk Encryption). Laptops or CDs must not be left unattended and must be stored securely in locked cabinets or rooms.

· Portable electronic media, if authorized to be used to maintain CI, must include encryption functionality, and must be stored in locked cabinets or rooms.

· USB Thumb Drives must have password or biometric protection to provide for encrypted file security. The encryption must be enabled whenever the CI is not being used. (Example: the Lexar Jumpdrive Secure)

· CI stored on a CD-Rom must be maintained in an encrypted file. (Example: WinZip 9 with 256 bit AES encryption)

· Data Backup – The Vendor shall backup CI as is necessary to ensure the integrity and availability of all information required to perform vendor’s obligations under the Contract. The Vendor shall provide for the security of all backup tapes and storage media.

· If the Department’s CI is stored on backup tapes, which cannot be segregated from other data maintained by the Vendor due to the choice of backup media and system, the Vendor shall continue to ensure the privacy and security of the Department’s CI so long as the backup media is needed. All protections pertaining to any CI covered by the Agreement shall remain in force for so long as the Vendor maintains such CI. To the extent feasible a separate back-up tape should be utilized for the CI under this contract.

· Media Sanitization - Unless otherwise authorized under the terms of the contract, all copies of any Department CI stored on electronic storage media, including thumb drives, controlled by the Vendor, must be destroyed upon termination of the Agreement. CI must be destroyed so that it cannot be recovered from the electronic storage media. Acceptable methods include the use of file wiping software implementing at a minimum DoD.5200.28-STD (7) disk wiping, and the degaussing of backup tapes. Electronic storage media such as floppy disks, CDs, and DVDs used to store data must be made unusable by physical destruction.

· Upon request, the Vendor will furnish the Department with a description of the steps it has taken to prevent use or disclosure of the CI not authorized by this Contract and agrees to allow authorized representatives of the Department access to premises where the CI is kept for the purpose of inspecting security (physical and electronic) arrangements.

Section 5. Non-Secure Transmissions Prohibited. The Vendor agrees that it will not transmit the CI over any unsecured network or over any wireless communication device.

· Transmissions of CI over the Internet are limited to secure transmission protocols approved in writing by the Department

· All CI hosted by the Vendor, and accessible remotely, including via the Internet, must be secured through the use of Firewalls and other perimeter security technologies and must be approved in writing by the Department.

Section 6. Reporting of Disclosures or Security Incidents. The Vendor agrees that it will notify the Department under this Contract both orally and in writing no later than (1) business day following discovery or notice of:

· any use or disclosure of CI not allowed by this Contract,

· any security incident involving or potentially involving the Department’s CI

Section 7. Mitigation. The Vendor shall mitigate, to the extent practicable, any harmful effect that is known to the Vendor of its use or disclosure of CI in violation of the Contract or any security breach. The Vendor shall in consultation with the Department take measures that the Department deems appropriate to recover the CI and prevent a future breach of the confidentiality and security of the CI. The Vendor shall report to the Department the results of all mitigation actions taken. Nothing in this Section shall be deemed to waive any of the Department's legal rights or remedies that arise from the Vendor's unauthorized use or disclosure of the CI or security breach.

Section 8. Notice of Request for CI. The Vendor agrees to notify the Department prior to the return date or within five (5) days of the Vendor's receipt of any legal request, court order, or subpoena for CI, whichever is earlier. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Vendor agrees to cooperate fully with the Department in such challenge.

Section 9. Access to CI or Personal Data.

A. The Vendor shall provide the Department with access to or copies of any CI that it maintains pursuant to the contract.

B. The Vendor shall provide the data subject with access directly to the subject’s PD, subject to restrictions, if the individual makes the request directly to the Vendor, as shall be necessary to meet its obligation under M.G.L. c. 66A.

C. Such access or copies shall be provided to the Department or individual within five (5) days of the request.

Section 10. Availability of PD for Amendment. The Vendor shall allow an individual to make requests to amend his or her PD that the Vendor maintains and for which the Vendor is the source, subject to restrictions. The Vendor shall also make any amendment(s) to PD that it received from or created or received on behalf of the Department that the Department directs, in order for the Department to meet its obligations under M.G.L. c. 66A. All such amendments shall be made within ten (10) days of receipt of the request from the Department.

Section 11. Accounting of Disclosures. The Vendor shall document PD disclosures and required information related to such disclosures, as is necessary for the Department to respond to an individual's request for accounting of disclosures in accordance with the Department's Confidentiality Policy and Procedures, Procedure # 12. The Vendor agrees to provide to the Department or the individual, within ten (10) days of the request an accounting of disclosures of PD. At a minimum, the Vendor will provide the following information: (i) the date of the disclosure, (ii) the name of the entity or person who received the PD, and if known, the address of such entity or person, (iii) a brief description of the PD disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure.

Section 12. Access to Records. The Vendor shall make available to the Department its internal practices, books, and records including policies and procedures relating to the use and disclosure of the CI received from the Department, or created or received by the Vendor on behalf of the Department as well as security procedures. The Department shall determine the time and manner for making such material available.

IV. PERMITTED USES AND DISCLOSURES BY THE VENDOR

Section 1. Uses and Disclosures of CI. The Vendor agrees to use or disclose CI that it receives from and/or creates or receives on behalf of the Department only as specified in this Section IV.

To Perform the Contract (MDPH to check one)

A. FORMCHECKBOX

The Vendor's responsibilities under the contract require only the use of CI. Vendor is prohibited from disclosing any CI to any entity other than the Department. The Vendor shall give the Department full access to such CI for purposes of auditing the performance of the Vendor under the Contract and as the Department determines is otherwise necessary.

If the box above is checked, Sections 9 (B), 10, and 11 of Part III of this agreement do not apply.

FORMCHECKBOX

The Vendor may use or disclose CI, or create CI on behalf of the Department, as is necessary for the Vendor to administer or perform the functions, activities and services that are required to satisfy its obligations under the Contract. This shall include providing the Department with full access to such CI for purposes of auditing the performance of the Vendor under the Contract and as the Department determines is otherwise necessary for: (1) providing treatment to individuals receiving services under the contract; (2) the payment for or reimbursement of those services; and/or (3) health care operations. Operations shall include reporting to the Department to fulfill state or federal reporting requirements. If the Vendor concludes that a client authorization is required for the release of personal data to the Department as required in this section, the Vendor agrees to timely secure client authorizations.

Further Clarification (by MDPH if necessary):

B. For Publication or Presentation

No results or findings derived from the data provided or created pursuant to this contract may be published or publicly released without prior written approval by MDPH. All proposed publications or releases must be submitted for review and comment to MDPH at least thirty days prior to the date of the proposed release for the purpose of ensuring that at a minimum:

· No individual case level data are released;

· All aggregate data are in compliance with the MDPH aggregated data release standards;

· All materials developed with data provided or created pursuant to this contract shall clearly reflect the source of the data, and funding, if applicable, as the Massachusetts Department of Public Health;

· All MDPH recommendations are addressed prior to publication; in certain instances the inclusion of a disclaimer may be required.

The Vendor understands that Department approval pursuant to the conditions outlined in this subsection is required prior to any distribution by electronic media of data interpretation or findings derived from the data provided, and that any such distribution must be in read-only format. For purposes of this Agreement, publication by electronic media includes the Internet, the Vendor's extranet, electronic bulletin board or newsgroups, RSS or Atom-based syndication, or similar communication modes utilizing the electronic dissemination of information.

C. For Research: The Vendor agrees that it may not disclose CI received from or created or received pursuant to the contract with the Department for research purposes without the written approval of the MDPH Research and Data Access Review (RaDAR) Committee for the specific research.

Section 2. Minimum Necessary. The Vendor agrees to take reasonable steps to limit the amount of CI used and/or disclosed pursuant to Section 1 of this subsection to the minimum necessary to achieve the purpose of the use and disclosure.

V. PLEDGE BY AUTHORIZED USERS: The Vendor will limit access to the CI to only those individuals it has authorized to access the CI. All authorized users must sign the Confidentiality Pledge, attached to this agreement, prior to accessing the CI. Vendor shall hold a Confidentiality Pledge for each authorized user, and shall provide to the Department a copy of each pledge within ten (10) days of the signing of each pledge.

VI. TERMINATION OR COMPLETION OF CONTRACT WITH THE VENDOR

Section 1. Termination Upon Breach of Provisions Applicable to CI. The Department may terminate this Contract immediately upon written notice, as specified in section 5 of the Commonwealth Standard Terms and Conditions, if the Department determines, in its sole discretion, that the Vendor has materially breached any of its obligations regarding CI. Prior to terminating this Contract as permitted above, the Department, in its sole discretion and according to standards approved by the Department, may provide an opportunity for the Vendor to cure the breach or end the violation. If such an opportunity is provided, but cure is not feasible, or the Vendor fails to cure the breach or end the violations within a time period set by the Department, the Department may terminate the Contract immediately upon written notice.

Section 2. Effect of Termination or Completion:

A. The Vendor agrees that within 14 days of the termination or completion of this Contract, it will return, or destroy, at Department's direction and according to standards approved by the Department, any and all CI that it maintains in any form, including CI that is in the possession of its subcontractors or agents and will retain no copies of the CI.

B. Notwithstanding the foregoing, to the extent that the Department agrees that it is not feasible to return or destroy such CI, the Vendor shall continue to ensure the privacy and security of the Department’s CI so long as it retains the CI. All protections pertaining to any CI covered by this Agreement shall remain in force for so long as the Vendor maintains the CI.

C. The Confidentiality Agreement is coterminous with the underlying contract. If a renewal contract is signed, a renewal confidentiality agreement is also required. To the extent that a contract agreement is amended, the confidentiality agreement shall be amended as needed.

Section 3. Survives the Termination of the Contract. Notwithstanding any other provisions concerning the term of the Contract, all obligations of the Vendor and protections pertaining to the privacy and security of CI under this Agreement shall continue so long as the Vendor retains any CI covered under this agreement.

VII. MISCELLANEOUS PROVISIONS

Section 1. Remedies. Nothing in this Agreement shall be construed to waive or limit any of the Department's legal rights or remedies that may arise from the Vendor's unauthorized use or disclosure or security breach. The Department's exercise or non-exercise of any authority under the Agreement including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Vendor of any obligations as set forth herein nor be construed as a waiver of any of the Vendor's obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the Vendor.

Section 2. Interpretation. Any ambiguity in this contract shall be resolved to permit the Department to comply with M.G.L. c. 66A, and any other law pertaining to the privacy or security of Confidential Information.

The Vendor has caused its duly authorized representative to execute this Agreement.

(Insert Name of the Vendor)

By

Title

Date

THE COMMONWEALTH OF MASSACHUSETTS

DEPARTMENT OF PUBLIC HEALTH

Pledge of Confidentiality

Agreement for the Use of Confidential Information Department of Public Health

I, the undersigned, understand that in the course of my work for ______________, (name or organization) relating to a contract with the Massachusetts Department of Public Health (MDPH), I may have access to confidential information--including personal data about individuals or security information--either provided by MDPH or created on its behalf. This information may be contained in paper forms, computerized data bases or other media.

I understand that access to this confidential information is provided for the sole purpose of the work covered by the MDPH contract. I understand that this confidential information is protected from unauthorized disclosure under state law and that its use for this contract is limited by law and MDPH Confidentiality Policy and Procedures.

I recognize that the unauthorized use or disclosure of any confidential information may cause serious harm to individuals and damage to the mission of the Massachusetts Department of Public Health. Such unauthorized use is inconsistent with the terms of the contract, is against the ethical standards of my profession, may be a violation of state and/or federal law, and may be sufficient cause for MDPH to terminate this contract, bar future participation in MDPH contracts or take other legal action.

In order to preserve the confidentiality of the MDPH confidential information and the integrity of the data systems to which I have access, I acknowledge and agree that:

DATA USER INITIALS BELOW:

1. _________Regardless of how obtained, I will respect the confidentiality of all MDPH confidential information to which I have access. I will not disclose any confidential information unless authorized to under the contract with the MDPH and I will not attempt to access confidential information to which I am not entitled.

2. _________I will conduct any related activities, including but not limited to: analysis, discussion with others authorized to access this confidential information, and report writing performed with computerized data/information or paper form resources, in accordance with all applicable policies and procedures and best practices.

3. _________I will ensure the physical security of all MDPH confidential data when I leave my work area unattended through the use of locked files, locked workstations, locked offices, and similar methods. This applies to the security of medical records, case review forms, computerized printouts, computer diskettes and other materials relevant to my project duties.

4. _________Any passwords and/or identification codes assigned to me for access to computers containing MDPH confidential information are intended for my professional project-related use only. I understand that I will be accountable for all data, reports, and other activities performed under my assigned passwords and identification codes. I will not disclose my passwords/ID codes to others and will be responsible for assuring that any employees that I supervise are assigned their own passwords/codes.

5. _________I will report to my supervisor or the MDPH contact any misuse of computing resources or MDPH confidential information, or anything which leads me to suspect that the security of my own passwords has been compromised.

6. ________ I will report to my supervisor, or if I am the supervisor, to the MDPH contact, any inappropriate disclosure of confidential information provided by MDPH or created by this contract.

7. _________I will not discuss MDPH confidential information except in the performance of contract-related duties and only if authorized.

8. _________I will not remove any MDPH confidential information from the work place unless explicitly authorized by MDPH and my supervisor.

9. _________I will not place confidential information on a laptop or transmit the information electronically unless explicitly authorized by MDPH and my supervisor and shall be responsible for following all relevant standards if approved to use a laptop or transmit confidential information.

10. _________ I understand that infringement of these rules could result in the denial of future authorization of access to MDPH confidential information.

11. ________ I understand that all confidential information provided by or created on behalf of MDPH are owned by the MDPH and no findings derived from the data provided or created pursuant to this contract may be published or publicly released without prior submission and written approval by MDPH.

I have read the Confidentiality Agreement that is part of the contract with the Massachusetts Department of Public Health and I agree to abide by the conditions therein.

Confidential Information User’s Signature

Date

Confidential Information User’s name (printed or typed)

Vendor

CONFIDENTIALITY AGREEMENT– STANDARD TERMS AND CONDITIONS

Revised 01/08