Attachment I OHA RFP #5669, Care Coordination Services for OHP Open Card

SECURITY AND PRIVACY EXPECTATIONS FOR 3RD PARTIES ACCESSING THE ODHS|OHA NETWORK.

SECURITY AND PRIVACY DEFINITIONS.

“Access” means the ability or the means necessary to read, communicate, or otherwise use State of Oregon Data, Network and Information Systems, and Information Assets.

“Breach” means the acquisition, access, exposure, use, disclosure, of an Information Asset (such as Data) in a manner not in compliance with applicable law, rule, or policy, or data loss, misuse, or compromise.

“Client Records” includes any client, applicant, or participant information regardless of the media or source, exchanged between the parties. Client Records may be for clients of ODHS|OHA, Contractor, both, or another entity.

“Data” means information created, transmitted, and stored pursuant to this Agreement, including metadata, personal information, and Client Records.

“Incident” means the attempted or successful unexpected or unwanted unauthorized access, use, disclosure, modification, or destruction of any Network and Information System or Information Asset. An Incident is an observable, measurable occurrence that is a deviation from expected operations or activities. An incident may be a Breach, failure to protect a User’s identification (ID), or theft of computer equipment that uses or stores any de-identified Data.

“Individual Access Request (IAR)” refers to the Agencies’ form used to authorize a User, identify the User’s job assignment, and the required access to Network and Information System(s). It generates a unique alpha/numeric code used to access the Agencies’ Network and Information Systems.

“Information Asset(s)” refers to all information provided through the Agencies, regardless of the source, which requires measures for security and privacy. Includes Data.

“Network and Information System(s)” or “Systems” means the State of Oregon’s computer infrastructure which provides personal communications, Data, and Information Assets, regional, wide area, and local networks, and the internetworking of various types of networks.

“User” means any individual (authorized or unauthorized) who Accesses the Network and Information Systems or Information Assets through contractor’s Access under this Agreement. Authorized Users each have an assigned unique log-on identifier.

NOTIFICATIONS.

Incident and Breach Notifications. In the event contractor or its subcontractors or agents discover or are notified of an Incident or a Breach, including a failure to comply with contractor’s confidentiality obligations, contractor shall notify the ODHS|OHA point of contact of the Incident or Breach immediately, and in no event more than 24 hours following discovery or notification. If the State of Oregon determines that the Incident or Breach requires notification of ODHS|OHA clients, or other notification required by law, the State of Oregon will have sole control over the notification content, timing, and method, subject to contractor’s obligations under applicable law. Notwithstanding the foregoing, the parties acknowledge and agree that this section constitutes notice by contractor to ODHS|OHA of the ongoing existence and occurrence of security incidents that are “unsuccessful,” such as “pings” on a firewall, and do not represent Incidents or Breaches.

Requests for Data. In the event contractor receives a third-party request for Data, including any electronic discovery, litigation hold, or discovery searches, contractor shall first give Agencies notice and provide such information as may be reasonably necessary to enable the State of Oregon to protect its interests.

Changes in Law. Each party shall provide notice to the other of any change in law, or any other legal development, which may significantly affect its ability to perform its obligations under this Agreement.

DATA PRIVACY. In addition to contractor’s obligations under the Services contract regarding confidentiality:

Generally. Contractor shall hold all Client Records and other information as to personal facts and circumstances obtained by contractor on ODHS|OHA clients as confidential, in accordance with the standard of care applicable to the Client Records, and shall not divulge any Client Records without the written consent of the client, the client’s attorney, the responsible parent of a minor child, or the minor child’s guardian except as required by other terms of its Services contract, this Agreement, or applicable law.

Accuracy of Data. Data Accessed under this Agreement is from multiple sources and subject to change arising from numerous factors. Without limiting any other provision of this Agreement, neither party nor its vendors are responsible or liable under this Agreement for any claim related to the accuracy, content, currency, completeness, or delivery of any Data either provided or used by the parties.

Limited Purposes. Contractor shall limit the use or disclosure of Data concerning clients to persons directly connected with the Services and administration of this Agreement or the Services contract.

Privacy Protections. Data may include information, such as Client Records, subject to specific confidentiality protections under state or federal law. Contractor shall comply with laws and regulations applicable to the information to which contractor has Access, including as specified in the Services contract and this Agreement.

Training. Contractor’s employees, subcontractors, and agents who will be granted Access have received training on the privacy and security obligations relating to the Access, including on Client Records. Contractor shall provide periodic privacy and security training to its employees, subcontractors, and agents. This periodic training may include State of Oregon trainings available to third parties on security and use and disclosure of Data.

SECURITY REQUIREMENTS.

Compliance with Laws, Regulations, and Policies. Contractor and its employees, subcontractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of Data (including Client Records) and Access, including as those laws, regulations, and policies may be updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

Oregon’s Statewide Information Security Standards https://www.oregon.gov/eis/cyber-security-services/Documents/2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf Oregon’s Statewide Information Security Plan, https://www.oregon.gov/eis/cyber-security-services/Documents/StatewideInformationSecurityPlan.pdf Oregon’s Statewide Policies: https://www.oregon.gov/das/Pages/policies.aspx.

ODHS and OHA Privacy and Confidentiality administrative rules, OAR Chapter 407, Division 14, and OAR Chapter 943, Division 14.

The Oregon Consumer Identity Theft Protection Act, ORS 646A.600 through 646A.628, to the extent applicable.

The Health Insurance Portability and Accountability Act (HIPAA), including as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5 (“ARRA”), and its implementing Privacy Rule and Security Rule, 45 CFR Parts 160 and 164[, to the extent contractor receives Protected Health Information (as defined in HIPAA) in connection with this Agreement. [and as applicable, contractor shall comply with the Business Associate Agreement (BAA) which is included in its Services contract, in connection with contractor’s Access.] Responsible for Compliance. Contractor is responsible for the compliance of its employees, agents, and subcontractors with this Agreement and with any third-party licenses to which Access is subject.

Subcontractors. Contractor shall disclose its subcontractors acquiring Access to Data under this Agreement to the Agencies’ point of contact.

Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security and privacy of all Information Assets, including Client Records, regardless of the media, and all Network and Information Systems. Contractor shall monitor, periodically assess, and update its security controls and risk to ensure continued effectiveness of those controls.

Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required in accordance with this Agreement is documented in a security risk management plan. Contractor shall make its security risk management plan available to the State of Oregon for review upon request.

Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Agreement, and provide ODHS|OHA, the Oregon Secretary of State, the federal government, and their duly authorized representatives, access to Contractor officers, agents, contractors, subcontractors, employees, facilities and records for them to:

Determine Contractor’s compliance with this Agreement, Validate contractor’s written security risk management plan, or Gather or verify any additional information ODHS may require to meet any state or federal laws, rules, or orders regarding Data.

Access to facilities, systems, and records under this section will be granted following reasonable notice to contractor. Records include paper or electronic form, system security logs, and related system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

ACCESS TO AGENCY SYSTEMS.

Contractor’s Responsibilities for User Accounts. Contractor agrees to facilitate the completion any forms, such as the Individual Access Request (IAR), for each person for whom Access is requested.

Contractor is responsible for all activities that occur through its Access, including for any acts related to a lost or stolen User ID or password.

Except as otherwise specified or approved by ODHS|OHA, neither contractor nor its Users shall modify, alter, delete, or destroy any Information Asset.

Contractor shall immediately notify ODHS|OHA when a User, group of Users, or contractor, no longer requires Access whether due to changes in duties or due to changes in contractor’s programs related to this Agreement.

Contractor is responsible for ensuring account information for its Users is accurate, complete, and up to date.

Security. Contractor shall maintain security of equipment and hardware, and ensure the proper handling, storage and disposal of all State of Oregon or ODHS|OHA Information Assets accessed, obtained, or reproduced by contractor and its Users to prevent inadvertent destruction or loss.

Prevention of Unauthorized Access. Contractor shall not allow any Access to State of Oregon Network and Information Systems or Information Assets by its Users that is not authorized in accordance with this Agreement and applicable law and shall implement and maintain safeguards to prevent unauthorized Access.

Access from Outside the US and its Territories. PE Access to the state network from outside the US and its territories is prohibited unless approved through the Geofencing Exception Request Process, ODHS|OHA 090-009-05.

PE shall not allow use of any Information Asset in any country or in any manner prohibited by governing applicable law, rule, or policy.

Authorized Access and Use Only. No User may Access or use State of Oregon Network and Information Systems or Information Assets for any purpose other than those specifically authorized under this Agreement.

Users shall not use Access to obtain or attempt to obtain Access or any Data not authorized or intentionally made available.

The use and disclosure of any Data is strictly limited to the minimum information necessary for the Services described in the Services contract.

Revocation or Termination of Access. Breach, or wrongful use or disclosure of Data by contractor or its Users, may cause the immediate revocation of the Access granted though this Agreement, in the sole discretion of ODHS|OHA, or ODHS|OHA may specify a reasonable opportunity for contractor to cure the unauthorized use or disclosure and end the violation, and terminate the Access if contractor does not do so within the time specified by ODHS|OHA. Legal actions also may be taken for violations of applicable regulations and laws.

No Unauthorized Distribution. Contractor shall not sell, make available, or provide Information Assets in any form to any other persons or organizations, and shall not use the Data for any purposes other than as allowed under the Services contract, this Agreement and applicable law.

No Impairment. Contractor shall not allow use of this Access in any manner which could damage, disable, overburden, or impair Network and Information Systems, or interfere with any other entity’s use or benefit of Network and Information Systems.

Prohibition on Data Mining. Contractor shall not use any data-mining technology on Network and Information Systems for any non-authorized activity. For purposes of this requirement, “non-authorized activity” means the data mining or processing of data on Network and Information Systems, stored or transmitted for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in this Agreement.

Incidents and Breaches. Contractor shall comply, and shall cause its subcontractors to comply, with any requirements for identifying and addressing an Incident or Breach. This requirement applies regardless of whether the Incident or Breach was accidental or otherwise.

RETURN OF INFORMATION ASSETS. Upon expiration or termination of this Agreement for any reason whatsoever, contractor shall comply with its obligations under applicable law and this Agreement for the return of Agencies’ property, including:

Disposal. Contractor shall ensure the proper handling, storage and disposal of all State of Oregon or ODHS|OHA Information Assets accessed, obtained, or reproduced by contractor and its Users to prevent inadvertent destruction or loss. Contractor shall ensure proper disposal of equipment and Information Assets when authorized use ends, consistent with contractor’s record retention obligations and obligations regarding Data under applicable law and this Agreement.

Sanitization. Except as necessary to meet its records maintenance and audit obligations under the Services contract, applicable law and this Agreement, contractor shall not retain any copies of State of Oregon or ODHS|OHA Data. Contractor shall notify ODHS|OHA of any conditions that make returning all such Data not feasible. Upon ODHS|OHA’s written acknowledgement that returning all Data is not feasible, contractor shall purge or destroy retained State of Oregon and ODHS|OHA Data in all its forms in accordance with the most current version of NIST SP 800-88 (or other agreed-upon standard) and on request provide ODHS|OHA with written certification of sanitization.

Protections. Contractor shall maintain protections required by law, the Services contract and this Agreement for any retained State of Oregon or ODHS|OHA Data for so long as contractor (including through any subcontractor) retains it.

OregonBuys Bid Number S-44300-00009613

OHA RFP 5669

Attachment I – Security and Privacy Expectations for 3rd Parties Assessing the ODHS/OHA Network Page 1 of 14