RFQ 2022-010 Web Hosting for Health Care Transparency Website~1.docx

REQUEST FOR QUOTE UNDER ITT72

Web Hosting for Health Care Transparency Website RFQ #2022-010

REQUEST FOR QUOTE UNDER ITT72

RFQ #2022-010

ISSUE DATE: 11/29/2021

1. Description or Purpose of Procurement:

Background

The Center for Health Information and Analysis (CHIA) is an independent agency of the Commonwealth of Massachusetts (Commonwealth) established pursuant to M.G.L. c. 12C, a health care reform law enacted to improve health care quality and contain health care costs. CHIA is charged with monitoring the health care system in Massachusetts and providing reliable information and meaningful analysis for those seeking to improve health care quality, affordability, access, and outcomes. CHIA’s vision is to be the hub of information and analysis with respect to the Massachusetts health care system, connecting our products to policymakers, providers, public and private payers, employers, researchers, and the residents of the Commonwealth.

CHIA maintains a website, MassCompareCare.gov (CompareCare), that provides visitors with informational data and tools to better understand the Massachusetts health care market.

Procurement Scope and Project Overview

CHIA is seeking a contractor to render web hosting services for the CompareCare site. The contractor will be expected to work collaboratively with CHIA and, if necessary, coordinate with CHIA’s website maintenance vendor in connection with any updates, upgrades, redesigns, maintenance and support services relating to the CompareCare site, to ensure the most current and accurate version of the website is being hosted. This procurement does not include development services.

CHIA seeks quotes from qualified and approved contractors currently listed as eligible vendors under Category 7: Managed Services of statewide contract ITT72 Category 2 to 9: Network Services, Communications Services & Related Equipment.

2. Applicable Procurement Law

Executive Branch Goods and Services

3. Acquisition Method:

4. Whether Single or Multiple Contractors are Required for Contract:

Check One (“X”):

a. Estimated Number of Awards The target maximum number of Contractors is 1; the purchasing department may award more or fewer contracts, if it is in the best interest of the Commonwealth to do so.

b. Adding Contractors after initial Contract Award If, over the life of the contract, the purchasing department determines that additional Contractors are needed, these may be drawn from qualified companies which responded to this Solicitation but were not awarded contracts. If necessary to meet the requirements of the Commonwealth, the Solicitation may be reopened to obtain additional Bids.

5. Expected Duration of Contract (Initial Duration and any Options to Renew):

Initial Duration

From the execution date through 6/30/2022

Total Maximum Contract Duration

6/30/25 The Maximum Contract End Date is contingent upon the terms of ITT72.

6. Contract Performance and Business Specifications:

6.1 Scope of Services:

The Contractor will:

· Work in concert with CHIA staff and/or CHIA’s website maintenance vendor to acquire full insight and knowledge of the CompareCare website architecture to ensure successful and reliable hosting of the website.

· Hold a kick-off meeting with CHIA staff and/or CHIA’s website maintenance vendor to define and determine goals and expectations with respect to hosting the CompareCare website.

· Render website hosting services including:

· provision of a dedicated server or server space sufficient to host the website

· server or server space scalability

· server management

· security

· backup services

· 24/7 uptime

· 24/7 live technical support

· SSL certificates, if necessary

· availability and access to file transfer protocol and secure file transfer protocol

· Conduct testing following website transfer prior to making the website live

6.1.3 CHIA Responsibilities:

CHIA will:

· Meet with the Contractor to provide background on technical decisions made to date

· Provide the Contractor with available documentation

· Provide the Contractor with access to CompareCare, including production and staging environments

6.2 Required Elements of Quote:

6.2.1. Description of Approach (1-2 pages)

Please provide a description of your proposed approach to accomplishing the activities and deliverables in the Scope of Services under Section 6.1.

6.2.2 Compensation and Key Personnel (1-3 pages)

· Please complete Appendix A.

· Please propose a monthly hosting fee and an hourly rate budget for additional set up work described in section 6.1 Scope of Services.

· Hourly rates should not exceed the approved hourly rates allowed under ITT72. Also, hourly rates should be all inclusive of any indirect costs.

· Provide a listing of key personnel that will perform the work associated with this contract. Please include the names, titles rates, and a brief bio. The titles and rates must not exceed the previously submitted and approved ITT72 ceiling rates.

CHIA understands that the maximum obligation amounts in Appendix A are estimates and that these may change during the project. Any additional scope(s) of work that aligns with the goals of the project will remain flexible and will not exceed any internal maximum obligation cap decided upon by CHIA.

Contractors must submit responses that meet all the requirements of the RFQ. Only responsive proposals will be considered.

7 Change in Scope/Additional Responsibilities

CHIA shall have the option, at its sole discretion, to modify, increase, reduce or terminate any activity related to any contract that may result from this procurement whenever, in the judgment of CHIA, the goals of any of the projects have been modified or altered in a way that necessitates such changes. CHIA may determine that additional work products are necessary to accomplish the Scope of Services or that certain items are not required or must be substantially modified. The Contractor(s) and CHIA may negotiate changes to any Statement of Work that are in the best interests of the Commonwealth. CHIA will provide prior written notice of any such action to the Contractor(s) and the parties will negotiate the effect of such changes in scope on the Statement of Work.

8 Anticipated Expenditures, Funding or Compensation:

The funding for any contract resulting from this procurement is subject to appropriation in each fiscal year.

9 Fiscal Terms

Proposals must include Appendix A: Key Personnel and Budget.

The cost proposal must reflect specific and transparent pricing information. . The cost proposal must also reflect whether subcontractors will be engaged and describe the portion of the project to be completed by subcontractors.

Contract funds are specific to each fiscal year and any unspent funds at the end of a fiscal year do not carry forward to a subsequent fiscal year.

10 Amendment

The scope of work is subject to amendment by agreement of CHIA and the Contractor(s), consistent with the terms of ITT72.

11 Data Use and Confidentiality

It is acknowledged that in the course of providing services under a resulting Agreement, the Contractor may be provided with access to Confidential Information, as defined herein. If the Contractor is provided access to Confidential Information, this Section sets forth the terms and conditions pursuant to which Confidential Information that the Contractor uses, maintains, discloses, receives, creates or otherwise obtains from or on behalf of CHIA will be handled during the term of and after the termination of the services.

Confidential Information includes Identifiable Confidential Information and CHIA Confidential Information both as defined below.

1. Identifiable Confidential Information “Identifiable Confidential Information” shall mean any “Personal Data” as defined in M.G.L. c. 66A; any “Personal Information” as defined in M.G.L. c. 93H; any “Patient Identifying Information” as defined in 42 CFR Part 2; any “Protected Health Information” as defined in the Privacy Rule (45 CFR 160.103) and 957 CMR 5.00; and any other individually identifiable information, as defined under any federal or state law (including for example any state or federal tax return information), that the Contractor uses, maintains, discloses, receives, creates or otherwise obtains under a resulting Agreement. Information, including aggregate information, is considered Identifiable Confidential Information unless it is fully de-identified in accord with 45 CFR 164.514(a), (b), and (c).

If the Contractor has access to Identifiable Confidential Information, the terms of the Data Use Agreement attached hereto and incorporated herein, shall apply. Further, prior to execution of an agreement for services Contractor must provide a Data Management Plan that must be approved by CHIA.

If the Contractor is not authorized under a resulting Agreement to obtain Identifiable Confidential Information, but receives such information inadvertently, the Contractor shall immediately notify CHIA, destroy the information and submit a Certificate of Destruction.

If the Contractor has access to Patient Identifying Information, as defined under 42 CFR Part 2, the Contractor shall adhere fully to any and all restrictions on the use and/or disclosure of such information as required by the federal regulations governing the Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2.

1. CHIA Confidential Information “CHIA Confidential Information” shall mean records and information maintained by CHIA that is exempt from disclosure under public records law, as defined by M.G.L. c4 §7, and may include correspondence, documents, raw and aggregate data (including data submitted by payers), studies and reports, and policy under development. CHIA Confidential Information also includes information identified as “Confidential” under a resulting Agreement.

If the Contractor has access to CHIA Confidential Information, the Contractor shall take reasonable steps to ensure the physical safety of such information, as well as manually held information under its control. Such steps may include, but are not limited to: the use of devices and methods such as alarm systems, locked files, guards, camera surveillance of work areas or other devices reasonably expected to prevent loss or unauthorized removal of manually held information. In addition, the Contractor agrees to take reasonable steps to prevent unauthorized use of passwords, access logs, badges or other methods designed to prevent loss of or unauthorized access to electronically or mechanically held information by using methods including, but not limited to: restricted terminal access, restricted access to input and output documents and other such restrictions designed to protect CHIA Confidential Information.

The Contractor shall require all employees, agents, and/or subcontractors who use, maintain, disclose, receive, create or otherwise obtain Confidential Information to sign the Confidentiality Agreement, attached hereto and incorporated herein. The Contractor shall maintain a log of all individuals who sign a Confidentiality Agreement.

Unless otherwise set forth under a resulting Agreement, all Confidential Information will be destroyed or returned to CHIA upon termination of the services. If Identifiable Confidential Information is destroyed or returned, the Contractor shall complete and return the Certificate of Completion and Data Destruction attached to and incorporated within the Data Use Agreement.

12 Performance Measures

In performance of the contracted work, the Contractor is expected to:

· Be responsive and have the ability to meet project tasks within compressed timeframes;

· Incorporate CHIA’s suggestions, edits, and comments and deliver revised products to CHIA for review;

· Allow sufficient time for review and feedback by CHIA staff on preliminary drafts;

· Complete the project at or under the agreed-upon budget; and

· Respond promptly and thoroughly to CHIA requests and inquiries.

13 Evaluation Criteria

This RFQ is open only to eligible and approved Contractors under Category 7 of the ITT72 master contract. Contractors must submit responses that meet all the submission requirements of the RFQ. Only responsive proposals that meet the submission requirements will be considered, evaluated and scored by the evaluation team in accordance with the evaluation criteria described herein. Additional information may be requested for evaluation purposes.

Contractors must be available to start work upon award of a contract and have the capacity to complete the work expeditiously. CHIA will consider the following criteria in selecting qualified Contractors for this engagement:

1. Responsiveness and Approach. The Contractor:

(a) Proposes a feasible approach that is well-tailored to the activities and deliverables described in the Scope of Services in Section 6.1;

(b) Proposes an appropriate timeline;

(c) Demonstrates the ability to maintain a high-level of responsiveness and professionalism while rendering services on behalf of CHIA; and

(d) Provides sufficient information to assist CHIA in understanding how the Contractor will carry out the items delineated in the Scope of Services.

2. Relevant Experience. The Contractor has:

(a) Experience building and maintaining complex, data-driven websites;

(b) Experience reaching and communicating with key target audiences;

(c) Experience managing/supporting online technologies for public consultation;

(d) Demonstrated project management capabilities;

(e) Experience developing Application Programming Interfaces that pull from multiple data sources.

3. Capacity. The Contractor:

(a) Is able to supply experienced staff to successfully perform and coordinate the work described in the Scope of Services in Section 6.1; and

(b) Is willing and able to work effectively as a strategic partner with CHIA.

4. Sample Projects. The Contractor:

(a) Provides and/or describes sample projects that in the estimation of CHIA are high quality projects and align with CHIA’s web development needs; and

5. Best Value. The Contractor demonstrates:

(a) Proposed costs that are reasonable and in line with the Scope of Services. Lowest rates will not be the sole determining factor in awarding the contract;

(b) Demonstrates best value based on qualifications and pricing. In addition to the above evaluation criteria, CHIA will select and enter into a contract with the candidate whose proposal, in reviewers’ opinions, provides the best value for the services required;

14 Estimated Procurement Calendar

14.1 Procurement Calendar Updates

Times are Eastern Standard/Daylight Savings (US), as applicable. If there is a conflict between the dates in this RFQ Calendar and the dates posted to COMMBUYS, the posted dates shall prevail. Any changes in the RFQ Calendar that are made after the RFQ has been published will not result in amendments to the RFQ and the related RFQ Calendar therein. Instead, such changes will appear only on COMMBUYS. Bidders are required to monitor COMMBUYS for changes to the procurement calendar for this Bid.

14.2 Prohibitions

Bidders are prohibited from communicating directly with any employee of the procuring Department or any member of CHIA regarding this RFQ except as specified in this RFQ, and no other individual Commonwealth employee or representative is authorized to provide any information or respond to any question or inquiry concerning this RFQ. Bidders may contact the contact person using the contact information provided in this Bid in the event that this RFQ is incomplete or information is missing. Bidders experiencing technical problems accessing information or attachments stored on COMMBUYS should contact the COMMBUYS Helpdesk.

14.3 Online Questions (Bid Q&A)

Written Questions must be entered by pressing the “Bid Q&A” tab for the Bid in COMMBUYS no later than the “Online Questions Due” date and time indicated in the Estimated Procurement Calendar (above). The issuing department reserves the right not to respond to questions submitted after this date. It is the Bidder’s responsibility to verify receipt of questions.

It is the responsibility of the prospective Bidder and awarded Contractor to maintain an active registration in COMMBUYS and to keep current the email address of the Bidder’s contact person and prospective contract manager, if awarded a contract, and to monitor that email inbox for communications from the Purchasing Department, including requests for clarification. The Purchasing Department and the Commonwealth assume no responsibility if a prospective Bidder’s/awarded Contractor’s designated email address is not current, or if technical problems, including those with the prospective Bidder’s/awarded Contractor’s computer, network or internet service provider (ISP) cause email communications sent to/from the prospective Bidder/Awarded contractor and the Purchasing Department to be lost or rejected by any means including email or spam filtering.

Written Responses to Questions will be released on or about the “Official Answers for Bid Q&A” date indicated in the Estimated Procurement Calendar (above).

(Written questions and responses will be posted on the Bid Q&A Tab for this Bid in COMMBUYS.)

14.4 Bid Amendment Deadline

The Purchasing Department reserves the right to make amendments to the Bid after initial publication. It is each Bidder’s responsibility to check COMMBUYS for any amendments, addenda or modifications to this Bid, and any Bid Q&A records related to this Bid. The Purchasing Department and the Commonwealth accept no responsibility and will provide no accommodation to Bidders who submit a Quote based on an out-of-date Bid or on information received from a source other than COMMBUYS.

14.5 Quotes (Bid Responses) Deadline (Bid Opening Date/Time)

See the Quotes (Bid Responses) Deadline (Bid Opening) Date and Time indicated in the Estimated Procurement Calendar (above). .

14.6 Estimated Contract Start Date

This is the approximate start date. The actual start date will be the Contract Effective Date which is the date the Contract is executed by the parties.

15 Instructions for Submission of Responses:

Only electronic quotes submitted via COMMBUYS will be accepted in response to this RFQ. Responses must be sent via the “Create Quote” functionality contained in COMMBUYS. For instructions concerning how to submit a Quote, please see Appendix C.

16 Required Forms Responses to this RFQ must contain the following documents:

The above attachments are available as part of the Bid record on COMMBUYS (WWW.COMMBUYS.COM).

Appendix A: Key Personnel & Budget

1. Please complete the following budget table. You can add as many rows as necessary.

Section 1 should include primary deliverables and all labor-related costs.

FY22 (Contract execution date through 6/30/2022)

Section 1

Monthly Hosting Fee

Services as described in Section 6.1

Total cost

2. Please provide a listing of ITT72 functional roles and/or titles / job classifications necessary to perform any work for the anticipated project; (e.g., Graphic Designer, Editor, Technical Support, Content Migration, Testing, etc.) and indicate the maximum hourly rates for each.

3. Key Personnel Listing

· Provide a listing of key personnel that will initially perform the work associated with this contract; please include names, titles and a brief bio.

· Changes in key personnel from the original consultant’s proposal must be pre-approved by the contract manager.

· Brief personnel bios not listed must be submitted to the contract manager for approval prior to billing for said personnel.

NOTES:

Hourly rates should not exceed the ceiling rates approved in ITT72.

CHIA understands that the amounts for the deliverables in Appendix A are estimates and that the maximum obligation amounts may change for each deliverable. Any additional scope(s) of work that align with the goals of this project will remain flexible and will not exceed any internal maximum obligation cap decided upon by CHIA.

Changes in key personnel from the original contractors’ proposal must be pre-approved by the contract managers and should fit under a role that was initially approved.

Appendix B (For Review Only, Vendors may need to sign a Confidentiality Agreement, a Data Use Agreement or a Data Management Plan at Contract Award depending on the type of services provided.)

AGREEMENT FOR USE OF CENTER FOR HEALTH INFORMATION AND ANALYSIS (CHIA) DATA CONTAINING IDENTIFIABLE CONFIDENTIAL INFORMATION ALLOWED UNDER A TASK ORDER The Contractor and the Center for Health Information and Analysis [“CHIA”] are parties to that certain task order dated as of ________________ [“Task Order/Agreement”].

This Data Use Agreement [“DUA”] addresses the conditions under which CHIA will release and the Contractor will obtain, use, reuse and disclose data released by CHIA to Contractor, including but not limited to, any derivative file(s) created by the Contractor, copies of CHIA data, subsets of CHIA data, and additional years or release versions of CHIA data (“Data”).

The Contractor shall grant reasonable access to its facilities, personnel and the Data, and to any non-Contractor site where the Data is held, to authorized representatives of CHIA for the purpose of confirming compliance with the terms of this DUA. Contractor shall promptly respond to any request by CHIA to verify Contractor’s compliance with the terms of this DUA, as well as compliance of any agent, contractor or third party to whom the Contractor disclosed CHIA Data.

CHIA retains all ownership rights in and to the Data; the Contractor does not obtain any right, title, or interest in or to the Data.

VI. Data Retention and Destruction Except set forth herein, the Data released under the Task Order/Agreement may be retained by the Contractor until performance of work under the Task Order/Agreement is completed. The Contractor shall notify CHIA of completion of performance of work under the Task Order/Agreement, whereupon the Contractor shall promptly destroy the Data received under the Task Order/Agreement, including all copies thereof. The Contractor shall promptly, but no later than 30 days after completion of performance of work under the Task Order/Agreement, or upon other termination of the Task Order/Agreement, send written certification of the destruction of the Data to CHIA, using the form attached hereto. The Contractor shall not retain Data received under the Task Order/Agreement after the work is completed unless authorized in writing by CHIA. The Contractor acknowledges its affirmative obligation to destroy the Data upon completion of performance of work under the Task Order/Agreement, and that such obligation is not contingent upon action by CHIA.

The terms of this DUA can be changed only by written amendment to this DUA or by the parties adopting a new agreement.

IX. Violations and Penalties A violation of this DUA or the Task Order may result in penalties and remedies allowed by law, including but not limited to M.G.L. c. 214 § 1B and M.G.L. c. 93A. CHIA may notify state and federal law enforcement officials, as applicable, of any data breaches in connection with any violation of this DUA. It is the sole responsibility of the Contractor to ensure compliance with all other local, state, and federal laws and regulations. Nothing in this section shall limit CHIA’s remedies at law or in equity.

CHIA USES AVAILABLE TECHNOLOGY TO MATCH PATIENT IDENTITIES WITH THEIR HEALTH INFORMATION. BECAUSE PATIENT INFORMATION IS MAINTAINED IN MULTIPLE PLACES, NOT ALL OF WHICH ARE ACCESSIBLE TO CHIA, AND BECAUSE NOT ALL PATIENT INFORMATION IS KEPT IN A STANDARD FASHION OR IS REGULARLY UPDATED, IT IS POSSIBLE THAT FALSE MATCHES MAY OCCUR OR THAT THERE MAY BE ERRORS OR OMISSIONS IN THE INFORMATION. CHIA DOES NOT AND CANNOT INDEPENDENTLY VERIFY OR REVIEW THE INFORMATION TRANSMITTED FOR ACCURACY OR COMPLETENESS.

The Custodian hereby acknowledges his/her appointment as Custodian of the aforesaid file(s) on behalf of the Contractor, and agrees to comply with all of the provisions of this DUA and the Task Order/Agreement on behalf of the Contractor.

Confidentiality Agreement I, ________________________, hereby acknowledge that in connection with my performance of services under a task order and/or other agreement for services (the “Agreement”) between the Center for Health Information and Analysis (“CHIA”) and ________________ (the “Contractor”), I may come into contact with, or CHIA or the Contractor may provide me with CHIA Confidential Information (“CI”), which may include, but is not limited to, patient level protected health information, payer information and/or information that CHIA considers to be confidential. I further acknowledge that the CI may constitute “personal data” or “personal information,” as defined in M.G.L. c. 66A and M.G.L. c. 93H, respectively, and that if the Contractor is provided with access to such information, the Contractor will become a “holder” of personal data as that term is defined in M.G.L. c. 66A; will be subject to all of the requirements of M.G.L. c. 66A, M.G.L. c. 93H, and M.G.L. c. 93I regarding such data; and will be subject to penalties for violations of M.G.L. c. 66A in accordance with the provisions of M.G.L. c. 214, § 3B.

I hereby agree to the following:

I will comply with all of the terms of the Agreement regarding the access to, use, and disclosure of any CI provided by CHIA or the Contractor, or created or received by or on behalf of CHIA. I will at all times maintain the confidentiality of the CI and will not, either directly or indirectly, disclose or otherwise make the CI available to any unauthorized person at any time. I will not inspect or “browse” the CI for any purpose not set forth in the Agreement.

If patient level protected information, I will comply with the terms of the Data Use Agreement. I will not access, or attempt to access, (i) my own CI for any purpose, or (ii) CI relating to any individual or entity, including family members, neighbors, relatives, friends, ex-spouses, their employers, or others, for any reason other than as required to perform my responsibilities under the Agreement. I will comply with all laws and regulations relating to confidentiality, privacy, security and disposal of the CI, including but not limited to M.G.L. c. 66A, M.G.L. c. 93H and M.G.L. c. 93I, together with any applicable federal laws and regulations. M.G.L. c. 66A prohibits the unauthorized disclosure of “personal data,” as defined therein.

I understand that any violations of this Agreement, M.G.L. c. 93H (regarding data breaches), M.G.L. c. 93I (regarding data destruction), and other laws protecting privacy and data security may subject me to criminal or civil liability. I further understand that CHIA will notify state and federal law enforcement officials, as applicable, of any data breaches in connection with any violation of the Agreement.

Name

CERTIFICATION OF COMPLETION & DATA DESTRUCTION

CHIA Data must be destroyed so that it cannot be recovered from the electronic storage media. Acceptable methods include the use of file wiping software implementing at a minimum DoD.5200.28-STD (7) disk wiping, and the degaussing of backup tapes. Electronic storage media such as floppy disks, CDs, and DVDs used to store data must be made unusable by physical destruction. All data destruction must comply with the requirements of M.G.L. c. 93I.

The undersigned hereby certifies that the work under the Task Order between ____________ and CHIA dated as of ________________ and subject to the Data Use Agreement dated as of _______________________ is complete as of this date: _________________________.

The undersigned further certifies as follows (check the appropriate section):

☐ I/we certify that I/we have destroyed all Data received from CHIA in connection with this Task Order, in all media that was used during the scope of work. This includes, but is not limited to, Data maintained on hard drives and other storage media.

☐ I/we certify that I/we will continue to hold Data pending any request for an extended retention date (which request may or may not be granted by CHIA in its discretion.)

Data Management Plan for Use of CHIA Data

I. INSTRUCTiONS

Any Recipients, contractors, or agents receiving CHIA Data (“Data”) must complete and execute this Data Management Plan. Certain CHIA Data includes Protected Health Information (“PHI” as defined under the Health Insurance Portability and Accountability Act [HIPAA] and its implementing regulations) and all CHIA Data contains elements that may be used to identify an individual. The Data Management Plan(s) will be incorporated within the Data Use Agreement that must be executed prior to receipt of the Data. You may wish to refer to the Data Use Agreement as you complete this Data Management Plan. This Data Management Plan should be completed by the Chief Information Security Officer, Chief Privacy Officer, legal counsel or another officer with sufficient knowledge of the Agency or Organization’s data privacy and security practices and who has authority to bind the Agency or Organization.

II. GENERAL INFORMATION

Title of ISA or Task Order

Organization Holding CHIA Data under this Data Management Plan:

III. CERTIFICATIONS

The undersigned certifies and agrees as follows:

· The Data will be encrypted at rest on storage media (backup tapes, local hard drives, network storage, et al) with at least AES-256 standard or stronger.

· The Data will be encrypted in transit consistent with the approved method(s) described in this Data Management plan at section V.3-b.

· Anti-virus software or service is active on any server or endpoint containing the Data.

· If a Covered Entity or Business Associate under HIPAA, the Agency or Organization is in full compliance with the privacy and security requirements of HIPAA; trains all staff who access PHI on the requirements of HIPAA; and has Business Associate Agreements with all non-employees who access PHI.

· The Agency or Organization has policies and procedures in place to address:

· The sharing, transmission and distribution of PHI

· The physical removal, transport and transmission of PHI

· The physical possession and storage of PHI

· The destruction of PHI upon the completion of its use

· Confidentiality agreements with all individuals, including contractors, who will access PHI

· Agreements governing the use and disclosure of PHI with all non-employees who will access PHI

IV. RESPONSIBLE PARTIES

Please identify the following individuals within your Agency or Organization:

1. The individual responsible for organizing, storing and archiving the Data. This individual is the Custodian of the CHIA Data required under Article XI of the Data Use Agreement.

Name:

Agency/Organization:

Title:

Phone:

Address, City/Town, State, Zip Code:

Email:

Reports to (name and title):

2. The individual(s) responsible for the research team using the Data, including ensuring each individual (i) has a signed confidentiality agreement, (ii) accesses and uses only the minimal Data necessary to achieve the research purpose, (iii) accesses the Data only on a secured server according to Applicant’s policies. This individual is also responsible for maintaining the access log required under Article II, Section 5 of the Data Use Agreement.

Name:

Agency/Organization:

Title:

Phone:

Address, City/Town, State, Zip Code:

Email:

Reports to (name and title):

3. The individual responsible for notifying CHIA of any breach of the Data Use Agreement or this Data Management Plan.

Name:

Organization:

Title:

Phone:

Address, City/Town, State, Zip Code:

Email:

Reports to (name and title):

4. The individual responsible for ensuring the Data is destroyed upon termination of the Data Use Agreement, completing the Data Destruction Form and providing that Form to CHIA.

Name:

Organization:

Title:

Phone:

Address, City/Town, State, Zip Code:

Email:

Reports to (name and title):

V. DATA SECURITY AND INTEGRITY

Agents or contractors that will have access to or store the CHIA Data at a location other than the Recipient’s location, or in an off-site server and/or database, must complete a separate Data Management Plan.

1. Physical Location of the Data:

a. Please provide the delivery address for the Data, as well as the full address, including building and floor, of each location where Data will be delivered and stored.

Delivery: (if applicable) Organization:

Office Telephone (Include Area Code):

Storage:

Organization:

Office Telephone (Include Area Code):

b. Will the Data be stored by the third party on a system in the cloud (reachable via the Internet)?

☐ Yes ☐ No

i. If you answered yes to (b): Has this Cloud Service Provider passed a FedRAMP 3PAO assessment for the specific cloud system which will host the data?

☐ Yes ☐ No

ii. If you answered yes to (b): What is the name of the provider and the FedRAMP level the specific cloud system hosting the data is operating at?

2. Data Privacy Training and Awareness:

a. Has every individual who will access the Data received training on the proper handling of protected health information and/or personal data within the last year?

☐ Yes ☐ No

3. Encryption of Data:

a. Will all CHIA Data at rest be encrypted on storage media (backup tapes, local hard drives, network storage, et al) with encryption at least AES-256 or stronger. All Recipients of CHIA Data must encrypt data at res. A Data Management Plan indicating otherwise will not be approved and returned for revisions.

☐ Yes ☐ No

b. Will CHIA Data be transmitted by your Agency or Organization over the Internet?

☐ Yes ☐ No

If you answered yes to (b): which of the following if any are used when transmitting data over the internet? If selecting other please describe the method in space provided below.

☐ SSL (meets or exceeds TLS 1.1 or TLS 1.2) ☐ SFTP ☐ other

4. Information Security:

a. Does your Agency or Organization have published information security policies which are followed and accessible to all staff accessing or handling CHIA Data?

☐ Yes ☐ No

b. Has every individual who will access the CHIA Data received cyber security awareness training in the last year?

☐ Yes ☐ No

c. Has your Agency or Organization experienced a breach of PHI or Personally Identifiable Information in the last seven (7) years?

☐ Yes ☐ No

i. If you answered yes to (c): how was the breach resolved and what steps were taken to prevent a recurrence?

5. Technical and Physical Controls:

a. Are all the user accounts that log on to any machine (server or endpoint) that accesses the Data uniquely assigned to individual users (i.e., the user accounts are not shared)?

☐ Yes ☐ No

b. Is an audit log maintained of all user log-ons to the system hosting the CHIA Data?

☐ Yes ☐ No

c. What is the minimum password length and character complexity (uppercase, lowercase, numeric, and special characters) required for new passwords on the user accounts logging on to the system accessing the CHIA Data?

d. Describe any additional authentication technical security controls you employ to defend the system against unauthorized logon, e.g. maximum failed login attempts, lockout period, etc.:

e. Do you run a current version of a commercial off-the-shelf anti-virus or anti-malware product on the server that will host the CHIA Data?

☐ Yes ☐ No

f. If the CHIA Data will be on a server or network accessible storage drive, then check all the security features present in the room containing CHIA Data:

i. ☐ Recorded video

ii. ☐ Access log of all individuals entering the room

iii. ☐ Secure server rack

iv. ☐ Access control limiting access only to authorized individuals

g. What additional specific physical or technical safeguards (not mentioned in prior answers) will be used to mitigate the risk of unauthorized access to CHIA Data?

h. When was the last information security risk assessment performed in your Agency or Organization? Who conducted it?

i. When was the last IT audit performed in your Agency or Organization? Who conducted it?

VI. DATA DESTRUCTION

The Recipient attests that the CHIA Data and all copies of the CHIA Data used by the Applicant or its employees, contractors, or agents will be destroyed upon Project Completion or termination of the Data Use Agreement. All data destruction must conform to the requirements of M.G.L. c. 93I and to the Data Use Agreement. Please specify below the technical measures you will use to meet these requirements.

VI. ATTESTATION

By submitting this Data Management Plan, the Agency or Organization attests that it is aware of its data use, privacy and security obligations imposed by state and federal law and confirms that it is compliant with such use, privacy and security standards. The Agency or Organization further agrees and understands that it is solely responsible for any breaches or unauthorized access, disclosure or use of CHIA Data, including, but not limited to, any breach or unauthorized access, disclosure or use by its agents.

By signature below, I attest: (1) to the accuracy of the information provided herein; (2) that the Agency or Organization agrees to hold and/or access CHIA Data at all times in compliance with all provisions of this Data Management Plan and the Data Use Agreement; and (3) to my authority to bind the Agency or Organization undersigned as an authorized signatory of the Organization.

Signature:

(Authorized Signatory for Organization holding CHIA Data)

Printed Name:

Title:

Organization Holding CHIA Data:

Date:

Appendix C: Instructions for Vendors Responding to Bids Introduction COMMBUYS refers to all solicitations, including but not limited to Requests for Proposals (RFP), Invitations for Bid (IFB), Requests for Response (RFR), Requests for Quote (RFQ), as “Bids.” All responses to Bids are referred to as “Quotes.”

Steps for Bidders to Submit a Quote

1. Launch the COMMBUYS website by entering the URL (www.COMMBUYS.com) into the browser.

2. Enter Bidder login credentials and click the Login button on the COMMBUYS homepage. Bidders must be registered in COMMBUYS in order to submit a Quote. Each Vendor has a COMMBUYs Seller Administrator, who is responsible for maintaining authorized user access to COMMBUYS.

3. Upon successful login, the Vendor home page displays with the Navigation and Header Bar as well as the Control Center. The Control Center is where documents assigned to your role are easily accessed and viewed.

4. Click on the Bids tab

5. Clicking on the Bid tab opens four sections:

a. Request for Revision

b. Bids/Bid Amendments

c. Open Bids

d. Closed Bids

6. Click on the blue Open Bid hyperlinks to open and review an open bid

7. A new page opens with a message requesting you acknowledge receipt of the bid. Click Yes to acknowledge receipt of the bid.