RFR Attachment 2 - Technical Standards~2.docx

RFR ATTACHMENT 2 – TECHNICAL STANDARDS

Technical Standards

The following requirements are current versions as of the publication date of the RFR. The Contractor shall comply with these throughout the term of the Agreement resulting from this RFR. These requirements may be updated by the Health Connector from time to time through an amendment to the Contract.

In providing the Services, Contractor shall rely on and provide Contractor Technology that meets or exceeds the following Health Connector, Federal state, and EOHHS Standards:

I General Security (only applicable if the Health Connector exercises the Contingent Interpretation Scope)

All IT systems serving the Health Connector receive, process, transmit, create, and store personally identifiable information (PII) as defined in Exhibit 9 to the RFR, “Defined Terms”. Systems and infrastructure environments must remain in compliance with:

A. Applicable Federal CMS security standards such as 45 CFR 155.260, HIPAA (including without limitation the Security and Privacy Rules), , and the other standards set forth in section B below, and

B. Commonwealth laws, regulations, policies, and standards such as:

· the Commonwealth’s Fair Information Practices Act, MGL ch. 66A and the regulations promulgated thereunder (801 CMR 3.0 Privacy and Confidentiality (2017));

· its identity theft laws, MGL ch. 93H and 93I and the regulations promulgated thereunder;

· the Commonwealth of Massachusetts Executive Office for Technology Services and Security (EOTSS) Enterprise Information Security Policies and Standards: https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards;

· the EOHHS Acceptable Use Policy: https://www.mass.gov/doc/eohhs-acceptable-use-policy/download.

IT systems must not only comply with current certifications at the time of contracting, but must stay up to date with changing laws, regulations, standards, and policies.

Data must remain fully secured, both at rest and while in transit, according to the applicable and appropriate standards.

II Specific Federal Security and Other Requirements (Only applicable if Health Connector exercises the Contingent Interpretive Scope)

All IT and other services used by the Health Connector through which the Contractor shall receive, process or store PII must meet the requirements set forth below.

Federal Information Technology Policy and Guidelines

1) US Department of Health and Human Services – Office of the Chief Information Officer – Policy for Information Technology (IT) Security and Privacy Incident Reporting and Response:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-reference/index.html

2) Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance V. 2 https://heisecurity.com/wp-content/uploads/2020/11/FICAM_Roadmap_and_Implem_Guide.pdf

3) Federal Information Security Management Act of 2002 (FISMA) https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf, as amended by the Federal Information Security Modernization Act, https://www.congress.gov/bill/113th-congress/senate-bill/2521

4) Guidance for Exchange and Medicaid Information Technology (IT) Systems (Version 2.0) https://www.cms.gov/CCIIO/Resources/Files/Downloads/exchange_medicaid_it_guidance_05312011.pdf

5) Acceptable Risk Controls for Affordable Care Act (ACA), Medicaid and Partner Entities, Volume I, https://www.cms.gov/files/document/arc-ampe-vol-1-v102-508-5cr-04112025.pdf

6) ARC-AMPE Volume II, available at https://www.cms.gov/search/cms?keys=arc-ampe+volume+II (click on “Instructional Guidance”)10) National Institute of Standards and Technology (NIST), including but not limited to:

· Special Publication 800-18, Revision 1 https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final

· NIST 800.53 (rev. 4) https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

· NIST 800-66 (rev. 2) https://csrc.nist.gov/pubs/sp/800/66/r2/final

III Accessibility

IT systems must meet and remain compliant with Section 508 of the Federal GSA’s accessibility standards, available online at www.section508.gov and the Commonwealth’s Enterprise Information Technology Accessibility Standards, available at https://www.mass.gov/policy-advisory/enterprise-information-technology-accessibility-policy.

The contract awarded under this RFR will require that the winning Bidder also comply with the EOTSS Accessibility Contract Language for IT Solutions set forth at https://www.mass.gov/info-details/accessibility-contract-language-for-it-solutions.

The Contractor confirms that it will hire its own accessibility vendor.

IV Data Ownership

All data received, processed, stored, transmitted, or created by systems used by the Health Connector will remain the property of the Health Connector. Such systems must also ensure data integrity. Data, extracts, reports, and documentation should be self-identifiable, to avoid inappropriate consumption or reporting of both line of business and data warehouse data stores.

V Use of Generative Artificial Intelligence

The Contractor shall not use generative artificial intelligence to provide Services under this RFR unless such services are approved in writing by the Health Connector.