RFR Attachment 3 - Data Management and Confidentiality Agreement 1.docx

RFR ATTACHMENT 3 – DATA MANAGEMENT AND CONFIDENTIALITY AGREEMENT

Data Management and Confidentiality Agreement

1.1 Definitions

For purposes of this Data Management and Confidentiality Agreement (“DMCA”), the following terms shall have the assigned meanings. All other terms used but not otherwise defined in the Master Services Agreement (the “MSA”) shall be construed in a manner consistent with applicable state or federal confidentiality or data security laws, as defined below, and with the defined terms set forth in the Agreement. When used in this Agreement, the following terms shall have the same meaning as those terms have in the HIPAA Rules: Business Associate, Limited Data Set, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident and Workforce. All other capitalized terms used in the Agreement and this DMCA, but not otherwise defined herein or elsewhere in the Agreement, shall be construed in a manner consistent with the HIPAA Rules, M.G.L. c. 66A and all other Applicable Laws.

“Activities” shall mean the activities, functions, and/or services to be performed by the Contractor on behalf of the Health Connector pursuant to this Agreement in which Contractor will have access to PI or Health Connector Security Information.

“Agreement” is the entire agreement between the parties regarding the Services. The Agreement is comprised of multiple documents, of which the MSA and this DMCA are but two. The DMCA’s place in the order of precedence of the Agreement is set forth in the MSA.

“Agreement Services” shall mean the activities, services and goods to be performed or provided by Contractor pursuant to the Agreement.

“Applicable Law” shall mean the Health Insurance Portability and Accountability Act (HIPAA) Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, Subpart F, 42 CFR Part 2, 45 CFR 155.260, the ARC-AMPE standard, the Fair Information Practices Act and the regulations promulgated thereunder (MGL ch. 66A, 950 CMR 33.00 and 801 CMR 3.00, Privacy and Confidentiality), MGL ch. 93H and the regulations promulgated thereunder (201 CMR 16.00, Placing, Lifting and Removal of Security Freezes; 201 CMR 17.00, Standards for the Protection of Personal Information of Residents of the Commonwealth, and SPR Bulletin 01-08, Security Breach Protections), MGL ch. 93I, and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality or security of PII or Health Connector Security Information.

0. “Breach” for portions of this DMCA pertaining to MGL ch. 93H, shall mean “Breach of Security” as defined in MGL ch. 93H; in all other cases it shall mean any incident that results in unauthorized access to applications, systems, networks or devices, potentially including data, by bypassing security mechanisms, that occurs when someone illegitimately enters a private, confidential or unauthorized IT perimeter.

“Breach Notification Rule” shall mean the Breach Notification Rule at 45 CFR Part 164, Subpart D

0. “Confidential Information” shall mean any nonpublic EOHHS or Health Connector information that, if inappropriately accessed or disclosed, could cause adverse financial, regulatory, or reputational damage to the Health Connector and its constituents.

0. “Enforcement Rule” shall mean the HIPAA Enforcement Rule at 45 CFR Part 160, Subparts C, D and E.

0. “EOTSS” shall mean the Massachusetts Executive Office of Technology Services and Security.

“Health Connector Security Information” shall mean all data that pertains to the security of the Health Connector’s and its vendors’ IT, specifically, information pertaining to the manner in which the Health Connector and its vendors protect their IT systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users, or the provision of service to unauthorized users, including those measures necessary to detect, document and counter such threats.

“Health Connector” shall mean the Commonwealth Health Insurance Connector Authority.

“Electronic PII” shall mean PII that is transmitted or maintained by electronic media. PII shall be limited to Electronic PII received or created by Contractor from or on behalf of the Health Connector.

“Event” shall mean the following, either individually or collectively in connection with the Activities: 1) any use or disclosure of PI by the Contractor or its subcontractors not permitted under this DMCA; 2) any Security Incident; or 3) any event by the same that would trigger notification obligations under the Breach Notification Rule, MGL 93H or other similar Applicable Law or other similar Applicable Law, or Third Party Agreement (defined below) requiring notice to consumers and/or oversight agencies.

Health Connector” shall mean the Commonwealth Health Insurance Connector Authority, a body politic and corporate and a public instrumentality of the Commonwealth of Massachusetts. It was established pursuant to Massachusetts’ landmark health reform law, Chapter 58 of the Acts of 2006. The Health Connector’s primary objective is facilitating access to affordable health insurance coverage for eligible individuals and small businesses. The Health Connector was designated, in accordance with Chapter 96, §7 of the Acts of 2012, to serve as the ACA-Compliant Exchange (“Exchange”) for the Commonwealth of Massachusetts.

“HIPAA Rules” shall mean 45 CFR Parts 160, 162, and 164, inclusive of the Privacy Rule, the Security Rule, the Breach Notification Rule and the Enforcement Rule at 45 CFR Part 160 and Part 164, Subparts A, C, D and E.

“Individual” shall mean the person to whom the PI refers and shall include a data subject as defined by MGL ch. 66A; a person as defined by MGL ch. 93H, s. 1; a data subject as defined by MGL ch. 93I; and any cognate terms under other Applicable Law.

“IT” shall mean information technology.

“Personally Identifiable Information” or “Personal Information” or “PII” shall mean any information obtained in the course of performance of Agreement Services concerning an Individual, including, without limitation, demographic information, collected from an Individual and which identifies the Individual or with respect to which there is a reasonable basis to believe it can be used to identify the Individual. This term shall include without limitation any Protected Health Information as defined in 45 CFR § 160.103, “personal data” as that term is defined in MGL ch. 66A, §1; any “personal information” as defined in MGL ch. 93H and 93I; any “patient identifying information” as used in 42 CFR Part 2, any “personally identifiable information” as used in 45 CFR §155.260, Third Party Data (defined below in Section 1.1.17) and any other individually identifiable information that is treated as confidential under Applicable Law or the Agreement (including, for example, any state and federal tax return information) that the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains, in each case from or on behalf of EOHHS, in connection with its performance of the Activities). Such information, including aggregate information, is considered PI if it is not fully de-identified in accord with 45 CFR §§164.514(a)-(c). and any other confidential individually identifiable information under any federal and state law (including for example any state and federal tax return information)

“Privacy Rule” shall mean the Standards of Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

“Required By Law” shall mean required by any Applicable Law.

“Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.

“Third Party Data” shall mean any PII the Health Connector receives from a third party under an agreement.

“Third Party System” shall mean any IT system not owned or controlled by the Health Connector that contains Third Party Data.

“Security Breach” shall mean the unauthorized acquisition or unauthorized use of unencrypted data, or encrypted electronic data and the confidential process or key, that is capable of compromising the security, confidentiality or integrity of PII maintained by the Health Connector.

“Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with systems operations in an information system.

“System” shall mean any Health Connector system, database, application or other information technology resource.

Contractor Obligations

Acknowledgments.

The Contractor acknowledges that in performing the Agreement, it or its subcontractor will create, receive, use, disclose, maintain, transmit or otherwise obtain: (a) “personal data,” as that term is used within MGL ch. 66A and that in so doing, it will become a “holder” of personal data, as that terms is used therein, and that to the extent that it receives such data, in a manner consistent with the Privacy and Security Rules and other Applicable Laws, it will comply with the terms of MGL ch. 66A and the regulations promulgated thereunder; and (b) “personal information” as that term is used in MGL ch. 93H and 93I, and that to the extent that it receives such data it will comply with the terms of those laws and the regulations promulgated thereunder, and agrees to implement privacy and security standards that are consistent with the principles listed in MGL ch. 66A, 93H and 93I and other Applicable Law.

The Contractor shall protect the physical security of and restrict any access to PII or other Health Connector data in the Contractor's possession, or used by the Contractor in the performance of the Agreement, which shall include, but is not limited to the Health Connector’s records, documents, files, software, equipment or systems.

The Contractor certifies that all steps will be taken to ensure the security and confidentiality of all PII for which the Contractor becomes a holder, either as part of performance or inadvertently during performance, with special attention to restricting access, use and disbursement of PII under Applicable Law. With respect to the proper disposal of all paper and electronic media, backups, or systems containing personal data and information, Contractor shall comply with MGL ch. 66A and MGL ch. 93I. Contractor shall ensure that any PII or information transmitted electronically or through a portable device be properly encrypted.

In providing Agreement Services, Contractor shall comply with the Health Connector’s Privacy Policy and Procedures, Security Management Policy, and Incident Response Policy & Procedures, copies of which are attached hereto as Exhibits D-1 and D-3 through D-4 hereto.

The Contractor shall implement reasonable safeguards to protect PII under this DMCA.

In performing the Activities, the Contractor acknowledges and agrees that it is acting as the Health Connector’s Business Associate and agrees to comply with all requirements of the HIPAA Rules applicable to a Business Associate with respect to Protected Health Information. To the extent that the Contractor carries out an obligation of the Health Connector under the Privacy Rule pursuant to this DMCA or the Agreement, the Contractor agrees that it shall comply with the requirements of such Rule that apply to the Contractor as the Health Connector’s Business Associate in the performance of such obligations.

1.2.2 Telephonic Laws. To the extent the Activities involve outreach to or other contact with consumers (including individuals), the Parties agree that such contact shall be compliant with all applicable federal and state laws and regulations, including the Telephonic Consumer Protection Act of 1991 (47 U.S.C. section 227) and its attendant regulations. To the extent the Activities involve call recording activities, the Parties shall comply with all federal and state wiretapping and recording laws and regulations, including M.G.L. c. 272 §99.

1.2.3 Compliance with Third Party Agreements. The Contractor agrees that it shall comply (and shall cause its employees and other workforce members used to perform the Activities to comply) with any other privacy and security obligation applicable to Contractor in its performance of the Activities that required as the result of the Health Connector having entered into an agreement (any such agreement, a “Third Party Agreement”) with a third party (such as the Centers for Medicaid and Medicare Services) to obtain or to access PI necessary to perform the Activities from such third party (any such PI, “Third Party Data”) or to access any System containing Third Party Data or through which Third Party Data is or is expected to be accessed. The Parties acknowledge and agree that Third Party Data includes, without limitation, all data that the Health Connector EOHHS receives or obtains from CMS and the Federal Data Services Hub and, notwithstanding anything herein to the contrary, the Contractor may not access any such Third Party Data unless disclosure of such data to the Contractor is permitted under the applicable Third Party Agreement(s), all conditions for disclosure under such Agreement (s) have been satisfied and the Contractor’s access to such data is otherwise permitted under the terms of this Agreement. Notwithstanding the foregoing, the Contractor shall not be required to comply (or ensure compliance with) a Third Party Agreement under this paragraph unless it has been provided with a copy of the applicable Third Party Agreement and mutually agreed upon. Further, if the Health Connector inadvertently discloses to the Contractor any Third Party Data that the Contractor is not permitted to access, the Contractor shall not be deemed to be in breach of this Agreement, provided that Contractor does not disclose such Third Party Data to any unauthorized parties, notifies the Health Connector promptly upon becoming aware of such disclosure, and returns all such Third Party Data to the Health Connector promptly. EOHHS shall identify to the Contractor Third Party Data at the payload data level. For the purpose of this DMCA, the Third Party Agreements in place as of the date hereof include the agreements attached hereto as Exhibits A through C.

Recognition of the Health Connector’s Rights.

At all times, the Contractor shall recognize the Health Connector’s right to control access, use, disclosure and disposition of all PII created, obtained, received, used, maintained or disclosed during the performance of services under the Agreement. The Health Connector is the lawful owner, lawful holder or license holder of all PI and Health Connector Security Information (each as defined herein) provided to the Contractor in connection with the Contractor’s performance of the Services contemplated under the Contract and has the right to permit the Contractor access to or use of the PI and Health Connector Security Information in connection with its performance of the Services, subject to the Contractor’s obligations under the Contract (including this DMCA). The Contractor acknowledges that its access to, receipt, creation, use, disclosure, transmission and maintenance of any PI, and any data derived or extracted from such PI, arises from and is defined by the Contractor’s obligations under the Contract, and that the Contractor does not possess any independent rights of ownership to such data. The Health Connector hereby disclaims all warranties, whether express, implied, statutory, or otherwise. The Health Connector specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage or practice. The Health Connector makes no warranty of any kind that the PI and Health Connector Security Information will be secure, accurate, complete, free of harmful code, or error free. In no event will the Health Connector be liable under or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

The Contractor shall create, use or disclose PII only to the extent such creation, use or disclosure is necessary to carry out the Agreement Services. The Contractor may not create, use or disclose PII in the performance of the Agreement Services unless such creation, use or disclosure is consistent with the requirements of this DMCA, as Required by Law or as required by law.

Sanctions for Improper Access, Use or Disclosure of PI. The Contractor acknowledges that PI subject to this Agreement is highly regulated and the Contractor and its subcontractors, agents, employees and other workforce members may be subject to civil and criminal penalties under state and federal law for accessing, using or disclosing PII in violation of this Agreement or Applicable Law.

Agents or Subcontractors

The Contractor shall ensure that any agents or subcontractors that use, maintain, disclose, receive, create or otherwise obtain PII on behalf of the Health Connector in connection with the Agreement agree in writing to the same restrictions and conditions that apply to the Contractor under this DMCA with respect to such information, including, but not limited to, implementing reasonable safeguards to protect such information. The Contractor shall ensure that all subcontractors enter into a data management and confidentiality agreement with the Contractor containing the terms of this DMCA; provided that the Health Connector may authorize the Contractor to enter into a modified version of the DMCA as appropriate to reflect the particular activities or circumstances of the subcontractor with the written consent of the Health Connector. The Contractor must ensure that any required written agreement for permitted subcontractors meets all relevant requirements of this DMCA.

All Subcontractors who need access to Third Party Data or a Third-Party System shall comply (and cause their employees and other representatives to comply) with any privacy and security obligation that may be required under a Third-Party Agreement, as defined in Section 1.2.3. Such subcontractors shall verify in writing that they have satisfied all such requirements prior to being granted access to any Third-Party Data or Third-Party System.

Administrative, Physical, and Technical Safeguards

In addition to any other requirement in the Agreement or this DMCA, the Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PII and that prevent use or disclosure of such data other than as provided for by the Agreement or this DMCA. All such safeguards must meet, at a minimum, all standards set forth in the Security Rule, MGL ch. 66A; MGL ch. 93H, and MGL ch. 93I; and must comply with all Health Connector security and IT resource policies, processes, and mechanisms established for access to PII.

For Electronic PII, the Contractor’s safeguards must include a prohibition restricting all employees and agents from transmitting PII in non-secure transmissions over the Internet or any wireless communication device, including electronic PII transmitted between the Parties, which must be encrypted by a process that renders the Electronic PII unusable, unreadable, or indecipherable to unauthorized individuals. The Contractor shall protect from inappropriate use or disclosure any password, user ID, or other mechanism or code permitting access to any database containing PII.

In the event the Contractor (or a representative of the Contractor) is granted direct access into any systems, databases, or other IT resources owned or operated by the Health Connector, the Contractor shall comply with all security mechanisms and processes established for such access established by the Health Connector. In the event the Contractor (or a representative of the Contractor) is granted direct access into any systems, databases, or other IT resources owned or operated by the Health Connector and the Commonwealth or by the Commonwealth, the Contractor shall comply with all security mechanisms and processes established for such access established by the Health Connector or the Commonwealth or both, as applicable, and any Commonwealth requirements established by applicable Commonwealth policies and procedures, and EOTSS. The Contractor shall protect from inappropriate use or disclosure any password, user ID, or other mechanism or code permitting access to any such systems, databases, or IT resources, and shall give the Health Connector prior notice of any change in personnel or other representatives whenever the change requires a termination or modification of any such password, user ID, or other security mechanism or code, to maintain the integrity of the system, database, or IT resource. Except as agreed to by the Health Connector (and subject to any conditions to such agreement), the Contractor may not permit any of its representatives to access such systems, databases, or IT resources with any personal mobile devices.

Upon reasonable request by the Health Connector, the Contractor agrees that it shall make available qualified individuals and/or a member of senior management responsible for security and data protection, for the purposes of discussing relevant IT controls, including those policies, procedures, and controls relevant to the provision of services and security obligations under this DMCA and applicable laws. The Contractor will make every reasonable effort to be responsive to such inquiries, but reserves the right to limit disclosure of details, if it determines, in its sole judgment, that such disclosure would put at risk the confidentiality, availability, or integrity of its own or its other clients’ data.

The Contractor shall comply with all security mechanisms and processes established for access to any of the Health Connector’s databases. The Contractor shall comply with the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth found at 201 C.M.R. 17.00, including securing user authentication protocols by controlling user IDs and other identifies, utilizing a reasonably secure method of assigning and selecting passwords or use of other technologies such as biometrics or token devices, controlling data security passwords to ensure passwords are kept in locations and formats that do not compromise the security of the data they protect, restricting access to active users and active user accounts only and blocking access to user identification after multiple unsuccessful attempts to gain access or the limitation placed on access for the particular system. Additionally, the Contractor shall restrict access to records and files containing PII to those who need such information to perform or support Agreement Services, assign unique identifications and non-default passwords designed to maintain the integrity of the security of the access controls, encrypt transmitted records and files containing PII, reasonably monitor systems for unauthorized use or access of PII, encrypt all PII stored on laptops or other portable devices in the US (and refrain from storing PII on laptops or other portable devices to the extent that the Agreement permits the Contractor to perform all or part of the services outside the US), maintain a reasonably up to date firewall protection and operating system security patches of all files containing PII on a system connected to the Internet, maintain reasonably up to date versions of system security agent software including malware protection and reasonably up to date patches and virus definitions or a version of such software than can be supported with up to date patches and virus definitions which is set to receive the most current security updates on a regular basis and education and train employees on the proper use of the computer security system and the importance of PII security. When accessing any of the Health Connector’s systems, the Contractor shall at all times comply with all Health Connector security policies, procedures and guidelines, and IT resource policies, processes and mechanisms established for access to such PII. Upon the Health Connector’s request, the Contractor shall permit representatives of the Connector access to premises where PII is maintained, created, used, or disclosed for the purpose of inspecting privacy and security arrangements; provided, however, that (i) Contractor and the Health Connector mutually agree in advance upon the scope, location and timing of such an inspection; and (ii) the Health Connector shall protect the confidentiality of all confidential and proprietary information of Contractor to which the Connector as authorized by Contractor has access during the course of such inspection.

Mitigation and Reporting

Promptly upon becoming aware of, but in any event, no more than one (1) hour after, any use or disclosure of PII not permitted under the Agreement or this DMCA or of any Security Incident or Security Breach, the Contractor shall take all appropriate action necessary to: 1) retrieve, to the extent practicable, any PII used or disclosed in the non-permitted manner or involved in the Security Incident or Security Breach, 2) mitigate, to the extent reasonably practicable, any harmful effect of the non-permitted use or disclosure of the PII or of the Security Incident or Security Breach known to the Contractor and 3) take such further action as may be required by any Applicable Law including any applicable state or federal law concerning the privacy and security of such PII. Including the above requirement and consistent with 17 C.M.R. 201, the Contractor shall complete a written information security program and will provide a copy of that program to the Health Connector upon request. The Contractor shall report to the Health Connector, orally and/or in writing, the nature of the non-permitted use or disclosure or Security Incident or Security Breach, the harmful effects known to the Contractor, all actions it has taken or plans to take in accord with this paragraph and the results of all mitigation actions already taken by it under this paragraph.

In the case of an Event, as soon as possible (and no more than two (2) business days after the Contractor becomes aware of the Event), the Contractor shall provide the Health Connector with a written report outlining the Event with the following details (or, if unavailable at such time, as many of the following details as possible along with an explanation of the cause of the delay and the actions the Contractor will take to further gather and confirm facts surrounding the Event):

(i) the date of the Event or, if unknown, the estimated date;

(ii) the date of the discovery of the Event;

(iii) the nature of the Event (e.g., cause, contributing factors, chronology of events) and the nature of the PII involved (e.g., types of identifiers such as name, address, age, social security numbers or account numbers; or medical or financial or other types of information);

(iv) the number of Individuals involved or, if unknown, a reasonable estimate (categorized by the type of PII involved, if applicable) with a description of how the exact or estimated number of Individuals was determined;

(v) the nature and scope of the Contractor’s investigation;

(vi) the harmful effects of the Event known to the Contractor, and all of Contractor’s taken or planned mitigation actions and their results; and.

(vii) Any additional information and/or documentation that the Contractor is required to provide to EOHHS under 45 CFR §164.410, M.G.L. c. 93H, §3(a) or other similar Applicable Law.

In the case of an Event, the Contractor shall also, at the Health Connector’s request: (a) take such other reasonable actions as identified by the Health Connector to provide further information or clarification regarding the Event; (b) provide the Health Connector with a written review of, and description of any plans to implement changes to, the Contractor’s policies and procedures, including staff training, to prevent a similar event in the future; (c) take such actions as may be required by any Applicable Law concerning the privacy and security of any PII involved in the Event; and (d) take such other reasonable actions as identified by the Health Connector to further mitigate, to the extent practicable, any harmful effect of the Event. Any actions to mitigate harmful effects of such privacy or security violations undertaken by the Contractor on its own initiative or pursuant to the Health Connector’s request under this paragraph shall not relieve the Contractor of its obligations to report such violations under this paragraph or any other provisions of the Agreement or this DMCA.

1.7 Reimbursement for Costs

The Contractor shall reimburse and indemnify, defend and hold harmless (subject to the limitation on liability set forth in the Health Connector Terms and Conditions) the Health Connector for all costs incurred or sustained by the Health Connector in responding to, and mitigating damages caused by, any Event or third party claims or causes of action brought or asserted against the Health Connector involving:

a. the Contractor’s failure to meet its responsibilities under, or in violation of, any provision of this DMCA or the Contract;

b. the Contractor’s violation of Applicable Law;

c. the Contractor’s negligence;

d. the Contractor’s failure to protect data under its control with encryption or other security measures that constitute an explicit safe-harbor or exception to any requirement to give notice under Applicable Law; or

e. any activity or omission of the Contractor resulting in or contributing to an Event.

Such costs may include, for example and without limitation, losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees and the costs associated with any required consumer notification, including staffing and materials costs. Alternatively, at the Health Connector’s direction, in lieu of reimbursing the Health Connector for any such costs the Contractor shall, at Contractor’s expense, conduct any such notification or other mitigation-related activity on the Health Connector’s behalf. This provision shall apply in addition to and separate from any generally applicable indemnity provision applicable to the Contractor.

0. Subpoenas or other Legal Process

The Contractor shall, as legally permissible, promptly report to the Health Connector, both orally and in writing, but in any event not more than three (3) Business Days after becoming aware of any instance where PII or any other data obtained under the Agreement is requested, subpoenaed, or becomes the subject of a court or administrative order or other legal process, including a public records request. If the Health Connector directs the Contractor to respond to such requests, the Contractor shall take all necessary steps as directed by the Health Connector to comply with any applicable federal and state law. To the extent the Health Connector determines that it shall respond or challenge such requests directly, the Contractor shall fully cooperate and assist the Health Connector in its response or challenge.

Access

Upon the Health Connector’s Request, the Contractor shall cooperate with the Health Connector to provide to an Individual the individual’s PII that Contractor maintains through simple and timely means that allow the Individual to access and obtain their PII in a readable form and format, and:

The Contractor, with respect to any PII in its possession: (a) shall take such action(s) in sufficient time and manner as may be requested by the Health Connector that are necessary to meet the Authority’s obligations under 45 CFR §§ 164.524, 164.526 or 164.528, MGL. Ch. 66A, MGL. Ch. 93H or 93I, 45 CFR 155.260 and other Applicable Law; and (b) if an Individual contacts the Contractor with respect to exercising any rights the Individual may have under the Privacy Rule, MGL. Ch. 66A.and MGL ch. 149 s. 52C or other Applicable Law with respect to such PII, shall notify the Health Connector within two (2) business days of the Individual’s request and cooperate with the Health Connector to meet any of its obligations with respect to such request.

With respect to an Individual’s right to an accounting under 45 CFR § 164.528, 45 CFR 155.260 or MGL ch. 66A, the Contractor shall document all disclosures of PII and other data access activities as would be necessary for the Health Connector to respond to a request by an Individual for an accounting in accord with such law.

Corrections

Upon the Health Connector’s request, the Contractor shall take reasonable steps to cooperate with the Health Connector to provide Individuals with a final means to dispute the accuracy or integrity of their PII maintained by the Contractor and to have erroneous information corrected or to have a dispute documented if their requests are denied. Such corrections shall be made promptly in a manner specified in, and in accord with any time requirement under, MGL ch. 66A s. 2 and MGL ch. 149 s. 52C. In the event the Contractor receives a request for amendment directly from the Individual, the Contractor shall, within two (2) Business Days of receipt of such request, notify the Health Connector, and shall only make any amendment in accord with the Health Connector’s instructions.

Documentation of Disclosures

The Contractor shall document all disclosures of PII, and required information related to such disclosures, as would be necessary for the Health Connector to respond to a request by an Individual for an accounting of disclosures of PII. In the event the Contractor receives a request for an accounting directly from an Individual, the Contractor shall, within three (3) Business Days of receipt of such request, notify the Health Connector and proceed in accord with this paragraph. Within ten (10) Business Days of the Health Connector’s request, the Contractor shall make a listing of such disclosures and related information available to the Health Connector or, upon the Health Connector’s direction, to the Individual.

Compliance with Notification of Restrictions

Upon Contractor’s receipt of a notification of a restriction on the use of disclosure of PII from the Health Connector under section 1.4.4 below, Contractor will promptly (a) cease the use and disclosure of any such Individual’s PII as specified in the notice; (b) comply with the limitations specified in the notice; and/or (c) comply with the restrictions specified in the notice, as applicable.

Individual’s Direct Authorization to Disclose PII to Third Party

In the event the Contractor receives a request from an Individual or from a third party to release PII to a third party pursuant to a consent, authorization, or other written document, the Contractor shall, within three (3) business days of receipt of such consent, authorization, or other written document, notify the Health Connector and shall cooperate with the Health Connector in confirming the validity and sufficiency of such document before releasing any PII to the third party. Contractor shall not make a disclosure pursuant to such a request without the express written consent of the Health Connector.

0.2 Consumer Reporting Obligations

In the event that the consumer notification provisions of MGL ch. 93H, or similar notification requirements in other state or federal laws are triggered by an Event, the Contractor shall promptly comply with its obligations under such laws. If the Health Connector determines, in its sole discretion, that it is required to give such notifications, the Contractor shall, at the Health Connector’s request, assist the Health Connector in undertaking all actions reasonably necessary to meet consumer notification requirements and in drafting the consumer notices and any related required notices to state or federal agencies for the Health Connector’s review and approval, but in no event shall the Contractor have the authority to give these notifications on the Health Connector’s behalf. In addition to the Contractor’s other indemnification rights under the Agreement, the Contractor shall indemnify the Health Connector for the costs associated with such notification.

0.3 Third Party Agreements

The Contractor shall comply with (and shall cause its employees, agents, and subcontractors to comply with) any privacy and security obligation that is required as the result of the Health Connector having entered into any other agreement with a third party to obtain or to access any Third-Party Data or to access any Third Party System. Any such agreement is referred to herein as a “Third Party Agreement.” Obligations that may be applicable to the Party under a Third-Party Agreement include, by way of illustration and not limitation, signing a written compliance acknowledgment or confidentiality agreement, undergoing a background check, or completing training.

Third Party Data

Third Party Data includes, without limitation, all data that the Health Connector receives or obtains from Third Party Contractors.

Notwithstanding anything herein to the contrary, Contractor may not access any Third Party Data unless disclosure of Third Party Data to the Contractor is permitted under the applicable agreement, all conditions for disclosure under such respective agreement(s) have been satisfied, and the access otherwise complies with the terms and conditions of the respective agreement(s). Without limiting the generality of the foregoing paragraphs, the Contractor acknowledges and agrees that it cannot use or disclose PII except as specifically permitted under Permitted Uses and Disclosures of PII by the Contractor, Section 1.19 of this DMCA.

1.16 Health Connector Security Information

If, in connection with the Agreement Services, the Contractor obtains access to any Health Connector Security Information, it may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Contractor shall limit access to the information only to its employees and other representatives as necessary to perform the permitted purposes. Other than in the foregoing circumstances, the Contractor shall not release or disclose such information except in accord with the Health Connector’s express written instructions, unless such disclosure is Required by Law and then only in accordance with this DMCA. While in possession of such information, the Contractor shall apply all applicable privacy and security requirements set forth in this DMCA to maintain the confidentiality, security, integrity and availability of such information. Notwithstanding any other provision in this DMCA, the Contractor shall report any non-permitted use or disclosure of Commonwealth or Health Connector Security Information to the Health Connector within twenty-four (24) hours following the date upon which the Contractor becomes aware of the use or disclosure (or such earlier time as may be required under a CMS Agreement or other Third-Party Agreement). The Contractor shall immediately take all reasonable and legal actions to retrieve such information if disclosed to any non-permitted individual or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further commercially reasonable retrieval action as the Health Connector may require (or as may be required under a Third Party Agreement).

0. Access to Systems, Databases and Resources

In connection with the Contractor’s performance of its obligations under the Agreement or this DMCA, it may be necessary for the Contractor and its representatives to access systems, databases, or other IT resources owned and/or operated by the Health Connector, the Commonwealth, owners of Third Party Data, or parties to Third Party Agreements.

The Contractor agrees that it shall restrict access to such systems, databases, or other IT resources to only those authorized representatives of the Contractor who need such data to perform their official duties in connection with the Contractor’s performance under the Agreement or this DMCA.

The Contractor further agrees that it shall ensure that any representative of the Contractor that is granted access any such system, application or IT resource: (i) uses such system, application or resource (and any PII accessible within or through it) solely to perform the authorized purpose(s) for which such representative was granted such access; and (ii) does not access or use PII available through such system, application or IT resource except as necessary to perform such authorized purpose(s).

To the extent that any Third Party Data or other data received from a third party under or in connection with a Third Party Agreement is accessible within or through a system, database, or other IT resource owned and/or operated by the Health Connector or by the Commonwealth or by both, the Contractor agrees that it shall ensure that any of its representatives accessing any such system, application or IT resource for any reason, has satisfied all applicable requirements of the applicable Third Party Agreement prior to accessing the system, application or IT resource, and continues to satisfy such requirements for so long as such access is continued. Each time the Contractor requests for one of its representatives to access any such system, application or IT resource, the Contractor shall be deemed to represent and warrant to the Health Connector that the representative has satisfied all requirements of any Third-Party Agreement that may be applicable to such access.

Disclosure of Reports and Other Deliverables

The Contractor shall not disseminate, reproduce, display, or publish any draft or final report or other deliverable prepared for the Health Connector under the Agreement or this DMCA without the prior written consent of the Health Connector.

Permitted Uses and Disclosures by the Contractor

Except as otherwise provided in the Agreement, the Contractor may use or disclose PII or any data derived or extracted from it to perform functions, activities, or services for, or on behalf of, as specified in the Agreement to the Health Connector, provided such use or disclosure would not violate any Applicable Law if done by the Health Connector, except as otherwise specifically permitted in the Agreement.

Except as otherwise provided in the Agreement, the Contractor may use PII for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

The Contractor may use and disclose PII to report violations of law to appropriate federal and state authorities consistent with Applicable Law.

Obligations of the Health Connector

Privacy Policy and Procedures, Security Management Policy, and Incident Response Policy & Procedures, and Changes thereto.

The Health Connector’s Privacy Policy and Procedures, Security Management Policy, and Incident Response Policy & Procedures are attached hereto as Exhibits D-1, D-3 and D-4 hereto. The Health Connector shall notify Contractor’s Compliance Officer in writing of any changes in such documents to the extent that such change may affect Contractor’s use or disclosure of PII in its performance of this DMCA and shall provide Contractor with a new copy of such documents as modified or amended.

Requests to Use or Disclose PII.

The Health Connector shall not request Contractor to use or disclose PII in any manner that would not be permissible under Applicable Law if done by the Health Connector or that is not otherwise expressly permitted under this DMCA.

Notification of Changes in Authorizations to Disclose.

The Health Connector shall notify the Contractor’s Compliance Officer in writing of any changes in, or revocation of, permission by an Individual to use or disclose PII that are known to the Health Connector, to the extent that such changes may affect the Contractor’s use or disclosure of PII in its performance of this DMCA or any other vendor’s use or disclosure of PII under this DMCA.

Notification of Restrictions.

The Health Connector shall notify the Contractor in writing of any restriction to the use or disclosure of PII that it has agreed to in accord with any Applicable Law, to the extent that such restriction may affect the Contractor’s use or disclosure of PII in its performance of this DMCA.

Consents, Authorizations and Permissions

The Health Connector agrees to obtain and maintain such consents, authorizations and/or permissions, if any, as may be necessary or required under federal or state laws or regulations or Health Connector policy to permit the Health Connector to disclose PII to Contractor in order for Contractor to use and disclose PII as required or permitted under the Agreement. The Health Connector agrees to promptly inform Contractor in writing as soon as the Health Connector becomes aware of any modifications to, restrictions on, defects in, or revocation or other termination of effectiveness of, any such consent, authorization or permission, to the extent any such modifications, restrictions, defects, revocations or terminations affect Contractor’s permitted or required uses and disclosures of PII specified in the Agreement or this DMCA.

Minimum PII

The Health Connector shall provide to, or request from, Contractor, only the minimum PII necessary for Contractor to perform or fulfill a specific function required or permitted hereunder.

Confidentiality and Data Security Agreements.

If Contractor is required in order to perform its obligations in the Agreement or this DMCA, or if Contractor is otherwise instructed by the Health Connector, to disclose PII to other vendors of the Health Connector or to any other entities or persons when it is required by law to refrain from such disclosing PII to such entities or persons, the Health Connector will be responsible for obtaining any confidentiality and data security agreements with other vendors, entities or persons as may be required by law.

Effect of Termination

Except as provided immediately below in subsection 1.21.2, upon termination of the Agreement for any reason whatsoever, this DMCA shall terminate, and the Contractor shall, at the Health Connector’s option, either return or destroy all PII and the Contractor shall not retain any copies of all such PII and data in any form. This provision shall apply to all PII and other data in the possession of the Contractor’s subcontractors or agents, and the Contractor shall ensure that all such PII and data derived or extracted from such PII in the possession of its subcontractors or agents has been returned or destroyed and that no subcontractor or agent retains any copies of such PII and data derived or extracted from such PII in any form. In no event shall the Contractor destroy any PII or other data without first obtaining the Health Connector’s approval.

Notwithstanding the foregoing, in the event that the Contractor determines that returning or destroying the PII is not feasible, the Contractor shall provide the Health Connector with written notification of the conditions that make return or destruction not feasible. Upon mutual agreement of the Parties that return or destruction of PII is not feasible, the Contractor shall extend the protections of the Agreement to such PII and limit further uses and disclosures of such data to those purposes that make the return or destruction not feasible, for as long as the Contractor maintains the PII and other data.

Notwithstanding any other provision of the Agreement all privacy and security protections pertaining to any PII shall continue to apply until such time as all such PII and data is returned to the Health Connector, or destroyed, or if returned or destruction is not feasible, protections are applied to such PII and data in accord with this DMCA.

Miscellaneous Provisions

Amendment.

The Contractor agrees to take such action as is necessary to amend this DMCA in order for the Health Connector and Contractor to comply with any requirements of any Applicable Law pertaining to the privacy, confidentiality, or security of PII or other data. In the event that any law or regulation, court decision, or interpretive policy affecting the use or disclosure of PII in enacted or promulgated, the parties will negotiate in good faith to amend this DMCA in such manner necessary to comply with such law, regulation, court decision, or interpretive guideline or policy.

Survival

The Contractor’s obligations under this DMCA shall survive the termination of the Agreement.

Waiver

Nothing in this DMCA shall be construed to waive or limit any of the Health Connector’s legal rights or remedies which may arise from the Contractor’s unauthorized use or disclosure of any PII received or created by it under the Agreement. The Health Connector’s exercise or non-exercise of any authority under this DMCA, including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Contractor of any obligations set forth herein, nor be construed as a waiver of any of the Contractor’s obligations or as an acceptance of any unsatisfactory practices or privacy or security failures or breaches by the Contractor.

Interpretation

Any ambiguity in the data sharing provisions of this DMCA shall be resolved to permit the Health Connector to comply with any Applicable Law or applicable law…