HomeMy WebLinkAboutResolution - 2017-R0260 - Amendment To Electronic Registration Remote System - 07/27/2017Resolution No.2017-R0260
Item No.6.21
July 27,2017
RESOLUTION
BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF LUBBOCK:
THAT the Mayor of the City of Lubbock is hereby authorized and directed to execute for
and on behalf of the City of Lubbock,Amendment No. 01 to that certain Agreement dated
November 5,2015 being an interlocal agreement (No.537-16-0020-00001 -Amended)with the
State of Texas'Department of State Health Services ("DSHS")to provide access to the Texas
Electronic Registration Remote System ("TER Remote System")to allow issuance of
individual birth certificates,by and between the City of Lubbock and the DSHS, and related
documents.Said Amendment is attached hereto and incorporated in this resolution as if fully set
forth herein and shall be included in the minutes of the City Council.
Passed bythe City Council on July 27, 2017 .
LATRELLE JOY,MAYOR PRO TEM
ATTEST:
leb^cca Garza,City Secretary \
APPROVED AS TO CONTENT:
A itULA^
ReHecca Garza, City Secretary
APPROVED AS TO FORM:
Rya#Braoke,Assistant City Attorney
RES.Amend #01 Interlocal Agreement-DSHS 537-16-0020-00001 Vital Stats.2016
07.05.17
Resolution No. 2017-R0260
DEPARTMENT OF STATE HEALTH SERVICES
AMENDMENT NO.01
The Department of State Health Services ("DSHS") and City of Lubbock ("Contractor") agree to
amend Contract No. 537-16-0020-00001 (Contract), which was effective on September 1, 2015.
This amendment will be denominated as Contract No. 537-16-0020-00001A.
1. The Parties agree to amend Article II. Term of the Contract to extend the end of the contract
term to August 31, 2018.
II. The Parties agree to delete Article IV. Statement of Work, Section B. in its entirety, and
replace it with the following:
Contractor will search DSHS databases, locate data, and issue Certifications of Vital
Records to authorized individuals requesting such data. The certifications will be in a
format formally approved by DSHS. Contractor will take reasonable efforts to ensure use
of the TER Remote System is not abused by its staff. Abuse of the access to confidential
information in the TER Remote System may be cause for termination of this Contract in
accordance with Section IX.K.
III. The parties agree to delete Article VIII. Representatives in its entirety, and replace it with
the following:
The following will act as the Representative authorized to administer activities under this
Contract on behalf of their respective Party.
City of Lubbock
DSHS
City of Lubbock
Texas Department of State Health Services
Vital Records
DCP/RLHS Contract Management Unit
Attn: City Secretary/Local Registrar
Attn: Lori Pate
P.O. Box 2000
Mail Code 1990
Lubbock, TX 79457-2000
P.O. Box 149347
Austin, TX 78714-9347
Phone: 806-775-2025
Phone: 512-776-7428
Email: bgarza(a),mail.ci.lubbock.tx.us
Email: Lori. Pater'dshs.state.tx.us
IV. The parties agree to delete Article IX. General Terms and Conditions, Section C.
Confidentiality, 1., and replace with the following:
C. Confidentiality.
1. The parties are required to comply with all applicable state and federal laws relating
to the privacy and confidentiality of patient and client records that contain Personal
Identifying Information (PII) or Personally Sensitive Information (PSI) or other
information or records made confidential by law, including Tex. Bus. & Comm. Code
Section 521.002. To the extent the Parties execute, or have executed, a separate Data
Use Agreement or other confidentiality agreement in compliance with the relevant
statutes, that agreement will also apply to this Contract.
V. This Amendment No. 01 shall be effective as of the date last signed below.
VL: Except as amended and modified by this Amendment No. 01, all terms and conditions of
the Contract, as amended, shall remain in full force and effect.
VII. Any further revisions to the Contract shall be by written agreement of the Parties.
SIGNATURE PAGE FOLLOWS
2
SIGNATURE PAGE FOR AMENDMENT No. 01
DSHS CONTRACT No. 537-16-0020-OOOOIA
DEPARTMENT OF STATXWEALTH
Mike Maples `,
Assistant Depu Com issijonQerr
Date of Execution:
CITY OF LUBBOCK
By-
N e: Latrelle Joy
Title:_ Mayor Pro Tern
Date of Execution: July 27, 2017
3
ATTACHMENT A - DATA USE AGREEMENT
DATA USE AGREEMENT
BETWEEN THE
TEXAS HEALTH AND HuNIAN SERVICES ENTERPRISE
AND
CITY of LUBBOCK ("CONTRACTOR")
This Data Use Agreement ("DUA"), effective as of the date signed below ("Effective Date"), is
entered into by and between the Texas Health and Human Services Enterprise agency DSHS ("HHS") and
City of Lubbock ("CONTRACTOR"), and incorporated into the terms of HHS Contract No. 537-16-0020-
00001, in Travis County, Texas (the "Base Contract").
ARTICLE I. PURPOSE; APPLICABILITY; ORDER OF PRECEDENCE
ATTACHMENT 1. The purpose of this DUA is to facilitate creation, receipt, maintenance,
use, disclosure or access to Confidential Information with CONTRACTOR, and describe
CONTRACTOR's rights and obligations with respect to the Confidential Information
and the limited purposes for which the CONTRACTOR may create, receive, maintain, use,
disclose or have access to Confidential Information. 45 CFR 164.504(e)(1)-(3) This DUA
also describes HHS's remedies in the event of CONTRACTOR's noncompliance with
its obligations under this DUA. This DUA applies to both Business Associates and contractors who
are not Business Associates who create, receive, maintain, use, disclose or have access to Confidential
Information on behalf of HHS, its programs or clients as described in the Base Contract.
As of the Effective Date of this DUA, if any provision of the Base Contract, including any General
Provisions or Uniform Terns and Conditions, conflicts with this DUA, this DUA controls.
ARTICLE 2. DEFINITIONS
For the purposes of this DUA, capitalized, underlined terms have the meanings set forth in the
following: Health insurance Portability and Accountability Act of 1996, Public Law 104-191 (42 U.S.C.
§ 1320d, et seq.) and regulations thereunder in 45 CFR Parts 160 and 164, including all amendments,
regulations and guidance issued thereafter, The Social Security Act, including Section 1137 (42 U.S.C.
§§ 1320b-7), Title XVI of the Act; The Privacy Act of 1974, as amended by the Computer Matching and
Privacy Protection Act of 1988, 5 U.S.C. § 552a and regulations and guidance thereunder, Internal Revenue
Code, Title 26 of the United States Code and regulations and publications adopted under that code, including
IRS Publication 1075; OMB Memorandum 07-18; Texas Business and Commerce Code Ch. 521; Texas
Government Code, Ch. 552, and Texas Government Code §2054.1125. In addition, the following terms in
this DUA are defined as follows:
"Authorized Purpose" means the specific purpose or purposes described in the Scope of Work of
the Base Contract for CONTRACTOR to fulfill its obligations under the Base Contract, or any other purpose
expressly authorized by HHS in writing in advance.
"Authorized User" means a Person:
(1) Who is authorized to create, receive, maintain, have access to, process, view, handle,
examine, interpret, or analyze Confidential Information pursuant to this DUA;
(2) For whom CONTRACTOR warrants and represents has a demonstrable need to create,
receive, maintain, use, disclose or have access to the Confidential Information; and
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
GOVERNMENTAL ENTITY VERSION
HHS Contract No. 537-16-0020-0000 1 A
(3) Who has agreed in writing to be bound by the disclosure and use limitations pertaining to
the Confidential Information as required by this DUA.
"Confidential Information" means any communication or record (whether oral, written,
electronically stored or transmitted, or in any other form) provided to or made available to CONTRACTOR
or that CONTRACTOR may create, receive, maintain, use, disclose or have access to on behalf of HHS that
consists of or includes any or all of the following:
(1) Client Information;
(2) Protected hlealth Information in any form including without limitation, Electronic
Protected Health Information or Unsecured Protected Health Information;
(3) Sensitive Personal Information defined by Texas Business and Commerce Code Ch. 521;
(4) Federal Tax Information;
(5) Personally Identifiable Information;
(6) Social Security Administration Data, including, without liniitation, Medicaid
information;
(7) All privileged work product;
(8) All information desiomated as confidential under the constitution and laws of the State of
Texas and of the United States, including the Texas Health & Safety Code and the Texas Public
Information Act, Texas Government Code, Chapter 552.
"Legally Authorized Representative" of the Individual, as defined by Texas law, including as
provided in 45 CFR 435.923 (Medicaid), 45 CFR 164.502(g)(I) (HIPAA); Tex. Occ. Code § 151.002(6);
Tex. H. & S. Code § 166.I64; Estates Code Ch. 752 and Texas Prob. Code § 3.
ARTICLE 3.CONTRACTOR'S DUTIES REGARDING CONFIDENTIAL INFORMATION
Section 3.01 Obligations of CONTRACTOR
CONTRACTOR agrees that:
(A) CONTRACTOR will exercise reasonable care and no less than the same degree of care
CONTRACTOR uses to protect its own confidential, proprietary and trade secret information to prevent
any portion of the Confidential Information from being used in a manner that is not expressly an
Authorized Purpose under this DUA or as Required by Law. 45 CFR 164.502(b)(1); 45 CFR 164.514(d)
(B) CONTRACTOR will not, without HHS's prior written consent, disclose or allow access
to any portion of the Confidential Information to any Person or other entity, other than Authorized User's
Workforce or Subcontractors of CONTRACTOR who have completed training in confidentiality, privacy,
security and the importance of promptly reporting any Event or Breach to CONTRACTOR's
management, to carry out the Authorized Purpose or as Required by Law.
HHS, at its election, may assist CONTRACTOR in training and education on specific or unique
HHS processes, systems and/or requirements. CONTRACTOR will produce evidence of completed
training to HHS upon request. 45 C.F.R. 164.308(a)(5)r); Tetras Health & Safety Code §181.101
(C) CONTRACTOR will establish, implement and maintain appropriate sanctions against
any member of its Workforce or Subcontractor who fails to comply with this DUA, the Base Contract or
applicable law. CONTRACTOR will maintain evidence of sanctions and produce it to HHS upon
request.45 C.F.R. 164.308(a) (1) (ii) (C); 164.530(e); 164.410(b); 164.530(b) (1)
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April I, 2015
Page 2 of 12
HHS Contract No. 537-16-0020-0000 1 A
(D) CONTRACTOR will not, without prior written approval of HHS, disclose or provide
access to any Confidential Information on the basis that such act is Required by Law without notifying
HHS so that HHS may have the opportunity to object to the disclosure or access and seek appropriate
relief. If HHS objects to such disclosure or access, CONTRACTOR will refrain from disclosing or
providing access to the Confidential Information until HHS has exhausted all alternatives for relief. 45
CFR 164.504(e) (2) (ii) (A)
(E) CONTRACTOR will not attempt to re -identify or further identify Confidential
Information or De -identified Information, or attempt to contact any Individuals whose records are
contained in the Confidential Information, except for an Authorized Purpose, without express written
authorization from HHS or as expressly permitted by the Base Contract. 45 CFR 164.502(d)(2)(i) and (ii)
CONTRACTOR will not engage in prohibited marketing or sale of Confidential Information. 45 CFR
164.501,164.508(a)(3) and (4); Texas Health & Safety Code Ch. 181.002
(F) CONTRACTOR will not permit, or enter into any agreement with a Subcontractor to,
create, receive, maintain, use, disclose, have access to or transmit Confidential Information, on behalf of
CONTRACTOR without requiring that Subcontractor first execute the Form Subcontractor Agreement,
Attachment 1, which ensures that the Subcontractor will comply with the identical terms, conditions,
safeguards and restrictions as contained in this DUA for PHI and any other relevant Confidential
Information and which permits more strict limitations; and 45 CFR 164.502(e)(1)(1)(ii); 164.504(e)(1)rt)
and (1)
(G) CONTRACTOR is directly responsible for compliance with, and enforcement of, all
conditions for creation, maintenance, use, disclosure, transmission and Destruction of Confidential
Information and the acts or omissions of Subcontractors as may be reasonably necessary to prevent
unauthorized use. 45 CFR 164.504(e)(5); 42 CFR 431.300, et seq.
(H) If CONTRACTOR maintains PHI in a Designated Record Set, CONTRACTOR will
make PHI available to HHS in a Designated Record Set or, as directed by HHS, provide PHI to the
Individual, or Legally Authorized Representative of the Individual who is requesting PHI in compliance
with the requirements of the HIPAA Privacy Regulations. CONTRACTOR will make other Confidential
Information in CONTRACTOR's possession available pursuant to the requirements of HIPAA or other
applicable law upon a determination of a Breach of Unsecured PHI as defined in HIPAA. 45 CFR
164.524and 164.504(e)(2)(ii)(E)
(1) CONTRACTOR will make PHI as required by HIPA-A available to HHS for amendment
and incorporate any amendments to this information that HHS directs or agrees to pursuant to the HIPAA.
45 CFR 164.504(e) (2) (ii) (E) and (F)
(J) CONTRACTOR will document and make available to HHS the PHI required to provide
access, an accounting of disclosures or amendment in compliance with the requirements of the HIPAA
Privacy Regulations. 45 CFR 164.504(e) (2) (ii) (G) and 164.528
(K) If CONTRACTOR receives a request for access, amendment or accounting of PHI by
any Individual subject to this DUA, it will promptly forward the request to HHS; however, if it would
violate HIPAA to forward the request, CONTRACTOR will promptly notify HHS of the request and of
CONTRACTOR's response. Unless CONTRACTOR is prohibited by law from forwarding a request,
HHS will respond to all such requests, unless HHS has given prior written consent for CONTRACTOR to
respond to and account for all such requests. 45 CFR 164.504(e)(2)
(L) CONTRACTOR will provide, and will cause its Subcontractors and agents to provide, to
HHS periodic written certifications of compliance with controls and provisions relating to information
privacy, security and breach notification, including without limitation information related to data transfers
and the handling and disposal of Confidential Information. 45 CFR 164.308; 164.530(c); I TAC 202
HFIS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 3 of 12
HHS Contract No. 537-16-0020-00001 A
(M) Except as otherwise limited by this DUA, the Base Contract, or law applicable to the
Confidential Information, CONTRACTOR may use or disclose PHI for the proper management and
administration of CONTRACTOR or to carry out CONTRACTOR's legal responsibilities if: 45 CFR
164.504(e) (ii) (1) (A)
(1) Disclosure is Required by Law, provided that CONTRACTOR complies with Section
3.0I (D);
(2) CONTRACTOR obtains reasonable assurances from the Person to whom the information
is disclosed that the Person will:
(a) Maintain the confidentiality of the Confidential Information in accordance with this DUA;
(b) Use or further disclose the information only as Required by Law or for the Authorized
Purpose for which it was disclosed to the Person; and
(c) Notify CONTRACTOR in accordance with Section 4.01 of any Event or Breach of
Confidential Information of which the Person discovers or should have discovered with the
exercise of reasonable diligence. 45 CFR 164.504(e)(4)(ii)(B)
(N) Except as otherwise limited by this DUA, CONTRACTOR will, if requested by HHS,
use PHI to provide data aggregation services to HHS, as that tern is defined in the I-IIPAA. 45 C.F.R.
§164.501 and permitted by I-IfPAA. 45 CFR 164.504(e)(2)(i)(B)
(0) CONTRACTOR will, on the termination or expiration of this DUA or the Base Contract,
at its expense, return to HHS or Destroy, at HHS's election, and to the extent reasonably feasible and
permissible by law, all Confidential Information received from HHS or created or maintained by
CONTRACTOR or any of CONTRACTOR's agents or Subcontractors on I- HS's behalf if that data
contains Confidential Information. CONTRACTOR will certify in writing to HHS that all the
Confidential Information that has been created, received, maintained, used by or disclosed to
CONTRACTOR, has been Destroyed or returned to HHS, and that CONTRACTOR and its agents and
Subcontractors have retained no copies thereof. Notwithstanding the foregoing, COivrIRACTOR
acknowledges and agrees that it may not Destroy any Confidential Information if federal or state law, or
HHS record retention policy or a litigation hold notice prohibits such Destruction. If such return or
Destruction is not reasonably feasible, or is impermissible by law, CONTRACTOR will immediately
notify HHS of the reasons such return or Destruction is not feasible, and agree to extend indefinitely the
protections of this DUA to the Confidential Information and limit its further uses and disclosures to the
purposes that make the return of the Confidential Information not feasible for as long as CONTRACTOR
maintains such Confidential Information. 45 CFR 164.504(e)(2)(ii)(J)
(P) CONTRACTOR will create, maintain, use, disclose, transmit or Destroy Confidential
Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the
security or integrity of such information or unauthorized uses. 45 CFR 164.306; 164.530(c)
(Q) If CONTRACTOR accesses, transmits, stores, and/or maintains Confidential
Information, CONTRACTOR will complete and return to HHS at in fosccuritv0ir,hhsc.state. tx.us the HHS
information security and privacy initial inquiry (SPI) at Attachment 2 . The SPI identifies basic privacy
and security controls with which CONTRACTOR must comply to protect HHS Confidential Information.
CONTRACTOR will comply with periodic security controls compliance assessment and monitoring by
HHS as required by state and federal law, based on the type of Confidential Information CONTRACTOR
creates, receives, maintains, uses, discloses or has access to and the Authorized Purpose and level of risk.
CONTRACTOR's security controls will be based on the National Institute of Standards and Technology
(MIST) Special Publication 800-53. CONTRACTOR will update its security controls assessment
whenever there are significant changes in security controls for HHS Confidential Information and will
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April I, 2015
Page 4 of 12
HHS Contract No. 537-16-0020-0000 1 A
provide the updated document to HHS. HHS also reserves the right to request updates as needed to
satisfy state and federal monitoring requirements. 45 CFR 164.306
(R) CONTRACTOR will establish, implement and maintain any and all appropriate
procedural, administrative, physical and technical safeguards to preserve and maintain the
confidentiality, integrity, and availability of the Confidential Information, and with respect to PHI, as
described in the HIPAA Privacy and Security Regulations, or other applicable laws or regulations relating
to Confidential Information. to prevent any unauthorized use or disclosure of Confidential Information as
long as CONTRACTOR has such Confidential Information in its actual or constructive possession. 45
CFR 164.308 (administrative safeguards); 164.310 (physical safeguards); 164.312 (technical
safeguards); 164.530(c) (privacy safeguards)
(S) CONTRACTOR will designate and identify, subject to HHS approval, a Person or
Persons, as Privacy Official 45 CFR 164.530(a)(1) and Information Security Official, each of whom is
authorized to act on behalf of CONTRACTOR and is responsible for the development and
implementation of the privacy and security requirements in this DUA. CONTRACTOR will provide
name and current address, phone number and e-mail address for such designated officials to HHS upon
execution of this DUA and prior to any change. 45 CFR 164.308(a)(2)
(T) CONTRACTOR represents and warrants that its Authorized Users each have a
demonstrated need to know and have access to Confidential Information solely to the minimum extent
necessary to accomplish the Authorized Purpose pursuant to this DUA and the Base Contract, and further,
that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the
Confidential Information contained in this DUA. 45 CFR 164.502; 164.514(d)
(U) CONTRACTOR and its Subcontractors will maintain an updated, complete, accurate and
numbered list of Authorized Users, their signatures, titles and the date they agreed to be bound by the
terms of this DUA, at all times and supply it to HHS, as directed, upon request.
(V) CONTRACTOR will implement, update as necessary, and document reasonable and
appropriate policies and procedures for privacy, security and Breach of Confidential Information and an
incident response plan for an Event or Breach to comply with the privacy, security and breach notice
requirements of this DUA prior to conducting work under the DUA. 45 CFR 164.308; 164.316;
164.514(d); 164.530(i)(1)
(W) CONTRACTOR will produce copies of its information security and privacy policies and
procedures and records relating to the use or disclosure of Confidential Information received from,
created by, or received, used or disclosed by CONTRACTOR on behalf of HHS for HHS's review and
approval within 30 days of execution of this DUA and upon request by HHS the following business day
or other agreed upon time frame. 45 CFR 164.308; 164.514(d)
(X) CONTRACTOR will make available to HHS any information HHS requires to fulfill HHS's
obligations to provide access to, or copies of, PHI in accordance with HIPAA and other applicable laws and
regulations relating to Confidential Information. CONTRACTOR will provide such information in a time
and manner reasonably agreed upon or as designated by the Secretary, or other federal or state law. 45 CFR
164.504(e) (2) (i) (I)
(I) CONTRACTOR will only conduct secure transmissions of Confidential Information
whether in paper, oral or electronic form. A secure transmission of electronic Confidential Information in
motion includes secure File Transfer Protocol (SFTP) or Encryption at an appropriate level or otherwise
protected as required by rule, regulation or law. HHS Confidential Information at rest requires Encryption
unless there is adequate administrative, technical, and physical security, or as otherwise protected as
required by rule, regulation or law. All electronic data transfer and communications of Confidential
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page5of12
II H S Contract No. 537-16-0020-00001 A
Information will be through secure systems. Proof of system, media or device security and/or Encryption
must be produced to HHS no later than 48 hours after HHS's written request in response to a compliance
investigation, audit or the Discovery of an Event or Breach. Otherwise, requested production of such
proof will be made as agreed upon by the parties. De -identification of HHS Confidential Information is
a means of security. With respect to de -identification of PHI, "secure" means de -identified according to
HIPAA Privacy standards and regulatory guidance. 45 CFR 164.312, 164.530(d) V
(Z) CONTRACTOR will comply with the following laws and standards if applicable to the type of
Con ldential Information and Contractor's Authorized Purpose:
• Title 1, Part 10, Chapter 202, Subchapter B, Texas Administrative Code;
• The Privacy Act of 1974;
• OINiB Memorandum 07-16;
• The Federal Information Security Management Act of 2002 (FISMA);
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA) as defined in the
DUA;
• Internal Revenue Publication 1075 - Tax Information Security Guidelines for Federal, State
and Local Agencies;
• National Institute of Standards and Technology (MIST) Special Publication 800-66 Revision
1 - An Introductory Resource Guide for Implementing the Health Insurance Portability and
Accountability Act (HIPAA) Security Rule;
• NIST Special Publications 800-53 and 800-53A .. Recommended Security Controls for
Federal Information Systems and Organizations, as currently revised;
• NIST Special Publication 800-47 -- Security Guide for Interconnecting Information
Technology Systems;
• NIST Special Publication 800-88, Guidelines for Media Sanitization:
• NIST Special Publication 800-111, Guide to Storage of Encryption Technologies for End
User Devices containing PHI; and
• Any other State or Federal law, regulation, or adnunistrative rule relating to the specific I-11-IS
program area that CONTRACTOR supports on behalf of HHS.
ARTICLE 4. BREACH NOTICE, REPORTING AND CORRECTION REQUIREMENTS
Section 4.01. Breach or Event Notifrcatiou to HHS. 45 CFR 164.400-414
(A) CONTRACTOR will cooperate fully with HHS in investigating, mitigating to the extent
practicable and issuing notifications directed by HHS, for any Event or Breach of Confidential
Information to the extent and in the manner determined by HHS.
(B) CONTRACTOR'S obligation begins at the Discovery of an Event or Breach and
continues as long as related activity continues, until all effects of the Event are mitigated to
HI-IS's satisfaction (the "incident response period"). 45 CFR 164.404
(C) Breach Notice:
1. Initial Notice,
HHS Data Use Agreement V.S.3 HIPAA Omnibus Compliant April I, 2015
Page 6 of 12
HHS Contract No. 537-16-0020-0000 1 A
a. For federal information, including without limitation, Federal Tax Information, Social Security
Administration Data, and Medicaid Client Information, within the first, consecutive clock hour
of Discovery, and for all other types of Confidential Information not more than 24 hours after
Discovery, or in a tinieframe otherwise approved by HHS in writing, initially report to HHS's
Privacy and Security Officers via email at: privacyna HHSC.state.tx.us and to the HHS division
responsible for this DUA; and IRS Publication 1075; Privacy Act of 1974, as amended by the
Computer Afatching and Privacy Protection Act of 1988, 5 U.S.C. § 552a; OjVB A1emorandunt
07-16 as cited in HHSC-CAPS Contracts for information exchange.
b, Report all information reasonably available to CONTRACTOR about the Event or Breach of
the privacy or security of Confidential Information. 45 CFR 164.410
c. Name, and provide contact information to HHS for, CONTRACTOR's single point of contact
who will communicate with HHS both on and off business hours during the incident response
period.
2. 48-Hour Formal Notice. No later than 48 consecutive clock hours after Discovery, or a
time within which Discovery reasonably should have been made by CONTRACTOR of an Event
or Breach of Confidential Information, provide formal notification to the State, including all
reasonably available information about the Event or Breach, and CONTRACTOR's investigation,
including without limitation and to the extent available: For (a) - (m) below: 45 CFR 164.400-
414
a. The date the Event or Breach occurred:
b. The date of CONTRACTOR's and, if applicable, Subcontractor's Discovery;
c. A brief description of the Event or Breach: including how it occurred and who is responsible
(or hypotheses, if not yet determined);
d. A brief description of CONTRACTOR's investigation and the status of the investigation;
e. A description of the types and amount of Confidential Information involved;
f. Identification of and number of all Individuals reasonably believed to be affected, including
first and last name of the individual and if applicable the, Legally authorized representative, last
known address, age, telephone number, and email address if it is a preferred contact method, to
the extent known or can be reasonably determined by CONTRACTOR at that time;
g. CONTRACTOR's initial risk assessment of the Event or Breach demonstrating whether
individual or other notices are _required by applicable law or this DUA for 1.11-1S approval,
including an analysis of whether there is a low probability of compromise of the Confidential
Information or whether any legal exceptions to notification apply;
h. CONTRACTOR's recommendation for HHS's approval as to the steps Individuals and/or
CONTRACTOR on behalf of Individuals, should take to protect the Individuals from potential
harm, including without limitation CONTRACTOR's provision of notifications, credit protection,
claims monitoring, and any specific protections for a Legally Authorized Representative to take
on behalf of an Individual with special capacity or circumstances;
i. The steps CONTRACTOR has taken to mitigate the harm or potential harm caused (including
without limitation the provision of sufficient resources to mitigate);
j. The steps CONTRACTOR has taken, or will take, to prevent or reduce the likelihood of
recurrence of a similar Event or Breach;
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 7 of 12
HHS Contract No. 537-16-0020-00001A
k. Identify, describe or estimate of the Persons, Workforce, Subcontractor, or Individuals and any
law enforcement that may be involved in the Event or Breach;
1. A reasonable schedule for CONTRACTOR to provide regular updates to the foregoing in the
future for response to the Event or Breach, but no less than every three (3) business days or as
otherwise directed by HHS, including information about risk estimations, reporting, notification,
if any, mitigation, corrective action, root cause analysis and when such activities are expected to
be completed; and
m. Any reasonably available, pertinent information, documents or reports related to an Event or
Breach that HHS requests following Discovery.
Section 4.02 Investigation, Response and Mitigation. For A-F below: 45 CFR 164.308, 310
and 312; 164.530
(A) CONTRACTOR will immediately conduct a full and complete investigation, respond to
the Event or Breach, commit necessary and appropriate staff and resources to expeditiously
respond, and report as required to and by HHS for incident response purposes and for purposes of
HHS's compliance with report and notification requirements, to the satisfaction of HHS.
(B) CONTRACTOR will complete or participate in a risk assessment as directed by HHS
following an Event or Breach, and provide the final assessment, corrective actions and
mitigations to HHS for review and approval.
(C) CONTRACTOR will fully cooperate with HHS to respond to inquiries and%or
proceedings by state and federal authorities, Persons and/or Individuals about the Event or
Breach.
(D) CONTRACTOR will fully cooperate with HHS's efforts to seek appropriate injunctive
relief or otherwise prevent or curtail such Event or Breach, or to recover or protect any
Confidential Information, including complying with reasonable corrective action or measures, as
specified by HHS in a Corrective Action Plan if directed by HHS under the Base Contract.
Section 4.03 Breach Notification to Individuals and Reporting to Authorities. Tec Bus. &
Concur. Code §521.053; 45 CFR 164.404 (Individuals), 164.406 (rbledia); 164.408 (Authorities)
(A) HHS may direct CONTRACTOR to provide Breach notification to Individuals,
regulators or third -parties, as specified by HHS following a Breach.
(B) CONTRACTOR must obtain HHS's prior written approval of the time, manner and
content of any notification to Individuals, regulators or third -parties, or any notice required by
other state or federal authorities. Notice letters will be in CONTRACTOR's name and on
CONTRACTOR's letterhead, unless otherwise directed by HHS, and will contain contact
information, including the name and title of CONTRACTOR's representative, an email address
and a toll -free telephone number, for the Individual to obtain additional information.
(C) CONTRACTOR will provide I -II -IS with copies of distributed and approved
communications.
(D) CONTRACTOR will have the burden of demonstrating to the satisfaction of HHS that
any notification required by HHS was timely made. If there are delays outside of
CONTRACTOR's control, CONTRACTOR will provide written documentation of the reasons
for the delay.
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 8 of 12
FIHS Contract No. 537-16-0020-00001A
(E) If HHS delegates notice requirements to CONTRACTOR, HHS shall, in the time and
manner reasonably requested by CONTRACTOR, cooperate and assist with CONTRACTOR's
information requests in order to make such notifications and reports.
ARTICLE 5. SCOPE OF WORK
Scope of Work means the services and deliverables to be performed or provided by
CONTRACTOR, or on behalf of CONTRACTOR by its Subcontractors or agents for HHS that are described
in detail in the Base Contract. The Scope of Work, including any future amendments thereto, is incorporated
by reference in this DUA as if set out word-for-word herein.
ARTICLE 6. GENERAL PROVISIONS
Section 6.01 O,vztershipofCozzfzderztiallnformation
CONTRACTOR acknowledges and agrees that the Confidential Information is and will remain the
property of HHS. CONTRACTOR agrees it acquires no title or rights to the Confidential Information.
Section 6.02 HHS Conzmitinent and Obligations
HHS will not request CONTRACTOR to create, maintain, transmit, use or disclose PHI in any manner
that would not be permissible under applicable law if done by HHS.
Section 6.03 HHS Right to Inspection
At any time upon reasonable notice to CONTRACTOR, or if HHS determines that CONTRACTOR
has violated this DUA, HHS, directly or through its agent, will have the right to inspect the facilities, systems,
books and records of CONTRACTOR to monitor compliance with this DUA. For purposes of this
subsection, HHS's agent(s) include, without limitation, the HHS Office of the Inspector General or the Office
of the Attorney General of Texas, outside consultants or legal counsel or other designee.
Section 6.04 Term; Termination ofDUA; Sunival
This DUA will be effective on the date on which CONTRACTOR executes the DUA, and will
terminate upon termination of the Base Contract and as set forth herein . If the Base Contract is extended or
amended, this DUA is updated automatically concurrent with such extension or amendment.
(A) HHS may immediately terminate this DUA and Base Contract upon a material violation
of this DUA.
(B) Termination or Expiration of this DUA will not relieve CONTRACTOR of its obligation
to return or Destroy the Confidential Information as set forth in this DUA and to continue to safeguard the
Confidential Information until such time as determined by HHS.
(D) If HHS detemunes that CONTRACTOR has violated a material term of this DUA; HHS
may in its sole discretion:
1. Exercise any of its rights including but not limited to reports, access and inspection under
this DUA and/or the Base Contract; or
2. Require CONTRACTOR to submit to a corrective action plan, including a plan for
monitoring and plan for reporting, as HHS may deternune necessary to maintain compliance with
this DUA; or
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 9 of 12
HHS Contract No. 537-16-0020-OOOOIA
3. Provide CONTRACTOR with a reasonable period to cure the violation as determined
by HHS; or
4. Terminate the DUA and Base Contract immediately, and seek relief in a court of
competent jurisdiction in Travis County, Texas.
Before exercising any of these options, HHS will provide written notice to CONTRACTOR
describing the violation and the action it intends to take.
(E) If neither termination nor cure is feasible, HHS shall report the violation to the Secretary.
(F) The duties of CONTRACTOR or its Subcontractor under this DUA survive the expiration or
termination of this DUA until all the Confidential Information is Destroved or returned to HHS, as
required by this DUA.
Section 6.05 Governing Law, Venue and Litigation
(A) The validity, construction and performance of this DUA and the legal relations among the
Parties to this DUA will be governed by and construed in accordance with the laws of the State of Texas.
(B) The Parties agree that the courts of Travis County, Texas, will be the exclusive venue for
any litigation, special proceeding or other proceeding as between the parties that may be brought, or arise
out of, or in connection with, or by reason of this DUA.
Section 6.06 Injunctive Relief
(A) CONTRACTOR acknowledges and agrees that HHS may suffer irreparable injury if
CONTRACTOR or its Subcontractor fails to comply with any of the terms of this DUA with respect to
the Confidential Information or a provision of HIPAA or other laws or regulations applicable to
Confidential Information.
(B) CONTRACTOR further agrees that monetary damages may be inadequate to compensate
HHS for CONTRACTOR's or its Subcontractor's failure to comply. Accordingly, CONTRACTOR
agrees that HHS will, in addition to any other remedies available to it at law or in equity, be entitled to
seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages,
to enforce the terms of this DUA.
Section 6.07 Indemnification
To the extent permitted by law, CONTRACTOR will indemnify, defend and hold harmless HHS and its
respective Executive Commissioner, employees, Subcontractors, agents (including other state agencies acting
on behalf of I-IHS) or other members of its Workforce (each of the foregoing hereinafter referred to as
"Indemnified Party") against all actual and direct losses suffered by the Indemnified Party and all liability to
third parties arising from or in connection with any breach of this DUA or from any acts or omissions related
to this DUA by CONTRACTOR or its employees, directors, officers, Subcontractors, or agents or other
members of its Workforce. The duty to indemnify, defend and hold harmless is independent of the duty to
insure and continues to apply even in the event insurance coverage required, if any, in the DUA or Base
Contract is denied, or coverage rights are reserved by any insurance carrier. Upon demand, CONTRACTOR
will reimburse HHS for any and all losses, liabilities, lost profits, fines, penalties, costs or expenses (including
reasonable attorneys' fees) which may for any reason be imposed upon any Indemnified Party by reason of
any suit, claim, action, proceeding or demand by any third party to the extent caused by and which results
from the CONTRACTOR's failure to meet any of its obligations under this DUA. To the extent permitted by
law, CONTRACTOR's obligation to defend, indemnify and hold harmless any Indemnified Party will
survive the expiration or termination of this DUA.
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 10 of 12
HHS Contract No. 537-I6-0020-0000IA
Section 6.08 Insurance
(A) CONTRACTOR represents and warrants that it maintains either self-insurance or
commercial insurancewith policy limits sufficient to cover any liability arising from any acts or omissions
by CONTRACTOR or its employees, directors, officers, Subcontractors, or agents or other members of its
Workforce under this DUA. CONTRACTOR warrants that HHS will be a loss payee and beneficiary for any
such claims. .
(B) CONTRACTOR will provide HHS with written proof that required insurance coverage is
in effect, at the request of HHS.
Section 6.09 Fees and Costs
Except as otherwise specified in this DUA or the Base Contract, including but not Iimited to
requirements to insure and/or indemnify HHS, if any legal action or other proceeding is brought for the
enforcement of this DUA, or because of an alleged dispute, contract violation, Event, Breach, default,
misrepresentation, or injunctive action, in connection with any of the provisions of this DUA, each party will
bear their own legal expenses and the other cost incurred in that action or proceeding.
Section 6.10 Entirety of the Contract
This Data Use Agreement is incorporated by reference into the Base Contract and, together with the
Base Contract, constitutes the entire agreement between the parties. No change, waiver, or discharge of
obligations arising under those documents will be valid unless in writing and executed by the party against
whom such change, waiver, or discharge is sought to be enforced.
Section 6.11 Automatic Antendment and Interpretation
Upon the effective date of any amendment or issuance of additional regulations to HIPAA, or any
other law applicable to Confidential Information, this DUA will automatically be amended so that the
obligations imposed on HHS and/or CONTRACTOR remain in compliance with such requirements. Any
ambiguity in this DUA will be resolved in favor of a meaning that permits HHS and CONTRACTOR to
comply with HIPAA or any other law applicable to Confidential Information.
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 11 of 12
HHS Contract No. 537-16-0020-0000 1 A
Section 6.08 Insurance
(A) CONTRACTOR represents and warrants that it maintains either self-insurance or
commercial insurancewith policy limits sufficient to cover any liability arising from any acts or omissions
by CONTRACTOR or its employees, directors, officers, Subcontractors, or agents or other members of its
Workforce under this DUA. CONTRACTOR warrants that HHS will be a loss payee and beneficiary for any
such claims. .
(B) CONTRACTOR will provide HHS with written proof that required insurance coverage is
in effect, at the request of HHS.
Section 6.09 Fees and Costs
Except as otherwise specified in this DUA or the Base Contract, including but not Iimited to
requirements to insure and/or indemnify HHS, if any legal action or other proceeding is brought for the
enforcement of this DUA, or because of an alleged dispute, contract violation, Event, Breach, default,
misrepresentation, or injunctive action, in connection with any of the provisions of this DUA, each party will
bear their own legal expenses and the other cost incurred in that action or proceeding.
Section 6.10 Entirety of the Contract
This Data Use Agreement is incorporated by reference into the Base Contract and, together with the
Base Contract, constitutes the entire agreement between the parties. No change, waiver, or discharge of
obligations arising under those documents will be valid unless in writing and executed by the party against
whom such change, waiver, or discharge is sought to be enforced.
Section 6.11 Automatic Antendntent and Interpretation
Upon the effective date of any amendment or issuance of additional regulations to HIPAA, or any
other law applicable to Confidential Information, this DUA will automatically be amended so that the
obligations imposed on HHS and/or CONTRACTOR remain in compliance with such requirements. Any
ambiguity in this DUA will be resolved in favor of a meaning that permits HHS and CONTRACTOR to
comply with PIPAA or any other law applicable to Confidential Information.
HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015
Page 11 of 12