Res 2018-113/approving a contract between the City and the Texas Department of State Health Services, Vital Statistics Unit, for the provision of on-line vital statistic computer services for the City

Home Browse Search

System Agency Contract No.HHSREV 100001023 data transfers and the handling and disposal of Confidential Information. 45 CFR 164.308, 164.530(c); 1 TAC 202 (M) Except as otherwise limited by this DUA, the Base Contract, or law applicable to the Confidential Information, Contractor may use or disclose PHI for the proper management and administration of Contractor or to carry out Contractor's legal responsibilities if, 45 CFR 164.504(e)(il)(1)(A) (1) Disclosure is Required by Law, provided that Contractor complies with Section 3.01(D); (2) Contractor obtains reasonable assurances from the Person to whom the information is disclosed that the Person will: (a) Maintain the confidentiality of the Confidential Information in accordance with this DUA; (b) Use or further disclose the information only as Required by Law or for the Authorized Purpose for which it was disclosed to the Person; and (c) Notify Contractor in accordance with Section 4.01 of any Event or Breach of Confidential Information of which the Person discovers or should have discovered with the exercise of reasonable diligence. 45 CFR 164.504(e)(4)(ii)(B) (N) Except as otherwise limited by this DUA, Contractor will, if requested by System Agency, use PHI to provide data aggregation services to System Agency, as that term is defined in the HIPAA, 45 C.F.R. §164.501 and permitted by HIPAA. 45 CFR 164.504(e)(2)(i)(B) (0) Contractor will, on the tennination or expiration of this DUA or the Base Contract, at its expense, return to System Agency or Destrov, at System Agency's election, and to the extent reasonably feasible and permissible by law, all Confidential Information received from System Agency or created or maintained by Contractor or any of Contractor's agents or Subcontractors on System Agency's behalf if that data contains Confidential Information. Contractor will certify in writing to System Agency that all the Confidential Information that has been created, received, maintained, used by or disclosed to Contractor, has been Destroyed or returned to System Agency, and that Contractor and its agents and Subcontractors have retained no copies thereof. Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destro v any Confidential Information if federal or state Iaw, or System Agency record retention policy or a litigation hold notice prohibits such Destruction. If such return or Destruction is not reasonably feasible, or is impermissible by law, Contractor will immediately notify System Agency of the reasons such return or Destruction is not feasible, and agree to extend indefinitely the protections of this DUA to the Confidential Information and limit its fitrther uses and disclosures to the purposes that make the return of the Confidential Information not feasible for as long as Contractor maintains such Confidential Information. 45 CFR 164.504(e)(2)(ii)(J) (P) Contractor will create, maintain, use, disclose, transmit or Destro v Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses. 45 CFR 164.306, 164.530(c) (Q) If Contractor accesses, transmits, stores, or maintains Confidential Information, Contractor will complete and return to System Agency at infosecurity@hhsc.state.tx.us the System Agency information security and privacy initial inquiry (SPI) at Attachment 2 . The SPI identifies basic privacy and security controls with which Contractor must comply to protect System Agency Confidential Information. Contractor will comply with periodic security controls compliance assessment and monitoring by System Agency as required by state and federal law, based on the type of Confidential Information Contractor creates, receives, maintains, uses, discloses or has access to and the Authorized Purpose and level of risk. Contractor's security controls will be based on the National Institute of Standards and Technology (NIST) Special Publication 800-53. Contractor will update its security controls assessment whenever there are significant changes in security controls for System Agency System Agency Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 4 of 11