Res 2018-113/approving a contract between the City and the Texas Department of State Health Services, Vital Statistics Unit, for the provision of on-line vital statistic computer services for the City

Home Browse Search

System Agency Contract No.HHSREV 100001023 Confidential Information and will provide the updated document to System Agency. System Agency also reserves the right to request updates as needed to satisfy state and federal monitoring requirements. 45 CFR 164.306 (R) Contractor will establish, implement and maintain any and all appropriate procedural, administrative, physical and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the Confidential Information, and with respect to PHI, as described in the HIPAA Privacy and Security Regulations, or other applicable laws or regulations relating to Confidential Information, to prevent any unauthorized use or disclosure of Confidential Information as long as Contractor has such Confidential Information in its actual or constructive possession. 45 CFR 164.308 (administrative safeguards); 164.310 (physical safeguards); 164.312 (technical safeguards); 164.530(c)(privacy safeguards) (S) Contractor will designate and identify, subject to System Agency approval, a Person or Persons, as Privacy Official 45 CFR 164.530(a)(1) and Information Security Official, each of whom is authorized to act on behalf of Contractor and is responsible for the development and implementation of the privacy and security requirements in this DUA. Contractor will provide name and current address, phone number and e-mail address for such designated officials to System Agency upon execution of this DUA and prior to any change. 45 CFR 164.308(a)(2) (T) Contractor represents and warrants that its Authorized Users each have a demonstrated need to know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose pursuant to this DUA and the Base Contract, and further, that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in this DUA. 45 CFR 164.502; 164.514(d) (U) Contractor and its Subcontractors will maintain an updated, complete, accurate and numbered list of Authorized Users, their signatures, titles and the date they agreed to be bound by the terms of this DUA, at all times and supply it to System Agency, as directed, upon request. (V) Contractor will implement, update as necessary, and document reasonable and appropriate policies and procedures for privacy, security and Breach of Confidential Information and an incident response plan for an Event or Breach, to comply with the privacy, security and breach notice requirements of this DUA prior to conducting work under the DUA. 45 CFR 164.308; 164.316; 164.514(d); 164.530(1)(1) (V) Contractor will produce copies of its information security and privacy policies and procedures and records relating to the use or disclosure of Confidential Information received from, created by, or received, used or disclosed by Contractor on behalf of System Agency for System Agency's review and approval within 30 days of execution of this DUA and upon request by System Agency the following business day or other agreed upon time frame. 45 CFR 164.308; 164.514(d) (X) Contractor will make available to System Agency any information System Agency requires to fulfill System Agency's obligations to provide access to, or copies of, PHI in accordance with HIPAA and other applicable laws and regulations relating to Confidential Information. Contractor will provide such information in a time and manner reasonably agreed upon or as designated by the Secretary, or other federal or state law. 45 CFR 164.504(e)(2)(i)a) (Y) Contractor will only conduct secure transmissions of Confidential Information whether in paper, oral or electronic form. A secure transmission of electronic Confidential Information in motion includes secure File Transfer Protocol (SFTP) or Encryption at an appropriate level or otherwise protected as required by rule, regulation or law. System Agency Confidential Information at rest requires Encryption unless there is adequate administrative, technical, and physical security, or as otherwise System Agency Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 5 of 11