Res 2018-113/approving a contract between the City and the Texas Department of State Health Services, Vital Statistics Unit, for the provision of on-line vital statistic computer services for the City

Home Browse Search

System Agency Contract No.HHSREV 100001023 protected as required by rule, regulation or law. All electronic data transfer and communications of Confidential Information will be through secure systems. Proof of system, media or device security or Encryption must be produced to System Agency no later than 48 hours after System Agency's written request in response to a compliance investigation, audit or the Discovery of an Event or Breach. Otherwise, requested production of such proof will be made as agreed upon by the parties. De - identification of System Agency Confidential Information is a means of security. With respect to de - identification of PHI, "secure" means de -identified according to H1PAA Privacy standards and regulatory guidance. 45 CFR 164.312; 164.530(d) (Z) Contractor will comply with the following laws and standards if applicable to the type of Confidential Inforneation and Contractor's Authorized Purpose: • Title 1, Part 10, Chapter 202, Subchapter B, Texas Administrative Code; • The Privacy Act of 1974; • OMB Memorandum 07-16; • The Federal Information Security Management Act of 2002 (FISMA); • The Health Insurance Portability and Accountability Act of 1996 (H]PAAas defined in the DUA; • Internal Revenue Publication 1075 — Tax Information Security Guidelines for Federal, State and Local Agencies; • National Institute of Standards and Technology (NIST) Special Publication 800-66 Revision 1 — An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule; • NIST Special Publications 800-53 and 800-53A — Recommended Security Controls for Federal Information Systems and Organizations, as currently revised; • NIST Special Publication 800-47 — Security Guide for Interconnecting Information Technology Systems; • NIST Special Publication 800-88, Guidelines for Media Sanitization; • NIST Special Publication 800-111, Guide to Storage of Encryption Technologies for End User Devices containing PHI; and • Any other State or Federal law, regulation, or administrative rule relating to the specific System Agency program area that Contractor supports on behalf of System Agency. ARTICLE 4. BREACH NOTICE, REPORTING AND CORRECTION REQUIREMENTS Section 4.01. Breach or Event Notification to System Agency. 45 CFR 164.400-414 (A) Contractor will cooperate fully with System Agency in investigating, mitigating to the extent practicable and issuing notifications directed by System Agency, for any Event or Breach of Confidential Information to the extent and in the manner determined by System Agency. (B) Contractor's obligation begins at the Discovery of an Event or Breach and continues as long as related activity continues, until all effects of the Event are mitigated to System Agency's satisfaction (the "incident response period"). 45 CFR 164.404 (C) Breach Notice: 1. Initial Notice. System Agency Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 6 of 11