Res 2018-113/approving a contract between the City and the Texas Department of State Health Services, Vital Statistics Unit, for the provision of on-line vital statistic computer services for the City

Home Browse Search

System Agency Contract No.HHSREV 100001023 a. For federal information, including without limitation, Federal Tax Information Social Security Administration Data, and Medicaid Client Information, within the first, consecutive clock hour of Discovery, and for all other types of Confidential Information not more than 24 hours after Discovery, or in a timeframe otherwise approved by System Agency in writing, initially report to System Agency's Privacy and Security Officers via email at: privacyASystem AgencyC.state.tx.us and to the System Agency division responsible for this DUA; and IRS Publication 1075; Privacy Act of 1974, as amended by the Computer Matching and Privacy Protection Act of 1988, 5 U.S.C. § 552a; OMB Memorandunt 07-16 as cited in System AgencyC-CMS Contracts for information exchange. b. Report all information reasonably available to Contractor about the Event or Breach of the privacy or security of Confidential Information. 45 CFR 164.410 c. Name, and provide contact information to System Agency for, Contractor's single point of contact who will communicate with System Agency both on and off business hours during the incident response period. 2. 48 -Hour Formal Notice. No later than 48 consecutive clock hours after Discovery, or a time within which Discovery reasonably should have been made by Contractor of an Event or Breach of Confidential Information, provide formal notification to the State, including all reasonably available information about the Event or Breach, and Contractor's investigation, including without limitation and to the extent available: For (a) - (m) below. 45 CFR 164.400- 414 a. The date the Event or Breach occurred; b. The date of Contractor's and, if applicable, Subcontractor's Discovery; c. A brief description of the Event or Breach; including how it occurred and who is responsible (or hypotheses, if not yet determined); d. A brief description of Contractor's investigation and the status of the investigation; e. A description of the types and amount of Confidential Information involved; f. Identification of and number of all Individuals reasonably believed to be affected, including first and last name of the individual and if applicable the, Legally authorized representative, last known address, age, telephone number, and email address if it is a preferred contact method, to the extent known or can be reasonably determined by Contractor at that time; g. Contractor's initial risk assessment of the Event or Breach demonstrating whether individual or other notices are required by applicable law or this DUA for System Agency approval, including an analysis of whether there is a low probability of compromise of the Confidential Information or whether any legal exceptions to notification apply; h. Contractor's recommendation for System Agency's approval as to the steps Individuals or Contractor on behalf of Individuals, should take to protect the Individuals from potential harm, including without limitation Contractor's provision of notifications, credit protection, claims monitoring, and any specific protections for a Legally Authorized Representative to take on behalf of an Individual with special capacity or circumstances; i. The steps Contractor has taken to mitigate the harm or potential harm caused (including without limitation the provision of sufficient resources to mitigate); j. The steps Contractor has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Event or Breach,- System reach; System Agency Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 7 of 11