SH22-011 - WA STATE HCA MOUD IN JAILS PSA - Amendment 1 - partially executed

Home Browse Search

Contractor must include all of the Data security terms, conditions and requirements set forth in this Contract in any such Subcontract. In no event will the existence of the Subcontract operate to release or reduce the liability of the Contractor to HCA for any breach in the performance of the Contractor's responsibilities. 9. Audit 9.1. At HCA's request or in accordance with OCIO 141. 10, Contractor shall obtain audits covering Data Security and Permissible Use. Contractor may cover both the Permissible Use and the Data Security Requirements under the same audit, or under separate audits. The term, "independent third -party" as referenced in this section means an outside auditor that is an independent auditing firm. 9.2. Data Security audits must demonstrate compliance with Data Security standards adopted by the Washington State Office of the Chief Information Officer (OCIO), and as set forth in Attachment 1, Data Security Requirements. At a minimum, audit(s) must determine whether Data Security policies, procedures, and controls are in place to ensure compliance with all Data Security Requirements set forth herein and as required by state and federal law. 9.3. Permissible Use Audits must demonstrate compliance with Permissible Use standards as set forth in this Contract and each Attachment A. Audit(s) must determine whether Permissible Use policies, procedures, and controls are in place to ensure compliance with all Permissible Use requirements in this Contract. 9.4. HCA may monitor, investigate, and audit the use of Personal Information received by Contractor through this Contract. The monitoring and investigating may include the act of introducing data containing unique but false information (commonly referred to as "salting" or "seeding") that can be used later to identify inappropriate use or disclosure of Data. 9.5. During the term of this Contract and for six (6) years following termination or expiration of this Contract, HCA will have the right at reasonable times and upon no less than five (5) business days prior written notice to access the Contractor's records and place of business for the purpose of auditing, and evaluating the Contractor's compliance with this Contract and applicable laws and regulations. 10. Data Breach Notification and Obligations 10.1. The Breach or potential compromise of Data shared under this Contract must be reported to the HCA Privacy Officer at PrivacyOfficer(a-),hca.wa.4ov within one (1) business day of discovery. 10.2. If the Breach or potential compromise of Data includes PHI, and the Contractor does not have full details, it will report what information it has and provide full details within 15 business days of discovery. To the extent possible, these reports must include the following: a. The identification of each individual whose PHI has been or may have been improperly accessed, acquired, used, or disclosed; b. The nature of the unauthorized Use or disclosure, including a brief description of what happened, the date of the event(s), and the date of discovery; c. A description of the types of PHI involved; Washington State Health Care Authority Page 12 HCA Contract No. K5885-1