Must inform the of any potential, suspected, or confirmed IV.M Operations - breach immediately upon Privacy and Security Contractor becoming aware. Must provide initial and ongoing privacy and security training to all employees and contract personnel IV.M Operations Phase - assigned to the project prior to Privacy and Security providing access to PHI. Must take reasonable industry recognized methods to secure the system from un-authorized access (e.g., NIST 800-53 rev4 at IV.M Operations Phase - nistpubs/SpecialPublications/ Privacy and Security NIST.SP.800-53Ar4.pdf). IV.M Operations Phase - Privacy and Security Must de-identify data for testing. Must de-identify data and maintain the value of the data without IV.M Operations Phase - compromising the ability to run Privacy and Security analytics and applications. Must submit an annual independent security audit each operations contract year. The audit must cover its internal controls and other system functions within the Contractor’s span of control. The IV.M Operations Phase - cost of the audit must be borne by Privacy and Security the Contractor, not the State. Must provide an copy of the annual independent security audit report within thirty (30) days of completion. The State will use the findings and recommendations of IV.M Operations Phase - each report as part of its Privacy and Security monitoring process. Must deliver to the State a corrective action plan to address IV.M Operations Phase - deficiencies identified during the Privacy and Security audit process within a maximum of
IV.M Operations - Privacy and Security Must inform the of any potential, suspected, or confirmed breach immediately upon Contractor becoming aware. IV.M Operations Phase - Privacy and Security Must provide initial and ongoing privacy and security training to all employees and contract personnel assigned to the project prior to providing access to PHI. IV.M Operations Phase - Privacy and Security Must take reasonable industry recognized methods to secure the system from un-authorized access (e.g., NIST 800-53 rev4 at nistpubs/SpecialPublications/ NIST.SP.800-53Ar4.pdf). IV.M Operations Phase - Privacy and Security Must de-identify data for testing. IV.M Operations Phase - Privacy and Security Must de-identify data and maintain the value of the data without compromising the ability to run analytics and applications. IV.M Operations Phase - Privacy and Security Must submit an annual independent security audit each operations contract year. The audit must cover its internal controls and other system functions within the Contractor’s span of control. The cost of the audit must be borne by the Contractor, not the State. IV.M Operations Phase - Privacy and Security Must provide an copy of the annual independent security audit report within thirty (30) days of completion. The State will use the findings and recommendations of each report as part of its monitoring process. IV.M Operations Phase - Privacy and Security Must deliver to the State a corrective action plan to address deficiencies identified during the audit process within a maximum of