assigned to the project prior to providing access to PHI. Must take reasonable industry recognized methods to secure the system from un-authorized access (e.g., NIST 800-53 rev4 II.P Design, Development, found at and Implementation (DDI) nistpubs/SpecialPublications/ – Privacy and Security NIST.SP.800-53Ar4.pdf). II.P Design, Development, and Implementation (DDI) Must de-identify data for testing – Privacy and Security purposes. Must de-identify data and maintain II.P Design, Development, the value of the data without and Implementation (DDI) compromising the ability to run – Privacy and Security analytics and applications. Must provide a third party cyber security assessment to execute a security audit prior to go-live. The selected third party assessor must work with the State Office of II.P Design, Development, Information Security and provide and Implementation (DDI) reports to the DHHS IT Security – Privacy and Security Administrator. Must develop an implementation and contingency plan documenting: The Contractor’s plan and milestones for implementation of the approved system and operations as applicable. Risks and contingency plans for mitigating and addressing risks during the implementation. II.Q Design, Development, resolution process. and Implementation (DDI) – The staff, tasks and Implementation and sequence of go-live Contingency
assigned to the project prior to providing access to PHI. II.P Design, Development, and Implementation (DDI) – Privacy and Security Must take reasonable industry recognized methods to secure the system from un-authorized access (e.g., NIST 800-53 rev4 found at nistpubs/SpecialPublications/ NIST.SP.800-53Ar4.pdf). II.P Design, Development, and Implementation (DDI) – Privacy and Security Must de-identify data for testing purposes. II.P Design, Development, and Implementation (DDI) – Privacy and Security Must de-identify data and maintain the value of the data without compromising the ability to run analytics and applications. II.P Design, Development, and Implementation (DDI) – Privacy and Security Must provide a third party cyber security assessment to execute a security audit prior to go-live. The selected third party assessor must work with the State Office of Information Security and provide reports to the DHHS IT Security Administrator. II.Q Design, Development, and Implementation (DDI) – Implementation and Contingency Must develop an implementation and contingency plan documenting: The Contractor’s plan and milestones for implementation of the approved system and operations as applicable. Risks and contingency plans for mitigating and addressing risks during the implementation. resolution process. The staff, tasks and sequence of go-live