Privacy Act of 1974 EGovernance Act of 2002 Patient Protection and Affordable Care Act of 2010 Safeguards for Protecting Federal Tax Returns and return Information (26 U.S.C. 6103 and related provitions) 155.260 HHS ACA Final Rule Hosted System Requirements This section is included if the best option is for the system to be hosted at a site other than at Covered California. A selected vendor shall be required to agree to terms acceptable to Covered California regarding the confidentiality and security of Covered California data. These terms may vary depending on the nature of the data to be stored by the Contractor. If applicable, Covered California may require compliance with Covered California MARS- E and NIST 800-53 security standards, IRS requirements, HIPAA, HITECH and/or FISMA compliance and/or compliance with State law relating to the privacy of personally identifiable information. Further, a selected vendor hosting a Covered California system may be a collector” “data for purposes of Covered California law and shall be required to (i) comply with certain data breach notification requirements; and (ii) indemnify Covered California for any third party claims against Covered California which may occur as a result of any data breach. The selected Vendor must agree to host Covered California’s solution within the continental United States of America. Covered California reserves the right to periodically audit the Contractor (or subcontractor) application infrastructure to ensure physical and network infrastructure meets the configuration and security standards and adheres to relevant Covered California policies governing the system. Covered California reserves the to run non-intrusive network audits (basic port scans, etc.) randomly, without prior notice. More intrusive network and physical audits may be conducted on or off site with 24 hours’ notice. The Contractor will have a party perform methodology-based (such as OSSTM) penetration testing quarterly and will report the results of that testing to Covered California. A selected vendor shall agree to cause an SSAE 16 Type II audit certification to be conducted annually. The audit results and the Contractor’s plan for addressing or resolution of the audit results shall be shared with Covered California. A selected vendor shall agree to terms acceptable to Covered California regarding system backup, disaster recovery planning and access to Covered California data. A selected vendor shall be required to agree to disclose the hosting provider which shall be acceptable to Covered California for purposes of the data to be stored and shall not change the hosting provider without the prior written consent of Covered California.
Privacy Act of 1974 EGovernance Act of 2002 Patient Protection and Affordable Care Act of 2010 Safeguards for Protecting Federal Tax Returns and return Information (26 U.S.C. 6103 and related provitions) 155.260 HHS ACA Final Rule Hosted System Requirements This section is included if the best option is for the system to be hosted at a site other than at Covered California. A selected vendor shall be required to agree to terms acceptable to Covered California regarding the confidentiality and security of Covered California data. These terms may vary depending on the nature of the data to be stored by the Contractor. If applicable, Covered California may require compliance with Covered California MARS- E and NIST 800-53 security standards, IRS requirements, HIPAA, HITECH and/or FISMA compliance and/or compliance with State law relating to the privacy of personally identifiable information. Further, a selected vendor hosting a Covered California system may be a “data collector” for purposes of Covered California law and shall be required to (i) comply with certain data breach notification requirements; and (ii) indemnify Covered California for any third party claims against Covered California which may occur as a result of any data breach. The selected Vendor must agree to host Covered California’s solution within the continental United States of America. Covered California reserves the right to periodically audit the Contractor (or subcontractor) application infrastructure to ensure physical and network infrastructure meets the configuration and security standards and adheres to relevant Covered California policies governing the system. Covered California reserves the to run non-intrusive network audits (basic port scans, etc.) randomly, without prior notice. More intrusive network and physical audits may be conducted on or off site with 24 hours’ notice. The Contractor will have a party perform methodology-based (such as OSSTM) penetration testing quarterly and will report the results of that testing to Covered California. A selected vendor shall agree to cause an SSAE 16 Type II audit certification to be conducted annually. The audit results and the Contractor’s plan for addressing or resolution of the audit results shall be shared with Covered California. A selected vendor shall agree to terms acceptable to Covered California regarding system backup, disaster recovery planning and access to Covered California data. A selected vendor shall be required to agree to disclose the hosting provider which shall be acceptable to Covered California for purposes of the data to be stored and shall not change the hosting provider without the prior written consent of Covered California.
2013-08%20Clinical%20and%20Network%20Analytics%20-%20DRAFT%20RFP.docx