HomeMy WebLinkAboutAgreement A-16-493 with DHCS Performance.pdfCounty of Fresno
16-93111
Page 1
Exhibit A
Program Specifications
1. Service Overview
The California Department of Health Care Services (hereafter referred to as DHCS or
Department) administers the Mental Health Services Act, Projects for Assistance in
Transition from Homelessness (PATH) and Community Mental Health Services Grant
(MHBG) programs and oversees county provision of community mental health services
provided with realignment funds. Contractor (hereafter referred to as County in this Exhibit)
must meet certain conditions and requirements to receive funding for these programs and
community mental health services. This Agreement, which is County’s performance
contract, as required by Welfare and Institutions Code (W&I) sections 5650(a), 5651, 5666
5897, and Title 9, California Code of Regulations (CCR), section 3310, sets forth conditions
and requirements that County must meet in order to receive this funding. This Agreement
does not cover federal financial participation or State general funds as they relate to Medi-
Cal services provided through the Mental Health Plan Contracts. County agrees to comply
with all of the conditions and requirements described herein.
DHCS shall monitor this Agreement to ensure compliance with applicable federal and State
law and applicable regulations. (Government Code sections 11180-11182; W&I §§ 5614,
5651(c), 5717(b), 14124.2(a))
2. Service Location
The services shall be performed at appropriate sites as described in this contract.
3. Service Hours
The services shall be provided during times required by this contract.
4. Project Representatives
A. The project representatives during the term of this Agreement will be:
Department of Health Care Services
Contract Manager: Erika Cristo
Telephone: (916) 552-9055
Fax: (916) 440-7620
Email: Erika.Cristo@dhcs.ca.gov
Contractor Name
Contract Manager: Dawan Utecht
Telephone: (559) 600-9193
Fax: (559) 600-7674
Email: dutecht@co.fresno.ca.us
B. Direct all inquiries to:
County of Fresno
16-93111
Page 2
Exhibit A
Program Specifications
Department of Health Care Services
Mental Health Services
Division/Program Policy Unit
Attention: Guy Stewart
1500 Capitol Avenue, MS 2702
P.O. Box Number 997413
Sacramento, CA, 95899-7413
Telephone: (916) 449-5997Fax: (916)
440-7620
Email: Guy.Stewart@dhcs.ca.gov
Contractor’s Name
Attention: Dawan Utecht
4441 E. Kings Canyon
Fresno, CA 93702
Telephone: (559) 600-9193
Fax: (559) 600-7674
Email: dutecht@co.fresno.ca.us
C. Either party may make changes to the information above by giving written notice to the
other party. Said changes shall not require an amendment to this Agreement.
5. Services to be Performed
County shall adhere to the program principles and, to the extent funds are available,
County shall provide the array of treatment options in accordance with Welfare and
Institutions Code sections 5600.2 through 5600.9, inclusive.
A. GENERAL REQUIREMENTS FOR AGREEMENT
County shall comply with all of the requirements in Section A.1 of this Provision for all
County mental health programs, including those specified in Sections B, C and D.
County shall comply with all of the data and information reporting requirements in
Section A.2 for each County mental health program, including those specified in
Sections B, C and D of this Provision, for which it receives federal or State funds.
1) W&I section 5651 provides specific assurances, which are listed below, that must be
included in this Agreement. County shall:
a. Comply with the expenditure requirements of W&I Section 17608.05,
b. Provide services to persons receiving involuntary treatment as required by Part 1
(commencing with Section 5000) and Part 1.5 (commencing with Section 5585)
of Division 5 of the Welfare and Institution Code,
c. Comply with all of the requirements necessary for Medi–Cal reimbursement for
mental health treatment services and case management programs provided to
Medi-Cal eligible individuals, including, but not limited to, the provisions set forth
in Chapter 3 (commencing with Section 5700) of the Welfare and Institutions
Code, and submit cost reports and other data to DHCS in the form and manner
determined by the DHCS,
County of Fresno
16-93111
Page 3
Exhibit A
Program Specifications
d. Ensure that the Local Mental Health Advisory Board has reviewed and approved
procedures ensuring citizen and professional involvement at all stages of the
planning process pursuant to W&I section 5604.2,
e. Comply with all provisions and requirements in law pertaining to patient rights,
f. Comply with all requirements in federal law and regulation pertaining to federally
funded mental health programs,
g. Provide all data and information set forth in Sections 5610 and 5664 of the
Welfare and Institutions Code,
h. If the County elects to provide the services described in Chapter 2.5
(commencing with Section 5670) of Division 5 of the Welfare and Institution
Code, comply with guidelines established for program initiatives outlined in this
chapter, and
i. Comply with all applicable laws and regulations for all services delivered,
including all laws, regulations, and guidelines of the Mental Health Services Act.
2) County shall comply with all data and information submission requirements specified
in this Agreement.
a. County shall provide all applicable data and information required by federal
and/or State law in order to receive any funds to pay for its mental health
programs and services, including but not limited to its MHSA programs, PATH
grant (if the County receives funds from this grant) or MHBG grant. These
federal and State laws include, Title 42, United States Code, sections 290cc-21
through 290cc-35 and 300x through 300x-9, inclusive, W&I sections 5610 and
5664 and the regulations that implement, interpret or make specific, these federal
and State laws and any DHCS-issued guidelines that relate to the programs or
services.
b. County shall comply with the reporting requirements set forth in W&I section
5845(d)(6 ), Division 1 of Title 9 of the California Code of Regulations (CCR) and
any other reporting requirements related to the County’s receipt of federal or
State funding for mental health programs. County shall submit complete and
accurate information to DHCS, and as applicable the Mental Health Services
Oversight and Accountability Commission, including, but not limited, to the
following:
i. Client and Service Information (CSI) System Data (See Subparagraph c of
this Paragraph)
ii. MHSA Quarterly Progress Reports, as specified in Title 9, CCR, section
3530.20. MHSA Quarterly Progress Reports provide the actual number of
County of Fresno
16-93111
Page 4
Exhibit A
Program Specifications
clients served by MHSA-funded program. Reports are submitted on a
quarterly basis.
iii. Full Service Partnership Performance Outcome data, as specified in Title 9,
CCR, section 3530.30.
iv. Consumer Perception Survey data, as specified in Title 9, CCR, section
3530.40.
v. The Annual Mental Health Services Act Revenue and
Expenditure Report, as specified in W&I section 5899(a) and Title 9, CCR,
sections 3510, 3510.010, 3510.020 and DHCS-issued guidelines.
vi. Innovative Project Reports (annual, final and supplements), as specified in
title 9, CCR, sections 3580-3580.020.
vii. The Annual Prevention and Early Intervention report, as specified in Title 9,
CCR, sections 3560 and 3560.010.
viii. Three Year Program and Evaluation Reports, as specified in Title 9, CCR,
sections 3560 and 3560.020.
c. County shall submit CSI data to DHCS, in accordance with the requirements set
forth in DHCS’ CSI Data Dictionary. County shall:
i. Report monthly CSI data to DHCS within 60 calendar days after the end of
the month in which services were provided.
ii. Report within 60 calendar days or be in compliance with an approved plan of
correction the DHCS’s CSI Unit.
iii. Make diligent efforts to minimize errors on the CSI error file.
iv. Notify DHCS 90 calendar days prior to any change in reporting system and/or
change of automated system vendor.
d. In the event that DHCS or County determines that, due to federal or state law
changes or business requirements, an amendment is needed of either County’s
or DHCS’ obligations under this contract relating to either DHCS’ or County’s
information needs both DHCS and County agree to provide notice to the other
party as soon as practicable prior to implementation. This notice shall include
information and comments regarding the anticipated requirements and impacts of
the projected changes. DHCS and County agree to meet and discuss the
design, development, and costs of the anticipated changes prior to
implementation.
County of Fresno
16-93111
Page 5
Exhibit A
Program Specifications
e. If applicable to a specific federal or State funding source covered by this
Agreement, County shall require each of its subcontractors to submit a fiscal
year-end cost report to DHCS no later than December 31 following the close of
the fiscal year, in accordance with applicable federal and State laws, regulations,
and DHCS-issued guidelines.
f. If applicable to a specific federal or State funding source covered by this
Agreement, County shall comply with W&I section 5751.7 and ensure that minors
are not admitted into inpatient psychiatric treatment with adults. If the health
facility does not have specific separate housing arrangements, treatment staff,
and treatment programs designed to serve children or adolescents it must
request a waiver of this requirement from DHCS as follows:
i. If this requirement creates an undue hardship on County, County may request
a waiver of this requirement. County shall submit the waiver request on
Attachment I of this Agreement, to DHCS.
ii. DHCS shall review County’s waiver request and provide a written notice of
approval or denial of the waiver. If County’s waiver request is denied, County
shall comply with the provision of W&I section 5751.7.
iii. County shall submit, the waiver request to DHCS at the time County submits
this Agreement, signed by County, to DHCS for execution. County shall
complete Attachment I, including responses to items 1 through 4 and attach it
to this Agreement. See Exhibit A, Attachment I, entitled “Request For Waiver”
of this Agreement for additional submission information.
Execution of this Agreement by DHCS shall not constitute approval of a
waiver submitted pursuant to this section.
Any waiver granted in the prior fiscal year’s contract shall be deemed to
continue until either party chooses to discontinue it. Execution of this contract
shall continue independently of the waiver review and approval process.
iv. In unusual or emergency circumstances, when County needs to request
waivers after the annual Performance Contract has been executed, these
requests should be sent immediately to: Licensing and Certification Section,
Program Oversight and Compliance Branch, California Department of Health
Care Services, P.O. Box 997413, MS 2703, Sacramento, CA 95899-7413,
Phone: (916) 319-0985.
v. Each admission of a minor to a facility that has an approved waiver shall be
reported to the Local Mental Health Director.
g. If County chooses to participate in the Assisted Outpatient Treatment program
(AOT) Demonstration Project Act of 2002 it shall be required to comply with all
applicable statutes including, but not limited to, W&I sections 5345 through
County of Fresno
16-93111
Page 6
Exhibit A
Program Specifications
5349.5, inclusive. In addition, County shall submit to DHCS any documents that
DHCS requests as part of its statutory responsibilities in accordance with DMH
Letter No.: 03-01 dated March 20, 2003.
h. For all mental health funding sources received by County that require submission
of a cost report, County shall submit a fiscal year-end cost report by December
31st following the close of the fiscal year in accordance with applicable federal
and State law, regulations and DHCS-issued guidelines. (W&I section 5705, 9
CCR sections 3500, 3505). The cost report shall be certified as true and correct,
by the mental health director and one of the following: the County mental health
departments chief financial officer (or equivalent), and individual who has
delegated authority to sign for, and reports directly to the county mental health
department’s chief financial officer (or equivalent), or the county’s auditor-
controller (or equivalent). Data submitted shall be full and complete. The County
shall also submit a reconciled cost report certified by the mental health director
and the county’s auditor-controller as being true and correct no later than 18
months after the close of the following fiscal year.
If the County does not submit the cost reports by the reporting deadlines or does
not meet the other requirements, DHCS shall request a plan of correction with
specific timelines (W&I §5897 (d)). If County does not submit cost reports by the
reporting deadlines or the County does not meet the other requirements, DHCS
may, after a hearing held with no less than 20 days-notice to the county mental
health director (W&I § 5655) withhold payments from the MHS Fund until the
County is in compliance with W&I section 5664.
B. THE MENTAL HEALTH SERVICES ACT PROGRAM
1) Program Description
Proposition 63, which created the Mental Health Services Act (MHSA), was
approved by the voters of California on November 2, 2004. The Mental Health
Services (MHS) Fund, which provides funds to counties for the implementation of its
MHSA programs, was established pursuant to W&I section 5890. The MHSA was
designed to expand California’s public mental health programs and services through
funding received by a one percent tax on personal incomes in excess of $1 million.
Counties use this funding for projects and programs for prevention and early
intervention, community services and supports, workforce development and training,
innovation, plus capital facilities and technological needs through mental health
projects and programs. The State Controller distributes MHS Funds to the counties
to plan for and provide mental health programs and other related activities outlined
in a county’s three-year program and expenditure plan or annual update. MHS
Funds are distributed by the State Controller’s Office to the counties on a monthly
basis.
County of Fresno
16-93111
Page 7
Exhibit A
Program Specifications
DHCS shall monitor County’s use of MHS Funds to ensure that the county meets the
MHSA and MHS Fund requirements. (Government Code sections 11180-11182;
W&I §§ 5614, 5651(c), 5717(b), 14124.2(a))
2) Issue Resolution Process
County shall have an Issue Resolution Process (Process) to handle client disputes
related to the provision of their mental health services. The Process shall be
completed in an expedient and appropriate manner. County shall develop a log to
record issues submitted as part of the Process. The log shall contain the date the
issue was received; a brief synopsis of the issue; the final issue resolution outcome;
and the date the final issue resolution was reached.
3) Revenue and Expenditure Report
County shall submit its Revenue and Expenditure Report (RER) by December 31st
following the close of the fiscal year in accordance with W&I sections 5705 and
5899, regulations and DHCS-issued guidelines. The RER shall be certified by the
mental health director and the County’s auditor-controller (or equivalent), using the
DHCS-issued certification form. Data submitted shall be full and complete.
If County does not submit the RER by the reporting deadlines or the RER does not
meet the requirements, DHCS shall request a plan of correction with specific
timelines. (W&I § 5897(d)) If the RER is not timely submitted, or does not meet the
requirements, DHCS may, after a hearing held with no less than 20 days- notice to
the county mental health director withhold payments from the MHS Fund until the
County submits a complete RER. (WIC 5655, 9 CCR 3510(c))
4) Distribution and Use of Local Mental Health Services Funds:
a. W&I section 5891(c) provides that commencing July 1, 2012 on or before the
15th day of each month, pursuant to a methodology provided by DHCS, the State
Controller shall distribute to County’s Local Mental Health Services Fund (MHS
Fund), established by County pursuant to W&I section 5892(f), all unexpended
and unreserved funds on deposit as of the last day of the prior month in the
Mental Health Services Fund for the provision of specified programs and other
related activities.
b. County shall allocate the monthly Local MHS Fund in accordance with W&I
section 5892 as follows :
i. Twenty percent of the funds shall be used for prevention and early
intervention (PEI) programs in accordance with W&I section 5840. The
expenditure for PEI may be increased by County if DHCS determines that the
increase will decrease the need and cost for additional services to severely
mentally ill persons in County by an amount at least commensurate with the
proposed increase.
County of Fresno
16-93111
Page 8
Exhibit A
Program Specifications
ii. The balance of funds shall be distributed to County’s mental health programs
for services to persons with severe mental illnesses pursuant to Part 4 of
Division 5 of the W&I,(commencing with Section 5850), for the children’s
system of care and Part 3 of Division 5 of the Welfare and Institutions Code
(commencing with Section 5800), for the adult and older adult system of care.
iii. Five percent of the total funding for the County’s mental health programs
established pursuant to Part 3 of Division 5 of the W&I (commencing with
Section 5800), Part 3.6 of Division 5 of the W&I (commencing with Section
5840), and Part 4 of Division 5 of the W&I (commencing with Section 5850)
shall be utilized for innovative programs in accordance with W&I sections
5830, 5847 and 5848.
iv. Programs for services pursuant to Part 3 of Division 5 of the W&I
(commencing with Section 5800), and Part 4 of Division 5 of the W&I
(commencing with Section 5850) may include funds for technological needs
and capital facilities, human resource needs, and a prudent reserve to ensure
services do not have to be significantly reduced in years in which revenues
are below the average of previous years. The total allocation for these
purposes shall not exceed 20 percent of the average amount of funds
allocated to County for the previous five years.
v. Allocations in Subparagraphs i. through iii. above, include funding for annual
planning costs pursuant to W&I section 5848. The total of these costs shall
not exceed five percent of the total annual revenues received for the Local
MHS Fund. The planning costs shall include moneys for County’s mental
health programs to pay for the costs of having consumers, family members,
and other stakeholders participate in the planning process and for the
planning and implementation required for private provider contracts to be
significantly expanded to provide additional services.
c. County shall use Local MHS Fund monies to pay for those portions of the mental
health programs/services for children and adults for which there is no other
source of funds available. (W&I §§ 5813.5(b), 5878.3(a) and 9 CCR 3610(d)).
d. County shall only use Local MHS Funds to expand mental health services. These
funds shall not be used to supplant existing state or county funds utilized to
provide mental health services. These funds shall only be used to pay for the
programs authorized in W&I section 5892. These funds may not be used to pay
for any other program and may not be loaned to County’s general fund or any
other County fund for any purpose. (W&I § 5891(a))
e. All expenditures for County mental health programs shall be consistent with a
currently approved three-year program and expenditure plan or annual update
pursuant to W&I section 5847. (W&I § 5892(g))
5) Three-Year Program and Expenditure Plan and Annual Updates:
County of Fresno
16-93111
Page 9
Exhibit A
Program Specifications
a. County shall prepare and submit a three-year program and expenditure plan, and
annual updates, adopted by County’s Board of Supervisors, to the Mental Health
Services Oversight and Accountability Commission (MHSOAC) within 30
calendar days after adoption. (W&I § 5847 (a)) The three-year program and
expenditure plan and annual updates shall include all of the following:
i. A program for Prevention and Early Intervention (PEI) in accordance with Part
3.6 of Division 5 of the Welfare and Institutions Code (commending with
Section 5840). (W&I § 5847 (b)(1))
ii. A program for services to children in accordance with Part 4 of Division 5 of
the Welfare and Institutions Code (commencing with Section 5850), to include
a wraparound program pursuant to Chapter 4 of Part 6 of Division 9 of the
Welfare and Institutions Code (commencing with Section 18250), or provide
substantial evidence that it is not feasible to establish a wraparound program
in the County. (W&I § 5847 (b)(2))
iii. A program for services to adults and seniors in accordance with Part 3 of
Division 5 of the Welfare and Institutions Code (commencing with Section
5800). (W&I § 5847 (b)(3))
iv. A program for innovations in accordance with Part 3.2 of Division 5 of the
Welfare and Institutions Code (commencing with Section 5830). (W&I § 5847
(b)(4)) Counties shall expend funds for their innovation programs upon
approval by the Mental Health Services Oversight and Accountability
Commission.
v. A program for technological needs and capital facilities needed to provide
services pursuant to Part 3 of Division 5 of the Welfare and Institutions Code
(commencing with Section 5800), Part 3.6 of Division 5 of the Welfare and
Institutions Code (commencing with Section 5840), and Part 4 of Division 5 of
the Welfare and Institutions Code (commencing with Section 5850). All plans
for proposed facilities with restrictive settings shall demonstrate that the
needs of the people to be served cannot be met in a less restrictive or more
integrated setting. (W&I § 5847 (b)(5))
vi. Identification of shortages in personnel to provide services pursuant to the
above programs and the additional assistance needed from the education and
training programs established pursuant to Part 3.1 of Division 5 of the Welfare
and Institutions Code (commencing with Section 5820) and Title 9, CCR,
section 3830(b). (W&I § 5847 (b)(6))
vii. Establishment and maintenance of a prudent reserve to ensure the County
program will continue to be able to serve children, adults, and seniors that it is
currently serving pursuant to Part 3 of Division 5 of the Welfare and
Institutions Code (commencing with Section 5800), Part 3.6 of Division 5 of
County of Fresno
16-93111
Page 10
Exhibit A
Program Specifications
the Welfare and Institutions Code (commencing with Section 5840), and Part
4 of Division 5 of the Welfare and Institutions Code (commencing with Section
5850), during years in which revenues for the MHS Fund are below recent
averages adjusted by changes in the state population and the California
Consumer Price Index. (W&I § 5847 (b)(7))
viii. Certification by County’s mental health director, which ensures that County
has complied with all pertinent regulations, laws, and statutes of the MHSA,
including stakeholder participation and non-supplantation requirements. (W&I
§ 5847 (b)(8))
ix. Certification by County’s Mental Health Director and County’s Auditor-
Controller that the County has complied with any fiscal accountability
requirements as directed by DHCS, and that all expenditures are consistent
with the requirements of the MHSA. (W&I § 5847 (b)(9))
b. County shall include services in the programs described in Subparagraphs 5.a.i.
through 5.a.v., inclusive, to address the needs of transition age youth between
the ages of 16 and 25 years old, including the needs of transition age foster
youth. (W&I § 5847(c))
c. County shall prepare expenditure plans for the programs described in
Subparagraphs 5.a.i. through 5.a.v., inclusive, and annual expenditure updates.
Each expenditure plan update shall indicate the number of children, adults, and
seniors to be served, and the cost per person. (W&I § 5847(e))
d. County’s three-year program and expenditure plan and annual updates shall
include reports on the achievement of performance outcomes for services
provided pursuant to the Adult and Older Adult Mental Health System of Care
Act, Prevention and Early Intervention, and the Children’s Mental Health Services
Act, which are funded by the MHS Fund and established jointly by DHCS and the
MHSOAC, in collaboration with the California Mental Health Director’s
Association (W&I § 5848(c)) County contracts with providers shall include the
performance goals from the County’s three-year program and expenditure plan
and annual updates that apply to each provider’s programs and services.
e. County’s three-year program and expenditure plan and annual update shall
consider ways to provide services that are similar to those established pursuant
to the Mentally Ill Offender Crime Reduction Grant Program. Funds shall not be
used to pay for persons incarcerated in state prison or parolees from state
prisons. (W&I § 5813.5(f))
6) Planning Requirements and Stakeholder Involvement:
a. County shall develop its three-year program and expenditure plan and annual
update with local stakeholders, including adults and seniors with severe mental
illness, families of children, adults, and seniors with severe mental illness,
County of Fresno
16-93111
Page 11
Exhibit A
Program Specifications
providers of services, law enforcement agencies, education, social services
agencies, veterans, representatives from veterans organizations, providers of
alcohol and drug services, health care organizations, and other important
interests. Counties shall demonstrate a partnership with constituents and
stakeholders throughout the process that includes meaningful stakeholder
involvement on mental health policy, program planning, and implementation,
monitoring, quality improvement, evaluation, and budget allocations. County
shall prepare and circulate a draft plan and update for review and comment for at
least 30 calendar days to representatives of stakeholder interests and any
interested party who has requested a copy of the draft plans. (W&I § 5848(a))
b. County’s mental health board, established pursuant to W&I section 5604, shall
conduct a public hearing on the County’s draft three-year program and
expenditure plan and annual updates at the close of the 30 calendar day
comment period. Each adopted three-year program and expenditure plan or
annual update shall summarize and analyze substantive recommendations and
describe substantive changes to the three-year program and expenditure plan
and annual updates. The County’s mental health board shall review the adopted
three-year program and expenditure plan and annual updates and make
recommendations to County’s mental health department for amendments. (W&I §
5848(b) and Title 9, CCR, § 3315)
7) County Requirements for Handling MHSA Funds
a. County shall place all funds received from the State MHS Fund into a Local
MHS Fund. The Local MHS Fund balance shall be invested consistent with
other County funds and the interest earned on the investments shall be
transferred into the Local MHS Fund. (W&I § 5892(f))
b. The earnings on investment of these funds shall be available for distribution
from the fund in future years. (W&I § 5892 (f))
c. Other than funds placed in a reserve in accordance with an approved plan, any
funds allocated to County which it has not spent for the authorized purpose
within the three years shall revert to the State. County may retain MSHA Funds
for capital facilities, technological needs, or education and training for up to 10
years before reverting to the State. (W&I § 5892(h))
d. When accounting for all receipts and expenditures of MHSA funds, County must
adhere to uniform accounting standards and procedures that conform to the
Generally Accepted Accounting Principles (GAAP), as prescribed by the State
Controller in Title 2, CCR, Div. 2, Ch. 2, Subchapter 1, Accounting Procedures
for Counties, sections 901-949, and a manual, which is currently entitled
“Accounting Standards and Procedures for Counties” and available at
http://www.sco.ca.gov/pubs_guides.html. (Government Code section 30200)
8) Department Compliance Investigations:
County of Fresno
16-93111
Page 12
Exhibit A
Program Specifications
DHCS may investigate County’s performance of the Mental Health Services Act
related provisions of this Agreement and compliance with the provisions of the
Mental Health Services Act, and relevant regulations. In conducting such an
investigation DHCS may inspect and copy books, records, papers, accounts,
documents and any writing as defined by Evidence Code Section 250 that is
pertinent or material to the investigation of the County. For purposes of this
Paragraph “provider” means any person or entity that provides services, goods,
supplies or merchandise, which are directly or indirectly funded pursuant to MHSA.
(Gov. Code §§ 11180, 11181, 11182 and W&I Code § 14124.2)
9) County Breach, Plan of Correction and Withholding of State Mental Health Funds:
a. If DHCS determines that County is out-of-compliance with the Mental Health
Services Act related provisions of this Agreement, DHCS may request that
County submit a plan of correction, including a specific timeline to correct the
deficiencies, to DHCS. (W&I § 5897(d))
b. In accordance with Welfare and Institutions Code Section 5655, if DHCS
considers County to be substantially out-of-compliance with any provision of the
Mental Health Services Act or relevant regulations, including all reporting
requirements, the director shall order County to appear at a hearing before the
Director or the Director’s designee to show cause why the Department should not
take administrative action. County shall be given at least twenty (20) days notice
before the hearing.
c. If the Director determines that there is or has been a failure, in a substantial
manner, on the part of County to comply with any provision of the W&I code or its
implementing regulations, and that administrative sanctions are necessary, the
Department may invoke any, or any combination of, the following sanctions:
1) Withhold part or all state mental health funds from County.
2) Require County to enter into negotiations with DHCS to agree on a plan for
County to address County’s non-compliance. (W&I § 5655.)
C. PROJECTS FOR ASSISTANCE IN TRANSITION FROM HOMELESSNESS (PATH)
PROGRAM (Title 42, United States Code, sections 290cc-21 through 290cc-35,
inclusive)
Pursuant to Title 42, United State Code, sections 290cc-21 through 290cc-35,
inclusive, the State of California has been awarded federal homeless funds through
the federal McKinney Projects for Assistance in Transition from Homelessness
(PATH) formula grant. The PATH grant funds community based outreach, mental
health and substance abuse referral/treatment, case management and other support
services, as well as a limited set of housing services for the homeless mentally ill.
County of Fresno
16-93111
Page 13
Exhibit A
Program Specifications
While county mental health programs serve thousands of homeless persons with
realignment funds and other local revenues, the PATH grant augments these
programs by providing services to approximately 8,300 additional persons annually.
The county determines its use of PATH funds based on county priorities and needs.
If County wants to receive PATH funds, it shall submit its Request for Application
(RFA) responses and required documentation specified in DHCS’ RFA. County shall
complete its RFA responses in accordance with the instructions, enclosures and
attachments available on the DHCS website at:
http://www.dhcs.ca.gov/services/MH/Pages/PATH.aspx.
If County applied for and DHCS approved its request to receive PATH grant funds,
the RFA, County’s RFA responses and required documentation, and DHCS’
approval constitute provisions of this Agreement and are incorporated by reference
herein. County shall comply with all provisions of the RFA and the County’s RFA
responses in order to receive its PATH grant funds.
D. COMMUNITY MENTAL HEALTH SERVICES GRANT (MHBG) PROGRAM (Title 42,
United States Code section 300x-1 et seq.)
DHCS awards federal Community Mental Health Services Block Grant funds (known
as Mental Health Block Grant (MHBG)) to counties in California. The county mental
health agencies provide a broad array of mental health services within their mental
health system of care (SOC) programs. These programs provide services to the
following target populations: children and youth with serious emotional disturbances
(SED) and adults and older adults with serious mental illnesses (SMI).
The MHBG funds provide the counties with a stable, flexible, and non-categorical
funding base that the counties can use to develop innovative programs or augment
existing programs within their SOC. The MHBG funds also assist the counties in
providing an appropriate level of community mental health services to the most
needy individuals in the target populations who have a mental health diagnosis,
and/or individuals who have a mental health diagnosis with a co-occurring substance
abuse disorder.
If County wants to receive MHBG funds, it shall submit its RFA responses and
required documentation specified in DHCS’ RFA. County shall complete its RFA
responses in accordance with the instructions, enclosures and attachments available
on the DHCS website at:
http://www.dhcs.ca.gov/services/MH/Pages/MHBG.aspx.
If County applied for and DHCS approved its request to receive MHBG grant funds,
the RFA, County’s RFA responses and required documentation, and DHCS’
approval constitute provisions of this Agreement and are incorporated by reference
herein. County shall comply with all provisions of the RFA and the County’s RFA
responses in order to receive its MHBG grant funds.
County of Fresno
16-93111
Page 14
Exhibit A
Program Specifications
E. SPECIAL TERMS AND CONDITIONS
1. Audit and Record Retention
(Applicable to agreements in excess of $10,000)
a. County and/or Subcontractor(s) shall maintain books, records, documents, and
other evidence, accounting procedures and practices, sufficient to properly
support all direct and indirect costs of whatever nature claimed to have been
incurred in the performance of this Agreement, including any matching costs and
expenses. The forgoing constitutes “records” for the purpose of this provision.
b. County’s and/or Subcontractor’s facility or office or such part thereof as may be
engaged in the performance of this Agreement and his/her records shall be
subject at all reasonable times to inspection, audit, and reproduction.
c. County agrees that DHCS, the Department of General Services, the Bureau of
State Audits, or their designated representatives including the Comptroller
General of the United States shall have the right to review and copy any records
and supporting documentation pertaining to the performance of this Agreement.
County agrees to allow the auditor(s) access to such records during normal
business hours and to allow interviews of any employees who might reasonably
have information related to such records. Further, County agrees to include a
similar right of the State to audit records and interview staff in any subcontract
related to performance of this Agreement.
d. County and/or Subcontractor(s) shall preserve and make available his/her
records (1) for a period of three years from the date of final payment under this
Agreement, and (2) for such longer period, if any, as is required by applicable
statute, by any other provision of this Agreement, or by subparagraphs (1) or (2)
below.
1) If this Agreement is completely or partially terminated, the records relating
to the work terminated shall be preserved and made available for a period
of three years from the date of any resulting final settlement.
2) If any litigation, claim, negotiation, audit, or other action involving the
records has been started before the expiration of the three-year period,
the records shall be retained until completion of the action and resolution
of all issues which arise from it, or until the end of the regular three-year
period, whichever is later.
e. County and/or Subcontractor(s) shall comply with the above requirements and
be aware of the penalties for violations of fraud and for obstruction of
investigation as set forth in Public Contract Code § 10115.10, if applicable.
f. County and/or Subcontractor(s) may, at its discretion, following receipt of final
payment under this Agreement, reduce its accounts, books, and records related
to this Agreement to microfilm, computer disk, CD ROM, DVD, or other data
storage medium. Upon request by an authorized representative to inspect, audit
or obtain copies of said records, County and/or Subcontractor(s) must supply or
make available applicable devices, hardware, and/or software necessary to view,
copy, and/or print said records. Applicable devices may include, but are not
limited to, microfilm readers and microfilm printers, etc.
County of Fresno
16-93111
Page 15
Exhibit A
Program Specifications
g. County shall, if applicable, comply with the Single Audit Act and the audit
reporting requirements set forth in OMB Circular A-133.
2. Dispute Resolution Process
a. A Contractor/County grievance exists whenever there is a dispute arising from
DHCS’ action in the administration of an Agreement. If there is a dispute or
grievance between County and DHCS, County must seek resolution using the
procedure outlined below.
1) County should first informally discuss the problem with the DHCS
Program Contract Manager. If the problem cannot be resolved informally,
County shall direct its grievance together with any evidence, in writing, to
the program Branch Chief. The grievance shall state the issues in dispute,
the legal authority or other basis for County’s position and the remedy
sought. The Branch Chief shall render a decision within ten (10) working
days after receipt of the written grievance from County. The Branch Chief
shall respond in writing to County indicating the decision and reasons
therefore. If County disagrees with the Branch Chief’s decision, County
may submit an appeal to the second level.
2) When appealing to the second level, County must prepare an appeal
indicating the reasons for disagreement with Branch Chief’s decision. The
County shall include a copy of the County’s original statement of dispute
along with any supporting evidence and a copy of the Branch Chief’s
decision. The appeal shall be addressed to the Deputy Director of the
division in which the branch is organized within ten (10) working days from
receipt of the Branch Chief’s decision. The Deputy Director of the division
in which the branch in organized or his/her designee shall meet with
County to review the issues raised. A written decision signed by the
Deputy Director of the division in which the branch is organized or his/her
designee shall be directed to County within twenty (20) working days of
receipt of the County’s second level appeal.
b. If County wishes to appeal the decision of the Deputy Director of the division in
which the branch is organized or his/her designee, County shall follow the
procedures set forth in Health and Safety Code Section 100171.
c. Unless otherwise stipulated in writing by DHCS, all dispute, grievance and/or
appeal correspondence shall be directed to the DHCS Program Contract
Manager.
d. There are organizational differences within DHCS’ funding programs and the
management levels identified in this dispute resolution provision may not apply in
every contractual situation. When a grievance is received and organizational
differences exist, County shall be notified in writing by the DHCS Program
Contract Manager of the level, name, and/or title of the appropriate management
official that is responsible for issuing a decision.
3. Novation
County of Fresno
16-93111
Page 16
Exhibit A
Program Specifications
a. If County proposes any novation agreement, DHCS shall act upon the proposal
within 60 days after receipt of the written proposal. DHCS may review and
consider the proposal, consult and negotiate with County, and accept or reject all
or part of the proposal. Acceptance or rejection of the proposal may be made
orally within the 60-day period and confirmed in writing within five days of said
decision. Upon written acceptance of the proposal, DHCS will initiate an
amendment to this Agreement to formally implement the approved proposal.
County of Fresno
16-93111
Page 1
Exhibit A, Attachment I
Request for Waiver
Request for Waiver Pursuant To Section 5751.7 of the Welfare and Institutions Codes
_______________________________ hereby requests a waiver for the following public or private
health facilities pursuant to Section 5751.7 of the Welfare and Institutions Code for the term of this
contract. These are facilities where minors may be provided psychiatric treatment with
nonspecific separate housing arrangements, treatment staff, and treatment programs designed to
serve minors. However, no minor shall be admitted for psychiatric treatment into the same
treatment ward as an adult receiving treatment who is in the custody of any jailor for a violent
crime, is a known registered sex offender, or has a known history of, or exhibits inappropriate
sexual or other violent behavior which would present a threat to the physical safety of others.
The request for waiver must include, as an attachment, the following:
1. A description of the hardship to the County/City due to inadequate or unavailable alternative
resources that would be caused by compliance with the state policy regarding the provision of
psychiatric treatment to minors.
2. The specific treatment protocols and administrative procedures established by the
County/City for identifying and providing appropriate treatment to minors admitted with adults.
3. Name, address, and telephone number of the facility
• Number of the facility’s beds designated for involuntary treatment
• Type of facility, license(s), and certification(s) held (including licensing and certifying
agency and license and certificate number)
• A copy of the facility’s current license or certificate and description of the program,
including target population and age groups to be admitted to the designated facility.
4. The County Board of Supervisors’ decision to designate a facility as a facility for evaluation
and treatment pursuant to Welfare and Institutions Codes 5150, 5585.50, and 5585.55.
Execution of this Agreement shall not constitute approval of this waiver. Full execution of this
contract will continue independently of the waiver review and approval process.
Any waiver granted in the prior fiscal year's Agreement shall be deemed to continue until either
party chooses to discontinue it.
To rescind the county’s designation of a designated facility, the county shall send a letter to the
Department on official letterhead signed by the County Behavioral Health Director or his or her
designee indicating that the county no longer designates the particular facility. If not otherwise
specified by the host county in the letter to the Department, the discontinuance shall be effective
the date the letter to the Department is postmarked and the facility shall no longer be approved as
a designated facility as of this date.
County of Fresno
16-93111
Page 1
Exhibit B
Funds Provision
1.Budget Contingency Clause
A.It is mutually agreed that if the Budget Act of the current year and/or any subsequent years
covered under this Agreement does not appropriate sufficient funds for the program, this
Agreement shall be of no further force and effect. In this event, DHCS shall have no liability to
pay any funds whatsoever to County of Fresno or to furnish any other considerations under
this Agreement and County of Fresno shall not be obligated to perform any provisions of this
Agreement.
B.If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this
program, DHCS shall have the option to either cancel this Agreement with no liability occurring
to DHCS, or offer an agreement amendment to County of Fresno to reflect the reduced
amount.
GTC 610
EXHIBIT C
GENERAL TERMS AND CONDITIONS
1. APPROVAL: This Agreement is of no force or effect until signed by both parties and
approved by the Department of General Services, if required. Contractor may not commence
performance until such approval has been obtained.
2. AMENDMENT: No amendment or variation of the terms of this Agreement shall be valid
unless made in writing, signed by the parties and approved as required. No oral understanding or
Agreement not incorporated in the Agreement is binding on any of the parties.
3. ASSIGNMENT: This Agreement is not assignable by the Contractor, either in whole or in
part, without the consent of the State in the form of a formal written amendment.
4. AUDIT: Contractor agrees that the awarding department, the Department of General Services,
the Bureau of State Audits, or their designated representative shall have the right to review and
to copy any records and supporting documentation pertaining to the performance of this
Agreement. Contractor agrees to maintain such records for possible audit for a minimum of three
(3) years after final payment, unless a longer period of records retention is stipulated. Contractor
agrees to allow the auditor(s) access to such records during normal business hours and to allow
interviews of any employees who might reasonably have information related to such records.
Further, Contractor agrees to include a similar right of the State to audit records and interview
staff in any subcontract related to performance of this Agreement. (Gov. Code §8546.7, Pub.
Contract Code §10115 et seq., CCR Title 2, Section 1896).
5. INDEMNIFICATION: Contractor agrees to indemnify, defend and save harmless the State, its
officers, agents and employees from any and all claims and losses accruing or resulting to any
and all contractors, subcontractors, suppliers, laborers, and any other person, firm or corporation
furnishing or supplying work services, materials, or supplies in connection with the performance
of this Agreement, and from any and all claims and losses accruing or resulting to any person,
firm or corporation who may be injured or damaged by Contractor in the performance of this
Agreement.
6. DISPUTES: Contractor shall continue with the responsibilities under this Agreement during
any dispute.
7. TERMINATION FOR CAUSE: The State may terminate this Agreement and be relieved of
any payments should the Contractor fail to perform the requirements of this Agreement at the
time and in the manner herein provided. In the event of such termination the State may proceed
with the work in any manner deemed proper by the State. All costs to the State shall be deducted
from any sum due the Contractor under this Agreement and the balance, if any, shall be paid to
the Contractor upon demand.
8. INDEPENDENT CONTRACTOR: Contractor, and the agents and employees of Contractor,
in the performance of this Agreement, shall act in an independent capacity and not as officers or
employees or agents of the State.
9. RECYCLING CERTIFICATION: The Contractor shall certify in writing under penalty of
perjury, the minimum, if not exact, percentage of post consumer material as defined in the Public
Contract Code Section 12200, in products, materials, goods, or supplies offered or sold to the
State regardless of whether the product meets the requirements of Public Contract Code Section
12209. With respect to printer or duplication cartridges that comply with the requirements of
Section 12156(e), the certification required by this subdivision shall specify that the cartridges so
comply (Pub. Contract Code §12205).
10. NON-DISCRIMINATION CLAUSE: During the performance of this Agreement, Contractor
and its subcontractors shall not unlawfully discriminate, harass, or allow harassment against any
employee or applicant for employment because of sex, race, color, ancestry, religious creed,
national origin, physical disability (including HIV and AIDS), mental disability, medical
condition (e.g., cancer), age (over 40), marital status, and denial of family care leave. Contractor
and subcontractors shall insure that the evaluation and treatment of their employees and
applicants for employment are free from such discrimination and harassment. Contractor and
subcontractors shall comply with the provisions of the Fair Employment and Housing Act (Gov.
Code §12990 (a-f) et seq.) and the applicable regulations promulgated thereunder (California
Code of Regulations, Title 2, Section 7285 et seq.). The applicable regulations of the Fair
Employment and Housing Commission implementing Government Code Section 12990 (a-f), set
forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations, are incorporated
into this Agreement by reference and made a part hereof as if set forth in full. Contractor and its
subcontractors shall give written notice of their obligations under this clause to labor
organizations with which they have a collective bargaining or other Agreement.
Contractor shall include the nondiscrimination and compliance provisions of this clause in all
subcontracts to perform work under the Agreement.
11. CERTIFICATION CLAUSES: The CONTRACTOR CERTIFICATION CLAUSES
contained in the document CCC 307 are hereby incorporated by reference and made a part of this
Agreement by this reference as if attached hereto.
12. TIMELINESS: Time is of the essence in this Agreement.
13. COMPENSATION: The consideration to be paid Contractor, as provided herein, shall be in
compensation for all of Contractor's expenses incurred in the performance hereof, including
travel, per diem, and taxes, unless otherwise expressly so provided.
14. GOVERNING LAW: This contract is governed by and shall be interpreted in accordance
with the laws of the State of California.
15. ANTITRUST CLAIMS: The Contractor by signing this agreement hereby certifies that if
these services or goods are obtained by means of a competitive bid, the Contractor shall comply
with the requirements of the Government Codes Sections set out below.
a. The Government Code Chapter on Antitrust claims contains the following definitions:
1) "Public purchase" means a purchase by means of competitive bids of goods, services, or
materials by the State or any of its political subdivisions or public agencies on whose behalf the
Attorney General may bring an action pursuant to subdivision (c) of Section 16750 of the
Business and Professions Code.
2) "Public purchasing body" means the State or the subdivision or agency making a public
purchase. Government Code Section 4550.
b. In submitting a bid to a public purchasing body, the bidder offers and agrees that if the bid is
accepted, it will assign to the purchasing body all rights, title, and interest in and to all causes of
action it may have under Section 4 of the Clayton Act (15 U.S.C. Sec. 15) or under the
Cartwright Act (Chapter 2 (commencing with Section 16700) of Part 2 of Division 7 of the
Business and Professions Code), arising from purchases of goods, materials, or services by the
bidder for sale to the purchasing body pursuant to the bid. Such assignment shall be made and
become effective at the time the purchasing body tenders final payment to the bidder.
Government Code Section 4552.
c. If an awarding body or public purchasing body receives, either through judgment or
settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor
shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand,
recover from the public body any portion of the recovery, including treble damages, attributable
to overcharges that were paid by the assignor but were not paid by the public body as part of the
bid price, less the expenses incurred in obtaining that portion of the recovery. Government Code
Section 4553.
d. Upon demand in writing by the assignor, the assignee shall, within one year from such
demand, reassign the cause of action assigned under this part if the assignor has been or may
have been injured by the violation of law for which the cause of action arose and (a) the assignee
has not been injured thereby, or (b) the assignee declines to file a court action for the cause of
action. See Government Code Section 4554.
16. CHILD SUPPORT COMPLIANCE ACT: For any Agreement in excess of $100,000, the
contractor acknowledges in accordance with Public Contract Code 7110, that:
a. The contractor recognizes the importance of child and family support obligations and shall
fully comply with all applicable state and federal laws relating to child and family support
enforcement, including, but not limited to, disclosure of information and compliance with
earnings assignment orders, as provided in Chapter 8 (commencing with section 5200) of Part 5
of Division 9 of the Family Code; and
b. The contractor, to the best of its knowledge is fully complying with the earnings assignment
orders of all employees and is providing the names of all new employees to the New Hire
Registry maintained by the California Employment Development Department.
17. UNENFORCEABLE PROVISION: In the event that any provision of this Agreement is
unenforceable or held to be unenforceable, then the parties agree that all other provisions of this
Agreement have force and effect and shall not be affected thereby.
18. PRIORITY HIRING CONSIDERATIONS: If this Contract includes services in excess of
$200,000, the Contractor shall give priority consideration in filling vacancies in positions funded
by the Contract to qualified recipients of aid under Welfare and Institutions Code Section 11200
in accordance with Pub. Contract Code §10353.
19. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING
REQUIREMENTS:
a. If for this Contract Contractor made a commitment to achieve small business participation,
then Contractor must within 60 days of receiving final payment under this Contract (or within
such other time period as may be specified elsewhere in this Contract) report to the awarding
department the actual percentage of small business participation that was achieved. (Govt. Code
§ 14841.)
b. If for this Contract Contractor made a commitment to achieve disabled veteran business
enterprise (DVBE) participation, then Contractor must within 60 days of receiving final payment
under this Contract (or within such other time period as may be specified elsewhere in this
Contract) certify in a report to the awarding department: (1) the total amount the prime
Contractor received under the Contract; (2) the name and address of the DVBE(s) that
participated in the performance of the Contract; (3) the amount each DVBE received from the
prime Contractor; (4) that all payments under the Contract have been made to the DVBE; and (5)
the actual percentage of DVBE participation that was achieved. A person or entity that
knowingly provides false information shall be subject to a civil penalty for each violation. (Mil.
& Vets. Code § 999.5(d); Govt. Code § 14841.)
20. LOSS LEADER:
If this contract involves the furnishing of equipment, materials, or supplies then the following
statement is incorporated: It is unlawful for any person engaged in business within this state to
sell or use any article or product as a “loss leader” as defined in Section 17030 of the Business
and Professions Code. (PCC 10344(e).)
C:\Users\evang\Desktop\2-2a MHP PC Exh C GTC-610.doc
County of Fresno
16-93111
Page 1 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
1. Definitions. For purposes of this Exhibit, the following definitions shall apply:
A. Public Information: Information that is not exempt from disclosure under the provisions of the
California Public Records Act (Government Code sections 6250-6265) or other applicable state or
federal laws.
B. Confidential Information: Information that is exempt from disclosure under the provisions of the
California Public Records Act (Government Code sections 6250-6265) or other applicable state or
federal laws.
C. Sensitive Information: Information that requires special precautions to protect from unauthorized
use, access, disclosure, modification, loss, or deletion. Sensitive Information may be either Public
Information or Confidential Information. It is information that requires a higher than normal
assurance of accuracy and completeness. Thus, the key factor for Sensitive Information is that of
integrity. Typically, Sensitive Information includes records of agency financial transactions and
regulatory actions.
D. Personal Information: Information that identifies or describes an individual, including, but not
limited to, their name, social security number, physical description, home address, home
telephone number, education, financial matters, and medical or employment history. It is DHCS’
policy to consider all information about individuals private unless such information is
determined to be a public record. This information must be protected from inappropriate
access, use, or disclosure and must be made accessible to data subjects upon request. Personal
Information includes the following:
Notice-triggering Personal Information: Specific items of personal information (name plus Social
Security number, driver license/California identification card number, or financial account number)
that may trigger a requirement to notify individuals if it is acquired by an unauthorized person. For
purposes of this provision, identity shall include, but not be limited to name, identifying number,
symbol, or other identifying particular assigned to the individual, such as finger or voice print or a
photograph. See Civil Code sections 1798.29 and 1798.82.
2. Nondisclosure. The Contractor and its employees, agents, or subcontractors shall protect from
unauthorized disclosure any Personal Information, Sensitive Information, or Confidential Information
(hereinafter identified as PSCI).
3. The Contractor and its employees, agents, or subcontractors shall not use any PSCI for any purpose
other than carrying out the Contractor's obligations under this Agreement.
4. The Contractor and its employees, agents, or subcontractors shall promptly transmit to the DHCS
Program Contract Manager all requests for disclosure of any PSCI not emanating from the person
who is the subject of PSCI.
5. The Contractor shall not disclose, except as otherwise specifically permitted by this Agreement or
authorized by the person who is the subject of PSCI, any PSCI to anyone other than DHCS without
prior written authorization from the DHCS Program Contract Manager, except if disclosure is required
by State or Federal law.
County of Fresno
16-93111
Page 2 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
6. The Contractor shall observe the following requirements:
A. Safeguards. The Contractor shall implement administrative, physical, and technical safeguards
that reasonably and appropriately protect the confidentiality, integrity, and availability of the PSCI,
including electronic PSCI that it creates, receives, maintains, uses, or transmits on behalf of
DHCS. Contractor shall develop and maintain a written information privacy and security program
that includes administrative, technical and physical safeguards appropriate to the size and
complexity of the Contractor’s operations and the nature and scope of its activities, Including at a
minimum the following safeguards:
1) Personnel Controls
a. Employee Training. All workforce members who assist in the performance of functions or
activities on behalf of DHCS, or access or disclose DHCS PSCI, must complete
information privacy and security training, at least annually, at Business Associate’s
expense. Each workforce member who receives information privacy and security training
must sign a certification, indicating the member’s name and the date on which the training
was completed. These certifications must be retained for a period of six (6) years following
contract termination.
b. Employee Discipline. Appropriate sanctions must be applied against workforce members
who fail to comply with privacy policies and procedures or any provisions of these
requirements, including termination of employment where appropriate.
c. Confidentiality Statement. All persons that will be working with DHCS PHI or PI must
sign a confidentiality statement that includes, at a minimum, General Use, Security and
Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must
be signed by the workforce member prior to access to DHCS PHI or PI. The statement
must be renewed annually. The Contractor shall retain each person’s written
confidentiality statement for DHCS inspection for a period of six (6) years following contract
termination.
d. Background Check. Before a member of the workforce may access DHCS PHI or PI, a
thorough background check of that worker must be conducted, with evaluation of the
results to assure that there is no indication that the worker may present a risk to the
security or integrity of confidential data or a risk for theft or misuse of confidential data.
The Contractor shall retain each workforce member’s background check documentation for
a period of three (3) years following contract termination.
2) Technical Security Controls
a. Workstation/Laptop encryption. All workstations and laptops that process and/or store
DHCS PHI or PI must be encrypted using a FIPS 140-2 certified algorithm which is 128bit
or higher, such as Advanced Encryption Standard (AES). The encryption solution must be
full disk unless approved by the DHCS Information Security Office.
b. Server Security. Servers containing unencrypted DHCS PHI or PI must have sufficient
administrative, physical, and technical controls in place to protect that data, based upon a
risk assessment/system security review.
County of Fresno
16-93111
Page 3 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
c. Minimum Necessary. Only the minimum necessary amount of DHCS PHI or PI required
to perform necessary business functions may be copied, downloaded, or exported.
d. Removable media devices. All electronic files that contain DHCS PHI or PI data must be
encrypted when stored on any removable media or portable device (i.e. USB thumb drives,
floppies, CD/DVD, smartphones, backup tapes etc.). Encryption must be a FIPS 140-2
certified algorithm which is 128bit or higher, such as AES.
e. Antivirus software. All workstations, laptops and other systems that process and/or store
DHCS PHI or PI must install and actively use comprehensive anti-virus software solution
with automatic updates scheduled at least daily.
f. Patch Management. All workstations, laptops and other systems that process and/or
store DHCS PHI or PI must have critical security patches applied, with system reboot if
necessary. There must be a documented patch management process which determines
installation timeframe based on risk assessment and vendor recommendations. At a
maximum, all applicable patches must be installed within 30 days of vendor release.
g. User IDs and Password Controls. All users must be issued a unique user name for
accessing DHCS PHI or PI. Username must be promptly disabled, deleted, or the
password changed upon the transfer or termination of an employee with knowledge of the
password, at maximum within 24 hours. Passwords are not to be shared. Passwords must
be at least eight characters and must be a non-dictionary word. Passwords must not be
stored in readable format on the computer. Passwords must be changed every 90 days,
preferably every 60 days. Passwords must be changed if revealed or compromised.
Passwords must be composed of characters from at least three of the following four
groups from the standard keyboard:
• Upper case letters (A-Z)
• Lower case letters (a-z)
• Arabic numerals (0-9)
• Non-alphanumeric characters (punctuation symbols)
h. Data Destruction. When no longer needed, all DHCS PHI or PI must be cleared, purged,
or destroyed consistent with NIST Special Publication 800-88, Guidelines for Media
Sanitization such that the PHI or PI cannot be retrieved.
i. System Timeout. The system providing access to DHCS PHI or PI must provide an
automatic timeout, requiring re-authentication of the user session after no more than 20
minutes of inactivity.
j. Warning Banners. All systems providing access to DHCS PHI or PI must display a
warning banner stating that data is confidential, systems are logged, and system use is for
business purposes only by authorized users. User must be directed to log off the system if
they do not agree with these requirements.
k. System Logging. The system must maintain an automated audit trail which can identify
the user or system process which initiates a request for DHCS PHI or PI, or which alters
DHCS PHI or PI. The audit trail must be date and time stamped, must log both successful
and failed accesses, must be read only, and must be restricted to authorized users. If
County of Fresno
16-93111
Page 4 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
DHCS PHI or PI is stored in a database, database logging functionality must be enabled.
Audit trail data must be archived for at least 3 years after occurrence.
l. Access Controls. The system providing access to DHCS PHI or PI must use role based
access controls for all user authentications, enforcing the principle of least privilege.
m. Transmission encryption. All data transmissions of DHCS PHI or PI outside the secure
internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128bit
or higher, such as AES. Encryption can be end to end at the network level, or the data
files containing PHI can be encrypted. This requirement pertains to any type of PHI or PI
in motion such as website access, file transfer, and E-Mail.
n. Intrusion Detection. All systems involved in accessing, holding, transporting, and
protecting DHCS PHI or PI that are accessible via the Internet must be protected by a
comprehensive intrusion detection and prevention solution.
3) Audit Controls
a. System Security Review. All systems processing and/or storing DHCS PHI or PI must
have at least an annual system risk assessment/security review which provides assurance
that administrative, physical, and technical controls are functioning effectively and
providing adequate levels of protection. Reviews should include vulnerability scanning
tools.
b. Log Reviews. All systems processing and/or storing DHCS PHI or PI must have a routine
procedure in place to review system logs for unauthorized access.
c. Change Control. All systems processing and/or storing DHCS PHI or PI must have a
documented change control procedure that ensures separation of duties and protects the
confidentiality, integrity and availability of data.
4) Business Continuity / Disaster Recovery Controls
a. Emergency Mode Operation Plan. Contractor must establish a documented plan to
enable continuation of critical business processes and protection of the security of
electronic DHCS PHI or PI in the event of an emergency. Emergency means any
circumstance or situation that causes normal computer operations to become unavailable
for use in performing the work required under this Agreement for more than 24 hours.
b. Data Backup Plan. Contractor must have established documented procedures to backup
DHCS PHI to maintain retrievable exact copies of DHCS PHI or PI. The plan must include
a regular schedule for making backups, storing backups offsite, an inventory of backup
media, and an estimate of the amount of time needed to restore DHCS PHI or PI should it
be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite
storage of DHCS data.
5) Paper Document Controls
a. Supervision of Data. DHCS PHI or PI in paper form shall not be left unattended at any
time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that
County of Fresno
16-93111
Page 5 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
information is not being observed by an employee authorized to access the information.
DHCS PHI or PI in paper form shall not be left unattended at any time in vehicles or planes
and shall not be checked in baggage on commercial airplanes.
b. Escorting Visitors. Visitors to areas where DHCS PHI or PI is contained shall be
escorted and DHCS PHI or PI shall be kept out of sight while visitors are in the area.
c. Confidential Destruction. DHCS PHI or PI must be disposed of through confidential
means, such as cross cut shredding and pulverizing.
d. Removal of Data. DHCS PHI or PI must not be removed from the premises of the
Contractor except with express written permission of DHCS.
e. Faxing. Faxes containing DHCS PHI or PI shall not be left unattended and fax machines
shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons
receiving faxes in error to destroy them. Fax numbers shall be verified with the intended
recipient before sending the fax.
f. Mailing. Mailings of DHCS PHI or PI shall be sealed and secured from damage or
inappropriate viewing of PHI or PI to the extent possible. Mailings which include 500 or
more individually identifiable records of DHCS PHI or PI in a single package shall be sent
using a tracked mailing method which includes verification of delivery and receipt, unless
the prior written permission of DHCS to use another method is obtained.
B. Security Officer. The Contractor shall designate a Security Officer to oversee its data security
program who will be responsible for carrying out its privacy and security programs and for
communicating on security matters with DHCS.
Discovery and Notification of Breach. Notice to DHCS:
(1) To notify DHCS immediately upon the discovery of a suspected security incident that involves
data provided to DHCS by the Social Security Administration. This notification will be by
telephone call plus email or fax upon the discovery of the breach. (2) To notify DHCS
within 24 hours by email or fax of the discovery of unsecured PHI or PI in electronic media
or in any other media if the PHI or PI was, or is reasonably believed to have been, accessed or
acquired by an unauthorized person, any suspected security incident, intrusion or
unauthorized access, use or disclosure of PHI or PI in violation of this Agreement and this
Addendum, or potential loss of confidential data affecting this Agreement. A breach shall be
treated as discovered by the contractor as of the first day on which the breach is known, or by
exercising reasonable diligence would have been known, to any person (other than the person
committing the breach) who is an employee, officer or other agent of the contractor..
Notice shall be provided to the DHCS Program Contract Manager, the DHCS Privacy Officer
and the DHCS Information Security Officer. If the incident occurs after business hours or on a
weekend or holiday and involves data provided to DHCS by the Social Security Administration,
notice shall be provided by calling the DHCS EITS Service Desk. Notice shall be made using
the “DHCS Privacy Incident Report” form, including all information known at the time. The
contractor shall use the most current version of this form, which is posted on the DHCS
Privacy Office website (www.dhcs.ca.gov, then select “Privacy” in the left column and then
County of Fresno
16-93111
Page 6 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
“Business Use” near the middle of the page) or use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DHCSBusinessAssociatesOnly.aspx
C. Upon discovery of a breach or suspected security incident, intrusion or unauthorized access, use
or disclosure of PHI or PI, the Contractor shall take:
1) Prompt corrective action to mitigate any risks or damages involved with the breach and to
protect the operating environment and
2) Any action pertaining to such unauthorized disclosure required by applicable Federal and
State laws and regulations.
D. Investigation of Breach. The Contractor shall immediately investigate such security incident,
breach, or unauthorized use or disclosure of PSCI. If the initial report did not include all of the
requested information marked with an asterisk, then within seventy-two (72) hours of the
discovery, The Contractor shall submit an updated “DHCS Privacy Incident Report” containing the
information marked with an asterisk and all other applicable information listed on the form, to the
extent known at that time, to the DHCS Program Contract Manager, the DHCS Privacy Officer,
and the DHCS Information Security Officer:
E. Written Report. The Contractor shall provide a written report of the investigation to the DHCS
Program Contract Manager, the DHCS Privacy Officer, and the DHCS Information Security
Officer, if all of the required information was not included in the DHCS Privacy Incident Report,
within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The
report shall include, but not be limited to, the information specified above, as well as a full, detailed
corrective action plan, including information on measures that were taken to halt and/or contain
the improper use or disclosure.
F. Notification of Individuals. The Contractor shall notify individuals of the breach or unauthorized
use or disclosure when notification is required under state or federal law and shall pay any costs
of such notifications, as well as any costs associated with the breach. The DHCS Program
Contract Manager, the DHCS Privacy Officer, and the DHCS Information Security Officer shall
approve the time, manner and content of any such notifications.
7. Affect on lower tier transactions. The terms of this Exhibit shall apply to all contracts, subcontracts,
and subawards, regardless of whether they are for the acquisition of services, goods, or commodities.
The Contractor shall incorporate the contents of this Exhibit into each subcontract or subaward to its
agents, subcontractors, or independent consultants.
8. Contact Information. To direct communications to the above referenced DHCS staff, the Contractor
shall initiate contact as indicated herein. DHCS reserves the right to make changes to the contact
information below by giving written notice to the Contractor. Said changes shall not require an
amendment to this Exhibit or the Agreement to which it is incorporated.
DHCS Program Contract
Manager
DHCS Privacy Officer DHCS Information Security Officer
County of Fresno
16-93111
Page 7 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/15
See the Scope of Work
exhibit for Program
Contract Manager
information
Privacy Officer
c/o Office of Legal Services
Department of Health Care Services
P.O. Box 997413, MS 0011
Sacramento, CA 95899-7413
Email: privacyofficer@dhcs.ca.gov
Telephone: (916) 445-4646
Information Security Officer
DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Help Desk
(916) 440-7000 or
(800) 579-0874
9. Audits and Inspections. From time to time, DHCS may inspect the facilities, systems, books and
records of the Contractor to monitor compliance with the safeguards required in the Information
Confidentiality and Security Requirements (ICSR) exhibit. Contractor shall promptly remedy any
violation of any provision of this ICSR exhibit. The fact that DHCS inspects, or fails to inspect, or has
the right to inspect, Contractor’s facilities, systems and procedures does not relieve Contractor of its
responsibility to comply with this ICSR exhibit.
County of Fresno
16-93111
Page 1
EXHIBIT E
PRIVACY AND INFORMATION SECURITY PROVISIONS
This Exhibit E is intended to protect the privacy and security of specified Department
information that Contractor may access, receive, or transmit under this Agreement. The
Department information covered under this Exhibit E consists of: (1) Protected Health
Information as defined under the Health Insurance Portability and Accountability Act of
1996, Public Law 104-191 (“HIPAA”)(PHI): and (2) Personal Information (PI) as defined
under the California Information Practices Act (CIPA), at California Civil Code Section
1798.3. Personal Information may include data provided to the Department by the
Social Security Administration.
Exhibit E consists of the following parts:
1. Exhibit E-1, HIPAA Business Associate Addendum, which provides for the
privacy and security of PHI.
2. Exhibit E-2, which provides for the privacy and security of PI in accordance with
specified provisions of the Agreement between the Department and the Social
Security Administration, known as the Information Exchange Agreement (IEA)
and the Computer Matching and Privacy Protection Act Agreement between the
Social Security Administration and the California Health and Human Services
Agency (Computer Agreement) to the extent Contractor access, receives, or
transmits PI under these Agreements. Exhibit E-2 further provides for the privacy
and security of PI under Civil Code Section 1798.3(a) and 1798.29.
3. Exhibit E-3, Miscellaneous Provision, sets forth additional terms and conditions
that extend to the provisions of Exhibit E in its entirety.
County of Fresno
16-93111
Page 2
EXHIBIT E-1
HIPAA Business Associate Addendum
1. Recitals.
A. A business associate relationship under the Health Insurance Portability
and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), the
Health Information Technology for Economic and Clinical Health Act,
Public Law 111-005 (”the HITECH Act"), 42 U.S.C. Section 17921 et
seq., and their implementing privacy and security regulations at 45 CFR
Parts 160 and 164 (“the HIPAA regulations”) between Department and
Contractor arises only to the extent that Contractor creates, receives,
maintains, transmits, uses or discloses PHI or ePHI on the Department’s
behalf, or provides services, arranges, performs or assists in the
performance of functions or activities on behalf of the Department that
are included in the definition of “business associate” in 45 C.F.R.
160.103 where the provision of the service involves the disclosure of
PHI or ePHI from the Department, including but not limited to, utilization
review, quality assurance, or benefit management. To the extent
Contractor performs these services, functions, and activities on behalf of
Department, Contractor is the Business Associate of the Department,
acting on the Department's behalf. The Department and Contractor are
each a party to this Agreement and are collectively referred to as the
"parties.”
B. The Department wishes to disclose to Contractor certain information
pursuant to the terms of this Agreement, some of which may constitute
Protected Health Information (“PHI”), including protected health
information in electronic media (“ePHI”), under federal law, to be used
or disclosed in the course of providing services and activities as set
forth in Section 1.A. of Exhibit E-1 of this Agreement. This information
is hereafter referred to as “Department PHI”.
C. The purpose of this Exhibit E-1 is to protect the privacy and security of
the PHI and ePHI that may be created, received, maintained,
transmitted, used or disclosed pursuant to this Agreement, and to
comply with certain standards and requirements of HIPAA, the HITECH
Act, and the HIPAA regulations, including, but not limited to, the
requirement that the Department must enter into a contract containing
specific requirements with Contractor prior to the disclosure of PHI to
County of Fresno
16-93111
Page 3
Contractor, as set forth in 45 CFR Parts 160 and 164 and the HITECH
Act. To the extent that data is both PHI or ePHI and Personally
Identifying Information, both Exhibit E-2 (including Attachment B, the
SSA Agreement between SSA, CHHS and DHCS, referred to in Exhibit
E-2) and this Exhibit E-1 shall apply.
D. The terms used in this Exhibit E-1, but not otherwise defined, shall have
the same meanings as those terms have in the HIPAA regulations. Any
reference to statutory or regulatory language shall be to such language
as in effect or as amended.
2. Definitions.
A. Breach shall have the meaning given to such term under HIPAA,
the HITECH Act, and the HIPAA regulations.
B. Business Associate shall have the meaning given to such term under
HIPAA, the HITECH Act, and the HIPAA regulations.
C. Covered Entity shall have the meaning given to such term under
HIPAA, the HITECH Act, and the HIPAA regulations.
D. Department PHI shall mean Protected Health Information or Electronic
Protected Health Information, as defined below, accessed by Contractor
in a database maintained by the Department, received by Contractor
from the Department or acquired or created by Contractor in connection
with performing the functions, activities and services on behalf of the
Department as specified in Section 1.A. of Exhibit E-1 of this Agreement.
The terms PHI as used in this document shall mean Department PHI.
E. Electronic Health Records shall have the meaning given to such term in
the HITECH Act, including, but not limited to, 42 U.S.C. Section 17921
and implementing regulations.
F. Electronic Protected Health Information (ePHI) means individually
identifiable health information transmitted by electronic media or
maintained in electronic media, including but not limited to
electronic media as set forth under 45 CFR section 160.103.
G. Individually Identifiable Health Information means health information,
including demographic information collected from an individual, that is
created or received by a health care provider, health plan, employer or
health care clearinghouse, and relates to the past, present or future
physical or mental health or condition of an individual, the provision of
County of Fresno
16-93111
Page 4
health care to an individual, or the past, present, or future payment for
the provision of health care to an individual, that identifies the individual
or where there is a reasonable basis to believe the information can be
used to identify the individual, as set forth under 45 CFR Section
160.103.
H. Privacy Rule shall mean the HIPAA Regulations that are found at 45 CFR
Parts 160 and 164, subparts A and E.
I. Protected Health Information (PHI) means individually identifiable
health information that is transmitted by electronic media, maintained in
electronic media, or is transmitted or maintained in any other form or
medium, as set forth under 45 CFR Section 160.103 and as defined
under HIPAA.
J. Required by law, as set forth under 45 CFR Section 164.103, means a
mandate contained in law that compels an entity to make a use or
disclosure of PHI that is enforceable in a court of law. This includes, but is
not limited to, court orders and court-ordered warrants, subpoenas or
summons issued by a court, grand jury, a governmental or tribal inspector
general, or an administrative body authorized to require the production of
information, and a civil or an authorized investigative demand. It also
includes Medicare conditions of participation with respect to health care
providers participating in the program, and statutes or regulations that
require the production of information, including statutes or regulations that
require such information if payment is sought under a government
program providing public benefits.
K. Secretary means the Secretary of the U.S. Department of Health and
Human Services ("HHS") or the Secretary's designee.
L. Security Incident means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of Department PHI,
or confidential data utilized by Contractor to perform the services,
functions and activities on behalf of Department as set forth in Section
1.A. of Exhibit E-1 of this Agreement; or interference with system
operations in an information system that processes, maintains or stores
Department PHI.
M. Security Rule shall mean the HIPAA regulations that are found at 45 CFR
Parts 160 and 164.
N. Unsecured PHI shall have the meaning given to such term under the
HITECH Act, 42 U.S.C. Section 17932(h), any guidance issued by the
County of Fresno
16-93111
Page 5
Secretary pursuant to such Act and the HIPAA regulations.
3. Terms of Agreement.
A. Permitted Uses and Disclosures of Department PHI by Contractor.
Except as otherwise indicated in this Exhibit E-1, Contractor may use or
disclose Department PHI only to perform functions, activities or services
specified in Section 1.A of Exhibit E-1 of this Agreement, for, or on behalf
of the Department, provided that such use or disclosure would not violate
the HIPAA regulations or the limitations set forth in 42 CFR Part 2, or any
other applicable law, if done by the Department. Any such use or
disclosure, if not for purposes of treatment activities of a health care
provider as defined by the Privacy Rule, must, to the extent practicable, be
limited to the limited data set, as defined in 45 CFR Section 164.514(e)(2),
or, if needed, to the minimum necessary to accomplish the intended
purpose of such use or disclosure, in compliance with the HITECH Act
and any guidance issued pursuant to such Act, and the HIPAA
regulations.
B. Specific Use and Disclosure Provisions. Except as otherwise indicated in
this Exhibit E-1, Contractor may:
1) Use and Disclose for Management and Administration. Use and
disclose Department PHI for the proper management and
administration of the Contractor’s business, provided that such
disclosures are required by law, or the Contractor obtains reasonable
assurances from the person to whom the information is disclosed, in
accordance with section D(7) of this Exhibit E-1, that it will remain
confidential and will be used or further disclosed only as required by
law or for the purpose for which it was disclosed to the person, and
the person notifies the Contractor of any instances of which it is aware
that the confidentiality of the information has been breached.
2) Provision of Data Aggregation Services. Use Department PHI to
provide data aggregation services to the Department to the extent
requested by the Department and agreed to by Contractor. Data
aggregation means the combining of PHI created or received by the
Contractor, as the Business Associate, on behalf of the Department
with PHI received by the Business Associate in its capacity as the
Business Associate of another covered entity, to permit data analyses
that relate to the health care operations of the Department
C. Prohibited Uses and Disclosures
County of Fresno
16-93111
Page 6
1) Contractor shall not disclose Department PHI about an individual to
a health plan for payment or health care operations purposes if the
Department PHI pertains solely to a health care item or service for
which the health care provider involved has been paid out of pocket
in full and the individual requests such restriction, in accordance
with 42 U.S.C. Section 17935(a) and 45 CFR Section 164.522(a).
2) Contractor shall not directly or indirectly receive remuneration in
exchange for Department PHI.
D. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose Department PHI other than
as permitted or required by this Agreement or as required by law,
including but not limited to 42 CFR Part 2.
2) Compliance with the HIPAA Security Rule. To implement
administrative, physical, and technical safeguards that reasonably
and appropriately protect the confidentiality, integrity, and availability
of the Department PHI, including electronic PHI, that it creates,
receives, maintains, uses or transmits on behalf of the Department, in
compliance with 45 CFR Sections 164.308, 164.310 and 164.312,
and to prevent use or disclosure of Department PHI other than as
provided for by this Agreement. Contractor shall implement
reasonable and appropriate policies and procedures to comply with
the standards, implementation specifications and other requirements
of 45 CFR Section 164, subpart C, in compliance with 45 CFR
Section164.316. Contractor shall develop and maintain a written
information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and
complexity of the Contractor’s operations and the nature and scope of
its activities, and which incorporates the requirements of section 3,
Security, below. Contractor will provide the Department with its
current and updated policies upon request.
3) Security. Contractor shall take any and all steps necessary to ensure
the continuous security of all computerized data systems containing
PHI and/or PI, and to protect paper documents containing PHI and/or
PI. These steps shall include, at a minimum:
a. Complying with all of the data system security precautions
County of Fresno
16-93111
Page 7
listed in Attachment A, Data Security Requirements;
b. Achieving and maintaining compliance with the HIPAA
Security Rule (45 CFR Parts 160 and 164), as necessary in
conducting operations on behalf of DHCS under this
Agreement; and
c. Providing a level and scope of security that is at least
comparable to the level and scope of security established by
the Office of Management and Budget in OMB Circular No.
A-130, Appendix III- Security of Federal Automated
Information Systems, which sets forth guidelines for
automated information systems in Federal agencies.
4) Security Officer. Contractor shall designate a Security Officer to
oversee its data security program who shall be responsible for
carrying out the requirements of this section and for communicating
on security matters with the Department.
5) Mitigation of Harmful Effects. To mitigate, to the extent practicable,
any harmful effect that is known to Contractor of a use or disclosure of
Department PHI by Contractor or its subcontractors in violation of the
requirements of this Exhibit E.
6) Reporting Unauthorized Use or Disclosure. To report to
Department any use or disclosure of Department PHI not provided for
by this Exhibit E of which it becomes aware.
7) Contractor’s Agents and Subcontractors.
a. To enter into written agreements with any agents, including
subcontractors and vendors to whom Contractor provides
Department PHI, that impose the same restrictions and
conditions on such agents, subcontractors and vendors that
apply to Contractor with respect to such Department PHI
under this Exhibit E, and that require compliance with all
applicable provisions of HIPAA, the HITECH Act and the
HIPAA regulations, including the requirement that any
agents, subcontractors or vendors implement reasonable
and appropriate administrative, physical, and technical
safeguards to protect such PHI. As required by HIPAA, the
HITECH Act and the HIPAA regulations, including 45 CFR
Sections 164.308 and 164.314, Contractor shall
incorporate, when applicable, the relevant provisions of this
Exhibit E-1 into each subcontract or subaward to such
County of Fresno
16-93111
Page 8
agents, subcontractors and vendors, including the
requirement that any security incidents or breaches of
unsecured PHI be reported to Contractor.
b. In accordance with 45 CFR Section 164.504(e)(1)(ii), upon
Contractor’s knowledge of a material breach or violation by
its subcontractor of the agreement between Contractor and
the subcontractor, Contractor shall:
i) Provide an opportunity for the subcontractor to cure
the breach or end the violation and terminate the
agreement if the subcontractor does not cure the
breach or end the violation within the time specified
by the Department; or
ii) Immediately terminate the agreement if the
subcontractor has breached a material term of the
agreement and cure is not possible.
8) Availability of Information to the Department and Individuals to
Provide Access and Information:
a. To provide access as the Department may require, and in
the time and manner designated by the Department (upon
reasonable notice and during Contractor’s normal
business hours) to Department PHI in a Designated
Record Set, to the Department (or, as directed by the
Department), to an Individual, in accordance with 45 CFR
Section 164.524. Designated Record Set means the group
of records maintained for the Department health plan
under this Agreement that includes medical, dental and
billing records about individuals; enrollment, payment,
claims adjudication, and case or medical management
systems maintained for the Department health plan for
which Contractor is providing services under this
Agreement; or those records used to make decisions
about individuals on behalf of the Department. Contractor
shall use the forms and processes developed by the
Department for this purpose and shall respond to requests
for access to records transmitted by the Department within
fifteen (15) calendar days of receipt of the request by
producing the records or verifying that there are none.
b. If Contractor maintains an Electronic Health Record with
County of Fresno
16-93111
Page 9
PHI, and an individual requests a copy of such
information in an electronic format, Contractor shall
provide such information in an electronic format to enable
the Department to fulfill its obligations under the HITECH
Act, including but not limited to, 42 U.S.C. Section
17935(e) and the HIPAA regulations.
9) Amendment of Department PHI. To make any amendment(s) to
Department PHI that were requested by a patient and that the
Department directs or agrees should be made to assure compliance
with 45 CFR Section 164.526, in the time and manner designated by
the Department, with the Contractor being given a minimum of twenty
(20) days within which to make the amendment.
10) Internal Practices. To make Contractor’s internal practices, books
and records relating to the use and disclosure of Department PHI
available to the Department or to the Secretary, for purposes of
determining the Department’s compliance with the HIPAA
regulations. If any information needed for this purpose is in the
exclusive possession of any other entity or person and the other
entity or person fails or refuses to furnish the information to
Contractor, Contractor shall provide written notification to the
Department and shall set forth the efforts it made to obtain the
information.
11) Documentation of Disclosures. To document and make available to
the Department or (at the direction of the Department) to an individual
such disclosures of Department PHI, and information related to such
disclosures, necessary to respond to a proper request by the subject
Individual for an accounting of disclosures of such PHI, in accordance
with the HITECH Act and its implementing regulations, including but
not limited to 45 CFR Section 164.528 and 42 U.S.C. Section
17935(c). If Contractor maintains electronic health records for the
Department as of January 1, 2009 and later, Contractor must provide
an accounting of disclosures, including those disclosures for
treatment, payment or health care operations. The electronic
accounting of disclosures shall be for disclosures during the three
years prior to the request for an accounting.
12) Breaches and Security Incidents. During the term of this
Agreement, Contractor agrees to implement reasonable systems
for the discovery and prompt reporting of any breach or security
incident, and to take the following steps:
County of Fresno
16-93111
Page 10
a. Initial Notice to the Department. (1) To notify the
Department immediately by telephone call or email or
fax upon the discovery of a breach of unsecured PHI in
electronic media or in any other media if the PHI was, or is
reasonably believed to have been, accessed or acquired by
an unauthorized person. (2) To notify the Department
w ithin 24 hours (one hour if SSA data) by email or fax of
the discovery of any suspected security incident, intrusion
or unauthorized access, use or disclosure of PHI in violation
of this Agreement or this Exhibit E-1, or potential loss of
confidential data affecting this Agreement. A breach shall
be treated as discovered by Contractor as of the first day on
which the breach is known, or by exercising reasonable
diligence would have been known, to any person (other
than the person committing the breach) who is an
employee, officer or other agent of Contractor.
Notice shall be provided to the Information Protection Unit,
Office of HIPAA Compliance. If the incident occurs after
business hours or on a weekend or holiday and involves
electronic PHI, notice shall be provided by calling the
Information Protection Unit (916.445.4646, 866-866-0602)
or by emailing privacyofficer@dhcs.ca.gov). Notice shall be
made using the DHCS “Privacy Incident Report” form,
including all information known at the time. Contractor
shall use the most current version of this form, which is
posted on the DHCS Information Security Officer website
(www.dhcs.ca.gov, then select “Privacy” in the left column
and then “Business Partner” near the middle of the page)
or use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DH
CSBusinessAssociatesOnly.aspx
Upon discovery of a breach or suspected security incident,
intrusion or unauthorized access, use or disclosure of
Department PHI, Contractor shall take:
i) Prompt corrective action to mitigate any risks or
damages involved with the breach and to protect the
operating environment; and
ii) Any action pertaining to such unauthorized disclosure
required by applicable Federal and State laws and
regulations.
County of Fresno
16-93111
Page 11
b. Investigation and Investigation Report. To immediately
investigate such suspected security incident, security
incident, breach, or unauthorized access, use or
disclosure of PHI . Within 72 hours of the discovery,
Contractor shall submit an updated “Privacy Incident
Report” containing the information marked with an
asterisk and all other applicable information listed on the
form, to the extent known at that time, to the Information
Protection Unit.
c. Complete Report. To provide a complete report of the
investigation to the Department Program Contract Manager
and the Information Protection Unit within ten (10) working
days of the discovery of the breach or unauthorized use or
disclosure. The report shall be submitted on the “Privacy
Incident Report” form and shall include an assessment of all
known factors relevant to a determination of whether a
breach occurred under applicable provisions of HIPAA, the
HITECH Act, and the HIPAA regulations. The report shall
also include a full, detailed corrective action plan, including
information on measures that were taken to halt and/or
contain the improper use or disclosure. If the Department
requests information in addition to that listed on the “Privacy
Incident Report” form, Contractor shall make reasonable
efforts to provide the Department with such information. If,
because of the circumstances of the incident, Contractor
needs more than ten (10) working days from the discovery to
submit a complete report, the Department may grant a
reasonable extension of time, in which case Contractor shall
submit periodic updates until the complete report is
submitted. If necessary, a Supplemental Report may be used
to submit revised or additional information after the completed
report is submitted, by submitting the revised or additional
information on an updated “Privacy Incident Report” form.
The Department will review and approve the determination of
whether a breach occurred and whether individual
notifications and a corrective action plan are required.
d. Responsibility for Reporting of Breaches. If the cause of a
breach of Department PHI is attributable to Contractor or its
agents, subcontractors or vendors, Contractor is responsible
for all required reporting of the breach as specified in 42
U.S.C. section 17932 and its implementing regulations,
County of Fresno
16-93111
Page 12
including notification to media outlets and to the Secretary
(after obtaining prior written approval of DHCS). If a breach of
unsecured Department PHI involves more than 500 residents
of the State of California or under its jurisdiction, Contractor
shall first notify DHCS, then the Secretary of the breach
immediately upon discovery of the breach. If a breach
involves more than 500 California residents, Contractor shall
also provide, after obtaining written prior approval of DHCS,
notice to the Attorney General for the State of California,
Privacy Enforcement Section. If Contractor has reason to
believe that duplicate reporting of the same breach or incident
may occur because its subcontractors, agents or vendors
may report the breach or incident to the Department in
addition to Contractor, Contractor shall notify the Department,
and the Department and Contractor may take appropriate
action to prevent duplicate reporting.
e. Responsibility for Notification of Affected Individuals. If
the cause of a breach of Department PHI is attributable to
Contractor or its agents, subcontractors or vendors and
notification of the affected individuals is required under state
or federal law, Contractor shall bear all costs of such
notifications as well as any costs associated with the
breach. In addition, the Department reserves the right to
require Contractor to notify such affected individuals, which
notifications shall comply with the requirements set forth in
42U.S.C. section 17932 and its implementing regulations,
including, but not limited to, the requirement that the
notifications be made without unreasonable delay and in no
event later than 60 calendar days after discovery of the
breach. The Department Privacy Officer shall approve the
time, manner and content of any such notifications and their
review and approval must be obtained before the
notifications are made. The Department will provide its
review and approval expeditiously and without
unreasonable delay.
f. Department Contact Information. To direct
communications to the above referenced Department staff,
the Contractor shall initiate contact as indicated herein. The
Department reserves the right to make changes to the
contact information below by giving written notice to the
Contractor. Said changes shall not require an amendment to
this Addendum or the Agreement to which it is incorporated.
County of Fresno
16-93111
Page 13
Department
Program Contract
Manager
DHCS Privacy Officer DHCS Information Security
Officer
See the Exhibit A,
Scope of Work for
Program Contract
Manager
information
Information Protection Unit
c/o: Office of HIPAA
Compliance Department of
Health Care Services
P.O. Box 997413, MS 4722
Sacramento, CA 95899-7413
(916) 445-4646; (866) 866-
0602
Email:
privacyofficer@dhcs.ca.gov
Fax: (916) 440-7680
Information Security Officer
DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Service Desk (916)
440-7000; (800) 579-
0874
Fax: (916)440-5537
13) Termination of Agreement. In accordance with Section 13404(b) of
the HITECH Act and to the extent required by the HIPAA
regulations, if Contractor knows of a material breach or violation by
the Department of this Exhibit E-1, it shall take the following steps:
a. Provide an opportunity for the Department to cure the breach
or end the violation and terminate the Agreement if the
Department does not cure the breach or end the violation
within the time specified by Contractor; or
b. Immediately terminate the Agreement if the Department has
breached a material term of the Exhibit E-1 and cure is not
possible.
14) Sanctions and/or Penalties. Contractor understands that a failure to
comply with the provisions of HIPAA, the HITECH Act and the HIPAA
regulations that are applicable to Contractors may result in the
imposition of sanctions and/or penalties on Contractor under HIPAA,
the HITECH Act and the HIPAA regulations.
E. Obligations of the Department.
The Department agrees to:
County of Fresno
16-93111
Page 14
1) Permission by Individuals for Use and Disclosure of PHI. Provide
the Contractor with any changes in, or revocation of, permission by an
Individual to use or disclose Department PHI, if such changes affect
the Contractor’s permitted or required uses and disclosures.
2) Notification of Restrictions. Notify the Contractor of any restriction to
the use or disclosure of Department PHI that the Department has
agreed to in accordance with 45 CFR Section 164.522, to the extent
that such restriction may affect the Contractor’s use or disclosure of
PHI.
3) Requests Conflicting with HIPAA Rules. Not request the Contractor
to use or disclose Department PHI in any manner that would not be
permissible under the HIPAA regulations if done by the Department.
4) Notice of Privacy Practices. Provide Contractor with the web link to
the Notice of Privacy Practices that DHCS produces in accordance
with 45 CFR Section 164.520, as well as any changes to such notice.
Visit the DHCS website to view the most current Notice of Privacy
Practices at:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/NoticeofPrivacy
Practices.aspx or the DHCS website at www.dhcs.ca.gov (select
“Privacy in the right column and “Notice of Privacy Practices” on the
right side of the page).
F. Audits, Inspection and Enforcement
If Contractor is the subject of an audit, compliance review, or complaint
investigation by the Secretary or the Office for Civil Rights, U.S. Department of
Health and Human Services, that is related to the performance of its
obligations pursuant to this HIPAA Business Associate Exhibit E-1,Contractor
shall immediately notify the Department. Upon request from the Department,
Contractor shall provide the Department with a copy of any Department PHI
that Contractor, as the Business Associate, provides to the Secretary or the
Office of Civil Rights concurrently with providing such PHI to the Secretary.
Contractor is responsible for any civil penalties assessed due to an audit or
investigation of Contractor, in accordance with 42 U.S.C. Section 17934(c).
G. Termination.
1) Term. The Term of this Exhibit E-1 shall extend beyond the
termination of the Agreement and shall terminate when all
Department PHI is destroyed or returned to the Department, in
accordance with 45 CFR Section 164.504(e)(2)(ii)(J).
County of Fresno
16-93111
Page 15
2) Termination for Cause. In accordance with 45 CFR Section
164.504(e)(1)(iii), upon the Department’s knowledge of a material
breach or violation of this Exhibit E-1 by Contractor, the Department
shall:
a. Provide an opportunity for Contractor to cure the breach or
end the violation and terminate this Agreement if Contractor
does not cure the breach or end the violation within the time
specified by the Department; or
b. Immediately terminate this Agreement if Contractor has
breached a material term of this Exhibit E-1 and cure is not
possible.
THE REST OF THIS PAGE IS INTENTIONALLY BLANK
County of Fresno
16-93111
Page 16
EXHIBIT E-2
Privacy and Security of Personal Information and Personally Identifiable
Information Not Subject to HIPAA
1. Recitals.
A. In addition to the Privacy and Security Rules under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) the Department is
subject to various other legal and contractual requirements with respect to
the personal information (PI) and personally identifiable information (PII) it
maintains. These include:
1) The California Information Practices Act of 1977 (California Civil
Code §§1798 et seq.),
2) The Agreement between the Social Security Administration (SSA)
and the Department, known as the Information Exchange
Agreement (IEA), which incorporates the Computer Matching and
Privacy Protection Act Agreement (CMPPA) between the SSA and
the California Health and Human Services Agency. The IEA,
including the CMPPA is attached to this Exhibit E as Attachment B
and is hereby incorporated in this Agreement.
3) Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2.
B. The purpose of this Exhibit E-2 is to set forth Contractor’s privacy and
security obligations with respect to PI and PII that Contractor may create,
receive, maintain, use, or disclose for or on behalf of Department pursuant
to this Agreement. Specifically this Exhibit applies to PI and PII which is
not Protected Health Information (PHI) as defined by HIPAA and therefore
is not addressed in Exhibit E-1 of this Agreement, the HIPAA Business
Associate Addendum; however, to the extent that data is both PHI or ePHI
and PII, both Exhibit E-1 and this Exhibit E-2 shall apply.
C. The IEA Agreement referenced in A.2) above requires the Department to
extend its substantive privacy and security terms to subcontractors who
receive data provided to DHCS by the Social Security Administration. If
Contractor receives data from DHCS that includes data provided to DHCS
by the Social Security Administration, Contractor must comply with the
following specific sections of the IEA Agreement: E. Security Procedures,
F. Contractor/Agent Responsibilities, and G. Safeguarding and Reporting
Responsibilities for Personally Identifiable Information (“PII”), and in
Attachment 4 to the IEA, Electronic Information Exchange Security
Requirements, Guidelines and Procedures for Federal, State and Local
County of Fresno
16-93111
Page 17
Agencies Exchanging Electronic Information with the Social Security
Administration. Contractor must also ensure that any agents, including a
subcontractor, to whom it provides DHCS data that includes data provided
by the Social Security Administration, agree to the same requirements for
privacy and security safeguards for such confidential data that apply to
Contractor with respect to such information.
D. The terms used in this Exhibit E-2, but not otherwise defined, shall have
the same meanings as those terms have in the above referenced statute
and Agreement. Any reference to statutory, regulatory, or contractual
language shall be to such language as in effect or as amended.
2. Definitions.
A. “Breach” shall have the meaning given to such term under the IEA and
CMPPA. It shall include a “PII loss” as that term is defined in the CMPPA.
B. “Breach of the security of the system” shall have the meaning given to
such term under the California Information Practices Act, Civil Code
section 1798.29(f).
C. “CMPPA Agreement” means the Computer Matching and Privacy
Protection Act Agreement between the Social Security Administration and
the California Health and Human Services Agency (CHHS).
D. “Department PI” shall mean Personal Information, as defined below,
accessed in a database maintained by the Department, received by
Contractor from the Department or acquired or created by Contractor in
connection with performing the functions, activities and services specified
in this Agreement on behalf of the Department.
E. “IEA” shall mean the Information Exchange Agreement currently in effect
between the Social Security Administration (SSA) and the California
Department of Health Care Services (DHCS).
F. “Notice-triggering Personal Information” shall mean the personal
information identified in Civil Code section 1798.29 whose unauthorized
access may trigger notification requirements under Civil Code section
1798.29. For purposes of this provision, identity shall include, but not be
limited to, name, address, email address, identifying number, symbol, or
other identifying particular assigned to the individual, such as a finger or
voice print, a photograph or a biometric identifier. Notice-triggering
Personal Information includes PI in electronic, paper or any other medium.
County of Fresno
16-93111
Page 18
G. “Personally Identifiable Information” (PII) shall have the meaning given to
such term in the IEA and CMPPA.
H. “Personal Information” (PI) shall have the meaning given to such term in
California Civil Code Section 1798.3(a).
I. “Required by law” means a mandate contained in law that compels an
entity to make a use or disclosure of PI or PII that is enforceable in a court
of law. This includes, but is not limited to, court orders and court-ordered
warrants, subpoenas or summons issued by a court, grand jury, a
governmental or tribal inspector general, or an administrative body
authorized to require the production of information, and a civil or an
authorized investigative demand. It also includes Medicare conditions of
participation with respect to health care providers participating in the
program, and statutes or regulations that require the production of
information, including statutes or regulations that require such information
if payment is sought under a government program providing public
benefits.
J. “Security Incident” means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of PI, or confidential
data utilized in complying with this Agreement; or interference with system
operations in an information system that processes, maintains or stores
PI.
3. Terms of Agreement
A. Permitted Uses and Disclosures of Department PI and PII by
Contractor
Except as otherwise indicated in this Exhibit E-2, Contractor may use or
disclose Department PI only to perform functions, activities or services for
or on behalf of the Department pursuant to the terms of this Agreement
provided that such use or disclosure would not violate the California
Information Practices Act (CIPA) if done by the Department.
B. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose Department PI or PII other
than as permitted or required by this Agreement or as required by
applicable state and federal law.
County of Fresno
16-93111
Page 19
2) Safeguards. To implement appropriate and reasonable
administrative, technical, and physical safeguards to protect the
security, confidentiality and integrity of Department PI and PII, to
protect against anticipated threats or hazards to the security or
integrity of Department PI and PII, and to prevent use or disclosure
of Department PI or PII other than as provided for by this
Agreement. Contractor shall develop and maintain a written
information privacy and security program that include administrative,
technical and physical safeguards appropriate to the size and
complexity of Contractor’s operations and the nature and scope of
its activities, which incorporate the requirements of section 3,
Security, below. Contractor will provide DHCS with its current
policies upon request.
3) Security. Contractor shall take any and all steps necessary to
ensure the continuous security of all computerized data systems
containing PHI and/or PI, and to protect paper documents containing
PHI and/or PI. These steps shall include, at a minimum:
a. Complying with all of the data system security precautions
listed in Attachment A, Business Associate Data Security
Requirements;
b. Providing a level and scope of security that is at least
comparable to the level and scope of security established by
the Office of Management and Budget in OMB Circular No. A-
130, Appendix III- Security of Federal Automated Information
Systems, which sets forth guidelines for automated
information systems in Federal agencies; and
c. If the data obtained by Contractor from DHCS includes PII,
Contractor shall also comply with the substantive privacy and
security requirements in the Computer Matching and Privacy
Protection Act Agreement between the SSA and the California
Health and Human Services Agency (CHHS) and in the
Agreement between the SSA and DHCS, known as the
Information Exchange Agreement, which are attached as
Attachment B and incorporated into this Agreement. The
specific sections of the IEA with substantive privacy and
security requirements to be complied with are sections E, F,
and G, and in Attachment 4 to the IEA, Electronic Information
Exchange Security Requirements, Guidelines and Procedures
for Federal, State and Local Agencies Exchanging Electronic
Information with the SSA. Contractor also agrees to ensure
that any agents, including a subcontractor to whom it provides
County of Fresno
16-93111
Page 20
DHCS PII, agree to the same requirements for privacy and
security safeguards for confidential data that apply to
Contractor with respect to such information.
4) Mitigation of Harmful Effects. To mitigate, to the extent
practicable, any harmful effect that is known to Contractor of a use
or disclosure of Department PI or PII by Contractor or its
subcontractors in violation of this Exhibit E-2.
5) Contractor’s Agents and Subcontractors. To impose the same
restrictions and conditions set forth in this Exhibit E-2 on any
subcontractors or other agents with whom Contractor subcontracts
any activities under this Agreement that involve the disclosure of
Department PI or PII to the subcontractor.
6) Availability of Information to DHCS. To make Department PI and
PII available to the Department for purposes of oversight,
inspection, amendment, and response to requests for records,
injunctions, judgments, and orders for production of Department PI
and PII. If Contractor receives Department PII, upon request by
DHCS, Contractor shall provide DHCS with a list of all employees,
contractors and agents who have access to Department PII,
including employees, contractors and agents of its subcontractors
and agents.
7) Cooperation with DHCS. With respect to Department PI, to
cooperate with and assist the Department to the extent necessary
to ensure the Department’s compliance with the applicable terms of
the CIPA including, but not limited to, accounting of disclosures of
Department PI, correction of errors in Department PI, production of
Department PI, disclosure of a security breach involving
Department PI and notice of such breach to the affected
individual(s).
8) Confidentiality of Alcohol and Drug Abuse Patient Records.
Contractor agrees to comply with all confidentiality requirements set
forth in Title 42 Code of Federal Regulations, Chapter I, Subchapter
A, Part 2. Contractor is aware that criminal penalties may be
imposed for a violation of these confidentiality requirements.
9) Breaches and Security Incidents. During the term of this
Agreement, Contractor agrees to implement reasonable
systems for the discovery and prompt reporting of any breach
or security incident, and to take the following steps:
a. Initial Notice to the Department. (1) To notify the Department
County of Fresno
16-93111
Page 21
immediately by telephone call or email or fax upon the
discovery of a breach of unsecured Department PI or PII in
electronic media or in any other media if the PI or PII was, or
is reasonably believed to have been, accessed or acquired
by an unauthorized person, or upon discovery of a suspected
security incident involving Department PII. (2) To notify the
Department within one (1) hour by email or fax if the data
is data subject to the SSA Agreement; and within 24 hours
by email or fax of the discovery of any suspected security
incident, intrusion or unauthorized access, use or disclosure
of Department PI or PII in violation of this Agreement or this
Exhibit E-1 or potential loss of confidential data affecting this
Agreement. A breach shall be treated as discovered by
Contractor as of the first day on which the breach is known,
or by exercising reasonable diligence would have been
known, to any person (other than the person committing the
breach) who is an employee, officer or other agent of
Contractor.
b. Notice shall be provided to the Information Protection Unit,
Office of HIPAA Compliance. If the incident occurs after
business hours or on a weekend or holiday and involves
electronic Department PI or PII, notice shall be provided by
calling the Department Information Security Officer. Notice
shall be made using the DHCS “Privacy Incident Report”
form, including all information known at the time. Contractor
shall use the most current version of this form, which is
posted on the DHCS Information Security Officer website
(www.dhcs.ca.gov, then select “Privacy” in the left column
and then “Business Partner” near the middle of the page) or
use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DHCS
BusinessAssociatesOnly.aspx .
c. Upon discovery of a breach or suspected security incident,
intrusion or unauthorized access, use or disclosure of
Department PI or PII, Contractor shall take:
i. Prompt corrective action to mitigate any risks or damages
involved with the breach and to protect the operating
environment; and
ii. Any action pertaining to such unauthorized disclosure
required by applicable Federal and State laws and
County of Fresno
16-93111
Page 22
regulations.
d. Investigation and Investigation Report. To immediately
investigate such suspected security incident, security
incident, breach, or unauthorized access, use or disclosure of
PHI. Within 72 hours of the discovery, Contractor shall
submit an updated “Privacy Incident Report” containing the
information marked with an asterisk and all other applicable
information listed on the form, to the extent known at that
time, to the Department Information Security Officer.
e. Complete Report. To provide a complete report of the
investigation to the Department Program Contract Manager
and the Information Protection Unit within ten (10) working
days of the discovery of the breach or unauthorized use or
disclosure. The report shall be submitted on the “Privacy
Incident Report” form and shall include an assessment of all
known factors relevant to a determination of whether a
breach occurred. The report shall also include a full, detailed
corrective action plan, including information on measures that
were taken to halt and/or contain the improper use or
disclosure. If the Department requests information in addition
to that listed on the “Privacy Incident Report” form, Contractor
shall make reasonable efforts to provide the Department with
such information. If, because of the circumstances of the
incident, Contractor needs more than ten (10) working days
from the discovery to submit a complete report, the
Department may grant a reasonable extension of time, in
which case Contractor shall submit periodic updates until the
complete report is submitted. If necessary, a Supplemental
Report may be used to submit revised or additional
information after the completed report is submitted, by
submitting the revised or additional information on an
updated “Privacy Incident Report” form. The Department will
review and approve the determination of whether a breach
occurred and whether individual notifications and a corrective
action plan are required.
f. Responsibility for Reporting of Breaches. If the cause of a
breach of Department PI or PII is attributable to Contractor or
its agents, subcontractors or vendors, Contractor is
responsible for all required reporting of the breach as
specified in CIPA, section 1798.29and as may be required
under the IEA. Contractor shall bear all costs of required
County of Fresno
16-93111
Page 23
notifications to individuals as well as any costs associated
with the breach. The Privacy Officer shall approve the time,
manner and content of any such notifications and their review
and approval must be obtained before the notifications are
made. The Department will provide its review and approval
expeditiously and without unreasonable delay.
g. If Contractor has reason to believe that duplicate reporting of
the same breach or incident may occur because its
subcontractors, agents or vendors may report the breach or
incident to the Department in addition to Contractor,
Contractor shall notify the Department, and the Department
and Contractor may take appropriate action to prevent
duplicate reporting.
h. Department Contact Information. To direct communications
to the above referenced Department staff, the Contractor shall
initiate contact as indicated herein. The Department reserves
the right to make changes to the contact information below by
giving written notice to the Contractor. Said changes shall not
require an amendment to this Addendum or the Agreement to
which it is incorporated.
Department
Program
Contract
DHCS Privacy Officer DHCS Information Security Officer
See the Exhibit
A, Scope of
Work for
Program
Contract
Manager
information
Information Protection Unit c/o: Office of HIPAA Compliance Department of Health Care Services P.O. Box 997413, MS 4722
Sacramento, CA 95899-7413 (916) 445-4646
Email:
privacyofficer@dhcs.ca.gov
Telephone:(916) 445-4646
Information Security Officer DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Service Desk
(916) 440-7000 or
(800) 579-0874
10) Designation of Individual Responsible for Security
Contractor shall designate an individual, (e.g., Security Officer), to
oversee its data security program who shall be responsible for carrying
out the requirements of this Exhibit E-2 and for communicating on
security matters with the Department.
County of Fresno
16-93111
Page 24
EXHIBIT E-3
Miscellaneous Terms and Conditions
Applicable to Exhibit E
1) Disclaimer. The Department makes no warranty or representation that
compliance by Contractor with this Exhibit E, HIPAA or the HIPAA
regulations will be adequate or satisfactory for Contractor’s own purposes or
that any information in Contractor’s possession or control, or transmitted or
received by Contractor, is or will be secure from unauthorized use or
disclosure. Contractor is solely responsible for all decisions made by
Contractor regarding the safeguarding of the Department PHI, PI and PII.
2) Amendment. The parties acknowledge that federal and state laws relating to
electronic data security and privacy are rapidly evolving and that amendment
of this Exhibit E may be required to provide for procedures to ensure
compliance with such developments. The parties specifically agree to take
such action as is necessary to implement the standards and requirements of
HIPAA, the HITECH Act, and the HIPAA regulations, and other applicable
state and federal laws. Upon either party’s request, the other party agrees to
promptly enter into negotiations concerning an amendment to this Exhibit E
embodying written assurances consistent with the standards and
requirements of HIPAA, the HITECH Act, and the HIPAA regulations, and
other applicable state and federal laws. The Department may terminate this
Agreement upon thirty (30) days written notice in the event:
a) Contractor does not promptly enter into negotiations to amend
this Exhibit E when requested by the Department pursuant to this
section; or
b) Contractor does not enter into an amendment providing
assurances regarding the safeguarding of Department PHI that the
Department deems is necessary to satisfy the standards and
requirements of HIPAA and the HIPAA regulations.
3) Judicial or Administrative Proceedings. Contractor will notify the
Department if it is named as a defendant in a criminal proceeding for a
violation of HIPAA or other security or privacy law. The Department may
terminate this Agreement if Contractor is found guilty of a criminal
violation of HIPAA. The Department may terminate this Agreement if a
finding or stipulation that the Contractor has violated any standard or
requirement of HIPAA, or other security or privacy laws is made in any
administrative or civil proceeding in which the Contractor is a party or
County of Fresno
16-93111
Page 25
has been joined. DHCS will consider the nature and seriousness of the
violation in deciding whether or not to terminate the Agreement.
4) Assistance in Litigation or Administrative Proceedings. Contractor
shall make itself and any subcontractors, employees or agents assisting
Contractor in the performance of its obligations under this Agreement,
available to the Department at no cost to the Department to testify as
witnesses, or otherwise, in the event of litigation or administrative
proceedings being commenced against the Department, its directors,
officers or employees based upon claimed violation of HIPAA, or the
HIPAA regulations, which involves inactions or actions by the
Contractor, except where Contractor or its subcontractor, employee or
agent is a named adverse party.
5) No Third-Party Beneficiaries. Nothing express or implied in the terms
and conditions of this Exhibit E is intended to confer, nor shall anything
herein confer, upon any person other than the Department or Contractor
and their respective successors or assignees, any rights, remedies,
obligations or liabilities whatsoever.
6) Interpretation. The terms and conditions in this Exhibit E shall be
interpreted as broadly as necessary to implement and comply with
HIPAA, the HITECH Act, and the HIPAA regulations. The parties agree
that any ambiguity in the terms and conditions of this Exhibit E shall be
resolved in favor of a meaning that complies and is consistent with
HIPAA, the HITECH Act and the HIPAA regulations, and, if applicable,
any other relevant state and federal laws.
7) Conflict. In case of a conflict between any applicable privacy or
security rules, laws, regulations or standards the most stringent shall
apply. The most stringent means that safeguard which provides the
highest level of protection to PHI, PI and PII from unauthorized
disclosure. Further, Contractor must comply within a reasonable period
of time with changes to these standards that occur after the effective
date of this Agreement.
8) Regulatory References. A reference in the terms and conditions of this
Exhibit E to a section in the HIPAA regulations means the section as in
effect or as amended.
9) Survival. The respective rights and obligations of Contractor under
Section 3, Item D of Exhibit E-1, and Section 3, Item B of Exhibit E-2,
Responsibilities of Contractor, shall survive the termination or expiration
of this Agreement.
County of Fresno
16-93111
Page 26
10) No Waiver of Obligations. No change, waiver or discharge of any
liability or obligation hereunder on any one or more occasions shall be
deemed a waiver of performance of any continuing or other obligation,
or shall prohibit enforcement of any obligation, on any other occasion.
11) Audits, Inspection and Enforcement. From time to time, and subject
to all applicable federal and state privacy and security laws and
regulations, the Department may conduct a reasonable inspection of the
facilities, systems, books and records of Contractor to monitor
compliance with this Exhibit E. Contractor shall promptly remedy any
violation of any provision of this Exhibit E. The fact that the Department
inspects, or fails to inspect, or has the right to inspect, Contractor’s
facilities, systems and procedures does not relieve Contractor of its
responsibility to comply with this Exhibit E. The Department's failure to
detect a non-compliant practice, or a failure to report a detected non-
compliant practice to Contractor does not constitute acceptance of such
practice or a waiver of the Department's enforcement rights under this
Agreement, including this Exhibit E.
12) Due Diligence. Contractor shall exercise due diligence and shall take
reasonable steps to ensure that it remains in compliance with this Exhibit
E and is in compliance with applicable provisions of HIPAA, the HITECH
Act and the HIPAA regulations, and other applicable state and federal
law, and that its agents, subcontractors and vendors are in compliance
with their obligations as required by this Exhibit E.
13) Term. The Term of this Exhibit E-1 shall extend beyond the termination of
the Agreement and shall terminate when all Department PHI is destroyed
or returned to the Department, in accordance with 45 CFR Section
164.504(e)(2)(ii)(I), and when all Department PI and PII is destroyed in
accordance with Attachment A.
14) Effect of Termination. Upon termination or expiration of this Agreement
for any reason, Contractor shall return or destroy all Department PHI, PI
and PII that Contractor still maintains in any form, and shall retain no
copies of such PHI, PI or PII. If return or destruction is not feasible,
Contractor shall notify the Department of the conditions that make the
return or destruction infeasible, and the Department and Contractor shall
determine the terms and conditions under which Contractor may retain the
PHI, PI or PII. Contractor shall continue to extend the protections of this
Exhibit E to such Department PHI, PI and PII, and shall limit further use of
such data to those purposes that make the return or destruction of such
data infeasible. This provision shall apply to Department PHI, PI and PII
that is in the possession of subcontractors or agents of Contractor.
County of Fresno
16-93111
Page 27
Attachment A
Data Security Requirements
1. Personnel Controls
A. Employee Training. All workforce members who assist in the
performance of functions or activities on behalf of the Department, or
access or disclose Department PHI or PI must complete information
privacy and security training, at least annually, at Contractor's expense.
Each workforce member who receives information privacy and security
training must sign a certification, indicating the member’s name and the
date on which the training was completed. These certifications must be
retained for a period of six (6) years following termination of this
Agreement.
B. Employee Discipline. Appropriate sanctions must be applied against
workforce members who fail to comply with privacy policies and
procedures or any provisions of these requirements, including termination
of employment where appropriate.
C. Confidentiality Statement. All persons that will be working with
Department PHI or PI must sign a confidentiality statement that includes,
at a minimum, General Use, Security and Privacy Safeguards,
Unacceptable Use, and Enforcement Policies. The statement must be
signed by the workforce member prior to access to Department PHI or PI.
The statement must be renewed annually. The Contractor shall retain
each person’s written confidentiality statement for Department inspection
for a period of six (6) years following termination of this Agreement.
D. Background Check. Before a member of the workforce may access
Department PHI or PI, a background screening of that worker must be
conducted. The screening should be commensurate with the risk and
magnitude of harm the employee could cause, with more thorough
screening being done for those employees who are authorized to bypass
significant technical and operational security controls. The Contractor shall
retain each workforce member’s background check documentation for a
period of three (3) years.
2. Technical Security Controls
A. Workstation/Laptop encryption. All workstations and laptops that store
Department PHI or PI either directly or temporarily must be encrypted
using a FIPS 140-2 certified algorithm which is 128bit or higher, such as
County of Fresno
16-93111
Page 28
Advanced Encryption Standard (AES). The encryption solution must be
full disk unless approved by the Department Information Security Office.
B. Server Security. Servers containing unencrypted Department PHI or PI
must have sufficient administrative, physical, and technical controls in place
to protect that data, based upon a risk assessment/system security review.
C. Minimum Necessary. Only the minimum necessary amount of Department
PHI or PI required to perform necessary business functions may be copied,
downloaded, or exported.
D. Removable media devices. All electronic files that contain Department
PHI or PI data must be encrypted when stored on any removable media or
portable device (i.e. USB thumb drives, floppies, CD/DVD, Blackberry,
backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm
which is 128bit or higher, such as AES.
E. Antivirus software. All workstations, laptops and other systems that process
and/or store Department PHI or PI must install and actively use comprehensive
anti-virus software solution with automatic updates scheduled at least daily.
F. Patch Management. All workstations, laptops and other systems that
process and/or store Department PHI or PI must have critical security
patches applied, with system reboot if necessary. There must be a
documented patch management process which determines installation
timeframe based on risk assessment and vendor recommendations. At a
maximum, all applicable patches must be installed within 30 days of vendor
release. Applications and systems that cannot be patched within this time
frame due to significant operational reasons must have compensatory
controls implemented to minimize risk until the patches can be installed.
Applications and systems that cannot be patched must have compensatory
controls implemented to minimize risk, where possible.
G. User IDs and Password Controls. All users must be issued a unique user
name for accessing Department PHI or PI. Username must be promptly
disabled, deleted, or the password changed upon the transfer or termination of
an employee with knowledge of the password. Passwords are not to be
shared. Passwords must be at least eight characters and must be a non-
dictionary word. Passwords must not be stored in readable format on the
computer. Passwords must be changed at least every 90 days, preferably
every 60 days. Passwords must be changed if revealed or compromised.
Passwords must be composed of characters from at least three of the following
four groups from the standard keyboard:
County of Fresno
16-93111
Page 29
1) Upper case letters (A-Z)
2) Lower case letters (a-z)
3) Arabic numerals (0-9)
4) Non-alphanumeric characters (punctuation symbols)
H. Data Destruction. When no longer needed, all Department PHI or PI must be
wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7
Pass) standard, or by degaussing. Media may also be physically destroyed in
accordance with NIST Special Publication 800-88. Other methods require prior
written permission of the Department Information Security Office.
I. System Timeout. The system providing access to Department PHI or PI
must provide an automatic timeout, requiring re-authentication of the user
session after no more than 20 minutes of inactivity.
J. Warning Banners. All systems providing access to Department PHI or PI
must display a warning banner stating that data is confidential, systems
are logged, and system use is for business purposes only by authorized
users. User must be directed to log off the system if they do not agree
with these requirements.
K. Sys tem Logging. The system must maintain an automated audit trail
which can identify the user or system process which initiates a request for
Department PHI or PI, or which alters Department PHI or PI. The audit
trail must be date and time stamped, must log both successful and failed
accesses, must be read only, and must be restricted to authorized users.
If Department PHI or PI is stored in a database, database logging
functionality must be enabled. Audit trail data must be archived for at
least 3 years after occurrence.
L. Access Controls. The system providing access to Department PHI or PI
must use role based access controls for all user authentications, enforcing
the principle of least privilege.
M. Transmission encryption. All data transmissions of Department PHI or
PI outside the secure internal network must be encrypted using a FIPS
140-2 certified algorithm which is 128bit or higher, such as AES.
Encryption can be end to end at the network level, or the data files
containing Department PHI can be encrypted. This requirement pertains
to any type of Department PHI or PI in motion such as website access, file
transfer, and E-Mail.
County of Fresno
16-93111
Page 30
N. Intrusion Detection. All systems involved in accessing, holding,
transporting, and protecting Department PHI or PI that are accessible via
the Internet must be protected by a comprehensive intrusion detection and
prevention solution.
3. Audit Controls
A. System Security Review. Contractor must ensure audit control
mechanisms that record and examine system activity are in place. All
systems processing and/or storing Department PHI or PI must have at
least an annual system risk assessment/security review which provides
assurance that administrative, physical, and technical controls are
functioning effectively and providing adequate levels of protection.
Reviews should include vulnerability scanning tools.
B. Log Reviews. All systems processing and/or storing Department PHI or
PI must have a routine procedure in place to review system logs for
unauthorized access.
C. Change Control. All systems processing and/or storing Department PHI
or PI must have a documented change control procedure that ensures
separation of duties and protects the confidentiality, integrity and
availability of data.
4. Business Continuity / Disaster Recovery Controls
A. Emergency Mode Operation Plan. Contractor must establish a
documented plan to enable continuation of critical business processes and
protection of the security of Department PHI or PI held in an electronic
format in the event of an emergency. Emergency means any
circumstance or situation that causes normal computer operations to
become unavailable for use in performing the work required under this
Agreement for more than 24 hours.
B. Data Backup Plan. Contractor must have established documented
procedures to backup Department PHI to maintain retrievable exact
copies of Department PHI or PI. The plan must include a regular schedule
for making backups, storing backups offsite, an inventory of backup
media, and an estimate of the amount of time needed to restore
Department PHI or PI should it be lost. At a minimum, the schedule must
be a weekly full backup and monthly offsite storage of Department data.
5. Paper Document Controls
County of Fresno
16-93111
Page 31
A. Supervision of Data. Department PHI or PI in paper form shall not be left
unattended at any time, unless it is locked in a file cabinet, file room, desk
or office. Unattended means that information is not being observed by an
employee authorized to access the information. Department PHI or PI in
paper form shall not be left unattended at any time in vehicles or planes
and shall not be checked in baggage on commercial airplanes.
B. Escorting Visitors. Visitors to areas where Department PHI or PI is
contained shall be escorted and Department PHI or PI shall be kept out of
sight while visitors are in the area.
C. Confidential Destruction. Department PHI or PI must be disposed of
through confidential means, such as cross cut shredding and pulverizing.
D. Removal of Data. Only the minimum necessary Department PHI or PI
may be removed from the premises of the Contractor except with express
written permission of the Department. Department PHI or PI shall not be
considered "removed from the premises" if it is only being transported
from one of Contractor's locations to another of Contractors locations.
E. Faxing. Faxes containing Department PHI or PI shall not be left
unattended and fax machines shall be in secure areas. Faxes shall
contain a confidentiality statement notifying persons receiving faxes in
error to destroy them. Fax numbers shall be verified with the intended
recipient before sending the fax.
F. Mailing. Mailings containing Department PHI or PI shall be sealed and
secured from damage or inappropriate viewing of such PHI or PI to the
extent possible. Mailings which include 500 or more individually
identifiable records of Department PHI or PI in a single package shall be
sent using a tracked mailing method which includes verification of delivery
and receipt, unless the prior written permission of the Department to use
another method is obtained.
..
INFORMATION EXCHANGE AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION (SSA) AND
THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES (STATE AGENCY) ·-
A.PURPOSE: The purpose of this Information Exchange Agreement ("IEA") is to establish
terms, conditions, and safeguards under which SSA will disclose to the State Agency certain
information, records, or data (herein "data") to assist the State Agency in administering
certain federally funded state-administered benefit programs (including state-funded state
supplementary payment programs under Title XVI of the Social Security Act) identified in
·this IEA. By entering into this IEA, the State Agency agrees to comply with: ·•the terms and conditions set forth in the Computer Matching and Privacy Protection ActAgreement ("CMPPA Agreement") attached as Attachment 1, governing the State
Agency's use of the data disclosed from SSA's Privacy Act System of Records; and•all other terms and conditions set forth in this IEA.
B.PROGRAMS AND DATA EXCHANGE SYSTEMS: (1) The State Agency will use thedata received or accessed from SSA under this IEA for the purpose of administering the
federally funded, state-administered programs identified in Table 1 below. In Table 1, the
State Agency has identified: (a) each federally funded, state-administered program that it
administers; and (b) each SSA data exchange system to which the State Agency needs accessin order to administer the identified program. The list of SSA's data exchange systems is
attached as Attachment 2:
TABLE 1
FED ERALLY FUNDED BENEFIT PROGRAMS
Program SSA Data Exchange System(s)
[X]· Medicaid BENDEX/SDX/EVS/SVES/SOLQ!SVES I-Citizenship /Quarters of Coverage/Prisoner Query
D Temporary Assistance to Needy Families
(TANF)
D Supplemental Nutrition Assistance Program
(SNAP� formally Food Stamps)·
D Unemployment Compensation (Federal)
D Unemployment Compensation (State)
D State Child Support Agency
D Low-Income Home Energy Assistance
Program (LI-HEAP)
O Workers Compensation
O Vocational Rehabilitation Services
1
Exhibit E, Attachment B
SSA - IEA
County of Fresno
16-93111
1 of 70
D Foster Care (IV-E)
D State Health Insurance Program (S-CHIP)
D Women, Infants and Children (W.l.C.)
[X] Medicare Savings Programs (MSP) LIS File
[X] Medicare 1144 (Outreach) Medicare 1144 Outreach File
D Other Federally Funded, State-Administered Programs (List Below)
Program SSA Data Exchange System(s)
(2) The State Agency will use each identified data exchange system onlv for the purpose of
administering the specific program for which access to the data exchange system is provided.
SSA data exchange systems are protected by the Privacy Act and federal law prohibits the
use of SSA's data for any purpose other than the purpose of administering the specific
program for which such data is disclosed. In particular, the State Agency will use: (a) the tax
return data disclosed by SSA only to determine individual eligibility for, or the amount of,
assistance under a state plan pursuant to Section 113 7 programs and child support
enforcement programs in accordance with 26 U.S.C. § 6103(1)(8); and (b) the citizenship
status data disclosed by SSA under the Children'.s Health Insurance Program
Reauthorization Act of 2009, Pub. L. 111-3, only for the purpose of determining entitlement
to Medicaid and CHIP program for new applicants. The State Agency also acknowledges
that SSA's citizenship data may be less than 50 percent current. Applicants for SSNs report
their citizenship data at the time they apply for their SSNs; there is no obligation for an
individual to report to SSA a change in his or her immigration status until he or she files a
claim for benefits.
C. PROGRAM QUESTIONNAIRE: Prior to signing this IEA, the State Agency will
complete and submit to SSA a program questionnaire for each of the federally funded, state
administered programs checked in ';[able 1 above. SSA will not disclose any data under this
!EA until it has received and approved the completed program questionnaire for each of the
programs identified in Table 1 above.
2
County of Fresno
16-93111
2 of 70
D. TRANSFER OF DATA: SSA will transmit the data to the State Agency under this IBA
using the data transmission method identified in Table 2 below:
TABLE2
TRANSFER OF DATA
D Data will be transmitted directly between SSA and the State Agency.
[X} Data will be transmitted directly between SSA and the California Office of Technology (State
Transmission/Transfer Component ("STC")) by the File Transfer Management System, a secure
mechariism approved by SSA. The STC will serve as the conduit between SSA and the State
Agency pursuant to the State STC Agreement.
D Data will be transmitted directly between SSA and the Interstate Connection Network
("ICON"). ICON is a wide area telecommunications network connecting state agencies that
administer the state unemployment insurance laws. When receiving data through ICON, the
State Agency will comply with the "Systems Security Requirements for SSA Web Access to SSA
Information Through the ICON," attached as Attachment 3.
E. SECURITY PROCEDURES: The State Agency will comply with limitations on use,
treatment, and safeguarding of data under the Privacy Act of 1974 (5 U.S.C. 552a), as
amended by the Computer Matching and Privacy Protection Act of 1988, related Office of
Management and Budget guidelines, the Federal Information Security Management Act of
2002 (44 U.S.C. § 3541, et seq.), and related National Institute of Standards and Technology
guidelines. In addition, the State Agency will comply with SSA's "Information System
Security Guidelines for Federal, State and Local Agencies Receiving Electronic Information
from the Social Security Adniinistration," attached as Attachment 4. For any tax return
data, the State Agency will also comply with the "Tax Information Security Guidelines for
Federal, State and Local Agencies," Publication 1075, published by the Secretary of the
Treasury and available at the following Internal Revenue Service (IRS) website:
http://www.irs.gov/pub/irs-pdf/pl075.pdf. This IRS Publication 1075 is incorporated by
reference into this IBA.
F. CONTRACTOR/AGENT RESPONSIBILITIES: The State Agency will restrict access to
the data obtained from SSA.to only those authorized State employees, contractors, and
agents who need such data to perform their official duties in connection with purposes
identified in this IEA. At SSA's request, the State Agency will obtain from each of its
contractors and agents a current list of the employees of its contractors and agents who have
access to SSA data disclosed under this IEA. The State Agency will require its contractors,
agents, and all employees of such contractors or agents with authorized access to the SSA
data disclosed under this IEA, to comply with the terms and conditions set forth in this IBA,
and not to duplicate, disseminate, or disclose such data without obtaining SSA's prior written
approval. In addition, the State Agency will comply with the limitations on use, duplication,
and redisclo~ure of SSA data set forth in Section IX. of the CMPP A Agreement, especially
with respect to its contractors and agents.
3
County of Fresno
16-93111
3 of 70
G. SAFEGUARDING AND REPORTING RESPONSIBILITIES FOR PERSONALLY
.IDENTIFIABLE INFORMATION ("PII"):
1. The State Agency will ensure that its employees, contractors, and agents:
a. properly safeguard PU furnished by SSA under this IBA from loss, theft or
inadvertent disclosure;
b. understand that they are responsible for safeguarding this information at all times,
regardless of whether or not the State employe·e, contractor, or agent is at bis or her
regular duty station;
c. ensure that laptops and other electronic devices/media containing PII are encrypted
and/or password protected;
d. send emails containing PII only if encrypted or if to and from addresses that are
secure; and .
e. limit disclosure of the information and details relating to a PII loss only to those with
a need to know.
2. If an employee of the State Agency or an employee of the State Agency's contractor or
agent becomes aware of suspected or actual loss of PII, he or she must immediately
contact the State Agency official responsible for Systems Security designated below or
his or her delegate. That State Agency official or delegate must then notify the SSA
Regional Office Contact and the SSA Systems Security Contact identified below. If, for
any reason, the responsible State Agency official or delegate is unable to notify the SSA
Regional Office or the SSA Systems Security Contact within 1 hour, the responsible State
Agency official or delegate must call SSA's Network Customer Service Center
("NCSC") at 410-965-7777 or toll free at 1-888-772-6661 to report the actual or
suspected loss. The responsible State Agency official or delegate will use the worksheet,
attached as Attachment 5, to quickly gather and organize information about the incident.
The responsible State Agency official or delegate must provide to SSA timely updates as
any additional information about the loss of PII becomes available.
3. SSA will make the necessary contact within SSA to file a formal report in accordance
with SSA procedures. SSA will notify the Department of Homeland Security's United
States Computer Emergency Readiness Team if loss or potential loss of PII related to a
data exchange under this IEA occurs.
4. Ifthe State Agency experiences a loss or breach of data, it will determine whether or not
to provide notice to individuals whose data has been lost of breached and bear any costs
associated with the notice or any mitigation.
4
County of Fresno
16-93111
4 of 70
H. POINTS OF CONTACT:
FOR SSA
San Francisco Regional Office:
Ellery Brown
Data Exchange Coordinator
Frank Hagel Federal Building
1221 Nevin A venue
Richmond CA 94801
Phone: (510) 970-8243
Fax: {510) 970-8101
Email: Ellery.Brown@ssa.gov
Systems Issues:
Pamela Riley
Office of Earnings, Enumeration &
Administrative Systems
DIVES/Data Exchange Branch
6401 Security Boulevard .
Baltimore, MD 21235
Phone: (410) 965-7993
Fax: (410) 966-3147
Email: Pamela.Riley@ssa.gov
FOR STATE AGENCY
Agreement Issues:
Manuel Urbina
Chief, Security Unit
Policy Operations Branch
Medi-Cal Eligibility Division
1501 Capitol Avenue, MS 4607
Sacramento, CA 95814
Phone: (916) 650-0160.
Email: Manuel.Urbina@dhcs.ca.gov
Data Exchange Issues:
Guy Fortson
Office of Electronic Information Exchange
GD 10 East High Rise
6401 Security Boulevard
Baltimore, MD 21235
Phone: (410) 597-1103
Fax: (410) 597-0841 .
Email: guy.fortson@ssa.gov
Systems Security Issues:
Michael G. Johnson
Acting Director
Office of Electronic Information Exchange
. Office of Strategic Services
6401 Security Boulevard
Baltimore, MD 21235
Phone: ( 410) 965-0266
Fax: (410) 966-0527
Email: Michael.G.Johnson@ssa.gov
Technical Issues:
Fei Collier
. Chief, Application Support Branch
Information Technology Services Division
1615 Capitol Ave, MS 6100
Sacramento, CA 95814
Phone: (916) 440-7036
Email: Fei.Collier@dhcs.ca.gov
I. DURATION: The effective date ofthis IEA is January 1; 2010. This IEA will remain in
effect for as long as: (1) a CMPPA Agreement governing this IEA is in effect between SSA
and the State or the State Agency; and (2) the State Agency submits a certification in·
accordance with Section J. below at least 30 days before the expiration and renewal of such
CMPP A Agreement.
5
County of Fresno
16-93111
5 of 70
J. CERTIFICATION AND PROGRAM CHANGES: At least 30 days before the expiration
and renewal of the State CMPPA Agreement governing this IBA, the State Agency will
certify in writing to SSA that: (l)it is in compliance with the terms and conditions of this
IEA; (2) the data exchange processes under this IEA have been and will be conducted
without change; and(3) it will, upon SSA's request, provide audit reports or other documents
that demonstrate review and oversight activities. Ifthere are substantive changes in any of
the programs or data exchange processes listed in this IEA, the parties will modify the IEA in
accordance with Section K. below and the State Agency will submit for SSA's approval new
program questionnaires under .Section C. above describing such changes prior to using SSA's
data to administer such new or changed program.
K. MODIFICATION: Modifications to this IEA must be in writing and agreed to by the
parties.
L. TERMINATION: The parties may terminate this IEA at any time upon mutual written
consent. In addition, either party may unilaterally terminate this IBA upon 90 days advance
written notice to the other party. Such unilateral termination will be effective 90 days after
the date of the notice, or at a later date specified in the notice.
SSA may immediately and unilaterally ~uspend the data flow under this IEA, or terminate
this IBA, if SSA, in its sole discretion, determines that the State Agency (including its ·
employees, contractors, and agents) has: (1) made an unauthorized use or disclosure of SSA
supplied data; or (2) violated or failed to follow the terms and conditions of this IEA or the
CMPP A Agreement.
M. INTEGRATION: This IEA, including all attachments, constitutes the entire agreement of
the parties with respect to its subject matter. There have been no representations, warranties,
or promises made outside of this IEA. This IEA shall take precedence over any other
document that may be in conflict with it.
ATTACHMENTS
1 -CMPPA Agreement
2 -SSA Data Exchange Systems
3-Systems Security Requirements for SSA Web Access to SSA Information
Through ICON
4-Information System Security Guidelines for Federal, State and Local Agencies
Receiving Electronic Information from the Social Security Administration
5 -PII Loss Reporting Worksheet
6
County of Fresno
16-93111
6 of 70
N. SSA AUTHORIZED SIGNATURE: The signatory below warrants and represents that he
or she has the competent authority on behalf of SSA to enter into the obligations set forth in
this IEA.
SOCIAL SECURITY ADMINISTRATION
Date
7
County of Fresno
16-93111
7 of 70
0. REGIONAL AND STATE AGENCY SIGNATURES:
SOCIAL SECURITY ADMINISTRATION
REGIONIX..
anal Commissioner
THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES
The signatory below warrants and represents that he or she has the competent authority
on behalf of the State Agency to enter into the obligations set forth in this IEA.
Date
j
8
County of Fresno
16-93111
8 of 70
2015 IEA CERTIFICATION OF COMPLIANCE
(IEA-F)
CERTIFICATION OF COMPLIANCE
FOR
THE INFORMATION EXCHANGE AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION (SSA)
AND
THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES (STATE
AGENCY)
(State Agency Level)
In accordance with the terms of the Information Exchange Agreement (IEA/F) between SSA and
the State Agency, the State Agency, through its authorized representative, hereby certifies that,
as of the date of this certification:
1. The State Agency is in compliance with the terms and conditions of the IEA/F.
2. The State Agency has conducted the data exchange processes under the IEA/F without
change, except as modified in accordance with the IEA/F.
3. The State Agency will continue to conduct the data exchange processes under the IEA/F
without change, except as may be modified in accordance with the IEA/F.
4. Upon SSA's request, the State Agency will provide audit reports or other documents that
demonstrate compliance with the review and oversight activities required under the
IEA/F and the governing Computer Matching and Privacy Protection Act Agreement.
5. In compliance with the requirements of the "Electronic Information Exchange Security
Requirements and Procedures for State and Local Agencies Exchanging Electronic
Information with the Social Security Administration," (last updated April 2014)
Attachment 4 to the IEA/F, as periodically updated by SSA, the State Agency has not
made any changes in the following areas that could potentially affect the security of SSA
data:
• General System Security Design and Operating Environment
• System Access Control
• Automated Audit Trail
• Monitoring and Anomaly Detection
• Management Oversight
• Data and Communications Security
• Contractors of Electronic Information Exchange Partners
The State Agency will submit an updated Security Design Plan at least 30 days prior to
making any changes to the areas listed above and provide updated contractor employee
lists before allowing new employees' access to SSA provided data.
1
County of Fresno
16-93111
9 of 70
2015 IEA CERTIFICATION OF COMPLIANCE
(IEA-F)
6. The State Agency agrees that use of computer technology to transfer the data is more
economical, efficient, and faster than using a manual process. As such, the State Agency
will continue to utilize data exchange to obtain data it needs to administer the programs
for which it is authorized under the IEA/F. Further, before directing an individual to an
SSA field office to obtain data, the State Agency will verify that the information it
submitted to SSA via data exchanges is correct, and verify with the individual that the
information he/she supplied is accurate. The use of electronic data exchange expedites
program administration and limits SSA field office traffic.
The signatory below warrants and represents that he or she is a representative of the State
Agency duly authorized to make this certification on behalf of the State Agency.
S OF CALIFORNIA
Toby Douglas
Director
Date
2
County of Fresno
16-93111
10 of 70
ATTACHMENT 1
COMPUTER MATCHING AND PRIVACY
PROTECTION ACT AGREEMENT
County of Fresno
16-93111
11 of 70
' '
Model CMPPA Agreement
COMPUTER MATCHING AND PRIVACY PROTECTION ACT AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION
AND
THE HEALTH AND HUMAN SERVICES AGENCY
OF CALIFORNIA
I. Purpose and Legal Authority
A. Purpose
This Computer Matching and Privacy Protection Act (CMPPA) Agreement
between the Social Security Administration (SSA) and the California Health and
Human Services Agency (State Agency) sets forth the terms and conditions
governing disclosures of records, information, or data (collectively referred to
herein as "data") made by SSA to the State Agency that administers federally
funded benefit programs, including those under various provisions of the Social
Security Act (Act), such as section 1137 (42 U.S.C. § 1320b-7), as well as the
state-funded state supplementary payment programs under Title XVI of the Act.
The terms and conditions of this Agreement ensure that SSA makes such
disclosures of data, and the State Agency uses such disclosed data, in accordance
with the requirements of the Privacy Act of 1974, as amended by the CMPPA of
1988, 5 U.S.C. § 552a.
Under section 1137 of the Act, the State Agency is required to use an income and
eligibility verification system to administer specified federally funded benefit
programs, including the state-funded state supplementary payment programs
under Title XVI of the Act. To assist the State Agency in determining entitlement
to and eligibility for benefits under those programs, as well as other federally
funded benefit programs, SSA discloses certain data about applicants (and in
limited circumstances, members of an applicant's household), for state benefits
from SSA Privacy Act Systems of Records (SOR) and verifies the Social Security
numbers (SSN) of the applicants.
B. Legal Authority
SSA's authority to disclose data and the State Agency's authority to collect,
maintain, and use data protected under SSA SORs for specified purposes is:
• Sections 1137, 453, and 1106(b) of the Act (42 U.S.C. §§ 1320b-7, 653,
and 1306(b)) (income and eligibility verification data);
• 26 U.S.C. § 6103(1)(7) and (8) (tax return data);
• Section 202(x)(3)(B)(iv) of the Act (42 U.S.C. § 402(x)(3)(B)(iv))
(prisoner data);
County of Fresno 16-93111
12 of 70
2
• Section 1611(e)(l)(I)(iii) of the Act (42 U.S.C. § 1382(e)(l)(I)(iii)
(Supplemental Security Income (SS!));
• Section 205(r)(3) of the Act (42 U.S.C. § 405(r)(3)) and the Intelligence
Reform and Terrorism Prevention Act of 2004, Pub. L. 108-458,
§ 7213(a)(2) (death data);
• Sections 402, 412, 421, and 435 of Pub. L. 104-193 (8 U.S.C. §§ 1612,
1622, 1631, and 1645) (quarters of coverage data);
• Children's Health Insurance Program Reauthorization Act of2009
(CHIPRA), Pub. L. 111-3 (citizenship data); and
• Routine use exception to the Privacy Act, 5 U.S.C. § 552a(b)(3) (data
necessary to administer other programs compatible with SSA programs).
This Agreement further carries out section 1106(a) of the Act (42 U.S.C. § 1306),
the regulations promulgated pursuant to that section (20 C.F.R. Part 401 ), the
Privacy Act of 1974 (5 U.S.C. § 552a), as amended by the CMPPA, related Office·
of Management and Budget (OMB) guidelines, the Federal Information Security
Management Act of2002 (FISMA) (44 U.S.C. § 3541, et seq.), and related
National Institute of Standards and Technology (NIST) guidelines, which provide
the requirements that the State Agency must follow with regard to use, treatment,
and safeguarding of data.
II. Scope
A. The State Agency will comply with the terms and conditions of this Agreement
and the Privacy Act, as amended by the CMPPA.
B. The State Agency will execute one or more Information Exchange Agreements
(IEA) with SSA, documenting additional terms and conditions applicable to those
specific data exchanges, including the particular benefit programs administered by
the State Agency, the data elements that will be disclosed, and the data protection .
requirements implemented to assist the State Agency in the administration of
those programs.
C. The State Agency will use the SSA data governed by this Agreement to determine
entitlement and eligibility of individuals for one or more of the following
programs:
1. Temporary Assistance to Needy Families (TANF) program under Part A
of Title IV of the Act;
2. Medicaid provided under an approved State plan or an approved waiver under
Title XIX of the Act;
3. State Children's Health Insurance Program (CHIP) under Title XXI of
the Act, as amended by the Children's Health Insurance Program
Reauthorization Act of 2009;
County of Fresno 16-93111
13 of 70
3
4. Supplemental Nutritional Assistance Program (SNAP) under the Food Stamp
Act of 1977 (7 U.S.C. § 2011, et seq.);
5. Women, Infants and Children Program (WIC) under the Child Nutrition Act
of 1966 (42 U.S.C. § 1771, et seq.);
6. Medicare Savings Programs (MSP) under 42 U.S.C. § 1396a(10)(E);
7. Unemployment Compensation programs provided under a state law described
in section 3304 of the Internal Revenue Code of 1954;
8. Low Income Heating and Energy Assistance (LIHEAP or home energy
grants) program under 42 U.S.C. § 8621;
9. State-administered supplementary payments of the type described in
section 1616(a) of the Act;
10. Programs under a plan approved under Titles I, X, XIV, or XVI of the Act;
11. Foster Care and Adoption Assistance under Title IV of the Act;
12. Child Support Enforcement programs under section 453 of the Act
(42 U.S.C. § 653);
13. Other applicable federally funded programs administered by the State Agency
under Titles I, IV, X, XIV, XVI, XVIII, XIX, XX, and XX! of the Act; and
14. Any other federally funded programs administered by the State Agency that
are compatible with SSA's programs.
D. The Stale Agency will ensure that SSA data disclosed for the specific purpose of
administering a particular federally funded benefit program is used only to
administer that program.
III. Justification and Expected Results
A. Justification
This Agreement and related data exchanges with the State Agency are necessary
for SSA to assist the State Agency in its administration of federally funded benefit
programs by providing the data required to accurately determine entitlement and
eligibility of individuals for benefits provided under these programs. SSA uses
computer technology to transfer the data because it is more economical, efficient,
and faster than using manual processes.
B. Expected Results
The State Agency will use the data provided by SSA to improve public service
and program efficiency and integrity. The use of SSA data expedites the
application process and ensures that benefits are awarded only to applicants that
satisfy the State Agency's program criteria. A cost-benefit analysis for the
exchange made under this Agreement is not required in accordance with the
determination by the SSA Data Integrity Board (DIB) to waive such analysis
pursuant to 5 U.S.C. § 552a(u)(4)(B).
County of Fresno 16-93111
14 of 70
4
IV. Record Description
A. Systems of Records
SSA SO Rs used for purposes of the subject data exchanges include:
• 60-0058 -- Master Files of SSN Holders and SSN Applications;
• 60-0059 -- Earnings Recording and Self-Employment Income System;
• 60-0090 -- Master Beneficiary Record;
• 60-0103 --Supplemental Security Income Record (SSR) and Special
Veterans Benefits (SVB);
• 60-0269 -- Prisoner Update Processing System (PUPS); and
• 60-0321 -- Medicare Part D and Part D Subsidy File.
The State Agency will only use the tax return data contained in SOR 60-0059
(Earnings Recording and Self-Employment Income System) in accordance with
26 u.s.c. § 6103.
B. Data Elements
Data elements disclosed in computer matching governed by this Agreement are
Personally Identifiable Information (PII) from specified SSA SORs, including
names, SSNs, addresses, amounts, and other information related to SSA benefits
and earnings information. Specific listings of data elements are available at:
http:l/www.ssa.gov/dataexchange/
C. Number of Records Involved
The number of records for each program covered under this Agreement is equal to
the number of Title II, Title XVI, or Title XVIII recipients resident in the State as
recorded in SSA's Annual Statistical Supplement found on the Internet at:
http://www.ssa.gov/policy/docs/statcomps/
This number will fluctuate during the term of this Agreement, corresponding to
the number of Title II, Title XVI, and Title XVIII recipients added to, or deleted
from, SSA databases.
V. Notice and Opportunity to Contest Procedures
A. Notice to Applicants
The State Agency will notify all individuals who apply for federally funded,
state-administered benefits under the Act that any data they provide are subject to
verification through computer matching with SSA. The State Agency and SSA
County of Fresno 16-93111
15 of 70
5
will provide such notice through appropriate language printed on application
forms or separate handouts.
B. Notice to Beneficiaries/Recipients/Annuitants
The State Agency will provide notice to beneficiaries, recipients, and annuitants
under the programs covered by this Agreement informing them of ongoing
computer matching with SSA. SSA will provide such notice through publication
in the Federal Register and periodic mailings to all beneficiaries, recipients, and
annuitants describing SSA's matching activities.
C. Opportunity to Contest
The State Agency will not terminate, suspend, reduce, deny, or take other adverse
action against an applicant for or recipient of federally funded, state-administered
benefits based on data disclosed by SSA from its SO Rs until the individual is
notified in writing of the potential adverse action and provided an opportunity to
contest the planned action. "Adverse action" means any action that results in a
termination, suspension, reduction, or final denial of eligibility, payment, or
benefit. Such notices will:
1. Inform the individual of the match findings and the opportunity to contest
these findings;
2. Give the individual until the expiration of any time period established for the
relevant program by a statute or regulation for the individual to respond to
the notice. If no such time period is established by a statute or regulation for
the program, a 30-day period will be provided. The time period begins on
the date on which notice is mailed or otherwise provided to the individual to
respond; and
3. Clearly state that, unless the individual responds to the notice in the required
time period, the State Agency will conclude that the SSA data are correct and,
will effectuate the threatened action or otherwise make the necessary
adjustment to the individual's benefit or entitlement.
VI. Records Accuracy Assessment and Verification Procedures
Pursuant to 5 U.S.C. § 552a(p)(l)(A)(ii), SSA's DIB has determined that the State
Agency may use SSA's benefit data without independent verification. SSA has
independently assessed the accuracy of its benefits data to be more than 99 percent
accurate when the benefit record is created.
Prisoner and death data, some of which is not independently verified by SSA, does
not have the same degree of accuracy as SSA's benefit data. Therefore, the State
County of Fresno 16-93111
16 of 70
6
Agency must independently verify these data through applicable State verification
procedures and the notice and opportunity to contest procedures specified in
Section V of this Agreement before taking any adverse action against any individual.
Based on SSA's Office of Quality Performance "FY 2009 Enumeration Quality
Review Report #2-The 'Numident' (January 2011)," the SSA Enumeration System
database (the Master Files of SSN Holders and SSN Applications System) used for
SSN matching is 98 percent accurate for records updated by SSA employees.
Individuals applying for SSNs report their citizenship status at the time they apply for.
their SSNs. There is no obligation for an individual to report to SSA a change in his
or her immigration status until he or she files for a Social Security benefit. The State
Agency must independently verify citizenship data through applicable State
verification procedures and the notice and opportunity to contest procedures specified
in Section V of this Agreement before taking any adverse action against any
individual.
VII. Disposition and Records Retention of Matched Items
A The State Agency will retain all data received from SSA to administer programs
governed by this Agreement only for the required processing times for the
applicable federally funded benefit programs and will then destroy all such data.
B. The State Agency may retain SSA data in hardcopy to meet evidentiary
requirements, provided that they retire such data in accordance with applicable
state laws governing the State Agency's retention of records.
C. The State Agency may use any accretions, deletions, or changes to the SSA data
governed by this Agreement to update their master files of federally funded,
state-administered benefit program applicants and recipients and retain such
master files in accordance with applicable state laws governing the State
Agency's retention of records.
D. The State Agency may not create separate files or records comprised solely of the
data provided by SSA to administer programs governed by this Agreement.
E. SSA will delete electronic data input files received from the State Agency after it
processes the applicable match. SSA will retire its data in accordance with the
Federal Records Retention Schedule (44 U.S.C. § 3303a).
VIII. Security Procedures
The State Agency will comply with the security and safeguarding requirements of the
Privacy Act, as amended by the CMPPA, related OMB guidelines, FISMA, related
County of Fresno 16-93111
17 of 70
7
NIST guidelines, and the current revision of Internal Revenue Service (IRS)
Publication 1075, Tax Information Security Guidelines for Federal, State and Local
Agencies, available at http:Uwww.irs.gov. In addition, the State Agency will have in
place administrative, technical, and physical safeguards for the matched data and
results of such matches. Additional administrative, technical, and physical security
requirements governing all data SSA provides electronically to the State Agency,
including specific guidance on safeguarding and reporting responsibilities for PII, are
set forth in the IEAs.
IX. Records Usage, Duplication, and Redisclosure Restrictions
A. The State Agency will use and access SSA data and the records created using that
data only for the purpose of verifying eligibility for the specific federally funded
benefit programs identified in the IEA.
B. The State Agency will comply with the following limitations on use, duplication,
and redisclosure of SSA data:
1. The State Agency will not use or redisclose the data disclosed by SSA for any
purpose other than to determine eligibility for, or the amount of, benefits
under the state-administered income/health maintenance programs identified
in this Agreement.
2. The State Agency will not extract information concerning individuals who are
neither applicants for, nor recipients of, benefits under the state-administered ·
income/health maintenance programs identified in this Agreement. In limited
circumstances that are approved by SSA, the State Agency may extract
information about an individual other than the applicant/recipient when the
applicant/recipient has provided identifying information about the individual
and the individual's income or resources affect the applicant's/recipient's
eligibility for such program.
3. The State Agency will not disclose to an applicant/recipient information about
another individual (i.e., an applicant's household member) without the written
consent from the individual to whom the information pertains.
4. The State Agency will use the Federal tax information (FT!) disclosed by SSA
only to determine individual eligibility for, or the amount of, assistance under
a state plan pursuant to section 1137 programs and child support enforcement
programs in accordance with 26 U.S.C. § 6103(1)(7) and (8). The State
Agency receiving FT! will maintain all FT! from IRS in accordance with
26 U.S.C. § 6103(p)(4) and the IRS Publication 1075. Contractors and agents
acting on behalf of the State Agency will only have access to tax return data
where specifically authorized by 26 U.S.C. § 6103 and the current revision
IRS Publication 1075.
County of Fresno 16-93111
18 of 70
I
8'
5, The State Agency will use the citizenship status data disclosed by SSA under
CHIPRA, Pub. L. 111-3, only for the purpose of determining entitlement to
Medicaid and CHIP programs for new applicants.
6. The State Agency will restrict access to the data disclosed by SSA to only
those authorized State employees, contractors, and agents who need such data
to perform their official duties in connection with the purposes identified in
this Agreement.
7. The State Agency will enter into a written agreement with each of its
contractors and agents who need SSA data to perform their official duties
whereby such contractor or agent agrees to abide by all relevant Federal laws,
restrictions on access, use, and disclosure, and security requirements in this
Agreement. The State Agency will provide its contractors and agents with
copies of this Agreement, related IEAs, and all related attachments before
initial disclosure of SSA data to such contractors and agents. Prior to signing
this Agreement, and thereafter at SSA's request, the State Agency will obtain
from its contractors and agents a current list of the employees of such
contractors and agents with access to SSA data and provide such lists to SSA.
8. The State Agency's employees, contractors, and agents who access, use, or
disclose SSA data in a manner or purpose not authorized by this Agreement
may be subject to civil and criminal sanctions pursuant to applicable Federal
statutes.
9. The State Agency will conduct triennial compliance reviews of its
contractor(s) and agent(s) no later than three years after the initial approval of
the security certification to SSA. The State Agency will share documentation
of its recurring compliance reviews with its contractor(s) and agent(s) with
SSA. The State Agency will provide documentation to SSA during its
scheduled compliance and certification reviews or upon request.
C. The State Agency will not duplicate in a separate file or disseminate, without prior
written permission from SSA, the data governed by this Agreement for any
purpose other than to determine entitlement to, or eligibility for, federally funded
benefits. The State Agency proposing the redisdosure must specify in writing to
SSA what data are being disclosed, to whom, and the reasons that justify the
redisclosure. SSA will not give permission for such redisclosure unless the
redisclosure is required by law or essential to the conduct of the matching
program and authorized under a routine use. To the extent SSA approves the
requested redisclosure, the State Agency will ensure that any entity receiving the
redisclosed data will comply with the procedures and limitations on use,
duplication, and redisclosure of SSA data, as well as all administrative, technical,
and physical security requirements governing all data SSA provides electronically
to the State Agency including specific guidance on safeguarding and reporting
County of Fresno 16-93111
19 of 70
9
responsibilities for PII, as set forth in this Agreement and the accompanying
IEAs.
X. Comptroller General Access
The Comptroller General (the Government Accountability Office) may have access to
all records of the State Agency that the Comptroller General deems necessary to
monitor and verify compliance with this Agreement in accordance with
5 U.S.C. § 552a( o )(l)(K).
XI. Duration, Modification, and Termination of the Agreement
A. Duration
1. This Agreement is effective from January 1, 2015 (Effective Date) through
June 30, 2016 (Expiration Date).
2. In accordance with the CMPPA, SSA will: (a) publish a Computer
Matching Notice in the Federal Register at least 30 days prior to the
Effective Date; (b) send required notices to the Congressional committees of
jurisdiction under 5 U.S.C. § 552a(o)(2)(A)(i) at least 40 days prior to the
Effective Date; and (c) send the required report to OMB at least 40 days
prior to the Effective Date.
3. Within 3 months prior the Expiration Date, the SSA DIB may, without
additional review, renew this Agreement for a period not to exceed
12 months, pursuant to 5 U.S.C. § 552a(o)(2)(D), if:
• the applicable data exchange will continue without any change; and
• SSA and the State Agency certify to the DIB in writing that the
applicable data exchange has been conducted in compliance with this
Agreement.
4. If either SSA or the State Agency does not wish to renew this Agreement, it
must notify the other party of its intent not to renew at least 3 months prior
to the Expiration Date.
B. Modification
Any modification to this Agreement must be in writing, signed by both parties,
and approved by the SSA DIB.
County of Fresno 16-93111
20 of 70
10
C. Termination
The parties may terminate this Agreement at any time upon mutual written
consent of both parties. Either party may unilaterally terminate this Agreement
upon 90 days advance written notice to the other party; such unilateral termination
will be effective 90 days after the date of the notice, or at a later date specified in
the notice.
SSA may immediately and unilaterally suspend the data flow or terminate this
Agreement if SSA determines, in its sole discretion, that the State Agency has
violated or failed to comply with this Agreement.
XII. Reimbursement
In accordance with section 1106(b) of the Act, the Commissioner of SSA has
determined not to charge the State Agency the costs of furnishing the electronic data
from the SSA SORs under this Agreement.
XIII. Disclaimer
SSA is not liable for any damages or loss resulting from errors in the data provided
to the State Agency under any IEAs governed by this Agreement. Furthermore, SSA
is not liable for any damages or loss resulting from the destruction of any materials
or data provided by the State Agency.
County of Fresno 16-93111
21 of 70
11
XIV. Points of Contact
A. SSA Point of Contact
Regional Office
Dolores Dunnachie, Director
San Francisco Regional Office, Center for Programs Support
1221 Nevin Avenue
Richmond CA 94801
Phone: (510) 970-8444 Fax: (510) 970-8101
Dolores.Dunnachie@ssa.gov
B. State Agency Point of Contact
Sonia Herrera
California Health and Human Services Agency
1600 Ninth Street
Sacramento, CA 95814
Phone: (916) 654-3459 Fax: 916-440-5001
Sonia.Herrera@chhs.ca.gov
County of Fresno 16-93111
22 of 70
12
XV. SSA and Data Integrity Board Approval of' Model CMPPA Agreement
The signatories below warrant and represent that they have the competent authority
on behalf of SSA to approve the model of this CMPPA Agreement.
SOCIAL SECURITY ADMINISTRATION
Da~S. Wiggin
Deputy Executive Director
Office of Privacy and Disclosure
Office of the General Counsel
Date
I certify that the SSA Data Integrity Board approved the model of this CMPPA
Agreement.
Date
County of Fresno 16-93111
23 of 70
13
' '
XVI. Authorized Signatures
The signatories below warrant and represent that they have the competent authority
on behalf of their respective agency to enter into the obligations set forth in this
Agreement.
SOCIAL SECURITY ADMINISTRATION
Regional Commissioner
San Francisco
Date / I
HEALTH AND HUMAN SERVICES AGENCY
Date
County of Fresno 16-93111
24 of 70
ATTACHMENT 2
AUTHORIZED DATA EXCHANGE SYSTEM(S)
County of Fresno
16-93111
25 of 70
Attachment 2
Authorized Data Exchange System(s)
BEER (Beneficiary Earnings Exchange Record): Employer data for the last calendar year.
BENDEX (Beneficiary and Earnings Data Exchange): Primary source for Title II eligibility,
benefit and demographic data.
LIS (Low-Income Subsidy): Data from the Low-Income Subsidy Application for Medicare Part
D beneficiaries -- used for Medicare Savings Programs (MSP).
Medicare 1144 (Outreach): Lists of individuals on SSA roles, who may be eligible for medical
assistance for: payment of the cost of Medicare cost-sharing under the Medicaid program
pursuant to Sections 1902(a)(10)(E) and 1933 of the Act; transitional assistance under Section
1860D-31(f) of the Act; or premiums and cost-sharing subsidies for low-income individuals
under Section 1860D-14 of the Act.
PUPS (Prisoner Update Processing System): Confinement data received from over 2000 state
and local institutions (such as jails, prisons, or other penal institutions or correctional facilities) -
PUPS matches the received data with the MBR and SSR benefit data and generates alerts for
review/action.
QUARTERS OF COVERAGE (QC): Quarters of Coverage data as assigned and described
under Title II of the Act --The term "quarters of coverage" is also referred to as "credits" or
“Social Security credits” in various SSA public information documents, as well as to refer to
"qualifying quarters" to determine entitlement to receive Food Stamps.
SDX (SSI State Data Exchange): Primary source of Title XVI eligibility, benefit and
demographic data as well as data for Title VIII Special Veterans Benefits (SVB).
SOLQ/SOLQ-I (State On-line Query/State On-line Query-Internet): A real-time online
system that provides SSN verification and MBR and SSR benefit data similar to data provided
through SVES.
County of Fresno
16-93111
26 of 70
Attachment 2
SVES (State Verification and Exchange System): A batch system that provides SSN
verification, MBR benefit information, and SSR information through a uniform data
response based on authorized user-initiated queries. The SVES types are divided into
five different responses as follows:
SVES I: This batch provides strictly SSN verification.
SVES I/Citizenship* This batch provides strictly SSN verification and
citizenship data.
SVES II: This batch provides strictly SSN verification and
MBR benefit information
SVES III: This batch provides strictly SSN verification and
SSR/SVB.
SVES IV: This batch provides SSN verification, MBR benefit
information, and SSR/SVB information, which
represents all available SVES data.
* Citizenship status data disclosed by SSA under the Children’s Health Insurance
Program Reauthorization Act of 2009, Pub. L. 111-3 is only for the purpose of
determining entitlement to Medicaid and CHIP program for new applicants.
2
County of Fresno
16-93111
27 of 70
ATTACHMENT 3 OMITTED
County of Fresno
16-93111
28 of 70
SENSITIVE DOCUMENT
ATTACHMENT 4
ELECTRONIC INFORMATION EXCHANGE SECURITY
REQUIREMENTS AND PROCEDURES
This document is SENSITIVE and should not be released to the public without prior authorization from DHCS.
County of Fresno
16-93111
29 of 70
ELECTRONIC INFORMATION EXCHANGE
SECURITY REQUIREMENTS AND PROCEDURES
FOR
STATE AND LOCAL AGENCIES EXCHANGING
ELECTRONIC INFORMATION WITH THE SOCIAL
SECURITY ADMINISTRATION
SENSITIVE DOCUMENT
VERSION 6.0.2
April 2014
1
County of Fresno
16-93111
30 of 70
Table of Contents
1. Introduction
2. Electronic Information Exchange Definition
3. Roles and Responsibilities
4. General Systems Security Standards
5. Systems Security Requirements
5.1 Overview
5.2 General System Security Design and Operating Environment
5.3 System Access Control
5.4 Automated Audit Trail
5.5 Personally Identifiable Information
5.6 Monitoring and Anomaly Detection
5.7 Management Oversight and Quality Assurance
5.8 Data and Communications Security
5.9 Incident Reporting
5.10 Security Awareness and Employee Sanctions
5.11 Contractors of Electronic Information Exchange Partners
6. General--Security Certification and Compliance Review Programs
6.1 The Security Certification Program
6.2 Documenting Security Controls in the Security Design Plan
6.2.1 When the SDP and Risk Assessment are Required
6.3 The Certification Process
6.4 The Compliance Review Program and Process
6.5.1 EIEP Compliance Review Participation
6.5.2 Verification of Audit Samples
6.6 Scheduling the Onsite Review
7. Additional Definitions
8. Regulatory References
9. Frequently Asked Questions
10. Diagrams
Flow Chart of the OIS Certification Process
Flow Chart of the OIS Compliance Review Process
Compliance Review Decision Matrix
2
County of Fresno
16-93111
31 of 70
RECEIVING ELECTRONIC INFORMATION FROM THE
SOCIAL SECURITY ADMINISTRATION
1. Introduction
The law requires the Social Security Administration (SSA) to maintain oversight and assure the
protection of information it provides to its Electronic Information Exchange Partners (EIEP). EIEPs
are entities that have information exchange agreements with SSA.
The overall aim of this document is twofold. First, to ensure that SSA can properly certify EIEPs as
compliant by the SSA security requirements, standards, and procedures expressed in this document
before we grant access to SSA information in a production environment. Second, to ensure that
EIEPs continue to adequately safeguard electronic information provided to them by SSA.
This document (which SSA considers SENSITIVE1 and should only be shared with those who need it
to ensure SSA-provided information is safeguarded), describes the security requirements, standards,
and procedures EIEPs must meet and implement to obtain information from SSA electronically. This
document helps EIEPs understand criteria that SSA uses when evaluating and certifying the system
design and security features used for electronic access to SSA-provided information.
The addition, elimination, and modification of security control factors determine which level of
security and due diligence SSA requires for the EIEP to mitigate risks. The emergence of new
threats, attack methods, and the availability of new technology warrants frequent reviews and
revisions to our System Security Requirements (SSR). Consequently, EIEPs should expect SSA’s
System Security Requirements to evolve in concert with the industry.
EIEPs must comply with SSA’s most current SSRs to gain access to SSA-provided data. SSA will
work with its partners to resolve deficiencies that occur subsequent to, and after, approval for access
if updates to our security requirements cause an agency to be uncompliant. EIEPs may proactively
ensure their ongoing compliance with the SSRs by periodically requesting the most current SSR
package from their SSA contact. Making periodic adjustments is often necessary.
2. Electronic Information Exchange Definition
For discussion purposes herein, Electronic Information Exchange (EIE) is any electronic process in
which SSA discloses information under its control to any third party for any purpose, without the
specific consent of the subject individual or agent acting on his or her behalf. EIE involves
individual data transactions and data files processed within the systems of parties to electronic
information sharing agreements with SSA. These processes include direct terminal access or DTA
to SSA systems, batch processing, and variations thereof (e.g., online query) regardless of the
systematic method used to accomplish the activity or to interconnect SSA with the EIEP.
1 Sensitive data ‐“any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the
national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a
(The Privacy Act), but that has not been specifically authorized under criteria established by an Executive Order or an Act of
Congress to be kept classified in the interest of national defense or foreign policy but is to be protected in accordance with the
requirements of the Computer Security Act of 1987 (P.L.100-235).”
3
County of Fresno
16-93111
32 of 70
3. Roles and Responsibilities
The SSA Office of Information Security (OIS) has agency-wide responsibility for interpreting,
developing, and implementing security policy; providing security and integrity review
requirements for all major SSA systems; managing SSA's fraud monitoring and reporting
activities; developing and disseminating security training and awareness materials; and
providing consultation and support for a variety of agency initiatives. SSA’s security reviews
ensure that external systems receiving information from SSA are secure and operate in a
manner consistent with SSA’s Information Technology (IT) security policies and in compliance
with the terms of electronic information sharing agreements executed by SSA with outside
entities. Within the context of SSA’s security policies and the terms of electronic information
sharing agreements with SSA’s EIEPs, OIS exclusively conducts and brings to closure initial
security certifications and periodic security compliance reviews of EIEPs that process, maintain,
transmit, or store SSA-provided information in accordance with pertinent Federal requirements
which include the following (see also Regulatory References):
a. The Federal Information Security Management Act (FISMA) requires the protection of
“Federal information in contractor systems, including those systems operated by state and
local governments.”
b. The Social Security Administration requires EIEPs to adhere to the policies, standards,
procedures, and directives published in this Systems Security Requirements (SSR)
document.
Personally Identifiable Information (PII), covered under several Federal laws and statutes, is
information about an individual including, but not limited to, personal identifying information
including the Social Security Number (SSN).
The data (last 4 digits of the SSN) that SSA provides to its EIEPs for purposes of the Help
America Vote Act (HAVA) does not identify a specific individual; therefore, is not “PII” as
defined by the Act.
However, SSA is diligent in discharging its responsibility for establishing appropriate
administrative, technical, and physical safeguards to ensure the security, confidentiality, and
availability of its records and to protect against any anticipated threats or hazards to their
security or integrity.
NOTE: Disclosure of Federal Tax Information (FTI) is limited to certain Federal
agencies and state programs supported by federal statutes under Sections 1137,
453, and 1106 of the Social Security Act. For information regarding safeguards for
protecting FTI, consult IRS Publication 1075, Tax Information Security Guidelines
for Federal, State, and Local Agencies.
The SSA Regional Data Exchange Coordinators (DECs) serve as a bridge between SSA and
state EIEPs. In the security arena, DECs assist OIS in coordinating data exchange security
review activities with state and local EIEPs; e.g., they provide points of contact with state
agencies, assist in setting up security reviews, etc. DECs are also the first points of contact
for states if an employee of a state agency or an employee of a state agency’s contractor or
4
County of Fresno
16-93111
33 of 70
agent becomes aware of a suspected or actual loss of SSA-provided Personally Identifiable
Information (PII).
4. General Systems Security Standards
EIEPs that request and receive information electronically from SSA must comply with the
following general systems security standards concerning access to and control of SSA-
provided information.
NOTE: EIEPs may not create separate files or records comprised solely of the
information provided by SSA.
a. EIEPs must ensure that means, methods, and technology used to process, maintain,
transmit, or store SSA-provided information neither prevents nor impedes the EIEP‟s
ability to
safeguard the information in conformance with SSA requirements,
efficiently investigate fraud, data breaches, or security events that involve
SSA-provided information, or
detect instances of misuse or abuse of SSA-provided information
For example, utilization of cloud computing may have the potential to
jeopardize an EIEP’s compliance with the terms of their agreement or SSA’s
associated system security requirements and procedures.
b. EIEPs must use the electronic connection established between the EIEP and SSA
only in support of the current agreement(s) between the EIEP and SSA.
c. EIEPs must use the software and/or devices provided to the EIEP only in support of
the current agreement(s) between the EIEP and SSA.
d. SSA prohibits modifying any software or devices provided to the EIEPs by SSA.
e. EIEPs must ensure that SSA-provided information is not processed, maintained,
transmitted, or stored in or by means of data communications channels, electronic
devices, computers, or computer networks located in geographic or virtual areas not
subject to U.S. law.
f. EIEPs must restrict access to the information to authorized users who need it to
perform their official duties.
NOTE: Contractors and agents (hereafter referred to as contractors) of the
EIEP who process, maintain, transmit, or store SSA-provided information are
held to the same security requirements as employees of the EIEP. Refer to the
section Contractors of Electronic Information Exchange Partners in the Systems
Security Requirements for additional information.
g. EIEPs must store information received from SSA in a manner that, at all times, is
physically and electronically secure from access by unauthorized persons.
5
County of Fresno
16-93111
34 of 70
h. The EIEP must process SSA-provided information under the immediate supervision
and control of authorized personnel.
i. EIEPs must employ both physical and technological safeguards to prevent
unauthorized retrieval of SSA-provided information via computer, remote terminal,
or other means.
j. EIEPs must have formal PII incident response procedures. When faced with a
security incident caused by malware, unauthorized access, software issues, or acts
of nature, the EIEP must be able to respond in a manner that protects SSA-provided
information affected by the incident.
k. EIEPs must have an active and robust employee security awareness program, which
is mandatory for all employees who access SSA-provided information.
l. EIEPs must advise employees with access to SSA-provided information of the
confidential nature of the information, the safeguards required to protect the
information, and the civil and criminal sanctions for non-compliance contained in
the applicable Federal and state laws.
m. At its discretion, SSA or its designee must have the option to conduct onsite
security reviews or make other provisions to ensure that EIEPs maintain adequate
security controls to safeguard the information we provide.
5. Systems Security Requirements
5.1 Overview
SSA must certify that the EIEP has implemented controls that meet the requirements and
work as intended, before we will authorize initiating transactions to and from SSA
through batch data exchange processes or online processes such as State Online Query
(SOLQ) or Internet SOLQ (SOLQ-I).
The Technical Systems Security Requirements (TSSRs) address management,
operational, and technical aspects of security safeguards to ensure only the authorized
disclosure and use of SSA-provided information by SSA’s EIEPs.
SSA recommends that the EIEP develop and publish a comprehensive Systems Security
Policy document that specifically addresses:
the classification of information processed and stored within the network,
administrative controls to protect the information stored and processed within the
network,
access to the various systems and subsystems within the network,
Security Awareness Training,
Employee Sanctions Policy,
6
County of Fresno
16-93111
35 of 70
Incident Response Policy, and
the disposal of protected information and sensitive documents derived from the
system or subsystems on the network.
SSA’s systems security requirements represent the current state-of-the-practice security
controls, safeguards, and countermeasures required for Federal information systems by
Federal regulations, statutes, standards, and guidelines. Additionally, SSA’s systems
security requirements also include organizationally defined interpretations, policies, and
procedures mandated by the authority of the Commissioner of Social Security in areas
when or where other cited authorities may be silent or non-specific.
5.2 General System Security Design and Operating Environment
EIEPs must provide descriptions and explanations of their overall system design,
configuration, security features, and operational environment and include explanations of
how they conform to SSA’s requirements. Explanations must include the following:
o Descriptions of the operating environment(s) in which the EIEP will utilize, maintain,
and transmit SSA-provided information
o Descriptions of the business process(es) in which the EIEP will use SSA-provided
information
o Descriptions of the physical safeguards employed to ensure that unauthorized
personnel cannot access SSA-provided information and details of how the EIEP keeps
audit information pertaining to the use and access to SSA-provided information and
associated applications readily available
o Descriptions of electronic safeguards, methods, and procedures for protecting the
EIEP’s network infrastructure and for protecting SSA-provided information while in
transit, in use within a process or application, and at rest (stored or not in use)
o Descriptions of how the EIEP prevents unauthorized retrieval of SSA-provided
information by computer, remote terminal, or other means, including descriptions of
security software other than access control software (e.g., security patch and anti-
malware software installation and maintenance, etc.)
o Descriptions of how the configurations of devices (e.g., servers, workstations, and
portable devices) involving SSA-provided information comply with recognized industry
standards and SSA’s system security requirements
o Description of how the EIEP implements adequate security controls (e.g., passwords
enforcing sufficient construction strength to defeat or minimize risk-based identified
vulnerabilities)
7
County of Fresno
16-93111
36 of 70
5.3 System Access Control
EIEPs must utilize and maintain technological (logical) access controls that limit access to
SSA-provided information and associated transactions and functions to only those users,
processes acting on behalf of authorized users, or devices (including other information
systems) authorized for such access based on their official duties or purpose(s). EIEPs
must employ a recognized user access security software package (e.g. RAC-F, ACF-2,
TOP SECRET) or a security software design which is equivalent to such products. The
access control software must utilize personal identification numbers (PIN) and passwords
or Biometric identifiers in combination with the user’s system identification code (userID).
The access control software must employ and enforce (1) PIN/password, and/or (2)
PIN/biometric identifier, and/or (3) SmartCard/biometric identifier, etc., for
authenticating users).
Depending on the computing platform (e.g., client/server (PC), mainframe) and the
access software implementation, the terms “PIN” and “user system identification code
(userID)” may be, for practical purposes, synonymous. For example, the PIN/password
combination may be required for access to an individual’s PC after which, the
userID/password combination may be required for access to a mainframe application. A
biometric identifier may supplant one element in the pair of those combinations. SSA
strongly recommends Two-Factor Authentication.
The EIEP’s implementation of the control software must comply with recognized industry
standards. Password policies should enforce sufficient construction strength (length and
complexity) to defeat or minimize risk-based identified vulnerabilities and ensure
limitations for password repetition. Technical controls should enforce periodic password
changes based on a risk-based standard (e.g., maximum password age of 90 days,
minimum password age of 3 – 7 days) and enforce automatic disabling of user accounts
that have been inactive for a specified period of time (e.g., 90 days).
The EIEP’s password policies must also require more stringent password construction
(e.g., passwords greater than eight characters in length requiring upper and lower case
letters, numbers, and special characters; password phrases) for the user accounts of
persons, processes, or devices whose functions require access privileges in excess of
those of ordinary users.
EIEPs must have management control and oversight of the function of authorizing
individual user access to SSA-provided information and to oversee the process of issuing
and managing access control PINs, passwords, biometric identifiers, etc. for access to the
EIEP’s system.
The EIEP’s systems access rules must cover least privilege and individual accountability.
The EIEP’s rules should include procedures for access to sensitive information and
transactions and functions related to it. Procedures should include control of transactions
by permissions module, the assignment and limitation of system privileges, disabling
accounts of separated employees (e.g., within 24 hours), individual accountability, work
at home, dial-up access, and connecting to the Internet.
8
County of Fresno
16-93111
37 of 70
5.4 Automated Audit Trail
SSA requires EIEPs to implement and maintain a fully automated audit trail system
(ATS). The system must be capable of creating, storing, protecting, and efficiently
retrieving and collecting records identifying the individual user who initiates a request for
information from SSA or accesses SSA-provided information. At a minimum, individual
audit trail records must contain the data needed (including date and time stamps) to
associate each query transaction or access to SSA-provided information with its initiator,
their action, if any, and the relevant business purpose/process (e.g., SSN verification for
Medicaid). Each entry in the audit file must be stored as a separate record, not overlaid
by subsequent records. The Audit Trail System must create transaction files to capture
all input from interactive internet applications which access or query SSA-provided
information.
If a State Transmission Component (STC) handles and audits the EIEP’s transactions with
SSA, the EIEP is responsible for ensuring that the STC’s audit capabilities meet SSA’s
requirements for an automated audit trail system. The EIEP must also establish a process
to obtain specific audit information from the STC regarding the EIEP’s SSA transactions.
Access to the audit file must be restricted to authorized users with a “need to know.”
Audit file data must be unalterable (read-only) and maintained for a minimum of three
(preferably seven) years. Information in the audit file must be retrievable by an
automated method. EIEPs must have the capability to make audit file information
available to SSA upon request. EIEPs must back-up audit trail records on a regular basis
to ensure their availability. EIEPs must apply the same level of protection to backup
audit files that apply to the original files.
If the EIEP retains SSA-provided information in a database (e.g., Access database,
SharePoint, etc.), or if certain data elements within the EIEP’s system indicate to users
that SSA verified the information, the EIEP’s system must also capture an audit trail
record of users who viewed SSA-provided information stored within the EIEP’s system.
The retrieval requirements for SSA-provided information at rest and the retrieval
requirements for regular transactions are identical.
5.5 Personally Identifiable Information (PII)
PII is any information about an individual maintained by an agency, including (1)
any information that can be used to distinguish or trace an individual‘s identity,
such as name, social security number, date and place of birth, mother‘s maiden
name, or biometric records; and (2) any other information that is linked or linkable
to an individual, such as medical, educational, financial, and employment
information. An item such as date and place of birth, mother’s maiden name, or
father’s surname is PII, regardless of whether combined with other data.
SSA defines a PII loss as a circumstance when SSA has reason to believe that
information on hard copy or in electronic format, which contains PII provided by SSA,
left the EIEP’s custody or the EIEP disclosed it to an unauthorized individual or entity.
PII loss is a reportable incident (refer to Incident Reporting).
9
County of Fresno
16-93111
38 of 70
If a PII loss involving SSA-provided information occurs or is suspected, the EIEP
must be able to quantify the extent of the loss and compile a complete list of the
individuals potentially affected by the incident (refer to Incident Reporting).
5.6 Monitoring and Anomaly Detection
SSA recommends that EIEPs use an Intrusion Protection System (IPS) or an
Intrusion Detection System (IDS). The EIEP must establish and/or maintain
continuous monitoring of its network infrastructure and assets to ensure the following:
o The EIEP’s security controls continue to be effective over time
o Only authorized individuals, devices, and processes have access to SSA-
provided information
o The EIEP detects efforts by external and internal entities, devices, or processes to
perform unauthorized actions (i.e., data breaches, malicious attacks, access to
network assets, software/hardware installations, etc.) as soon as they occur
o The necessary parties are immediately alerted to unauthorized actions
performed by external and internal entities, devices, or processes
o Upon detection of unauthorized actions, measures are immediately initiated to
prevent or mitigate associated risk
o In the event of a data breach or security incident, the EIEP can efficiently determine
and initiate necessary remedial actions
o The trends, patterns, or anomalous occurrences and behavior in user or network
activity that may be indicative of potential security issues are readily discernible
The EIEP’s system must include the capability to prevent employees from unauthorized
browsing of SSA records. SSA strongly recommends the use of a transaction-driven
permission module design, whereby employees are unable to initiate transactions not
associated with the normal business process. If the EIEP uses such a design, they then
need anomaly detection to detect and monitor employee’s unauthorized attempts to gain
access to SSA-provided information and attempts to obtain information from SSA for
clients not in the EIEP’s client system. The EIEP should employ measures to ensure the
permission module’s integrity. Users should not be able to create a bogus case and
subsequently delete it in such a way that it goes undetected.
If the EIEP’s design does not currently use a permission module and is not transaction-
driven, until at least one of these security features exists, the EIEP must develop and
implement compensating security controls to deter employees from browsing SSA
records. These controls must include monitoring and anomaly detection features, either
systematic, manual, or a combination thereof. Such features must include the
capability to detect anomalies in the volume and/or type of transactions or queries
requested or initiated by individuals and include systematic or manual procedures for
verifying that requests and queries of SSA-provided information comply with valid
official business purposes. The system must also produce reports that allow
management and/or supervisors to monitor user activity, such as the following:
10
County of Fresno
16-93111
39 of 70
User ID Exception Reports:
This type of report captures information about users who enter incorrect user IDs
when attempting to gain access to the system or to the transaction that initiates
requests for information from SSA, including failed attempts to enter a password.
Inquiry Match Exception Reports:
This type of report captures information about users who may be initiating
transactions for SSNs that have no client case association within the EIEP’s system
(the EIEP’s management should review 100 percent of these cases).
System Error Exception Reports:
This type of report captures information about users who may not understand
or may be violating proper procedures for access to SSA-provided information.
Inquiry Activity Statistical Reports:
This type of report captures information about transaction usage patterns
among authorized users and is a tool which enables the EIEP’s management to
monitor typical usage patterns in contrast to extraordinary usage patterns.
The EIEP must have a process for distributing these monitoring and exception reports to
appropriate local managers/supervisors or to local security officers. The process must
ensure that only those whose responsibilities include monitoring anomalous activity of
users, to include those who have exceptional system rights and privileges, use the
reports.
5.7 Management Oversight and Quality Assurance
The EIEP must establish and/or maintain ongoing management oversight and quality
assurance capabilities to ensure that only authorized employees have access to SSA-
provided information. They must ensure ongoing compliance with the terms of the EIEP’s
electronic information sharing agreement with SSA and the SSRs established for access to
SSA-provided information. The entity responsible for management oversight must consist
of one or more of the EIEP’s management officials whose job functions include
responsibility to ensure that the EIEP only grants access to the appropriate employees and
position types which require SSA-provided information to do their jobs.
The EIEP must ensure that employees granted access to SSA-provided information
receive adequate training on the sensitivity of the information, associated safeguards,
operating procedures, and the penalties for misuse.
SSA recommends that EIEPs establish the following job functions and require that
employees tasked with these job functions do not also share the same job functions as
personnel who request or use information from SSA.
Perform periodic self-reviews to monitor the EIEP’s ongoing usage of SSA-
provided information.
Perform random sampling of work activity that involves SSA-provided
information to determine if the access and usage comply with SSA’s
requirements.
11
County of Fresno
16-93111
40 of 70
5.8 Data and Communications Security
EIEPs must encrypt PII and SSA-provided information when transmitting across dedicated
communications circuits between its systems, intrastate communications between its local
office locations, and on the EIEP’s mobile computers, devices and removable media. The
EIEP’s encryption methods should align with the Standards established by the National
Institute of Standards and Technology (NIST). SSA recommends the Advanced
Encryption Standard (AES) or triple DES (Data Encryption Standard 3), if AES is
unavailable, encryption method for securing SSA-provided information during transport.
Files encrypted for external users (when using tools such as Microsoft WORD
encryption,) require a key length of nine characters. We also recommend that the key
(also referred to as a password) contain both special characters and a number. SSA
requires that the EIEP deliver the key so that the key does not accompany the media.
The EIEP must secure the key when not in use or unattended.
SSA discourages the use of the public Internet for transmission of SSA-provided
information. If however, the EIEP uses the public Internet or other electronic
communications, such as emails and faxes to transmit SSA-provided information, they
must use a secure encryption protocol such as Secure Socket Layer (SSL) or Transport
Layer Security (TLS). SSA also recommends 256-bit encryption protocols or more
secure methods such as Virtual Private Network technology. The EIEP should only send
data to a secure address or device to which the EIEP can control and limit access to only
specifically authorized individuals and/or processes. SSA recommends that EIEPs
use Media Access Control (MAC) Filtering and Firewalls to protect access points
from unauthorized devices attempting to connect to the network.
EIEPs should not retain SSA-provided information any longer than business
purpose(s) dictate. The Information Exchange Agreement with SSA stipulates a time
for data retention. The EIEP should delete, purge, destroy, or return SSA-provided
information when the business purpose for retention no longer exists.
The EIEP may not save or create separate files comprised solely of information provided
by SSA. The EIEP may apply specific SSA-provided information to the EIEP’s matched
record from a preexisting data source. Federal law prohibits duplication and redisclosure
of SSA-provided information without written approval. The prohibition applies to both
internal and external sources who do not have a “need-to-know2.” SSA recommends
that EIEPs use either Trusted Platform Module (TPM) or Hardware Security
Module (HSM) technology solutions to encrypt data at rest on hard drives and
other data storage media.
EIEPs must prevent unauthorized disclosure of SSA-provided information after they
complete processing and after the EIEP no longer requires the information. The EIEP’s
operational processes must ensure that no residual SSA-provided information remains on
the hard drives of user’s workstations after the user exits the application(s) that use
SSA-provided information. If the EIEP must send a computer, hard drive, or other
computing or storage device offsite for repair, the EIEP must have a non-disclosure
clause in their contract with the vendor. If the EIEP used the item in connection with a
business process that involved SSA-provided information and the vendor will retrieve or
may view SSA-provided information during servicing, SSA reserves the right to inspect
Need-to-know - access to the information must be necessary for the conduct of one's official duties.
12
2
County of Fresno
16-93111
41 of 70
the EIEP’s vendor contract. The EIEP must remove SSA-provided information from
electronic devices before sending it to an external vendor for service. SSA expects the
EIEP to render it unrecoverable or destroy the electronic device if they do not need to
recover the data. The same applies to excessed, donated, or sold equipment placed into
the custody of another organization.
To sanitize media, the EIEP should use one of the following methods:
Overwriting
Overwrite utilities can only be used on working devices. Overwriting is appropriate only for
devices designed for multiple reads and writes. The EIEP should overwrite disk drives,
magnetic tapes, floppy disks, USB flash drives, and other rewriteable media. The overwrite
utility must completely overwrite the media. SSA recommends the use of purging media
sanitization to make the data irretrievable and to protect data against laboratory attacks or
forensics. Please refer to Definitions for more information regarding Media
Sanitization). Reformatting the media does not overwrite the data.
Degaussing
Degaussing is a sanitization method for magnetic media (e.g., disk drives, tapes,
floppies, etc.). Degaussing is not effective for purging non-magnetic media (e.g.,
optical discs). Degaussing requires a certified tool designed for particular types of
media. Certification of the tool is required to ensure that the magnetic flux applied to
the media is strong enough to render the information irretrievable. The degaussing
process must render data on the media irretrievable by a laboratory attack or
laboratory forensic procedures (refer to Definitions for more information regarding
Media Sanitization).
Physical destruction
Physical destruction is the method when degaussing or over-writing cannot be
accomplished (for example, CDs, floppies, DVDs, damaged tapes, hard drives,
damaged USB flash drives, etc.). Examples of physical destruction include shredding,
pulverizing, and burning.
State agencies may retain SSA-provided information in hardcopy only if required to
fulfill evidentiary requirements, provided the agencies retire such data in accordance
with applicable state laws governing retention of records. The EIEP must control print
media containing SSA-provided information to restrict its access to authorized
employees who need such access to perform their official duties. EIEPs must destroy
print media containing SSA-provided information in a secure manner when it is no longer
required for business purposes. The EIEP should destroy paper documents that contain
SSA-provided information by burning, pulping, shredding, macerating, or other similar
means that ensure the information is unrecoverable.
NOTE: Hand tearing or lining through documents to obscure information
does not meet SSA’s requirements for appropriate destruction of PII.
The EIEP must employ measures to ensure that communications and data furnished to
SSA contain no viruses or other malware.
Special Note: If SSA-provided information will be stored in a commercial
13
County of Fresno
16-93111
42 of 70
cloud, please provide the name and address of the cloud provider. Also,
please describe the security features contractually required of the cloud
provider to protect SSA-provided information.
5.9 Incident Reporting
SSA requires EIEPs to develop and implement policies and procedures to respond to
data breaches or PII loses. You must explain how your policies and procedures
conform to SSA’s requirements. The procedures must include the following
information:
If the EIEP experiences or suspects a breach or loss of PII or a security incident,
which includes SSA-provided information, they must notify the State official
responsible for Systems Security designated in the agreement. That State official or
delegate must then notify the SSA Regional Office Contact and the SSA Systems
Security Contact identified in the agreement. If, for any reason, the responsible State
official or delegate is unable to notify the SSA Regional Office or the SSA Systems
Security Contact within one hour, the responsible State Agency official or delegate
must report the incident by contacting SSA’s National Network Service Center
(NNSC) toll free at 877-697-4889 (select “Security and PII Reporting” from the
options list). The EIEP will provide updates as they become available to the SSA
contact, as appropriate. Refer to the worksheet provided in the agreement to
facilitate gathering and organizing information about an incident.
The EIEP must agree to absorb all costs associated with notification and remedial actions
connected to security breaches, if SSA determines that the risk presented by the
breach or security incident requires the notification of the subject individuals. SSA
recommends that EIEPs seriously consider establishing incident response
teams to address PII breaches.
5.10 Security Awareness and Employee Sanctions
The EIEP must designate a department or party to take the responsibility to provide
ongoing security awareness training for employees who access SSA-provided
information. Training must include:
o The sensitivity of SSA-provided information and address the Privacy Act and other
Federal and state laws governing its use and misuse
o Rules of behavior concerning use and security in systems processing SSA-provided
information
o Restrictions on viewing and/or copying SSA-provided information
o The employee’s responsibility for proper use and protection of SSA-provided
information including its proper disposal
o Security incident reporting procedures
o Basic understanding of procedures to protect the network from malware attacks
14
County of Fresno
16-93111
43 of 70
o Spoofing, Phishing, and Pharming scam prevention
o The possible sanctions and penalties for misuse of SSA-provided information
SSA requires the EIEP to provide security awareness training to all employees and
contractors who access SSA-provided information. The training should be annual,
mandatory, and certified by the personnel who receive the training. SSA also requires
the EIEP to certify that each employee or contractor who views SSA-provided data also
certify that they understand the potential criminal and administrative sanctions or
penalties for unlawful disclosure.
5.11 Contractors of Electronic Information Exchange Partners
As previously stated in The General Systems Security Standards, contractors of the
EIEP must adhere to the same security requirements as employees of the EIEP. The
EIEP is responsible for the oversight of its contractors and the contractor’s compliance
with the security requirements. The EIEP will enter into a written agreement with each
of its contractors and agents who need SSA data to perform their official duties,
whereby such contractors or agents agree to abide by all relevant Federal laws,
restrictions on access, use, disclosure, and the security requirements in this
Agreement.
The EIEP’s employees, contractors, and agents who access, use, or disclose
SSA data in a manner or purpose not authorized by this Agreement may be subject to
both civil and criminal sanctions pursuant to applicable Federal statutes. The EIEP will
provide its contractors and agents with copies of this Agreement, related
IEAs, and all related attachments before initial disclosure of SSA data to such
contractors and agents. Prior to signing this Agreement, and thereafter at SSA’s
request, the EIEP will obtain from its contractors and agents a current list of
the employees of such contractors and agents with access to SSA data and provide
such lists to SSA.
The EIEP must be able to provide proof of the contractual agreement If the contractor
processes, handles, or transmits information provided to the EIEP by SSA or has
authority to perform on the EIEP’s behalf, the EIEP should clearly state the specific roles
and functions of the contractor. The EIEP will provide SSA written certification that the
contractor is meeting the terms of the agreement, including SSA security requirements.
The certification will be subject to our final approval before redisclosing our information.
The EIEP must also require that contractors who will process, handle, or transmit
information provided to the EIEP by SSA sign an agreement with the EIEP that obligates
the contractor to follow the terms of the EIEP’s data exchange agreement with SSA. The
EIEP or the contractor must provide a copy of the data exchange agreement to each of
the contractor’s employees before disclosing data and make certain that the contractor’s
employees receive the same security awareness training as the EIEP’s employees. The
EIEP should maintain awareness-training records for the contractor’s employees and
require the same annual certification procedures.
The EIEP will be required to conduct the review of contractors and is responsible
for ensuring compliance of its contractors with security and privacy requirements and
limitations. As such, the EIEP will subject the contractor to ongoing security compliance
15
County of Fresno
16-93111
44 of 70
reviews that must meet SSA standards. The EIEP will conduct compliance
reviews at least triennially commencing no later than three (3) years after the approved
initial security certification to SSA; and must provide SSA with written documentation of
recurring compliance reviews, with the contractor, subject to our approval.
If the EIEP’s contractor will be involved with the processing, handling, or transmission
of information provided to the EIEP by SSA offsite from the EIEP, the EIEP must have
the contractual option to perform onsite reviews of that offsite facility to ensure that the
following meet SSA’s requirements:
o safeguards for sensitive information
o computer system safeguards
o security controls and measures to prevent, detect, and resolve unauthorized
access to, use of, and redisclosure of SSA-provided information
o continuous monitoring of the EIEP contractors’ network infrastructures and assets
6. General --Security Certification and Compliance Review Programs
SSA’s security certification and compliance review programs are distinct processes. The
certification program is a one-time process when an EIEP initially requests electronic access to
SSA-provided information. The certification process entails two rigorous stages intended to
ensure that technical, management, and operational security measures work as designed. SSA
must ensure that the EIEPs fully conform to SSA’s security requirements and satisfy both
stages of the certification process before SSA will permit online access to its data in a
production environment.
The compliance review program, however, ensures that the suite of security measures
implemented by an EIEP to safeguard SSA-provided information remains in full compliance with
SSA’s security standards and requirements. The compliance review program applies to both
online and batch access to SSA-provided information. Under the compliance review program,
EIEPs are subject to ongoing and periodic security reviews by SSA.
6.1 The Security Certification Program
The security certification process applies to EIEPs that seek online electronic access to SSA
information and consists of two general phases:
Phase One: The Security Design Plan (SDP) phase is a formal written plan authored
by the EIEP to comprehensively document its technical and non-technical security
controls to safeguard SSA-provided information (refer to Documenting Security
Controls in the Security Design Plan).+
NOTE: SSA may have legacy EIEPs (EIEPs not certified under the current
process) who have not prepared an SDP. OIS strongly recommends that
these EIEPs prepare an SDP.
The EIEP’s preparation and maintenance of a current SDP will aid them in
determining potential compliance issues prior to reviews, assuring
continued compliance with SSA’s security requirements, and providing for
16
County of Fresno
16-93111
45 of 70
more efficient security reviews.
Phase 2: The SSA Onsite Certification phase is a formal onsite review conducted by
SSA to examine the full suite of technical and non-technical security controls
implemented by the EIEP to safeguard data obtained from SSA electronically (refer to
The Certification Process).
6.2 Documenting Security Controls in the Security Design Plan (SDP)
6.2.1 When the SDP and Risk Assessment are Required
EIEPs must submit an SDP and a security risk assessment (RA) for evaluation when one or
more of the following circumstances apply. The RA must be in electronic format. It must
include discussion of the measures planned or implemented to mitigate risks identified by
the RA and (as applicable) risks associated with the circumstances below:
to obtain approval for requested access to SSA-provided information for an initial
agreement
to obtain approval to reestablish previously terminated access to SSA-provided data
to obtain approval to implement a new operating or security platform that will involve
SSA-provided information
to obtain approval for significant changes to the EIEP’s organizational structure,
technical processes, operational environment, data recovery capabilities, or security
implementations planned or made since approval of their most recent SDP or of their
most recent successfully completed security review
to confirm compliance when one or more security breaches or incidents involving
SSA-provided information occurred since approval of the EIEP’s most recent SDP
or of their most recent successfully completed security review
to document descriptions and explanations of measures implemented as the result
of a data breach or security incident
to document descriptions and explanations of measures implemented to resolve
non-compliancy issue(s)
to obtain a new approval after SSA revoked approval of the most recent SDP
SSA may require a new SDP if changes occurred (other than those listed above) that
may affect the terms of the EIEP’s information sharing agreement with SSA.
SSA will not approve the SDP or allow the initiation of transactions and/or access
to SSA-provided information before the EIEP complies with the SSRs.
An SDP must satisfactorily document the EIEP’s compliance with all of SSA’s SSRs in order to
provide the minimum level of security acceptable to SSA for its EIEP’s access to SSA-provided
information.
EIEP’s must correct deficiencies identified through the evaluation of the SDP and submit a
revised SDP that incorporates descriptions and explanations of the measures implemented to
17
County of Fresno
16-93111
46 of 70
eliminate the deficiencies. SSA cannot grant access to SSA-provided information until the EIEP
corrects the deficiencies, documents the SDP, and SSA approves the revisions. The EIEP will
communicate the implementation of corrective actions to SSA on a regular basis. SSA will
withhold final approval until the EIEP can rectify all deficiencies.
SSA may revoke the approval of the EIEP’s SDP and its access to SSA-provided information if we
learn the EIEP is non-compliant with one or more SSRs. The EIEP must submit a revised SDP,
which incorporates descriptions and explanations of the measures the EIEP will implement to
resolve the non-compliance issue(s). The EIEP must communicate the progress of corrective
action(s) to SSA on a regular basis. SSA will consider the EIEP in non-compliant status until
resolution of the issue(s), the EIEP’s SDP documents the corrections, and we approve the SDP.
If, within a reasonable time as determined by SSA, the EIEP is unable to rectify a deficiency
determined by SSA to present a substantial risk to SSA-provided information or to SSA, SSA will
withhold approval of the SDP and discontinue the flow of SSA-provided information.
NOTE: EIEPs that function only as an STC, transferring SSA-provided information
to other EIEPs must, per the terms of their agreements with SSA, adhere to SSA’s
System Security Requirements (SSR) and exercise their responsibilities regarding
protection of SSA-provided information.
6.3 The Certification Process
Once the EIEP has successfully satisfied Phase 1, SSA will conduct an onsite certification
review. The objective of the onsite review is to ensure the EIEP’s non-technical and
technical controls safeguard SSA-provided information from misuse and improper disclosure
and that those safeguards function and work as intended.
At its discretion, SSA may request that the EIEP participate in an onsite review and
compliance certification of their security infrastructure.
The onsite review may address any or all of SSA’s security requirements and include, when
appropriate:
a demonstration of the EIEP’s implementation of each requirement
random sampling of audit records and transactions submitted to SSA
a walkthrough of the EIEP’s data center to observe and document physical security
safeguards
a demonstration of the EIEP’s implementation of electronic exchange of data with SSA
discussions with managers/supervisors
examination of management control procedures and reports (e.g., anomaly detection
reports, etc.)
demonstration of technical tools pertaining to user access control and if appropriate,
browsing prevention, specifically:
o If the design is based on a permission module or similar design, or it is transaction
driven, the EIEP will demonstrate how the system triggers requests for information
from SSA.
18
County of Fresno
16-93111
47 of 70
o If the design is based on a permission module, the EIEP will demonstrate how the
process for requests for SSA-provided information prevent SSNs not present in the
EIEP’s system from sending requests to SSA. We w ill attempt to obtain information
from SSA using at least one, randomly created, fictitious number not known to the
EIEPs system.
During a certification or compliance review, SSA or a certifier acting on its behalf, may
request a demonstration of the EIEP’s audit trail system (ATS) and its record retrieval
capability. The certifier may request a demonstration of the ATS’ capability to track the
activity of employees who have the potential to access SSA-provided information within the
EIEP’s system. The certifier may request more information from those EIEPs who use an
STC to handle and audit transactions. We will conduct a demonstration to see how the EIEP
obtains audit information from the STC regarding the EIEP’s SSA transactions.
If an STC handles and audits an EIEP’s transactions, SSA requires the EIEP to demonstrate
both their own in-house audit capabilities and the process used to obtain audit information
from the STC.
If the EIEP employs a contractor who processes, handles, or transmits the EIEP’s SSA-
provided information offsite, SSA, at its discretion, may include the contractor’s facility in
the onsite certification review. The inspection may occur with or without a representative
of the EIEP.
Upon successful completion of the onsite certification exercise, SSA will authorize
electronic access to production data by the EIEP. SSA will provide written notification of
its certification to the EIEP and all appropriate internal SSA components.
The following is a high-level flow chart of the OIS Certification Process:
Kickoff Meeting
to discuss certification process with
EIEP
Request SDP
Evaluate SDP for approval
Conduct onsite review
Certify the EIEP
19
County of Fresno
16-93111
48 of 70
6.5 The Compliance Review Program and Process
Similar to the certification process, the compliance review program entails a rigorous
process intended to ensure that EIEPs who receive electronic information from SSA are in full
compliance with the Agency’s security requirements and standards. As a practice, SSA
attempts to conduct compliance reviews following a two to five year periodic review
schedule. However, as circumstances warrant, a review may take place at any time. Three
prominent examples that would trigger an ad hoc review are:
a significant change in the outside EIEP’s computing platform
a violation of any of SSA’s systems security requirements
an unauthorized disclosure of SSA information by the EIEP
The following is a high-level flow chart of the OIS Compliance Review Process:
Make risked-based selection of target
Determine method of review
Gather background information
Set review date
Conduct compliance review
Finalize review documentation
Monitor findings
SSA may conduct onsite compliance reviews and include both the EIEP’s main facility and a field
office.
SSA may, also at its discretion, request that the EIEP participate in an onsite compliance
review of their security infrastructure to confirm the implementation of SSA’s security
requirements.
20
County of Fresno
16-93111
49 of 70
The onsite review may address any or all of SSA’s security requirements and include, where
appropriate:
a demonstration of the EIEP’s implementation of each requirement
random sampling of audit records and transactions submitted to SSA
a walkthrough of the EIEP’s data center to observe and document physical security
safeguards
a demonstration of the EIEP’s implementation of online exchange of data with SSA
discussions with managers/supervisors
examination of management control procedures and reports (e.g. anomaly detection
reports, etc.)
demonstration of technical tools pertaining to user access control and, if appropriate,
browsing prevention:
o If the design uses a permission module or similar design, or is transaction driven, the
EIEP will demonstrate how the system triggers requests for information from SSA.
o If the design uses a permission module, the EIEP will demonstrate the process used to
request SSA-provided information and prevent the EIEP’s system from processing SSNs
not present in the EIEP’s system. We can accomplish this by attempting to obtain
information from SSA using at least one, randomly created, fictitious number not known
to the EIEP’s system.
SSA may, at its discretion, perform an onsite or remote review for reasons including, but
not limited to the following:
the EIEP has experienced a security breach or incident involving SSA-provided information
the EIEP has unresolved non-compliancy issue(s)
to review an offsite contractor’s facility that processes SSA-provided information
the EIEP is a legacy organization that has not yet been through SSAs security certification
and compliance review programs
the EIEP requested that SSA perform an IV & V (Independent Verification and Validation
review)
During the compliance review, SSA, or a certifier acting on its behalf, may request a
demonstration of the system’s audit trail and retrieval capability. The certifier may request a
demonstration of the system’s capability for tracking the activity of employees who view SSA-
provided information within the EIEP’s system. The certifier may request EIEPs that have STCs
that handle and audit transactions with SSA to demonstrate the process used to obtain audit
information from the STC.
If an STC handles and audits the EIEP’s transactions with SSA, we may require the EIEP to
demonstrate both their in-house audit capabilities and the processes used to obtain audit
information from the STC regarding the EIEP’s transactions with SSA.
21
County of Fresno
16-93111
50 of 70
If the EIEP employs a contractor who will process, handle, or transmit the EIEP’s SSA-provided
information offsite, SSA, at its discretion, may include in the onsite compliance review an onsite
inspection of the contractor’s facility. The inspection may occur with or without a representative
of the EIEP. The format of the review in routine circumstances (i.e., the compliance review is
not being conducted to address a special circumstance, such as a disclosure violation) will
generally consist of reviewing and updating the EIEP’s compliance with the systems security
requirements described above in this document. At the conclusion of the review, SSA will issue
a formal report to appropriate EIEP personnel. The Final Report will address findings and
recommendations from SSA’s compliance review, which includes a plan for monitoring each issue
until closure.
NOTE: SSA handles documentation provided for compliance reviews as sensitive
information. The information is only accessible to authorized individuals who have a
need for the information as it relates to the EIEP’s compliance with its electronic
information sharing agreement with SSA and the associated system security
requirements and procedures. SSA will not retain the EIEP’s documentation any longer
than required. SSA will delete, purge, or destroy the documentation when the
retention requirement expires.
The following is a high-level example of the analysis that aids SSA in making a preliminary
determination as to which review format is appropriate. We may also use additional factors to
determine whether SSA will perform an onsite or remote compliance review.
High/Medium Risk Criteria
o undocumented closing of prior review finding(s)
o implementation of technical/operational controls that affect security of SSA-provided
information (e.g. implementation of new data access method)
o PII breach
Low Risk Criteria
o no prior review finding(s) or prior finding(s) documented as closed
o no implementation of technical/operational controls that impact security of SSA-provided
information (e.g. implementation of new data access method)
o no PII breach
6.5.1 EIEP Compliance Review Participation
SSA may request to meet with the following persons during the compliance review:
a sample of managers and/or supervisors responsible for enforcing and monitoring
ongoing compliance to security requirements and procedures to assess their level of
training to monitor their employee’s use of SSA-provided information, and for
reviewing reports and taking necessary action
the individuals responsible for performing security awareness and employee sanction
functions to learn how you fulfill this requirement
a sample of the EIEP’s employees to assess their level of training and
understanding of the requirements and potential sanctions applicable to the use
and misuse of SSA-provided information
22
County of Fresno
16-93111
51 of 70
the individual(s) responsible for management oversight and quality assurance
functions to confirm how your agency accomplishes this requirement
additional individuals as deemed appropriate by SSA
6.5.2 Verification of Audit Samples
Prior to or during the compliance review, SSA will present to the EIEP a sampling
of transactions previously submitted to SSA for verification. SSA requires the
EIEP to verify whether each transaction was, per the terms of their agreement
with SSA, legitimately submitted by a user authorized to do so.
SSA requires the EIEP to provide a written attestation of the transaction review
results. The document must provide:
confirmation that each sample transaction located in the EIEP’s audit file
submitted by its employee(s) was for legitimate and authorized business
purposes
an explanation for each sample transaction located in the EIEP’s audit file(s)
determined to have been unauthorized
an explanation for each sample transaction not found in the EIEP’s ATS
When SSA provides the sample transactions to the EIEP, detailed instructions will be
included. Only an official responsible for the EIEP is to provide the attestation.
6.6 Scheduling the Onsite Review
SSA will not schedule the onsite review until we approve the EIEP’s SDP. SSA will send
approval notification via email. There is no prescribed period for arranging the subsequent
onsite review (certification review for an EIEP requesting initial access to SSA-provided
information for an initial agreement or compliance review for other EIEPs). Unless there
are compelling circumstances precluding it, the onsite review will follow as soon as
reasonably possible.
However, the scheduling of the onsite review may depend on additional factors including:
the reason for submission of a plan
the severity of security issues, if any
circumstances of the previous review, if any
SSA workload considerations
Although the scheduling of the review is contingent upon approval of the SDP, SSA may
perform an onsite review prior to approval if we determine that it is necessary to
complete our evaluation of a plan.
23
County of Fresno
16-93111
52 of 70
(THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
24
County of Fresno
16-93111
53 of 70
7. Additional Definitions
Back Button:
Refers to a button on a web browser’s toolbar, the backspace button on a
computer keyboard, a programmed keyboard button or mouse button, etc.,
that returns a user to a previously visited web page or application screen.
Breach:
Refers to actual loss, loss of control, compromise, unauthorized disclosure,
unauthorized acquisition, unauthorized access, or any similar term referring to
situations where unauthorized persons have access or potential access to PII or
Covered Information, whether physical, electronic, or in spoken word or
recording.
Browsing:
Requests for or queries of SSA-provided information for purposes not related to
the performance of official job duties.
Choke Point:
The firewall between a local network and the Internet is a choke point in
network security, because any attacker would have to come through that
channel, which is typically protected and monitored.
Cloud Computing:
The term refers to Internet-based computing derived from the cloud
drawing representing the Internet in computer network diagrams. Cloud
computing providers deliver on-line and on-demand Internet services.
Cloud Services normally use a browser or Web Server to deliver and store
information.
Cloud Computing (NIST SP 800‐145 Excerpt):
Cloud computing is a model for enabling ubiquitous, convenient, on‐demand network access to a
shared pool of configurable computing resources (e.g., networks, servers, storage, applications,
and services) that can be rapidly provisioned and released with minimal management effort or
service provider interaction. This cloud model is composed of five essential characteristics, three
service models, and four deployment models.
Essential Characteristics:
On‐demand self‐service ‐A consumer can unilaterally provision computing capabilities, such as
server time and network storage, as needed automatically without requiring human interaction
with each service provider.
Broad network access ‐Capabilities are available over the network and accessed through
standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g.,
25
County of Fresno
16-93111
54 of 70
mobile phones, tablets, laptops, and workstations).
Resource pooling ‐The provider’s computing resources are pooled to serve multiple consumers
using a multi‐tenant model, with different physical and virtual resources dynamically assigned and
reassigned according to consumer demand. There is a sense of location independence in that the
customer generally has no control or knowledge over the exact location of the provided resources
but may be able to specify location at a higher level of abstraction (e.g., country, state, or
datacenter). Examples of resources include storage, processing, memory, and network bandwidth.
Rapid elasticity ‐Capabilities can be elastically provisioned and released, in some cases
automatically, to scale rapidly outward and inward commensurate with demand. To the
consumer, the capabilities available for provisioning often appear to be unlimited and can be
appropriated in any quantity at any time.
Measured service ‐Cloud systems automatically control and optimize resource use by leveraging
a metering capability1 at some level of abstraction appropriate to the type of service (e.g.,
storage, processing, bandwidth, and active user accounts). Resource usage can be monitored,
controlled, and reported, providing transparency for both the provider and consumer of the
utilized service.
Service Models:
Software as a Service (SaaS) ‐The capability provided to the consumer is to use the provider’s
applications running on a cloud infrastructure2. The applications are accessible from various client
devices through either a thin client interface, such as a web browser (e.g., web‐based email), or a
program interface. The consumer does not manage or control the underlying cloud infrastructure
including network, servers, operating systems, storage, or even individual application capabilities,
with the possible exception of limited user‐specific application configuration settings.
Platform as a Service (PaaS) ‐The capability provided to the consumer is to deploy onto the cloud
infrastructure consumer‐created or acquired applications created using programming languages,
libraries, services, and tools supported by the provider.3 The consumer does not manage or
control the underlying cloud infrastructure including network, servers, operating systems, or
storage, but has control over the deployed applications and possibly configuration settings for the
application‐hosting environment.
Infrastructure as a Service (IaaS) ‐The capability provided to the consumer is to provision
processing, storage, networks, and other fundamental computing resources where the consumer
is able to deploy and run arbitrary software, which can include operating systems and
applications. The consumer does not manage or control the underlying cloud infrastructure but
has control over operating systems, storage, and deployed applications; and possibly limited
control of select networking components (e.g., host firewalls).
26
County of Fresno
16-93111
55 of 70
_________________________________
Deployment Models:
Private cloud ‐The cloud infrastructure is provisioned for exclusive use by a single organization
comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by
the organization, a third party, or some combination of them, and it may exist on or off premises.
Community cloud ‐The cloud infrastructure is provisioned for exclusive use by a specific
community of consumers from organizations that have shared concerns (e.g., mission, security
requirements, policy, and compliance considerations). It may be owned, managed, and operated
by one or more of the organizations in the community, a third party, or some combination of
them, and it may exist on or off premises.
Public cloud ‐The cloud infrastructure is provisioned for open use by the general public. It may be
owned, managed, and operated by a business, academic, or government organization, or some
combination of them. It exists on the premises of the cloud provider.
Hybrid cloud ‐The cloud infrastructure is a composition of two or more distinct cloud
infrastructures (private, community, or public) that remain unique entities, but are bound
together by standardized or proprietary technology that enables data and application portability
(e.g., cloud bursting for load balancing between clouds).
1 Typically this is done on a pay‐per‐use or charge‐per‐use basis.
2 A cloud infrastructure is the collection of hardware and software that enables the five essential
characteristics of cloud computing. The cloud infrastructure can be viewed as containing both a physical
layer and an abstraction layer. The physical layer consists of the hardware resources that are necessary to
support the cloud services being provided, and typically includes server, storage and network components.
The abstraction layer consists of the software deployed across the physical layer, which manifests the
essential cloud characteristics. Conceptually the abstraction layer sits above the physical layer.
3 This capability does not necessarily preclude the use of compatible programming languages, libraries,
services, and tools from other sources.
Cloud Drive:
A cloud drive is a Web-based service that provides storage space on a remote
server.
Cloud Audit:
Cloud Audit is a specification developed at Cisco Systems, Inc. that provides
cloud computing service providers a standard way to present and share
detailed, automated statistics about performance and security.
27
County of Fresno
16-93111
56 of 70
Commingling:
Commingling is the creation of a common database or repository that stores and
maintains both SSA-provided and preexisting EIEP PII.
Degaussing:
Degaussing is the method of using a “special device” (i.e., a device that
generates a magnetic field) in order to disrupt magnetically recorded
information. Degaussing can be effective for purging damaged media and media
with exceptionally large storage capacities. Degaussing is not effective for
purging non-magnetic media (e.g., optical discs).
Dial-up:
Sometimes used synonymously with dial-in, refers to digital data transmission
over the wires of a local telephone network.
Function:
One or more persons or organizational components assigned to serve a
particular purpose, or perform a particular role. The purpose, activity, or role
assigned to one or more persons or organizational components.
Hub:
As it relates to electronic data exchange with SSA, a hub is an organization,
which serves as an electronic information conduit or distribution collection
point. The term Hub is interchangeable with the terms “StateTransmission
Component,” “State Transfer Component,” or “STC.”
ICON:
Interstate Connection Network (various entities use 'Connectivity' rather than
'Connection')
IV & V:
Independent Verification and Validation
Legacy System:
A term usually referring to a corporate or organizational computer system or
network that utilizes outmoded programming languages, software, and/or
hardware that typically no longer receives support from the original vendors or
developers.
Manual Transaction:
A user-initiated operation (also referred to as a “user-initiated transaction‟).
This is the opposite of a system-generated automated process.
Example: A user enters a client’s information including the client’s SSN and
presses the “ENTER‟ key to acknowledge that input of data is complete. A
new screen appears with multiple options, which include “VERIFY SSN‟ and
28
County of Fresno
16-93111
57 of 70
“CONTINUE‟. The user has the option to verify the client’s SSN or perform
alternative actions.
Media Sanitization:
Disposal: Refers to the discarding (e.g., recycling) of media that
contains no sensitive or confidential data.
Clearing: This type of media sanitization is adequate for protecting
information from a robust keyboard attack. Clearing must prevent retrieval
of information by data, disk, or file recovery utilities. Clearing must be
resistant to keystroke recovery attempts executed from standard input
devices and from data scavenging tools. For example, overwriting is an
acceptable method for clearing media. Deleting items, however, is not
sufficient for clearing.
This process may include overwriting all addressable locations of the data, as
well as its logical storage location (e.g., its file allocation table). The aim of
the overwriting process is to replace or obfuscate existing information with
random data. Most rewriteable media may be cleared by a single overwrite.
This method of sanitization is not possible on un-writeable or damaged media.
Purging: This type of media sanitization is a process that protects
information from a laboratory attack. The terms clearing and purging are
sometimes synonymous. However, for some media, clearing is not
sufficient for purging (i.e., protecting data from a laboratory attack).
Although most re-writeable media requires a single overwrite, purging
may require multiple rewrites using different characters for each write
cycle.
This is because a laboratory attack involves threats with the capability to
employ non-standard assets (e.g., specialized hardware) to attempt data
recovery on media outside of that media’s normal operating environment.
Degaussing is also an example of an acceptable method for purging magnetic
media. The EIEP should destroy media if purging is not a viable method for
sanitization.
Destruction: Physical destruction of media is the most effective form of
sanitization. Methods of destruction include burning, pulverizing, and
shredding. Any residual medium should be able to withstand a laboratory
attack.
Permission module:
A utility or subprogram within an application, which automatically enforces
the relationship of a request for or query of SSA-provided information to an
authorized process or transaction before initiating a transaction. For
example, requests for verification of an SSN for issuance of a driver’s license
happens automatically from within a state driver’s license application. The
System will not allow a user to request information from SSA unless the
EIEP’s client system contains a record of the subject individual’s SSN.
Screen Scraping:
29
County of Fresno
16-93111
58 of 70
Screen scraping is normally associated with the programmatic collection of visual
data from a source. Originally, screen scraping referred to the practice of
reading text data from a computer display terminal’s screen. This involves
reading the terminal's memory through its auxiliary port, or by connecting the
terminal output port of one computer system to an input port on another. The
term screen scraping is synonymous with the term bidirectional exchange of
data.
A screen scraper might connect to a legacy system via Telnet, emulate the
keystrokes needed to navigate the legacy user interface, process the resulting
display output, extract the desired data, and pass it on to a modern system.
More modern screen scraping techniques include capturing the bitmap data
from a screen and running it through an optical character reader engine, or
in the case of graphical user interface applications, querying the graphical
controls by programmatically obtaining references to their underlying
programming objects.
Security Breach:
An act from outside an organization that bypasses or violates security policies,
practices, or procedures.
Security Incident:
A security incident happens when a fact or event signifies the possibility that a
breach of security may be taking place, or may have taken place. All threats are
security incidents, but not all security incidents are threats.
Security Violation:
An act from within an organization that bypasses or disobeys security
policies, practices, or procedures.
Sensitive data:
Any information, the loss, misuse, or unauthorized access to or modification of
which could adversely affect the national interest of the conduct of federal
programs, or the privacy to which individuals are entitled under section 552a of
title 5, United States Code (the Privacy Act), but which has not been specifically
authorized under criteria established by an Executive Order or an Act of Congress
to be kept secret in the interest of national defense or foreign policy.
SMDS (Switched Multimegabit Data Service (SMDS):
SMDS is a telecommunications service that provides connectionless, high-
performance, packet-switched data transport. Although not a protocol, it
supports standard protocols and
communications interfaces using current technology.
SSA-provided data/information:
Synonymous with “SSA-supplied data/information.‟ Defines information under
the control of SSA that is provided to an external entity under the terms of an
information exchange agreement with SSA. The following are examples of
30
County of Fresno
16-93111
59 of 70
SSA-provided data/information:
SSA’s response to a request from an EIEP for information from SSA (e.g., date
of death)
SSA’s response to a query from an EIEP for verification of an SSN
SSA data/information:
This term, sometimes used interchangeably with “SSA-provided data/information‟,
denotes
information under the control of SSA that is provided to an external entity under
the terms of an information exchange agreement with SSA. However, “SSA
data/information” also includes information provided to the EIEP by a source
other than SSA, but which the EIEP attests to that SSA verified it, or the EIEP
couples the information with data from SSA as to to certify the accuracy of the
information. The following are examples of SSA information:
SSA’s response to a request from an EIEP for information from SSA (e.g., date
of death)
SSA’s response to a query from an EIEP for verification of an SSN
Display by the EIEP of SSA’s response to a query for verification of an
SSN and the associated SSN provided by SSA
Display by the EIEP of SSA’s response to a query for verification of an
SSN and the associated SSN provided to the EIEP by a source other
than SSA
Electronic records that contain only SSA’s response to a query for verification of
an SSN
and the associated SSN whether provided to the EIEP by SSA or a source
other than SSA
SSN:
Social Security Number
STC:
A State Transmission/Transfer Component is an organization that performs as an
electronic information conduit or collection point for one or more other entities
(also referred to as a hub).
System-generated transaction:
A transaction automatically triggered by an automated system process.
Example: A user enters a client’s information including the client’s SSN on an
input screen and presses the “ENTER‟ key to acknowledge that input of data is
complete. An automated process then matches the SSN against the
organization’s database and when the systems finds no match, automatically
sends an electronic request for verification of the SSN to SSA.
31
County of Fresno
16-93111
60 of 70
Systems process:
The Term “Systems Process” refers to a software program module that runs
in the background within an automated batch, online, or other process.
Third Party:
This term pertains to an entity (person or organization) provided access to SSA-
provided information by an EIEP or other SSA business partner for which one or
more of the following apply:
is not stipulated access to SSA-provided information by an information-sharing
agreement between an EIEP and SSA
has no information-sharing agreement with SSA
SSA does not directly authorize access to SSA-provided information
Transaction-driven:
This term pertains to an automatically initiated online query of or request for
SSA information by an automated transaction process (e.g., driver license
issuance, etc.). The query or request will only occur the automated process
meets prescribed conditions.
Uncontrolled transaction:
This term pertains to a transaction that falls outside a permission module. An
uncontrolled transaction is not subject to a systematically enforced relationship
between an authorized process or application and an existing client record.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
32
County of Fresno
16-93111
61 of 70
8. Regulatory References
Federal Information Processing Standards
(FIPS) Publications Federal Information
Security Management Act of 2002 (FISMA)
Homeland Security Presidential Directive
(HSPD-12)
National Institute of Standards and Technology (NIST) Special Publications
Office of Management and Budget (OMB) Circular A-123, Management’s
Responsibility for Internal
Control
Office of Management and Budget (OMB) Circular A-130, Appendix III,
Management of Federal
Information Resources
Office of Management and Budget (OMB) Memo M-06-16, Protection of Sensitive
Agency
Information, June 23, 2006
Office of Management and Budget (OMB) Memo M-07-16, Memorandum for the
Heads of Executive
Departments and Agencies May 22, 2007
Office of Management and Budget (OMB) Memo M-07-17, Safeguarding Against
and Responding to the Breach of Personally Identifiable Information, May 22,
2007
Privacy Act of 1974
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
33
County of Fresno
16-93111
62 of 70
9. Frequently Asked Questions
(Click links for answers or additional information)
1. Q: What is a breach of data?
A: Refer also to Security Breach, Security Incident, and Security
Violation.
2. Q: What is employee browsing?
A: Requests for or queries of SSA-provided information for purposes not
related to the performance of official job duties
3. Q: Okay, so the SDP was submitted. Can the Onsite Review be
scheduled now?
A: Refer to Scheduling the Onsite Review.
4. Q: What is a “Permission Module”?
A: A utility or subprogram within an application, which
automatically enforces the relationship of a request for or query
of SSA-provided information to an authorized process or
transaction before initiating a transaction. For example, if
requests for verification of an SSN for issuance of a driver’s
license happens automatically from within a state driver’s
license application. The System will not allow a user to request
information from SSA unless the EIEP’s client system contains a
record of the subject individual’s SSN.
5. Q: What is meant by Screen Scraping?
A: Screen scraping is normally associated with the programmatic
collection of visual data from a source. Originally, screen scraping
referred to the practice of reading text data from a computer display
terminal’s screen. This involves reading the terminal's memory
through its auxiliary port, or by connecting the terminal output port
of one computer system to an input port on another. The term
screen scraping is synonymous with the term bidirectional exchange
of data.
A screen scraper might connect to a legacy system via Telnet,
emulate the keystrokes needed to navigate the legacy user
interface, process the resulting display output, extract the desired
data, and pass it on to a modern system.
More modern screen scraping techniques include capturing the
bitmap data from a screen and running it through an optical
character reader engine, or in the case of graphical user
interface applications, querying the graphical controls by
programmatically obtaining references to their underlying
programming objects.
6. Q: When does an EIEP have to submit an SDP?
A: Refer to When the SDP and RA are Required.
7. Q: Does an EIEP have to submit an SDP when the agreement is
34
County of Fresno
16-93111
63 of 70
renewed?
A: The EIEP does not have to submit an SDP because the agreement
between the EIEP and SSA was renewed. There are, however,
circumstances that require an EIEP to submit an SDP. Refer to
When the SDP and RA are Required.
8. Q: Is it acceptable to save SSA data with a verified indicator on a
(EIEP) workstation if the EIEP uses an encrypted hard drive? If not,
what options does the agency have?
A: There is no problem with an EIEP saving SSA-provided information
on the encrypted hard drives of computers used to process SSA
data if the EIEP retains the information only as provided for in the
EIEP’s data-sharing agreement with SSA. Refer to Data and
Communications Security.
9. Q: Does SSA allow EIEPs to use caching of SSA-provided information on
the EIEP’s workstations?
A: Caching during processing is not a problem. However, SSA-provided
information must clear from the cache when the user exits the
application. Refer to Data and Communications Security.
10. Q: What does the term “interconnections to other systems” mean?
A: As used in SSA’s system security requirements document, the term
“interconnections” is the same as the term “connections.”
11. Q: Is it acceptable to submit the SDP as a .PDF file?
A: No, it is not. The document must remain editable.
12. Q: Should the EIEP write the SDP from the standpoint of my agency’s
SVES access itself, or from the standpoint of access to all data
provided to us by SSA?
A: The SDP is to encompass your agency’s electronic access to SSA-
provided information as per the electronic data sharing agreement
between your agency and SSA. Refer to Developing the SDP.
13. Q: If we have a “transaction-driven” system, do we still need a
permission module? If employees cannot initiate a query to
SSA, why would we need the permission module?
A: “Transaction driven” basically means that queries automatically
submit requests (and it might depend on the transaction).
Depending on the system’s design, queries might not be automatic or
it may still permit manual transactions. A system may require
manual transactions to correct an error. SSA does not prohibit
manual transactions if an ATS properly tracks such transactions. If a
“transaction-driven” system permits any type of alternate access; it still
requires a permission module, even if it restricts users from performing
manual transactions. If the system does not require the user to be
in a particular application or the query to be for an existing record in
the EIEP’s system before the system will allow a query to go through
to SSA, it would still need a permission module.
14. Q: What is an Onsite Compliance Review?
35
County of Fresno
16-93111
64 of 70
A: The Onsite Compliance Review is the process wherein SSA performs
periodic site visits to its Electronic Information Exchange Partners
(EIEP) to certify whether the EIEP’s technical, managerial, and
operational security measures for protecting data obtained
electronically from SSA continue to conform to the terms of the EIEP’s
data sharing agreements with SSA and SSA’s associated system
security requirements and procedures. Refer to the Compliance
Review Program and Process.
15. Q: What are the criteria for performing an Onsite Compliance Review?
A: The following are criteria for performing the Onsite
Compliance Review:
EIEP initiating new access or new access method for obtaining
information from SSA
EIEP’s cyclical review (previous review was performed remotely)
EIEP has made significant change(s) in its operating or security
platform involving SSA-provided information
EIEP experienced a breach of SSA-provided personally identifying
information (PII)
EIEP has been determined to be high-risk
Refer also to the Review Determination Matrix.
16. Q: What is a Remote Compliance Review?
A: The Remote Compliance Review is when SSA conducts the meetings
remotely (e.g., via conference calls). SSA schedules conference calls
with its EIEPs to determine whether the EIEPs technical, managerial,
and operational security measures for protecting data obtained
electronically from SSA continue to conform to the terms of the EIEP’s
data sharing agreements with SSA and SSA‟s associated system
security requirements and procedures. Refer to the Compliance
Review Program and Process.
17. Q: What are the criteria for performing a Remote Compliance Review?
A: The EIEP must satisfy the following criteria to qualify for a Remote
Compliance Review:
EIEP’s cyclical review (SSA’s previous review yielded no findings
or the EIEP satisfactorily resolved cited findings)
EIEP has made no significant change(s) in its operating or
security platform involving SSA-provided information
EIEP has not experienced a breach of SSA-provided
personally identifiable information (PII) since its
previous compliance review.
SSA rates the EIEP as a low-risk agency or state
36
County of Fresno
16-93111
65 of 70
Refer also to the Review Determination Matrix
37
County of Fresno
16-93111
66 of 70
ATTACHMENT 5
WORKSHEET FOR REPORTING LOSS OR POTENTIAL LOSS
OF PERSONALLY IDENTIFIABLE INFORMATION
County of Fresno
16-93111
67 of 70
ATTACHMENT 5 09/27/06
Worksheet for Reporting Loss or Potential Loss of Personally Identifiable
Information
1. Information about the individual making the report to the NCSC:
Name:
Position:
Deputy Commissioner Level Organization:
Phone Numbers:
Work: Cell: Home/Other:
E-mail Address:
Check one of the following:
Management Official Security Officer Non-Management
2. Information about the data that was lost/stolen:
Describe what was lost or stolen (e.g., case file, MBR data):
Which element(s) of PII did the data contain?
Name Bank Account Info
SSN Medical/Health Information
Date of Birth Benefit Payment Info
Place of Birth Mother’s Maiden Name
Address Other (describe):
Estimated volume of records involved:
3. How was the data physically stored, packaged and/or contained?
Paper or Electronic? (circle one):
If Electronic, what type of device?
Laptop Tablet Backup Tape Blackberry
Workstation Server CD/DVD Blackberry Phone #
Hard Drive Floppy Disk USB Drive
Other (describe):
County of Fresno
16-93111
68 of 70
ATTACHMENT 5 09/27/06
Additional Questions if Electronic:
Yes No Not Sure
a. Was the device encrypted?
b. Was the device password protected?
c. If a laptop or tablet, was a VPN SmartCard lost?
Cardholder’s Name:
Cardholder’s SSA logon PIN:
Hardware Make/Model:
Hardware Serial Number:
Additional Questions if Paper:
Yes No Not Sure
a. Was the information in a locked briefcase?
b. Was the information in a locked cabinet or drawer?
c. Was the information in a locked vehicle trunk?
d. Was the information redacted?
e. Other circumstances:
4. If the employee/contractor who was in possession of the data or to whom the
data was assigned is not the person making the report to the NCSC (as listed in
#1), information about this employee/contractor:
Name:
Position:
Deputy Commissioner Level Organization:
Phone Numbers:
Work: Cell: Home/Other:
E-mail Address:
5. Circumstances of the loss:
a. When was it lost/stolen?
b. Brief description of how the loss/theft occurred:
c. When was it reported to SSA management official (date and time)?
6. Have any other SSA components been contacted? If so, who? (Include deputy
commissioner level, agency level, regional/associate level component names)
County of Fresno
16-93111
69 of 70
ATTACHMENT 5 09/27/06
7. Which reports have been filed? (include FPS, local police, and SSA reports)
Report Filed Yes No Report Number
Federal Protective Service
Local Police
Yes No
SSA-3114 (Incident Alert)
SSA-342 (Report of Survey)
Other (describe)
8. Other pertinent information (include actions under way, as well as any contacts
with other agencies, law enforcement or the press):
County of Fresno
16-93111
70 of 70
CCC-307
CERTIFICATION
I, the official named below, CERTIFY UNDER PENALTY OF PERJURY that I am duly
authorized to legally bind the prospective Contractor to the clause(s) listed below. This
certification is made under the laws of the State of California.
Contractor/Bidder Firm Name (Printed) Federal ID Number
County of Fresno 94-6000512
By (Authorized Signature)
F_ .:::1-A~ j_ .A ~ 1
Printed Name and Title of Pe~on Signing
Ernest Buddy Mendes, Chairman Board of Supervisors I Date Executed
~-\\-\lo
I Executed in the County of
Fr esno
CONTRACTOR CERTIFICATION CLAUSES
1. STATEMENT OF COMPLIANCE: Contractor has , unless exempted , complied with
the nondiscrimination program requirements . (Gov. Code §12990 (a-f) and CCR, Title 2 ,
Section 81 03) (Not applicable to public entities .)
2. DRUG-FREE WORKPLACE REQ UIREMENTS: Contractor will comply with the
requirements ofthe Drug-Free Workplace Act of 1990 and will provide a drug-free
workplace by taking the following actions:
a. Publish a statement notifying employees that unlawful manufacture, distribution,
dispensation, possession or use of a controlled substance is prohibited and specifying
actions to be taken against employees for violations.
b. Establish a Drug-Free Awareness Program to inform employees about:
1) the dangers of drug abuse in the workplace ;
2) the person's or organization's policy of maintaining a drug-free workplace;
3) any available counseling , rehabilitation and employee assistance programs; and,
4) penalties that may be imposed upon employees for drug abuse violations.
c . Every employee who works on the proposed Agreement will :
1) receive a copy ofthe company's drug-free workplace policy statement; and ,
2) agree to abide by the terms of the company's statement as a condition of employment
on the Agreement.
Failure to comply with these requirements may result in suspension of payments under
the Agreement or termination of the Agreement or both and Contractor may be ineligible
for award of any future State agreements if the department determines that any of the
following has occurred: the Contractor has made false certification, or violated the
certification by failing to carry out the requirements as noted above. (Gov. Code §8350 et
seq.)
3. NATIONAL LABOR RELATIONS BOARD CERTIFICATION: Contractor certifies
that no more than one (1) final unappealable finding of contempt of court by a Federal
court has been issued against Contractor within the immediately preceding two-year
period because of Contractor's failure to comply with an order of a Federal court, which
orders Contractor to comply with an order of the National Labor Relations Board. (Pub.
Contract Code §10296) (Not applicable to public entities.)
4. CONTRACTS FOR LEGAL SERVICES $50,000 OR MORE- PRO BONO
REQUIREMENT: Contractor hereby certifies that contractor will comply with the
requirements of Section 6072 of the Business and Professions Code, effective January 1,
2003.
Contractor agrees to make a good faith effort to provide a minimum number of hours of
pro bono legal services during each year of the contract equal to the lessor of 30
multiplied by the number of full time attorneys in the firm’s offices in the State, with the
number of hours prorated on an actual day basis for any contract period of less than a full
year or 10% of its contract with the State.
Failure to make a good faith effort may be cause for non-renewal of a state contract for
legal services, and may be taken into account when determining the award of future
contracts with the State for legal services.
5. EXPATRIATE CORPORATIONS: Contractor hereby declares that it is not an
expatriate corporation or subsidiary of an expatriate corporation within the meaning of
Public Contract Code Section 10286 and 10286.1, and is eligible to contract with the
State of California.
6. SWEATFREE CODE OF CONDUCT:
a. All Contractors contracting for the procurement or laundering of apparel, garments or
corresponding accessories, or the procurement of equipment, materials, or supplies, other
than procurement related to a public works contract, declare under penalty of perjury that
no apparel, garments or corresponding accessories, equipment, materials, or supplies
furnished to the state pursuant to the contract have been laundered or produced in whole
or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal
sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or
with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under
penal sanction, abusive forms of child labor or exploitation of children in sweatshop
labor. The contractor further declares under penalty of perjury that they adhere to the
Sweatfree Code of Conduct as set forth on the California Department of Industrial
Relations website located at www.dir.ca.gov, and Public Contract Code Section 6108.
b. The contractor agrees to cooperate fully in providing reasonable access to the
contractor’s records, documents, agents or employees, or premises if reasonably required
by authorized officials of the contracting agency, the Department of Industrial Relations,
or the Department of Justice to determine the contractor’s compliance with the
requirements under paragraph (a).
7. DOMESTIC PARTNERS: For contracts over $100,000 executed or amended after
January 1, 2007, the contractor certifies that contractor is in compliance with Public
Contract Code section 10295.3.
DOING BUSINESS WITH THE STATE OF CALIFORNIA
The following laws apply to persons or entities doing business with the State of
California.
1. CONFLICT OF INTEREST: Contractor needs to be aware of the following provisions
regarding current or former state employees. If Contractor has any questions on the
status of any person rendering services or involved with the Agreement, the awarding
agency must be contacted immediately for clarification.
Current State Employees (Pub. Contract Code §10410):
1). No officer or employee shall engage in any employment, activity or enterprise from
which the officer or employee receives compensation or has a financial interest and
which is sponsored or funded by any state agency, unless the employment, activity or
enterprise is required as a condition of regular state employment.
2). No officer or employee shall contract on his or her own behalf as an independent
contractor with any state agency to provide goods or services.
Former State Employees (Pub. Contract Code §10411):
1). For the two-year period from the date he or she left state employment, no former state
officer or employee may enter into a contract in which he or she engaged in any of the
negotiations, transactions, planning, arrangements or any part of the decision-making
process relevant to the contract while employed in any capacity by any state agency.
2). For the twelve-month period from the date he or she left state employment, no former
state officer or employee may enter into a contract with any state agency if he or she was
employed by that state agency in a policy-making position in the same general subject
area as the proposed contract within the 12-month period prior to his or her leaving state
service.
If Contractor violates any provisions of above paragraphs, such action by Contractor shall
render this Agreement void. (Pub. Contract Code §10420)
Members of boards and commissions are exempt from this section if they do not receive
payment other than payment of each meeting of the board or commission, payment for
preparatory time and payment for per diem. (Pub. Contract Code §10430 (e))
2. LABOR CODE/WORKERS' COMPENSATION: Contractor needs to be aware of the
provisions which require every employer to be insured against liability for Worker's
Compensation or to undertake self-insurance in accordance with the provisions, and
Contractor affirms to comply with such provisions before commencing the performance
of the work of this Agreement. (Labor Code Section 3700)
3. AMERICANS WITH DISABILITIES ACT: Contractor assures the State that it
complies with the Americans with Disabilities Act (ADA) of 1990, which prohibits
discrimination on the basis of disability, as well as all applicable regulations and
guidelines issued pursuant to the ADA. (42 U.S.C. 12101 et seq.)
4. CONTRACTOR NAME CHANGE: An amendment is required to change the
Contractor's name as listed on this Agreement. Upon receipt of legal documentation of
the name change the State will process the amendment. Payment of invoices presented
with a new name cannot be paid prior to approval of said amendment.
5. CORPORATE QUALIFICATIONS TO DO BUSINESS IN CALIFORNIA:
a. When agreements are to be performed in the state by corporations, the contracting
agencies will be verifying that the contractor is currently qualified to do business in
California in order to ensure that all obligations due to the state are fulfilled.
b. "Doing business" is defined in R&TC Section 23101 as actively engaging in any
transaction for the purpose of financial or pecuniary gain or profit. Although there are
some statutory exceptions to taxation, rarely will a corporate contractor performing
within the state not be subject to the franchise tax.
c. Both domestic and foreign corporations (those incorporated outside of California) must
be in good standing in order to be qualified to do business in California. Agencies will
determine whether a corporation is in good standing by calling the Office of the Secretary
of State.
6. RESOLUTION: A county, city, district, or other local public body must provide the
State with a copy of a resolution, order, motion, or ordinance of the local governing body
which by law has authority to enter into an agreement, authorizing execution of the
agreement.
7. AIR OR WATER POLLUTION VIOLATION: Under the State laws, the Contractor
shall not be: (1) in violation of any order or resolution not subject to review promulgated
by the State Air Resources Board or an air pollution control district; (2) subject to cease
and desist order not subject to review issued pursuant to Section 13301 of the Water
Code for violation of waste discharge requirements or discharge prohibitions; or (3)
finally determined to be in violation of provisions of federal law relating to air or water
pollution.
8. PAYEE DATA RECORD FORM STD. 204: This form must be completed by all
contractors that are not another state agency or other governmental entity.