HomeMy WebLinkAboutAgreement A-17-614 with Department of Health Care Services.pdfCounty of Fresno
17-94521
Page 1 of 16
Exhibit A
Program Specifications
1.Service Overview
The California Department of Health Care Services (hereafter referred to as DHCS or
Department) administers the Mental Health Services Act, Projects for Assistance in
Transition from Homelessness (PATH) and Community Mental Health Services Grant
(MHBG) programs and oversees county provision of community mental health services
provided with realignment funds. Contractor (hereafter referred to as County in this Exhibit)
must meet certain conditions and requirements to receive funding for these programs and
community mental health services. This Agreement, which is County’s performance
contract, as required by Welfare and Institutions Code (Welf. & Inst. Code) sections
5650(a), 5651, 5666, 5897, and Title 9, California Code of Regulations (Cal. Code Regs.),
Title 9, section 3310, sets forth conditions and requirements that County must meet in order
to receive this funding. This Agreement does not cover federal financial participation or
State general funds as they relate to Medi-Cal services provided through the Mental Health
Plan Contracts. County agrees to comply with all of the conditions and requirements
described herein.
DHCS shall monitor this Agreement to ensure compliance with applicable federal and State
law and applicable regulations. (Gov. Code §§ 11180-11182; Welf. & Inst. Code §§ 5614,
5651, subd. (c), subd. (b) &, 14124.2, subd. (a).)
2.Service Location
The services shall be performed at appropriate sites as described in this contract.
3.Service Hours
The services shall be provided during times required by this contract.
4.Project Representatives
A.The project representatives during the term of this Agreement will be:
Department of Health Care Services
Contract Manager: Erika Cristo
Telephone: (916) 552-9055
Fax: (916) 440-7620
Email: Erika.Cristo@dhcs.ca.gov
County of Fresno
Contract Manager: Dawan Utecht
Telephone: (559) 600-9193
Fax: (559) 600-7674
Email: dutecht@co.fresno.ca.us
B.Direct all inquiries to:
County of Fresno
17-94521
Page 2 of 16
Exhibit A
Program Specifications
Department of Health Care Services
Mental Health Services
Division/Program Policy Unit
Attention: Guy Stewart
1500 Capitol Avenue, MS 2702
P.O. Box Number 997413
Sacramento, CA, 95899-7413
Telephone: (916) 449-5997
Fax: (916) 440-7620
Email: Guy.Stewart@dhcs.ca.gov
County of Fresno
Attention: Dawan Utecht
4441 E. Kings Canyon
Fresno, CA 93702
Telephone: (559) 600-9193
Fax: (559) 600-7674
Email: dutecht@co.fresno.ca.us
C.Either party may make changes to the information above by giving written notice to the
other party. Said changes shall not require an amendment to this Agreement.
5.General Requirements for Agreement
Welfare and Institutions Code section 5651 provides specific assurances, which are listed
below, that must be included in this Agreement. County shall:
A.Comply with the expenditure requirements of Welfare and Institutions Code
Section 17608.05,
B.Provide services to persons receiving involuntary treatment as required by Part 1
(commencing with section 5000) and Part 1.5 (commencing with section 5585) of
Division 5 of the Welfare and Institution Code,
C.Comply with all of the requirements necessary for Medi–Cal reimbursement for
mental health treatment services and case management programs provided to
Medi-Cal eligible individuals, including, but not limited to, the provisions set forth
in Chapter 3 (commencing with section 5700) of the Welfare and Institutions
Code, and submit cost reports and other data to DHCS in the form and manner
determined by the DHCS,
D.Ensure that the Local Mental Health Advisory Board has reviewed and approved
procedures ensuring citizen and professional involvement at all stages of the
planning process pursuant to Welfare and Institutions Code section 5604.2,
E.Comply with all provisions and requirements in law pertaining to patient rights,
F.Comply with all requirements in federal law and regulation pertaining to federally
funded mental health programs,
G.Provide all data and information set forth in Sections 5610 and 5664 of the
Welfare and Institutions Code,
County of Fresno
17-94521
Page 3 of 16
Exhibit A
Program Specifications
H.If the County elects to provide the services described in Chapter 2.5
(commencing with Section 5670) of Division 5 of the Welfare and Institution
Code, comply with guidelines established for program initiatives outlined in this
chapter, and
I.Comply with all applicable laws and regulations for all services delivered,
including all laws, regulations, and guidelines of the Mental Health Services Act.
6.Services Authority
County shall adhere to the program principles and, to the extent funds are available,
County shall provide the array of treatment options in accordance with Welfare and
Institutions Code sections 5600.4 through 5600.7, inclusive.
A.THE MENTAL HEALTH SERVICES ACT PROGRAM
1)Program Description
Proposition 63, which created the Mental Health Services Act (MHSA), was
approved by the voters of California on November 2, 2004. The Mental Health
Services (MHS) Fund, which provides funds to counties for the implementation of its
MHSA programs, was established pursuant to Welfare and Institutions Code section
5890. The MHSA was designed to expand California’s public mental health
programs and services through funding received by a one percent tax on personal
incomes in excess of $1 million. Counties use this funding for projects and
programs for prevention and early intervention, community services and supports,
workforce development and training, innovation, plus capital facilities and
technological needs through mental health projects and programs. The State
Controller distributes MHS Funds to the counties to plan for and provide mental
health programs and other related activities outlined in a county’s three-year
program and expenditure plan or annual update. MHS Funds are distributed by the
State Controller’s Office to the counties on a monthly basis.
DHCS shall monitor County’s use of MHS Funds to ensure that the county meets the
MHSA and MHS Fund requirements. (Gov. Code §§ 11180-11182; Welf. & Inst.
Code §§ 5651(c), 5897(d), 14124.2(a).)
2)Issue Resolution Process
County shall have an Issue Resolution Process (Process) to handle client disputes
related to the provision of their mental health services. The Process shall be
completed in an expedient and appropriate manner. County shall develop a log to
record issues submitted as part of the Process. The log shall contain the date the
issue was received; a brief synopsis of the issue; the final issue resolution outcome;
and the date the final issue resolution was reached.
3) Revenue and Expenditure Report
I
County of Fresno
17-94521
Page 4 of 16
Exhibit A
Program Specifications
County shall submit its Revenue and Expenditure Report (RER) electronically to the
Department and the Mental Health Services Oversight and Accountability
Commission by December 31 following the close of the fiscal year in accordance
with Welfare and Institutions Code sections 5705 and 5899, regulations and DHCS-
issued guidelines. The RER shall be certified by the mental health director and the
County’s auditor-controller (or equivalent), using the DHCS-issued certification form.
Data submitted shall be full and complete.
If County does not submit the RER by the required deadline, DHCS may withhold
MHSA funds until the reports are submitted or require the county to submit a
corrective action plan with specific timelines. (Welf. & Inst. Code § § 5897(e) and
5899(e); Cal. Code Regs., tit. 9, § 3510(c)) If the RER does not meet the
requirements outlined above, DHCS may request a plan of correction with specific
timelines. (Welf. & Inst. Code § 5897(e)) If the RER does not meet the
requirements, in accordance with the procedure in paragraph 9, DHCS may withhold
payments from the MHS Fund until the County submits a complete RER. (W elf. &
Inst. Code §§ 5655, Cal. Code Regs., tit. 9 § 3510(c).)
4) Distribution and Use of Local Mental Health Services Funds:
a.Welfare and Institutions Code section 5891(c) provides that commencing July 1,
2012, on or before the 15th day of each month, pursuant to a methodology
provided by DHCS, the State Controller shall distribute to County’s Local Mental
Health Services Fund (MHS Fund) (established by County pursuant to Welfare &
Institutions Code section 5892, subd. (f)) all unexpended and unreserved funds
on deposit as of the last day of the prior month in the Mental Health Services
Fund for the provision of specified programs and other related activities.
b. County shall allocate the monthly Local MHS Fund in accordance with Welfare
and Institutions Code section 5892 as follows:
i.Twenty percent of the funds shall be used for prevention and early
intervention (PEI) programs in accordance with Welfare and Institutions Code
section 5840. The expenditure for PEI may be increased by County if DHCS
determines that the increase will decrease the need and cost for additional
services to severely mentally ill persons in County by an amount at least
commensurate with the proposed increase.
ii.The balance of funds shall be distributed to County’s mental health programs
for services to persons with severe mental illnesses pursuant to Part 4 of
Division 5 of the Welfare and Institutions Code, (commencing with Section
5850), for the children’s system of care and Part 3 of Division 5 of the Welfare
and Institutions Code (commencing with Section 5800), for the adult and older
adult system of care.
iii. Five percent of the total funding for the County’s mental health programs
established pursuant to Part 3 of Division 5 of the Welfare and Institutions
Code (commencing with Section 5800), Part 3.6 of Division 5 of the Welfare
County of Fresno
17-94521
Page 5 of 16
Exhibit A
Program Specifications
and Institutions Code (commencing with Section 5840), and Part 4 of Division
5 of the Welfare and Institutions Code (commencing with Section 5850) shall
be utilized for innovative programs in accordance with W elfare and
Institutions Code sections 5830, 5847 and 5848.
iv. Programs for services pursuant to Part 3 of Division 5 of the Welfare and
Institutions Code (commencing with Section 5850) may include funds for
technological needs and capital facilities, human resource needs, and a
prudent reserve to ensure services do not have to be significantly reduced in
years in which revenues are below the average of previous years. The total
allocation for these purposes shall not exceed 20 percent of the average
amount of funds allocated to County for the previous five years.
v.Allocations in Subparagraphs i. through iii. above, include funding for annual
planning costs pursuant to Welfare and Institutions Code section 5848. The
total of these costs shall not exceed five percent of the total annual revenues
received for the Local MHS Fund. The planning costs shall include moneys
for County’s mental health programs to pay for the costs of having
consumers, family members, and other stakeholders participate in the
planning process and for the planning and implementation required for private
provider contracts to be significantly expanded to provide additional services.
c.County shall use Local MHS Fund monies to pay for those portions of the mental
health programs/services for children and adults for which there is no other
source of funds available. (Welf. & Inst. Code §§ 5813.5, subd. (b), 5878.3 subd.
(a); Cal. Code Regs., tit. 9 § 3610, subd. (d).)
d.County shall only use Local MHS Funds to expand mental health services. These
funds shall not be used to supplant existing state or county funds utilized to
provide mental health services. These funds shall only be used to pay for the
programs authorized in W elfare and Institutions Code section 5892. These funds
may not be used to pay for any other program and may not be loaned to
County’s general fund or any other County fund for any purpose. (Welf. & Inst.
Code § 5891, subd. (a).)
e.All expenditures for County mental health programs shall be consistent with a
currently approved three-year program and expenditure plan or annual update
pursuant to Welfare and Institutions Code section 5847. (Welf. & Inst. Code §
5892, subd. (g).)
5) Three-Year Program and Expenditure Plan and Annual Updates:
a. County shall prepare and submit a three-year program and expenditure plan, and
annual updates, adopted by County’s Board of Supervisors, to the Mental Health
Services Oversight and Accountability Commission (MHSOAC) and DHCS within
30 calendar days after adoption. (Welf. & Inst. Code, § 5847 subd. (a).) The
three-year program and expenditure plan and annual updates shall include all of
the following:
County of Fresno
17-94521
Page 6 of 16
Exhibit A
Program Specifications
i.A program for Prevention and Early Intervention (PEI) in accordance with Part
3.6 of Division 5 of the Welfare and Institutions Code (commending with
Section 5840). (Welf. & Inst. Code, § 5847, subd. (b)(1).)
ii.A program for services to children in accordance with Part 4 of Division 5 of
the Welfare and Institutions Code (commencing with Section 5850), to include
a wraparound program pursuant to Chapter 4 of Part 6 of Division 9 of the
Welfare and Institutions Code (commencing with Section 18250), or provide
substantial evidence that it is not feasible to establish a wraparound program
in the County. (Welf. & Inst. Code § 5847, subd. (b)(2).)
iii. A program for services to adults and seniors in accordance with Part 3 of
Division 5 of the Welfare and Institutions Code (commencing with Section
5800). (Welf. & Inst. Code § 5847, subd. (b)(3).)
iv. A program for innovations in accordance with Part 3.2 of Division 5 of the
Welfare and Institutions Code (commencing with Section 5830). (Welf. & Inst.
Code § 5847, subd. (b)(4).) Counties shall expend funds for their innovation
programs upon approval by the Mental Health Services Oversight and
Accountability Commission. (Welf. & Inst. Code, § 5830, subd. (e).)
v.A program for technological needs and capital facilities needed to provide
services pursuant to Part 3 of Division 5 of the Welfare and Institutions Code
(commencing with Section 5800), Part 3.6 of Division 5 of the Welfare and
Institutions Code (commencing with Section 5840), and Part 4 of Division 5 of
the Welfare and Institutions Code (commencing with Section 5850). All plans
for proposed facilities with restrictive settings shall demonstrate that the
needs of the people to be served cannot be met in a less restrictive or more
integrated setting. (Welf. & Inst. Code, § 5847, subd. (b)(5).)
vi. Identification of shortages in personnel to provide services pursuant to the
above programs and the additional assistance needed from the education and
training programs established pursuant to Part 3.1 of Division 5 of the Welfare
and Institutions Code (commencing with Section 5820) and California Code of
Regulations, Title 9, section 3830, subdivision(b). (Welf. & Inst. Code § 5847,
subd. (b)(6).)
vii. Establishment and maintenance of a prudent reserve to ensure the County
program will continue to be able to serve children, adults, and seniors that it is
currently serving pursuant to Part 3 of Division 5 of the Welfare and
Institutions Code (commencing with Section 5800), Part 3.6 of Division 5 of
the Welfare and Institutions Code (commencing with Section 5840), and Part
4 of Division 5 of the Welfare and Institutions Code (commencing with Section
5850), during years in which revenues for the MHS Fund are below recent
averages adjusted by changes in the state population and the California
Consumer Price Index. (Welf. & Inst. Code, § 5847, subd. (b)(7).)
County of Fresno
17-94521
Page 7 of 16
Exhibit A
Program Specifications
viii. Certification by County’s mental health director, which ensures that County
has complied with all pertinent regulations, laws, and statutes of the MHSA,
including stakeholder participation and non-supplantation requirements. (Welf.
& Inst. Code, § 5847, subd. (b)(8).)
ix. Certification by County’s Mental Health Director and County’s Auditor-
Controller that the County has complied with any fiscal accountability
requirements as directed by DHCS, and that all expenditures are consistent
with the requirements of the MHSA pursuant to California Code of
Regulations, Title 9, sections 3500 and 3505. (Welf. & Inst. Code, § 5847,
subd. (b)(9).)
b. County shall include services in the programs described in Subparagraphs 5.a.i.
through 5.a.v., inclusive, to address the needs of transition age youth between
the ages of 16 and 25 years old, including the needs of transition age foster
youth. (Welf. & Inst. Code, § 5847, subd. (c).)
c. County shall prepare expenditure plans for the programs described in
Subparagraphs 5.a.i. through 5.a.v., inclusive, and annual expenditure updates.
Each expenditure plan update shall indicate the number of children, adults, and
seniors to be served, and the cost per person. The expenditure update shall
include utilization of unspent funds allocated in the previous year and the
proposed expenditure for the same purpose. (Welf. & Inst. Code, § 5847, subd.
(e).)
d.County’s three-year program and expenditure plan and annual updates shall
include reports on the achievement of performance outcomes for services
provided pursuant to the Adult and Older Adult Mental Health System of Care
Act, Prevention and Early Intervention, and the Children’s Mental Health Services
Act, which are funded by the MHS Fund and established jointly by DHCS and the
MHSOAC, in collaboration with the California Mental Health Director’s
Association (Welf. & Inst. Code, § 5848, subd. (c).) County contracts with
providers shall include the performance goals from the County’s three-year
program and expenditure plan and annual updates that apply to each provider’s
programs and services
e.County’s three-year program and expenditure plan and annual update shall
consider ways to provide services to adults and older adults that are similar to
those established pursuant to the Mentally Ill Offender Crime Reduction Grant
Program. Funds shall not be used to pay for persons incarcerated in state prison
or parolees from state prisons. (Welf. & Inst. Code, § 5813.5, subd. (f).)
6)Planning Requirements and Stakeholder Involvement:
a. County shall develop its three-year program and expenditure plan and annual
update with local stakeholders, including adults and seniors with severe mental
County of Fresno
17-94521
Page 8 of 16
Exhibit A
Program Specifications
illness, families of children, adults, and seniors with severe mental illness,
providers of services, law enforcement agencies, education, social services
agencies, veterans, representatives from veterans organizations, providers of
alcohol and drug services, health care organizations, and other important
interests. Counties shall demonstrate a partnership with constituents and
stakeholders throughout the process that includes meaningful stakeholder
involvement on mental health policy, program planning, and implementation,
monitoring, quality improvement, evaluation, and budget allocations. County
shall prepare and circulate a draft plan and update for review and comment for at
least 30 calendar days to representatives of stakeholder interests and any
interested party who has requested a copy of the draft plans. (Welf. & Inst. Code,
§ 5848, subd. (a); Cal. Code Regs., tit. 9, §§ 3300, 3310, 3315 & 3320.)
b. County’s mental health board, established pursuant to Welfare and Institutions
Code, section 5604, shall conduct a public hearing on the County’s draft three-
year program and expenditure plan and annual updates at the close of the 30
calendar day comment period. Each adopted three-year program and
expenditure plan or annual update shall summarize and analyze substantive
recommendations and describe substantive changes to the three-year program
and expenditure plan and annual updates. The County’s mental health board
shall review the adopted three-year program and expenditure plan and annual
updates and recommend revisions to the County’s mental health department.
(Welf. & Inst. Code, § 5848, subd. (b); Cal. Code Regs., tit. 9, § 3315.)
c.The County shall provide for a Community Planning Process as the basis for
developing the Three-Year Program and Expenditure Plans and updates. The
County shall designate positions and or units responsible for: the overall
Community Program Planning Process; coordination and management of the
Community Program Planning Process; ensuring stakeholders have the
opportunity to participate; ensuring that stakeholders reflect the diversity of the
demographics of the County; providing outreach to clients and their family
members. The Community Program Planning process shall, at a minimum,
include: involvement of clients and their family members in all aspects of the
Process; participation of stakeholders; training, as needed, to County staff and
stakeholders, clients, and family members regarding the stakeholder process.
(Cal. Code Regs., tit. 9, § 3300.)
d.The County shall adopt the following standards in planning, implementing, and
evaluating the programs and/or services provided with MHSA funds; community
collaboration, as defined in California Code of Regulations, Title 9, section
3200.060; cultural competence, as defined in section 3200.100; client driven, as
defined in section 3200.050; family driven, as defined in section 3200.120;
wellness, recovery and resilience focused; and integrated service experiences for
clients and their families, as defined in section 3200.190. The planning,
implementation and evaluation process includes, but is not limited to, the
Community Program Planning Process; development of the Three-Year Program
and Expenditure Plans and updates; and the manner in which the County
I
County of Fresno
17-94521
Page 9 of 16
Exhibit A
Program Specifications
delivers services and evaluates service delivery. (Cal. Code Regs., tit. 9, §
3320)
7) County Requirements for Handling MHSA Funds
a.County shall place all funds received from the State MHS Fund into a Local
MHS Fund. The Local MHS Fund balance shall be invested consistent with
other County funds and the interest earned on the investments shall be
transferred into the Local MHS Fund. (Welf. & Inst. Code, § 5892, subd. (f).)
b.The earnings on investment of these funds shall be available for distribution
from the fund in future years. (Welf. & Inst. Code, § 5892, subd. (f).)
c.Other than funds placed in a reserve in accordance with an approved plan, any
funds allocated to County which it has not spent for the authorized purpose
within the three years shall revert to the State. County may retain MSHA Funds
for capital facilities, technological needs, or education and training for up to 10
years before reverting to the State. (Welf. & Inst. Code, § 5892, subd. (h).)
d.When accounting for all receipts and expenditures of MHSA funds, County must
adhere to uniform accounting standards and procedures that conform to the
Generally Accepted Accounting Principles (GAAP), as prescribed by the State
Controller in California Code of Regulations, Title 2, division 2, chapter 2,
subchapter 1, Accounting Procedures for Counties, sections 901-949, and a
manual, which is currently entitled “Accounting Standards and Procedures for
Counties” and available at http://www.sco.ca.gov/pubs_guides.html. (Gov.
Code, §30200.)
8) Department Compliance Investigations:
DHCS may investigate County’s performance of the Mental Health Services Act
related provisions of this Agreement and compliance with the provisions of the
Mental Health Services Act, and relevant regulations. In conducting such an
investigation DHCS may inspect and copy books, records, papers, accounts,
documents and any writing as defined by Evidence Code Section 250 that is
pertinent or material to the investigation of the County. For purposes of this
Paragraph “provider” means any person or entity that provides services, goods,
supplies or merchandise, which are directly or indirectly funded pursuant to MHSA.
(Gov. Code §§ 11180, 11181, 11182; Welf. & Inst. Code §§ 5651, subd. (a)(9),
5897(d) 14124.2.)
9) County Breach, Plan of Correction and Withholding of State Mental Health Funds:
a.If DHCS determines that County is out-of-compliance with the Mental Health
Services Act related provisions of this Agreement, DHCS may request that
County submit a plan of correction, including a specific timeline to correct the
deficiencies, to DHCS. (Welf. & Inst. Code § 5897(d).)
County of Fresno
17-94521
Page 10 of 16
Exhibit A
Program Specifications
b.In accordance with Welfare and Institutions Code section 5655, if DHCS
considers County to be substantially out-of-compliance with any provision of the
Mental Health Services Act or relevant regulations, including all reporting
requirements, the director shall order County to appear at a hearing before the
Director or the Director’s designee to show cause why the Department should not
take administrative action. County shall be given at least twenty (20) days notice
before the hearing.
c.If the Director determines that there is or has been a failure, in a substantial
manner, on the part of County to comply with any provision of the Welfare and
Institutions Code or its implementing regulations, and that administrative
sanctions are necessary, the Department may invoke any, or any combination of,
the following sanctions Welfare and Institutions Code Section 5655:
1)Withhold part or all state mental health funds from County.
2)Require County to enter into negotiations with DHCS to agree on a plan for
County to address County’s non-compliance.
3)Bring an action in mandamus or any other action in court as may be
appropriate to compel compliance. Any action filed in accordance with the
section shall be entitled to a preference in setting a date for hearing.
B.PROJECTS FOR ASSISTANCE IN TRANSITION FROM HOMELESSNESS (PATH)
PROGRAM (42, U.S.C. §§, 290cc-21 -290cc-35, inclusive)
Pursuant to Title 42 of the United States Code, sections 290cc-21 through 290cc-35,
inclusive, the State of California has been awarded federal homeless funds through
the federal McKinney Projects for Assistance in Transition from Homelessness
(PATH) formula grant. The PATH grant funds community based outreach, mental
health and substance abuse referral/treatment, case management and other support
services, as well as a limited set of housing services for the homeless mentally ill.
County shall submit its Request for Application (RFA) responses and required
documentation specified in DHCS’ RFA to receive PATH funds. County shall
complete its RFA responses in accordance with the instructions, enclosures and
attachments available on the DHCS website at:
http://www.dhcs.ca.gov/services/MH/Pages/PATH.aspx.
If County applied for and DHCS approved its request to receive PATH grant funds,
the RFA, County’s RFA responses and required documentation, and DHCS’
approval constitute provisions of this Agreement and are incorporated by reference
herein. County shall comply with all provisions of the RFA and the County’s RFA
responses.
County of Fresno
17-94521
Page 11 of 16
Exhibit A
Program Specifications
C.COMMUNITY MENTAL HEALTH SERVICES GRANT (MHBG) PROGRAM (42, U.S.C. §
300x-1 et seq.)
Pursuant to Title 42, United States Code section 300x-1 et seq., the State of
California has been awarded the federal Community Mental Health Services Block
Grant funds (known as Mental Health Block Grant (MHBG)). County mental health
agencies utilize MHBG funding to provide a broad array of mental health services
within their mental health system of care (SOC) programs. These programs provide
services to the following target populations: children and youth with serious
emotional disturbances (SED) and adults and older adults with serious mental
illnesses (SMI).
County shall submit its RFA responses and required documentation specified in
DHCS’ RFA to receive MHBG funding. County shall complete its RFA responses in
accordance with the instructions, enclosures and attachments available on the
DHCS website at:
http://www.dhcs.ca.gov/services/MH/Pages/MHBG.aspx.
If County applied for and DHCS approved its request to receive MHBG grant funds,
the RFA, County’s RFA responses and required documentation, and DHCS’
approval constitute provisions of this Agreement and are incorporated by reference
herein. County shall comply with all provisions of the RFA and the County’s RFA
responses.
7.Data Information and Submission Requirements
County shall comply with all data and information submission requirements specified in this
Agreement
A.County shall provide all applicable data and information required by federal and/or State
law in order to receive any funds to pay for its MHSA programs, PATH grant (if the
County receives funds from this grant), MHBG grant (if the County receives funds from
this grant), or county provision of community mental health services provided with 1991
realignment funds (other than Medi-Cal). These federal and State laws include, Title 42
of the United States Code, sections 290cc-21 through 290cc-35 and 300x through 300x-
9, inclusive, Welfare & Institutions Code sections 5610 and 5664 and the regulations
that implement, interpret or make specific, these federal and State laws and any DHCS-
issued guidelines that relate to the programs or services.
B.County shall comply with DHCS reporting requirements related to the County’s receipt
of federal or State funding for mental health programs. County shall submit complete
and accurate information to DHCS, and as applicable the Mental Health Services
Oversight and Accountability Commission, including, but not limited, to the following:
1)Client and Service Information (CSI) System Data, as specified in Title 9 of
the California Code of Regulations, section 3530.10 (See subparagraph c of
this paragraph)
County of Fresno
17-94521
Page 12 of 16
Exhibit A
Program Specifications
ii.MHSA Quarterly Progress Reports, as specified in the California Code of
Regulations. Title 9, section 3530.20. MHSA Quarterly Progress Reports
provide the actual number of clients served by MHSA-funded program.
Reports are submitted on a quarterly basis.
iii. Full Service Partnership Performance Outcome data, as specified in the
California Code of Regulations, Title 9, section 3530.30.
iv. Consumer Perception Survey data, as specified in the California Code of
Regulations, Title 9, section 3530.40.
v.The Annual Mental Health Services Act Revenue and
Expenditure Report, as specified in Welfare and Institutions Code section
5899(a) and the California Code of Regulations, Title 9, sections 3510,
3510.010, and 3510.020 and DHCS-issued guidelines.
vi.Innovative Project Reports (annual, final and supplements), as specified in
the California Code of Regulations, Title 9, sections 3580 through 3580.02.
vii.The Annual Prevention and Early Intervention report, as specified in the
California Code of Regulations, Title 9, sections 3560 and 3560.010.
viii. Three Year Program and Evaluation Reports, as specified in the California
Code of Regulations, Title 9, sections 3560 and 3560.020.
C.County shall submit CSI data to DHCS, in accordance with Title 9 of the California Code
of Regulations, section 3530.10, and according to the specifications set for in DHCS’
CSI Data Dictionary, County shall:
i.Report monthly CSI data to DHCS within 60 calendar days after the end of
the month in which services were provided.
ii. Report within 60 calendar days or be in compliance with an approved plan of
correction to the DHCS’s CSI Unit.
iii. Make diligent efforts to minimize errors on the CSI error file.
iv. Notify DHCS 90 calendar days prior to any change in reporting system and/or
change of automated system vendor.
a.In the event that DHCS or County determines that, due to federal or state law
changes or business requirements, an amendment is needed of either County’s
or DHCS’ obligations under this contract relating to either DHCS’ or County’s
information needs both DHCS and County agree to provide notice to the other
party as soon as practicable prior to implementation. This notice shall include
information and comments regarding the anticipated requirements and impacts of
County of Fresno
17-94521
Page 13 of 16
Exhibit A
Program Specifications
the projected changes. DHCS and County agree to meet and discuss the
design, development, and costs of the anticipated changes prior to
implementation.
b.For all mental health funding sources received by County that require submission
of a cost report, County shall submit a fiscal year-end cost report by December
31 following the close of the fiscal year in accordance with applicable federal and
State law, regulations and DHCS-issued guidelines. (Welf. & Inst. Code § 5705;
Cal. Code Regs., tit. 9, §§ 3500, 3505.) The cost report shall be certified as true
and correct, and with respect to Mental Health Service Fund moneys, that the
County is in compliance with the California Code of Regulations, Title 9, section
3410, Non-Supplant. The certification must be completed by the mental health
director and one of the following: the County mental health departments chief
financial officer (or equivalent), and individual who has delegated authority to
sign for, and reports directly to the county mental health department’s chief
financial officer (or equivalent), or the county’s auditor-controller (or equivalent).
Data submitted shall be full and complete. The County shall also submit a
reconciled cost report certified by the mental health director and the county’s
auditor-controller as being true and correct no later than 18 months after the
close of the following fiscal year.
c.If applicable to a specific federal or state funding source covered by this
Agreement, County shall require each of its subcontractors to submit a fiscal
year-end cost report to DHCS no later than December 31 following the close of
the fiscal year, in accordance with applicable federal and state laws, regulations,
and DHCS-issued guidelines.
8.Special Terms and Conditions
A.Audit and Record Retention
(Applicable to agreements in excess of $10,000)
1)County and/or Subcontractor(s) shall maintain records, including books,,
documents, and other evidence, accounting procedures and practices, sufficient
to properly support all direct and indirect costs of whatever nature claimed to
have been incurred in the performance of this Agreement, including any
matching costs and expenses. The forgoing constitutes “records” for the purpose
of this provision.
2)County’s and/or Subcontractor’s facility or office or such part thereof as may be
engaged in the performance of this Agreement and his/her records shall be
subject at all reasonable times to inspection, audit, and reproduction.
3)County agrees that DHCS, the Department of General Services, the Bureau of
State Audits, or their designated representatives including the Comptroller
General of the United States shall have the right to review and copy any records
and supporting documentation pertaining to the performance of this Agreement.
County of Fresno
17-94521
Page 14 of 16
Exhibit A
Program Specifications
County agrees to allow the auditor(s) access to such records during normal
business hours and to allow interviews of any employees who might reasonably
have information related to such records. Further, County agrees to include a
similar right of the State to audit records and interview staff in any subcontract
related to performance of this Agreement.
4)County and/or Subcontractor(s) shall preserve and make available his/her
records (1) for a period of ten years from the date of final payment under this
Agreement, and (2) for such longer period, if any, as is required by applicable
statute, by any other provision of this Agreement, or by subparagraphs (a) or (b)
below.
a.If this Agreement is completely or partially terminated, the records
relating to the work terminated shall be preserved and made
available for a period of three years from the date of any resulting
final settlement.
b.If any litigation, claim, negotiation, audit, or other action involving
the records has been started before the expiration of the ten-year
period, the records shall be retained until completion of the action
and resolution of all issues which arise from it, or until the end of
the regular ten-year period, whichever is later.
5)County and/or Subcontractor(s) may, at its discretion, following receipt of final
payment under this Agreement, reduce its accounts, books, and records related
to this Agreement to microfilm, computer disk, CD ROM, DVD, or other data
storage medium. Upon request by an authorized representative to inspect, audit
or obtain copies of said records, County and/or Subcontractor(s) must supply or
make available applicable devices, hardware, and/or software necessary to view,
copy, and/or print said records. Applicable devices may include, but are not
limited to, microfilm readers and microfilm printers, etc.
6)County shall, if applicable, comply with the Single Audit Act and the audit
reporting requirements set forth in 2 Code of Regulations part 200.
B.Dispute Resolution Process for Projects for Assistance in Transition from Homelessness Program
Grant and Community Mental Health Services Grant Program
If a dispute arises between the Contractor and DHCS regarding Contractor
compliance with Section 6, of this Agreement, subsection B, Projects for Assistance
in Transition from Homelessness Program or subsection C, Community Mental
Health Services Grant Program, the Contractor must seek resolution using the
process outlined below.
1)The Contractor must first informally discuss the problem with the DHCS Project
Representative listed in paragraph 3. If the parties are unable to resolve the
problem informally, the Contractor must mail a written Statement of Dispute, with
supporting evidence, to DHCS at the address listed in paragraph 3 below. The
County of Fresno
17-94521
Page 15 of 16
Exhibit A
Program Specifications
Statement of Dispute must describe the issues in dispute, the legal authority or other
basis for the Contractor's position, and the remedy sought.
2)The Branch Chief of DHCS’ Mental Health Management and Outcomes Reporting
Branch will decide the dispute and mail a written decision to the Contractor within
twenty (20) working days of receiving the Statement of Dispute from the Contractor.
The decision will be in writing, resolve the dispute and include a statement of the
reasons for the decision that addresses each issue raised by the Contractor. If
applicable, the decision will also indicate any action Contractor must take to comply
with the decision. The Branch Chief’s decision shall be the final administrative
determination of DHCS.
3)Unless otherwise agreed to in writing by DHCS, the Statement of Dispute,
supporting documentation, and all correspondence and documents related to the
dispute resolution process shall be directed to the following:
Department of Health Care Services
Mental Health Services Division/Program Policy Unit
Attention: Guy Stewart
1500 Capitol Avenue, MS 2702
P.O. Box Number 997413
Sacramento, CA, 95899-7413
C.Novation
If County proposes any novation agreement, DHCS shall act upon the proposal
within 60 days after receipt of the written proposal. DHCS may review and consider
the proposal, consult and negotiate with County, and accept or reject all or part of
the proposal. Acceptance or rejection of the proposal may be made orally within the
60-day period and confirmed in writing within five days of said decision. Upon written
acceptance of the proposal, DHCS will initiate an amendment to this Agreement to
formally implement the approved proposal.
D.Laura’s Law
If County chooses to participate in the Assisted Outpatient Treatment program (AOT)
Demonstration Project Act of 2002 it shall be required to comply with all applicable statutes
including, but not limited to, Welfare and Institutions Code sections 5345 through 5349.5,
inclusive. In addition, County shall submit to DHCS any documents that DHCS requests as
part of its statutory responsibilities in accordance with DMH Letter No.: 03-01 dated March
20, 2003.
E.Welfare and Institutions Code section 5751.7 Waiver
1)County shall comply with Welfare and Institutions Code section 5751.7 and
ensure that minors are not admitted into inpatient psychiatric treatment with
adults. If this requirement creates undue hardship to County due to inadequate
County of Fresno
17-94521
Page 16 of 16
Exhibit A
Program Specifications
or unavailable alternative resources, County may request a waiver of this
requirement. County shall submit the waiver request on Attachment I of this
Agreement, to DHCS.
2)DHCS shall review County’s waiver request and provide a written notice of
approval or denial of the waiver. If County’s waiver request is denied, County
shall prohibit health facilities from admitting minors into psychiatric treatment
with adults.
3)County shall submit, the waiver request to DHCS at the time County submits
this Agreement, signed by County, to DHCS for execution. County shall
complete Attachment I, and attach it to this Agreement. See Exhibit A,
Attachment I, entitled “Request For Waiver” of this Agreement for additional
submission information.
Execution of this Agreement by DHCS shall not constitute approval of a waiver
submitted pursuant to this section.
Any waiver granted in the prior fiscal year’s Agreement shall be deemed to
continue until either party chooses to discontinue it, as specified in Exhibit A,
Attachment I. Execution of this Agreement shall continue independently of the
waiver review and approval process.
4)In unusual or emergency circumstances, when County needs to request waivers
after the annual Performance Contract has been executed, these requests
should be sent immediately to: Licensing and Certification Section, Program
Oversight and Compliance Branch, California Department of Health Care
Services, P.O. Box 997413, MS 2800, Sacramento, CA 95899-7413, telephone:
(916)323-1864.
5)Each admission of a minor to a facility that has an approved waiver shall be
reported to the Local Mental Health Director.
F.Americans with Disabilities Act
Contractor agrees to ensure that deliverables developed and produced, pursuant to
this Agreement shall comply with the accessibility requirements of Section 508 of the
Rehabilitation Act and the Americans with Disabilities Act of 1973 as amended (29
U.S.C. § 794 (d)), and regulations implementing that Act as set forth in Part 1194 of
Title 36 of the Code of Federal Regulations. In 1998, Congress amended the
Rehabilitation Act of 1973 to require Federal agencies to make their electronic and
information technology (EIT) accessible to people with disabilities. California
Government Code section 11135 codifies section 508 of the Act requiring
accessibility of electronic and information technology.
County of Fresno
17-94521
Page 1 of 1
Exhibit A, Attachment I
Request for Waiver
Request for Waiver Pursuant To Section 5751.7 of the Welfare and Institutions Code
_______________________________ hereby requests a waiver for the following public or private
health facilities pursuant to section 5751.7 of the Welfare and Institutions Code for the term of this
contract. These are facilities where minors may be provided psychiatric treatment with
nonspecific separate housing arrangements, treatment staff, and treatment programs designed to
serve minors. However, no minor shall be admitted for psychiatric treatment into the same
treatment ward as an adult receiving treatment who is in the custody of any jailor for a violent
crime, is a known registered sex offender, or has a known history of, or exhibits inappropriate
sexual or other violent behavior which would present a threat to the physical safety of others.
The request for waiver must include, as an attachment, the following:
1.A description of the hardship to the County/City due to inadequate or unavailable alternative
resources that would be caused by compliance with the state policy regarding the provision of
psychiatric treatment to minors.
2.The specific treatment protocols and administrative procedures established by the
County/City for identifying and providing appropriate treatment to minors admitted with adults.
3. Name, address, and telephone number of the facility
•Number of the facility’s beds designated for involuntary treatment
•Type of facility, license(s), and certification(s) held (including licensing and certifying agency
and license and certificate number)
•A copy of the facility’s current license or certificate and description of the program, including
target population and age groups to be admitted to the designated facility.
4.If applicable, the County Board of Supervisors’ decision to designate a facility as a facility for
evaluation and treatment pursuant to Welfare and Institutions Code sections 5150, 5585.50,
and 5585.55.
To rescind the a waiver, either party shall send a letter to the other party on official letterhead
signed by their respective Behavioral Health Director or his or her designee indicating that the
party no longer grants or requests a waiver. If not otherwise specified by the party in the letter to
the respective party, the discontinuance shall be effective the date the letter to the party is
postmarked and the facility shall no longer be waivered as of this date.
When the Department denies or rescinds a waiver issued to a County, the facility and the County
Behavioral Health Director or designee shall receive written notification from the Department, by
certified mail or e-mail. The notice shall include the decision, the basis for the decision, and any
supporting documentation.
NOT APPLICABLE
County of Fresno
17-94521
Page 1of 1
Exhibit B
Funds Provision
1. Budget Contingency Clause
A. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years
covered under this Agreement does not appropriate sufficient funds for the program, this
Agreement shall be of no further force and effect. In this event, DHCS shall have no liability to
pay any funds whatsoever to County of Fresno or to furnish any other considerations under this
Agreement and County of Fresno shall not be obligated to perform any provisions of this
Agreement.
B. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this
program, DHCS shall have the option to either cancel this Agreement with no liability occurring
to DHCS, or offer an agreement amendment to County of Fresno to reflect the reduced amount.
Page 1 of 5
GTC 04/2017
EXHIBIT C
GENERAL TERMS AND CONDITIONS
1. APPROVAL: This Agreement is of no force or effect until signed by both parties and
approved by the Department of General Services, if required. Contractor may not commence
performance until such approval has been obtained.
2. AMENDMENT: No amendment or variation of the terms of this Agreement shall be valid
unless made in writing, signed by the parties and approved as required. No oral understanding or
Agreement not incorporated in the Agreement is binding on any of the parties.
3. ASSIGNMENT: This Agreement is not assignable by the Contractor, either in whole or in
part, without the consent of the State in the form of a formal written amendment.
4. AUDIT: Contractor agrees that the awarding department, the Department of General Services,
the Bureau of State Audits, or their designated representative shall have the right to review and
to copy any records and supporting documentation pertaining to the performance of this
Agreement. Contractor agrees to maintain such records for possible audit for a minimum of three
(3) years after final payment, unless a longer period of records retention is stipulated. Contractor
agrees to allow the auditor(s) access to such records during normal business hours and to allow
interviews of any employees who might reasonably have information related to such records.
Further, Contractor agrees to include a similar right of the State to audit records and interview
staff in any subcontract related to performance of this Agreement. (Gov. Code §8546.7, Pub.
Contract Code §10115 et seq., CCR Title 2, Section 1896).
5. INDEMNIFICATION: Contractor agrees to indemnify, defend and save harmless the State, its
officers, agents and employees from any and all claims and losses accruing or resulting to any
and all contractors, subcontractors, suppliers, laborers, and any other person, firm or corporation
furnishing or supplying work services, materials, or supplies in connection with the performance
of this Agreement, and from any and all claims and losses accruing or resulting to any person,
firm or corporation who may be injured or damaged by Contractor in the performance of this
Agreement.
6. DISPUTES: Contractor shall continue with the responsibilities under this Agreement during
any dispute.
7. TERMINATION FOR CAUSE: The State may terminate this Agreement and be relieved of
any payments should the Contractor fail to perform the requirements of this Agreement at the
time and in the manner herein provided. In the event of such termination the State may proceed
with the work in any manner deemed proper by the State. All costs to the State shall be deducted
from any sum due the Contractor under this Agreement and the balance, if any, shall be paid to
the Contractor upon demand.
Page 2 of 5
8. INDEPENDENT CONTRACTOR: Contractor, and the agents and employees of Contractor,
in the performance of this Agreement, shall act in an independent capacity and not as officers or
employees or agents of the State.
9. RECYCLING CERTIFICATION: The Contractor shall certify in writing under penalty of
perjury, the minimum, if not exact, percentage of post consumer material as defined in the Public
Contract Code Section 12200, in products, materials, goods, or supplies offered or sold to the
State regardless of whether the product meets the requirements of Public Contract Code Section
12209. With respect to printer or duplication cartridges that comply with the requirements of
Section 12156(e), the certification required by this subdivision shall specify that the cartridges so
comply (Pub. Contract Code §12205).
10. NON-DISCRIMINATION CLAUSE: During the performance of this Agreement, Contractor
and its subcontractors shall not deny the contract’s benefits to any person on the basis of race,
religious creed, color, national origin, ancestry, physical disability, mental disability, medical
condition, genetic information, marital status, sex, gender, gender identity, gender expression,
age, sexual orientation, or military and veteran status, nor shall they discriminate unlawfully
against any employee or applicant for employment because of race, religious creed, color,
national origin, ancestry, physical disability, mental disability, medical condition, genetic
information, marital status, sex, gender, gender identity, gender expression, age, sexual
orientation, or military and veteran status. Contractor shall insure that the evaluation and
treatment of employees and applicants for employment are free of such discrimination.
Contractor and subcontractors shall comply with the provisions of the Fair Employment and
Housing Act (Gov. Code §12900 et seq.), the regulations promulgated thereunder (Cal. Code
Regs., tit. 2, §11000 et seq.), the provisions of Article 9.5, Chapter 1, Part 1, Division 3, Title 2
of the Government Code (Gov. Code §§11135-11139.5), and the regulations or standards
adopted by the awarding state agency to implement such article. Contractor shall permit access
by representatives of the Department of Fair Employment and Housing and the awarding state
agency upon reasonable notice at any time during the normal business hours, but in no case less
than 24 hours’ notice, to such of its books, records, accounts, and all other sources of information
and its facilities as said Department or Agency shall require to ascertain compliance with this
clause. Contractor and its subcontractors shall give written notice of their obligations under this
clause to labor organizations with which they have a collective bargaining or other agreement.
(See Cal. Code Regs., tit. 2, §11105.)
Contractor shall include the nondiscrimination and compliance provisions of this clause in all
subcontracts to perform work under the Agreement.
11. CERTIFICATION CLAUSES: The CONTRACTOR CERTIFICATION CLAUSES
contained in the document CCC 04/2017 are hereby incorporated by reference and made a part
of this Agreement by this reference as if attached hereto.
12. TIMELINESS: Time is of the essence in this Agreement.
Page 3 of 5
13. COMPENSATION: The consideration to be paid Contractor, as provided herein, shall be in
compensation for all of Contractor's expenses incurred in the performance hereof, including
travel, per diem, and taxes, unless otherwise expressly so provided.
14. GOVERNING LAW: This contract is governed by and shall be interpreted in accordance
with the laws of the State of California.
15. ANTITRUST CLAIMS: The Contractor by signing this agreement hereby certifies that if
these services or goods are obtained by means of a competitive bid, the Contractor shall comply
with the requirements of the Government Codes Sections set out below.
a. The Government Code Chapter on Antitrust claims contains the following definitions:
1) "Public purchase" means a purchase by means of competitive bids of goods, services, or
materials by the State or any of its political subdivisions or public agencies on whose behalf the
Attorney General may bring an action pursuant to subdivision (c) of Section 16750 of the
Business and Professions Code.
2) "Public purchasing body" means the State or the subdivision or agency making a public
purchase. Government Code Section 4550.
b. In submitting a bid to a public purchasing body, the bidder offers and agrees that if the bid is
accepted, it will assign to the purchasing body all rights, title, and interest in and to all causes of
action it may have under Section 4 of the Clayton Act (15 U.S.C. Sec. 15) or under the
Cartwright Act (Chapter 2 (commencing with Section 16700) of Part 2 of Division 7 of the
Business and Professions Code), arising from purchases of goods, materials, or services by the
bidder for sale to the purchasing body pursuant to the bid. Such assignment shall be made and
become effective at the time the purchasing body tenders final payment to the bidder.
Government Code Section 4552.
c. If an awarding body or public purchasing body receives, either through judgment or
settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor
shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand,
recover from the public body any portion of the recovery, including treble damages, attributable
to overcharges that were paid by the assignor but were not paid by the public body as part of the
bid price, less the expenses incurred in obtaining that portion of the recovery. Government Code
Section 4553.
d. Upon demand in writing by the assignor, the assignee shall, within one year from such
demand, reassign the cause of action assigned under this part if the assignor has been or may
have been injured by the violation of law for which the cause of action arose and (a) the assignee
has not been injured thereby, or (b) the assignee declines to file a court action for the cause of
action. See Government Code Section 4554.
Page 4 of 5
16. CHILD SUPPORT COMPLIANCE ACT: For any Agreement in excess of $100,000, the
contractor acknowledges in accordance with Public Contract Code 7110, that:
a. The contractor recognizes the importance of child and family support obligations and shall
fully comply with all applicable state and federal laws relating to child and family support
enforcement, including, but not limited to, disclosure of information and compliance with
earnings assignment orders, as provided in Chapter 8 (commencing with section 5200) of Part 5
of Division 9 of the Family Code; and
b. The contractor, to the best of its knowledge is fully complying with the earnings assignment
orders of all employees and is providing the names of all new employees to the New Hire
Registry maintained by the California Employment Development Department.
17. UNENFORCEABLE PROVISION: In the event that any provision of this Agreement is
unenforceable or held to be unenforceable, then the parties agree that all other provisions of this
Agreement have force and effect and shall not be affected thereby.
18. PRIORITY HIRING CONSIDERATIONS: If this Contract includes services in excess of
$200,000, the Contractor shall give priority consideration in filling vacancies in positions funded
by the Contract to qualified recipients of aid under Welfare and Institutions Code Section 11200
in accordance with Pub. Contract Code §10353.
19. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING
REQUIREMENTS:
a. If for this Contract Contractor made a commitment to achieve small business participation,
then Contractor must within 60 days of receiving final payment under this Contract (or within
such other time period as may be specified elsewhere in this Contract) report to the awarding
department the actual percentage of small business participation that was achieved. (Govt. Code
§ 14841.)
b. If for this Contract Contractor made a commitment to achieve disabled veteran business
enterprise (DVBE) participation, then Contractor must within 60 days of receiving final payment
under this Contract (or within such other time period as may be specified elsewhere in this
Contract) certify in a report to the awarding department: (1) the total amount the prime
Contractor received under the Contract; (2) the name and address of the DVBE(s) that
participated in the performance of the Contract; (3) the amount each DVBE received from the
prime Contractor; (4) that all payments under the Contract have been made to the DVBE; and (5)
the actual percentage of DVBE participation that was achieved. A person or entity that
knowingly provides false information shall be subject to a civil penalty for each violation. (Mil.
& Vets. Code § 999.5(d); Govt. Code § 14841.)
Page 5 of 5
20. LOSS LEADER:
If this contract involves the furnishing of equipment, materials, or supplies then the following
statement is incorporated: It is unlawful for any person engaged in business within this state to
sell or use any article or product as a “loss leader” as defined in Section 17030 of the Business
and Professions Code. (PCC 10344(e).)
County of Fresno
17-94521
Page 1 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
1.Definitions. For purposes of this Exhibit, the following definitions shall apply:
A.Public Information: Information that is not exempt from disclosure under the provisions of the
California Public Records Act (Government Code sections 6250-6265) or other applicable state or
federal laws.
B.Confidential Information: Information that is exempt from disclosure under the provisions of the
California Public Records Act (Government Code sections 6250-6265) or other applicable state or
federal laws.
C.Sensitive Information: Information that requires special precautions to protect from unauthorized
use, access, disclosure, modification, loss, or deletion. Sensitive Information may be either Public
Information or Confidential Information. It is information that requires a higher than normal
assurance of accuracy and completeness. Thus, the key factor for Sensitive Information is that of
integrity. Typically, Sensitive Information includes records of agency financial transactions and
regulatory actions.
D.Personal Information: Information that identifies or describes an individual, including, but not
limited to, their name, social security number, physical description, home address, home telephone
number, education, financial matters, and medical or employment history. It is DHCS’ policy to
consider all information about individuals private unless such information is determined to
be a public record. This information must be protected from inappropriate access, use, or
disclosure and must be made accessible to data subjects upon request. Personal Information
includes the following:
Notice-triggering Personal Information: Specific items of personal information (name plus Social
Security number, driver license/California identification card number, or financial account number)
that may trigger a requirement to notify individuals if it is acquired by an unauthorized person. For
purposes of this provision, identity shall include, but not be limited to name, identifying number,
symbol, or other identifying particular assigned to the individual, such as finger or voice print or a
photograph. See Civil Code sections 1798.29 and 1798.82.
2.Nondisclosure. The Contractor and its employees, agents, or subcontractors shall protect from
unauthorized disclosure any Personal Information, Sensitive Information, or Confidential Information
(hereinafter identified as PSCI).
3.The Contractor and its employees, agents, or subcontractors shall not use any PSCI for any purpose
other than carrying out the Contractor's obligations under this Agreement.
4.The Contractor and its employees, agents, or subcontractors shall promptly transmit to the DHCS
Program Contract Manager all requests for disclosure of any PSCI not emanating from the person who
is the subject of PSCI.
5.The Contractor shall not disclose, except as otherwise specifically permitted by this Agreement or
authorized by the person who is the subject of PSCI, any PSCI to anyone other than DHCS without
prior written authorization from the DHCS Program Contract Manager, except if disclosure is required
by State or Federal law.
County of Fresno
17-94521
Page 2 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
6.The Contractor shall observe the following requirements:
A.Safeguards. The Contractor shall implement administrative, physical, and technical safeguards
that reasonably and appropriately protect the confidentiality, integrity, and availability of the PSCI,
including electronic PSCI that it creates, receives, maintains, uses, or transmits on behalf of DHCS.
Contractor shall develop and maintain a written information privacy and security program that
includes administrative, technical and physical safeguards appropriate to the size and complexity of
the Contractor’s operations and the nature and scope of its activities, Including at a minimum the
following safeguards:
1)Personnel Controls
a.Employee Training. All workforce members who assist in the performance of functions or
activities on behalf of DHCS, or access or disclose DHCS PSCI, must complete information
privacy and security training, at least annually, at Business Associate’s expense. Each
workforce member who receives information privacy and security training must sign a
certification, indicating the member’s name and the date on which the training was
completed. These certifications must be retained for a period of six (6) years following
contract termination.
b.Employee Discipline. Appropriate sanctions must be applied against workforce members
who fail to comply with privacy policies and procedures or any provisions of these
requirements, including termination of employment where appropriate.
c.Confidentiality Statement. All persons that will be working with DHCS PSCI must sign a
confidentiality statement that includes, at a minimum, General Use, Security and Privacy
Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed
by the workforce member prior to access to DHCS PSCI. The statement must be renewed
annually. The Contractor shall retain each person’s written confidentiality statement for
DHCS inspection for a period of six (6) years following contract termination.
d.Background Check. Before a member of the workforce may access DHCS PSCI, a
thorough background check of that worker must be conducted, with evaluation of the results
to assure that there is no indication that the worker may present a risk to the security or
integrity of confidential data or a risk for theft or misuse of confidential data. The Contractor
shall retain each workforce member’s background check documentation for a period of three
(3) years following contract termination.
2)Technical Security Controls
a.Workstation/Laptop encryption. All workstations and laptops that process and/or store
DHCS PSCI must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or
higher, such as Advanced Encryption Standard (AES). The encryption solution must be full
disk unless approved by the DHCS Information Security Office.
b.Server Security. Servers containing unencrypted DHCS PSCI must have sufficient
administrative, physical, and technical controls in place to protect that data, based upon a
risk assessment/system security review.
County of Fresno
17-94521
Page 3 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
c.Minimum Necessary. Only the minimum necessary amount of DHCS PSCI required to
perform necessary business functions may be copied, downloaded, or exported.
d.Removable media devices. All electronic files that contain DHCS PSCI data must be
encrypted when stored on any removable media or portable device (i.e. USB thumb drives,
floppies, CD/DVD, smartphones, backup tapes etc.). Encryption must be a FIPS 140-2
certified algorithm which is 128bit or higher, such as AES.
e.Antivirus software. All workstations, laptops and other systems that process and/or store
DHCS PSCI must install and actively use comprehensive anti-virus software solution with
automatic updates scheduled at least daily.
f.Patch Management. All workstations, laptops and other systems that process and/or store
DHCS PSCI must have critical security patches applied, with system reboot if necessary.
There must be a documented patch management process which determines installation
timeframe based on risk assessment and vendor recommendations. At a maximum, all
applicable patches must be installed within 30 days of vendor release.
g.User IDs and Password Controls. All users must be issued a unique user name for
accessing DHCS PSCI. Username must be promptly disabled, deleted, or the password
changed upon the transfer or termination of an employee with knowledge of the password,
at maximum within 24 hours. Passwords are not to be shared. Passwords must be at least
eight characters and must be a non-dictionary word. Passwords must not be stored in
readable format on the computer. Passwords must be changed every 90 days, preferably
every 60 days. Passwords must be changed if revealed or compromised. Passwords must
be composed of characters from at least three of the following four groups from the standard
keyboard:
•Upper case letters (A-Z)
•Lower case letters (a-z)
•Arabic numerals (0-9)
•Non-alphanumeric characters (punctuation symbols)
h.Data Destruction. When no longer needed, all DHCS PSCI must be cleared, purged, or
destroyed consistent with NIST Special Publication 800-88, Guidelines for Media
Sanitization such that the PSCI cannot be retrieved.
i.System Timeout. The system providing access to DHCS PSCI must provide an automatic
timeout, requiring re-authentication of the user session after no more than 20 minutes of
inactivity.
j.Warning Banners. All systems providing access to DHCS PSCI must display a warning
banner stating that data is confidential, systems are logged, and system use is for business
purposes only by authorized users. User must be directed to log off the system if they do
not agree with these requirements.
k.System Logging. The system must maintain an automated audit trail which can identify
the user or system process which initiates a request for DHCS PSCI, or which alters DHCS
PSCI. The audit trail must be date and time stamped, must log both successful and failed
accesses, must be read only, and must be restricted to authorized users. If DHCS PSCI is
County of Fresno
17-94521
Page 4 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
stored in a database, database logging functionality must be enabled. Audit trail data must
be archived for at least 3 years after occurrence.
l.Access Controls. The system providing access to DHCS PSCI must use role based access
controls for all user authentications, enforcing the principle of least privilege.
m.Transmission encryption. All data transmissions of DHCS PSCI outside the secure
internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or
higher, such as AES. Encryption can be end to end at the network level, or the data files
containing PSCI can be encrypted. This requirement pertains to any type of PSCI in motion
such as website access, file transfer, and E-Mail.
n.Intrusion Detection. All systems involved in accessing, holding, transporting, and
protecting DHCS PSCI that are accessible via the Internet must be protected by a
comprehensive intrusion detection and prevention solution.
3)Audit Controls
a.System Security Review. All systems processing and/or storing DHCS PSCI must have at
least an annual system risk assessment/security review which provides assurance that
administrative, physical, and technical controls are functioning effectively and providing
adequate levels of protection. Reviews should include vulnerability scanning tools.
b.Log Reviews. All systems processing and/or storing DHCS PSCI must have a routine
procedure in place to review system logs for unauthorized access.
c.Change Control. All systems processing and/or storing DHCS PSCI must have a
documented change control procedure that ensures separation of duties and protects the
confidentiality, integrity and availability of data.
4)Business Continuity / Disaster Recovery Controls
a.Emergency Mode Operation Plan. Contractor must establish a documented plan to enable
continuation of critical business processes and protection of the security of electronic DHCS
PSCI in the event of an emergency. Emergency means any circumstance or situation that
causes normal computer operations to become unavailable for use in performing the work
required under this Agreement for more than 24 hours.
b.Data Backup Plan. Contractor must have established documented procedures to backup
DHCS PSCI to maintain retrievable exact copies of DHCS PSCI. The plan must include a
regular schedule for making backups, storing backups offsite, an inventory of backup media,
and an estimate of the amount of time needed to restore DHCS PSCI should it be lost. At a
minimum, the schedule must be a weekly full backup and monthly offsite storage of DHCS
data.
5)Paper Document Controls
a.Supervision of Data. DHCS PSCI in paper form shall not be left unattended at any time,
unless it is locked in a file cabinet, file room, desk or office. Unattended means that
information is not being observed by an employee authorized to access the information.
County of Fresno
17-94521
Page 5 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
DHCS PSCI in paper form shall not be left unattended at any time in vehicles or planes and
shall not be checked in baggage on commercial airplanes.
b.Escorting Visitors. Visitors to areas where DHCS PSCI is contained shall be escorted and
DHCS PSCI shall be kept out of sight while visitors are in the area.
c.Confidential Destruction. DHCS PSCI must be disposed of through confidential means,
such as cross cut shredding and pulverizing.
d.Removal of Data. DHCS PSCI must not be removed from the premises of the Contractor
except with express written permission of DHCS.
e.Faxing. Faxes containing DHCS PSCI shall not be left unattended and fax machines shall
be in secure areas. Faxes shall contain a confidentiality statement notifying persons
receiving faxes in error to destroy them. Fax numbers shall be verified with the intended
recipient before sending the fax.
f.Mailing. Mailings of DHCS PSCI shall be sealed and secured from damage or inappropriate
viewing of PSCI to the extent possible. Mailings which include 500 or more individually
identifiable records of DHCS PSCI in a single package shall be sent using a tracked mailing
method which includes verification of delivery and receipt, unless the prior written permission
of DHCS to use another method is obtained.
B.Security Officer. The Contractor shall designate a Security Officer to oversee its data security
program who will be responsible for carrying out its privacy and security programs and for
communicating on security matters with DHCS.
Discovery and Notification of Breach. Notice to DHCS:
(1)To notify DHCS immediately upon the discovery of a suspected security incident that involves
data provided to DHCS by the Social Security Administration. This notification will be by
telephone call plus email or fax upon the discovery of the breach. (2) To notify DHCS within
24 hours by email or fax of the discovery of unsecured PSCI in electronic media or in any
other media if the PSCI was, or is reasonably believed to have been, accessed or acquired by
an unauthorized person, any suspected security incident, intrusion or unauthorized access, use
or disclosure of PSCI in violation of this Agreement and this Addendum, or potential loss of
confidential data affecting this Agreement. A breach shall be treated as discovered by the
contractor as of the first day on which the breach is known, or by exercising reasonable diligence
would have been known, to any person (other than the person committing the breach) who is
an employee, officer or other agent of the contractor..
Notice shall be provided to the DHCS Program Contract Manager, the DHCS Privacy Officer
and the DHCS Information Security Officer. If the incident occurs after business hours or on a
weekend or holiday and involves data provided to DHCS by the Social Security Administration,
notice shall be provided by calling the DHCS EITS Service Desk. Notice shall be made using
the “DHCS Privacy Incident Report” form, including all information known at the time. The
contractor shall use the most current version of this form, which is posted on the DHCS Privacy
Office website (www.dhcs.ca.gov, then select “Privacy” in the left column and then “Business
Use” near the middle of the page) or use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DHCSBusinessAssociatesOnly.aspx
County of Fresno
17-94521
Page 6 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
C.Upon discovery of a breach or suspected security incident, intrusion or unauthorized access, use or
disclosure of PSCI, the Contractor shall take:
1)Prompt corrective action to mitigate any risks or damages involved with the breach and to protect
the operating environment and
2)Any action pertaining to such unauthorized disclosure required by applicable Federal and State
laws and regulations.
D.Investigation of Breach. The Contractor shall immediately investigate such security incident,
breach, or unauthorized use or disclosure of PSCI. If the initial report did not include all of the
requested information marked with an asterisk, then within seventy-two (72) hours of the discovery,
The Contractor shall submit an updated “DHCS Privacy Incident Report” containing the information
marked with an asterisk and all other applicable information listed on the form, to the extent known
at that time, to the DHCS Program Contract Manager, the DHCS Privacy Officer, and the DHCS
Information Security Officer:
E.Written Report. The Contractor shall provide a written report of the investigation to the DHCS
Program Contract Manager, the DHCS Privacy Officer, and the DHCS Information Security Officer,
if all of the required information was not included in the DHCS Privacy Incident Report, within ten
(10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall
include, but not be limited to, the information specified above, as well as a full, detailed corrective
action plan, including information on measures that were taken to halt and/or contain the improper
use or disclosure.
F.Notification of Individuals. The Contractor shall notify individuals of the breach or unauthorized
use or disclosure when notification is required under state or federal law and shall pay any costs of
such notifications, as well as any costs associated with the breach. The DHCS Program Contract
Manager, the DHCS Privacy Officer, and the DHCS Information Security Officer shall approve the
time, manner and content of any such notifications.
7.Affect on lower tier transactions. The terms of this Exhibit shall apply to all contracts, subcontracts,
and subawards, regardless of whether they are for the acquisition of services, goods, or commodities.
The Contractor shall incorporate the contents of this Exhibit into each subcontract or subaward to its
agents, subcontractors, or independent consultants.
8.Contact Information. To direct communications to the above referenced DHCS staff, the Contractor
shall initiate contact as indicated herein. DHCS reserves the right to make changes to the contact
information below by giving written notice to the Contractor. Said changes shall not require an
amendment to this Exhibit or the Agreement to which it is incorporated.
DHCS Program Contract
Manager
DHCS Privacy Officer DHCS Information Security Officer
County of Fresno
17-94521
Page 7 of 7
Exhibit D
Information Confidentiality and Security Requirements
DHCS ICSR 2/17
See the Scope of Work
exhibit for Program
Contract Manager
information
Privacy Officer
c/o Office of Legal Services
Department of Health Care Services
P.O. Box 997413, MS 0011
Sacramento, CA 95899-7413
Email: privacyofficer@dhcs.ca.gov
Telephone: (916) 445-4646
Information Security Officer
DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Help Desk
(916) 440-7000 or
(800) 579-0874
9.Audits and Inspections. From time to time, DHCS may inspect the facilities, systems, books and
records of the Contractor to monitor compliance with the safeguards required in the Information
Confidentiality and Security Requirements (ICSR) exhibit. Contractor shall promptly remedy any
violation of any provision of this ICSR exhibit. The fact that DHCS inspects, or fails to inspect, or has
the right to inspect, Contractor’s facilities, systems and procedures does not relieve Contractor of its
responsibility to comply with this ICSR exhibit.
County of Fresno
17-94521
Page 1 of 31
EXHIBIT E
PRIVACY AND INFORMATION SECURITY PROVISIONS
This Exhibit E is intended to protect the privacy and security of specified Department
information that Contractor may access, receive, or transmit under this Agreement. The
Department information covered under this Exhibit E consists of: (1) Protected Health
Information as defined under the Health Insurance Portability and Accountability Act of
1996, Public Law 104-191 (“HIPAA”)(PHI): and (2) Personal Information (PI) as defined
under the California Information Practices Act (CIPA), at California Civil Code Section
1798.3. Personal Information may include data provided to the Department by the
Social Security Administration.
Exhibit E consists of the following parts:
1. Exhibit E-1, HIPAA Business Associate Addendum, which provides for the
privacy and security of PHI.
2. Exhibit E-2, which provides for the privacy and security of PI in accordance with
specified provisions of the Agreement between the Department and the Social
Security Administration, known as the Information Exchange Agreement (IEA)
and the Computer Matching and Privacy Protection Act Agreement between the
Social Security Administration and the California Health and Human Services
Agency (Computer Agreement) to the extent Contractor access, receives, or
transmits PI under these Agreements. Exhibit E-2 further provides for the privacy
and security of PI under Civil Code Section 1798.3(a) and 1798.29.
3. Exhibit E-3, Miscellaneous Provision, sets forth additional terms and conditions
that extend to the provisions of Exhibit E in its entirety.
County of Fresno
17-94521
Page 2 of 31
EXHIBIT E-1
HIPAA Business Associate Addendum
1. Recitals.
A. A business associate relationship under the Health Insurance Portability
and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), the
Health Information Technology for Economic and Clinical Health Act,
Public Law 111-005 (”the HITECH Act"), 42 U.S.C. Section 17921 et
seq., and their implementing privacy and security regulations at 45 CFR
Parts 160 and 164 (“the HIPAA regulations”) between Department and
Contractor arises only to the extent that Contractor creates, receives,
maintains, transmits, uses or discloses PHI or ePHI on the Department’s
behalf, or provides services, arranges, performs or assists in the
performance of functions or activities on behalf of the Department that
are included in the definition of “business associate” in 45 C.F.R.
160.103 where the provision of the service involves the disclosure of
PHI or ePHI from the Department, including but not limited to, utilization
review, quality assurance, or benefit management. To the extent
Contractor performs these services, functions, and activities on behalf of
Department, Contractor is the Business Associate of the Department,
acting on the Department's behalf. The Department and Contractor are
each a party to this Agreement and are collectively referred to as the
"parties.”
B. The Department wishes to disclose to Contractor certain information
pursuant to the terms of this Agreement, some of which may constitute
Protected Health Information (“PHI”), including protected health
information in electronic media (“ePHI”), under federal law, to be used
or disclosed in the course of providing services and activities as set
forth in Section 1.A. of Exhibit E-1 of this Agreement. This information
is hereafter referred to as “Department PHI”.
C. The purpose of this Exhibit E-1 is to protect the privacy and security of
the PHI and ePHI that may be created, received, maintained,
transmitted, used or disclosed pursuant to this Agreement, and to
comply with certain standards and requirements of HIPAA, the HITECH
Act, and the HIPAA regulations, including, but not limited to, the
requirement that the Department must enter into a contract containing
specific requirements with Contractor prior to the disclosure of PHI to
Contractor, as set forth in 45 CFR Parts 160 and 164 and the HITECH
County of Fresno
17-94521
Page 3 of 31
Act. To the extent that data is both PHI or ePHI and Personally
Identifying Information, both Exhibit E-2 (including Attachment B, the
SSA Agreement between SSA, CHHS and DHCS, referred to in Exhibit
E-2) and this Exhibit E-1 shall apply.
D. The terms used in this Exhibit E-1, but not otherwise defined, shall have
the same meanings as those terms have in the HIPAA regulations. Any
reference to statutory or regulatory language shall be to such language
as in effect or as amended.
2. Definitions.
A. Breach shall have the meaning given to such term under HIPAA,
the HITECH Act, and the HIPAA regulations.
B. Business Associate shall have the meaning given to such term under
HIPAA, the HITECH Act, and the HIPAA regulations.
C. Covered Entity shall have the meaning given to such term under
HIPAA, the HITECH Act, and the HIPAA regulations.
D. Department PHI shall mean Protected Health Information or Electronic
Protected Health Information, as defined below, accessed by Contractor
in a database maintained by the Department, received by Contractor
from the Department or acquired or created by Contractor in connection
with performing the functions, activities and services on behalf of the
Department as specified in Section 1.A. of Exhibit E-1 of this Agreement.
The terms PHI as used in this document shall mean Department PHI.
E. Electronic Health Records shall have the meaning given to such term in
the HITECH Act, including, but not limited to, 42 U.S.C. Section 17921
and implementing regulations.
F. Electronic Protected Health Information (ePHI) means individually
identifiable health information transmitted by electronic media or
maintained in electronic media, including but not limited to
electronic media as set forth under 45 CFR section 160.103.
G. Individually Identifiable Health Information means health information,
including demographic information collected from an individual, that is
created or received by a health care provider, health plan, employer or
health care clearinghouse, and relates to the past, present or future
physical or mental health or condition of an individual, the provision of
health care to an individual, or the past, present, or future payment for
the provision of health care to an individual, that identifies the individual
County of Fresno
17-94521
Page 4 of 31
or where there is a reasonable basis to believe the information can be
used to identify the individual, as set forth under 45 CFR Section
160.103.
H. Privacy Rule shall mean the HIPAA Regulations that are found at 45 CFR
Parts 160 and 164, subparts A and E.
I. Protected Health Information (PHI) means individually identifiable
health information that is transmitted by electronic media, maintained in
electronic media, or is transmitted or maintained in any other form or
medium, as set forth under 45 CFR Section 160.103 and as defined
under HIPAA.
J. Required by law, as set forth under 45 CFR Section 164.103, means a
mandate contained in law that compels an entity to make a use or
disclosure of PHI that is enforceable in a court of law. This includes, but is
not limited to, court orders and court-ordered warrants, subpoenas or
summons issued by a court, grand jury, a governmental or tribal inspector
general, or an administrative body authorized to require the production of
information, and a civil or an authorized investigative demand. It also
includes Medicare conditions of participation with respect to health care
providers participating in the program, and statutes or regulations that
require the production of information, including statutes or regulations that
require such information if payment is sought under a government
program providing public benefits.
K. Secretary means the Secretary of the U.S. Department of Health and
Human Services ("HHS") or the Secretary's designee.
L. Security Incident means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of Department PHI,
or confidential data utilized by Contractor to perform the services,
functions and activities on behalf of Department as set forth in Section
1.A. of Exhibit E-1 of this Agreement; or interference with system
operations in an information system that processes, maintains or stores
Department PHI.
M. Security Rule shall mean the HIPAA regulations that are found at 45 CFR
Parts 160 and 164.
N. Unsecured PHI shall have the meaning given to such term under the
HITECH Act, 42 U.S.C. Section 17932(h), any guidance issued by the
Secretary pursuant to such Act and the HIPAA regulations.
3. Terms of Agreement.
County of Fresno
17-94521
Page 5 of 31
A. Permitted Uses and Disclosures of Department PHI by Contractor.
Except as otherwise indicated in this Exhibit E-1, Contractor may use or
disclose Department PHI only to perform functions, activities or services
specified in Section 1.A of Exhibit E-1 of this Agreement, for, or on behalf
of the Department, provided that such use or disclosure would not violate
the HIPAA regulations or the limitations set forth in 42 CFR Part 2, or any
other applicable law, if done by the Department. Any such use or
disclosure, if not for purposes of treatment activities of a health care
provider as defined by the Privacy Rule, must, to the extent practicable, be
limited to the limited data set, as defined in 45 CFR Section 164.514(e)(2),
or, if needed, to the minimum necessary to accomplish the intended
purpose of such use or disclosure, in compliance with the HITECH Act
and any guidance issued pursuant to such Act, and the HIPAA
regulations.
B. Specific Use and Disclosure Provisions. Except as otherwise indicated in
this Exhibit E-1, Contractor may:
1) Use and Disclose for Management and Administration. Use and
disclose Department PHI for the proper management and
administration of the Contractor’s business, provided that such
disclosures are required by law, or the Contractor obtains reasonable
assurances from the person to whom the information is disclosed, in
accordance with section D(7) of this Exhibit E-1, that it will remain
confidential and will be used or further disclosed only as required by
law or for the purpose for which it was disclosed to the person, and
the person notifies the Contractor of any instances of which it is aware
that the confidentiality of the information has been breached.
2) Provision of Data Aggregation Services. Use Department PHI to
provide data aggregation services to the Department to the extent
requested by the Department and agreed to by Contractor. Data
aggregation means the combining of PHI created or received by the
Contractor, as the Business Associate, on behalf of the Department
with PHI received by the Business Associate in its capacity as the
Business Associate of another covered entity, to permit data analyses
that relate to the health care operations of the Department
C. Prohibited Uses and Disclosures
1) Contractor shall not disclose Department PHI about an individual to
a health plan for payment or health care operations purposes if the
Department PHI pertains solely to a health care item or service for
County of Fresno
17-94521
Page 6 of 31
which the health care provider involved has been paid out of pocket
in full and the individual requests such restriction, in accordance
with 42 U.S.C. Section 17935(a) and 45 CFR Section 164.522(a).
2) Contractor shall not directly or indirectly receive remuneration in
exchange for Department PHI.
D. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose Department PHI other than
as permitted or required by this Agreement or as required by law,
including but not limited to 42 CFR Part 2.
2) Compliance with the HIPAA Security Rule. To implement
administrative, physical, and technical safeguards that reasonably
and appropriately protect the confidentiality, integrity, and availability
of the Department PHI, including electronic PHI, that it creates,
receives, maintains, uses or transmits on behalf of the Department, in
compliance with 45 CFR Sections 164.308, 164.310 and 164.312,
and to prevent use or disclosure of Department PHI other than as
provided for by this Agreement. Contractor shall implement
reasonable and appropriate policies and procedures to comply with
the standards, implementation specifications and other requirements
of 45 CFR Section 164, subpart C, in compliance with 45 CFR
Section164.316. Contractor shall develop and maintain a written
information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and
complexity of the Contractor’s operations and the nature and scope of
its activities, and which incorporates the requirements of section 3,
Security, below. Contractor will provide the Department with its
current and updated policies upon request.
3) Security. Contractor shall take any and all steps necessary to ensure
the continuous security of all computerized data systems containing
PHI and/or PI, and to protect paper documents containing PHI and/or
PI. These steps shall include, at a minimum:
a. Complying with all of the data system security precautions
listed in Attachment A, Data Security Requirements;
b. Achieving and maintaining compliance with the HIPAA
Security Rule (45 CFR Parts 160 and 164), as necessary in
conducting operations on behalf of DHCS under this
County of Fresno
17-94521
Page 7 of 31
Agreement; and
c. Providing a level and scope of security that is at least
comparable to the level and scope of security established by
the Office of Management and Budget in OMB Circular No.
A-130, Appendix III- Security of Federal Automated
Information Systems, which sets forth guidelines for
automated information systems in Federal agencies.
4) Security Officer. Contractor shall designate a Security Officer to
oversee its data security program who shall be responsible for
carrying out the requirements of this section and for communicating
on security matters with the Department.
5) Mitigation of Harmful Effects. To mitigate, to the extent practicable,
any harmful effect that is known to Contractor of a use or disclosure of
Department PHI by Contractor or its subcontractors in violation of the
requirements of this Exhibit E.
6) Reporting Unauthorized Use or Disclosure. To report to
Department any use or disclosure of Department PHI not provided for
by this Exhibit E of which it becomes aware.
7) Contractor’s Agents and Subcontractors.
a. To enter into written agreements with any agents, including
subcontractors and vendors to whom Contractor provides
Department PHI, that impose the same restrictions and
conditions on such agents, subcontractors and vendors that
apply to Contractor with respect to such Department PHI
under this Exhibit E, and that require compliance with all
applicable provisions of HIPAA, the HITECH Act and the
HIPAA regulations, including the requirement that any
agents, subcontractors or vendors implement reasonable
and appropriate administrative, physical, and technical
safeguards to protect such PHI. As required by HIPAA, the
HITECH Act and the HIPAA regulations, including 45 CFR
Sections 164.308 and 164.314, Contractor shall
incorporate, when applicable, the relevant provisions of this
Exhibit E-1 into each subcontract or subaward to such
agents, subcontractors and vendors, including the
requirement that any security incidents or breaches of
unsecured PHI be reported to Contractor.
b. In accordance with 45 CFR Section 164.504(e)(1)(ii), upon
County of Fresno
17-94521
Page 8 of 31
Contractor’s knowledge of a material breach or violation by
its subcontractor of the agreement between Contractor and
the subcontractor, Contractor shall:
i) Provide an opportunity for the subcontractor to cure
the breach or end the violation and terminate the
agreement if the subcontractor does not cure the
breach or end the violation within the time specified
by the Department; or
ii) Immediately terminate the agreement if the
subcontractor has breached a material term of the
agreement and cure is not possible.
8) Availability of Information to the Department and Individuals to
Provide Access and Information:
a. To provide access as the Department may require, and in
the time and manner designated by the Department (upon
reasonable notice and during Contractor’s normal
business hours) to Department PHI in a Designated
Record Set, to the Department (or, as directed by the
Department), to an Individual, in accordance with 45 CFR
Section 164.524. Designated Record Set means the group
of records maintained for the Department health plan
under this Agreement that includes medical, dental and
billing records about individuals; enrollment, payment,
claims adjudication, and case or medical management
systems maintained for the Department health plan for
which Contractor is providing services under this
Agreement; or those records used to make decisions
about individuals on behalf of the Department. Contractor
shall use the forms and processes developed by the
Department for this purpose and shall respond to requests
for access to records transmitted by the Department within
fifteen (15) calendar days of receipt of the request by
producing the records or verifying that there are none.
b. If Contractor maintains an Electronic Health Record with
PHI, and an individual requests a copy of such
information in an electronic format, Contractor shall
provide such information in an electronic format to enable
the Department to fulfill its obligations under the HITECH
Act, including but not limited to, 42 U.S.C. Section
17935(e) and the HIPAA regulations.
County of Fresno
17-94521
Page 9 of 31
9) Amendment of Department PHI. To make any amendment(s) to
Department PHI that were requested by a patient and that the
Department directs or agrees should be made to assure compliance
with 45 CFR Section 164.526, in the time and manner designated by
the Department, with the Contractor being given a minimum of twenty
(20) days within which to make the amendment.
10) Internal Practices. To make Contractor’s internal practices, books
and records relating to the use and disclosure of Department PHI
available to the Department or to the Secretary, for purposes of
determining the Department’s compliance with the HIPAA
regulations. If any information needed for this purpose is in the
exclusive possession of any other entity or person and the other
entity or person fails or refuses to furnish the information to
Contractor, Contractor shall provide written notification to the
Department and shall set forth the efforts it made to obtain the
information.
11) Documentation of Disclosures. To document and make available to
the Department or (at the direction of the Department) to an individual
such disclosures of Department PHI, and information related to such
disclosures, necessary to respond to a proper request by the subject
Individual for an accounting of disclosures of such PHI, in accordance
with the HITECH Act and its implementing regulations, including but
not limited to 45 CFR Section 164.528 and 42 U.S.C. Section
17935(c). If Contractor maintains electronic health records for the
Department as of January 1, 2009 and later, Contractor must provide
an accounting of disclosures, including those disclosures for
treatment, payment or health care operations. The electronic
accounting of disclosures shall be for disclosures during the three
years prior to the request for an accounting.
12) Breaches and Security Incidents. During the term of this
Agreement, Contractor agrees to implement reasonable systems
for the discovery and prompt reporting of any breach or security
incident, and to take the following steps:
a. Initial Notice to the Department. (1) To notify the
Department immediately by telephone call or email or
fax upon the discovery of a breach of unsecured PHI in
electronic media or in any other media if the PHI was, or is
reasonably believed to have been, accessed or acquired by
an unauthorized person. (2) To notify the Department
within 24 hours (one hour if SSA data) by email or fax of
County of Fresno
17-94521
Page 10 of 31
the discovery of any suspected security incident, intrusion
or unauthorized access, use or disclosure of PHI in violation
of this Agreement or this Exhibit E-1, or potential loss of
confidential data affecting this Agreement. A breach shall
be treated as discovered by Contractor as of the first day on
which the breach is known, or by exercising reasonable
diligence would have been known, to any person (other
than the person committing the breach) who is an
employee, officer or other agent of Contractor.
Notice shall be provided to the Information Protection Unit,
Office of HIPAA Compliance. If the incident occurs after
business hours or on a weekend or holiday and involves
electronic PHI, notice shall be provided by calling the
Information Protection Unit (916.445.4646, 866-866-0602)
or by emailing privacyofficer@dhcs.ca.gov). Notice shall be
made using the DHCS “Privacy Incident Report” form,
including all information known at the time. Contractor
shall use the most current version of this form, which is
posted on the DHCS Information Security Officer website
(www.dhcs.ca.gov, then select “Privacy” in the left column
and then “Business Partner” near the middle of the page)
or use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DH
CSBusinessAssociatesOnly.aspx
Upon discovery of a breach or suspected security incident,
intrusion or unauthorized access, use or disclosure of
Department PHI, Contractor shall take:
i) Prompt corrective action to mitigate any risks or
damages involved with the breach and to protect the
operating environment; and
ii) Any action pertaining to such unauthorized disclosure
required by applicable Federal and State laws and
regulations.
b. Investigation and Investigation Report. To immediately
investigate such suspected security incident, security
incident, breach, or unauthorized access, use or
disclosure of PHI . Within 72 hours of the discovery,
Contractor shall submit an updated “Privacy Incident
Report” containing the information marked with an
asterisk and all other applicable information listed on the
County of Fresno
17-94521
Page 11 of 31
form, to the extent known at that time, to the Information
Protection Unit.
c. Complete Report. To provide a complete report of the
investigation to the Department Program Contract Manager
and the Information Protection Unit within ten (10) working
days of the discovery of the breach or unauthorized use or
disclosure. The report shall be submitted on the “Privacy
Incident Report” form and shall include an assessment of all
known factors relevant to a determination of whether a
breach occurred under applicable provisions of HIPAA, the
HITECH Act, and the HIPAA regulations. The report shall
also include a full, detailed corrective action plan, including
information on measures that were taken to halt and/or
contain the improper use or disclosure. If the Department
requests information in addition to that listed on the “Privacy
Incident Report” form, Contractor shall make reasonable
efforts to provide the Department with such information. If,
because of the circumstances of the incident, Contractor
needs more than ten (10) working days from the discovery to
submit a complete report, the Department may grant a
reasonable extension of time, in which case Contractor shall
submit periodic updates until the complete report is
submitted. If necessary, a Supplemental Report may be used
to submit revised or additional information after the completed
report is submitted, by submitting the revised or additional
information on an updated “Privacy Incident Report” form.
The Department will review and approve the determination of
whether a breach occurred and whether individual
notifications and a corrective action plan are required.
d. Responsibility for Reporting of Breaches. If the cause of a
breach of Department PHI is attributable to Contractor or its
agents, subcontractors or vendors, Contractor is responsible
for all required reporting of the breach as specified in 42
U.S.C. section 17932 and its implementing regulations,
including notification to media outlets and to the Secretary
(after obtaining prior written approval of DHCS). If a breach of
unsecured Department PHI involves more than 500 residents
of the State of California or under its jurisdiction, Contractor
shall first notify DHCS, then the Secretary of the breach
immediately upon discovery of the breach. If a breach
involves more than 500 California residents, Contractor shall
also provide, after obtaining written prior approval of DHCS,
notice to the Attorney General for the State of California,
County of Fresno
17-94521
Page 12 of 31
Privacy Enforcement Section. If Contractor has reason to
believe that duplicate reporting of the same breach or incident
may occur because its subcontractors, agents or vendors
may report the breach or incident to the Department in
addition to Contractor, Contractor shall notify the Department,
and the Department and Contractor may take appropriate
action to prevent duplicate reporting.
e. Responsibility for Notification of Affected Individuals. If
the cause of a breach of Department PHI is attributable to
Contractor or its agents, subcontractors or vendors and
notification of the affected individuals is required under state
or federal law, Contractor shall bear all costs of such
notifications as well as any costs associated with the
breach. In addition, the Department reserves the right to
require Contractor to notify such affected individuals, which
notifications shall comply with the requirements set forth in
42U.S.C. section 17932 and its implementing regulations,
including, but not limited to, the requirement that the
notifications be made without unreasonable delay and in no
event later than 60 calendar days after discovery of the
breach. The Department Privacy Officer shall approve the
time, manner and content of any such notifications and their
review and approval must be obtained before the
notifications are made. The Department will provide its
review and approval expeditiously and without
unreasonable delay.
f. Department Contact Information. To direct
communications to the above referenced Department staff,
the Contractor shall initiate contact as indicated herein. The
Department reserves the right to make changes to the
contact information below by giving written notice to the
Contractor. Said changes shall not require an amendment to
this Addendum or the Agreement to which it is incorporated.
Department
Program Contract
Manager
DHCS Privacy Officer DHCS Information Security
Officer
County of Fresno
17-94521
Page 13 of 31
See the Exhibit A,
Scope of Work for
Program Contract
Manager
information
Information Protection Unit
c/o: Office of HIPAA
Compliance Department of
Health Care Services
P.O. Box 997413, MS 4722
Sacramento, CA 95899-7413
(916) 445-4646; (866) 866-
0602
Email:
privacyofficer@dhcs.ca.gov
Fax: (916) 440-7680
Information Security Officer
DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Service Desk (916)
440-7000; (800) 579-
0874
Fax: (916)440-5537
13) Termination of Agreement. In accordance with Section 13404(b) of
the HITECH Act and to the extent required by the HIPAA
regulations, if Contractor knows of a material breach or violation by
the Department of this Exhibit E-1, it shall take the following steps:
a. Provide an opportunity for the Department to cure the breach
or end the violation and terminate the Agreement if the
Department does not cure the breach or end the violation
within the time specified by Contractor; or
b. Immediately terminate the Agreement if the Department has
breached a material term of the Exhibit E-1 and cure is not
possible.
14) Sanctions and/or Penalties. Contractor understands that a failure to
comply with the provisions of HIPAA, the HITECH Act and the HIPAA
regulations that are applicable to Contractors may result in the
imposition of sanctions and/or penalties on Contractor under HIPAA,
the HITECH Act and the HIPAA regulations.
E. Obligations of the Department.
The Department agrees to:
1) Permission by Individuals for Use and Disclosure of PHI. Provide
the Contractor with any changes in, or revocation of, permission by an
Individual to use or disclose Department PHI, if such changes affect
the Contractor’s permitted or required uses and disclosures.
2) Notification of Restrictions. Notify the Contractor of any restriction to
County of Fresno
17-94521
Page 14 of 31
the use or disclosure of Department PHI that the Department has
agreed to in accordance with 45 CFR Section 164.522, to the extent
that such restriction may affect the Contractor’s use or disclosure of
PHI.
3) Requests Conflicting with HIPAA Rules. Not request the Contractor
to use or disclose Department PHI in any manner that would not be
permissible under the HIPAA regulations if done by the Department.
4) Notice of Privacy Practices. Provide Contractor with the web link to
the Notice of Privacy Practices that DHCS produces in accordance
with 45 CFR Section 164.520, as well as any changes to such notice.
Visit the DHCS website to view the most current Notice of Privacy
Practices at:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/NoticeofPrivacy
Practices.aspx or the DHCS website at www.dhcs.ca.gov (select
“Privacy in the right column and “Notice of Privacy Practices” on the
right side of the page).
F. Audits, Inspection and Enforcement
If Contractor is the subject of an audit, compliance review, or complaint
investigation by the Secretary or the Office for Civil Rights, U.S. Department of
Health and Human Services, that is related to the performance of its
obligations pursuant to this HIPAA Business Associate Exhibit E-1,Contractor
shall immediately notify the Department. Upon request from the Department,
Contractor shall provide the Department with a copy of any Department PHI
that Contractor, as the Business Associate, provides to the Secretary or the
Office of Civil Rights concurrently with providing such PHI to the Secretary.
Contractor is responsible for any civil penalties assessed due to an audit or
investigation of Contractor, in accordance with 42 U.S.C. Section 17934(c).
G. Termination.
1) Term. The Term of this Exhibit E-1 shall extend beyond the
termination of the Agreement and shall terminate when all
Department PHI is destroyed or returned to the Department, in
accordance with 45 CFR Section 164.504(e)(2)(ii)(J).
2) Termination for Cause. In accordance with 45 CFR Section
164.504(e)(1)(iii), upon the Department’s knowledge of a material
breach or violation of this Exhibit E-1 by Contractor, the Department
shall:
a. Provide an opportunity for Contractor to cure the breach or
County of Fresno
17-94521
Page 15 of 31
end the violation and terminate this Agreement if Contractor
does not cure the breach or end the violation within the time
specified by the Department; or
b. Immediately terminate this Agreement if Contractor has
breached a material term of this Exhibit E-1 and cure is not
possible.
THE REST OF THIS PAGE IS INTENTIONALLY BLANK
County of Fresno
17-94521
Page 16 of 31
EXHIBIT E-2
Privacy and Security of Personal Information and Personally Identifiable
Information Not Subject to HIPAA
1. Recitals.
A. In addition to the Privacy and Security Rules under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) the Department is
subject to various other legal and contractual requirements with respect to
the personal information (PI) and personally identifiable information (PII) it
maintains. These include:
1) The California Information Practices Act of 1977 (California Civil
Code §§1798 et seq.),
2) The Agreement between the Social Security Administration (SSA)
and the Department, known as the Information Exchange
Agreement (IEA), which incorporates the Computer Matching and
Privacy Protection Act Agreement (CMPPA) between the SSA and
the California Health and Human Services Agency. The IEA,
including the CMPPA is attached to this Exhibit E as Attachment B
and is hereby incorporated in this Agreement.
3) Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2.
B. The purpose of this Exhibit E-2 is to set forth Contractor’s privacy and
security obligations with respect to PI and PII that Contractor may create,
receive, maintain, use, or disclose for or on behalf of Department pursuant
to this Agreement. Specifically this Exhibit applies to PI and PII which is
not Protected Health Information (PHI) as defined by HIPAA and therefore
is not addressed in Exhibit E-1 of this Agreement, the HIPAA Business
Associate Addendum; however, to the extent that data is both PHI or ePHI
and PII, both Exhibit E-1 and this Exhibit E-2 shall apply.
C. The IEA Agreement referenced in A.2) above requires the Department to
extend its substantive privacy and security terms to subcontractors who
receive data provided to DHCS by the Social Security Administration. If
Contractor receives data from DHCS that includes data provided to DHCS
by the Social Security Administration, Contractor must comply with the
following specific sections of the IEA Agreement: E. Security Procedures,
F. Contractor/Agent Responsibilities, and G. Safeguarding and Reporting
Responsibilities for Personally Identifiable Information (“PII”), and in
Attachment 4 to the IEA, Electronic Information Exchange Security
Requirements, Guidelines and Procedures for Federal, State and Local
County of Fresno
17-94521
Page 17 of 31
Agencies Exchanging Electronic Information with the Social Security
Administration. Contractor must also ensure that any agents, including a
subcontractor, to whom it provides DHCS data that includes data provided
by the Social Security Administration, agree to the same requirements for
privacy and security safeguards for such confidential data that apply to
Contractor with respect to such information.
D. The terms used in this Exhibit E-2, but not otherwise defined, shall have
the same meanings as those terms have in the above referenced statute
and Agreement. Any reference to statutory, regulatory, or contractual
language shall be to such language as in effect or as amended.
2. Definitions.
A. “Breach” shall have the meaning given to such term under the IEA and
CMPPA. It shall include a “PII loss” as that term is defined in the CMPPA.
B. “Breach of the security of the system” shall have the meaning given to
such term under the California Information Practices Act, Civil Code
section 1798.29(f).
C. “CMPPA Agreement” means the Computer Matching and Privacy
Protection Act Agreement between the Social Security Administration and
the California Health and Human Services Agency (CHHS).
D. “Department PI” shall mean Personal Information, as defined below,
accessed in a database maintained by the Department, received by
Contractor from the Department or acquired or created by Contractor in
connection with performing the functions, activities and services specified
in this Agreement on behalf of the Department.
E. “IEA” shall mean the Information Exchange Agreement currently in effect
between the Social Security Administration (SSA) and the California
Department of Health Care Services (DHCS).
F. “Notice-triggering Personal Information” shall mean the personal
information identified in Civil Code section 1798.29 whose unauthorized
access may trigger notification requirements under Civil Code section
1798.29. For purposes of this provision, identity shall include, but not be
limited to, name, address, email address, identifying number, symbol, or
other identifying particular assigned to the individual, such as a finger or
voice print, a photograph or a biometric identifier. Notice-triggering
Personal Information includes PI in electronic, paper or any other medium.
G. “Personally Identifiable Information” (PII) shall have the meaning given to
such term in the IEA and CMPPA.
County of Fresno
17-94521
Page 18 of 31
H. “Personal Information” (PI) shall have the meaning given to such term in
California Civil Code Section 1798.3(a).
I. “Required by law” means a mandate contained in law that compels an
entity to make a use or disclosure of PI or PII that is enforceable in a court
of law. This includes, but is not limited to, court orders and court-ordered
warrants, subpoenas or summons issued by a court, grand jury, a
governmental or tribal inspector general, or an administrative body
authorized to require the production of information, and a civil or an
authorized investigative demand. It also includes Medicare conditions of
participation with respect to health care providers participating in the
program, and statutes or regulations that require the production of
information, including statutes or regulations that require such information
if payment is sought under a government program providing public
benefits.
J. “Security Incident” means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of PI, or confidential
data utilized in complying with this Agreement; or interference with system
operations in an information system that processes, maintains or stores
PI.
3. Terms of Agreement
A. Permitted Uses and Disclosures of Department PI and PII by
Contractor
Except as otherwise indicated in this Exhibit E-2, Contractor may use or
disclose Department PI only to perform functions, activities or services for
or on behalf of the Department pursuant to the terms of this Agreement
provided that such use or disclosure would not violate the California
Information Practices Act (CIPA) if done by the Department.
B. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose Department PI or PII other
than as permitted or required by this Agreement or as required by
applicable state and federal law.
2) Safeguards. To implement appropriate and reasonable
administrative, technical, and physical safeguards to protect the
security, confidentiality and integrity of Department PI and PII, to
protect against anticipated threats or hazards to the security or
County of Fresno
17-94521
Page 19 of 31
integrity of Department PI and PII, and to prevent use or disclosure
of Department PI or PII other than as provided for by this
Agreement. Contractor shall develop and maintain a written
information privacy and security program that include administrative,
technical and physical safeguards appropriate to the size and
complexity of Contractor’s operations and the nature and scope of
its activities, which incorporate the requirements of section 3,
Security, below. Contractor will provide DHCS with its current
policies upon request.
3) Security. Contractor shall take any and all steps necessary to
ensure the continuous security of all computerized data systems
containing PHI and/or PI, and to protect paper documents containing
PHI and/or PI. These steps shall include, at a minimum:
a. Complying with all of the data system security precautions
listed in Attachment A, Business Associate Data Security
Requirements;
b. Providing a level and scope of security that is at least
comparable to the level and scope of security established by
the Office of Management and Budget in OMB Circular No. A-
130, Appendix III- Security of Federal Automated Information
Systems, which sets forth guidelines for automated
information systems in Federal agencies; and
c. If the data obtained by Contractor from DHCS includes PII,
Contractor shall also comply with the substantive privacy and
security requirements in the Computer Matching and Privacy
Protection Act Agreement between the SSA and the California
Health and Human Services Agency (CHHS) and in the
Agreement between the SSA and DHCS, known as the
Information Exchange Agreement, which are attached as
Attachment B and incorporated into this Agreement. The
specific sections of the IEA with substantive privacy and
security requirements to be complied with are sections E, F,
and G, and in Attachment 4 to the IEA, Electronic Information
Exchange Security Requirements, Guidelines and Procedures
for Federal, State and Local Agencies Exchanging Electronic
Information with the SSA. Contractor also agrees to ensure
that any agents, including a subcontractor to whom it provides
DHCS PII, agree to the same requirements for privacy and
security safeguards for confidential data that apply to
Contractor with respect to such information.
County of Fresno
17-94521
Page 20 of 31
4) Mitigation of Harmful Effects. To mitigate, to the extent
practicable, any harmful effect that is known to Contractor of a use
or disclosure of Department PI or PII by Contractor or its
subcontractors in violation of this Exhibit E-2.
5) Contractor’s Agents and Subcontractors. To impose the same
restrictions and conditions set forth in this Exhibit E-2 on any
subcontractors or other agents with whom Contractor subcontracts
any activities under this Agreement that involve the disclosure of
Department PI or PII to the subcontractor.
6) Availability of Information to DHCS. To make Department PI and
PII available to the Department for purposes of oversight,
inspection, amendment, and response to requests for records,
injunctions, judgments, and orders for production of Department PI
and PII. If Contractor receives Department PII, upon request by
DHCS, Contractor shall provide DHCS with a list of all employees,
contractors and agents who have access to Department PII,
including employees, contractors and agents of its subcontractors
and agents.
7) Cooperation with DHCS. With respect to Department PI, to
cooperate with and assist the Department to the extent necessary
to ensure the Department’s compliance with the applicable terms of
the CIPA including, but not limited to, accounting of disclosures of
Department PI, correction of errors in Department PI, production of
Department PI, disclosure of a security breach involving
Department PI and notice of such breach to the affected
individual(s).
8) Confidentiality of Alcohol and Drug Abuse Patient Records.
Contractor agrees to comply with all confidentiality requirements set
forth in Title 42 Code of Federal Regulations, Chapter I, Subchapter
A, Part 2. Contractor is aware that criminal penalties may be
imposed for a violation of these confidentiality requirements.
9) Breaches and Security Incidents. During the term of this
Agreement, Contractor agrees to implement reasonable
systems for the discovery and prompt reporting of any breach
or security incident, and to take the following steps:
a. Initial Notice to the Department. (1) To notify the Department
immediately by telephone call or email or fax upon the
discovery of a breach of unsecured Department PI or PII in
electronic media or in any other media if the PI or PII was, or
is reasonably believed to have been, accessed or acquired
County of Fresno
17-94521
Page 21 of 31
by an unauthorized person, or upon discovery of a suspected
security incident involving Department PII. (2) To notify the
Department within one (1) hour by email or fax if the data
is data subject to the SSA Agreement; and within 24 hours
by email or fax of the discovery of any suspected security
incident, intrusion or unauthorized access, use or disclosure
of Department PI or PII in violation of this Agreement or this
Exhibit E-1 or potential loss of confidential data affecting this
Agreement. A breach shall be treated as discovered by
Contractor as of the first day on which the breach is known,
or by exercising reasonable diligence would have been
known, to any person (other than the person committing the
breach) who is an employee, officer or other agent of
Contractor.
b. Notice shall be provided to the Information Protection Unit,
Office of HIPAA Compliance. If the incident occurs after
business hours or on a weekend or holiday and involves
electronic Department PI or PII, notice shall be provided by
calling the Department Information Security Officer. Notice
shall be made using the DHCS “Privacy Incident Report”
form, including all information known at the time. Contractor
shall use the most current version of this form, which is
posted on the DHCS Information Security Officer website
(www.dhcs.ca.gov, then select “Privacy” in the left column
and then “Business Partner” near the middle of the page) or
use this link:
http://www.dhcs.ca.gov/formsandpubs/laws/priv/Pages/DHCS
BusinessAssociatesOnly.aspx .
c. Upon discovery of a breach or suspected security incident,
intrusion or unauthorized access, use or disclosure of
Department PI or PII, Contractor shall take:
i. Prompt corrective action to mitigate any risks or damages
involved with the breach and to protect the operating
environment; and
ii. Any action pertaining to such unauthorized disclosure
required by applicable Federal and State laws and
regulations.
d. Investigation and Investigation Report. To immediately
investigate such suspected security incident, security
incident, breach, or unauthorized access, use or disclosure of
County of Fresno
17-94521
Page 22 of 31
PHI. Within 72 hours of the discovery, Contractor shall
submit an updated “Privacy Incident Report” containing the
information marked with an asterisk and all other applicable
information listed on the form, to the extent known at that
time, to the Department Information Security Officer.
e. Complete Report. To provide a complete report of the
investigation to the Department Program Contract Manager
and the Information Protection Unit within ten (10) working
days of the discovery of the breach or unauthorized use or
disclosure. The report shall be submitted on the “Privacy
Incident Report” form and shall include an assessment of all
known factors relevant to a determination of whether a
breach occurred. The report shall also include a full, detailed
corrective action plan, including information on measures that
were taken to halt and/or contain the improper use or
disclosure. If the Department requests information in addition
to that listed on the “Privacy Incident Report” form, Contractor
shall make reasonable efforts to provide the Department with
such information. If, because of the circumstances of the
incident, Contractor needs more than ten (10) working days
from the discovery to submit a complete report, the
Department may grant a reasonable extension of time, in
which case Contractor shall submit periodic updates until the
complete report is submitted. If necessary, a Supplemental
Report may be used to submit revised or additional
information after the completed report is submitted, by
submitting the revised or additional information on an
updated “Privacy Incident Report” form. The Department will
review and approve the determination of whether a breach
occurred and whether individual notifications and a corrective
action plan are required.
f. Responsibility for Reporting of Breaches. If the cause of a
breach of Department PI or PII is attributable to Contractor or
its agents, subcontractors or vendors, Contractor is
responsible for all required reporting of the breach as
specified in CIPA, section 1798.29and as may be required
under the IEA. Contractor shall bear all costs of required
notifications to individuals as well as any costs associated
with the breach. The Privacy Officer shall approve the time,
manner and content of any such notifications and their review
and approval must be obtained before the notifications are
made. The Department will provide its review and approval
expeditiously and without unreasonable delay.
County of Fresno
17-94521
Page 23 of 31
g. If Contractor has reason to believe that duplicate reporting of
the same breach or incident may occur because its
subcontractors, agents or vendors may report the breach or
incident to the Department in addition to Contractor,
Contractor shall notify the Department, and the Department
and Contractor may take appropriate action to prevent
duplicate reporting.
h. Department Contact Information. To direct communications
to the above referenced Department staff, the Contractor shall
initiate contact as indicated herein. The Department reserves
the right to make changes to the contact information below by
giving written notice to the Contractor. Said changes shall not
require an amendment to this Addendum or the Agreement to
which it is incorporated.
Department
Program
Contract
DHCS Privacy Officer DHCS Information Security Officer
See the Exhibit
A, Scope of
Work for
Program
Contract
Manager
information
Information Protection Unit c/o: Office of HIPAA Compliance Department of Health Care Services P.O. Box 997413, MS 4722
Sacramento, CA 95899-7413 (916) 445-4646
Email:
privacyofficer@dhcs.ca.gov
Telephone:(916) 445-4646
Information Security Officer DHCS Information Security Office
P.O. Box 997413, MS 6400
Sacramento, CA 95899-7413
Email: iso@dhcs.ca.gov
Telephone: ITSD Service Desk
(916) 440-7000 or
(800) 579-0874
10) Designation of Individual Responsible for Security
Contractor shall designate an individual, (e.g., Security Officer), to
oversee its data security program who shall be responsible for carrying
out the requirements of this Exhibit E-2 and for communicating on
security matters with the Department.
County of Fresno
17-94521
Page 24 of 31
EXHIBIT E-3
Miscellaneous Terms and Conditions
Applicable to Exhibit E
1) Disclaimer. The Department makes no warranty or representation that
compliance by Contractor with this Exhibit E, HIPAA or the HIPAA
regulations will be adequate or satisfactory for Contractor’s own purposes or
that any information in Contractor’s possession or control, or transmitted or
received by Contractor, is or will be secure from unauthorized use or
disclosure. Contractor is solely responsible for all decisions made by
Contractor regarding the safeguarding of the Department PHI, PI and PII.
2) Amendment. The parties acknowledge that federal and state laws relating to
electronic data security and privacy are rapidly evolving and that amendment
of this Exhibit E may be required to provide for procedures to ensure
compliance with such developments. The parties specifically agree to take
such action as is necessary to implement the standards and requirements of
HIPAA, the HITECH Act, and the HIPAA regulations, and other applicable
state and federal laws. Upon either party’s request, the other party agrees to
promptly enter into negotiations concerning an amendment to this Exhibit E
embodying written assurances consistent with the standards and
requirements of HIPAA, the HITECH Act, and the HIPAA regulations, and
other applicable state and federal laws. The Department may terminate this
Agreement upon thirty (30) days written notice in the event:
a) Contractor does not promptly enter into negotiations to amend
this Exhibit E when requested by the Department pursuant to this
section; or
b) Contractor does not enter into an amendment providing
assurances regarding the safeguarding of Department PHI that the
Department deems is necessary to satisfy the standards and
requirements of HIPAA and the HIPAA regulations.
3) Judicial or Administrative Proceedings. Contractor will notify the
Department if it is named as a defendant in a criminal proceeding for a
violation of HIPAA or other security or privacy law. The Department may
terminate this Agreement if Contractor is found guilty of a criminal
violation of HIPAA. The Department may terminate this Agreement if a
finding or stipulation that the Contractor has violated any standard or
requirement of HIPAA, or other security or privacy laws is made in any
administrative or civil proceeding in which the Contractor is a party or
has been joined. DHCS will consider the nature and seriousness of the
County of Fresno
17-94521
Page 25 of 31
violation in deciding whether or not to terminate the Agreement.
4) Assistance in Litigation or Administrative Proceedings. Contractor
shall make itself and any subcontractors, employees or agents assisting
Contractor in the performance of its obligations under this Agreement,
available to the Department at no cost to the Department to testify as
witnesses, or otherwise, in the event of litigation or administrative
proceedings being commenced against the Department, its directors,
officers or employees based upon claimed violation of HIPAA, or the
HIPAA regulations, which involves inactions or actions by the
Contractor, except where Contractor or its subcontractor, employee or
agent is a named adverse party.
5) No Third-Party Beneficiaries. Nothing express or implied in the terms
and conditions of this Exhibit E is intended to confer, nor shall anything
herein confer, upon any person other than the Department or Contractor
and their respective successors or assignees, any rights, remedies,
obligations or liabilities whatsoever.
6) Interpretation. The terms and conditions in this Exhibit E shall be
interpreted as broadly as necessary to implement and comply with
HIPAA, the HITECH Act, and the HIPAA regulations. The parties agree
that any ambiguity in the terms and conditions of this Exhibit E shall be
resolved in favor of a meaning that complies and is consistent with
HIPAA, the HITECH Act and the HIPAA regulations, and, if applicable,
any other relevant state and federal laws.
7) Conflict. In case of a conflict between any applicable privacy or
security rules, laws, regulations or standards the most stringent shall
apply. The most stringent means that safeguard which provides the
highest level of protection to PHI, PI and PII from unauthorized
disclosure. Further, Contractor must comply within a reasonable period
of time with changes to these standards that occur after the effective
date of this Agreement.
8) Regulatory References. A reference in the terms and conditions of this
Exhibit E to a section in the HIPAA regulations means the section as in
effect or as amended.
9) Survival. The respective rights and obligations of Contractor under
Section 3, Item D of Exhibit E-1, and Section 3, Item B of Exhibit E-2,
Responsibilities of Contractor, shall survive the termination or expiration
of this Agreement.
10) No Waiver of Obligations. No change, waiver or discharge of any
County of Fresno
17-94521
Page 26 of 31
liability or obligation hereunder on any one or more occasions shall be
deemed a waiver of performance of any continuing or other obligation,
or shall prohibit enforcement of any obligation, on any other occasion.
11) Audits, Inspection and Enforcement. From time to time, and subject
to all applicable federal and state privacy and security laws and
regulations, the Department may conduct a reasonable inspection of the
facilities, systems, books and records of Contractor to monitor
compliance with this Exhibit E. Contractor shall promptly remedy any
violation of any provision of this Exhibit E. The fact that the Department
inspects, or fails to inspect, or has the right to inspect, Contractor’s
facilities, systems and procedures does not relieve Contractor of its
responsibility to comply with this Exhibit E. The Department's failure to
detect a non-compliant practice, or a failure to report a detected non-
compliant practice to Contractor does not constitute acceptance of such
practice or a waiver of the Department's enforcement rights under this
Agreement, including this Exhibit E.
12) Due Diligence. Contractor shall exercise due diligence and shall take
reasonable steps to ensure that it remains in compliance with this Exhibit
E and is in compliance with applicable provisions of HIPAA, the HITECH
Act and the HIPAA regulations, and other applicable state and federal
law, and that its agents, subcontractors and vendors are in compliance
with their obligations as required by this Exhibit E.
13) Term. The Term of this Exhibit E-1 shall extend beyond the termination of
the Agreement and shall terminate when all Department PHI is destroyed
or returned to the Department, in accordance with 45 CFR Section
164.504(e)(2)(ii)(I), and when all Department PI and PII is destroyed in
accordance with Attachment A.
14) Effect of Termination. Upon termination or expiration of this Agreement
for any reason, Contractor shall return or destroy all Department PHI, PI
and PII that Contractor still maintains in any form, and shall retain no
copies of such PHI, PI or PII. If return or destruction is not feasible,
Contractor shall notify the Department of the conditions that make the
return or destruction infeasible, and the Department and Contractor shall
determine the terms and conditions under which Contractor may retain the
PHI, PI or PII. Contractor shall continue to extend the protections of this
Exhibit E to such Department PHI, PI and PII, and shall limit further use of
such data to those purposes that make the return or destruction of such
data infeasible. This provision shall apply to Department PHI, PI and PII
that is in the possession of subcontractors or agents of Contractor.
County of Fresno
17-94521
Page 27 of 31
Attachment A
Data Security Requirements
1. Personnel Controls
A. Employee Training. All workforce members who assist in the
performance of functions or activities on behalf of the Department, or
access or disclose Department PHI or PI must complete information
privacy and security training, at least annually, at Contractor's expense.
Each workforce member who receives information privacy and security
training must sign a certification, indicating the member’s name and the
date on which the training was completed. These certifications must be
retained for a period of six (6) years following termination of this
Agreement.
B. Employee Discipline. Appropriate sanctions must be applied against
workforce members who fail to comply with privacy policies and
procedures or any provisions of these requirements, including termination
of employment where appropriate.
C. Confidentiality Statement. All persons that will be working with
Department PHI or PI must sign a confidentiality statement that includes,
at a minimum, General Use, Security and Privacy Safeguards,
Unacceptable Use, and Enforcement Policies. The statement must be
signed by the workforce member prior to access to Department PHI or PI.
The statement must be renewed annually. The Contractor shall retain
each person’s written confidentiality statement for Department inspection
for a period of six (6) years following termination of this Agreement.
D. Background Check. Before a member of the workforce may access
Department PHI or PI, a background screening of that worker must be
conducted. The screening should be commensurate with the risk and
magnitude of harm the employee could cause, with more thorough
screening being done for those employees who are authorized to bypass
significant technical and operational security controls. The Contractor shall
retain each workforce member’s background check documentation for a
period of three (3) years.
2. Technical Security Controls
A. Workstation/Laptop encryption. All workstations and laptops that store
Department PHI or PI either directly or temporarily must be encrypted
using a FIPS 140-2 certified algorithm which is 128bit or higher, such as
County of Fresno
17-94521
Page 28 of 31
Advanced Encryption Standard (AES). The encryption solution must be
full disk unless approved by the Department Information Security Office.
B. Server Security. Servers containing unencrypted Department PHI or PI
must have sufficient administrative, physical, and technical controls in place
to protect that data, based upon a risk assessment/system security review.
C. Minimum Necessary. Only the minimum necessary amount of Department
PHI or PI required to perform necessary business functions may be copied,
downloaded, or exported.
D. Removable media devices. All electronic files that contain Department
PHI or PI data must be encrypted when stored on any removable media or
portable device (i.e. USB thumb drives, floppies, CD/DVD, Blackberry,
backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm
which is 128bit or higher, such as AES.
E. Antivirus software. All workstations, laptops and other systems that process
and/or store Department PHI or PI must install and actively use comprehensive
anti-virus software solution with automatic updates scheduled at least daily.
F. Patch Management. All workstations, laptops and other systems that
process and/or store Department PHI or PI must have critical security
patches applied, with system reboot if necessary. There must be a
documented patch management process which determines installation
timeframe based on risk assessment and vendor recommendations. At a
maximum, all applicable patches must be installed within 30 days of vendor
release. Applications and systems that cannot be patched within this time
frame due to significant operational reasons must have compensatory
controls implemented to minimize risk until the patches can be installed.
Applications and systems that cannot be patched must have compensatory
controls implemented to minimize risk, where possible.
G. User IDs and Password Controls. All users must be issued a unique user
name for accessing Department PHI or PI. Username must be promptly
disabled, deleted, or the password changed upon the transfer or termination of
an employee with knowledge of the password. Passwords are not to be
shared. Passwords must be at least eight characters and must be a non-
dictionary word. Passwords must not be stored in readable format on the
computer. Passwords must be changed at least every 90 days, preferably
every 60 days. Passwords must be changed if revealed or compromised.
Passwords must be composed of characters from at least three of the following
four groups from the standard keyboard:
1) Upper case letters (A-Z)
County of Fresno
17-94521
Page 29 of 31
2) Lower case letters (a-z)
3) Arabic numerals (0-9)
4) Non-alphanumeric characters (punctuation symbols)
H. Data Destruction. When no longer needed, all Department PHI or PI must be
wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7
Pass) standard, or by degaussing. Media may also be physically destroyed in
accordance with NIST Special Publication 800-88. Other methods require prior
written permission of the Department Information Security Office.
I. System Timeout. The system providing access to Department PHI or PI
must provide an automatic timeout, requiring re-authentication of the user
session after no more than 20 minutes of inactivity.
J. Warning Banners. All systems providing access to Department PHI or PI
must display a warning banner stating that data is confidential, systems
are logged, and system use is for business purposes only by authorized
users. User must be directed to log off the system if they do not agree
with these requirements.
K. Sys tem Logging. The system must maintain an automated audit trail
which can identify the user or system process which initiates a request for
Department PHI or PI, or which alters Department PHI or PI. The audit
trail must be date and time stamped, must log both successful and failed
accesses, must be read only, and must be restricted to authorized users.
If Department PHI or PI is stored in a database, database logging
functionality must be enabled. Audit trail data must be archived for at
least 3 years after occurrence.
L. Access Controls. The system providing access to Department PHI or PI
must use role based access controls for all user authentications, enforcing
the principle of least privilege.
M. Transmission encryption. All data transmissions of Department PHI or
PI outside the secure internal network must be encrypted using a FIPS
140-2 certified algorithm which is 128bit or higher, such as AES.
Encryption can be end to end at the network level, or the data files
containing Department PHI can be encrypted. This requirement pertains
to any type of Department PHI or PI in motion such as website access, file
transfer, and E-Mail.
N. Intrusion Detection. All systems involved in accessing, holding,
transporting, and protecting Department PHI or PI that are accessible via
County of Fresno
17-94521
Page 30 of 31
the Internet must be protected by a comprehensive intrusion detection and
prevention solution.
3. Audit Controls
A. System Security Review. Contractor must ensure audit control
mechanisms that record and examine system activity are in place. All
systems processing and/or storing Department PHI or PI must have at
least an annual system risk assessment/security review which provides
assurance that administrative, physical, and technical controls are
functioning effectively and providing adequate levels of protection.
Reviews should include vulnerability scanning tools.
B. Log Reviews. All systems processing and/or storing Department PHI or
PI must have a routine procedure in place to review system logs for
unauthorized access.
C. Change Control. All systems processing and/or storing Department PHI
or PI must have a documented change control procedure that ensures
separation of duties and protects the confidentiality, integrity and
availability of data.
4. Business Continuity / Disaster Recovery Controls
A. Emergency Mode Operation Plan. Contractor must establish a
documented plan to enable continuation of critical business processes and
protection of the security of Department PHI or PI held in an electronic
format in the event of an emergency. Emergency means any
circumstance or situation that causes normal computer operations to
become unavailable for use in performing the work required under this
Agreement for more than 24 hours.
B. Data Backup Plan. Contractor must have established documented
procedures to backup Department PHI to maintain retrievable exact
copies of Department PHI or PI. The plan must include a regular schedule
for making backups, storing backups offsite, an inventory of backup
media, and an estimate of the amount of time needed to restore
Department PHI or PI should it be lost. At a minimum, the schedule must
be a weekly full backup and monthly offsite storage of Department data.
5. Paper Document Controls
A. Supervision of Data. Department PHI or PI in paper form shall not be left
unattended at any time, unless it is locked in a file cabinet, file room, desk
or office. Unattended means that information is not being observed by an
employee authorized to access the information. Department PHI or PI in
County of Fresno
17-94521
Page 31 of 31
paper form shall not be left unattended at any time in vehicles or planes
and shall not be checked in baggage on commercial airplanes.
B. Escorting Visitors. Visitors to areas where Department PHI or PI is
contained shall be escorted and Department PHI or PI shall be kept out of
sight while visitors are in the area.
C. Confidential Destruction. Department PHI or PI must be disposed of
through confidential means, such as cross cut shredding and pulverizing.
D. Removal of Data. Only the minimum necessary Department PHI or PI
may be removed from the premises of the Contractor except with express
written permission of the Department. Department PHI or PI shall not be
considered "removed from the premises" if it is only being transported
from one of Contractor's locations to another of Contractors locations.
E. Faxing. Faxes containing Department PHI or PI shall not be left
unattended and fax machines shall be in secure areas. Faxes shall
contain a confidentiality statement notifying persons receiving faxes in
error to destroy them. Fax numbers shall be verified with the intended
recipient before sending the fax.
F. Mailing. Mailings containing Department PHI or PI shall be sealed and
secured from damage or inappropriate viewing of such PHI or PI to the
extent possible. Mailings which include 500 or more individually
identifiable records of Department PHI or PI in a single package shall be
sent using a tracked mailing method which includes verification of delivery
and receipt, unless the prior written permission of the Department to use
another method is obtained.
INFORMATION EXCHANGE AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION (SSA)
AND
THE CALIFORNIA DEPARTMENT OF HEAL TH CARE SERVICES
A.PURPOSE: The purpose of this Information Exchange Agreement ("IEA") is to establish
terms, conditions, and safeguards under which SSA will disclose to the State Agency certain
information, records, or data (herein "data") to assist the State Agency in administering
certain federally funded, state-administered benefit programs (including state-funded, state
supplementary payment programs under Title XVI of the Social Security Act) identified in
this IEA. By entering into this IEA, the State Agency agrees to comply with:
•the terms and conditions set forth in the Computer Matching and Privacy Protection Act
Agreement ("CMPPA Agreement") attached as Attachment 1, governing the State
Agency's use of the data disclosed from SSA's Privacy Act System of Records; and
•all other terms and conditions set forth in this IEA and Attachments 2 through 6.
B.PROGRAMS AND DATA EXCHANGE SYSTEMS: (1) The State Agency will use the
data received or accessed from SSA under this IEA for the purpose of administering the
federally funded, state-administered programs identified in Table 1 below. In Table 1, the
State Agency has identified: (a) each federally funded, state-administered program that it
administers; and (b) each SSA data exchange system to which the State Agency needs access
in order to administer the identified program. The list of SSA's data exchange systems is
attached as Attachment 2. Attachment 2 provides a brief explanation of each system, as
well as use parameters, as necessary.
TABLE 1
FEDERALLY FUNDED BENEFIT PROGRAMS
Program SSA Data Exchange System(s)
[8] Medicaid BENDEX/SDX/SVES IV /SOLQ/SVES-1-
Citizenship/Quarters of Coverage/PUPS
D Temporary Assistance to Needy Families
(TANF)
D Supplemental Nutrition Assistance Program
(SNAP-formally Food Stamps)
D Unemployment Compensation
D State Child Support Agency
D Low-Income Home Energy Assistance
Program (LI-HEAP)
D Workers Compensation
D Vocational Rehabilitation Services
1
Exhibit E, Attachment B
Exhibit E, Attachment B
D Foster Care (IV-E)
~ State Children's Health Insurance Program BENDEX/SDX/SVES IV,SVES -1 Citizenship (CHIP)
D Women, Infants and Children (W.I .C.)
~ Medicare Savings Programs (MSP) LIS File
~ Medicare 1144 (Outreach) Medicare 1144 Outreach File
~ Other Federally Funded, State-Administered Programs (List Below)
Program SSA Data Exchange System(s)
Medi-Cal Access Program (MCAP) BENDEX /S DX/SVES IV
(2) The State Agency will use each identified data exchange system only for the purpose of
administering the specific program for which access to the data exchange system is provided.
SSA data exchange systems are protected by the Privacy Act and Federal law prohibits the
use of SSA's data for any purpose other than the purpose of administering the specific
program for which such data is disclosed. In particular, the State Agency will:
a) use the tax return data disclosed by SSA only to determine indiv idual eligibility for,
or the amount of, assistance under a program li sted in 26 U .S.C. § 6103(1)(7) and (8).
b) u se citizenship status data disclosed by SSA only to determine entitlement of new
applicants to: (a) the Medicaid program and C HIP pursuant to the Children's Health
Ins urance Program Reauthorization Act of 2009, Pub. L. 111-3 ; or (b) federally
funded , state-administered hea lth or incom e maintenance programs approved by SSA
to receive the SSA Data Set through the Centers for Medicare & Medicaid Services'
(CMS) Federal Data Services Hub (Hub).
Applicants for Social Security numbers (SSN) report their citi zenship data at the time they
apply for their SSNs; there is n o obli gation for an individual to report to SSA a change in his
or her immigration status until h e or sh e fil es a claim for benefits.
C. PROGRAM QUESTIONNAIRE: Prior to s igning this IEA, the State Agency will
complete and submit to SSA a program questionnaire for each of the federally funded ,
state-administered programs checked in Table 1 above. SSA will not disclose any data
under this IEA until it has received and approved the completed program questionnaire for
each of the programs identified in Table 1 above.
2
Exhibit E, Attachment B
D. TRANSFER OF DATA: SSA will transmit the data to the State Agency under this IEA
using the data transmission method identified in Table 2 below:
TABLE2
TRANSFER OF DATA
D Data will be transmitted directly between SSA and the State Agency.
~ Data will be transmitted directly between SSA and The California Office of Technology
(State Transmission/Transfer Component ("STC")) by File Transfer Management System
(FTMS), a secure mechanism approved by SSA. The STC will serve as the conduit between SSA
and the State Agency pursuant to the State STC Agreement.
D Data will be transmitted directly between SSA and CMS' Hub by a secure method of transfer
approved by SSA. CMS will transmit the SSA Data Set between SSA and the State Agency
pursuant to an agreement between SSA and CMS regarding the use of the Hub.
D Data will be transmitted [select one: directly between SSA and the Interstate Connection
Network ("ICON") or through the [name of STC Agency/Vendor] as the conduit between SSA
and the Interstate Connection Network ("ICON")]. ICON is a wide area telecommunications
network connecting state agencies that administer the state unemployment insurance laws. When
receiving data through ICON, the State Agency will comply with the "Systems Security
Requirements for SSA Web Access to SSA Information Through the ICON," attached as
Attachment 3.
E. SECURITY PROCEDURES: The State Agency will comply with limitations on use ,
treatment, and safeguarding of data under the Privacy Act of 1974 (5 U .S.C. § 552a), as
amended by the Computer Matching and Privacy Protection Act of 1988 , related Office of
Management and Budget guidelines, the Federal Information Security Management Act of
2002 (44 U.S.C. § 3541, et seq.), and related National Institute of Standards and Technology
guidelines. In addition, the State Agency will comply with SSA's "Electronic Information
Exchange Security Requirements and Procedures for State and Local Agencies Exchanging
Electronic Information with the Social Security Administration," attached as Attachment 4 , as
well as the Security Certification Requirements for use of the SSA Data Set transmitted via
CMS' Hub, attached as Attachment 5. The SSA security controls identified under
Attachment 4 of this IEA prevail for all SSA data received by the State Agency, as identified
in Table 1 of this IEA. For any tax return data, the State Agency will also comply with the
"Tax Information Security Guidelines for Federal, State and Local Agencies," Publication
1075, published by the Secretary of the Treasury and available at the following Internal
Revenue Service (IRS) website: http ://www.irs.gov/pub/irs-pdf/p10 75 .pdf. This IRS
Publication 1075 is incorporated by reference into this IEA.
F. STATE AGENCY'S RESPONSIBILITIES: The State Agency will not direct individuals
to SSA field offices to obtain data that the State Agency is authorized to receive under this
IEA in accordance with Table 1. Where disparities exist between individual-supplied data
and SSA's data, the State Agency will take the following steps before referring the individual
to an SSA field office:
3
Exhibit E, Attachment B
• Check its records to be sure that the data of the original submission has not changed (e.g.,
last name recently changed);
• Contact the individual to verify the data submitted is accurate; and,
• Consult with the SSA Regional Office Contact to discuss options before advising
individuals to contact SSA for resolution. The Regional Office Contact will inform the
State Agency of the current protocol through which the individual should contact SSA,
i.e., visiting the field office, calling the national network service number, or creating an
online account via my Social Security.
G. CONTRACTOR/AGENT RESPONSIBILITIES: The State Agency will restrict access to
the data obtained from SSA to only those authorized State employees, contractors, and
agents who need such data to perform their official duties in connection with purposes
identified in this IEA. At SSA's request, the State Agency will obtain from each of its
contractors and agents a current list of the employees of its contractors and agents who have
access to SSA data disclosed under this IEA. The State Agency will require its contractors,
agents, and all employees of such contractors or agents with authorized access to the SSA
data disclosed under this IEA, to comply with the terms and conditions set forth in this IEA,
and not to duplicate, disseminate, or disclose such data without obtaining SSA's prior written
approval. In addition, the State Agency will comply with the limitations on use, duplication,
and redisclosure of SSA data set forth in Section IX. of the CMPPA Agreement, especially
with respect to its contractors and agents.
H. SAFEGUARDING AND REPORTING RESPONSIBILITIES FOR PERSONALLY
IDENTIFIABLE INFORMATION ("PII''):
1. The State Agency will ensure that its employees, contractors, and agents:
a. properly safeguard PII furnished by SSA under this IEA from loss, theft, or
inadvertent disclosure;
b. understand that they are responsible for safeguarding this information at all times,
regardless of whether or not the State employee, contractor, or agent is at his or her
regular duty station;
c. ensure that laptops and other electronic devices/media containing PII are encrypted
and/or password protected;
d. send emails containing PII only if encrypted or if to and from addresses that are
secure; and
e. limit disclosure of the information and details relating to a PII loss only to those with
a need to know.
2. If an employee of the State Agency or an employee of the State Agency's contractor or
agent becomes aware of suspected or actual loss of PII, he or she must immediately
contact the State Agency official responsible for Systems Security designated below or
his or her delegate. That State Agency official or delegate must then notify the SSA
Regional Office Contact and the SSA Systems Security Contact identified below. If, for
any reason, the responsible State Agency official or delegate is unable to notify the SSA
Regional Office or the SSA Systems Security Contact within 1 hour, the responsible State
Agency official or delegate must report the incident by contacting SSA's National
Network Service Center at 1-877-697-4889. The responsible State Agency official or
delegate will use the worksheet, attached as Attachment 6 , to quickly gather and
4
Exhibit E, Attachment B
organize information about the incident. The responsible State Agency official or
delegate must provide to SSA timely updates as any additional infom1ation about the loss
of PU becomes available.
3. SSA will make the necessary contact within SSA to file a formal report in accordance
with SSA procedures. SSA will notify the Department of Homeland Security's United
States Computer Emergency Readiness Team if loss or potential loss of PU related to a
data exchange under this IEA occurs.
4. If the State Agency experiences a loss or breach of data, it will determine whether or not
to provide notice to individuals whose data has been lost or breached and bear any costs
associated with the notice or any mitigation.
I. POINTS OF CONT ACT:
FOR SSA
San Francisco Regional Office:
Nancy Borjon
Data Exchange Coordinator
Frank Hagel Federal Building
1221 Nevin Avenue
Richmond, CA 94801
Phone: (510) 970-8256
Fax: (510) 970-8101
Email: Nancy.Borjon@ ssa.gov
Program and Policy Issues:
Michael Wilkins
State Liaison Program Manager
Office of Retirement and Disability Policy
Office of Data Exchange and Policy
Publications
Office of Data Exchange
3609 Annex Building
6401 Security Boulevard
Baltimore, MD 2123 5
Phone: ( 410) 966A965
Fax: (410) 966-4054
Email: Mich ael.Wilkin s@ ssa.gov
Systems Issues:
Michelle J. Anderson, Branch Chief
DBIAE/Data Exchange and Verification
Branch
Data Exchange Issues:
Sarah Reagan
Government Information Specialist
Office of the General Counse l
Office of Privacy and Disclosure
617 Altmeyer
6401 Security Boulevard
Baltimore, MD 2123 5
Phone: (410) 965-9127
Fax: (410) 594-0115
Email: Sarah.Reagan@ ssa.gov
Systems Security Issues:
Sean Hagan, Acting Director
Division of Compliance and
Assessments
Office of Information Security
Office of Systems
Social Security Administration
3829 Annex Building
6401 Security Boulevard
Baltimore, MD 2123 5
Phone: (410) 965-4519
Fax: ( 410) 597-0845
Email: Sean.Hagan@ ssa.gov
5
Exhibit E, Attachment B
Office of Information Technology Business
Support
Office of Systems
3-D-1 Robert M. Ball Building
6401 Security Boulevard
Baltimore, MD 21235
Phone: (410) 965-5943
Fax: (410) 966-3147
Email: Michelle.J.Anderson@ssa.gov
FOR STATE AGENCY
Agreement Issues:
Rocky Evans
Chief, Eligibility Administration Section
Program Review Branch
Medi-Cal Eligibility Division (MCED)
1501 Capitol Avenue
Sacramento, CA 95814
Phone: (916) 319-8434
Fax: (916) 552-9477
Email: Rocky.Evans@dhcs.ca. gov
Technical Issues:
YK Chalamcherla
Chief, Application Development &
Support Branch
Enterrprise Innovative Technology
Services (EITS)
1501 Capitol A venue
Sacramento, CA 95814
Phone: (916) 322-8044
Fax: (916) 440-7065
Email: YK.Chalamcherla@dhcs.ca.gov
Sean Wieland
Chief, Business & Application
Integration Section
Enterprise Innovative Technology
Services (EITS)
1501 Capitol A venue
Sacramento, CA 95814
Phone: (916) 550-7088
Fax: (916) 440-7065
Email: Sean.Wieland@dhcs .ca.gov
J. DURATION: The effective date ofthis IEA is March 6, 2017. This IEA will remain in
effect for as long as: (1) a CMPPA Agreement governing this IEA is in effect between SSA
and the State or the State Agency; and (2) the State Agency submits a certification in
accordance with Section K. below at least 30 days before the expiration and renewal of such
CMPP A Agreement.
K. CERTIFICATION AND PROGRAM CHANGES: At least 30 days before the expiration
and renewal of the State CMPP A Agreement governing this IEA, the State Agency will
certify in writing to SSA that: (1) it is in compliance with the terms and conditions of this
IEA; (2) the data exchange processes under this IEA have been and will be conducted
without change; and (3) it will, upon SSA's request, provide audit reports or other documents
that demonstrate review and oversight activities. If there are substantive changes in any of
the programs or data exchange processes listed in this IEA, the parties will modify the IEA in
6
Exhibit E, Attachment B
accordance with Section L. below and the State Agency will submit for SSA's approval new
program questionnaires under Section C. above describing such changes prior to using SSA's
data to administer such new or changed program.
L. MODIFICATION: Modifications to this IEA must be in writing and agreed to by the
parties.
M. TERMINATION: The parties may terminate this IEA at any time upon mutual written
consent. In addition, either party may unilaterally terminate this IEA upon 90 days advance
written notice to the other party. Such unilateral termination will be effective 90 days after
the date of the notice, or at a later date specified in the notice.
SSA may immediately and unilaterally suspend the data flow under this IEA, or terminate
this IEA, if SSA, in its sole discretion, determines that the State Agency (including its
employees, contractors, and agents) has: (1) made an unauthorized use or disclosure of
SSA-supplied data; or (2) violated or failed to follow the terms and conditions of this IEA or
the CMPP A Agreement.
N. INTEGRATION: This IEA, including all attachments, constitutes the entire agreement of
the parties with respect to its subject matter. There have been no representations , warranties,
or promises made outside of this IEA. This IEA shall take precedence over any other
document that may be in conflict with it.
ATTACHMENTS
1 -CMPP A Agreement
2 -SSA Data Exchange Systems
3 -Systems Security Requirements for SSA Web Access to SSA Information
Through ICON
4 -Electronic Information Exchange Security Requirements and Procedures for State and
Local Agencies Exchanging Electronic Information with the Social Security
Administration
5 -Security Certification Requirements for use of the SSA Data Set Transmitted via CMS'
Hub
6 -PII Loss R eporting Worksheet
7
Exhibit E, Attachment B
0. AUTHORIZED SIGNATURES: The signatories below warrant and represent that they
have competent authority on behalf of their respective agency to enter into the obligations set
forth in this IEA.
SOCIAL SECURITY ADMINISTRATION
REGION IX
Regional Commissioner
os/03/2-01-=1--
Date
THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES
Jennifer
Director, ifornia Department of Health Care Services
lf-/+/17
Date
8
Exhibit E, Attachment B
2017 IEA CERTIFICATION OF COMPLIANCE
{IEA/F)
CERTIFICATION OF COMPLIANCE
FOR
THE INFORMATION EXCHANGE AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION (SSA)
AND
THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES (STATE
AGENCY)
(State Agency Level)
In accordance with the terms of the Information Exchange Agreement (IENF) between SSA and
the State Agency, the State Agency, through its authorized representative, hereby certifies that,
as of the date of this certification:
1. The State Agency is in compliance with the terms and conditions of the IENF;
2. The State Agency has conducted the data exchange processes under the IENF without
change, except as modified in accordance with the IENF;
3. The State Agency will continue to conduct the data exchange processes under the IENF
without change, except as may be modified in accordance with the IENF;
4 . Upon SSA's request, the State Agency will provide audit reports or other documents that
demonstrate compliance with the review and oversight activities required under the
IENF and the governing Computer Matching and Privacy Protection Act Agreement;
and
5. In compliance with the requirements of the "Electronic Information Exchange Security
Requirements and Procedures for State and Local Agencies Exchanging E lectronic
Information with the Social Security Administration," (last updated July 2015)
Attachment 4 to the IENF, as periodically updated by SSA, the State Agency has not
made any changes in the following areas that could potentially affect the security of SSA
data:
• General S ystem Security Design and Operating Environment
• System Access Control
• Automated Audit Trail
• Monitoring and Anomaly Detection
• M anagement Oversight
• Data and Communications Security
• Contractor s of Electronic Information Exchange Partners
• Cloud Service Providers for Electronic Information Exchange Partners
1
Exhibit E, Attachment B
2017 I EA C ERTIFICAT ION OF C O MPLIANCE
(IEA/F)
The State Agency will submit an updated Security Design Plan at least 30 days prior to
making any changes to the areas listed above and provide updated contractor employee
lists before allowing new employees' access to SSA provided data.
6. The State Agency agrees that use of computer technology to transfer the data is more
economical, efficient, and faster than using a manual process. As such, the State Agency
will continue to utilize data exchange to obtain data it needs to administer the programs
for which it is authorized, unde r the IENF. Further, before directing an individual to an
SSA field office to obtain data, the State Agency will verify that the information it
submitted to SSA via data exchange is correct, and verify with the individual that the
information he /she supplied is accurate. The use of electronic data exchange expedites
program administration a nd limits SSA field office traffic.
The signato ry below warrants and represents that he or she is a representative of the State
Agency duly authorized to make this certification on behalf of the State Agency.
DEPARTMENT 01!' HEALTH CARE SERVICES OF CALIFORNIA
Jennifc~
Director
-D a te
2
ATTAC HMENT 1
COMPUTER MATCHING AND PRIVACY PROTECTION ACT AGREEMENT
(CMPPA)
Exhibit E, Attachment B
Exhibit E, Attachment B
COMPUTER MATCHING AND PRIVACY PROTECTION ACT AGREEMENT
BETWEEN
THE SOCIAL SECURITY ADMINISTRATION
AND
THE HEALTH AND HUMAN SERVICES AGENCY
OF CALIFORNIA
I. Purpose and Legal Authority
A. Purpose
This Computer Matching and Privacy Protection Act (CMPP A) Agreement
(Agreement) between the Social Security Administration (SSA) and the Health
and Human Services Agency of California (State Agency) set s forth the terms and
conditions governing disclosures of records, information, or data ( collectively
referred to herein as "data") made by SSA to the State Agency that administers
federally funded benefit programs, including those under various provisions of the
Social Security Act (Act), such as section 113 7 (42 U.S.C. § 1320b-7), as well as
the state-funded state supplementary payment programs under Title XVI of the
Act. The terms and conditions of this Agreement ensure that SSA makes such
disclosures of data, and the State Agency uses such disclosed data, in accordance
with the requirements of the Privacy Act of 1974, as amended by the CMPPA of
1988, 5 U.S .C. § 552a.
Under section 1137 of the Act, the State Agency is required to use an income and
eligibility verification system to administer specified federally funded benefit
programs, including the state-funded state supplementary payment programs
under Title XVI of the Act. To assist the State Agency in determining entitlement
to and eligibility for benefits under those programs, as well as other federally
funded benefit programs, SSA discloses certain data about applicants ( and in
limited circumstances, members of an applicant's household), for state benefits
from SSA Privacy Act Systems of Records (SOR) and verifies the Social Security
numbers (SSN) of the applicants.
B. Legal Authority
SSA 's authority to disclose data and the State Agency 's authority to collect,
maintain, and use data protected under SSA SO Rs for specified purposes is:
• Sections 453 , 1106(b), and 1137 of the Act (42 U.S.C. §§ 653, 1306(b),
and 1320b-7) (income and eligibility verification data);
• 26 U.S.C. § 6103(1)(7) and (8) (tax return data);
• Section 202(x)(3)(B)(iv) of the Act (42 U.S.C. § 402(x)(3)(B)(iv)) and
Section 161 l(e)(l)(I)(iii) of the Act (42 U .S .C. § 1382(e)(l)(I)(iii))
(prisoner data);
Exhibit E, Attachment B
• Section 205(r)(3) of the Act (42 U.S.C. § 405(r)(3)) and the Intelligence
Reform and Terrorism Prevention Act of 2004, Pub. L. 108-458,
§ 7213(a)(2) (death data);
• Sections 402,412,421 , and 435 of Pub. L. 104-193 (8 U.S.C. §§ 1612,
1622, 1631, and 1645) (quarters of coverage data);
• Children's Health Insurance Program Reauthorization Act of 2009
(CHIPRA), Pub. L. 111-3 (citizenship data); and
• Routine use exception to the Privacy Act, 5 U.S.C. § 552a(b)(3) (data
necessary to administer other programs compatible with SSA programs).
2
This Agreement further carries out section l 106(a) of the Act (42 U.S.C. § 1306),
the regulations promulgated pursuant to that section (20 C.F.R. Part 401), the
Privacy Act of 1974 (5 U.S .C. § 552a), as amended by the CMPPA, related Office
of Management and Budget (0MB) guidelines, the Federal Information Security
Management Act of 2002 (FISMA) (44 U.S.C. § 3541 , et seq.), as amended by
the Federal Information Security Modernization Act of2014 (Pub. L. 113-283);
and related National Institute of Standards and Technology (NIST) guidelines,
which provide the requirements that the State Agency must follow with regard to
use, treatment, and safeguarding of data.
II. Scope
A. The State Agency will comply with the terms and conditions of this Agreement
and the Privacy Act, as amended by the CMPP A.
B. The State Agency will execute an Information Exchange Agreement (IEA) with
SSA, documenting additional terms and conditions applicable to those specific
data exchanges, including the particular benefit programs administered by the
State Agency, the data elements that will be disclosed, and the data protection
requirements implemented to assist the State Agency in the administration of
those programs.
C. The State Agency will use the SSA data governed by this Agreement to determine
entitlement and eligibility of individuals for one or more of the following
programs, which are specifically identified in the IEA:
1. Temporary Assistance to Needy Families (T ANF) program under Part A
of Title IV of the Act;
2 . Medicaid provided under an approved State plan or an approved waiver under
Title XIX of the Act;
3. State Children's Health Ins urance Program (CHIP) under Title XXI of
the Act, as amended by the Children's Health Insurance Program
Reauthorization Act of2009;
Exhibit E, Attachment B
4. Supplemental Nutritional Assistance Program (SNAP) under the Food Stamp
Act of 1977 (7 U.S.C. § 2011 , et seq.);
5. Women, Infants and Children Program (WIC) under the Child Nutrition Act
of 1966 (42 U.S .C. § 1771, et seq.);
6. Medicare Savings Programs (MSP) under 42 U .S.C. § 1396a(10)(E);
3
7. Unemployment Compensation programs provided under a state law described
in section 3304 of the Internal Revenue Code of 1954;
8. Low Income Heating and Energy Assistance (LIHEAP or home energy
grants) program under 42 U.S.C. § 8621;
9. State-administered supplementary payments of the type described in
section 1616(a) of the Act;
10. Programs under a plan approved under Titles I, X, XIV, or XVI of the Act;
11. Foster Care and Adoption Assistance under Title IV of the Act;
12. Child Support Enforcement programs under section 453 of the Act
(42 U.S.C. § 653);
13. Other applicable federally funded programs administered by the State Agency
under Titles I , IV, X, XIV, XVI, XVIII, XIX, XX, and XXI of the Act; and
14. Any other federally funded programs administered by the State Agency that
are compatible with SSA 's programs.
D. The State Agency will ensure that SSA data disclosed for the specific purpose of
administering a particular federally funded benefit program is used only to
administer that program.
III. Justification and Expected Results
A . Justification
This Agreement and related data exchanges with the State Agency are necessary
for SSA to assist the State Agency in its administration of federally funded benefit
programs by providing the data required to accurately determine entitlement and
eligibility of individuals for benefits provided under these programs. SSA uses
computer technology to transfer the data because it is more economical, efficient,
and faster than using manual processes.
B. Expected Results
The State Agency will use the data provided by SSA to improve public service
and program efficiency and integrity. The use of SSA data expedites the
application process and ensures that benefits are awarded only to applicants that
satisfy the State Agency's program criteria. A cost-benefit analysis for the
exchange made under this Agreement is not required in accordance with the
determination by the SSA Data Integrity Board (DIB) to waive such analysis
pursuant to 5 U.S .C. § 552a(u)(4)(B).
Exhibit E, Attachment B
IV. Record Description
A. Systems of Records (SOR)
SSA SORs used for purposes of the subject data exchanges include:
• 60-0058 --Master Files of SSN Holders and SSN Applications;
• 60-0059 --Earnings Recording and Self-Employment Income System;
• 60-0090 --Master Beneficiary Record;
• 60-0103 --Supplemental Security Income Record (SSR) and Special
Veterans Benefits (SVB);
• 60-0269 --Prisoner Update Processing System (PUPS); and
• 60-0321 --Medicare Part D and Part D Subsidy File.
The State Agency will only use the tax return data contained in SOR 60-0059
(Earnings Recording and Self-Employment Income System) in accordance with
26 U.S.C. § 6103.
B. Data Elements
Data elements disclosed in computer matching governed by this Agreement are
Personally Identifiable Information (PII) from specified SSA SORs, including
names, SSNs, addresses , amounts, and other information related to SSA benefits
and earnings information. Specific listings of data elements are available at:
http://www.ssa.gov/dataexchange/
C . Number of Records Involved
4
The maximum number of records involved in this matching activity is the number
ofrecords maintained in SSA 's SORs listed above in Section IV.A.
V. Notice and Opportunity to Contest Procedures
A. Notice to Applicants
The State Agency will notify all individuals who apply for federally funded,
state-administered benefits that any data they provide are subject to verification
through computer matching with SSA. The State Agency and SSA will provide
such notice through appropriate language printed on application forms or separate
handouts.
Exhibit E, Attachment B
B. Notice to Beneficiaries/Recipients/ Annuitants
The State Agency will provide notice to beneficiaries, recipients, and annuitants
under the programs covered by this Agreement informing them of ongoing
computer matching with SSA. SSA will provide such notice through publication
in the Federal Register and periodic mailings to all beneficiaries, recipients, and
annuitants describing SSA's matching activities.
C. Opportunity to Contest
5
The State Agency will not terminate, suspend, reduce, deny, or take other adverse
action against an applicant for or recipient of federally funded , state-administered
benefits based on data disclosed by SSA from its SORs until the individual is
notified in writing of the potential adverse action and provided an opportunity to
contest the planned action. "Adverse action" means any action that results in a
termination, suspension, reduction, or final denial of eligibility, payment, or
benefit. Such notices will:
1. Inform the individual of the match findings and the opportunity to contest
these findings;
2. Give the individual until the expiration of any time period established for the
relevant program by a statute or regulation for the individual to respond to
the notice. If no such time period is established by a statute or regulation for
the program, a 30-day period will be provided. The time period begins on
the date on which notice is mailed or otherwise provided to the individual to
respond; and
3 . Clearly state that, unless the individual responds to the notice in the required
time period, the State Agency will conclude that the SSA data are correct and
will effectuate the planned action or otherwise make the necessary
adjustment to the individual's benefit or entitlement.
VI. Records Accuracy Assessment and Verification Procedures
Pursuant to 5 U.S.C. § 552a(p)(l)(A)(ii), SSA's DIB has determined that the State
Agency may use SSA's benefit data without independent verification. SSA has
independently assessed the accuracy of its benefits data to be more than 99 percent
accurate when the benefit record is created.
Prisoner and death data, some of which is not independently verified by SSA, does
not have the same degree of accuracy as SSA 's benefit data. Therefore, the State
Agency mus t independently verify these data through applicable State verification
procedures and the notice and opportunity to contest procedures specified in
Section V of this Agreement before taking any adverse action against any individual.
Exhibit E, Attachment B
Based on SSA's Office of Quality Review "Fiscal Year 2014 Enumeration Accuracy
Report," the SSA Enumeration System database (the Master Files of SSN Holders
and SSN Applications System) used for SSN matching is 99 percent accurate for
records updated by SSA employees.
6
Individuals applying for SSNs report their citizenship status at the time they apply for
their SSNs. There is no obligation for an individual to report to SSA a change in his
or her immigration status until he or she files for a Social Security benefit. The State
Agency must independently verify citizenship data through applicable State
verification procedures and the notice and opportunity to contest procedures specified
in Section V of this Agreement before taking any adverse action against any
individual.
VII. Disposition and Records Retention of Matched Items
A. The State Agency will retain all data received from SSA to administer programs
governed by this Agreement only for the required processing times for the
applicable federally funded benefit programs and will then destroy all such data.
B. The State Agency may retain SSA data in hardcopy to meet evidentiary
requirements, provided that they retire such data in accordance with applicable
state laws governing the State Agency's retention of records.
C. The State Agency may use any accretions, deletions, or changes to the SSA data
governed by this Agreement to update their master files of federally funded,
state-administered benefit program applicants and recipients and retain such
master files in accordance with applicable state laws governing the State
Agency's retention of records.
D. The State Agency may not create separate files or records comprised solely of the
data provided by SSA to administer programs governed by this Agreement.
E. SSA will delete electronic data input files received from the State Agency after it
processes the applicable match. SSA will retire its data in accordance with the
Federal Records Retention Schedule (44 U.S.C. § 3303a).
VIII. Security Procedures
SSA and the State Agency will comply with the security and safeguarding
requirements of the Privacy Act, as amended by the CMPPA, related 0MB
guidelines, FISMA, related NIST guidelines, and the current revision of Internal
Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for
Federal, State and Local Agencies, available at http://www.irs.gov. In addition, SSA
Exhibit E, Attachment B
and the State Agency will have in place administrative, technical, and physical
safeguards for the matched data and results of such matches. Additional
administrative, technical, and physical security requirements governing all data SSA
provides electronically to the State Agency, including SSA's Electronic Information
Exchange Security Requirements and Procedures for State and local Agencies
Exchanging Electronic Information with SSA , as well as specific guidance on
safeguarding and reporting responsibilities for PII, are set forth in the IEAs.
SSA has the right to monitor the State Agency's compliance with FISMA, the terms
of this Agreement, and the IEA and to make onsite inspections of the State Agency
for purposes of auditing compliance, if necessary, during the lifetime of this
Agreement or of any extension of this Agreement. This right includes onsite
inspection of any entity that receives SSA information from the State Agency under
the terms of this Agreement, if SSA determines it is necessary.
IX. Records Usage, Duplication, and Redisclosure Restrictions
7
A. The State Agency will use and access SSA data and the records created using that
data only for the purpose of verifying eligibility for the specific federally funded
benefit programs identified in the IEA.
B. The State Agency will comply with the following limitations on use, duplication,
and redisclosure of SSA data:
1. The State Agency will not use or redisclose the data disclosed by SSA for any
purpose other than to determine eligibility for, or the amount of, benefits
under the state-administered income/health maintenance programs identified
in this Agreement.
2. The State Agency will not extract information concerning individuals who are
neither applicants for, nor reci pients of, benefits under the state-administered
income/health maintenance programs identified in this Agreement. In limited
circumstances that are approved by SSA, the State Agency may extract
information about an individual other than the applicant/recipient when the
applicant/recipient has provided identifying information about the individual
and the individual 's income or resources affect the applicant's/recipient's
eligibility for such program.
3. The State Agency will not disclose to an applicant/recipient information about
another individual (i.e., an applicant's household member) without the written
consent from the individual to whom the information pertains.
4. The State Agency will u se the Federal tax information (FTI) disclosed by SSA
only to d etermine individual eligibility for, or the amount of, assistance under
a state plan pursuant to section 113 7 programs and child support enforcement
Exhibit E, Attachment B
programs in accordance with 26 U.S.C. § 6103(1)(7) and (8). The State
Agency receiving FTI will maintain all FTI from IRS in accordance with
8
26 U.S.C . § 6103(p)(4) and the IRS Publication 1075. Contractors and agents
acting on behalf of the State Agency will only have access to tax return data
where specifically authorized by 26 U.S.C. § 6103 and the current revision
IRS Publication 1075.
5. The State Agency will use the citizenship status data disclosed by SSA onl y to
determine entitlement of new applicants to: (a) the Medicaid program and
CHIP pursuant to CHIPRA, Pub. L. 111 -3; or (b) federally funded,
state-administered health or income maintenance programs approved by SSA.
The State Agency will further comply with additional terms and conditions
regarding use of citizenship data, as set forth in the State Agency's IEA.
6. The State Agency will restrict access to the data disclosed by SSA to only
those authorized State employees, contractors, and agents who need such data
to perform their official duties in connection with the purposes identified in
this Agreement.
7 . The State Agency will enter into a written agreement with each of its
contractors and agents who need SSA data to perform their official duties
whereby such contractor or agent agrees to abide by all relevant Federal laws,
restrictions on access, use, and disclosure, and security requirements in this
Agreement. The State Agency will provide its contractors and agents with
copies of this Agreement, related IEAs, and all related attachments before
initial disclosure of SSA data to such contractors and agents. Prior to signing
this Agreement, and thereafter at SSA's request, the State Agency will obtain
from its contractors and agents a current list of the employees of such
contractors and agents with access to SSA data and provide such lists to SSA.
8. If the State Agency is authorized or required-pursuant to an applicable law,
regulation, or intra-governmental documentation -to provide SSA data to
another State or local government entity for the administration of the federally
funded, state-administered programs covered by this Agreement, the State
Agency must ensure that the State or local government entity, including its
employees, abides by all relevant Federal laws, restrictions on access, use, and
disclosure, and security requirements in this Agreement and the IEA. At
SSA's request, the State Agency will provide copies of any applicable law,
regulation, or intra-governmental documentation that authorizes the
intra-governmental relationship with the State or local government entity.
Upon request from SSA, the State Agency will also establish how it ensures
that State or local government entity complies with the terms of this
Agreement and the IEA.
9 . The State Agency's employees, contractors, and agents who access, use, or
disclose SSA data in a manner or purpose not authorized by this Agreement
Exhibit E, Attachment B
may be subject to civil and criminal sanctions pursuant to applicable Federal
statutes.
9
10. The State Agency will conduct triennial compliance reviews of its
contractor(s) and agent(s) no later than three years after the initial approval of
the security certification to SSA. The State Agency will share documentation
of its recurring compliance reviews with its contractor(s) and agent(s) with
SSA. The State Agency will provide documentation to SSA during its
scheduled compliance and certification reviews or upon request.
C. The State Agency will not duplicate in a separate file or disseminate, without prior
written permission from SSA, the data governed by this Agreement for any
purpose other than to determine entitlement to, or eligibility for, federally funded
benefits. The State Agency proposing the redisclosure must specify in writing to
SSA what data are being disclosed, to whom, and the reasons that justify the
redisclosure. SSA will not give permission for such redisclosure unless the
redisclosure is required by law or essential to the conduct of t he matching
program and authorized under a routine use. To the extent SSA approves the
requested redisclosure, the State Agency will ensure that any entity receiving the
redisclosed data will comply with the procedures and limitations on use,
duplication, and redisclosure of SSA data, as well as all administrative, technical,
and physical security requirements governing all data SSA provides electronically
to the State Agency including specific guidance on safeguarding and reporting
responsibilities for PU, as set forth in this Agreement and the accompanying
IEAs.
X. Comptroller General Access
The Comptroller General (the Government Accountability Office) may have access to
all records of the State Agency that the Comptroller General deems necessary to
monitor and verify compliance with this Agreement in accordance with
5 U.S.C. § 552a(o)(I)(K).
XI. Duration, Modification, and Termination of the Agreement
A. Duration
1. This Agreement is effective from July 1, 2017 (Effective Date) through
December 31, 2018 (Expiration Date).
2. In accordance with the CMPPA, SSA will: (a) publish a Computer
Matching Notice in the Federal Register at least 30 days prior to the
Effective Date; (b) send required notices to the Congressional committees of
jurisdiction under 5 U.S.C. § 552a(o)(2)(A)(i) at least 40 day s prior to the
Exhibit E, Attachment B
Effective Date; and (c) send the required report to 0MB at least 40 days
prior to the Effective Date.
3. Within 3 months prior the Expiration Date, the SSA DIB may, without
additional review, renew this Agreement for a period not to exceed
12 months, pursuant to 5 U.S.C. § 552a(o)(2)(D), if:
• the applicable data exchange will continue without any change; and
• SSA and the State Agency certify to the DIB in writing that the
applicable data exchange has been conducted in compliance with this
Agreement.
10
4. If either SSA or the State Agency does not wish to renew this Agreement, it
must notify the other party of its intent not to renew at least 3 months prior
to the Expiration Date.
B. Modification
Any modification to this Agreement must be in writing, signed by both parties,
and approved by the SSA DIB.
C. Termination
The parties may terminate this Agreement at any time upon mutual written
consent of both parties. Either party may unilaterally terminate this Agreement
upon 90 days advance written notice to the other party; such unilateral termination
will be effective 90 days after the date of the notice, or at a later date specified in
the notice.
SSA may immediately and unilaterally suspend the data flow or terminate this
Agreement if SSA determines, in its sole discretion, that the State Agency has
violated or failed to comply with this Agreement.
XII . Reimbursement
In accordance with section 1106(b) of the Act, the Commissioner of SSA has
determined not to charge the State Agency the costs of furnishing the electronic data
from the SSA SORs under this Agreement.
XIII. Disclaimer
SSA is not liable for any damages or loss resulting from errors in the data provided
to the State Agency under any IEAs governed by this Agreement. Furthermore, SSA
Exhibit E, Attachment B
is not liable for any damages or loss resulting from the destruction of any materials
or data provided by the State Agency.
11
The performance or delivery by SSA of the goods and/or services described herein
and the timeliness of said delivery are authorized only to the extent that they are
consistent with proper performance of the official duties and obligations of SSA and
the relative importance of this request to others. If for any reason SSA delays or
fails to provide services, or discontinues the services or any part thereof, SSA is not
liable for any damages or loss resulting from such delay or for any such failure or
discontinuance.
XIV. Points of Contact
A. SSA Point of Contact
San Francisco Regional Office:
Jamie Lucero, Director
San Francisco Regional Office, Center for Disability and Programs Support
1221 Nevin Ave., 6 th Floor
Richmond, CA 94801
Phone: 510-970-8297
Fax: 510-970-8101
Email: Jamie.Lucero@ ssa.gov
B. State Agency Point of Contact
Sonia Herrera
California Health and Human Services Agency
1600 Ninth Street
Sacramento, CA 95814
Phone: 916-654-3459 I Fax: 916-440-5001
Email: Sonia.Herrera@ chhs.ca.gov
Exhibit E, Attachment B
XV. SSA and Data Integrity Board Approval of Model CMPPA Agreement
The signatories below warrant and represent that they have the competent author ity
on behalf of SSA to approve the model of this CMPP A Agreement.
SOCIAL SECURITY ADMINISTRATION
.t.l.:JfL) -kiA.111..I...LJ~-17 %:' ·,
ary Zi mm an
A c ting D e puty E xec uti ve Directo r
Office o f Privacy and D isclosure
Office of the Ge ne ral Counsel
I certify that the SSA Data Integrity Board approved the model of this CMPPA
Agreement.
~)b _____ ttL,'-----"'------·-
Glenn Sklar
Acting Chair
SS A Data Integrity Boa rd
Date
12
Exhibit E, Attachment B
XVI. Authorized Signatures
The signatories below warrant and represent that they have the competent authority
on behalf of their respective agency to enter into the obligations set forth in this
Agreement.
SOCIAL SECURITY ADMINISTRATION
Date
HEALTH AND HUMAN SERVICES AGENCY
13
ATTACHMENT 2
AUTHORIZED DATA EXCHANGE SYSTEM(S)
Exhibit E, Attachment B
Attachment 2
Authorized Data Exchange System(s)
BEER (Beneficiary Earnings Exchange Record): Employer data for the last calendar year.
BENDEX (Beneficiary and Earnings Data Exchange): Primary source for Title II eligibility,
benefit and demographic data.
LIS (Low-Income Subsidy): Data from the Low-Income Subsidy Application for Medicare Part
D beneficiaries -- used for Medicare Savings Programs (MSP).
Medicare 1144 (Outreach): Lists of individuals on SSA roles, who may be eligible for medical
assistance for: payment of the cost of Medicare cost-sharing under the Medicaid program
pursuant to Sections 1902(a)(10)(E) and 1933 of the Act; transitional assistance under Section
1860D-31(f) of the Act; or premiums and cost-sharing subsidies for low-income individuals
under Section 1860D-14 of the Act.
PUPS (Prisoner Update Processing System): Confinement data received from over 2000 state
and local institutions (such as jails, prisons, or other penal institutions or correctional facilities) --
PUPS matches the received data with the MBR and SSR benefit data and generates alerts for
review/action.
QUARTERS OF COVERAGE (QC): Quarters of Coverage data as assigned and described
under Title II of the Act -- The term "quarters of coverage" is also referred to as "credits" or
“Social Security credits” in various SSA public information documents, as well as to refer to
"qualifying quarters" to determine entitlement to receive Food Stamps.
SDX (SSI State Data Exchange): Primary source of Title XVI eligibility, benefit and
demographic data as well as data for Title VIII Special Veterans Benefits (SVB).
SOLQ/SOLQ-I (State On-line Query/State On-line Query-Internet): A real-time online
system that provides SSN verification and MBR and SSR benefit data similar to data provided
through SVES.
Exhibit E, Attachment B
2
Attachment 2
SVES (State Verification and Exchange System): A batch system that provides SSN
verification, MBR benefit information, and SSR information through a uniform data
response based on authorized user-initiated queries. The SVES types are divided into
five different responses as follows:
SVES I: This batch provides strictly SSN verification.
SVES I/Citizenship* This batch provides strictly SSN verification and
citizenship data.
SVES II: This batch provides strictly SSN verification and
MBR benefit information
SVES III: This batch provides strictly SSN verification and
SSR/SVB.
SVES IV: This batch provides SSN verification, MBR benefit
information, and SSR/SVB information, which
represents all available SVES data.
* Citizenship status data disclosed by SSA under the Children’s Health Insurance
Program Reauthorization Act of 2009, Pub. L. 111-3 is only for the purpose of
determining entitlement to Medicaid and CHIP program for new applicants.
Exhibit E, Attachment B
ATTACHMENT 3
SYSTEM SECURITY REQUIREMENTS THROUGH THE ICON SYSTEM
Not Applicable
Exhibit E, Attachment B
Attachment 3
Systems Security Requirements for SWA Access
to SSA Information Through the ICON System
12/9/2016
Exhibit E, Attachment B
2
Systems Security Requirements for SWA Access to
SSA Information Through the ICON System
A. General Systems Security Standards
SWA’s that request and receive information from SSA through the ICON system
must comply with the following general systems security standards concerning access
to and control of SSA information. The SWA must restrict access to the information
to authorized employees who need it to perform their official duties. Similar to IRS
requirements, information retrieved from SSA must be stored in a manner that is
physically and electronically secure from access by unauthorized persons during both
duty and non-duty hours, or when not in use. SSA information must be processed
under the immediate supervision and control of authorized personnel. The SWA must
employ both physical and electronic safeguards to ensure that unauthorized personnel
cannot retrieve SSA information by means of computer, remote terminal or other
means.
All persons who will have access to any SSA information must be advised of the
confidentiality of the information, the safeguards required to protect the information,
and the civil and criminal sanctions for non-compliance contained in the applicable
Federal and State laws. SSA may, at its discretion, make on-site inspections or other
provisions to ensure that adequate safeguards are being maintained by the SWA.
B. System Security Requirements for SWA’s
SWA’s that receive SSA information through the ICON system must comply with the
following systems security requirements which must be met before DOL will approve
a request from an SWA for online access to SSA information through the ICON
system. The SWA system security design and procedures must conform to these
requirements. They must be documented by the SWA and subsequently certified by
either DOL or by an Independent Verification and Validation (IV&V) contractor prior
to initiating transactions to and from SSA through the ICON.
No specific format for submitting this documentation to DOL is required. However,
regardless of how it is presented, the information should be submitted to DOL in both
hardcopy and electronic format, and the hardcopy should be submitted over the
signature of an official representative of the SWA. Written documentation should
address each of the following security control areas:
Exhibit E, Attachment B
3
1. General System Security Design and Operating Environment
The SWA must provide a written description of its’ system configuration and
security features. This should include the following:
a. A general description of the major hardware, software and communications
platforms currently in use, including a description of the system’s security
design features and user access controls; and
b. A description of how SSA information will be obtained by and presented to
SWA users, including sample computer screen presentation formats and an
explanation of whether the SWA system will request information from SSA
by means of systems generated or user initiated transactions; and
c. A description of the organizational structure and relationships between
systems managers, systems security personnel, and users, including an
estimate of the number of users that will have access to SSA data within the
SWA system and an explanation of their job descriptions.
Meeting this Requirement
SWA’s must explain in their documentation the overall design and security
features of their system. During onsite certification, the IV&V contractor, or other
certifier, will use the SWA’s design documentation and discussion of the
additional systems security requirements (following) as their guide for conducting
the onsite certification and for verifying that the SWA systems and procedures
conform to SSA requirements.
Following submission to the DOL in connection with the initial certification
process, the documentation must be updated any time significant architectural
changes are made to the system or to its’ security features. During its future
compliance reviews (see below), the SSA will ask to review the updated design
documentation as needed.
2. Automated Audit Trail
SWA’s receiving SSA information through the ICON system must implement and
maintain a fully automated audit trail system capable of data collection, data
retrieval and data storage. At a minimum, data collected through the audit trail
system must associate each query transaction to its initiator and relevant business
purpose (i.e. the SWA client record for which SSA data was requested), and each
transaction must be time and date stamped. Each query transaction must be stored
Exhibit E, Attachment B
4
in the audit file as a separate record, not overlaid by subsequent query
transactions.
Access to the audit file must be restricted to authorized users with a “need to
know” and audit file data must be unalterable (read only) and maintained for a
minimum of three (preferably seven) years. Retrieval of information from the
automated audit trail may be accomplished online or through batch access. This
requirement must be met before DOL will approve the SWA’s request for access
to SSA information through the ICON system.
If SSA-supplied information is retained in the SWA system, or if certain data
elements within the SWA system will indicate to users that the information has
been verified by SSA, the SWA system also must capture an audit trail record of
any user who views SSA information stored within the SWA system. The audit
trail requirements for these inquiry transactions are the same as those outlined
above for SWA transactions requesting information directly from SSA.
Meeting this Requirement
The SWA must include in their documentation a description of their audit trail
capability and a discussion of how it conforms to SSA’s requirements. During
onsite certification, the IV&V contractor, or other certifier, will request a
demonstration of the system’s audit trail and retrieval capability. The SWA must
be able to identify employee’s who initiate online requests for SSA information
(or, for systems generated transaction designs, the SWA case that triggered the
transaction), the time and date of the request, and the purpose for which the
transaction was originated. The certifier, or IV&V contractor, also will request a
demonstration of the system’s audit trail capability for tracking the activity of
SWA employees that are permitted to view SSA supplied information within the
SWA system, if applicable.
During its future compliance reviews (see below), the SSA also will test the SWA
audit trail capability by requesting verification of a sample of transactions it has
processed from the SWA after implementation of access to SSA information
through the ICON system.
3. System Access Control
The SWA must utilize and maintain technological (logical) access controls that
limit access to SSA information to only those users authorized for such access
based on their official duties. The SWA must use a recognized user access
security software package (e.g. RAC-F, ACF-2, TOP SECRET) or an equivalent
security software design. The access control software must utilize personal
identification numbers (PIN) and passwords (or biometric identifiers) in
combination with the user’s system identification code. The SWA must have
Exhibit E, Attachment B
5
management control and oversight of the function of authorizing individual user
access to SSA information, and over the process of issuing and maintaining access
control PINs and passwords for access to the SWA system.
Meeting this Requirement
The SWA must include in their documentation a description of their technological
access controls, including identifying the type of software used, an overview of
the process used to grant access to protected information for workers in different
job categories, and a description of the function responsible for PIN/password
issuance and maintenance.
During onsite certification, the IV&V contractor, or other certifier, will meet with
the individual(s) responsible for these functions to verify their responsibilities in
the SWA’s access control process and will observe a demonstration of the
procedures for logging onto the SWA system and for accessing SSA information.
4. Monitoring and Anomaly Detection
The SWA’s system must include the capability to prevent employees from
browsing (i.e. unauthorized access or use of SSA information) SSA records for
information not related to an SWA client case (e.g. celebrities, SWA employees,
relatives, etc.) If the SWA system design is transaction driven (i.e. employees
cannot initiate transactions themselves, rather, the SWA system triggers the
transaction to SSA), or if the design includes a “permission module” (i.e. the
transaction requesting information from SSA cannot be triggered by an SWA
employee unless the SWA system contains a record containing the client’s Social
Security Number), then the SWA needs only minimal additional monitoring and
anomaly detection. If such designs are used, the SWA only needs to monitor any
attempts by their employees to obtain information from SSA for clients not in
their client system, or attempts to gain access to SSA data within the SWA system
by employees not authorized to have access to such information.
If the SWA design does not include either of the security control features
described above, then the SWA must develop and implement compensating
security controls to prevent their employees from browsing SSA records. These
controls must include monitoring and anomaly detection features, either
systematic, manual, or a combination thereof. Such features must include the
capability to detect anomalies in the volume and/or type of queries requested by
individual SWA employees, and systematic or manual procedures for verifying
that requests for SSA information are in compliance with valid official business
purposes. The SWA system must produce reports providing SWA management
and/or supervisors with the capability to appropriately monitor user activity, such
as:
Exhibit E, Attachment B
6
User ID exception reports
This type of report captures information about users who enter incorrect
user ID’s when attempting to gain access to the system or to the
transaction that initiates requests for information from SSA, including
failed attempts to enter a password.
Inquiry match exception reports
This type of report captures information about users who may be initiating
transactions for Social Security Numbers that have no client case
association within the SWA system.
System error exception reports
This type of report captures information about users who may not
understand or be following proper procedures for access to SSA
information through the ICON system.
Inquiry activity statistical reports
This type of report captures information about transaction usage patterns
among authorized users, which would provide SWA management a tool
for monitoring typical usage patterns compared to extraordinary usage.
The SWA must have a process for distributing these monitoring and exception
reports to appropriate local managers/supervisors, or to local security officers, to
ensure that the reports are used by those whose responsibilities include monitoring
the work of the authorized users.
Meeting this Requirement
The SWA must explain in their documentation how their system design will
monitor and/or prevent their employees from browsing SSA information. If the
design is based on a “permission module” (see above), a similar design, or is
transaction driven (i.e. no employee initiated transactions) then the SWA does not
need to implement additional systematic and/or managerial oversight procedures
to monitor their employees access to SSA information. The SWA only needs to
monitor user access control violations. The documentation should clearly explain
how the system design will prevent SWA employees from browsing SSA records.
If the SWA system design permits employee initiated transactions that are
uncontrolled (i.e. no systematically enforced relationship to an SWA client), then
the SWA must develop and document the monitoring and anomaly detection
process they will employ to deter their employees from browsing SSA
Exhibit E, Attachment B
7
information. The SWA should include sample report formats demonstrating their
capability to produce the types of reports described above, and the SWA should
include a description of the process that will be used to distribute these reports to
managers/supervisors, and the management controls that will ensure the reports
are used for their intended purpose.
During onsite certification, the IV&V contractor, or other certifier, will request a
demonstration of the SWA’s monitoring and anomaly detection capability.
If the design is based on a permission module or similar design, or is
transaction driven, the SWA will demonstrate how the system triggers requests for
information from SSA.
If the design is based on a permission module, the SWA will demonstrate the
process by which requests for SSA information are prevented for Social Security
Numbers not present in the SWA system (e.g. by attempting to obtain information
from SSA using at least one, randomly created, fictitious number not known to the
SWA system.)
If the design is based on systematic and/or managerial monitoring and
oversight, the SWA will provide copies of anomaly detection reports and
demonstrate the report production capability.
During onsite certification, the IV&V contractor, or other certifier, also will meet
with a sample of managers and/or supervisors responsible for monitoring ongoing
compliance to assess their level of training to monitor their employee’s use of
SSA information, and for reviewing reports and taking necessary action.
5. Management Oversight and Quality Assurance
The SWA must establish and/or maintain ongoing management oversight and
quality assurance capabilities to ensure that only authorized employees have
access to SSA information through the ICON system, and to ensure there is
ongoing compliance with the terms of the SWA’s data exchange agreement with
SSA. The management oversight function must consist of one or more SWA
management officials whose job functions include responsibility for assuring that
access to and use of SSA information is appropriate for each employee position
type for which access is granted.
This function also should include responsibility for assuring that employees
granted access to SSA information receive adequate training on the sensitivity of
the information, safeguards that must be followed, and the penalties for misuse,
and should perform periodic self-reviews to monitor ongoing usage of the online
access to SSA information. In addition, there should be the capability to
randomly sample work activity involving online requests for SSA information to
Exhibit E, Attachment B
8
determine whether the requests comply with these guidelines. These functions
should be performed by SWA employees whose job functions are separate from
those who request or use information from SSA.
Meeting this Requirement
The SWA must document that they will establish and/or maintain ongoing
management oversight and quality assurance capabilities for monitoring the
issuance and maintenance of user ID’s for online access to SSA information, and
oversight and monitoring of the use of SSA information within the SWA business
process. The outside entity should describe how these functions will be
performed within their organization and identify the individual(s) or component(s)
responsible for performing these functions.
During onsite certification, the IV&V contractor, or other certifier, will meet with
the individual(s) responsible for these functions and request a description of how
these responsibilities will be carried out.
6. Security Awareness and Employee Sanctions
The SWA must establish and/or maintain an ongoing function that is responsible
for providing security awareness training for employees that includes information
about their responsibility for proper use and protection of SSA information, and
the possible sanctions for misuse. Security awareness training should occur
periodically or as needed, and should address the Privacy Act and other Federal
and State laws governing use and misuse of protected information. In addition,
there should be in place a series of administrative procedures for sanctioning
employees who violate these laws through the unlawful disclosure of protected
information.
Meeting this Requirement
The SWA must document that they will establish and/or maintain an ongoing
function responsible for providing security awareness training for employees that
includes information about their responsibility for proper use and protection of
SSA information, and the possible sanctions for misuse of SSA information. The
SWA should describe how these functions will be performed within their
organization, identify the individual(s) or component(s) responsible for
performing the functions, and submit copies of existing procedures, training
material and employee acknowledgment statements.
During onsite certification, the IV&V contractor, or other certifier, will meet with
the individuals responsible for these functions and request a description of how
these responsibilities are carried out. The IV&V contractor, or other certifier, also
will meet with a sample of SWA employees to assess their level of training and
Exhibit E, Attachment B
9
understanding of the requirements and potential sanctions applicable to the use
and misuse of SSA information.
7. Data and Communications Security
The encryption method employed must meet acceptable standards designated by
the National Institute of Standards and Technology (NIST). The recommended
encryption method to secure data in transport for use by SSA is the Advanced
Encryption Standard (AES) or triple DES (DES3) if AES is unavailable.
D. Onsite Systems Security Certification Review
The SWA must obtain and participate in an onsite review and compliance
certification of their security infrastructure and implementation of these security
requirements prior to being permitted to submit online transaction to SSA through the
ICON system. DOL will require an initial onsite systems security certification review
to be performed by either an independent IV&V contractor, or other DOL approved
certifier. The onsite certification will address each of the requirements described
above and will include, where appropriate, a demonstration of the SWA’s
implementation of each requirement. The review will include a walkthrough of the
SWA’s data center to observe and document physical security safeguards, a
demonstration of the SWA’s implementation of online access to SSA information
through the ICON system, and discussions with managers/supervisors. The IV&V
contractor, or other certifier, also will visit at least one of the SWA’s field offices to
discuss the online access to SSA information with a sample of line workers and
managers to assess their level of training and understanding of the proper use and
protection of SSA information.
The IV&V contractor, or other certifier, will separately document and certify SWA
compliance with each SSA security requirement. To fully comply with SSA’s
security requirements and be certified to connect to SSA through the ICON system,
the SWA must submit to DOL a complete package of documentation as described
above and a complete certification from an independent IV&V contractor, or other
DOL approved certifier, that the SWA system design and infrastructure is in
agreement with the SWA documentation and consistent with SSA requirements. Any
unresolved or unimplemented security control features must be resolved by the SWA
before DOL will authorize their connection to SSA through the ICON system.
Following initial certification and authorization from DOL to connect to SSA through
the ICON system, SSA is responsible for future systems security compliance reviews.
SSA conducts such reviews approximately once every three years, or as needed if
there is a significant change in the SWA’s computing platform, or if there is a
violation of any of SSA’s systems security requirements or an unauthorized disclosure
of SSA information by the SWA. The format of those reviews generally consists of
Exhibit E, Attachment B
10
reviewing and updating the SWA compliance with the systems security requirements
described above.
Exhibit E, Attachment B
SENSITIVE DOCUMENT
ATTACHMENT 4
ELECTRONIC INFORMATION EXCHANGE SECURITY REQUIREMENTS
AND PROCEDURES
(Technical Systems Security Requirements- TSSR)
Attachment 4 is a sensitive document, not a public document, and shall not in any manner be made available to the public without prior
approval from DHCS.
Exhibit E, Attachment B
ELECTRONIC INFORMATION EXCHANGE SECURITY
REQUIREMENTS AND PROCEDURES
FOR
STATE AND LOCAL AGENCIES EXCHANGING ELECTRONIC
INFORMATION WITH THE SOCIAL SECURITY
ADMINISTRATION
SENSITIVE DOCUMENT
Version 7.0
July 2015
Exhibit E, Attachment B
TSSR-Version 7.0 Page 2
TABLE OF CONTENTS
1. Introduction
2. Electronic Information Exchange (EIE) Definition
3. Roles and Responsibilities
4. General Systems Security Standards
5. Systems Security Requirements
5.1 Overview
5.2 General System Security Design and Operating Environment
5.3 System Access Control
5.4 Automated Audit Trail
5.5 Personally Identifiable Information (PII)
5.6 Monitoring and Anomaly Detection
5.7 Management Oversight and Quality Assurance
5.8 Data and Communications Security
5.9 Incident Reporting
5.10 Security Awareness and Employee Sanctions
5.11 Contractors of Electronic Information Exchange Partners
5.12 Cloud Service Providers (CSP) for Electronic Information Exchange Partners
6. Security Certification and Compliance Review Programs
6.1 The Security Certification Program
6.2 Documenting Security Controls in the Security Design Plan (SDP)
6.2.1 When the SDP is Required
6.3 The Certification Process
6.4 The Compliance Review Program and Process
6.5.1 EIEP Compliance Review Participation
6.6 Scheduling the Onsite Review
7. Additional Definitions
8. Regulatory References
9. Frequently Asked Questions
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 3
1. Introduction
Federal standards require the Social Security Administration (SSA) to maintain
oversight of the information it provides to its Electronic Information Exchange
Partners (EIEPs). EIEPs must protect the information with efficient and
effective security controls. EIEPs are entities that have electronic information
exchange agreements with the agency.
This document consistently references the concept of Electronic Information
Exchange Partners (EIEP); however, our Compliance Review Questionnaire
(CRQ) and Security Design Plan (SDP) documents will use the terms “state
agency” or “state agency, contractor(s), and agent(s)” for clarity. Most state
officials and agreement signatories are not familiar with the acronym EIEP;
therefore, SSA will continue to use the terms “state agency” or “state agency,
contractor(s), and agent(s)” in the same manner as the Computer Matching and
Privacy Protection Act (CMPPA) and Information Exchange Agreements (IEA).
This allows for easier alignment and mapping back to our data exchange
agreements between state agencies and SSA. It will also provide a more “user-
friendly” experience for the state officials who complete these forms on behalf of
their state agencies.
The objective of this document is twofold. The first is to ensure that SSA can
properly certify EIEPs as compliant with SSA security standards, requirements, and
procedures. The second is to ensure that EIEPs adequately safeguard electronic
information provided to them by SSA.
This document helps EIEPs understand the criteria that SSA uses when evaluating and
certifying the system design and security features used for electronic access to SSA-
provided information. Finally, this document provides the framework and general
procedures for SSA’s Security Certification and Compliance Review Programs.
The primary statutory authority that supports the information contained in this
document is the Federal Information Security Management Act (FISMA). FISMA
became law as part of the Electronic Government Act of 2002. FISMA is the United
States legislation that defines a comprehensive framework to protect government
information, operations, and assets against natural or manufactured threats. FISMA
assigned the National Institute of Standards and Technology (NIST), a branch of
the U.S. Department of Commerce, the responsibility to outline and define compliance
with FISMA. Unless otherwise stated, all of SSA’s requirements mirror the NIST-
defined management, operational, and technical controls listed in the various NIST
Special Publications (SP) libraries of technical guidance documents.
To gain electronic access to SSA-provided information, under the auspices of a data
exchange agreement, EIEP’s must comply with SSA’s most current Technical
System Security Requirements (hereafter referred to as TSSRs) to gain access to
SSA-provided information. This document is synonymous with the Electronic
Information Exchange Security Requirements and Procedures for State and
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 4
Local Agencies Exchanging Electronic Information with the Social Security
Administration in the agreements. The TSSR specifies minimally acceptable levels
of security standards and controls to protect SSA-provided information. SSA
maintains the TSSR as a living document—subject to change--that addresses emerging
threats, new attack methods and the development of new technology that potentially
places SSA-provided information at risk. EIEPs may proactively ensure their ongoing
compliance to the TSSR by periodically requesting the most current version from
SSA. SSA will work with EIEPs to resolve deficiencies, which result from updates to
the TSSRs. SSA refers to this process as Gap Analysis. EIEPs may proactively
ensure their ongoing compliance with the TSSRs by periodically requesting the most
current TSSR package from their SSA Point of Contact (POC) from the data exchange
agreement.
SSA’s standard for categorization of information (Moderate) and information systems
is to provide appropriate levels of security according to risk level. Additions,
deletions, or modification of security controls directly affect the level of security and
due diligence SSA requires EIEPs use to mitigate risks. The emergence of new
threats, attack methods, and the development of new technology warrants frequent
reviews and revisions to our TSSR. Consequently, EIEPs should expect SSA’s TSSR
to evolve in harmony with the industry.
2. Electronic Information Exchange (EIE) Definition
For discussion purposes herein, EIE is any electronic process in which SSA
discloses information under its control to any third party for program or non-
program purposes, without the specific consent of the subject individual or any
agent acting on his or her behalf. EIE involves individual data transactions and data
files processed within the programmatic systems of parties to electronic information
sharing agreements with SSA. This includes direct terminal access (DTA) to SSA
systems, batch processing, and variations thereof (e.g., online query) regardless of
the systematic method used to accomplish the activity or to interconnect SSA with
the EIEP.
3. Roles and Responsibilities
The SSA Office of Information Security (OIS) has agency-wide responsibility for
interpreting, developing, and implementing security policy; providing security and
integrity review requirements for all major SSA systems; managing SSA's fraud
monitoring and reporting activities, developing and disseminating security training
and awareness materials, and providing consultation and support for a variety of
agency initiatives. SSA’s security reviews ensure that external systems receiving
information from SSA are secure and operate in a manner consistent with SSA’s
Information Technology (IT) security policies and in compliance with the terms of
electronic data exchange agreements executed by SSA with outside entities. Within
the context of SSA’s security policies and the terms of the electronic data exchange
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 5
agreements with SSA’s EIEPs, SSA exclusively conducts and brings to closure initial
security certifications and triennial security compliance reviews. This includes (but
not limited to) any EIEP that processes, maintains, transmits, or stores SSA-provided
information in accordance with pertinent Federal requirements.
a. The SSA Regional Data Exchange Coordinators (DECs) serve as a bridge
between SSA and EIEPs. DECs assist in coordinating data exchange security
review activities with EIEPs; (e.g., providing points of contact with state agencies,
assisting in setting up security reviews, etc.) DECs are also the first points of
contact for states if an employee of a state agency or an employee of a state
agency’s contractor or agent becomes aware of suspected or actual loss of SSA-
provided information.
b. SSA requires EIEPs to adhere to the standards, requirements, and procedures,
published in this TSSR document.
“Personally Identifiable Information (PII),” covered under several Federal
laws and statutes, refers to specific information about an individual used to
trace that individual’s identity. Information such as his/her name, Social
Security Number (SSN), date and place of birth, mother’s maiden name, or
biometric records, alone, or when combined with other personal or
identifying information is linkable or lined to a specific individual’s
medical, educational, financial, and employment information.
The data (last 4 digits of the SSN) that SSA provides to its EIEPs for
purposes of the Help America Vote Act (HAVA) does not identify a
specific individual; therefore, is not “PII” as defined by the Act.
Both SSA and EIEPs must remain diligent in the responsibility for
establishing appropriate management, operational, and technical safeguards
to ensure the confidentiality, integrity, and availability of its records and to
protect against any anticipated threats or hazards to their security or
integrity.
c. A State Transmission/Transfer Component (STC) is an organization that performs
as an electronic information conduit or collection point for one of more other
entities (also referred to as a hub). An STC must also adhere to the same
management, operational and technical controls as SSA and the EIEP.
NOTE: Disclosure of Federal Tax Information (FTI) is limited to certain
Federal agencies and state programs supported by federal statutes under Sections
1137, 453, and 1106 of the Social Security Act. For information regarding
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 6
safeguards for protecting FTI, consult IRS Publication 1075, Tax Information
Security Guidelines for Federal, State, and Local Agencies.
4. General Systems Security Standards
EIEPs that request and receive information electronically from SSA must comply with
the following general systems security standards concerning access to and control of
SSA-provided information.
NOTE: EIEPs may not create separate files or records comprised solely of the
information provided by SSA.
1. EIEPs must ensure that means, methods, and technology used to process, maintain,
transmit, or store SSA-provided information neither prevents nor impedes the EIEP‟s
ability to:
safeguard the information in conformance with SSA requirements
efficiently investigate fraud, data breaches, or security events that involve
SSA-provided information
detect instances of misuse or abuse of SSA-provided information
For example, Utilization of cloud computing may have the potential to
jeopardize an EIEP’s compliance with the terms of their agreement or
associated systems security requirements and procedures.
2. The EIEP must use the electronic connection established between the EIEP and SSA
only in support of the current agreement(s) between the EIEP and SSA.
3. The EIEP must use the software and/or devices provided to the EIEPs only in support
of the current agreement(s) between the EIEPs and SSA.
4. SSA prohibits the EIEP from modifying any software or devices provided to the
EIEPs by SSA.
5. EIEPs must ensure that SSA-provided information is not processed, maintained,
transmitted, or stored in or by means of data communications channels, electronic
devices, computers, or computer networks located in geographic or virtual areas not
subject to U.S. law.
6. EIEPs must restrict access to the information to authorized users who need it to
perform their official duties.
NOTE: Contractors and agents (hereafter referred to as contractors) of the
EIEP who process, maintain, transmit, or store SSA-provided information
are held to the same security requirem ents as employees of the EIEP. Refer
to the section ‘Contractors of Electronic Information Exchange Partners in
the Systems Security Requirements for additional information.
7. EIEPs must store information received from SSA in a manner that, at all times, is
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 7
physically and electronically secure from access by unauthorized persons.
8. The EIEP must process SSA-provided information under the immediate supervision
and control of authorized personnel.
9. EIEPs must employ both physical and technological barriers to prevent unauthorized
retrieval of SSA-provided information via computer, remote terminal, or other
means.
10. EIEPs must have formal PII incident response procedures. When faced with a
security incident, caused by malware, unauthorized access, software issues, or acts of
nature, the EIEP must be able to respond in a manner that protects SSA-provided
information affected by the incident.
11. EIEPs must have an active and robust security awareness program, which is
mandatory for all employees who access SSA-provided information.
12. EIEPs must advise employees with access to SSA-provided information of the
confidential nature of the information, the safeguards required to protecting the
information, and the civil and criminal sanctions for non-compliance contained in the
applicable Federal and state laws.
13. In accordance with the National Institute of Standards and Technology (NIST)
Special Publication (SP) on Contingency Planning requirements and
recommendations, SSA requires EIEPs to document a senior management approved
Contingency plan that includes a disaster recovery plan that addresses both natural
disaster and cyber-attack situations.
14. SSA requires the Contingency Plan to include details regarding the organizational
business continuity plan (BCP) and a business impact analyses (BIA) that address the
security of SSA-provided information if a disaster occurs.
15. At its discretion, SSA or its designee must have the option to conduct onsite security
reviews or make other provisions, to ensure that EIEPs maintain adequate security
controls to safeguard the information we provide.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 8
5. Systems Security Requirements
5.1 Overview
SSA’s TSSR represent the current industry standard for security controls,
safeguards, and countermeasures required for Federal information systems by
Federal regulations, statutes, standards, and guidelines. Additionally, SSA’s
TSSR includes organizationally defined interpretations, policies, and procedures
mandated by the authority of the Commissioner of Social Security in areas when
or where other cited authorities may be silent or non-specific.
SSA must certify that the EIEP has implemented security controls that meet the
requirements and work as intended, before the authorization to initiate
transactions to and from SSA, through batch data exchange processes or online
processes such as State Online Query (SOLQ) or Internet SOLQ (SOLQ-I).
The TSSR address management, operational, and technical controls regarding
security safeguards to ensure only authorized disclosure and usage of SSA
provided information used, maintained, transmitted, or stored by SSA’s EIEPs.
SSA requires EIEPs to maintain an organizational access control structure that
adheres to a three-tiered best practices model. The SSA recommended model is
“separation of duties,” “need-to-know” and “least privilege.”
SSA requires EIEPs to document and notify SSA prior to sharing SSA-provided
information with another state entity, or to allow them direct access to their
system. This includes (but not limited to) law enforcement, other state
agencies, and state organizations that perform audit, quality, or integrity
functions.
SSA recommends that the EIEP develop and publish a comprehensive
Information Technology (IT) Systems Security Policy document that specifically
addresses:
1) the classification of information processed and stored within the network,
2) management, operational, and technical controls to protect the information
stored and processed within the network,
3) access to the various systems and subsystems within the network,
4) Security Awareness Training,
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 9
5) Employee and End User Sanctions Policy,
6) Contingency Planning and Disaster Recovery
7) Incident Response Policy, and
8) The disposal of protected information and sensitive documents derived from
the system or subsystems on the network.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 10
5.2 General System Security Design and Operating Environment
(Planning (PL) Family – (System Security Plan), Contingency Plan (CP)
Family, Physical and Environmental (PE) Family,
NIST SP 800-53 rev. 4)
In accordance with the NIST suite of Special Publications (SP) (e.g., 800-53,
800-34, etc.), SSA requires the EIEP to maintain policies, procedures,
descriptions, and explanations of their overall system design, configuration,
security features, and operational environment. They should include
explanations of how they conform to SSA’s TSSRs. The EIEPs General System
Security design and Operating Environment must also address:
a) the operating environment(s) in which the EIEP will utilize,
maintain, store, and transmit SSA-provided information,
b) the business process(es) in which the EIEP will use SSA-provided
information,
c) the physical safeguards employed to ensure that unauthorized
personnel, the public or visitors to the agency cannot access SSA-
provided information,
d) details of how the EIEP keeps audit information pertaining to the use
and access to SSA-provided information and associated applications
readily available,
e) electronic safeguards, methods, and procedures for protecting the
EIEP’s network infrastructure and for protecting SSA-provided
information while in transit, in use within a process or application,
and at rest ,
f) a senior management approved Information System Contingency
Plan (ISCP) that addresses both internal and external threats. SSA
requires the ISCP to include details regarding the organizational
business continuity plan (BCP) and a business impact analyses
(BIA) that addresses the security of SSA-provided information if a
disaster occurs. SSA recommends that state agencies perform
disaster exercises at least once annually.,
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 11
g) how the EIEP prevents unauthorized retrieval of SSA-provided
information by computer, remote terminal, or other means; including
descriptions of security software other than access control software
(e.g., security patch and anti-malware software installation and
maintenance, etc.)
h) how the configurations of devices (e.g., servers, workstations,
portable devices) involving SSA-provided information complies
with recognized industry standards (i.e. NIST SP’s) and SSA’s
TSSR, and
i) organizational structure of the agency, number of users, and all
external entities that will have access to the system and/or
application that displays, transmits, and/or application that displays,
transmits and/or stores SSA-provided information.
Note: At its discretion, SSA or a third party (i.e. contractor) must
have the option to conduct onsite security reviews or make other
provisions, to ensure that EIEPs maintain adequate security controls
to safeguard the information we provide.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 12
5.3 System Access Control
(Access Control (AC) Family, NIST SP 800-53 rev. 4)
EIEPs must utilize and maintain technological (logical) access controls that limit
access to SSA-provided information and associated transactions and functions to
only those users, processes acting on behalf of authorized users, or devices
(including other information systems) authorized for such access based on their
official duties or purpose(s). EIEPs must employ a recognized user-access
security software package (e.g.,RAC-F, ACF-2, TOP SECRET, Active
Directory, etc.) or a security software design, which is equivalent to such
products. The access control software must employ and enforce (1)
PIN/password, and/or (2) PIN/biometric identifier, and/or (3)
SmartCard/biometric identifier, etc., (for authenticating users), (and lower case
letters, numbers, and special characters; password phrases) for the user accounts
of persons, processes, or devices whose functions require access privileges in
excess of those of ordinary users.
The EIEP’s password policies must require stringent password construction as
supported by current NIST guidelines for the user accounts of persons,
processes, or devices whose functions require access privileges above those of
ordinary users. SSA strongly recommends Two-Factor Authentication.
The EIEP’s implementation of the control software must comply with
recognized industry standards. Password policies should enforce sufficient
construction strength (length and complexity) to defeat or minimize risk-based
identified vulnerabilities and ensure limitations for password repetition.
Technical controls should enforce periodic password changes based on a risk-
based standard (e.g., maximum password age of 90 days, minimum password
age of 3 – 7 days) and enforce automatic disabling of user accounts that have
been inactive for a specified period of time (e.g., 90 days).
The EIEP’s password policies must require stringent password construction
(e.g., passwords greater than eight characters in length requiring upper and lower
case letters, numbers, and/or special characters; password phrases) for the user
accounts of persons, processes, or devices whose functions require access
privileges in excess of those of ordinary users.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 13
In addition, SSA has the following specific requirements in the area of Access
Control:
1. Upon hiring or before granting access to SSA-provided information,
EIEPs should verify the identities of any employees, contractors, and
agents who will have access to SSA-provided information in
accordance with the applicable agency or state’s “personnel identity
verification policy.”
2. SSA requires that state agencies have a logical control feature that
designates a maximum number of unsuccessful login attempts for
agency workstations and devices that store or process SSA-provided
information, in accordance with NIST guidelines. SSA recommends
no fewer than three (3) and no greater than five (5)..
3. SSA requires that the state agency designate specific official(s) or
functional component(s) to issue PINs, passwords, biometric
identifiers, or Personal Identity Verification (PIV) credentials to
individuals who will access SSA-provided information. SSA also
requires that the state agency prohibit any functional
component(s) or official(s) from issuing credentials or access
authority to themselves or other individuals within their job-
function or category of access.
4. SSA requires that EIEPs grant access to SSA-provided information
based on least privilege, need-to-know, and separation of duties.
State agencies should not routinely grant employees, contractors, or
agents access privileges that exceed the organization’s business
needs. SSA also requires that EIEPs periodically review employees,
contractors, and agent’s system access to determine if the same
levels and types of access remain applicable.
5. If an EIEP employee, contractor, or agent is subject to an adverse
administrative action by the EIEP (e.g., reduction in pay,
disciplinary action, termination of employment), SSA recommends
the EIEP remove his or her access to SSA-provided information in
advance of the adverse action to reduce the possibility that will the
employee will perform unauthorized activities that involve SSA-
provided information.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 14
6. SSA requires that work-at-home, remote access, and/or Internet
access comply with applicable Federal and state security policy and
standards. Furthermore, the EIEPs access control policy must define
the safeguards in place to adequately protect SSA-provided
information for work-at-home, remote access, and/or Internet access.
7. SSA requires EIEPs to design their system with logical control(s)
that prevent unauthorized browsing of SSA-provided information.
SSA refers to this setup as a Permission Module. The term
“Permission Module” supports a business rule and systematic
control that prevents users from browsing a system that contains
SSA-provided information. It also supports the principle of
referential integrity. It should prevent non-business related or
unofficial access to SSA-provided information. Before a user or
process requests SSA-provided information for verification, the
system should verify it is an authorized transaction. Some
organizations use the term “referential integrity” to describe the
verification step. A properly configured Permission Module should
prevent a user from performing any actions not consistent with a
need-to-know business process. If a logical permission module
configuration is not possible, the state agency must enforce its
Access Control List (ACL) in accordance with the principle of least
privilege. The only acceptable compensating control for a system
that lacks a permission module is a 100% review of all
transactions that involve SSA-provided information.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 15
5.4 Automated Audit Trail
(Audit and Accountability (AU) Family, NIST SP 800-53 rev. 4)
SSA requires EIEPs, and other STCs or agencies that provide audit trail services
to other state agencies that receive information electronically from SSA, to
implement and maintain a fully automated audit trail system (ATS). The system
must be capable of creating, storing, protecting, and (efficiently) retrieving and
collecting records identifying the individual user who initiates a request for
information from SSA or accesses SSA-provided information. At a minimum,
individual audit trail records must contain the data needed (including date and
time stamps) to associate each query transaction or access to SSA-provided
information with its initiator, their action, if any, and the relevant business
purpose/process (e.g., SSN verification for Medicaid). Each entry in the audit
file must be stored as a separate record, not overlaid by subsequent records. The
ATS must create transaction files to capture all input from interactive internet
applications that access or query SSA-provided information.
SSA requires that the agency’s ATS create an audit record when users view
screens that contain SSA-provided information. If an STC handles and audits
the EIEP’s transactions with SSA, the EIEP is responsible for ensuring that the
STC’s audit capabilities meet NIST’s guidelines for an automated audit trail
system. The EIEP must also establish a process to obtain specific audit
information from the STC regarding the EIEP’s SSA transactions.
SSA requires that EIEPs have automated retrieval and collection of audit
records. Such automated functions can be via online queries, automated reports,
batch processing, or any other logical means of delivering audit records in an
expeditious manner. Information in the audit file must be retrievable by an
automated method and must allow the EIEP the capability to make them
available to SSA upon request.
Access to the audit file must be restricted to authorized users with a “need to
know,” audit file data must be unalterable (read-only), and maintained for a
minimum of three (3) (preferably seven (7)) years. Information in the audit file
must be retrievable by an automated method and must allow the EIEP the
capability to make them available to SSA upon request. The EIEP must backup
audit trail records on a regular basis to ensure its availability. EIEPs must apply
the same level of protection to backup audit files that apply to the original files
to ensure the integrity of the data.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 16
If the EIEP retains SSA-provided information in a database (e.g., Access
database, SharePoint, etc.), or if certain data elements within the EIEP’s system
indicates to users that SSA verified the information, the EIEP’s system must also
capture an audit trail record of users who view SSA-provided information stored
within the EIEP’s system. The retrieval requirements for SSA-provided
information at rest and the retrieval requirements for regular transactions are
identical. Similar to the Permission Module requirement above, the only
acceptable compensating control for a system that lacks an Automated
Audit Trail System (ATS) is a 100% review of all transactions that involve
SSA-provided information.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 17
5.5 Personally Identifiable Information (PII)
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347), and
AP Family – Authority and Purpose (Privacy Controls),
NIST SP 800-53 rev. 4)
Personally Identifiable Information (PII) is information used to distinguish
or trace an individual’s identity, such as their name, Social Security Number,
biometric records, alone or when combined with other personal or identifying
information linked or linkable to a specific individual. An item such as date
and place of birth, mother’s maiden name, or father’s surname is PII,
regardless of whether combined with other data.
SSA defines a PII loss as a circumstance when an EIEP employee,
contractor, or agent has reason to believe that information on hard copy or in
electronic format, which contains PII provided by SSA, left the EIEP’s
custody or the EIEP disclosed it to an unauthorized individual or entity. PII
loss is a reportable incident. SSA requires that contracts for periodic
disposal/destruction of case files or other print media contain a non-disclosure
agreement signed by all personnel who will encounter products that contain
SSA-provided information.
If a P II loss involving SSA-provided information occurs or is suspected,
the EIEP must be able to quantify the extent of the loss and compile a
complete list of the individuals potentially affected by the incident (refer to
Incident Reporting).
The EIEP should have procedural documents to describe methods and
controls for safeguarding SSA-provided PII while in use, at rest, during
transmission, or after archiving. The document should explain how the
EIEP manages and handles SSA-provided information on print media and
explain how the methods and controls conform to NIST requirements.
SSA requires that printed items that contain SSA-provided PII always
remain in the custody of authorized EIEP employees, contractors, or
agents. SSA also requires that the agency destroy the items when no
longer required for the EIEP’s business process. If retained in paper files
for evidentiary purposes, the EIEP should safeguard such PII in a manner
that prevents unauthorized personnel from accessing such materials. All
agencies that receive SSA-provided information must maintain an
inventory of all documents that outline statewide or agency policy and
procedures regarding the same.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 18
5.6 Monitoring and Anomaly Detection
(Information Security Continuous Monitoring (ISCM) for Federal
Information Systems and Organizations, NIST SP 800-137, E-Government
Act of 2002 (P.L. 107-347), and Security Assessment and Authorization
(CA) and Risk Assessment (RA) Families, NIST SP 800-53 rev. 4)
SSA requires that the EIEPs use an Intrusion Protection System (IPS) or
an Intrusion Detection System (IDS). The EIEP must establish and/or
maintain continuous monitoring of its network infrastructure and assets to
ensure that:
1) the EIEP’s security controls continue to be effective over time,
2) the EIEP uses industry-standard Security Information Event
Manager (SIEM) tools, anti-malware software, and effective
antivirus protection,
3) only authorized individuals, devices, and processes have access to
SSA-provided information,
4) the EIEP detects efforts by external and internal entities, devices, or
processes to perform unauthorized actions (e.g., data breaches,
malicious attacks, access to network assets, software/hardware
installations, etc.) as soon as they occur,
5) the necessary parties are immediately alerted to unauthorized actions
performed by external and internal entities, devices, or processes,
6) upon detection of unauthorized actions, measures are immediately
initiated to prevent or mitigate associated risk,
7) in the event of a data breach or security incident, the EIEP can
efficiently determine and initiate necessary remedial actions, and
8) trends, patterns, or anomalous occurrences and behavior in user or
network activity that may be indicative of potential security issues
are readily discernible.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 19
The EIEP’s system must include the capability to prevent users from
unauthorized browsing of SSA records. SSA requires the use of a transaction-
driven permission module design, whereby employees are unable to initiate
transactions not associated with the normal business process. If the EIEP uses
such a design, they also must have anomaly detection to monitor an
employee’s unauthorized attempts to gain access to SSA-provided information
and attempts to obtain information from SSA for clients not in the EIEP’s
client system. The EIEP should employ measures to ensure the permission
module’s integrity. Users should not be able to create a bogus case and
subsequently delete it in such a manner that it goes undetected. The SSA
permission module design employs both role and rules based logical access
control restrictions. (Refer to Access Control)
If the EIEP’s design does not use a permission module and is not transaction-
driven, until at least one of these security features exists, the EIEP must develop
and implement compensating security controls to deter employees from
browsing SSA records. These controls must include monitoring and anomaly
detection features, such as: systematic, manual, or a combination thereof. Such
features must include the capability to detect anomalies in the volume and/or
type of transactions or queries requested or initiated by individuals and include
systematic or manual procedures for verifying that requests and queries of
SSA-provided information comply with valid official business purposes.
Risk Management Program
SSA recommends that EIEPs develop and maintain a published Risk
Assessment Policy and Procedures document. A Risk Management
Program may include, but is not limited to the following:
1. A risk assessment policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among
organizational entities, and compliance,
2. Procedures to facilitate the implementation of the risk assessment
policy and associated risk assessment controls,
3. A function that conducts an assessment of risk, including the likelihood
and magnitude of harm, from the unauthorized access, use, disclosure,
disruption, modification, or destruction of the information system and
the information it processes, stores, or transmits,
4. An independent function that conducts vulnerability and risk
assessments, reviews risk assessment results, and disseminates such
information to senior management,
5. A firm commitment from senior management to update the risk
assessment whenever there are significant changes to the information
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 20
system or environment of operation or other conditions that may affect
the security of SSA-provided information,
6. A robust vulnerability scanning protocol that employs industry standard
scanning tools and techniques that facilitate interoperability among
tools and automates parts of the vulnerability management process,
7. Remediates legitimate vulnerabilities in accordance with an
organizational assessment of risk, and
8. Shares information obtained from the vulnerability scanning process
and security control assessments with senior management to help
eliminate similar vulnerabilities in other information systems that
receive, process, transmit, or store SSA-provided information.
Note: The EIEP’s decision to initiate or maintain an official Risk
Management Program and establish a formal Risk Assessment
Strategy for mitigating risk is strictly voluntary, but highly
recommended by SSA.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 21
5.7 Management Oversight and Quality Assurance
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347), and
the AC – Access Control & PM – Program Management Families, NIST
SP 800-53 rev. 4)
SSA requires the EIEP to establish and/or maintain ongoing management
oversight and quality assurance capabilities to ensure that only authorized
users have access to SSA-provided information. This will ensure there is
ongoing compliance with the terms of the EIEP’s electronic information
sharing agreement with SSA and the TSSRs established for access to SSA-
provided information. The entity responsible for management oversight should
consist of one or more of the EIEP’s management officials whose job functions
include responsibility to ensure that the EIEP only grants access to the
appropriate users and position types (least privilege), which require the SSA-
provided information to do their jobs (need-to-know).
SSA requires the EIEP to ensure that users granted access to SSA-provided
information receive adequate training on the sensitivity of the information,
associated safeguards, operating procedures, and the civil and criminal
consequences or penalties for misuse or improper disclosure.
SSA requires that EIEPs establish the following job functions and require that
only users whose job functions are separate from personnel who request or use
SSA-provided information.
SSA requires that EIEPs establish the following job functions separate
from personnel who request or use SSA-provided information.
a)Perform periodic self-reviews to monitor the EIEP’s ongoing usage of SSA-
provided information.
b) Perform random sampling of work activity that involves SSA-provided
information to determine if the access and usage comply with SSA’s
requirements
SSA requires the EIEP’s system to produce reports that allow management
and/or supervisors to monitor user activity. The EIEP must have a process for
distributing these monitoring and exception reports to appropriate local
managers/supervisors or to local security officers. The process must ensure
that only those whose responsibilities include monitoring anomalous activity
of users, to include those who have exceptional system rights and privileges,
use the reports.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 22
1. User ID Exception Reports:
This type of report captures information about users who enter incorrect
user IDs when attempting to gain access to the system or to a transaction
that initiates requests for information from SSA, including failed
attempts to enter a password.
2. Inquiry Match Exception Reports:
This type of report captures information about users who initiate
transactions for SSNs that have no client case association within the
EIEP’s system (the EIEP’s management must review 100% of these
cases).
3. System Error Exception Reports:
This type of report captures information about users who may not
understand or may be violating proper procedures for access to SSA-
provided information.
4. Inquiry Activity Statistical Reports:
This type of report captures information about transaction usage
patterns among authorized users and is a tool that enables the EIEP’s
management to monitor typical usage patterns in contrast to
extraordinary usage patterns.
The EIEP must have a process for distributing these monitoring and
exception reports to appropriate local managers/supervisors or to local
security officers. The process must ensure that only those whose
responsibilities include monitoring anomalous activity of users, to include
those who have exceptional system rights and privileges, use the reports. (THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 23
5.8 Data and Communications Security
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347), and
the Access Control (AC), Configuration Management (CM), Media
Protection (MP), and System and Communication (SC) Families, NIST
SP 800-53 rev. 4)
SSA requires EIEPs to encrypt PII and SSA-provided information when
transmitting across dedicated communications circuits between its systems,
intrastate communications between its local office locations, and on the EIEP’s
mobile computers, devices and removable media. The EIEP’s encryption
methods must align with the Guidelines established by the National Institute of
Standards and Technology (NIST). SSA recommends the Advanced
Encryption Standard (AES) or Triple DES (Data Encryption Standard 3).
Files encrypted for external users (when using tools such as Microsoft
Word encryption,) require a key length of at least nine characters. SSA
recommends that the key (also referred to as a password) contain both special
characters and numbers. SSA supports the NIST Guidelines that requires the
EIEP deliver the key so that it does not accompany the media. The EIEP must
secure the key when not in use or unattended.
SSA discourages the use of the public Internet for transmission of SSA-
provided information. If, however, the EIEP uses the public Internet or other
electronic communications, such as emails and faxes to transmit SSA-provided
information, they must use a secure encryption protocol such as Secure Socket
Layer (SSL) or Transport Layer Security (TLS). SSA also recommends 256-
bit encryption protocols or more secure methods such as Virtual Private
Network technology. The EIEP should only send data to a secure address or
device to which the EIEP can control and limit access to only specifically
authorized individuals and/or processes. SSA recommends that EIEPs use
Media Access Control (MAC) Filtering and Firewalls to protect access
points from unauthorized devices attempting to connect to the network.
EIEPs should not retain SSA-provided information any longer than
business purpose(s) dictate. The IEA with SSA stipulates a time for data
retention. The EIEP should delete, purge, destroy, or return SSA-
provided information when the business purpose for retention no longer
exists.
The EIEP may not save or create separate files comprised solely of information
provided by SSA. The EIEP may apply specific SSA-provided information to
the EIEP’s matched record from a preexisting data source. Federal law
prohibits duplication and redisclosure of SSA-provided information without
written approval from SSA.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 24
This prohibition applies to both internal and external sources who do not have a
“need-to-know.” SSA recommends that EIEPs use either Trusted Platform
Module (TPM) or Hardware Security Module (HSM) technology solutions
to encrypt data at rest on hard drives and other data storage media.
SSA requires EIEPs to prevent unauthorized disclosure of SSA-provided
information after they complete processing and after the EIEP no longer
requires the information. The EIEP’s operational processes must ensure that no
residual SSA-provided information remains on the hard drives of user’s
workstations after the user exits the application(s) that use SSA-provided
information. If the EIEP must send a computer, hard drive, or other computing
or storage device offsite for repair, the EIEP must have a non-disclosure clause
in their contract with the vendor. If the EIEP used the item in connection with
a business process that involved SSA-provided information and the vendor will
retrieve or may view SSA-provided information during servicing, SSA reserves
the right to inspect the EIEP’s vendor contract. The EIEP must remove SSA-
provided information from electronic devices before sending it to an external
vendor for service. SSA expects the EIEP to render SSA-provided information
unrecoverable or destroy the electronic device if they do not need to recover the
information. The same applies to excessed, donated, or sold equipment placed
into the custody of another organization.
To sanitize media, the EIEP should use one of the following methods:
1. Overwriting/Clearing:
Overwrite utilities can only be used on working devices. Overwriting is
appropriate only for devices designed for multiple reads and writes. The EIEP
should overwrite disk drives, magnetic tapes, floppy disks, USB flash
drives, and other rewriteable media. The overwrite utility must completely
overwrite the media. SSA recommends the use of purging media
sanitization to make the data irretrievable, protecting data against laboratory
attacks or forensics. Reformatting the media does not overwrite the data.
2. Degaussing:
Degaussing is a sanitization method for ma gnetic media (e.g., disk drives, tapes,
floppies, etc.). Degaussing is not effective for purging non-magnetic media (e.g.,
optical discs). SSA and NIST Guidelines require EIEP to use a certified tool
designed to degauss each particular type of media. NIST guidelines require
certification of the tool to ensure that the magnetic flux applied to the media is
strong enough to render the information irretrievable. The degaussing process
must render data on the media irretrievable by a laboratory attack or laboratory
forensic procedures.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 25
3. Physical destruction:
NIST guidelines require physical destruction when degaussing or over-
writing cannot be accomplished (for example, CDs, floppies, DVDs,
damaged tapes, hard drives, damaged USB flash drives, etc.). Examples
of physical destruction include shredding, pulverizing, and burning.
State agencies may retain SSA-provided information in hardcopy only if
required to fulfill evidentiary requirements, provided the agencies retire such
data in accordance with applicable state laws governing state agency’s
retention of records. The EIEP must control print media containing SSA-
provided information to restrict access to authorized employees who need
such access to perform official duties. EIEPs must destroy print media
containing SSA-provided information in a secure manner when no longer
required for business purposes. SSA requires the EIEP to destroy paper
documents that contain SSA-provided information by burning, pulping,
shredding, macerating, or other similar means that ensure the information is
unrecoverable.
State agencies may use any accretions, deletions, or changes to the SSA-
provided information governed by the CMPPA agreement to update their
master files or federally funded state-administered benefit program applicants
and recipients and retain such master files in accordance with applicable state
laws governing State Agencies’ retention of records.
NOTE: Hand tearing or lining through documents to obscure
information does not meet SSA’s requirements for appropriate destruction
of PII.
The EIEP must employ measures to ensure that communications and data
furnished to SSA contain no viruses or other malware. Special Note regarding Cloud Service Providers:
If the EIEP will store SSA-provided information through a Cloud Service
Provider, please provide the name and address of the cloud provider.
Describe the security responsibilities the contract requires to protect SSA-
provided information.
SSA will ask for detailed descriptions of the security features contractually
required of the cloud provider and information regarding how they will
protect SSA-provided information at rest and when in transit.
EIEPs cannot legally process, transmit, or store SSA-provided
information in a cloud environment without explicit permission from
SSA’s Chief Information Officer.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 26
5.9 Incident Reporting
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347),
and the Incident Response (IR) Family, NIST SP 800-53 rev. 4)
FISMA, NIST Guidelines, and Federal Law require the EIEP to develop and
implement policies and procedures to respond to potential data breaches or
PII loses. EIEPs must articulate, in writing, how the policies and procedures
conform to SSA’s requirements. The procedures must include the following
information:
If your agency experiences or suspects a breach or loss of PII or a
security incident, which includes SSA-provided information, they must
notify the State official responsible for Systems Security designated in the
agreement. That State official or delegate must then notify the SSA
Regional Office Contact or the SSA Systems Security Contact identified in
the agreement. If, for any reason, the responsible State official or
delegate is unable to notify the SSA Regional Office or the SSA Systems
Security Contact within one hour, the responsible State Agency official or
delegate must report the incident by contacting SSA’s National Network
Service Center (NNSC) toll free at 877-697-4889 (select “Security and
PII Reporting” from the options list). The EIEP will provide updates as
they become available to SSA contact, as appropriate. Refer to the
worksheet provided in the agreement to facilitate gathering and
organizing information about an incident.
If SSA, or another Federal investigating entity (e.g. TIGTA or DOJ),
determines that the risk presented by a breach or security incident requires that
the state agency notify the subject individuals, the agency must agree to
absorb all costs associated with notification and remedial actions connected to
security breaches. SSA and NIST Guidelines encourage agencies to
consider establishing incident response teams to address PII and SSA-
provided information breaches.
Incident reporting policies and procedures are part of the security awareness
program. Incident reporting pertains to all employees, contractors, or agents
regardless as to whether they have direct responsibility for contacting SSA.
The written policy and procedures document should include specific names,
titles, or functions of the individuals responsible for each stage of the
notification process. The document should include detailed instructions for
how, and to whom each employee, contractor, or agent should report the
potential breach or PII loss.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 27
5.10 Security Awareness Training and User Sanctions
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347), and
Awareness and Training (AT), Personnel Security (PS), and Program
Management (PM) Families, NIST SP 800-53 rev. 4)
The EIEP must have an active and robust security awareness program and
security training for all employees, contractors, and agents who access SSA-
provided information. The training and awareness programs must include:
a. the sensitivity of SSA-provided information and addresses the
Privacy Act and other Federal and state laws governing its use and
misuse,
b. the rules of behavior concerning use and security in systems and/or
applications processing SSA-provided information,
c. the restrictions on viewing and/or copying SSA-provided
information,
d. the responsibilities of employees, contractors, and agent’s pertaining
to the proper use and protection of SSA-provided information,
e. the proper disposal of SSA-provided information,
f. the security breach and data loss incident reporting procedures,
g. the basic understanding of procedures to protect the network from
malware attacks,
h. spoofing, phishing and pharming, and network fraud prevention, and
i. the possible criminal and civil sanctions and penalties for misuse of
SSA-provided information.
SSA requires the EIEP to provide security awareness training to all
employees, contractors, and agents who access SSA-provided information.
The training should be annual, mandatory, and certified by the personnel who
receive the training. SSA also requires the EIEP to certify that each employee,
contractor, and agent who views SSA-provided information certify that they
understand the potential criminal, civil, and administrative sanctions or
penalties for unlawful assess and/or disclosure.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 28
SSA requires the EIEP to provide security awareness training to all
employees, contractors, and agents who access SSA-provided information.
The training should be annual, mandatory, and certified by the personnel who
receive the training. SSA also requires the EIEP to certify that each employee,
contractor, or agent who views SSA-provided information also certify that
they understand the potential criminal and administrative sanctions or
penalties for unlawful disclosure. SSA requires the state agency to require
employees, contractors, and agents to sign a non-disclosure agreement, attest
to their receipt of Security Awareness Training, and acknowledge the rules of
behavior concerning proper use and security in systems that process SSA-
provided information. The non-disclosure attestation must also include
acknowledgement from each employee, contractor, and agent that he or she
understands and accepts the potential criminal and/or civil sanctions or
penalties associated with misuse or unauthorized disclosure of SSA-provided
information. The state agency must retain the non-disclosure attestations for at
least five (5) to seven (7) years for each individual who processes, views, or
encounters SSA-provided information as part of their duties.
SSA strongly recommends the use of login banners, emails, posters, signs,
memoranda, special events, and other promotional materials to encourage
security awareness throughout your enterprise.
The state agency must designate a department or party to take the
responsibility to provide ongoing security awareness training for all
employees, contractors, and agents who access SSA-provided information.
Training must include:
The sensitivity of SSA-provided information and address the
Privacy Act and other Federal and state laws governing its use and
misuse
Rules of behavior concerning use and security in systems
processing SSA-provided information
Restrictions on viewing and/or copying SSA-provided information
The employee, contractor, and agent’s responsibility for proper use
and protection of SSA-provided information
Proper disposal of SSA-provided information
Security incident reporting procedures
Basic understanding of procedures to protect the network from
malware attacks
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 29
Spoofing, Phishing and Pharming scam prevention
The possible sanctions and penalties for misuse of SSA-provided
information
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 30
5.11 Contractors of Electronic Information Exchange Partners
(The Privacy Act of 1974, E-Government Act of 2002 (P.L. 107-347),
and Risk Assessment (RA), System and Services Acquisition (SA),
Awareness and Training (AT), Personnel Security (PS), and Program
Management (PM) Families, NIST SP 800-53 rev. 4)
The state agency’s employees, contractors, and agents who access, use, or
disclose SSA data in a manner or purpose not authorized by the Agreement
may be subject to both civil and criminal sanctions pursuant to applicable
Federal statutes. The state agency will provide its contractors and agents with
copies of the Agreement, related IEAs, and all related attachments before
initial disclosure of SSA data to such contractors and agents. Prior to signing
the Agreement, and thereafter at SSA’s request, the state agency will obtain
from its contractors and agents a current list of the employees of such
contractors and agents with access to SSA data and provide such lists to SSA.
Contractors of the state agency must adhere to the same security
requirements as employees of the state agency. The state agency is
responsible for the oversight of its contractors and the contractor’s
compliance with the security requirements. The state agency must enter into
a written agreement with each of its contractors and agents who need SSA
data to perform their official duties. Such contractors or agents agree to
abide by all relevant Federal laws, restrictions on access, use, disclosure, and
the security requirements contained within the state agency’s agreement with
SSA.
The state agency must provide proof of the contractual agreement with all
contractors and agents who encounter SSA-provided information as part of
their duties. If the contractor processes, handles, or transmits information
provided to the state agency by SSA or has authority to perform on the state
agency’s behalf, the state agency should clearly state the sp ecific roles and
functions of the contractor within the agreement. The state agency will
provide SSA written certification that the contractor is meeting the terms of
the agreement, including SSA security requirements. The service level
agreements with the contractors and agents must contain non-disclosure
language as it pertains to SSA-provided information.
The state agency must also require that contractors and agents who will
process, handle, or transmit information provided to the state agency by SSA to
include language in their signed agreement that obligates the contractor to
follow the terms of the state agency’s data exchange agreement with SSA. The
state agency must also make certain that the contractor and agent’s employees
receive the same security awareness training as the state agency’s employees.
The state agency, the contractor, and the agent should maintain awareness-
training records for their employees and require the same mandatory annual
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 31
certification procedures.
SSA requires the state agency to subject the contractor to ongoing security
compliance reviews that must meet SSA standards. The state agency will
conduct compliance reviews at least triennially commencing no later than three
(3) years after the approved initial security certification to SSA. The state
agencies will provide SSA with documentation of their recurring compliance
reviews of their contractors and agents. The state agencies will provide the
documentation to SSA during their scheduled compliance and certification
reviews or upon SSA’s request.
If the state agency’s contractor will be involved with the processing, handling,
or transmission of information provided to the EIEP by SSA offsite from the
EIEP, the EIEP must have the contractual option to perform onsite reviews of
that offsite facility to ensure that the following meet SSA’s requirements:
a) safeguards for sensitive information,
b) technological safeguards on computer(s) that have access to SSA-
provided information,
c) security controls and measures to prevent, detect, and resolve
unauthorized access to, use of, and redisclosure of SSA-provided
information, and
d) continuous monitoring of the EIEP contractors or agent’s network
infrastructures and assets.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 32
5.12 Cloud Service Providers (CSP) for Electronic Information Exchange
Partners
(NIST SP 800-144, NIST SP 800-145, NIST SP 800-146, OMB Memo M-
14-03, NIST SP 137)
The National Institute of Standards and Technology (NIST) Special Publication
(SP) 800-145 defines Cloud Computing as “a model for enabling ubiquitous,
convenient, on-demand network access to a shared pool of configurable computing
resources (e.g., networks, servers, storage, applications, and services) that can be
rapidly provisioned and released with minimal management effort or service
provider interaction. This cloud model is composed of five essential characteristics,
three service models, and four deployment models.” The three service models, as
defined by NIST SP 800-145 are Software as a Service (SaaS), Platform as a
Service (PaaS), and Infrastructure as a Service (IaaS). The Deployment models are
Private Cloud, Community Cloud, Public Cloud, and Hybrid Cloud. Furthermore,
The Federal Risk and Authorization Program (FedRAMP) is a risk management
program that provides a standardized approach for assessing and monitoring the
security of cloud products and services.
SSA requires the State Agency, contractor(s), and agent(s) to exercise due diligence
to avoid hindering legal actions, warrants, subpoenas, court actions, court
judgments, state or Federal investigations, and SSA special inquiries for matters
pertaining to SSA-provided information.
SSA requires the State Agency, contractor(s), and agent(s) to agree that any state-
owned or subcontracted facility involved in the receipt, processing, storage, or
disposal of SSA-provided information operate as a “de facto” extension of the State
Agency and is subject to onsite inspection and review by the State Agency or SSA
with prior notice.
SSA requires that the State Agency thoroughly describe all specific contractual
obligations of each party to the Cloud Service Provider (CSP) agreement between
the state agency and the CSP vendor(s). If the obligations, services, or conditions
widely differ from agency to agency, we require separate SDP Questionnaires to
address the CSP services provided to each state agency involved in the receipt,
processing, storage, or disposal of SSA-provided information.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 33
6. Security Certification and Compliance Review Programs
(NIST SP 800-18 – System Security Plans and Planning (PL) Family, NIST
SP 800-53 rev. 4)
SSA’s security certification and compliance review programs are distinct processes.
The certifi cation program is a unique episodic process when an EIEP initially requests
electronic access to SSA-provided information or makes substantive changes to
existing exchange protocol, delivery method, infrastructure, or platform . The
certification process entails two stages (refer to 6.1 for details) intended to ensure that
management, operational, and technical security measures work as designed. SSA
must ensure that the EIEPs fully conform to SSA’s security requirements at the time of
certification and satisfy both stages of the certification process before SSA will permit
online access to its data in a production environment.
The compliance review program entails cyclical security review of the EIEP performed
by, or on behalf of SSA. The purpose of the review is to to assess an EIEP’s conformance
to SSA’s current security requirements at the time of the review engagement. The
compliance review program applies to both online and batch access to SSA-provided
information. Under the compliance review program, EIEPs are subject to ongoing and
periodic security reviews by SSA.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 34
6.1 The Security Certification Program
(NIST SP 800-18 – System Security Plans, Security Assessment and Authorization Controls (CA), and Planning (PL) Families, NIST SP 800-53 rev. 4)
The security certification process applies to EIEPs that seek online electronic
access to SSA-provide information and consists of two general phases:
a) Phase 1: The Security Design Plan (SDP) is a formal written plan
authored by the EIEP to document its management, operational, and
technical security controls to safeguard SSA-provided information (refer
to Documenting Security Controls in the Security Design Plan).
NOTE: SSA may have legacy EIEPs (EIEPs not certified under
the current process) who have not prepared an SDP. SSA
strongly recommends that these EIEPs prepare an SDP.
The EIEP’s preparation and maintenance of a current SDP will
aid them in determining potential compliance issues prior to
reviews, assuring continued compliance with SSA’s TSSRs, and
providing for more efficient security reviews.
b) Phase 2: The SSA Onsite Certification is a formal security review
conducted by SSA, or on its behalf, to examine the full suite of
management, operational, and technical security controls implemented by
the EIEP to safeguard data obtained from SSA electronically (refer to
The Certification Process).
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 35
6.2 Documenting Security Controls in the SDP
(NIST SP 800-18 – System Security Plans, Security Assessment and
Authorization Controls (CA), and Planning (PL) Families, NIST SP
800-53 rev. 4)
6.2.1 When an SDP is required:
EIEPs must submit an SDP when one or more of the following
circumstances apply:
a) to obtain approval for requested access to SSA-provided information for an
initial agreement,
b) to obtain approval to reestablish previously terminated access to SSA-
provided information,
c) to obtain approval to implement a new operating or security platform that
will involve SSA-provided information,
d) to obtain approval for significant changes to the EIEP’s organizational
structure, technical processes, operational environment, or security
implementations planned or made since approval of their most recent SDP
or of their most recent successfully completed security review,
e) to confirm compliance when one or more security breaches or incidents
involving SSA-provided information occurred since approval of the EIEP’s
most recent SDP or of their most recent successfully completed security
review,
f) to document descriptions and explanations of measures implemented as the
result of a data breach or security incident,
g) to document descriptions and explanations of measures implemented to
resolve non-compliancy issue(s), and
h) to obtain a new approval after SSA revoked approval of the most recent
SDP
SSA may require a new SDP if changes occurred (other than those listed
above) that may affect the terms of the EIEP’s data exchange agreement
with SSA.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 36
SSA will not approve the SDP or allow the initiation of transactions
and/or access to SSA-provided information before the EIEP complies
with the TSSRs.
NOTE: EIEPs that function only as an STC, transferring SSA-
provided information to other EIEPs must, per the terms of their
agreements with SSA, adhere to SSA’s TSSR and exercise their
responsibilities regarding protection of SSA-provided information.
(See Page 48 Definition of STC)
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 37
6.3 The Certification Process (NIST SP 800-18 – System Security Plans, Security Assessment and Authorization Controls (CA), and Planning (PL) Families, NIST SP 800-53 rev. 4)
Once the EIEP has successfully satisfied Phase 1, SSA will conduct an onsite
certification review. The objective of the onsite review is to ensure the EIEP’s
management, operational, and technical controls safeguarding SSA-provided
information from misuse and improper disclosure and that those safeguards
function and work as intended.
At its discretion, SSA may request the EIEP to participate in an onsite review and
compliance certification of their security infrastructure.
The onsite review may address any or all of SSA’s security requirements and
include, when appropriate:
1)a demonstration of the EIEP’s implementation of each security requirement,
2) a physical review of pertinent supporting documentation to verify the
accuracy of responses in the SDP,
3) a demonstration of the functionality of the software interface for the system
that will receive, process, and store SSA-provided information,
4) a demonstration of the Automated Audit Trail System (ATS),
5) a walkthrough of the EIEP’s data center to observe and document physical
security safeguards,
6)a demonstration of the EIEP’s implementation of electronic exchange of
data with SSA,
7)a discussions with managers, supervisors, information security officers,
system administrators, or other state stakeholders,
8)an examination of management control procedures and reports pertaining to
anomaly detection or anomaly prevention,
9)a demonstration of technical tools pertaining to user access control and, if
appropriate, browsing prevention,
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 38
10) a demonstration of the permission module or similar design, to show how
the system triggers requests for information from SSA,
11) a demonstration of how the process for requests for SSA-provided
information prevents SSNs not present in the EIEP’s system from sending
requests to SSA.
We may attempt to obtain information from SSA using at least one,
randomly created, fictitious number not known to the EIEPs system.
During a certification or compliance review, SSA or a certifier acting on its behalf,
may request a demonstration of the EIEP’s ATS and its record retrieval capability.
SSA or a certifier may request a demonstration of the ATS’ capability to track the
activity of employees who have the potential to access SSA-provided information
within the EIEP’s system. The certifier may request more information from those
EIEPs who use an STC to handle and audit transactions. SSA or a certifier may
conduct a demonstration to see how the EIEP obtains audit information from the
STC regarding the EIEP’s SSA transactions.
If an STC handles and audits an EIEP’s transactions, SSA requires the EIEP to
demonstrate both their in-house audit capabilities and the process used to obtain
audit information from the STC.
If the EIEP employs a contractor or agent who processes, handles, or transmits
the EIEP’s SSA-provided information offsite, SSA, at its discretion, may request
to include the contractor’s facility in the onsite certification review. The
inspection may occur with or without a representative of the EIEP.
Upon successful completion of the onsite certification review, SSA will
authorize electronic access to production data by the EIEP. SSA will provide
written notification of its certification to the EIEP and all appropriate internal
SSA components.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 39
6.5 The Compliance Review Program and Process
(NIST SP 800-18 – System Security Plans, Configuration Management (CM), Security Assessment and Authorization Controls (CA), and Planning (PL) Families, NIST SP 800-53 rev. 4)
Similar to the certification process, the compliance review program entails a
process intended to ensure that EIEPs that receive electronic information from SSA
are in full compliance with the SSA’s TSSRs. SSA requires EIEPs to complete
and submit (based on a timeline agreed upon by SSA and EIEP’s stakeholders) a
Compliance Review Questionnaire (CRQ). The CRQ (similar to the SDP),
describes the EIEP’s management, operational, and technical controls used to
protect SSA-provided information from misuse and improper disclosure. We also
want to verify that those safeguards function and work as intended.
As a practice, SSA attempts to conduct compliance reviews following a 3-5 year
periodic review schedule. However, as circumstances warrant, a review may take
place at any time. Three prominent examples that would trigger an ad hoc review
are:
A. a significant change in the outside EIEP’s computing platform,
B. a violation of any of SSA’s TSSRs, or
C. an unauthorized disclosure of SSA-provided information by the EIEP.
SSA may conduct onsite compliance reviews and include both the EIEP’s main
facility and a field office.
SSA may, at its discretion, request that the EIEP participate in an onsite compliance
review of their security infrastructure to confirm the implementation of SSA’s
security requirements.
The onsite review may address any or all of SSA’s security requirements and
include, where appropriate:
D. a demonstration of the EIEP’s implementation of each requirement
E. a random sampling of audit records and transactions submitted to SSA
F. a walkthrough of the EIEP’s data center to observe and document physical
security safeguards
G. a demonstration of the EIEP’s implementation of online exchange of data
with SSA,
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 40
H. a discussion with managers, supervisors, information security officers,
system administrators, or other state stakeholders,
I. an examination of management control procedures and reports pertaining to
anomaly detection and prevention reports,
J. a demonstration of technical tools pertaining to user access control and, if
appropriate, browsing prevention,
K. a demonstration of how a permission module or similar design triggers
requests for information from SSA, and
L. a demonstration of how a permission module prevents the EIEP’s system
from processing SSNs not present in the EIEP’s system.
1) We can accomplish this by attempting to obtain information from SSA
using at least one, randomly created, fictitious number not known to
the EIEP’s system.
SSA may perform an onsite or remote review for reasons including, but not
limited, to the following:
a) the EIEP has experienced a security breach or incident involving SSA-
provided information
b) the EIEP has unresolved non-compliancy issue(s)
c) to review an offsite contractor’s facility that processes SSA-
provided information
d) the EIEP is a legacy organization that has not yet been through SSAs
security certification and compliance review programs
e) the EIEP requested that SSA perform an IV & V (Independent
Verification and Validation review)
During the compliance review, SSA, or a certifier acting on its behalf, may request
a demonstration of the system’s audit trail and retrieval capability. The certifier
may request a demonstration of the system ’s capability for tracking the activity of
employees who view SSA-provided information within the EIEP’s system. The
certifier may request EIEPs that have STCs that handle and audit transactions with
SSA to demonstrate the process used to obtain audit information from the STC.
If an STC handles and audits the EIEP’s transactions with SSA, we may require the
EIEP to demonstrate both their in-house audit capabilities and the processes used to
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 41
obtain audit information from the STC regarding the EIEP’s transactions with SSA.
If the EIEP employs a contractor who will process, handle, or transmit the EIEP’s
SSA-provided information offsite, SSA, at its discretion, may request to include in
the onsite compliance review an onsite inspection of the contractor’s facility. The
inspection may occur with or without a representative of the EIEP. The format of
the review in routine circumstances (e.g., the compliance review is not being
conducted to address a special circumstance, such as a disclosure violation, etc.)
will generally consist of reviewing and updating the EIEP’s compliance with the
systems security requirements described above in this document. At the conclusion
of the review, SSA will issue a formal report to appropriate EIEP personnel. The
Compliance Report will address findings and recommendations from SSA’s
compliance review, which includes a plan for monitoring each issue until closure.
NOTE: SSA will never request documentation for compliance reviews unless
necessary to assess the EIEP’s security posture. The information is only
accessible to authorized individuals who have a need for the information as it
relates to the EIEP’s compliance with its electronic data exchange agreement
with SSA and the associated system security requirements and procedures. SSA
will not retain the EIEP’s documentation any longer than required. SSA will
delete, purge, or destroy the documentation when the retention requirement
expires.
Compliance Reviews are either on-site or remote reviews. High-risk reviews must
be onsite reviews, medium risk reviews are usually onsite, and low risk reviews
may qualify for a remote review via telephone. The past performance of the entire
state determines whether a review is onsite or remote SSA determines a state’s
risk level based on the “high water mark principle.” If one agency is high risk,
the entire state is high risk. The following is a high-level example of the analysis
that aids SSA in making a preliminary determination as to which review format is
appropriate. SSA may also use additional factors to determine whether SSA will
perform an onsite or remote compliance review.
A. High/Medium Risk Criteria
1) undocumented closing of prior review finding(s),
2) implementation of management, operational or technical controls
that affect security of SSA-provided information (e.g.
implementation of new data access method), or
3) a reported PII breach within the state.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 42
B.Low Risk Criteria
1) no prior review finding(s) or prior finding(s) documented as closed
2) no implementation of technical/operational controls that impact
security of SSA provided
3) information (e.g. implementation of new data access method) no
reported PII breach
6.5.1 EIEP Compliance Review Participation
SSA may request to meet with the following stakeholders during the
compliance review:
a)a sample of managers, supervisors, information security officers,
system administrators, etc. responsible for enforcing and
monitoring ongoing compliance to security requirements and
procedures to assess their level of training to monitor their
employee’s use of SSA-provided information, and for reviewing
reports and taking necessary action
b)the individuals responsible for performing security awareness and
employee sanction functions to learn how EIEPs fulfill this
requirement
c)a sample of the EIEP’s employees to assess their level of training
and understanding of the requirements and potential sanctions
applicable to the use and misuse of SSA-provided information
d)the individual(s) responsible for management oversight and quality
assurance functions to confirm how the EIEP accomplishes this
requirement
e)any additional individuals as deemed appropriate by SSA (i.e.
analysts, Project/Program Manager, claims reps, etc.)
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 43
6.6 Scheduling the Onsite Review
SSA will not schedule the onsite review until SSA approves the EIEP’s SDP or the
EIEPs stakeholders participating in the compliance review have agreed upon a
schedule. There is no prescribed period for arranging the subsequent onsite review
(certification review for an EIEP requesting initial access to SSA-provided
information for an initial agreement or compliance review for other EIEPs). Unless
there are compelling circumstances precluding it; the onsite review will occur as
soon as reasonably possible.
The scheduling of the onsite review may depend on additional factors including:
a) the reason for submission of an SDP or CRQ,
b) the severity of security issues, if any,
c) circumstances of the previous review, if any, and
d) SSA’s workload and resource considerations.
(THE REST OF THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY)
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 44
7. Additional Definitions
Back Button:
Refers to a button on a web browser’s toolbar, the backspace button on a computer
keyboard, a programmed keyboard button or mouse button, etc., that returns a
user to a previously visited web page or application screen.
Breach:
Refers to actual loss, loss of control, compromise, unauthorized disclosure,
unauthorized acquisition, unauthorized access, or any similar term referring to
situations where unauthorized persons have access or potential access to PII or
Covered Information, whether physical, electronic, or in spoken word or recording
Browsing:
Requests for or queries of SSA-provided information for purposes not related to the
performance of official job duties
Choke Point:
The firewall between a local network and the Internet is a choke point in
network security, because any attacker would have to come through that
channel, which is typically protected and monitored.
Cloud Computing:
The term refers to Internet-based computing derived from the cloud drawing
representing the Internet in computer network diagrams. Cloud computing
providers deliver on-line and on-demand Internet services. Cloud Services
normally use a browser or Web Server to deliver and store information.
Cloud Computing (NIST SP 800-145 Excerpt):
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a
shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management effort or service
provider interaction. This cloud model is composed of five essential characteristics, three service
models, and four deployment models.
Essential Characteristics:
On-demand self-service - A consumer can unilaterally provision computing capabilities, such as
server time and network storage, as needed automatically without requiring human interaction with
each service provider.
Broad network access - Capabilities are available over the network and accessed through standard
mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones,
tablets, laptops, and workstations).
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 45
Resource pooling - The provider’s computing resources are pooled to serve multiple consumers
using a multi-tenant model, with different physical and virtual resources dynamically assigned and
reassigned according to consumer demand. There is a sense of location independence in that the
customer generally has no control or knowledge over the exact location of the provided resources
but may be able to specify location at a higher level of abstraction (e.g., country, state, or
datacenter). Examples of resources include storage, processing, memory, and network bandwidth.
Rapid elasticity - Capabilities can be elastically provisioned and released, in some cases
automatically, to scale rapidly outward and inward commensurate with demand. To the consumer,
the capabilities available for provisioning often appear to be unlimited and can be appropriated in
any quantity at any time.
Measured service - Cloud systems automatically control and optimize resource use by leveraging
a metering capability1 at some level of abstraction appropriate to the type of service (e.g., storage,
processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled,
and reported, providing transparency for both the provider and consumer of the utilized service.
Service Models:
Software as a Service (SaaS) - The capability provided to the consumer is to use the provider’s
applications running on a cloud infrastructure2. The applications are accessible from various client
devices through either a thin client interface, such as a web browser (e.g., web-based email), or a
program interface. The consumer does not manage or control the underlying cloud infrastructure
including network, servers, operating systems, storage, or even individual application capabilities,
with the possible exception of limited user-specific application configuration settings.
Platform as a Service (PaaS) - The capability provided to the consumer is to deploy onto the
cloud infrastructure consumer-created or acquired applications created using programming
languages, libraries, services, and tools supported by the provider.3 The consumer does not manage
or control the underlying cloud infrastructure including network, servers, operating systems, or
storage, but has control over the deployed applications and possibly configuration settings for the
application-hosting environment.
Infrastructure as a Service (IaaS) - The capability provided to the consumer is to provision
processing, storage, networks, and other fundamental computing resources where the consumer is
able to deploy and run arbitrary software, which can include operating systems and applications.
The consumer does not manage or control the underlying cloud infrastructure but has control over
operating systems, storage, and deployed applications; and possibly limited control of select
networking components (e.g., host firewalls).
Deployment Models:
Private cloud - The cloud infrastructure is provisioned for exclusive use by a single organization
comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by
the organization, a third party, or some combination of them, and it may exist on or off premises.
Community cloud - The cloud infrastructure is provisioned for exclusive use by a specific
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 46
community of consumers from organizations that have shared concerns (e.g., mission, security
requirements, policy, and compliance considerations). It may be owned, managed, and operated by
one or more of the organizations in the community, a third party, or some combination of them, and
it may exist on or off premises.
Public cloud - The cloud infrastructure is provisioned for open use by the general public. It may be
owned, managed, and operated by a business, academic, or government organization, or some
combination of them. It exists on the premises of the cloud provider.
Hybrid cloud - The cloud infrastructure is a composition of two or more distinct cloud
infrastructures (private, community, or public) that remain unique entities, but are bound together
by standardized or proprietary technology that enables data and application portability (e.g., cloud
bursting for load balancing between clouds).
_________________________________
1 Typically this is done on a pay-per-use or charge-per-use basis.
2 A cloud infrastructure is the collection of hardware and software that enables the five essential
characteristics of cloud computing. The cloud infrastructure can be viewed as containing both a physical
layer and an abstraction layer. The physical layer consists of the hardware resources that are necessary to
support the cloud services being provided, and typically includes server, storage and network components.
The abstraction layer consists of the software deployed across the physical layer, which manifests the
essential cloud characteristics. Conceptually the abstraction layer sits above the physical lay er.
3 This capability does not necessarily preclude the use of compatible programming languages, libraries,
services, and tools from other sources.
Cloud Drive:
A cloud drive is a Web-based service that provides storage space on a remote server.
Cloud Audit:
Cloud Audit is a specification developed at Cisco Systems, Inc. that provides cloud
computing service providers a standard way to present and share detailed,
automated statistics about performance and security.
The Federal Risk and Authorization Program (FedRAMP):
FedRAMP is a risk management program that provides a standardized approach
for assessing and monitoring the security of cloud products and services.
Commingling:
Commingling is the creation of a common database or repository that stores a nd
maintains both SSA-provided information and preexisting EIEP PII.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 47
Data Exchange:
Data Exchange is a logical transfer of information from one government entity’s
systems of records (SOR) to another agency’s application or mainframe through a
secure and exclusive connection.
Degaussing:
Degaussing is the method of using a “special device” (i.e., a device that generates a
magnetic field) in order to disrupt magnetically recorded information. Degaussing
can be effective for purging damaged media and media with exceptionally large
storage capacities. Degaussing is not effective for purging non-magnetic media (e.g.,
optical discs).
Function:
One or more persons or organizational components assigned to serve a particular
purpose, or perform a particular role. The purpose, activity, or role assigned to one
or more persons or organizational components.
Hub:
As it relates to electronic data exchange with SSA, a hub is an organization, which
serves as an electronic information conduit or distribution collection point. The
term Hub is interchangeable with the terms “StateTransmission Component,”
“State Transfer Component,” or “STC.”
ICON:
Interstate Connection Network (various entities use 'Connectivity' rather than
'Connection')
IV & V:
Independent Verification and Validation
Legacy System:
A term usually referring to a corporate or organizational computer system or
network that utilizes outmoded programming languages, software, and/or hardware
that typically no longer receives support from the original vendors or developers.
Manual Transaction:
A user-initiated operation (also referred to as a “user-initiated transaction‟). This is
the opposite of a system-generated automated process.
Example: A user enters a client’s information including the client’s SSN and
presses the “ENTER‟ key to acknowledge that input of data is complete. A new
screen appears with multiple options, which include “VERIFY SSN‟ and
“CONTINUE‟. The user has the option to verify the client’s SSN or perform
alternative actions.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 48
Media Sanitization:
f)Disposal: Refers to the discarding (e.g., recycling) media that
contains no sensitive or confidential data.
g)Overwriting/Clearing: This type of media sanitization is adequate for
protecting information from a robust keyboard attack. Clearing must
prevent retrieval of information by data, disk, or file recovery utilities.
Clearing must be resistant to keystroke recovery attempts executed
from standard input devices and from data scavenging tools. For
example, overwriting is an acceptable method for clearing media.
Deleting items, however, is not sufficient for clearing.
This process may include overwriting all addressable locations of the
data, as well as its logical storage location (e.g., its file allocation table).
The aim of the overwriting process is to replace or obfuscate existing
information with random data. Most rewriteable media may be cleared
by a single overwrite. This method of sanitization is not possible on un-
writeable or damaged media.
h) Purging: This type of media sanitization is a process that protects
information from a laboratory attack. The terms clearing and
purging are sometimes synonymous. However, for some media,
clearing is not sufficient for purging (i.e., protecting data from a
laboratory attack). Although most re-writeable media requires a
single overwrite, purging may require multiple rewrites using
different characters for each write cycle.
This is because a laboratory attack involves threats with the capability
to employ non-standard assets (e.g., specialized hardware) to attempt
data recovery on media outside of that media’s normal operating
environment.
i)Degaussing is also an example of an acceptable method for purging
magnetic media. The EIEP should destroy media if purging is not a
viable method for sanitization.
Destruction: Physical destruction of media is the most effective form of
sanitization. Methods of destruction include burning, pulverizing, and
shredding. Any residual medium should be able to withstand a laboratory
attack.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 49
Permission module:
A utility or subprogram within an application, which automatically enforces the
relationship of a request for or query of SSA-provided information to an
authorized process or transaction before initiating a transaction. The System
will not allow a user to request information from SSA unless the EIEP’s client
system contains a record of the subject individual’s SSN. A properly configured
Permission Module also enforces referential integrity and prevents unauthorized
random browsing of PII.
Screen Scraping:
Screen scraping is normally associated with the programmatic collection of visual
data from a source. Originally, screen scraping referred to the practice of reading
text data from a computer display terminal’s screen. This involves reading the
terminal's memory through its auxiliary port, or by connecting the terminal output
port of one computer system to an input port on another. The term screen scraping is
synonymous with the term bidirectional exchange of data.
A screen scraper might connect to a legacy system via Telnet, emulate the keystrokes
needed to navigate the legacy user interface, process the resulting display output,
extract the desired data, and pass it on to a modern system.
More modern screen scraping techniques include capturing the bitmap data from
a screen and running it through an optical character reader engine, or in the case
of graphi cal user interface applications, querying the graphical controls by
programmatically obtaining references to their underlying programming objects.
Security Breach: An act from outside an organization that bypasses or violates security policies,
practices, or procedures.
Security Incident: A security incident happens when a fact or event signifies the possibility that a breach
of security may be taking place, or may have taken place. All threats are security
incidents, but not all security incidents are threats.
Security Violation:
An act from within an organization that bypasses or disobeys security policies,
practices, or procedures.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 50
Sensitive data:
Sensitive data is a special category of personally identifiable information (PII) that has
the potential to cause great harm to an individual, government agency, or program if
abused, misused, or breached. It is sensitive information protected against unwarranted
disclosure and carries specific criminal and civil penalties for an individual convicted of
unauthorized access, disclosure, or misuse. Protection of sensitive information usually
involves specific classification or legal precedents that provide special protection for
legal and ethical reasons.
Security Information Management (SIM):
SIM is software that automates the collection of event log data from security devices
such as firewalls, proxy servers, intrusion detection systems and anti-virus software.
The SIM translates the data into correlated and simplified formats.
SMDS (Switched Multimegabit Data Service (SMDS):
SMDS is a telecommunications service that provides connectionless, high-
performance, packet- switched data transport. Although not a protocol, it supports
standard protocols and communications interfaces using current technology.
SSA-provided data/information:
Synonym ous with “SSA-supplied data/information‟, defines information under the
control of SSA provided to an external entity under the terms of an information
exchange agreement with SSA. The following are examples of SSA-provided
data/information:
SSA’s response to a request from an EIEP for information from SSA (e.g.,
date of death)
SSA’s response to a query from an EIEP for verification of an SSN
SSA data/information:
This term, sometimes used interchangeably with “SSA-provided data/information,‟
denotes information under the control of SSA provided to an external entity under the
terms of an information exchange agreement with SSA. However, “SSA
data/information” also includes information provided to the EIEP by a source other
than SSA, but which the EIEP attests to that SSA verified it, or the EIEP couples the
information with data from SSA as to to certify the accuracy of the information. The
following are examples of SSA information:
SSA’s response to a request from an EIEP for information from SSA (e.g.,
date of death)
SSA’s response to a query from an EIEP for verification of an SSN
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 51
Display by the EIEP of SSA’s response to a query for
verification of an SSN and the associated SSN provided by SSA
Display by the EIEP of SSA’s response to a query for
verification of an SSN and the associated SSN provided to the
EIEP by a source other than SSA
Electronic records that contain only SSA’s response to a query for
verification of an SSN and the associated SSN whether provided to the
EIEP by SSA or a source other than SSA
SSN:
Social Security Number
STC:
A State Transmission/Transfer Component is an organization, which performs as an
electronic information conduit or collection point for one or more other entities (also
referred to as a hub).
System-generated transaction:
A transaction automatically triggered by an automated system process.
Example: A user enters a client’s information including the client’s SSN on an
input screen and presses the “ENTER‟ key to acknowledge that input of data is
complete. An automated process then matches the SSN against the organization’s
database and when the systems finds no match, automatically sends an electronic
request for verification of the SSN to SSA.
Systems process:
Systems Process refers to a software program module that runs in the
background within an automated batch, online, or other process.
Third Party:
Third Party pertains to an entity (person or organization) provided access to SSA-
provided information by an EIEP or other SSA business partner for which one or
more of the following apply:
is not stipulated access to SSA-provided information by an information-
sharing agreement between an EIEP and SSA has no data exchange agreement with SSA SSA does not directly authorize access to SSA-provided information
Transaction-driven:
This term pertains to an automatically initiated online query of or request for SSA
information by an automated transaction process (e.g., driver license issuance,
etc.). The query or request will only occur the automated process meets prescribed
conditions.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 52
Uncontrolled transaction:
This term pertains to a transaction that falls outside a permission module. An
uncontrolled transaction is not subject to a systematically enforced relationship
between an authorized process or application and an existing client record.
8. Regulatory References
o Federal Information Processing Standards (FIPS) Publications
o Federal Information Security Management Act of 2002
(FISMA)
o Homeland Security Presidential Directive (HSPD-12)
o National Institute of Standards and Technology (NIST) Special
Publications
o Office of Management and Budget (OMB) Circular A-123,
Management’s Responsibility for Internal Control
o Office of Management and Budget (OMB) Circular A-130,
Appendix III, Management of Federal Information Resources
o Office of Management and Budget (OMB) Memo M-06-16,
Protection of Sensitive Agency Information, June 23, 2006
o Office of Management and Budget (OMB) Memo M-07-16,
Memorandum for the Heads of Executive Departments and
Agencies May 22, 2007
o Office of Management and Budget (OMB) Memo M-07-17,
Safeguarding Against and Responding to the Breach of
Personally Identifiable Information, May 22, 2007
o Privacy Act of 1974, as amended
9. Frequently Asked Questions
(Click links for answers or additional information)
1. Q: What is a breach of data?
A: Refer to Security Breach, Security Incident, and Security Violation.
2. Q: What is employee browsing?
A: Requests for or queries of SSA-provided information for purposes not
related to the performance of official job duties
3. Q: Okay, so the EIEP submitted the SDP. Can SSA schedule the Onsite
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 53
Review?
A: Refer to Scheduling the Onsite Review.
4. Q: What is a “Permission Module?”
A: A utility or subprogram within an application, which automatically
enforces the relationship of a request for or query of SSA-provided
information to an authorized process or transaction before initiating
a transaction. For example, if requests for verification of an SSN
for issuance of a driver’s license happens automatically from within
a state driver’s license application. The System will not allow a
user to request information from SSA unless the EIEP’s client
system contains a record of the subject individual’s SSN.
5. Q: What “Screen Scraping?”
A: Screen scraping is normally associated with the programmatic
collection of visual data from a source. Originall y, screen scraping
referred to the practice of reading text data from a computer display
terminal’s screen. This involves reading the terminal's memory through
its auxiliary port, or by connecting the terminal output port of one
computer system to an input port on another. The term screen scraping
is synonymous with the term bidirectional exchange of data.
A screen scraper might connect to a legacy system via Telnet, emulate
the keystrokes needed to navigate the legacy user interface, process
the resulting display output, extract the desired data, and pass it on to
a modern system.
More modern screen scraping techniques include capturing the
bitmap data from a screen and running it through an optical
character reader engine, or in the case of graphical user interface
applications, querying the graphical controls by programmatically
obtaining references to their underlyi ng programming objects.
6. Q: When does an EIEP have to submit an SDP?
A: Refer to When the SDP is Required .
7. Q: Does an EIEP have to submit an SDP when the agreement is renewed?
A: The EIEP does not have to submit an SDP because the agreement
between the EIEP and SSA was renewed. There are, however,
circumstances that require an EIEP to submit an SDP.
Refer to When the SDP is Required.
8. Q: Is it acceptable to save SSA-provided information with a verified
indicator on a (EIEP) workstation if the EIEP uses an encrypted hard
drive? If not, what options does the agency have?
A: There is no problem with an EIEP saving SSA-provided information on
the encrypted hard drives of computers used to process SSA-provided
information if the EIEP retains the information only as provided for in
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 54
the EIEP’s data-sharing agreement with SSA.
Refer to Data and Communications Security.
9. Q: Does SSA allow EIEPs to use caching of SSA-provided information on
the EIEP’s workstations?
A: Caching during processing is not a problem. However, SSA-provided
information must clear from the cache when the user exits the
application. Refer to Data and Communications Security.
10. Q: What does the term “interconnections to other systems” mean?
A: As used in SSA’s system security requirements document, the term
“interconnections” is the same as the term “connections.”
11. Q: Is it acceptable to submit the SDP as a .PDF file?
A: No, it is not. The document must remain editable.
12. Q: Should the EIEP write the SDP from the standpoint of the EIEP SVES
(or applicable data element) access itself, or from the standpoint of
access to all data provided to the EIEP by SSA?
A: The SDP is to encompass the EIEP’s entire electronic access to SSA-
provided information as per the electronic data exchange agreement
between the EIEP and SSA.
Refer to Developing the SDP.
13. Q: If the EIEP has a “transaction-driven” system, does the EIEP still
need a permission module? If employees cannot initiate a query to
SSA, why would the EIEP need the permission module?
A: “Transaction driven” means that queries submit requests
automatically (and it might depend on the transaction). Depending on
the system’s design, queries might not be automatic or it may still permit
manual transactions. A system may require manual transactions to
correct an error. SSA does not prohibit manual transactions if an ATS
properly tracks such transactions. If a “transaction-driven” system
permits any type of alternate access, it still requires a permission module, even
if it restricts users from performing manual transactions. If the system does
not require the user to be in a particular application and/or the query to
be for an existing record in the EIEP’s system before the system will
allow a query to go through to SSA, it would still need a permission
module.
14. Q: What is an Onsite Compliance Review?
A: The Onsite Compliance Review is SSA’s periodic site visits to its
Electronic Information Exchange Partners (EIEP) to certify whether the
EIEP’s management, operational, and technical security measures for
protecting data obtained electronically from SSA continue to conform to
the terms of the EIEP’s data sharing agreements with SSA and SSA’s
associated system security requirements and procedures.
Refer to the Compliance Review Program and Process.
Exhibit E, Attachment B
TSSR-Version 7.0 – 07/2015 Page 55
15. Q: What are the criteria for performing an Onsite Compliance Review?
A: The following are criteria for performing the Onsite
Compliance Review:
o EIEP initiating new access or new access method for obtaining
information from SSA
o EIEP’s cyclical review (previous review was performed remotely)
o EIEP has made significant change(s) in its operating or security
platform involving SSA-provided information
o EIEP experienced a breach of SSA-provided personally
identifying information (PII)
o EIEP has been determined to be high-risk
16. Q: What is a Remote Compliance Review?
A: The Remote Compliance Review is when SSA conducts the meetings
remotely (e.g., via conference calls). SSA schedules conference calls with
its EIEPs to determine whether the EIEPs technical, managerial, and
operational security measures for protecting data obtained electronically
from SSA continue to conform to the terms of the EIEP’s data sharing
agreements with SSA and SSA‟s associated system security requirements
and procedures. Refer to the Compliance Review Program and Process.
17. Q: What are the criteria for performing a Remote Compliance Review?
A: The EIEP must satisfy the following criteria to qualify for a Remote
Compliance Review:
o EIEP’s cyclical review (SSA’s previous review yielded no
findings or the EIEP satisfactorily resolved cited findings)
o EIEP has made no significant change(s) in its operating
or security platform involving SSA-provided information
o EIEP has not experienced a breach of SSA-provided
personally identifying information (PII) since its
previous compliance review.
o SSA rates the EIEP as a low-risk agency or state
Exhibit E, Attachment B
ATTACHMENT 5
SYSTEM CERTIFICATION REQUIREMENTS FOR THE CMS HUB
Not Applicable
Exhibit E, Attachment B
Attachment 5
Security Certification Requirements for use of the SSA Data Set via the Centers for
Medicare & Medicaid Services’ (CMS) Hub
The Social Security Administration (SSA) does not allow new data exchange partners to begin
receiving data electronically until the Authorized State Agency submits an approved Security
Design Plan (SDP). SSA’s Office of Information Security (OIS) usually performs an onsite
security review to verify and validate that the management, operational, and technical controls
conform to the requirements of the signed agreements between SSA and the Authorized State
Agency, as well as applicable Federal law and SSA’s technical systems security requirements
(Attachment 4 to the Information Exchange Agreement (IEA)). As it concerns the use of the
SSA Data Set via the Hub, OIS will waive the initial SDP/Certification for an existing
Authorized State Agency if it meets all the following criteria:
1.The Authorized State Agency already has a functioning CMS-approved Integrated
Eligibility Verification System (IEVS).
2. The Authorized State Agency is already receiving data from the Hub to support the
Medicaid program and/or the Children’s Health Insurance Program (CHIP).
3. The Authorized State Agency will only process requests for the SSA Data Set for
administration of health or income maintenance programs approved by SSA through the
Hub in conjunction with Insurance Affordability Programs eligibility determinations.
4. The Authorized State Agency agrees that the SSA security controls identified in the IEA
and Attachment 4 to the IEA will prevail for all SSA data received by the State Agency,
including the SSA Data Set.
5. The Authorized State Agency agrees that a significant vulnerability or risk in a security
control, a data loss, or a security breach may result in a suspension or termination of the
SSA Data Set through the Hub. In this case, at SSA’s request, the Authorized State
Agency agrees to immediately cease using the SSA Data Set for all SSA authorized health
or income maintenance programs until the State Agency sufficiently mitigates or
eliminates such risk(s) and/or vulnerabilities to SSA’s data.
6. The Authorized State Agency agrees not to process verification requests through the Hub
from a standalone application for health or income maintenance program requests that
have no connection to Insurance Affordability Programs eligibility determinations.
In the event that an Authorized State Agency decides to implement a new integrated eligibility
system or use a different Authorized State Agency to implement the health or income
maintenance data exchange process through the Hub, the Authorized State Agency will submit to
SSA’s OIS an SDP and be approved/certified prior to receipt of the SSA Data Set through the
Hub. The Authorized State Agency will adhere to the following criteria, in addition to those
stated in the IEA, section C, Program Questionnaire:
1.The Authorized State Agency agrees to provide an attestation to SSA that it has received
certification through the CMS Hub approval MARS-E process.
2. The Authorized State Agency attests that it operates and has a CMS-approved IEVS and
the IEVS initiates the request for the SSA Data Set for the State Agency’s administration
of health or income maintenance programs approved by SSA through the Hub in
conjunction with Insurance Affordability Programs eligibility determinations.
Exhibit E, Attachment B
Attachment 5
3. The Authorized State Agency uses a streamlined multi-benefit application. The
Authorized State Agency agrees not to process verification requests through the Hub
from a standalone application for health or income maintenance program requests that
have no connection to Insurance Affordability Programs eligibility determinations.
4. The Authorized State Agency will not request the SSA Data Set through the Hub until it
has successfully begun using the Hub for administration of Insurance Affordability
Programs eligibility determinations. SSA will begin sending the SSA Data Set to the
Authorized State Agency after the State Agency verifies that the Hub process works, as
required by the CMS Hub approval MARS-E process.
5. The Authorized State Agency agrees to participate in SSA’s SDP/Certification process
prior to transmitting requests for the SSA Data Set through the Hub and to participate in
SSA’s triennial security compliance reviews on an ongoing basis.
6. The Authorized State Agency agrees that a significant vulnerability or risk in a security
control, a data loss, or a security breach may result in a suspension or termination of the
SSA Data Set through Hub. In this case, at SSA’s request, the Authorized State Agency
agrees to immediately cease using the SSA Data Set for all SSA authorized health or
income maintenance programs until the State Agency sufficiently mitigates or eliminates
such risk(s) and/or vulnerabilities to SSA’s data.
Exhibit E, Attachment B
ATTACHMENT 6
WORKSHEET FOR REPORTING LOSS OR PORTENTIAL LOSS
OF PERSONALLY INDETIFIABLE INFORMATION
Exhibit E, Attachment B
ATTACHMENT 6
09/27/06
Worksheet for Reporting Loss or Potential Loss of Personally Identifiable
Information
1. Information about the individual making the report to the NCSC:
Name:
Position:
Deputy Commissioner Level Organization:
Phone Numbers:
Work: Cell: Home/Other:
E-mail Address:
Check one of the following:
Management Official Security Officer Non-Management
2. Information about the data that was lost/stolen:
Describe what was lost or stolen (e.g., case file, MBR data):
Which element(s) of PII did the data contain?
Name Bank Account Info
SSN Medical/Health Information
Date of Birth Benefit Payment Info
Place of Birth Mother’s Maiden Name
Address Other (describe):
Estimated volume of records involved:
3. How was the data physically stored, packaged and/or contained?
Paper or Electronic? (circle one):
If Electronic, what type of device?
Laptop Tablet Backup Tape Blackberry
Workstation Server CD/DVD Blackberry Phone #
Hard Drive Floppy Disk USB Drive
Other (describe):
Exhibit E, Attachment B
I
I
I
I I I I I
I
I I I I I
I
ATTACHMENT 6
09/27/06
Additional Questions if Electronic:
Yes No Not Sure
a. Was the device encrypted?
b. Was the device password protected?
c. If a laptop or tablet, was a VPN SmartCard lost?
Cardholder’s Name:
Cardholder’s SSA logon PIN:
Hardware Make/Model:
Hardware Serial Number:
Additional Questions if Paper:
Yes No Not Sure
a. Was the information in a locked briefcase?
b. Was the information in a locked cabinet or drawer?
c. Was the information in a locked vehicle trunk?
d. Was the information redacted?
e. Other circumstances:
4. If the employee/contractor who was in possession of the data or to whom the
data was assigned is not the person making the report to the NCSC (as listed in
#1), information about this employee/contractor:
Name:
Position:
Deputy Commissioner Level Organization:
Phone Numbers:
Work: Cell: Home/Other:
E-mail Address:
5. Circumstances of the loss:
a. When was it lost/stolen?
b. Brief description of how the loss/theft occurred:
c. When was it reported to SSA management official (date and time)?
6. Have any other SSA components been contacted? If so, who? (Include deputy
commissioner level, agency level, regional/associate level component names)
Exhibit E, Attachment B
I
I
I
I I I I I
I
ATTACHMENT 6
09/27/06
7. Which reports have been filed? (include FPS, local police, and SSA reports)
Report Filed Yes No Report Number
Federal Protective Service
Local Police
Yes No
SSA-3114 (Incident Alert)
SSA-342 (Report of Survey)
Other (describe)
8. Other pertinent information (include actions under way, as well as any contacts
with other agencies, law enforcement or the press):
Exhibit E, Attachment B
CCC 04/2017
CERTIFICATION
I, the officia l named below, CERTIFY UNDER PENALTY OF PERJURY that I am duly
authori zed to legall y bind the prospective Contractor to the c lause(s) li sted below. Th is
certification is made under the laws of the State of Cali fornia.
Contractor/Bidder Firm Name (Printed) Federal ID Number
County of Fresno 94 -6000512
By (ti:r:ignature)
P rinted Name and Title of Person Signing
Brian Pacheco, Chairman of th e Board of Supervisors
IDate Executed
1:J..-5-~lt
I Executed in the County of
Fresno
CONTRACTOR CERTIFICATION CLAUSES
I. ST A TEMENT OF COMPLIANCE: Contractor has, unless exempted , complied w ith
the nondi sc rimination program requirements. (Gov. Code§ 12990 (a-f) and CCR, Title 2,
Section 111 02) (Not applicable to public e ntities.)
2. DRUG-FREE WORKPLACE REQUIREMENTS: Contractor will comp ly with the
requirements of the Drug -Free Workplace Act of 1990 a nd wi ll provide a drug-free
workp lace by taking the fo ll owin g actions:
a. Publi s h a stat ement notifying employees that unlawful manufacture, distribution,
dispensation, possession or use of a contro ll ed s ubstance is prohibited and s pecifying
actions to be t aken against emp loyees for viol ations.
b. Establish a Drug-Free Awareness Program to inform employees about:
1) the dangers of drug abuse in the workplace;
2) the p erson's or organization's policy of maintaining a drug-free workplace;
3) a ny available counse lin g, rehabilitation and empl oyee assistance programs; and,
4) pe nalti es that ma y be imposed upon employees for drug abuse v io lations .
c. Every employee who works o n the proposed Agreement will:
1) receive a copy of the company's drug-free workplace policy stateme nt; and,
2) agre e to abide b y the term s of the company's state m ent as a condition of employment
on the Agreement.
Failure to comply with these requirements may res ult in suspens ion of payment s under
the Agreement or termin ation of the Agreement or both and Contractor may be ineligible
for awa rd of any future State agreements if the department determines that an y of the
fo ll owin g has occurred: the Contractor ha s made false certification , or violated the
Page 1 of 4
Page 2 of 4
certification by failing to carry out the requirements as noted above. (Gov. Code §8350 et
seq.)
3. NATIONAL LABOR RELATIONS BOARD CERTIFICATION: Contractor certifies
that no more than one (1) final unappealable finding of contempt of court by a Federal
court has been issued against Contractor within the immediately preceding two-year
period because of Contractor's failure to comply with an order of a Federal court, which
orders Contractor to comply with an order of the National Labor Relations Board. (Pub.
Contract Code §10296) (Not applicable to public entities.)
4. CONTRACTS FOR LEGAL SERVICES $50,000 OR MORE- PRO BONO
REQUIREMENT: Contractor hereby certifies that Contractor will comply with the
requirements of Section 6072 of the Business and Professions Code, effective January 1,
2003.
Contractor agrees to make a good faith effort to provide a minimum number of hours of
pro bono legal services during each year of the contract equal to the lessor of 30
multiplied by the number of full time attorneys in the firm’s offices in the State, with the
number of hours prorated on an actual day basis for any contract period of less than a full
year or 10% of its contract with the State.
Failure to make a good faith effort may be cause for non-renewal of a state contract for
legal services, and may be taken into account when determining the award of future
contracts with the State for legal services.
5. EXPATRIATE CORPORATIONS: Contractor hereby declares that it is not an
expatriate corporation or subsidiary of an expatriate corporation within the meaning of
Public Contract Code Section 10286 and 10286.1, and is eligible to contract with the
State of California.
6. SWEATFREE CODE OF CONDUCT:
a. All Contractors contracting for the procurement or laundering of apparel, garments or
corresponding accessories, or the procurement of equipment, materials, or supplies, other
than procurement related to a public works contract, declare under penalty of perjury that
no apparel, garments or corresponding accessories, equipment, materials, or supplies
furnished to the state pursuant to the contract have been laundered or produced in whole
or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal
sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or
with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under
penal sanction, abusive forms of child labor or exploitation of children in sweatshop
labor. The contractor further declares under penalty of perjury that they adhere to the
Sweatfree Code of Conduct as set forth on the California Department of Industrial
Relations website located at www.dir.ca.gov, and Public Contract Code Section 6108.
b. The contractor agrees to cooperate fully in providing reasonable access to the
contractor’s records, documents, agents or employees, or premises if reasonably required
by authorized officials of the contracting agency, the Department of Industrial Relations,
Page 3 of 4
or the Department of Justice to determine the contractor’s compliance with the
requirements under paragraph (a).
7. DOMESTIC PARTNERS: For contracts of $100,000 or more, Contractor certifies
that Contractor is in compliance with Public Contract Code section 10295.3.
8. GENDER IDENTITY: For contracts of $100,000 or more, Contractor certifies that
Contractor is in compliance with Public Contract Code section 10295.35.
DOING BUSINESS WITH THE STATE OF CALIFORNIA
The following laws apply to persons or entities doing business with the State of
California.
1. CONFLICT OF INTEREST: Contractor needs to be aware of the following provisions
regarding current or former state employees. If Contractor has any questions on the
status of any person rendering services or involved with the Agreement, the awarding
agency must be contacted immediately for clarification.
Current State Employees (Pub. Contract Code §10410):
1). No officer or employee shall engage in any employment, activity or enterprise from
which the officer or employee receives compensation or has a financial interest and
which is sponsored or funded by any state agency, unless the employment, activity or
enterprise is required as a condition of regular state employment.
2). No officer or employee shall contract on his or her own behalf as an independent
contractor with any state agency to provide goods or services.
Former State Employees (Pub. Contract Code §10411):
1). For the two-year period from the date he or she left state employment, no former state
officer or employee may enter into a contract in which he or she engaged in any of the
negotiations, transactions, planning, arrangements or any part of the decision-making
process relevant to the contract while employed in any capacity by any state agency.
2). For the twelve-month period from the date he or she left state employment, no former
state officer or employee may enter into a contract with any state agency if he or she was
employed by that state agency in a policy-making position in the same general subject
area as the proposed contract within the 12-month period prior to his or her leaving state
service.
If Contractor violates any provisions of above paragraphs, such action by Contractor shall
render this Agreement void. (Pub. Contract Code §10420)
Members of boards and commissions are exempt from this section if they do not receive
payment other than payment of each meeting of the board or commission, payment for
preparatory time and payment for per diem. (Pub. Contract Code §10430 (e))
Page 4 of 4
2. LABOR CODE/WORKERS' COMPENSATION: Contractor needs to be aware of the
provisions which require every employer to be insured against liability for Worker's
Compensation or to undertake self-insurance in accordance with the provisions, and
Contractor affirms to comply with such provisions before commencing the performance
of the work of this Agreement. (Labor Code Section 3700)
3. AMERICANS WITH DISABILITIES ACT: Contractor assures the State that it
complies with the Americans with Disabilities Act (ADA) of 1990, which prohibits
discrimination on the basis of disability, as well as all applicable regulations and
guidelines issued pursuant to the ADA. (42 U.S.C. 12101 et seq.)
4. CONTRACTOR NAME CHANGE: An amendment is required to change the
Contractor's name as listed on this Agreement. Upon receipt of legal documentation of
the name change the State will process the amendment. Payment of invoices presented
with a new name cannot be paid prior to approval of said amendment.
5. CORPORATE QUALIFICATIONS TO DO BUSINESS IN CALIFORNIA:
a. When agreements are to be performed in the state by corporations, the contracting
agencies will be verifying that the contractor is currently qualified to do business in
California in order to ensure that all obligations due to the state are fulfilled.
b. "Doing business" is defined in R&TC Section 23101 as actively engaging in any
transaction for the purpose of financial or pecuniary gain or profit. Although there are
some statutory exceptions to taxation, rarely will a corporate contractor performing
within the state not be subject to the franchise tax.
c. Both domestic and foreign corporations (those incorporated outside of California) must
be in good standing in order to be qualified to do business in California. Agencies will
determine whether a corporation is in good standing by calling the Office of the Secretary
of State.
6. RESOLUTION: A county, city, district, or other local public body must provide the
State with a copy of a resolution, order, motion, or ordinance of the local governing body
which by law has authority to enter into an agreement, authorizing execution of the
agreement.
7. AIR OR WATER POLLUTION VIOLATION: Under the State laws, the Contractor
shall not be: (1) in violation of any order or resolution not subject to review promulgated
by the State Air Resources Board or an air pollution control district; (2) subject to cease
and desist order not subject to review issued pursuant to Section 13301 of the Water
Code for violation of waste discharge requirements or discharge prohibitions; or (3)
finally determined to be in violation of provisions of federal law relating to air or water
pollution.
8. PAYEE DATA RECORD FORM STD. 204: This form must be completed by all
contractors that are not another state agency or other governmental entity.