RFR - Community Partners

(e) Contractor shall ensure that any agent or subcontractor to whom it provides PI received from, or
created or received by it on behalf of MassHealth agrees in writing to the same restrictions and conditions
that apply to Contractor under this Contract with respect to such information. Contractor is solely
responsible for its agents’ and subcontractors’ compliance with all provisions of this MassHealth and
Commonwealth Care Enrollment Outreach Grant Contract. Contractor is not relieved of any obligation
under this Contract because PI was in the hands of its agent or subcontractor or because its agent or
subcontractor failed to fulfill any reporting obligation to it necessary for Contractor to fulfill its reporting
obligations hereunder.
(f) Contractor shall implement administrative, physical, and technical safeguards that reasonably and
appropriately protect the confidentiality, integrity, and availability of PI. Upon MassHealth’s request,
Contractor shall permit representatives of MassHealth access to premises where PI is maintained, created,
used, or disclosed for the purpose of inspecting privacy and security arrangements. Such safeguards shall
meet, at a minimum, all standards set in the Privacy and Security Rules, as applicable to a business
associate. Contractor shall comply with all security mechanisms and processes established for access to
any of MassHealth’s databases. Contractor shall protect from inappropriate use or disclosure any
password, user ID, or other mechanism or code permitting access to any database containing
MassHealth’s PI, and shall give MassHealth prior notice of any change in personnel whenever the change
requires a termination or modification of any such password, user ID, or other security mechanism or
code to maintain the integrity of the database.
(g) Immediately upon becoming aware of any use or disclosure of PI not permitted under this
Contract or of any Security Incident, Contractor shall take all appropriate action necessary to: 1) retrieve,
to the extent practicable, any PI used or disclosed in the non-permitted manner, 2) mitigate, to the extent
practicable, any harmful effect of the non-permitted use or disclosure of the PI known to Contractor, and
3) take such further action as may be required by any applicable state or federal law concerning the
privacy and security of such PI. Within two business days of becoming aware of the non-permitted use or
disclosure, Contractor shall report to MassHealth, both verbally and in writing, the nature of the nonpermitted
use or disclosure, the harmful effects known to Contractor, all actions it has taken or plans to
take in accord with this paragraph, and the results of all mitigation actions already taken by it under this
paragraph. Upon MassHealth’s request, Contractor shall take such further actions as deemed appropriate
by MassHealth to mitigate, to the extent practicable, any harmful effect of the non-permitted use or
disclosure. Any actions to mitigate harmful effects of privacy or security violations undertaken by
Contractor on its own initiative or pursuant to MassHealth’s request under this paragraph shall not relieve
Contractor of its obligations to report such violations as set forth in other provisions of this Contract.
(h) Contractor shall immediately report to MassHealth, both verbally and in writing, any instance
where PI or any other data obtained under this Contract is requested, subpoenaed, or becomes the subject
of a court or administrative order or other legal process. In response to such requests, Contractor shall
take all necessary legal steps to comply with M.G.L. c. 66A, Medicaid regulations including 42 CFR
431.306 (f), and any other applicable federal and state law. In no event shall Contractor’s immediate
reporting obligations under this paragraph be delayed beyond two business days from obtaining such
knowledge or request for data.
(i) Contractor shall provide MassHealth, or upon MassHealth’s request, the Individual, with access
to or copies of any PI maintained by it, as shall be necessary for MassHealth to meet its obligation under
45 CFR § 164.524 to provide an Individual with access to certain PI pertaining to the Individual. Such
access or copies shall be provided to MassHealth or to the Individual at a reasonable time and manner to
be specified by MassHealth in the request and as shall be necessary for MassHealth to meet all time and
other requirements set forth in 45 CFR § 164.524. In the event Contractor receives a request for access
RFR for MassHealth and Commonwealth Care Enrollment Outreach Grants 2
FY 2008