Molina Medicaid Solutions - DHHR

Bridging the Rivers ofChange TogetherWest Virginia MMIS Re-ProcurementSolicitation: MED13006Req #GT.477. General and Technical (GT)Description of RequirementAbility to anticipate and provide a flexible solution that ispositioned to effectively meet the requirements of current andfuture HIPAA security regulations.YESwithoutcustomizationXGT.48 Ability to provide a role-based Single Sign On (SSO) solution. XGT.49 Requests for access are to come from an authoritative source(s) as Xdefined by BMS.GT.50 Ability to require that all users (including all vendor support staff Xmembers) have a unique user ID and password, where:GT.51 Required passwords are to expire on a staggered schedule andcan be reset at any time by appropriate personnel and/orautomated system reset.XGT.52 Passwords are to be strong passwords (e.g., containXcaps/numbers, cannot use prior passwords, etc.).GT.53 Passwords are to be stored in encrypted form. XGT.54 Restriction of application and/or function within an applicationthrough role-based security. Role assignments are to be usedto determine which user categories have permission to accesswhich application and/or function within an application.XGT.55GT.56GT.57GT.58GT.59GT.60Ability to provide the following three types of controls to maintainthe integrity, availability, and confidentiality of Protected HealthInformation (PHI) data contained within the system: Thesecontrols are to be in place at all appropriate points of processing.Preventive Controls: Controls designed to prevent errors andunauthorized events from occurring.Detective Controls: Controls designed to identify errors andunauthorized transactions which have occurred in the system.Corrective Controls: Controls to ensure that the problemsidentified by the detective controls are corrected.Allow properly authorized users to configure and maintain allsystem settings from any workstation on the local/wide areanetwork using a browser.Ability to provide audit trails of all updates to the security system(add/change/delete) by log-on ID (or batch update identifier), dateand time of the change, and source of entry (workstation ID),including all attempted updates.GT.61 The system's import and export capabilities are to provide userlevelXsecurity options to control access to sensitive information.GT.62 Ability to support file, record, and field-level security. XGT.63 Ability to provide document-based security. XGT.64 Ability to update all security roles automatically when a change in Xthe "master" role is made.GT.65 Ability to provide functional security to control what processes Xcan be performed by certain users.GT.66 Ability to allow local/central System Security Administrators to Xadd and change permissions for local/central system access.GT.67 Ability to prohibit display of passwords on the sign-on screen Xwhen entered by the user.GT.68 Ability to log and report all unauthorized access attempts byterminal ID, user ID, date, and time.XXXXXXXYESwithcustomizationNOunabletoprovide14.2-91