Review of legality and data minimisation (a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.
New Hampshire Specific Data Security Requirements The Provider agrees to the following privacy and security standards from “the Minimum Standards for Privacy and Security of Student and Employee Data” from the New Hampshire Department of Education. Specifically, the Provider agrees to:
(1) Limit system access to the types of transactions and functions that authorized users, such as students, parents, and LEA are permitted to execute;
(2) Limit unsuccessful logon attempts;
(3) Employ cryptographic mechanisms to protect the confidentiality of remote access sessions;
(4) Authorize wireless access prior to allowing such connections;
(5) Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity;
(6) Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions;
(7) Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles;
(8) Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services;
(9) Enforce a minimum password complexity and change of characters when new passwords are created;
(10) Perform maintenance on organizational systems;
(11) Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance;
(12) Ensure equipment removed for off-site maintenance is sanitized of any Student Data in accordance with NIST SP 800-88 Revision 1;
(13) Protect (i.e., physically control and securely store) system media containing Student Data, both paper and digital;
(14) Sanitize or destroy system media containing Student Data in accordance with NIST SP 800-88 Revision 1 before disposal or release for reuse;
(15) Control access to media containing Student Data and maintain accountability for media during transport outside of controlled areas;
(16) Periodically assess the security controls in organizational systems to determine if the controls are effective in their application and develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems;
(17) Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems;
(18) Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception);
(19) Protect the confidentiality of Student Data at rest;
(20) Identify, report, and correct system flaws in a timely manner;
(21) Provide protection from malicious code (i.e. Antivirus and Antimalware) at designated locations within organizational systems;
(22) Monitor system security alerts and advisories and take action in response; and
(23) Update malicious code protection mechanisms when new releases are available.
Bill of Rights for Data Privacy and Security As required by Education Law Section 2-d, the Parents Bill of Rights for Data Privacy and Security and the supplemental information for the Service Agreement are included as Exhibit A and Exhibit B, respectively, and incorporated into this DPA. Contractor shall complete and sign Exhibit B and append it to this DPA. Pursuant to Education Law Section 2-d, the EA is required to post the completed Exhibit B on its website.
Meteorological Data Reporting Requirement (Applicable to wind generation facilities only)
Liability for Failure to Stop Payment of Preauthorized Transfer If you order us to stop one of these payments 3 business days or more before the transfer is scheduled, and we do not do so, we will be liable for your losses or damages.
COMPLIANCE WITH BREACH NOTIFICATION AND DATA SECURITY LAWS Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law § 899-aa and State Technology Law § 208) and commencing March 21, 2020 shall also comply with General Business Law § 899-bb.
Suspension of unsafe Construction Works (i) Upon recommendation of the Authority’s Engineer to this effect, the Authority may by notice require the Contractor to suspend forthwith the whole or any part of the Works if, in the reasonable opinion of the Authority’s Engineer, such work threatens the safety of the Users and pedestrians.
(ii) The Contractor shall, pursuant to the notice under Clause 11.17 (i), suspend the Works or any part thereof for such time and in such manner as may be specified by the Authority and thereupon carry out remedial measures to secure the safety of suspended works, the Users and pedestrians. The Contractor may by notice require the Authority’s Engineer to inspect such remedial measures forthwith and make a report to the Authority recommending whether or not the suspension hereunder may be revoked. Upon receiving the recommendations of the Authority’s Engineer, the Authority shall either revoke such suspension or instruct the Contractor to carry out such other and further remedial measures as may be necessary in the reasonable opinion of the Authority, and the procedure set forth in this Clause 11.17 shall be repeated until the suspension hereunder is revoked.
(iii) Subject to the provisions of Clause 21.6, all reasonable costs incurred for maintaining and protecting the Works or part thereof during the period of suspension (the “Preservation Costs”), shall be borne by the Contractor; provided that if the suspension has occurred as a result of any breach of this Agreement by the Authority, the Preservation Costs shall be borne by the Authority.
(iv) If suspension of Works is for reasons not attributable to the Contractor, the Authority’s Engineer shall determine any Time Extension to which the Contractor is reasonably entitled.
Liability for Failure to Stop Payment of Preauthorized Transfers If you order us to stop payment of a preauthorized transfer three (3) business days or more before the transfer is scheduled and we do not do so, we will be liable for your losses or damages.
Data Requirements • The data referred to in this document are encounter data – a record of health care services, health conditions and products delivered for Massachusetts Medicaid managed care beneficiaries. An encounter is defined as a visit with a unique set of services/procedures performed for an eligible recipient. Each service should be documented on a separate encounter claim detail line completed with all the data elements including date of service, revenue and/or procedure code and/or NDC number, units, and MCE payments/cost of care for a service or product. • All encounter claim information must be for the member identified on the claim by Medicaid ID. Claims must not be submitted with another member’s identification (e.g., xxxxxxx claims must not be submitted under the Mom’s ID). • All claims should reflect the final status of the claim on the date it is pulled from the MCE’s Data Warehouse. • For MassHealth, only the latest version of the claim line submitted to MassHealth is “active”. Previously submitted versions of claim lines get offset (no longer “active” with MassHealth) and payments are not netted. • An encounter is a fully adjudicated service (with all associated claim lines) where the MCE incurred the cost either through direct payment or sub-contracted payment. Generally, at least one line would be adjudicated as “paid”. All adjudicated claims must have a complete set of billing codes. There may also be fully adjudicated claims where the MCE did not incur a cost but would otherwise like to inform MassHealth of covered services provided to Enrollees/Members, such as for quality measure reporting (e.g., CPT category 2 codes for A1c lab tests and care/patient management). • All claim lines should be submitted for each Paid claim, including zero paid claim lines (e.g., bundled services paid at an encounter level and patient copays that exceeded the fee schedule). Denied lines should not be included in the Paid submission. Submit one encounter record/claim line for each service performed (i.e., if a claim consisted of five services or products, each service should have a separate encounter record). Pursuant to contract, an encounter record must be submitted for all covered services provided to all enrollees. Payment amounts must be greater than or equal to zero. There should not be negative payments, including on voided claim lines. • Records/services of the same encounter claim must be submitted with same claim number. There should not be more than one active claim number for the same encounter. All paid claim lines within an encounter must share the same active claim number. If there is a replacement claim with a new version of the claim number, all former claim lines must be replaced by the new claim number or be voided. The claim number, which creates the encounter, and all replacement encounters must retain the same billing provider ID or be completely voided. • Plans are expected to use current MassHealth MCE enrollment assignments to attribute Members to the MassHealth assigned MCE. The integrity of the family of claims should be maintained when submitting claims for multiple MCEs (ACOs/MCO). Entity PIDSL, New Member ID, and the claim number should be consistent across all lines of the same claim. • Data should conform to the Record Layout specified in Section 3.0 of this document. Any deviations from this format will result in claim line or file rejections. Each row in a submitted file should have a unique Claim Number + Suffix combination. • A feed should consist of new (Original) claims, Amendments, Replacements (a.k.a. Adjustments) and/or Voids. The replacements and voids should have a former claim number and former suffix to associate them with the claim + suffix they are voiding or replacing. See Section 2.0, Data Element Clarifications, for more information. • While processing a submission, MassHealth scans the files for the errors. Rejected records are sent back to the MCEs in error reports in a format of the input files with two additional columns to indicate an error code and the field with the error. • Unless otherwise directed or allowed by XxxxXxxxxx, all routine monthly encounter submissions must be successfully loaded to the MH DW on or before the last day of each month with corrected rejections successfully loaded within 5 business days of the subsequent month for that routine monthly encounter submission to be considered timely and included in downstream MassHealth processes. Routine monthly encounter submissions should contain claims with paid/transaction dates through the end of the previous month.
