Federal Medicaid System Security Requirements Compliance Party shall provide a security plan, risk assessment, and security controls review document within three months of the start date of this Agreement (and update it annually thereafter) in order to support audit compliance with 45 CFR 95.621 subpart F, ADP System Security Requirements and Review Process.
Documentation Requirements ODM shall pay the MCP after it receives sufficient documentation, as determined by ODM, detailing the MCP’s Ohio Medicaid-specific liability for the Annual Fee. The MCP shall provide documentation that includes the following:
1. Total premiums reported on IRS Form 8963;
Data Security Requirements Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53).
Certification Requirements The hospice program certifies and attaches hereto documentation that:
(a) it is Medicare approved and meets all Medicare conditions of participation (42 CFR 418); and
(b) is licensed pursuant to any applicable state or local law.
Compliance with Safeguarding Customer Information Requirements The Servicer has implemented and will maintain security measures designed to meet the objectives of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information published in final form on February 1, 2001, 66 Fed. Reg. 8616, and the rules promulgated thereunder, as amended from time to time (the “Guidelines”). The Servicer shall promptly provide the Seller information regarding the implementation of such security measures upon the reasonable request of the Seller.
Contractor Security Clearance Customers may designate certain duties and/or positions as positions of “special trust” because they involve special trust responsibilities, are located in sensitive locations, or have key capabilities with access to sensitive or confidential information. The designation of a special trust position or duties is at the sole discretion of the Customer. Contractor or Contractor’s employees and Staff who, in the performance of this Contract, will be assigned to work in positions determined by the Customer to be positions of special trust, may be required to submit to background screening and be approved by the Customer to work on this Contract.
Information Requirements The Company covenants that, if at any time before the end of the Effectiveness Period the Company is not subject to the reporting requirements of the Exchange Act, it will cooperate with any Holder and take such further reasonable action as any Holder may reasonably request in writing (including, without limitation, making such reasonable representations as any such Holder may reasonably request), all to the extent required from time to time to enable such Holder to sell Registrable Securities without registration under the Securities Act within the limitation of the exemptions provided by Rule 144 and Rule 144A under the Securities Act and customarily taken in connection with sales pursuant to such exemptions. Upon the written request of any Holder, the Company shall deliver to such Holder a written statement as to whether it has complied with such filing requirements, unless such a statement has been included in the Company’s most recent report filed pursuant to Section 13 or Section 15(d) of Exchange Act. Notwithstanding the foregoing, nothing in this Section 7 shall be deemed to require the Company to register any of its securities (other than the Common Stock) under any section of the Exchange Act.
Notification Requirements 1. If the Family Leave is foreseeable, the employee must provide the agency/department with thirty (30) calendar days notice of his or her intent to take Family Leave.
2. If the event necessitating the Family Leave becomes known to the employee less than thirty (30) calendar days prior to the employee's need for Family Leave, the employee must provide as much notice as possible. In no case shall the employee provide notice later than five (5) calendar days after he or she learns of the need for Family Leave.
3. For foreseeable leave due to a qualifying exigency, an employee must provide notice of the need for leave as soon as practicable, regardless of how far in advance such leave is foreseeable.
4. When the Family Leave is for the purpose of the scheduled medical treatment or planned medical care of a child, parent, spouse or registered domestic partner, the employee shall, to the extent practicable, schedule treatment and/or care in a way that minimizes disruption to agency/department operations.
New Hampshire Specific Data Security Requirements The Provider agrees to the following privacy and security standards from “the Minimum Standards for Privacy and Security of Student and Employee Data” from the New Hampshire Department of Education. Specifically, the Provider agrees to:
(1) Limit system access to the types of transactions and functions that authorized users, such as students, parents, and LEA are permitted to execute;
(2) Limit unsuccessful logon attempts;
(3) Employ cryptographic mechanisms to protect the confidentiality of remote access sessions;
(4) Authorize wireless access prior to allowing such connections;
(5) Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity;
(6) Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions;
(7) Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles;
(8) Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services;
(9) Enforce a minimum password complexity and change of characters when new passwords are created;
(10) Perform maintenance on organizational systems;
(11) Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance;
(12) Ensure equipment removed for off-site maintenance is sanitized of any Student Data in accordance with NIST SP 800-88 Revision 1;
(13) Protect (i.e., physically control and securely store) system media containing Student Data, both paper and digital;
(14) Sanitize or destroy system media containing Student Data in accordance with NIST SP 800-88 Revision 1 before disposal or release for reuse;
(15) Control access to media containing Student Data and maintain accountability for media during transport outside of controlled areas;
(16) Periodically assess the security controls in organizational systems to determine if the controls are effective in their application and develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems;
(17) Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems;
(18) Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception);
(19) Protect the confidentiality of Student Data at rest;
(20) Identify, report, and correct system flaws in a timely manner;
(21) Provide protection from malicious code (i.e. Antivirus and Antimalware) at designated locations within organizational systems;
(22) Monitor system security alerts and advisories and take action in response; and
(23) Update malicious code protection mechanisms when new releases are available.
Encryption Requirements DST will not locally store Fund Data on any laptops or mobile devices (e.g., Blackberries, PDAs) managed by DST.
