Privacy and Security Audit by DOHMH. Without limiting any other audit rights of DOHMH, DOHMH shall have the right to review and audit Provider’s Privacy and Security Program and/or IT infrastructure and information security controls and processes prior to the commencement of this Agreement and from time to time during the term of this Agreement. DOHMH reserves the right to also perform relevant tests to ensure Provider is compliant with required security policies and standards. Provider shall permit DOHMH to perform such audit, including an audit of the physical security of any of Provider’s premises applicable to the Cloud Services provided to DOHMH and shall fully cooperate and furnish all requested materials in a timely manner. The review and audit may be conducted remotely or onsite by DOHMH or a DOHMH provider and at DOHMH’s expense. DOHMH shall conduct on-site audits in a manner so as not to unreasonably interfere with Provider’s business operations. In lieu of an on-site audit, upon request by DOHMH, Provider shall complete, within forty-five (45) calendar days of receipt, an audit questionnaire provided by DOHMH regarding Provider’s Privacy and Security Program. Provider shall not be entitled to compensation from DOHMH for the time it spends cooperating with any of the audits, scans, or tests provided for in this Section 4.5.3, or in completing any audit questionnaire(s).
