Common use of Specific Requirements under Data Exchange Application and Agreement with DOH Clause in Contracts

Specific Requirements under Data Exchange Application and Agreement with DOH. SBUH and DOH have entered into a Data Exchange Application and Agreement (“DEAA”), pursuant to which DOH will make available certain Medicaid confidential data/ protected health information (“DEAA PHI”) to SBUH, as a “contractor” to DOH. SBUH may, in turn, make available such DEAA PHI to SCC and to you in connection with this Agreement. Under the DEAA, you are deemed to be a third party subcontractor of SBUH, and SBUH is required to include certain provisions in any subcontract with any third party who will have access to such DEAA PHI. Accordingly, with respect to any DEAA PHI received under the DEAA, you agree to comply with DOH requirements for the release of such data to you, including without limitation (i) completing and signing a DEAA Subcontractor Packet (the “DEAA Subcontractor Packet”), as a subcontractor, and (ii) executing a HIPAA Business Associate Agreement (the “DEAA BAA”), in which you shall be deemed to be a “Subcontractor” and SBUH shall be deemed to be a “Covered Program,” and (iii) implementing administrative, physical and technical safeguards as required by the DOH, including but not limited to two factor authorization for access and data encryption. “Two factor authentication” is a security process in which the user provides two means of identification using at a minimum two of the following: something the user knows (knowledge factor - pin, username, password), something the user has (possession factor – hard or soft token), and/or something the user is (inherence factor) biometric. “Encryption” refers to the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key. You agree to comply with the provisions set forth in the DEAA Confidentiality Provisions annexed hereto as Exhibit D, which is incorporated herein by reference. The parties agree to execute and deliver, or cause to be executed and delivered, such further instruments or documents as the parties mutually agree are necessary to carry out the intentions of the parties as set forth in this Section 7(c).

Specific Requirements under Data Exchange Application and Agreement with DOH. SBUH and DOH have entered into a Data Exchange Application and Agreement (“DEAA”), pursuant to which DOH will make available certain Medicaid confidential data/ protected health information (“DEAA PHI”) to SBUH, as a “contractor” to DOH. SBUH may, in turn, make available such DEAA PHI to SCC and to you in connection with this Agreement. Under the DEAA, you are deemed to be a third party subcontractor of SBUH, and SBUH is required to include certain provisions in any subcontract with any third party who will have access to such DEAA PHI. Accordingly, with respect to any DEAA PHI received under the DEAA, you agree to comply with DOH requirements for the release of such data to you, including without limitation (i) completing and signing a DEAA Subcontractor Packet (the “DEAA Subcontractor Packet”), as a subcontractor, and (ii) executing a HIPAA Business Associate Agreement (the “DEAA BAA”), in which you shall be deemed to be a “Subcontractor” and SBUH shall be deemed to be a “Covered Program,” and (iii) implementing administrative, physical and technical safeguards as required by the DOH, including but not limited to two factor authorization authentication for access and data encryption. “Two factor authentication” is a security process in which the user provides two means of identification using at a minimum two of the following: something the user knows (knowledge factor - pin, username, password), something the user has (possession factor – hard or soft token), and/or something the user is (inherence factor) biometric. “Encryption” refers to the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key. You agree to comply with the provisions set forth in the DEAA Confidentiality Provisions annexed hereto as Exhibit D, which is incorporated herein by reference. The parties agree to execute and deliver, or cause to be executed and delivered, such further instruments or documents as the parties mutually agree are necessary to carry out the intentions of the parties as set forth in this Section 7(c).