2017-650-E Health - Carolinas IT to conduct HIPAA security risk analysis

Browse Search

DocuSign Envelope ID:88577424-D976-4534-82EF-EEA3A41BAB2A Carolinas IT 1600 Hillsborough Street Statement of Work Raleigh,NC 27605 PP,I(('Of 1\71;110 Corporate: (919)856-2300 Fax: (919)856-0420 Effective Date:20-Nov-2017 Expiration Date:31-Dec-2017 Client Information Client Contacts Carolinas IT Contacts Orange County Carla Julian Krista Cathey 300 West Tryon Street Phone/Ext.919-245-2434 Phone/Ext.919-573-4091 Hillsborough,NC 27278 Email:cjulian @orangecountync.gov Email:Krista.Cathey @CarolinaslT.com This Professional Services Agreement covers the services referenced herein. This Agreement shall be subject to all terms and conditions of the Master Agreement.To the extent any provisions of the Master Agreement conflict with the provisions of this Agreement,the provisions of the Master Agreement shall control, except to the extent that the applicable Statement of Work expressly and specifically states an intent to supersede the Master Agreement on a specific matter. The Master Agreement is hereby incorporated and made a part of this Agreement. This SOW defines exactly what work we are agreeing to do for you. Please DO NOT ASSUME that we are doing something as part of the project that is not specifically listed below. Overview:The goal of this project is to provide security risk assessments so the client is able to assess, identify and modify their overall security posture and to enable security, operations, organizational management and other personnel to collaborate and view the entire organization from an attacker's perspective. Initiation Phase:Carolinas IT will work with on-site IT staff/contractors to install and run a HIPAA Security specific data collection tool and gather information required for a complete assessment including: • Defining the client's Security Officer • Gaining required access to client's network • Installation of a network data collector • Installation of end-point device data collector • Delivery of a site survey including consultation on its use • Collection of public IP and wireless information Implementation Phase: Implementation of the assessments consist of one follow-up assessment and one on-site audit. The first scan, referred to as the annual on-site assessment,will be initiated immediately following the signing of this SOW or following the anniversary date of the original Security Risk Assessment. Carolinas IT will work with the on-site Security Officer, staff and contractors to complete the HIPAA Security specific data collection tool (installed during the initial assessment)and gather information required to assess progress made towards addressing the vulnerabilities identified in the initial HIPAA Security Management Plan and any subsequent updates to that plan. In addition to those steps, CIT Audit staff will conduct an annual on- site security audit required to validate the changes heretofore documented on the Management Plan. The second scan will be initiated at a scheduled time approximately six months after completion of the first scan mentioned above. The same steps will be followed to include working with the on-site Security Officer, staff and contractors to complete the HIPAA Security specific data collection tool and gather information required to assess progress made towards addressing the vulnerabilities identified in the most recent HIPAA Security Management Plan. The project will be implemented according to Carolinas IT best practices and manufacturers recommendations,while following the below steps: • On-going support of the data collecting tools • Interaction with Health Department staff to complete assessment of the environment • Report generation • On-site audit to validate mitigating tasks and documented improvements Deliverables and Closing: • Following the completion of each scan, the following versioned documents will be delivered: o Summary Risk Assessment including comparative risk score(documenting incremental improvement) o Risk Management Plan o Evidence of HIPAA Compliance Report • The reports will be presented via web conference. The objectives for the meeting include: o Review of the reports and identification of progress made towards mitigating vulnerabilities o Continued supervision and consulting of the Risk Management Plan 792094c7-3c00-42b2-aa97-9219813651e8.docx Page 1 of 4 11/20/2017