2017-650-E Health - Carolinas IT to conduct HIPAA security risk analysis

Browse Search

DocuSign Envelope ID:88577424-D976-4534-82EF-EEA3A41BAB2A Note: • The Client must provide available customer resources to provide console or network access to Internet router and fireweall and all servers..Alternatively, the customer may provide printed copied of the current software configurations, however this option will result in more limited discovery. • This audit/assessment is not meant to impact the network in any way. Every attempt will be made to protect the Client's production environment and avoid any interruption in service; however, the possibility of an interruption does exist during the scan. • No changes will be made to the Client's environment as a result of this engagement. This Assessment is meant to reveal any vulnerability and allow the Client to decide the most effective way to address them. • Carolinas IT does not recommend that any of the suggested"fixes"for discovered vulnerabilities be attempted without an assessment of the potential impact to the production network. Overall Client Responsibilities: • Client will provide security clearance and access to facilities, as required. This includes badges, user accounts, passwords, access cards and parking privileges.Any required network passwords will be provided to our technical resources and/or have an available resource to enter them at the time of the installation. • Client will provide Internet access for CIT engineers for the duration of the project. • Client will ensure accuracy of data/information supplied to CIT. • Client understands that CIT relies on immediate clarification and resolution regarding the integrity of data/information supplied to CIT. • CIT will require timely delivery of information from Client. This information includes, but is not limited to user names, extensions, map of user locations, and other pertinent information. • Client will provide a single point of contact for project coordination with CIT. • Client will be responsible for notifying users of any downtime they may experience during the course of the engagement. • Client will provide a list of key contacts and IT staff designated to support and/or assist CIT in the project prior to the kick- off meeting; including: Name, Title, Responsibility, Phone&E-mail wherever possible. • Client will provide any support related to the hardware and software being considered for inclusion in the design • Client will furnish CIT technical resources with requested information and data on Client operations, activities and existing systems, as required to achieve the project goals and provide CIT personnel with sufficient security access to said systems and facilities at all reasonable times during the performance of the Services. • Client shall provide network access as needed for the project(e.g., administrator access to servers included in scope, Internet access(FTP, HTTP), access to server consoles,etc.). *Client understands that any items listed under"Client Responsibilities"that are not in place or functioning when CIT engineers are onsite,that Client will be billed outside this statement of work for additional time needed. Completion Criteria: Carolinas IT will have fulfilled its obligations under this SOW upon completion of delivery of reports outlined in the Deliverables and Closing section of this SOW. Acceptance of Services: Upon completion of the Services/Tasks outlined under the Carolinas IT Responsibilities section(s)and any subsequent change orders, Carolinas IT shall request that the Client sign the Acknowledgement of Completion section of this work order indicating such completion and requesting Client's written acceptance of the Services. The Client shall promptly review the notification and provide a written response. If the Client's response indicates that Carolinas IT has not satisfactorily completed the Services/Tasks as outlined in the document and/or any subsequent change orders,the parties will meet and use good faith to resolve the issues. If the Client does not respond in writing within twelve (12)business days of receipt of Carolinas IT's notice,then the Services will be deemed accepted. Non-Disclosure Notice:This SOW includes information that cannot be disclosed outside of Client and will not be duplicated, used, or disclosed, in whole or in part, for any purpose other than to evaluate this SOW.To the extent permitted by North Carolina law, Client agrees not to reveal any of its contents to anyone not directly responsible for its evaluation without first obtaining the express written consent of CAROLINAS IT. This restriction does not limit Client's right to use information contained in this proposal if it is obtained from another source without restrictions or if already known to Client. Project Costs: This is a fixed fee engagement. Customer is responsible paying 50%of the total fee prior to the start of the project, with the balance being billed net 30-days upon completion of the annual on-site report. Should unexpected issues be discovered that could change the scope of the project, Client and CIT will jointly review the project status. Changes in services requirements to this SOW shall be approved in writing by the Client, and will be billed at CIT's T& M published rates. A copy of the Change Order is attached, (Appendix A-1). Scheduling: Project scheduling will typically occur within seven (7)to ten (10)working days after the signed Statement of Work and deposit(if applicable)has been received by Carolinas IT. 792094c7-3c00-42b2-aa97-9219813651e8.docx Page 2 of 4 11/20/2017