RGA-2027-DBH-01-MITIG: Mitigating Impacts of the Opioid Crisis

FORM NUMBER G-1 (version 11/2021)
Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
Subject:
GRANT AGREEMENT
The State of New Hampshire and the Grantee hereby
Mutually agree as follows:
GENERAL PROVISIONS
1.Identification and Definitions.
1.1. State Agency Name 1.2. State Agency Address
New Hampshire Department of Health and Human 129 Pleasant Street
Services Concord, NH 03301-3857
1.3. Grantee Name 1.4. Grantee Address
1.5 Grantee Phone # 1.6. Account Number 1.7. Completion Date 1.8. Grant Limitation
Select a Date $
1.9. Grant Officer for State Agency 1.10. State Agency Telephone Number
Robert W. Moore, Director (603)271-9631
If Grantee is a municipality or village district: "By signing this form we certify that we have complied with
any public meeting requirement for acceptance of this grant, including if applicable RSA 31:95-b."
1.11. Grantee Signature 1 1.12. Name & Title of Grantee Signor 1
Grantee Signature 2 Name & Title of Grantee Signor 2
Grantee Signature 3 Name & Title of Grantee Signor 3
1.13 State Agency Signature(s) 1.14. Name & Title of State Agency Signor(s)
1.15. Approval by Attorney General (Form, Substance and Execution) (if G & C approval required)
By: Assistant Attorney General, On:
1.16. Approval by Governor and Council (if applicable)
By: On:
2.SCOPE OF WORK: In exchange for grant funds provided by the State of New Hampshire, acting
through the Agency identified in block 1.1 (hereinafter referred to as "the State"), the Grantee identified in
block 1.3 (hereinafter referred to as "the Grantee"), shall perform that work identified and more particularly
described in the scope of work attached hereto as EXHIBIT B (the scope of work being hereinafter referred to
as "the Project").
Page 1 of 3
Contractor Initials
Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
3. AREA COVERED. Except as otherwise specifically provided for herein, the computer programs, computer printouts, notes, letters, memoranda, paper, and
Grantee shall perform the Project in, and with respect to, the State of New documents, all whether finished or unfinished.
Hampshire. 9.2. Between the Effective Date and the Completion Date the Grantee shall grant to
4. EFFECTIVE DATE: COMPLETION OF PROJECT. the State, or any person designated by it, unrestricted access to all data for
4.1. This Agreement, and all obligations of the parties hereunder, shall become examination, duplication, publication, translation, sale, disposal, or for any other
effective on the date on the date of approval of this Agreement by the Governor purpose whatsoever.
and Council of the State of New Hampshire if required (block 1.16), or upon 9.3. No data shall be subject to copyright in the United States or any other country by
signature by the State Agency as shown in block 1.14 ("the Effective Date"). anyone other than the State.
4.2. Except as otherwise specifically provided herein, the Project, including all reports 9.4. On and after the Effective Date all data, and any property which has been received
required by this Agreement, shall be completed in ITS entirety prior to the date in from the State or purchased with funds provided for that purpose under this
block 1.7 (hereinafter referred to as "the Completion Date"). Agreement, shall be the property of the State, and shall be returned to the State
5. GRANT AMOUNT: LIMITATION ON AMOUNT: VOUCHERS: upon demand or upon termination of this Agreement for any reason, whichever
PAYMENT. shall first occur.
5.1. The Grant Amount is identified and more particularly described in EXHIBIT C, 9.5. The State, and anyone it shall designate, shall have unrestricted authority to
attached hereto. publish, disclose, distribute and otherwise use, in whole or in part, all data.
5.2. The manner of, and schedule of payment shall be as set forth in EXHIBIT C. 10. CONDITIONAL NATURE OR AGREEMENT. Notwithstanding anything in
5.3. In accordance with the provisions set forth in EXHIBIT C, and in consideration this Agreement to the contrary, all obligations of the State hereunder, including,
of the satisfactory performance of the Project, as determined by the State, and as without limitation, the continuance of payments hereunder, are contingent upon
limited by subparagraph 5.5 of these general provisions, the State shall pay the the availability or continued appropriation of funds, and in no event shall the State
Grantee the Grant Amount. The State shall withhold from the amount otherwise be liable for any payments hereunder in excess of such available or appropriated
payable to the Grantee under this subparagraph 5.3 those sums required, or funds. In the event of a reduction or termination of those funds, the State shall
permitted, to be withheld pursuant to N.H. RSA 80:7 through 7-c. have the right to withhold payment until such funds become available, if ever, and
5.4. The payment by the State of the Grant amount shall be the only, and the complete shall have the right to terminate this Agreement immediately upon giving the
payment to the Grantee for all expenses, of whatever nature, incurred by the Grantee notice of such termination.
Grantee in the performance hereof, and shall be the only, and the complete, 11. EVENT OF DEFAULT: REMEDIES.
compensation to the Grantee for the Project. The State shall have no liabilities to 11.1. Any one or more of the following acts or omissions of the Grantee shall constitute
the Grantee other than the Grant Amount. an event of default hereunder (hereinafter referred to as "Events of Default"):
5.5. Notwithstanding anything in this Agreement to the contrary, and notwithstanding 11.1.1 Failure to perform the Project satisfactorily or on schedule; or
unexpected circumstances, in no event shall the total of all payments authorized, 11.1.2 Failure to submit any report required hereunder; or
or actually made, hereunder exceed the Grant limitation set forth in block 1.8 of 11.1.3 Failure to maintain, or permit access to, the records required hereunder; or
these general provisions. 11.1.4 Failure to perform any of the other covenants and conditions of this Agreement.
6. COMPLIANCE BY GRANTEE WITH LAWS AND REGULATIONS. In 11.2. Upon the occurrence of any Event of Default, the State may take any one, or more,
connection with the performance of the Project, the Grantee shall comply with all or all, of the following actions:
statutes, laws regulations, and orders of federal, state, county, or municipal 11.2.1 Give the Grantee a written notice specifying the Event of Default and requiring it
authorities which shall impose any obligations or duty upon the Grantee, including to be remedied within, in the absence of a greater or lesser specification of time,
the acquisition of any and all necessary permits and RSA 31-95-b. thirty (30) days from the date of the notice; and if the Event of Default is not
7. RECORDS and ACCOUNTS. timely remedied, terminate this Agreement, effective two (2) days after giving the
7.1. Between the Effective Date and the date seven (7) years after the Completion Grantee notice of termination; and
Date, unless otherwise required by the grant terms or the Agency, the Grantee 11.2.2 Give the Grantee a written notice specifying the Event of Default and suspending
shall keep detailed accounts of all expenses incurred in connection with the all payments to be made under this Agreement and ordering that the portion of the
Project, including, but not limited to, costs of administration, transportation, Grant Amount which would otherwise accrue to the Grantee during the period
insurance, telephone calls, and clerical materials and services. Such accounts shall from the date of such notice until such time as the State determines that the
be supported by receipts, invoices, bills and other similar documents. Grantee has cured the Event of Default shall never be paid to the Grantee; and
7.2. Between the Effective Date and the date seven (7) years after the Completion 11.2.3 Set off against any other obligation the State may owe to the Grantee any damages
Date, unless otherwise required by the grant terms or the Agency pursuant to the State suffers by reason of any Event of Default; and
subparagraph 7.1, at any time during the Grantee's normal business hours, and as 11.2.4 Treat the agreement as breached and pursue any of its remedies at law or in equity,
often as the State shall demand, the Grantee shall make available to the State all or both.
records pertaining to matters covered by this Agreement. The Grantee shall 12. TERMINATION.
permit the State to audit, examine, and reproduce such records, and to make audits 12.1. In the event of any early termination of this Agreement for any reason other than
of all contracts, invoices, materials, payrolls, records of personnel, data (as that the completion of the Project, the Grantee shall deliver to the Grant Officer, not
term is hereinafter defined), and other information relating to all matters covered later than fifteen (15) days after the date of termination, a report (hereinafter
by this Agreement. As used in this paragraph, "Grantee" includes all persons, referred to as the "Termination Report") describing in detail all Project Work
natural or fictional, affiliated with, controlled by, or under common ownership performed, and the Grant Amount earned, to and including the date of termination.
with, the entity identified as the Grantee in block 1.3 of these provisions In the event of Termination under paragraphs 10 or 12.4 of these general
8. PERSONNEL. 12.2. provisions, the approval of such a Termination Report by the State shall entitle
8.1. The Grantee shall, at its own expense, provide all personnel necessary to perform the Grantee to receive that portion of the Grant amount earned to and including
the Project. The Grantee warrants that all personnel engaged in the Project shall the date of termination.
be qualified to perform such Project, and shall be properly licensed and authorized In the event of Termination under paragraphs 10 or 12.4 of these general
to perform such Project under all applicable laws. 12.3. provisions, the approval of such a Termination Report by the State shall in no
8.2. The Grantee shall not hire, and it shall not permit any subcontractor, subgrantee, event relieve the Grantee from any and all liability for damages sustained or
or other person, firm or corporation with whom it is engaged in a combined effort incurred by the State as a result of the Grantee's breach of its obligations
to perform the Project, to hire any person who has a contractual relationship with hereunder.
the State, or who is a State officer or employee, elected or appointed. Notwithstanding anything in this Agreement to the contrary, either the State or,
8.3. The Grant Officer shall be the representative of the State hereunder. In the event 12.4. except where notice default has been given to the Grantee hereunder, the Grantee,
of any dispute hereunder, the interpretation of this Agreement by the Grant may terminate this Agreement without cause upon thirty (30) days written notice.
Officer, and his/her decision on any dispute, shall be final. 13. CONFLICT OF INTEREST. No officer, member of employee of the Grantee,
9. DATA; RETENTION OF DATA; ACCESS. and no representative, officer or employee of the State of New Hampshire or of
9.1. As used in this Agreement, the word "data" shall mean all information and things the governing body of the locality or localities in which the Project is to be
developed or obtained during the performance of, or acquired or developed by performed, who exercises any functions or responsibilities in the review or
reason of, this Agreement, including, but not limited to, all studies, reports, files,
formulae, surveys, maps, charts, sound recordings, video recordings, pictorial
reproductions, drawings, analyses, graphic representations,
P age 2 of 3
Contractor Intials
Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
approval of the undertaking or carrying out of such Project, shall participate in 17.2. The policies described in subparagraph 17.1 of this paragraph shall be the standard
any decision relating to this Agreement which affects his or her personal interest form employed in the State of New Hampshire, issued by underwriters acceptable
or the interest of any corporation, partnership, or association in which he or she to the State, and authorized to do business in the State of New Hampshire. Grantee
is directly or indirectly interested, nor shall he or she have any personal or shall furnish to the State, certificates of insurance for all renewal(s) of insurance
pecuniary interest, direct or indirect, in this Agreement or the proceeds thereof. required under this Agreement no later than ten (10) days prior to the expiration
14. GRANTEE'S RELATION TO THE STATE. In the performance of this date of each insurance policy.
Agreement the Grantee, its employees, and any subcontractor or subgrantee of 18. WAIVER OF BREACH. No failure by the State to enforce any provisions
the Grantee are in all respects independent contractors, and are neither agents hereof after any Event of Default shall be deemed a waiver of its rights with regard
nor employees of the State. Neither the Grantee nor any of its officers, to that Event, or any subsequent Event. No express waiver of any Event of Default
employees, agents, members, subcontractors or subgrantees, shall have authority shall be deemed a waiver of any provisions hereof. No such failure of waiver
to bind the State nor are they entitled to any of the benefits, workmen's shall be deemed a waiver of the right of the State to enforce each and all of the
compensation or emoluments provided by the State to its employees. provisions hereof upon any further or other default on the part of the Grantee.
15. ASSIGNMENT AND SUBCONTRACTS. The Grantee shall not assign, or 19. NOTICE. Any notice by a party hereto to the other party shall be deemed to have
otherwise transfer any interest in this Agreement without the prior written been duly delivered or given at the time of mailing by certified mail, postage
consent of the State. None of the Project Work shall be subcontracted or prepaid, in a United States Post Office addressed to the parties at the addresses
subgranted by the Grantee other than as set forth in Exhibit B without the prior first above given.
written consent of the State. 20. AMENDMENT. This Agreement may be amended, waived or discharged only
16. INDEMNIFICATION. The Grantee shall defend, indemnify and hold harmless by an instrument in writing signed by the parties hereto and only after approval of
the State, its officers and employees, from and against any and all losses suffered such amendment, waiver or discharge by the Governor and Council of the State
by the State, its officers and employees, and any and all claims, liabilities or of New Hampshire, if required or by the signing State Agency.
penalties asserted against the State, its officers and employees, by or on behalf 21. CONSTRUCTION OF AGREEMENT AND TERMS. This Agreement shall
of any person, on account of, based on, resulting from, arising out of (or which be construed in accordance with the law of the State of New Hampshire, and is
may be claimed to arise out of) the acts or omissions of the Grantee or binding upon and inures to the benefit of the parties and their respective successors
subcontractor, or subgrantee or other agent of the Grantee. Notwithstanding the and assignees. The captions and contents of the "subject" blank are used only as
foregoing, nothing herein contained shall be deemed to constitute a waiver of a matter of convenience, and are not to be considered a part of this Agreement or
the sovereign immunity of the State, which immunity is hereby reserved to the to be used in determining the intend of the parties hereto.
State. This covenant shall survive the termination of this agreement. 22. THIRD PARTIES. The parties hereto do not intend to benefit any third parties
17. INSURANCE. and this Agreement shall not be construed to confer any such benefit.
17.1 The Grantee shall, at its own expense, obtain and maintain in force, or shall 23. ENTIRE AGREEMENT. This Agreement, which may be executed in a number
require any subcontractor, subgrantee or assignee performing Project work to of counterparts, each of which shall be deemed an original, constitutes the entire
obtain and maintain in force, both for the benefit of the State, the following agreement and understanding between the parties, and supersedes all prior
insurance: agreements and understandings relating hereto.
17.1.1 Statutory workers' compensation and employees liability insurance for all 24. SPECIAL PROVISIONS. The additional or modifying provisions set forth in
employees engaged in the performance of the Project, and Exhibit A hereto are incorporated as part of this agreement.
17.1.2 General liability insurance against all claims of bodily injuries, death or property
damage, in amounts not less than $1,000,000 per occurrence and $2,000,000
aggregate for bodily injury or death any one incident, and $500,000 for property
damage in any one incident; and
P age 3 of 3
Contractor Intials
Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Name of Procurement
EXHIBIT A
Revisions to Standard Grant Agreement Provisions
1. Revisions to Form G-1, General Provisions
1.1. Paragraph 4, Effective Date: Completion of Project, is amended by adding
subparagraph 4.3 as follows:
4.3 If the Grantee commences the Services prior to the Effective Date, all
Services performed by the Grantee prior to the Effective Date shall be
performed at the sole risk of the Grantee, and in the event that this
Agreement does not become effective, the State shall have no liability
to the Grantee, including without limitation, any obligation to pay the
Grantee for any costs incurred or Services performed.
1.2. Paragraph 6, Compliance by Grantee with Laws and Regulations, is amended
as follows:
6. In connection with the performance of the Project, the Grantee shall
comply with all statutes, laws regulations, and orders of federal, state,
county, or municipal authorities which shall impose any obligations or
duty upon the Grantee, including but not limited to, RSA 151:21 Patients'
Bill of Rights, civil rights and equal employment opportunity laws, the
Governor's order on Respect and Civility in the Workplace, Executive
Order 2020-01, acquisition of any and all necessary permits and RSA
31-95-b. In addition, if this Agreement is funded in any part by monies of
the United States, the Contractor shall comply with all federal executive
orders, rules, regulations and statutes, and with any rules, regulations
and guidelines as the State or the United States issue to implement
these regulations. The Contractor shall also comply with all applicable
intellectual property laws.
1.3. Paragraph 11, Event of Default: Remedies, subparagraph 11.2.2, is amended
as follows:
11.2.2 Give the Grantee a written notice specifying the Event of Default and
suspending payments, in whole or in part, to be made under this
Agreement, until the State determines the Event of Default is cured.
1.4 Paragraph 12, Termination, subparagraph 12.4 is amended as follows:
12.4 Notwithstanding anything in this Agreement to the contrary, the State may
terminate this Agreement without cause upon thirty (30) days written
notice to the Grantee.
1.5 Paragraph 15, Assignment and Subcontracts, is amended by adding
subparagraph 15.1 as follows:
15.1. Subcontractors are subject to the same contractual conditions as the
Vendor Name G-A 1.1 Grantee Initials
Project Number Page 4 of 2 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Name of Procurement
EXHIBIT A
Grantee and the Grantee is responsible to ensure subcontractor
compliance with those conditions. The Grantee shall have written
agreements with all subcontractors, specifying the work to be performed,
and if applicable, a Business Associate Agreement in accordance with
the Health Insurance Portability and Accountability Act. Written
agreements shall specify how corrective action shall be managed. The
Grantee shall manage the subcontractor's performance on an ongoing
basis and take corrective action as necessary. The Grantee shall
annually provide the State with a list of all subcontractors provided for
under this Agreement and notify the State of any inadequate
subcontractor performance.
Vendor Name G-A 1.1 Grantee Initials
Project Number Page 5 of 2 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Exhibit D
DHHS Information Security Requirements
A. Definitions
The following terms may be reflected and have the described meaning in this document:
1. "Breach" means the loss of control, compromise, unauthorized disclosure,
unauthorized acquisition, unauthorized access, or any similar term referring to
situations where persons other than authorized users and for an other than authorized
purpose have access or potential access to personally identifiable information,
whether physical or electronic. With regard to Protected Health Information, " Breach"
shall have the same meaning as the term "Breach" in section 164.402 of Title 45,
Code of Federal Regulations.
2. "Computer Security Incident" shall have the same meaning "Computer Security
Incident" in section two (2) of NIST Publication 800-61, Computer Security Incident
Handling Guide, National Institute of Standards and Technology, U.S. Department of
Commerce.
3. "Confidential Information" or "Confidential Data" means all confidential information
disclosed by one party to the other such as all medical, health, financial, public
assistance benefits and personal information including without limitation, Substance
Abuse Treatment Records, Case Records, Protected Health Information and
Personally Identifiable Information.
Confidential Information also includes any and all information owned or managed by
the State of NH - created, received from or on behalf of the Department of Health and
Human Services (DHHS) or accessed in the course of performing contracted services
- of which collection, disclosure, protection, and disposition is governed by state or
federal law or regulation. This information includes, but is not limited to Protected
Health Information (PHI), Personal Information (PI), Personal Financial Information
(PFI), Federal Tax Information (FTI), Social Security Numbers (SSN), Payment Card
Industry (PCI), and or other sensitive and confidential information.
4. "End User" means any person or entity (e.g., contractor, contractor's employee,
business associate, subcontractor, other downstream user, etc.) that receives DHHS
data or derivative data in accordance with the terms of this Contract.
5. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and
the regulations promulgated thereunder.
6. "Incident" means an act that potentially violates an explicit or implied security policy,
which includes attempts (either failed or successful) to gain unauthorized access to a
system or its data, unwanted disruption or denial of service, the unauthorized use of
a system for the processing or storage of data; and changes to system hardware,
firmware, or software characteristics without the owner's knowledge, instruction, or
consent. Incidents include the loss of data through theft or device misplacement, loss
Contractor Initials
V5. Last update 10/09/18
Page 1 of 9 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Exhibit D
DHHS Information Security Requirements
or misplacement of hardcopy documents, and misrouting of physical or electronic
mail, all of which may have the potential to put the data at risk of unauthorized access,
use, disclosure, modification or destruction.
7. "Open Wireless Network" means any network or segment of a network that is not
designated by the State of New Hampshire's Department of Information Technology
or delegate as a protected network (designed, tested, and approved, by means of the
State, to transmit) will be considered an open network and not adequately secure for
the transmission of unencrypted PI, PFI, PHI or confidential DHHS data.
8. "Personal Information" (or "PI") means information which can be used to distinguish
or trace an individual's identity, such as their name, social security number, personal
information as defined in New Hampshire RSA 359-C:19, biometric records, etc.,
alone, or when combined with other personal or identifying information which is linked
or linkable to a specific individual, such as date and place of birth, mother's maiden
name, etc.
9. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health
Information at 45 C.F.R. Parts 160 and 164, promulgated under HIPAA by the United
States Department of Health and Human Services.
10. "Protected Health Information" (or "PHI") has the same meaning as provided in the
definition of "Protected Health Information" in the HIPAA Privacy Rule at 45 C.F.R.
160.103.
11. "Security Rule" shall mean the Security Standards for the Protection of Electronic
Protected Health Information at 45 C.F.R. Part 164, Subpart C, and amendments
thereto.
12. "Unsecured Protected Health Information" means Protected Health Information that is
not secured by a technology standard that renders Protected Health Information
unusable, unreadable, or indecipherable to unauthorized individuals and is developed
or endorsed by a standards developing organization that is accredited by the
American National Standards Institute.
I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR
A. Business Use and Disclosure of Confidential Information.
1. The Contractor must not use, disclose, maintain or transmit Confidential Information
except as reasonably necessary as outlined under this Contract. Further, Contractor,
including but not limited to all its directors, officers, employees and agents, must not
use, disclose, maintain or transmit PHI in any manner that would constitute a violation
of the Privacy and Security Rule.
Contractor Initials
V5. Last update 10/09/18
Page 2 of 9 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Exhibit D
DHHS Information Security Requirements
2. The Contractor must not disclose any Confidential Information in response to a request
for disclosure on the basis that it is required by law, in response to a subpoena, etc.,
without first notifying DHHS so that DHHS has an opportunity to consent or object to the
disclosure.
3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additional
restrictions over and above those uses or disclosures or security safeguards of PHI
pursuant to the Privacy and Security Rule, the Contractor must be bound by such
additional restrictions and must not disclose PHI in violation of such additional
restrictions and must abide by any additional security safeguards.
4. The Contractor agrees that DHHS Data or derivative there from disclosed to an End
User must only be used pursuant to the terms of this Contract.
5. The Contractor agrees DHHS Data obtained under this Contract may not be used for
any other purposes that are not indicated in this Contract.
6. The Contractor agrees to grant access to the data to the authorized representatives of
DHHS for the purpose of inspecting to confirm compliance with the terms of this
Contract.
II. METHODS OF SECURE TRANSMISSION OF DATA
1. Application Encryption. If End User is transmitting DHHS data containing Confidential
Data between applications, the Contractor attests the applications have been evaluated
by an expert knowledgeable in cyber security and that said application's encryption
capabilities ensure secure transmission via the internet.
2. Computer Disks and Portable Storage Devices. End User may not use computer disks or
portable storage devices, such as a thumb drive, as a method of transmitting DHHS data.
3. Encrypted Email. End User may only employ email to transmit Confidential Data if email
is encrypted and being sent to and being received by email addresses of persons
authorized to receive such information.
4. Encrypted Web Site. If End User is employing the Web to transmit Confidential Data, the
secure socket layers (SSL) must be used and the web site must be secure. SSL encrypts
data transmitted via a Web site.
5. File Hosting Services, also known as File Sharing Sites. End User may not use file hosting
services, such as Dropbox or Google Cloud Storage, to transmit Confidential Data.
6. Ground Mail Service. End User may only transmit Confidential Data via certified ground
mail within the continental U.S. and when sent to a named individual.
7. Laptops and PDA. If End User is employing portable devices to transmit Confidential Data
said devices must be encrypted and password-protected.
Contractor Initials
V5. Last update 10/09/18
Page 3 of 9 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Exhibit D
DHHS Information Security Requirements
8. Open Wireless Networks. End User may not transmit Confidential Data via an open
wireless network. End User must employ a virtual private network (VPN) when remotely
transmitting via an open wireless network.
9. Remote User Communication. If End User is employing remote communication to access
or transmit Confidential Data, a virtual private network (VPN) must be installed on the End
User's mobile device(s) or laptop from which information will be transmitted or accessed.
10.SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. If End
User is employing an SFTP to transmit Confidential Data, End User will structure the
Folder and access privileges to prevent inappropriate disclosure of information. SFTP
folders and sub-folders used for transmitting Confidential Data will be coded for 24-hour
auto-deletion cycle (i.e. Confidential Data will be deleted every 24 hours).
11.Wireless Devices. If End User is transmitting Confidential Data via wireless devices, all
data must be encrypted to prevent inappropriate disclosure of information.
III. RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS
The Contractor will only retain the data and any derivative of the data for the duration of this
Contract. After such time, the Contractor will have 30 days to destroy the data and any
derivative in whatever form it may exist, unless, otherwise required by law or permitted under
this Contract. To this end, the parties must:
A. Retention
1. The Contractor agrees it will not store, transfer or process data collected in
connection with the services rendered under this Contract outside of the United
States. This physical location requirement shall also apply in the implementation of
cloud computing, cloud service or cloud storage capabilities, and includes backup
data and Disaster Recovery locations.
2. The Contractor agrees to ensure proper security monitoring capabilities are in place
to detect potential security events that can impact State of NH systems and/or
Department confidential information for contractor provided systems.
3. The Contractor agrees to provide security awareness and education for its End
Users in support of protecting Department confidential information.
4. The Contractor agrees to retain all electronic and hard copies of Confidential Data
in a secure location and identified in section IV. A.2
5. The Contractor agrees Confidential Data stored in a Cloud must be in a
FedRAMP/HITECH compliant solution and comply with all applicable statutes and
regulations regarding the privacy and security. All servers and devices must have
currently-supported and hardened operating systems, the latest anti-viral,
antihacker, anti-spam, anti-spyware, and anti-malware utilities. The environment, as
a whole, must have aggressive intrusion-detection and firewall protection.
Contractor Initials
V5. Last update 10/09/18
Page 4 of 9 Date

Appendix A G-1 and Standard Exhibits
DO NOT COMPLETE
New Hampshire Department of Health and Human Services
Exhibit D
DHHS Information Security Requirements
6. The Contractor agrees to and ensures its complete cooperation with the State's
Chief Information Officer in the detection of any security vulnerability of the hosting
infrastructure.
B. Disposition
1. If the Contractor will maintain any Confidential Information on its systems (or its sub-
contractor systems), the Contractor will maintain a documented process for securely
disposing of such data upon request or contract termination; and will obtain written
certification for any State of New Hampshire data destroyed by the Contractor or any
subcontractors as a part of ongoing, emergency, and or disaster recovery
operations. When no longer in use, electronic media containing State of New
Hampshire data shall be rendered unrecoverable via a secure wipe program in
accordance with industry-accepted standards for secure deletion and media
sanitization, or otherwise physically destroying the media (for example, degaussing)
as described in NIST Special Publication 800-88, Rev 1, Guidelines for Media
Sanitization, National Institute of Standards and Technology, U. S. Department of
Commerce. The Contractor will document and certify in writing at time of the data
destruction, and will provide written certification to the Department upon request.
The written certification will include all details necessary to demonstrate data has
been properly destroyed and validated. Where applicable, regulatory and
professional standards for retention requirements will be jointly evaluated by the
State and Contractor prior to destruction.
2. Unless otherwise specified, within thirty (30) days of the termination of this Contract,
Contractor agrees to destroy all hard copies of Confidential Data using a secure
method such as shredding.
3. Unless otherwise specified, within thirty (30) days of the termination of this Contract,
Contractor agrees to completely destroy all electronic Confidential Data by means
of data erasure, also known as secure data wiping.
IV. PROCEDURES FOR SECURITY
A. Contractor agrees to safeguard the DHHS Data received under this Contract, and any
derivative data or files, as follows:
1. The Contractor will maintain proper security controls to protect Department confidential
information collected, processed, managed, and/or stored in the delivery of contracted
services.
2. The Contractor will maintain policies and procedures to protect Department confidential
information throughout the information lifecycle, where applicable, (from creation,
transformation, use, storage and secure destruction) regardless of the media used to
store the data (i.e., tape, disk, paper, etc.).
Contractor Initials
V5. Last update 10/09/18
Page 5 of 9 Date