Overview
Capitalized terms not defined in this Attachment will have the meanings set forth in the MSA.
Scope of Work
PatientLock intends to use SilverSky (“Host”) installed products and services to provide a Security Operations Center-as-a-Service (“Service”) designed to replace all of the necessary capital costs, licensed products and integration services normally required to establish a security program. The Host uses a secure and compliant cloud for ease of deployment and consumption by the healthcare industry, as well as others making the Service available at predictable and affordable rates. Under this Statement of Work for SilverSky’s Security Awareness and Phishing Training (“Security Awareness and Phishing Training”) PatientLock agrees to provide _________________________, (“Customer”) with certain described services. It is understood by the Customer that PatientLock intends to retain the Service, in whole or in part, by SilverSky in connection with the Service under this Statement of Work.
1. Service definition
“Services” will mean PatientLock services including Security Awareness and Phishing Training, as further defined in the Service Order and incorporated herein by reference. The Security Awareness and Phishing Training Service is a fully managed security awareness and continuous training program which can satisfy regulatory compliance mandates (i.e., PCI, HIPAA, SOX, and FFIEC). PatientLock partners with KnowBe4 to provide Security Awareness and Phishing Training and delivers this Service via our PatientLock Cyber Security Advisory team (CSA). The “Launch Date” of Security Awareness and Phishing Training Services under this Attachment will mean the date on which the Security Awareness and Phishing Training Services or any part of the services provided under the terms of this Attachment are first made available to Customer or 45 days from the Effective Date, whichever date is earlier.
2. Customer Responsibilities
During performance of the Security Awareness and Phishing Training Services, Customer agrees to perform the following obligations and acknowledge and agree that PatientLock’s ability to perform our obligations are dependent upon Customer’s compliance with the following:
Customer will:
Provide a technical resource familiar with Customer’s environment to assist in the implementation and testing during the initial setup of the services. This resource will assist with items such as providing:
An understanding of Customer’s specific regulatory and compliance requirements.
Customer’s current information security documentation.
Customer’s employees with access to related documentation.
Relevant information needed to configure Customer’s users.
Participate in all scheduled reviews (as established, monthly, quarterly, annually)
Assume responsible for the onsite enforcement and follow-up to ensure user compliance and completion of all required trainings.
Customer acknowledges that Customer’s fulfillment of these responsibilities is essential to our ability to perform the Security Awareness and Phishing Training Services in a timely manner.
3. PatientLock Deliverables
During performance of the Security Awareness and Phishing Training, PatientLock will:
Deliver the Service via our PatientLock Cyber Security Advisory team (CSA), which will integrate threat intelligence and real-time attack profiles to provide training and testing using current social engineering tactics being leveraged by attackers.
Utilize threat profiles are based on SOC (Security Operations Center) metrics, industry research and customer risk profiles.
Build a custom security testing program that considers Customer’s desired testing frequency, internal department factors, industry risk profiles and any customization necessary for Customer’s business.
Facilitate a complete user security awareness training suite.
This training suite is regularly updated to ensure users are current on the latest phishing techniques.
Training content can be customized for targeted at-risk groups such as privileged users, executives, and security personnel.
Implementation of the Security Awareness and Phishing Training Service will utilize defined process, coordinated by a specific named project coordinator.
The PatientLock Compliance team will work with Customer on a monthly, quarterly, and annual cadence for phishing/social engineering testing and awareness training.
Specific deliverables for each phase will be communicated in the implementation process.
Provide 8x5 support of the platform and manage ongoing support issues.
4. Key Assumptions/Exclusions.
Specific users will have limited access to administrative functions but based on their role in the system, will have the ability to login to perform trainings, review reports or managed sub functions as needed.
Excluded from this offering
Industry specific compliance training such as GDPR, HIPAA, PCI, or other compliance level trainings.
Any service support after business hours.
Phishing testing in excess of four quarterly sessions.
5. Performance Evaluation (if applicable)
Customer authorizes PatientLock to evaluate service upgrades and changes on an annual basis at each of Customer’s locations which utilize the Security Awareness and Phishing Training Services. In the event that such evaluations identify ways to improve performance or service at no additional cost to Customer, Customer authorize PatientLock to implement them.
6. Equipment (if applicable)
Equipment provided to Customer by PatientLock (“PatientLock Equipment”) is for Customer’s use only during the Term of this Attachment. PatientLock will service the PatientLock Equipment in accordance with our service policies. Customer agrees to (i) use PatientLock Equipment only for the purpose of receiving the Services outlined herein; (ii) prevent any connections to PatientLock Equipment not expressly authorized by PatientLock; (iii) prevent tampering, alteration, or repair of PatientLock Equipment by any persons other than PatientLock or PatientLock’s authorized personnel; and (iv) assume complete responsibility for improper use, damage to or loss of such PatientLock Equipment regardless of cause. Customer will pay PatientLock for any damaged or unrecoverable PatientLock Equipment. Customer authorizes PatientLock and PatientLock’s authorized agents, contractors, representatives, and vendors to enter Customer’s premises, with reasonable notice, during normal business hours (or as otherwise authorized by Customer), to install, maintain, repair and/or remove any PatientLock Equipment and/or to perform the Network Protection Services. Customer must return PatientLock Equipment, at Customer’s expense, within 14 days after this Attachment terminates or expires. PatientLock Equipment must be returned in the same condition in which it was provided to Customer, except for normal wear and tear. If Customer fails to do so, billing for Security Awareness and Phishing Training Services will resume and continue until all PatientLock Equipment is returned.
7. Term and Termination
This Attachment will be in effect during the Initial Term set forth in the Service Order and will thereafter automatically renew for a period equal to the initial term as provided in the Service Order. The fee schedule listed in the Service Order will be subject to annual pricing adjustments. However, such pricing adjustments may not exceed 5%, on an annualized basis, during the Initial Term. Intention not to renew must be provided at least 60 days prior to the beginning of the renewal term. The sections related to Payment Terms, Limitation of Liability, Warranties, Indemnity, Confidentiality and Intellectual Property from the General Terms and Conditions, as provided in the referenced General Terms and Conditions document, will survive the expiration or termination of this Attachment for any reason. Within 10 days after the expiration or termination of this Attachment for any reason, Customer must pay all undisputed fees accrued and unpaid at the time of termination, and the cancellation fee if applicable.
8. Additional Disclaimers
PatientLock does not guarantee a continuous, uninterrupted, virus-free, malware-free, intrusion-free, or continuously secure Customer’s network or network environment, and PatientLock is not liable if Customer or Customer’s end users are unable to access Customer’s network at any specific time. Additionally, PatientLock does not guarantee that PatientLock will be able to replace any of Customer’s information, content, or other data that may be lost, damaged, or stolen resulting from use of the Services.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy