Specifications include, but are not limited to: The Monitor is required to certify in writing to DHSS that they have expertise in compliance with the Security Rule and are able to perform the reviews described below in a professionally independent fashion taking into account any other business relationships or other engagements that may exist. DHSS will submit the name and qualifications of the monitor to HHS for approval. Once the Monitor is approved by HHS, the Monitor has 90 days to submit a written, adequately detailed plan explaining how they will fulfill the duties and tasks required by the CAP. This plan will be called the Monitor Plan. HHS will have 30 days to upon receipt of the Monitor Plan to submit comments and recommend changes to the plan. The Monitor Plan is required to be approved by HHS. The CAP compliance review period will expire three years from the approval date of the Monitor Plan. The Monitor will prepare quarterly reports for three years based on their findings from their reviews of DHSS compliance with the CAP. The quarterly report is to be provided to both DHSS and HHS. Then the Monitor will meet on a quarterly basis with the DHSS Chief Security Officer to discuss and evaluate the progress DHSS is making in meeting the obligations of the CAP. The DHSS Chief Security Officer is required to prepare a response to both the Monitor and HHS as to the Monitors findings in the Monitors Quarterly Report. One of the duties expected of the Monitor by HHS is to interview workforce members as needed and follow-up on reports of possible security violations. The Monitor shall immediately report any significant violation of the CAP to DHSS and HHS. DHSS will respond to all reported violations with a plan of correction and provide the response to the Monitor and HHS.
