Scope of Work
Define deliverables, milestones, acceptance criteria, and timelines so both parties know what constitutes successful completion and when payments are due.
Security and compliance items to include or confirm
Data handling:
Define data classification and handling standards for contractor access and storage.
HIPAA controls:
Include BAA if contractor will access protected health information.
Confidentiality term:
Specify duration and post-termination obligations for protected information.
Access limits:
Limit access to systems and require unique credentials where practical.
Audit rights:
Reserve the right to audit compliance with contract security terms.
Breach notification:
Require prompt reporting and remediation if a security incident involves covered data.