The tender deals with the procurement of infrastructure operation of the Health Insurance Solution. The health insurance solution shall support the municipal part of the health insurance task in relation to the administration and management of medical choices and the Yellow Health Insurance Card. The operating contract offered and its purpose are detailed in point II.2.4. The total supply of the Health Insurance Solution is divided into several contracts. Systematic A/S is a provider on the Health Insurance Solution related to development, further development, maintenance, application operation, management and service desk services. This tender deals with the procurement of infrastructure operations and related services and the supplier shall engage in close cooperation with Systematic A/S. The supplier, together with Systematic A/S, has full responsibility for the operation of the health insurance solution, including the usefulness of the solution to users.
The present tender includes the operation of the Health Insurance Solution in the form of infrastructure operations and related services. The health insurance solution shall support the municipal part of the health insurance task in relation to the administration and management of medical choices and the Yellow Health Insurance Card. The infrastructure must provide Kubernetes services, AMQP services, PostgreSQL services, etc. either on a standard dedicated server solution or on a cloud-based solution. Operation etc. of the Health Insurance Solution will be done in cooperation with Systematic A/S, which is responsible for development, further development, maintenance, application operation and service desk services, as well as KOMBIT, as it is KOMBIT that is responsible for the vendor dialogue and is a contract holder with the municipalities. However, the supplier must also be required to cooperate with other suppliers, including, in particular, user-system suppliers. Furthermore, reference is made to the requirements of the procurement material.
The task includes processing personal data. The supplier shall ensure, through the workflows and processes of the supplier and its subcontractors/subdata processors, and be able to demonstrate the absence of transfer of personal data to countries outside the EU/EEA (third countries).
Where the vendor intends to use public cloud services, these must be set up in a manner which ensures that no transfer of personal data to third countries via the cloud provider and so it is clear which subdata processors are used by the cloud provider for the delivery of those The vendor used cloud services.
The vendor shall ensure that cloud providers used by the vendor comply with the Data Protection Regulation as well as any other legislation. For example, this can be ensured by a statement from the cloud provider that it will not transfer personal data to third countries based on the specific cloud services and specific architecture selected at the specific time. Such a declaration could be used as evidence that the supplier complies with its obligations as a data processor in relation to the non-transfer of personal data to third countries through the cloud provider.
In connection with support of the system, it is required that the provider's support organization ensure close control of the cloud provider's access to personal data. It is therefore required that, in situations where the error cannot be handled without the cloud provider's support, the vendor initiates involvement of the cloud provider with an instruction to provide support services by EU/EEA employees.