Forrest Health

Bid # 1608

Company Name: ____________________________________________________ Contact Name: ______________________________________________________ Company Address: __________________________________________________ Phone Number: _____________________________________________________ Email Address: _____________________________________________________

Special Requirements for Bids

Forrest General Hospital Attention: Purchasing Department

125 South 28th Avenue Suite 100

Hattiesburg, MS 39401

(601) 288-1922

BID MUST BE RETURNED NO LATER THAN

May 26, 2026, at 2:00 p.m.

Return Bid Envelope Must Be Marked on Outside:

BID # 1608 ENCLOSED

“Intraoperative Neuromonitoring Services”

Bid Opening Date: Tuesday, May 26, 2026

Bid Opening Time: Immediately after 2:00 p.m.

Bid Opening To Take Place:

Purchasing Department 125 South 28th Avenue

Forrest Health reserves the right to accept or reject any or all bids, as well as waive any and all informalities it deems appropriate.

From: Paul DeFreese

Purchasing Department 125 South 28th Avenue

SUBJECT: BID INSTRUCTIONS

You are invited to bid on the attached request for quotation. Please read the information carefully.

The terms and conditions stated in this Request for Quotation shall be considered agreed to, unless specified otherwise. The Board reserves the right to reject any and all bids and to waive irregularities and informalities in the bid.

Please place your Company Name, Contact Name, Address, Telephone Number, and Email Address on the top left of page one (1). Complete all information as specified on pages seven (7) and eight (8). Provide signature of an official of your company at the bottom of page nine (9). On the Standard Contract Addendum, provide the name of the Contractor on page ten (10) and signatures on page eleven (11). On the Business Associate Addendum, provide date and name of Business Associate on page twelve (12), name and address on page seventeen (17), and signature and title on page eighteen (18).

Mail your bid as specified on the attached “Special Requirements” page to the above address for the Forrest General Hospital Purchasing Department in a sealed envelope.

Quotation envelope must be marked with “BID #1608 ENCLOSED” and “Intraoperative Neuromonitoring Services” on the outside of the sealed envelope.

Quotations received after the specified date, time and/or without bid # on the outside of the envelope, shall not be considered. Faxed copies of bid will only be accepted if faxed to an outside source and delivered to Forrest General Hospital Purchasing Department in a sealed envelope with all required information on outside of envelope.

Thank you, Paul DeFreese Purchasing Analyst

REQUEST FOR QUOTATION/PROPOSAL

FORREST HEALTH

P. O. BOX 16389, HATTIESBURG, MS 39404

(FOR SPECIFIED LOCATIONS)

Forrest Health reserves the right to reject any/or all bids and waive any informalities.

“Intraoperative Neuromonitoring (IONM) Services”

For all practical purposes in other sections of these bid specifications, the proposing bidder may be referred to as the “Vendor” and Forrest Health may be referred to as the “Hospital.”

Clinical Requirements

1. Hospital will provide Vendor not less than two (2) hours advance notice of unscheduled or emergency cases involving the provision of Services, and Vendor will ensure that Staff provide the Services at that time and place reasonably requested by Hospital.

2. Vendor shall provide set up for Services in advance of the scheduled commencement of the surgical procedure as mutually agreed.

3. Vendor shall be responsible for daily travel costs and costs of bringing in additional Staff and/or Equipment as may be required for certain procedures.

4. When applicable, the professional component of the Services shall be contracted for by Vendor. For remote monitoring, the professional shall be available to provide the surgeon or attending physician, as applicable, with a verbal report, followed by written authentication as required by regulatory agencies, of his or her interpretation of IONM data collected during the performance of Services in such format as may be agreed upon by the parties. As reasonably requested, Vendor agrees to use its reasonable efforts to cause the written report to be provided within seventy-two (72) hours of the completion of the procedure.

5. The Equipment shall be located at sites within Hospital’s premises as mutually agreed by Hospital and Vendor. Any such site shall have all utility, secure data transmission, and other connections, hookups, or means of attachment recommended or requested by Vendor to secure the Equipment to Hospital’s premises or as otherwise necessary so that the Equipment may be operated in the performance of the Services. Hospital shall not be required to provide lockable space for Equipment.

6. IONM Modalities included in Services:

a. Somatosensory Evoked Potentials (SSEP) – an intraoperative modality that stimulates the peripheral nerves in upper and lower extremities to obtain information about the sensory function of the spinal cord.

b. Transcranial Motor Evoked Potentials (TcMEP) – an intraoperative modality that tests the integrity of the motor tracks of the spinal cord via the use of electrical stimulation through the cranium.

c. Electromyography (EMG) – an intraoperative modality used to stimulate the nerve root to record compound muscle action potentials. The two (2) EMG techniques used are triggered EMG and free running EMG.

d. Electroencephalography (EEG) – an intraoperative modality that records brain wave activity.

e. Facial Nerve Monitoring – the recording of two (2) to four (4) channels of free-run and triggered EMG responses during certain procedures where the facial nerve may be at risk for injury.

f. Brainstem Auditory Evoked Potentials – intraoperative modalities used to test the integrity of the auditory system.

Forrest General Hospital Responsibility

1. The hospital shall provide one or more representative(s) who will interface with the Vendor’s Representative to answer questions, verify bid specifications and verify invoice information. Denise Jones-Lindley, Director of Surgery, will be the contact to answer questions pertaining to this Bid at 601-288-1474 or ajones@forrestgeneral.com.

2. The awarded vendor will be notified after the Bid opening by telephone, email or letter.

3. The Hospital reserves the right to reject any or all Bids submitted and waive any informalities, whichever is in the best interest of the Hospital.

4. The Hospital shall have, and hereby reserves and retains, the right and option to terminate the contract with Vendor upon thirty (30) days prior written notice to Vendor, either with or without cause.

Vendor Responsibility

1. It is recommended that the Vendor representative contact the Hospital representative to discuss any questions about the bid specifications prior to submitting a bid proposal.

All bid documents are to be returned complete per bid specifications in order to be considered.

2. Vendor must provide a copy of a Certificate of Insurance with bid. The amount of Workers’ Compensation coverage required by Mississippi State Law. Commercial General Public Liability with a minimum coverage of $1,000,000.00 per occurrence and $3,000,000.00 in the annual aggregate. Automobile General Liability with a minimum coverage of $1,000,000.00.

3. Vendor is required to register the company and sales team, including drivers, with Forrest Health’s authorized Vendor Credentialing Program, Green Security.

4. The Vendor Representative will be responsible for completing and signing all documents included in the bid packet. Vendors who do not submit all required documents at the time of bid opening will not be considered.

5. Forrest Health will not be responsible for completing credit applications submitted by the awarded vendor. Financial documents are included in the attached documentation.

6. If two or more Vendors quote the same low (tie) bid and meets all bid specifications and the terms in compliance with Section 31-7-15 (1), Mississippi Code 1972, annotated, the hospital has the option to divide the purchase equally as possible to each low Vendor or select the Awarded Vendor by drawing lots between or among the low (tie) Vendors.

7. Forrest Health reserves the right to reject any or all bids and award one or more of the options, whichever is in the best interest of the Hospital.

8. Documentation of trip logs must be provided to Forrest General for verification of invoices. A sample of invoice is required in bid submission.

BID CHECKLIST

❑ Complete section at top of Page 1 with Company Name, Contact Name, Company

Address, Phone Number, and Email Address.

❑ On Page 9, check Yes or No to certify that you and your company qualify to do business as a resident of the State of Mississippi.

❑ On Page 9, if you are a non-resident person/firm/corporation, check Yes or No to confirm that a copy of your Resident State’s Law pertaining to your state’s treatment of non-resident bidders is attached.

❑ On Page 9, fill in the information requested in the center of the page to include Date, Vendor, Address, Official Signature, and Print Name & Title

❑ On Page 10, Standard Contract Addendum – please enter Contractor’s name in space provided at top of the page

❑ On Page 11, Standard Contract Addendum – please sign Contractor’s name, and date at the bottom left of the page.

❑ On Page 12, Business Associate Addendum – please enter date and Business

Associate’s name at the top of the page.

❑ On Page 17, Business Associate Addendum – please enter name and address of

Business Associate (if applicable) at the top of the page.

❑ On Page 18, Business Associate Addendum – please sign Business Associate’s name and title at the end of the page.

Items Required with Bid:

❑ Provide certificate of insurance:

Vendor must provide a copy of certificate of insurance with bid:

• The amount of Worker’s Compensation coverage required by Mississippi State

Law.

• Commercial General Public Liability with a minimum coverage of $1,000,000.00 per occurrence and $3,000,000.00 in the annual aggregate.

• Automobile General Liability with a minimum coverage of $1,000,000.00.

❑ Standard Contract Addendum (pages 10 & 11)

❑ Business Associate Addendum (pages 12, 17, & 18)

Forrest County General Hospital requests your price quote for the following item(s) as per bid specifications. Operational start date will be June 1, 2023.

Intraoperative Neuromonitoring Services

FEE SCHEDULE

Description Fee

1. Intra-Operative Neurophysiological Monitoring (IONM) Technical Services includes:

per procedure

• Appropriate IONM Staff

• Initial Supplies as listed on Supplies Schedule

• Use of IONM Equipment as listed on Equipment Schedule

2. Miscellaneous Supplies $______________

SUPPLIES SCHEDULE

Description Quantity

Intra-Operative Neurophysiological Monitoring Initial Supplies include:

• Subdermal needles

• Surface Electrodes for SSEP stimulation

• Basic Probe

The following supplies are provided as additional cost to the Per Case Fee (if required) and are used by Vendor as needed when providing Services:

Item #

Description Cost

__________ Probe Monopolar Handle Only __________ __________ Monopolar Probe Disposable Probe, 100mm x 0.75mm, 1.9m Lead __________ __________ NIM Spine Probe 2.3mm Ball, 23cm Long __________ __________ Pedicle Screw Probe, 2.3mm Ball, 130mm x 1.9mm, 1.9m Lead __________ __________ Concentric Bipolar Disposable Probe 100mm x 1mm, 1.9m Lead __________ __________ Bipolar Disposable Probe, 2 x 100mm x 0.75mm, 1.9m Lead __________ __________ Pedicle Screw Disp Probe, 3mm Ball, 100mm x 0.75mm, 1.9m Lead __________ __________ Disposable Triple Hook Nerve Stimulator Probe __________ __________ Disposable Double Hook Nerve Stimulator Probe __________ __________ Probe 1.0mm Ball Tip (No Handle) __________ __________ Probe Monopolar Yingling Flex Tip __________ __________ Double Hook Probe, 2 x 2.4mm Hook, 38mm x 0.75mm, 1.9m Lead __________ __________ Triple Hook Probe, 2 x 2.4mm Hook, 38mm x 0.75mm, 1.9m Lead __________ __________ Natus Cortical Stim Bipolar Probe __________ __________ Dragonfly 2-Chan Laryngeal Surface Elec for 6.0-7.5mm ET Tube __________ __________ Dragonfly 1-Chan Laryngeal Surface Elec for 2.0-5.5mm ET Tube __________ __________ Endotracheal Tube, EMG 6mm __________ __________ Endotracheal Tube, EMG 7mm __________ __________ Endotracheal Tube, EMG 8mm __________ __________ Dragonfly 2-Chan Laryngeal Surface Elec for 8.0-9.5mm ET Tube __________ __________ Electrode, 10mm Cup, MR Conditional, 1.5m Lead __________ __________ 1x4-Contact Platinum Strip w/Attached Cable __________ __________ 4x4 16-Contact Platinum Grip Electrode w/Attached Cable __________ __________ 1x6-Contact Platinum Strip w/Attached Cable __________ __________ Spinal Electrode 3-Contact w/Attached Cable __________ __________ Multi-Stage Stimulating Clip, 1.83m Lead __________

EQUIPMENT SCHEDULE

Description Quantity

Intra-Operative Neurophysiological Monitoring Equipment:

Portable Neurophysiology Workstation

Bidders who are non-residents of the State of Mississippi must comply with the provisions of Section 31-3-21(3) of the Mississippi Code of 1972, as amended.

I certify that my company and I qualify to do business as a resident of the State of Mississippi.

Yes __________ No __________

As a non-resident person, firm or corporation, I confirm that a copy of my Resident State’s Law pertaining to my state’s treatment of non-resident bidders is attached.

Confirmed: Yes __________ No __________

We quote/propose you as specified by Forrest Health in this Bid.

Date:

Vendor:

Address:

Official Signature:

Print Name & Title:

FORREST COUNTY GENERAL HOSPITAL

STANDARD CONTRACT ADDENDUM

This standard contract addendum (“Addendum”) is an integral part of contracts entered into by Forrest County General Hospital (“FCGH”) and shall become a part of the following listed Agreements with

_____________________________________ (“Contractor”) as if fully copied into the body of that Agreement.

FCGH owns, leases, operates, and/or does business as the following entities: Jefferson Davis General Hospital, Marion General Hospital, Walthall General Hospital, Pearl River County Hospital, Highland Community Hospital, and Perry County General Hospital.

The following terms shall control over any and all conflicting parts of the Agreement:

1. FCGH is a political subdivision of the State of Mississippi and is afforded the protection of limited sovereign immunity pursuant to the Mississippi Tort Claims Act (Mississippi Code Annotated, Section §11-46-1, et seq.

as amended) and the Mississippi Constitution, including Article 4, Section 100. Any action against FCGH shall be subject to the limitations contained in those and other applicable laws, including interpretations by the Mississippi Attorney General’s Office of the laws applicable to FCGH and/or the Agreement, none of which are waived by FCGH by entering into the Agreement.

2. FCGH contracts (including the Agreement) are governed by and interpreted under the laws of the State of Mississippi and the jurisdiction/venue for any litigation, special proceeding or other proceeding as between the parties that may be brought, or arise out of, in connection with, or by reason of the Agreement shall be in Forrest County, Mississippi.

3. No contract (including the Agreement) may be for a term of more than three (3) years unless it is an agreement regarding physical property (i.e., lease agreement for buildings, property, etc.).

4. Generally, Mississippi law does not allow FCGH to agree to contractual provisions under which it indemnifies or holds harmless another person or entity. Only to the extent permissible by Mississippi law does FCGH agree to any vendor’s references, if any, to limitation of liabilities, damages, and indemnifications.

5. Any references to attorney's fees to be paid by FCGH are deleted. Any reference to FCGH indemnifying or holding harmless the Contractor is deleted; FCGH does not agree to defend any contractor. Each party shall be responsible for its own defense against all claims, liabilities, losses and expenses, including reasonable costs, collection expenses and attorneys' fees, which may arise because of the negligence, misconduct or other fault of its own agents or employees in the performance of its obligations under this Agreement.

Mississippi law also does not allow FCGH to agree to mandatory arbitration, choice of law (other than Mississippi), or choice of venue (other than Forrest County, Mississippi), and provisions in the Agreement to the contrary are hereby deleted.

6. All references to interest, penalties, and/or late fees to be paid by FCGH on other than lease-purchase contracts not exceeding five years are deleted. FCGH will pay within forty-five (45) days of invoice, receipt, inspection and approval of goods and services as provided in §31-7-305(3) of the Code.

7. In the event Contractor does not furnish products or services as agreed upon in the Agreement, including any stated time period to cure, FCGH may, at its discretion, declare the Agreement null and void by written notice to the Contractor or may require the Contractor, at Contractor's expense, to make such modification as necessary to make the products or services satisfactory.

8. As a political subdivision of the State, FCGH maintains professional and general liability coverage (or equivalent self-insurance) in the amounts set forth by the Mississippi Tort Claims Act under MS Code Annotated, Section 11-46-1, et seq.) and does not name others as additional insureds.

9. In the event of any conflict between the terms of the Agreement and the terms of this Standard Addendum, the terms of this Addendum shall control. This Addendum and the Agreement constitute the entire agreement of the Parties with regard to the subject matter of the Agreement. In all other respects, the Agreement shall remain unchanged. No modification to the Agreement or any term thereof may be amended except pursuant to in writing signed by an authorized representative of FCGH. Contractor hereby acknowledges that no other person has authority to bind FCGH to any change in any term of the Agreement, and specifically agrees that any Contractor cannot vary the terms of the Agreement by invoice, purchase order, memo or otherwise, unless it secures the signature of an authorized FCGH representative, acknowledging and expressly agreeing to the change. No acceptance or payment of an invoice by FCGH where the terms of that invoice that vary the Agreement shall constitute an amendment to the Agreement, but to the contrary shall be treated as mutual mistake and Contractor shall refund any payment received from FCGH which is not in compliance with the price terms and other provisions of the Agreement.

10. Contractor agrees to abide by the requirements of the Mississippi Employment Protection Act (E-Verify Program), as amended, by registering to do business with the Mississippi Department of Employment Security. Contractor further agrees that it shall only employ persons who are legal citizens of the United States or are legal aliens, properly documented and verified by Contractor in compliance with all applicable statutes, regulations and other laws.

11. If providing on site services, Contractor agrees to comply with fingerprinting and criminal history record checks requirements in accordance with Sections 37-29-232 and 43-11-13, Mississippi Code of 1972, as amended, to the extent applicable to Contractor. Contractor shall be responsible for ascertaining the application of those laws to it and its employees providing services under the Agreement.

12. If providing on-site patient care or on-site services in close proximity to patients, Contractor agrees to ensure its on-site staff have been drug screened no more than thirty (30) days prior to beginning the on-site assignment, using a drug screen procedure that is comparable to the drug screen currently used by FCGH in its post-offer pre-employment drug screening process.

13. Mississippi law limits those who can bind FCGH to any contractual provision and Contractor understands and agrees to this. Any changes in the Agreement, as to price or other terms, shall not be effective unless approved in writing signed by an authorized representative of FCGH.

14. Until the expiration of four (4) years after the furnishing of any Services hereunder, Contractor shall make available upon written request to the Department of Health and Human Services, or upon request to the Comptroller General of the United States, or of their duly authorized representatives this Agreement and the books, documents and records that are necessary to certify the nature and extent of the costs of the Agreement.

COMPLIANCE: As part of FCGH's overall Compliance Program, Contractor shall establish procedures and insure adherence to all applicable state and federal statutes, including but not limited to, the Stark Law (§42 USC 1395), the federal False Claims Act, the Medicare Anti-kickback Statutes, the federal Civil Monetary Penalty Act, the provisions of the Medicare carrier manual, Medicare and Medicaid statutes and regulations, the Emergency Medical Treatment and Active Labor Act (EMTALA), the Balanced Budget Act, and the Patient Protection and Affordable Care Act of 2010. All performance by Contractor pursuant to the Agreement shall be done in compliance with the applicable rules and regulations of the Det Norske Veritas (FCGH’s accreditation entity) and any third party payer.

Contractor certifies that it has not been disqualified in any manner from any federally funded program, is in compliance with all state, federal and local laws applicable to it and to its performance of the Agreement, and Contractor has never been debarred or limited in any manner from participation in the matters relevant to the Agreement.

CONTRACTOR FORREST COUNTY GENERAL HOSPITAL

Signature Signature Name Name Title Title Date Date

BUSINESS ASSOCIATE ADDENDUM

This BUSINESS ASSOCIATE ADDENDUM (hereinafter, the “Addendum”) is made and entered into as of the _____________ day of _________________________________, 202_____, by and between _____________________________________________(“Business Associate”) and FORREST COUNTY GENERAL HOSPITAL (“Covered Entity”), a Mississippi community hospital.

W I T N E S S E T H :

WHEREAS, Covered Entity is a duly organized and validly existing Mississippi community hospital operating under the governance of the Board of Trustees of Forrest County General Hospital in Hattiesburg, Mississippi, organized and operating in accordance with Title 41, Chapter 13 of the Mississippi Code;

WHEREAS, Covered Entity owns, leases, operates, controls, and/or does business as the following entities:

Jefferson Davis Community Hospital, Marion General Hospital, Walthall General Hospital, Pearl River County Hospital, Highland Community Hospital, and Perry County General Hospital;

WHEREAS, the parties have entered into one or more written agreements, and may in the future enter into additional agreement(s), (collectively, the “Arrangements”) pursuant to which Business Associate provides services under one or more existing agreements or other arrangements, for or on behalf of Covered Entity, and Business Associate has been identified as a Business Associate (as hereinafter defined) of Covered Entity;

WHEREAS, the business relationship between Business Associate and Covered Entity requires that individually identifiable Protected Health Information (as hereinafter defined) be provided by or on behalf of Covered Entity to Business Associate so that Business Associate may perform services for or on behalf of Covered Entity; and

WHEREAS, Business Associate and Covered Entity desire to comply with the National Standards for the Privacy and Security of Individually Identifiable Protected Health Information, 45 C.F.R. Parts 160 and 164 (“Privacy Rule”), the Security Standards for the Protection of Electronic Protected Health Information, 45 C.F.R.

Parts 160 and 164, Subparts A and C (“Security Rule”), and the HIPAA Omnibus Final Rule, 78 Fed. Reg. 5566 (January 25, 2013) (“Omnibus “Rule”) adopted by the Department of Health and Human Services (“DHHS”) pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Title XIII, Subtitle D of the American Recovery and Reinvestment Act of 2009 (“HITECH Act”). Collectively, the Privacy Rule, the Security Rule, the Omnibus Rule, and all other regulations promulgated pursuant to HIPAA and the HITECH Act are the “HIPAA Regulations”.

NOW THEREFORE, in consideration of the mutual promises herein contained, it is agreed as follows:

1. Definitions.

The following definitions apply to this Addendum:

a. “Protected Health Information” or “PHI” means any individually identifiable health information in any form or medium and includes, but is not limited to, genetic information as required by the Genetic Information Nondiscrimination Act of 2008. For all purposes hereunder, PHI shall include Electronic PHI.

b. “Access” shall have the same meaning as this term has in 45 C.F.R. § 164.304.

c. “Use” and “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within the entity that maintains the information.

d. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner PHI outside the entity that maintains the information, and shall hereinafter include “Access” and “Use” as defined herein.

e. “Discovery” shall have the same meaning as described in 45 C.F.R. § 164.404(a).

f. “Subcontractor” means a person to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of Business Associate.

g. “Transmit” means, with respect to Electronic PHI, the creation, receipt, maintenance or transmission of Electronic PHI by Business Associate on Covered Entity’s behalf.

h. Except as otherwise provided in this Addendum, all other terms used but not defined herein shall be defined in a manner that is consistent with the HIPAA Regulations.

2. Parameters of Business Relationship. In performing its obligations, Business Associate will be provided with and have access to individually identifiable PHI. Business Associate shall only use or disclose PHI such as necessary to perform the services set forth in the agreement or arrangement with Covered Entity. All such PHI will be used by Business Associate solely in the performance of its obligations under this Addendum in accordance with the terms hereof, and Business Associate shall limit and regulate all Uses and Disclosures of all such PHI in accordance with the terms of this Addendum. Business Associate may Use and Disclose PHI for the proper management and administration of Business Associate in accordance with the requirements of 45 C.F.R § 164.504(e).

3. De-Identification. Covered Entity may, but shall not be obligated to, de-identify any or all PHI in accordance with the HIPAA Regulations. If the information received by Business Associate from Covered Entity has been appropriately de-identified, then such information will not be considered PHI and this Addendum shall not apply to such de-identified information.

4. Duties of Business Associate. Business Associate warrants that it will comply in all material respects with the HIPAA Regulations when it Uses or Discloses PHI received by Business Associate from or on behalf of Covered Entity. Compliant with the HIPAA Regulations, Business Associate agrees to the following:

a. Permissible and non-permitted Disclosures. Business Associate will not Use or Disclose PHI received from Covered Entity in any way other than as permitted or required pursuant to the relationship described above in Section 2 of this Addendum. Business Associate may not Use or Disclose PHI in any manner that would violate the HIPAA Regulations if done by the Covered Entity. To the extent Business Associate carries out any of Covered Entity’s obligations under the HIPAA Regulations, Business Associate shall comply with the HIPAA Regulations in doing so. Business Associate may Disclose PHI as otherwise required by law.

b. Appropriate safeguards. Business Associate will exercise all appropriate safeguards to prevent Use or Disclosure of PHI other than as necessary for Business Associate to perform its obligations pursuant to the relationship described above in Section 2 of this Addendum and will comply with the Security Rules with regard to Electronic PHI. Business Associate shall Use and Disclose PHI consistent with “minimum necessary” policies and procedures and shall maintain PHI in accordance with the HIPAA Regulations.

c. Reporting requirements. Business Associate will immediately report to Covered Entity any Security Incident or non-permitted Use, Disclosure or Breach of PHI that is made to or by Business Associate, its employees, representatives, agents or Subcontractors, and shall comply with the HIPAA Regulations concerning notification in the event of breach, as such requirements apply to business associates.

Business Associate shall immediately report any such Security Incident or non-permitted Use, Disclosure or Breach to Covered Entity’s Privacy Officer, or other individual who may be designated by written notice to Business Associate, without unreasonable delay and in no case later than five (5) calendar days following Discovery of such Security Incident or non-permitted Use, Disclosure or Breach.

d. Subcontractors and agents. Business Associate will require that any and all Subcontractors or agents that create, receive, maintain, or transmit PHI on behalf of Business Associate enter into a written business associate agreement wherein such Subcontractor or agent agrees to be bound by the HIPAA

Regulations and the same restrictions, conditions and duties that apply to Business Associate in this Addendum. Business Associate will promptly and without unreasonable delay identify and report all such subcontractors and agents to Covered Entity prior to disclosing any PHI to such Subcontractors or agents. Business Associate shall also require, within its written business associate agreement with such Subcontractor or agent, that such Subcontractor or agent agree to notify Business Associate of any Security Incident or non-permitted Use, Disclosure or Breach without unreasonable delay and in no case later than five (5) calendar days following Discovery of such Security Incident or non-permitted Use, Disclosure or Breach.

e. Content of reporting. In each reporting of a Security Incident or non-permitted Use, Disclosure or Breach of Unsecured PHI, Business Associate (or Subcontractor, as applicable) shall include the name or other specific identification of the affected Individual, and any other available information regarding the Security Incident, non-permitted Use, Disclosure or Breach, including: (i) a brief description of what happened, including the date of the incident and discovery of the incident; (ii) the name, and address if known, of the entity or person who received the PHI; (iii) a brief description of the types of Unsecured PHI that were involved in the incident (such as full name, Social Security number, date of birth, home address, account number, disability code or any other identifiers that could lead to re identification);

(iv) the location of the PHI and the method of Disclosure (such as a computer or by mail); (v) whether any assurances have been made by the person who received the PHI that he or she will not further disclose the PHI; (vi) steps affected Individuals should take to protect themselves from potential harm resulting from the incident; (vii) the risk assessment Business Associate used to determine whether a non-permitted Use, Disclosure or Breach occurred; and (viii) any records of investigation related to the underlying incident.

f. Access to PHI. If Business Associate maintains PHI in a Designated Record Set that is the subject of an Individual’s request for access pursuant to 45 C.F.R. § 164.524, Business Associate will maintain appropriate procedures to make the PHI specified by Covered Entity available (in the requested form and medium) and will cooperate with Covered Entity so that it may comply with the obligations set forth in 45 C.F.R. § 164.524. Business Associate will maintain appropriate procedures by which Individuals are granted access to their PHI, including in electronic format if requested by the Individual and the information is held in an electronic health record.

g. Availability of internal practices, books and records. Business Associate will make its policies and procedures and books and records relating to Uses and Disclosures of PHI received from Covered Entity or created or received by the Business Associate on behalf of Covered Entity, available to the Secretary of DHHS for purposes of determining Business Associate’s and Covered Entity’s compliance with the HIPAA Regulations.

h. Amendments to PHI. When notified by Covered Entity, Business Associate will incorporate into its records any amendments or corrections to any of Covered Entity’s PHI maintained by Business Associate.

i. Return and destruction of PHI. Upon request from Covered Entity or at termination of this Addendum, Business Associate will, within a reasonable time period and from time to time, return to Covered Entity all PHI received from or on behalf of Covered Entity that Business Associate maintains in any form and all copies of such PHI (or if Covered Entity so requests, shall destroy such PHI and all copies and shall certify to Covered Entity that it has done so). If such return or destruction is not feasible, Business Associate will extend the protections of this Addendum to the PHI retained and will limit further Uses and Disclosures to those purposes that make return or destruction infeasible.

j. Accounting of disclosures. Upon request from Covered Entity, Business Associate will timely provide to Covered Entity or to an Individual an accounting of all Business Associate’s Disclosures of PHI received from or on behalf of Covered Entity concerning the Individual, except for Disclosures exempted from this requirement in 45 C.F.R. § 164.528. Every accounting shall include:

(i) The date of each disclosure;

(ii) The name and address of the organization or person who received the PHI;

(iii) A brief description of the information disclosed; and

(iv) For Disclosures other than those made at the request of the Individual, the purpose for which the information was Disclosed or a copy of the request or authorization for Disclosure.

Business Associate will provide the accounting to Covered Entity as soon as possible, but in any event no later than ten (10) business days after Covered Entity’s request therefor. Business Associate shall provide for a means of accounting for Disclosures for as long as Business Associate maintains PHI received from or on behalf of Covered Entity.

k. Covered Entity’s right to inspect. Business Associate shall permit Covered Entity, upon request, to inspect and audit all documents, books, databases, software, computer systems, files or other records, whether in electronic or paper form, to ensure Business Associate’s compliance with the HIPAA Regulations, related regulations and laws, and the terms of this Addendum. Any such inspection shall be subject to three (3) business days’ notice from Covered Entity; provided that in the event of breach of this Addendum, or in the event of a Security Incident, non-permitted Use, Disclosure or Breach of PHI by Business Associate, no such notice shall be required.

5. Obligations of Business Associate regarding electronic PHI. Any PHI that is transmitted via electronic media or maintained in electronic media by Business Associate will be protected under standards and specifications no less stringent that those described in the Security Rule and with such security requirements of the HITECH Act, as supplemented by the HIPAA Regulations. In accordance with the Security Rule, Business Associate will:

a. Comply with the applicable requirements of 45 C.F.R. Part 164, Subpart C.

b. Ensure that any Subcontractors that create, receive, maintain or transmit Electronic PHI on behalf of the Business Associate agree to comply with the applicable requirements of 45 C.F.R. Part 164, Subpart C by entering into a contract or other arrangement that complies with 45 C.F.R. § 164.314(a)(2)(i).

c. Alert Covered Entity of any Security Incident of which it becomes aware, including breaches of unsecured PHI as required by 45 C.F.R. § 164.410, and comply with all notification requirements applicable to Business Associate under state or federal law.

d. Make its policies and procedures related to the implementation of security safeguards available to the Secretary of DHHS for purposes of determining the Covered Entity’s compliance with the security standards.

6. Indemnification; Subpoena. Business Associate shall be responsible for the actions of its employees and partners in connection with its representation of Covered Entity, including, without limitation, the services listed in Section 2 of this Addendum. Business Associate will defend and indemnify Covered Entity from and against any and all claims, damages, liabilities, losses and expenses (including reasonable attorney’s fees) based on or arising out of the alleged or actual non-permitted Use, Disclosure or Breach of PHI (as described in Section 1 of this Addendum), breach of security, or other breach of this Addendum by Business Associate. Business Associate will relinquish to Covered Entity all control over responses to subpoenas received by Business Associate relating to PHI created or received on behalf of Covered Entity.

7. Remedies Upon Breach. In addition to Business Associate’s fulfilling its obligations set forth in the HIPAA Regulations, upon a Breach or a suspected Breach by Business Associate or its Subcontractors of any requirement of this Addendum, Covered Entity, at its option, may require Business Associate to:

a. Furnish to Covered Entity copies of its practices and procedures and books and records to facilitate Covered Entity’s mitigation of damages arising from a non-permitted Use, Disclosure or Breach of PHI by Business Associate or its Subcontractors;

b. Exercise all reasonable efforts to retrieve improperly Used or Disclosed PHI and to mitigate damages to Covered Entity and/or any Individual(s) arising from any Security Incident or non-permitted Use, Disclosure or Breach by Business Associate or its employees, agents or Subcontractors, including but not limited to (1) indemnifying Covered Entity for any and all costs associated with Covered Entity’s compliance and notification obligations under the HIPAA Regulations, and (2) gathering information necessary for Covered Entity’s compliance with such regulations;

c. Establish and adopt new practices, policies and procedures to assure that PHI is not Used or Disclosed in the future in violation of the HIPAA Regulations;

d. Fully cooperate with Covered Entity and comply with all auditing or reporting requests by Covered Entity to demonstrate Business Associate’s compliance with the HIPAA Regulations;

e. Pay any fines or penalties imposed against Covered Entity resulting from such Security Incident or non-permitted Use, Disclosure or Breach, as well as any costs Covered Entity reasonably incurs as a result of such violation, including, without limitation, legal fees and costs associated with investigation, costs and penalties associates with mitigation, costs and penalties associated with the reporting and notification of the incident, and any costs associated with responding to any inquiries of the Secretary in connection with such incident; and

f. Take such other actions as Covered Entity may reasonably require.

8. Term; Termination. This Addendum shall be in effect for the entire length of the underlying business relationship described in Section 2 of this Addendum or until terminated as provided in this section. Covered Entity may terminate this Addendum and the underlying business relationship described in Section 2 of this Addendum in the event that Business Associate or its employees, Subcontractors or agents improperly Uses or Discloses PHI or otherwise violates the HIPAA Regulations, or if Covered Entity determines that Business Associate fails to put in place appropriate safeguards to protect the security of electronic PHI, or otherwise violates a material term of this Addendum. All rights, duties and obligations established in this Addendum shall survive termination of this Addendum.

9. Change of Law. In the event any state or federal laws or regulations, now existing or enacted or promulgated after the effective date of this Addendum, are interpreted by judicial decision, a regulatory agency or legal counsel to a party hereto in such a manner as to indicate that any provision of this Addendum may be in violation of such laws or regulations, the parties shall amend this Addendum as necessary. To the maximum extent possible, any such amendment shall preserve the underlying rights, duties and obligations established in this Addendum.

10. General Provisions.

a. Notices. Any and all notices or other communications required or permitted to be given under any of the provisions of this Addendum shall be in writing and shall be deemed to have been delivered when given in the manner set forth below to the following addresses:

If to Business Associate:

Name: ________________________________________________ Address: ______________________________________________ City/State/Zip: _________________________________________

ATTN: ________________________________________________

If to Covered Entity:

Forrest County General Hospital 6051 U.S. Highway 49

ATTN: Contracts & Legal Services

(or at such other address or as any party may specify by notice to all other parties given as aforesaid). Unless otherwise specifically provided in this Addendum, such communications shall be deemed to have been given (a) three days after mailing, when mailed by registered or certified postage-paid mail; (b) on the next business day, when delivered to a same-day or overnight national courier service or the U.S. Post Office Express Mail; or (c) upon the date of receipt by the addressees when delivered personally; provided, however, that any notice of change of address shall be effective only upon receipt. Notice may be given on behalf of a party by its counsel.

b. Entire Addendum; Amendment. This writing constitutes the entire and only agreement of the parties with respect to the subject matter hereof and supersedes and cancels any and all prior negotiations, understandings and agreements concerning the subject matter hereof. This Addendum may be amended, modified, superseded, canceled, renewed or extended only by a written instrument executed by the parties herein.

c. Waiver. The failure by any party at any time to require performance or compliance by another of any of its obligations or agreements shall in no way affect the right to require such performance or compliance at any time thereafter. The waiver by any party of a breach of any provision hereof shall not be taken or held to be a waiver of any preceding or succeeding breach of such provision or as a waiver of the provision itself. No waiver of any kind shall be effective or binding, unless it is in writing and is signed by the party against which such waiver is sought to be enforced.

d. Binding Nature. This Addendum shall be binding upon and inure to the benefit of each party hereto, its successors and permitted assigns.

e. Assignment. Neither party may assign or otherwise transfer its rights or obligations under this Addendum, by operation of law or otherwise, without the prior written consent of the other party to this Addendum.

f. Geographic Limitation on Subcontracting and Assignment. Notwithstanding any language to the contrary, Business Associate shall not assign, delegate, or subcontract any of its rights or obligations under this Addendum to entities or individuals located or residing outside of the United States.

g. Captions; Language. The section headings contained in this Addendum are for the purposes of convenience only and are not intended to define or limit the contents of such sections. In this Addendum, unless the context requires otherwise, the singular includes the plural, the plural the singular, and the word “or” is used in the inclusive sense.

h. Counterparts. This Addendum may be executed in one or more counterparts, all of which taken together shall be deemed to evidence one and the same agreement.

i. Applicable Law. This Addendum and its validity, construction, and performance shall be governed in all respects by the laws of the State of Mississippi and by the HIPAA Regulations.

j. No Third-Party Beneficiaries. Nothing expressed or implied in this Addendum or in any underlying agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and respective successors or assignees of the parties, any rights, remedies, obligations, or liabilities whatsoever.

IN WITNESS WHEREOF, the parties have executed this Addendum as of the day and year first above written.

FORREST COUNTY GENERAL HOSPITAL

By: ________________________________________ Name: Ben Hester Title: VP/CFO

BUSINESS ASSOCIATE

By:____________________________________________ Name: _________________________________________ Title: __________________________________________