40DHHS-S3339 - DHCFP Business Continuity Agreement_v2.docx

Joe Lombardo Governor Richard Whitley, MS Director

DEPARTMENT OF

HEALTH AND HUMAN SERVICES

DIVISION OF HEALTH CARE FINANCING AND POLICY

Helping people. It’s who we are and what we do.

Stacie Weeks, JD MPH

Administrator 4070 Silver Sage Drive ● Carson City, Nevada 89701 775-684-3676 ● Fax 775-687-3893 ● dhcfp.nv.gov

Business Continuity Agreement

This Business Continuity Agreement is designed to safeguard the uninterrupted operation of services critical to the Nevada Medicaid Program in accordance with state and federal laws.

This Business Continuity Agreement ("Agreement") is made and entered into between:

The Division of Health Care Financing and Policy ("Client")

AND

("Vendor")

Purpose The purpose of this Agreement shall be to establish the Vendor's obligations to ensure continuity of services for the Nevada Medicaid Program, including the development, implementation, and maintenance of a comprehensive Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) to address system resilience. These provisions are required by Federal and State regulations to comply with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law 104-191, the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Public Law 111-5, 45 CFR 164.308(a)(7), and Nevada Revised Statute (NRS) 422.

WHEREAS, the Client requires the Vendor to provide certain services in connection with the administration and operation of the Nevada Medicaid Program;

WHEREAS, the continuity of the Vendor’s services are critical to the operations of the Nevada Medicaid Program, and any failure, delay, or disruption in the services provided by the Vendor could result in serious harm to the program’s beneficiaries, providers, and operations;

WHEREAS, the Vendor agrees to implement and maintain a comprehensive Business Continuity Plan to ensure that services continue uninterrupted, even in the event of disruptions, and to mitigate single points of failure to ensure service redundancy.

NOW, THEREFORE, the parties agree as follows:

Scope This Agreement applies to all systems, infrastructure, personnel, and third-party entities used by the Vendor in connection with the services provided under the Vendor Contract entered into on [Contract Date] between the Vendor and the Client. This Agreement governs the Vendor's responsibilities in ensuring uninterrupted service delivery.

Definitions For the purposes of this Agreement, the following terms shall have the meanings set forth below:

· "Client" - Refers to the Division of Health Care Financing and Policy (DHCFP), a division of the Nevada Department of Health and Human Services responsible for administering the Nevada Medicaid Program.

· "Vendor" - Refers to the party contracted by the Client to provide services under the terms of this Agreement.

· "Business Continuity Plan (BCP)" - A documented strategy developed, implemented, and maintained by the Vendor to ensure the continuation of critical services in the event of system outages, disasters, or other operational disruptions.

· "Disaster Recovery Plan (DRP)" - A detailed plan outlining the steps, roles, and procedures the Vendor will take to restore critical services and operations following a significant disruption, including recovery timelines.

· "Continuity of Services" - Refers to the Vendor’s responsibility to ensure that essential functions and services to the Nevada Medicaid Program remain available without interruption, even in adverse circumstances.

· "System Resilience" - The ability of the Vendor’s systems to withstand and recover from failures, attacks, or other disruptions, ensuring minimal downtime and impact on operations.

· "Redundancy" - The inclusion of additional or backup systems, processes, or personnel to prevent single points of failure, ensuring continuous operations in the event of disruptions.

· "Single Points of Failure" - Any individual component, system, or process whose failure would result in a complete disruption of service.

· "Subcontractor" - Any third-party entity engaged by the Vendor to provide part of the services under this Agreement. The Vendor is responsible for ensuring the subcontractor adheres to the same standards and obligations set forth herein.

· "Notice" - Formal communication, typically in writing, required between the parties for any amendments, changes, or compliance issues under this Agreement.

· "Confidential Information" - Any proprietary, sensitive, or legally protected information disclosed under this Agreement, including data related to the Nevada Medicaid Program, which must be kept confidential in accordance with applicable data protection laws.

Vendor Obligations The Vendor must provide the following within 30 days of contract signing or signing of this agreement:

Business Continuity Plan (BCP)

· The Vendor must provide, implement, and maintain a comprehensive BCP to ensure the uninterrupted provision of services to the Nevada Medicaid Program.

· The BCP must include redundancy measures, failover capabilities, and processes for maintaining operations during outages, cyberattacks, natural disasters, or other disruptions.

· Identify and mitigate any single points of failure by ensuring system, process and personnel redundancies. This includes but is not limited to:

· Data centers, cloud-based systems and switches,

· Key personnel positions

Disaster Recovery Plan (DRP)

· The Vendor must provide, implement, and maintain a comprehensive DRP that ensures timely recovery and restoration of critical services following a disruptive event.

· The DRP must include a detailed recovery process with clearly defined roles, timelines, and escalation procedures.

· The Vendor shall ensure that backup and recovery systems are tested at least annually, and that a successful test is demonstrated to the Client upon request.

Third-Party Accountability

· Any subcontractor or third-party service providers engaged by the Vendor shall adhere to the same business continuity and disaster recovery standards set forth in this Agreement.

· The Vendor must include flow-down provisions in its agreements with any subcontractors to ensure compliance.

· The Vendor remains fully responsible for the continuity of services provided by its subcontractors.

Reporting and Testing

· The Vendor must notify the Client in writing within five (5) business days of any changes to its BCP or DRP.

· The Vendor must conduct at least one (1) full BCP and DRP test annually, simulating potential disaster scenarios.

· Results of such tests, including any corrective actions or updates made as a result of the test, shall be provided to the Client upon request.

· In the event of any disruption or activation of the BCP or DRP, the Vendor must notify the Client immediately and provide a detailed report within five (5) business days. This report shall include:

· A summary of the event

· The effectiveness of the BCP/DRP response

· The impact on services

· Any corrective actions to prevent recurrence

Compliance The Vendor shall ensure that its BCP and DRP comply with all applicable federal and state regulations, including but not limited to those set by the Centers for Medicare and Medicaid Services (CMS), Health Insurance Portability and Accountability Act (HIPAA), Nevada Revised Statutes (NRS) and the Nevada Division of Health Care Financing and Policy (DHCFP).

Penalties Remedies for non-compliance with this Agreement, including service disruptions or delays, are governed by the Vendor Contract and may include service credits, financial penalties, or termination for cause, following the terms outlined in the Service Level Agreement (SLA) and the Vendor Contract.

Confidentiality The Vendor must ensure that all aspects of the BCP and DRP, including any proprietary information and sensitive data related to the Nevada Medicaid Program, are kept confidential and secure in accordance with the terms of the Vendor Contract and applicable data protection laws.

Term and Termination This Agreement shall remain in effect for the duration of the Vendor's contractual relationship with the Nevada Medicaid Program or until otherwise terminated by either party in accordance with the terms of the Vendor Contract.

Indemnification and Liability The indemnification and liability obligations under this Agreement are governed by the terms of the Vendor Contract. Each party agrees to indemnify and hold the other harmless from claims, losses, and expenses arising from misrepresentation, breach of obligations, or performance issues as specified in the Vendor Contract, including its limitations and exclusions.

Miscellaneous Entire Agreement This Agreement constitutes the entire understanding of the parties with respect to business continuity obligations and supersedes any prior agreements or understandings.

Amendments All requested amendments shall be submitted in writing to the other party no less than fourteen (14) days prior to execution of such amendments. Amendments must be signed by both parties.

Clarification This Agreement references the requirements of Federal and State Regulations, as well as amendments and/or provisions that are currently in place and any that may be forthcoming.

Interpretation The provisions of this Agreement shall prevail over any provisions in the Contract that conflict or appear inconsistent with any provision in this Agreement. This Agreement and the Contract shall be interpreted as broadly as necessary to implement and comply with Federal (HIPAA) and State Regulations. The parties agree that any ambiguity in this Agreement shall be resolved to permit the Client and the Vendor to comply with these Regulations.

IN WITNESS WHEREOF, the parties hereto have executed this Business Continuity Agreement as of the day and year first above written.

Division of Health Care Financing and Policy By: __________________________________ Name:

Title:

Date:

[Vendor Name] By: __________________________________ Name:

Title:

Date:

image1.png image2.jpeg