Addendum F - RIDOH Specific Supplemental Terms and Conditions.pdf

Department of Health

Three Capitol Hill

Providence, RI 02908-5097

TTY: 711

www.health.ri.gov

GC Addendum F – Supplemental Terms and Conditions

Name of Contractor: Vendor Name

Title of Agreement: Prescription Drug Monitoring Program (PDMP)

Basis for Contract: RFP

Contract Award: $

Term of the Agreement: January 1, 2027 through April 30, 2028

Four (4) 12-month options for extension may be exercised, commencing May 1, 2028 through April 30, 2032, contingent upon vendor performance and availability of funding.

This Addendum to the State’s General Conditions of Purchase (220-RICR-30-00-13 available at https://rules.sos.ri.gov/regulations/part/220-30-00-13), supplements and serves as additional terms and conditions to the General Conditions of Purchase (“General Conditions”). Under the

General Conditions of Purchase, 220-RICR-30-00-13.34, this Addendum serves as GC Addendum F.

The Contractor further agrees as follows:

WHEREAS this contract is executed between the RI Department of Health (the “State”) and

[Vendor] (the “Contractor”) (collectively the “Parties”) for services rendered to the State as the

Prescription Drug Monitoring Program (PDMP);

WHEREAS the Contractor will perform all duties and responsibilities contained in the

Scope of Work (Exhibit A) and adhere to the agreed-upon budget (Exhibit B);

WHEREAS the Contractor is a [Description] and therefore willing and qualified to provide services as the Prescription Drug Monitoring Program; and

WHEREAS the vendor is properly staffed for the Prescription Drug Monitoring Program, in addition to the performance requirements enumerated in PAR 2.

NOW THEREFORE, the Parties, for good and valuable consideration, the receipt of which is hereby acknowledged, agree as follows:

PAR. 1. GOVERNING LAW AND GENERAL TERMS AND CONDITIONS

The State’s Purchasing Law (Chapter 37-2 of the Rhode Island General Laws) and Rhode Island

Department of Administration, Division of Purchases, Purchasing Rules, Regulations, and

General Conditions of Purchase apply as the governing terms and conditions of the Entire

Agreement, which can be obtained at https://rules.sos.ri.gov/regulations/part/220-30-00-13. In addition, the provisions of Federal Laws, Regulations and Procedures governing the implementation of federal funds apply to this Entire Agreement.

PAR. 2. PERFORMANCE

In addition to the obligations stated in 220-RICR-30-00-13.22, the Contractor shall perform all obligations, duties, and work for the Term of the Agreement under this Entire Agreement. Said duties and responsibilities are contained in the Scope of Work in Exhibit A and Budget in

Exhibit B. The Rhode Island Department of Health (“RIDOH”) shall have the right, at all times, to review the work being performed and to that end, RIDOH shall be given reasonable access to all activities related to the Entire Agreement.

PAR. 3. TIME OF PERFORMANCE

The Contractor will perform under the Entire Agreement Prescription Drug Monitoring Program for a term commencing on January 1, 2027 and ending on April 30, 2028 (the “Term of the

Agreement”), with four (4) 12-month options for extension beginning on May 1, 2028 and expiring on April 30, 2032.

https://rules.sos.ri.gov/regulations/part/220-30-00-13 https://rules.sos.ri.gov/regulations/part/220-30-00-13

PAR. 4. INDEPENDENT CONTRACTOR

The Contractor shall be engaged as an independent contractor of the State. Nothing contained in the Entire Agreement will be construed to create the relationship of employer and employee, principal and agent, partnership or joint venture, or any other fiduciary relationship. The

Contractor may not act as agent for, or on behalf of, the State or to bind the State in any manner.

The State shall issue an IRS Form 1099 reflecting the Contractor’s compensation and shall not be responsible for federal, state and local taxes derived from the Contractor's net income or for the withholding and/or payment of any federal, state and local income, and other payroll taxes, workers' compensation, disability benefits, or other legal requirements applicable to the

Contractor. The Contractor will not be entitled to worker's compensation, retirement, insurance or other benefits afforded to employees of the State.

PAR. 5. PROJECT OFFICER - RIDOH

RIDOH shall appoint a Contract Manager (“Project Officer” or “Contract Manager”) to manage this Entire Agreement. The Contractor agrees to maintain close and continuing communication with the Contract Manager throughout the performance of work and services undertaken under the terms of the Entire Agreement. The Contract Manager is responsible for seeking authorization of all payments made by RIDOH to the Contractor under the Entire

Agreement. No work shall be commenced on the part of the Contractor without a valid Purchase

Order issued by the Department of Administration, Division of Purchases.

PAR. 6. CONTRACTOR

The Contractor shall be responsible for coordinating and reporting work performed pursuant to the Entire Agreement, subject to and in accordance with the Scope of Work in Exhibit A and within the Budget in Exhibit B. The Contractor shall notify RIDOH in writing immediately and seek approval from RIDOH should a change to the Entire Agreement be necessary in the opinion of the Contractor. Under no circumstances will a change be undertaken without the prior written approval of RIDOH.

PAR. 7. WORK REVIEWS

The Contractor recognizes the responsibilities of RIDOH to provide financial oversight of its contractors and consultants and agrees that the scope of all work performed under the Entire

Agreement may be reviewed by RIDOH and/or its designee and/or by any third party designated by RIDOH, for the purpose of verifying hours, costs, and expenses, and to ensure that they are in conformance with state and federal laws, regulations and policies or for any other reason in the sole discretion of RIDOH.

PAR. 8. RESPONSIBILITIES UPON TERMINATION AND/OR DEFAULT OF THE

ENTIRE AGREEMENT

Upon termination and/or default in accordance with 220-RICR-30-00-13.20 and the delivery to the

Contractor of a notice of termination, specifying the nature of the termination, the extent to which performance of work under the Entire Agreement is terminated, and the date upon which such termination becomes effective, the Contractor shall:

1. Stop work under the Entire Agreement on the date and to the extent specified in the notice of termination.

2. Take such action as may be necessary, or as RIDOH may reasonably direct, for the protection and preservation of the property related to the E n t i r e Agreement, which is in the possession of the Contractor and in which the State has or may acquire an interest.

3. Terminate all orders to the extent that they relate to the performance of work terminated by the notice of termination.

4. Subject to the provisions of this paragraph, assign to the State all of the rights, title, and interest of the Contractor under the orders so terminated, in which case the State shall have the right, at its discretion, to settle or pay any or all claims arising out of the termination of such orders, however, notwithstanding this provision, the Contractor will not be obligated to assign any such rights, title or interest in the absence of payment therefore by the

State.

5. With the approval or ratification of the State, initiate settlement of all outstanding liabilities and all claims, arising out of such termination of orders, the cost of which would be reimbursable in whole or in part, in accordance with the provisions of the

Entire Agreement. Final approval by the State shall not be unreasonably withheld.

6. Subject to the provisions of this paragraph, transfer title, or if the Contractor does not have title, then transfer its rights to the State (to the extent that title has not already been transferred) and deliver in the manner, at reasonable times, and to the extent reasonably directed by the State all files, processing systems, data manuals, or other documentation, in any form, that relate to the work completed or in progress prior to the notice of termination.

7. If instructed, complete the performance of such part of the work as shall not have been terminated by the notice of termination. The Contractor shall proceed immediately with the performance of the above obligations, notwithstanding any delay in determining or adjusting the amount of any item of reimbursable price under this clause.

8. Upon termination, Contractor agrees to an orderly transition in accordance with

220-RICR-30-00-13.30. Prior to the end of the Termination and up to sixty (60) days thereafter, the Contractor agrees to make an orderly transition of contract and/or deliverables hereunder and to perform any and all tasks in good faith that are necessary to preserve the integrity of the work performed by the Contractor on behalf of the State. Upon termination or expiration of the E n t i r e Agreement, the Contractor shall, if requested by the State at least thirty (30) days prior to such termination or expiration, provide reasonable training for the successor entity and/or continued performance of services. For providing such training or continued performance after the Term of the Agreement, the State shall pay the Contractor at mutually agreed-upon rates for personnel used in providing such training and/or services, unless services delivered are already defined herein and rates established, in which case such rates shall apply for such period. Should any missing data, materials, documents, etc., be discovered after expiration or termination, a grace period of one hundred and twenty (120) days shall be in effect during which the data, materials, documents, etc., is to be provided at a predetermined cost or at no additional cost if the Contractor caused the loss. Lost data shall be provided to the State in a form acceptable to the State.

PAR. 9 ACCESSIBILITY AND RETENTION OF RECORDS

The Contractor agrees to make accessible and to maintain all fiscal and activity records relating to the Entire Agreement to state and/or federal officials, or their designated representatives, necessary to verify the accuracy of Contractor invoices or compliance with the

Entire Agreement. This accessibility requirement shall include the right to review and copy such records. This requirement is also intended to include any auditing, monitoring, and evaluation procedures, including on-site visits, performed individually or jointly, by state or federal officials or their agents necessary to verify the accuracy of Contractor invoices or compliance with the En t i re Agreement. If such records are maintained out of the State of

Rhode Island, such records shall be made accessible by the Contractor at a Rhode Island location. Fiscal records, and narrative records pertaining to activities performed will be retained by the Contractor for audit purposes for a period of at least three (3) years following the submission of the final expenditure report for the Entire Agreement or if audit findings have not been resolved at the end of the three (3) years, the records shall be retained for an additional three (3) years after the resolution of the audit findings are made or as otherwise required by law.

The Contractor and its subcontractors, if subcontractors are permitted, w i l l provide and maintain a quality assurance system acceptable to the State covering deliverables and services under this Ent i re Agreement and will tender to the State only those deliverables that have been inspected and found to conform to the En t i re Agreement's requirements. The Contractor will keep records evidencing inspections and their results and will make these records available to the state during the Term of the Agreement and for three (3) years after final payment.

Further, the Contractor agrees to include a similar right of the State to audit records and interview staff in any subcontract related to performance of the Entire Agreement.

PAR. 10. SECURITY AND CONFIDENTIALITY

10.1. Definitions

The following definitions shall apply:

1. “Breach,” as defined pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) guidelines as well as those found in the

Health Information Technology for Economic and Clinical Health Act

(“HITECH”), means an acquisition, access, use or disclosure or suspected acquisition, access, use or disclosure of Protected Health Information (“PHI”) in violation of HIPAA privacy rules that compromise Personally Identifiable

Information (“PII”) security or privacy. Additionally, a Breach or suspected

Breach means an acquisition, access, use or disclosure or suspected acquisition, access, use or disclosure of PII or Sensitive Information (“SI”).

2. “Incident,” as defined by OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable

Information” (January 3, 2017), as an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

3. “Confidential Information” means, in addition to how it is defined in §13.17, any and all information that Contractor receives or has access to under the Entire Agreement, including but not limited to; PII; SI; PHI; Return

Information; other information (including electronically stored information) or records sufficient to identify an applicant for or recipient of government benefits;

preliminary draft, notes, impressions, memoranda, working papers and work product of State employees; any other records, reports, opinions, information, and statements required to be kept confidential by State or federal law or regulation, or rule of court; any statistical, personal, technical and other data and information relating to the State’s data; or other such data protected by State and federal laws, regulations.

4. “Personally Identifiable Information” or “PII” means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc. (As defined in 45 CFR § 75.2 and as defined in

OMB Memorandum M-06-19, “Reporting Incidents Involving Personally

Identifiable Information and Incorporating the Cost for Security in Agency

Information Technology Investments.”) PII shall also include individual's first name or first initial and last name in combination with any one or more of types of information, including, but not limited to, social security number, passport number, credit card numbers, clearances, bank numbers, biometrics, date and place of birth, mother's maiden name, criminal, medical and financial records, educational transcripts (as defined in 45 CFR § 75.2 Protected Personally

Identifiable Information).

5. “Protected Health Information” or “PHI” means individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, or transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations. Health information such as diagnoses, treatment information, medical test results, and prescription information are considered protected health information under HIPAA, as are national identification numbers and demographic information such as birth dates, gender, ethnicity, and contact and emergency contact information. PHI relates to physical records, while ePHI is any PHI that is created, stored, transmitted, or received electronically. PHI does not include information contained in educational and employment records, that includes health information maintained by a HIPAA covered entity in its capacity as an employer.

6. “Return Information” is defined under 26 USC § 6103(b)(2) and has the same meaning as “Federal Tax Information” or “FTI” as used in IRS

Publication 1075.

7. “Sensitive Information” or “SI” means information that could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals if the confidentiality, integrity, or availability is lost. Further, the loss of Sensitive Information confidentiality, integrity, or availability might: (i) cause a significant or severe degradation in mission capability to an extent and duration that the organization is unable to perform its primary functions; (ii) result in significant or major damage to organizational assets; (iii) result in significant or major financial loss; or (iv) result in significant, severe or catastrophic harm to individuals that may involve loss of life or serious life threatening injuries. (Defined in HHS Memorandum

ISP-2007-005, "Departmental Standard for the Definition of Sensitive

Information" as amended).

10.2. General

The Contractor shall take security measures to protect against the improper use, loss, access of and disclosure of any Confidential Information it may receive or have access to under this Entire Agreement as required by this Entire Agreement, the RFP and proposal, or which becomes available to the Contractor in carrying out the Entire Agreement and the RFP and the proposal and agrees to comply with State requirements for safeguarding Confidential

Information. All such information shall be held in strict confidence and protected by the

Contractor from unauthorized use and disclosure utilizing the same or more effective procedural requirements as are applicable to the State.

10.3. Privacy and Security Safeguards and Obligations

For all Confidential Information under the Entire Agreement, the Contractor must comply with the following privacy and security requirements and obligations:

a. Ensure that its employees, contractors, and agents implement the appropriate administrative, physical, and technical safeguards to protect Confidential

Information received by Contractor under this Entire Agreement from loss, theft, or inadvertent disclosure.

i. Administrative Safeguards. Contractor will advise all users who will have access to the Confidential Information of its confidential nature, the safeguards required to protect the Confidential Information, and the civil and criminal sanctions for noncompliance contained in applicable Federal laws.

ii. Physical Security/Storage: Contractor will store the Confidential

Information in an area that is physically and technologically secure from access by unauthorized persons during duty hours, as well as non-duty hours or when not in use (e.g., door locks, card keys, biometric identifiers, etc.). Only authorized personnel will transport the Confidential Information. Contractor will establish appropriate safeguards for such Confidential Information, as determined by a risk-based assessment of the circumstances involved.

iii. Technical Safeguards: Contractor agrees that the Confidential

Information exchanged under this Entire Agreement will be processed under the immediate supervision and control of authorized personnel to protect the confidentiality of the Confidential Information in such a way that unauthorized persons cannot retrieve any such Confidential Information by means of computer, remote terminal, or other means. Contractor personnel must enter personal identification information when accessing Confidential Information on the State’s systems. Contractor will strictly limit authorization to those electronic

Confidential Information areas necessary for authorized persons to perform his or her official duties.

iv. Understand that they are responsible for safeguarding this information at all times, regardless of whether or not the Contractor employee, subcontractor, or agent is at his or her regular duty station.

v. Ensure that laptops and other electronic devices/media containing

Confidential Information that constitutes PII are encrypted and/or password protected.

vi. Send E-mails containing Confidential Information that constitutes

PII only if encrypted and being sent to and received by email addresses of persons authorized to receive such information. In the case of FTI, Contractor employees, subcontractors, and agents must comply with Internal Revenue Service (“IRS”)

Publication 1075’s rules and restrictions on emailing return information.

vii. Restrict access to the Confidential Information only to those authorized Contractor employees, subcontractors, and agents who need such

Confidential Information to perform their official duties in connection with purposes identified in this Entire Agreement; such restrictions shall include, at a minimum, role-based access that limits access to those individuals who need it to perform their official duties in connection with the uses of Confidential

Information authorized in this Entire Agreement (“authorized users”). Contractor shall not use or access Confidential Data for independent projects unrelated to the purposes identified in this Entire Agreement. Further, the Contractor shall advise all users who will have access to the Confidential Information provided under this

Entire Agreement of the confidential nature of the Confidential Information, the safeguards required to protect the Confidential Information, and the civil and criminal sanctions for noncompliance contained in the applicable federal laws.

The Contractor shall require its contractors, agents, and all employees of such contractors or agents with authorized access to the Confidential Information disclosed under this Entire Agreement, to comply with the terms and conditions set forth in this Entire Agreement, and not to duplicate, disseminate, or disclose such Confidential Information unless authorized under this Entire Agreement.

viii. For receipt of FTI, the Contractor agrees to maintain all return information sourced from the IRS in accordance with IRC section 6103(p)(4) and comply with the safeguards requirements set forth in Publication 1075, “Tax

Information Security Guidelines for Federal, State and Local Agencies”, which is the IRS published guidance for security guidelines and other safeguards for protecting return information pursuant to 26 CFR § 301.6103(p)(4)-1. In addition, the Contractor shall:

(1) Establish a central point of control for all requests for and receipt of Return Information and maintain a log to account for all subsequent disseminations and products made with/from that information, and movement of the information until destroyed, in accordance with

Publication 1075.

(2) Establish procedures for secure storage of return information consistently maintaining two barriers of protection to prevent unauthorized access to the information, including when in transit, in accordance with Publication 1075.

(3) Consistently label return information obtained under this

Entire Agreement to make it clearly identifiable and to restrict access by unauthorized individuals. Any duplication or transcription of return information creates new records which must also be properly accounted for and safeguarded. Return information should not be commingled with other records unless the entire file is safeguarded in the same manner as required for return information and the FTI within is clearly labeled in accordance with Publication 1075.

(4) Restrict access to return information solely to officers, employees, agents, and subcontractors of the Contractor whose duties require access for the purposes of carrying out this Entire Agreement.

Prior to access, the Contractor must evaluate which personnel require such access on a need-to-know basis. Authorized individuals may only access return information to the extent necessary to perform services related to this Entire Agreement, in accordance with Publication 1075.

(5) Prior to initial access to FTI and annually thereafter, the

Contractor will ensure that employees, officers agents, and subcontractors that will have access to return information receive awareness training regarding the confidentiality restrictions applicable to the return information and certify acknowledgement in writing that they are informed of the criminal penalties and civil liability provided by sections

7213, 7213A, and 7431 of the Internal Revenue Code for any willful disclosure or inspection of return information that is not authorized by the

Internal Revenue Code, in accordance with Publication 1075.

(6) Contractor must ensure information systems processing return information are compliant with Section 3544(a)(1)(A)(ii) of the

Federal Information Security Management Act of 2002 (FISMA).

10.4. Ownership of Confidential Information

The Contractor expressly agrees and acknowledges that Confidential Information provided to and/or transferred by the State or to which the Contractor has access to for the performance of this Entire Agreement is the sole property of the State and shall not be disclosed and/or used or misused and/or provided and/or accessed by any other individual(s), entity(ies) and/or party(ies) without the express written consent of the State. Further, the Contractor expressly agrees to forthwith return to the State any and all said Confidential Information and/or information and/or database upon the State’s written request and/or cancellation and/or termination of this Entire Agreement.

10.5. Compliance with Applicable Laws, Regulations, Policies and Standards

The Contractor agrees to abide by all applicable, current and as amended federal and

State laws, regulations, policies, guidance and standards governing the confidentiality of information to which it may have access under this Entire Agreement, including to but not limited to the Business Associate requirements of HIPAA (www.hhs.gov/ocr/hipaa) and 45 CFR

§ 155.260. In addition, the Contractor agrees to comply with the State confidentiality policy recognizing a person's basic right to privacy and confidentiality of personal information.

The Contractor agrees to adhere to any and all applicable State and federal statutes and regulations relating to confidential health care and substance abuse treatment including but not limited to the Federal Regulation 42 CFR, Part 2; Rhode Island Mental Health Law, R.I. General

Laws Chapter 40.1-5-26; Confidentiality of Health Care Communications and Information Act, http://www.hhs.gov/ocr/hipaa

R.I. General Laws Chapter 5- 37.3-1 et seq; Identity Theft Protection Act of 2015, R.I. General

Laws Chapter 11-49.3 and HIPAA and its implementing regulations. The Contractor acknowledges that failure to comply with the provisions of this Paragraph constitutes a material breach on the part of the Contractor and will result in the termination of the Entire Agreement.

In connection with all PII that Contractor receives or has access to under this Entire

Agreement, the Contractor must comply with Minimum Acceptable Risk Standards for

Exchanges (“MARS-E:), version 2.0 dated November 15, 2015 which includes the following suite of documents: Volume I: Harmonized Security and Privacy Framework; Volume II:

Minimum Acceptable Risk Standards for Exchanges; Volume III: Catalog of Minimum

Acceptable Risk Security and Privacy Controls for Exchanges; and Volume IV: ACA

Administering Entity System Security Plan.

Notwithstanding any other requirement set out in this Entire Agreement, the Contractor acknowledges and agrees that the HITECH Act and its implementing regulations impose requirements with respect to privacy, security and Breach notification and contemplates that such requirements shall be implemented by regulations to be adopted by the U.S. Department of

Health and Human Services. The HITECH requirements, regulations and provisions are hereby incorporated by reference into this Entire Agreement as if set forth in this Entire Agreement in their entirety. Notwithstanding anything to the contrary or any provision that may be more restrictive within this Entire Agreement, all requirements and provisions of HITECH, and its implementing regulations currently in effect and promulgated and/or implemented after the date of this Entire Agreement, are automatically effective and incorporated herein. Where this Entire

Agreement requires stricter guidelines, the stricter guidelines must be adhered to.

10.6. Breach/Incident Reporting

Upon notice of a suspected or confirmed Incident or Breach, the State and Contractor will meet to jointly develop an Incident investigation and remediation plan. Depending on the nature and severity of the confirmed Breach, the plan may include the use of an independent third-party security firm to perform an objective security audit in accordance with recognized cyber security industry commercially reasonable practices. The Parties will consider the scope, severity and impact of the Incident to determine the scope and duration of the third-party audit. If the Parties cannot agree on either the need for or the scope of such audit, then the matter shall be escalated to senior officials of each organization for resolution. The Contractor will pay the costs of all such audits. Depending on the nature and scope of the Incident, remedies may include, among other things, providing information to individuals on obtaining credit reports and notification to applicable credit card companies, notification to the local office of the Secret Service, and or affected users and other applicable Parties, utilization of a call center and the offering of credit monitoring services on a selected basis.

10.7. Other

Failure to abide by the State's confidentiality policy or the required signed Business

Associate Agreement (“BAA”) will result in termination remedies, including but not limited to, termination of this Entire Agreement. A BAA shall be signed by the Contractor, simultaneously or as soon thereafter as possible, from the signing of this Entire Agreement, as required by the

State. The Contractor agrees that no findings, listing, or information derived from information obtained through performance of this Entire Agreement may be released or publicly disclosed in any form for any purpose if such findings, listing, or information contains any combination of data elements that might allow an individual to determine a beneficiary’s identification without first obtaining written authorization from the State’s Contract Manager. Examples of such data elements include, but are not limited to geographic indicators, age, sex, diagnosis, procedure, date of birth, or admission/discharge date(s). The Contractor agrees further that the State shall be the sole judge as to whether any finding, listing, information, or any combination of data extracted or derived from the State’s files identify or would, with reasonable effort, permit one to identify an individual, or to deduce the identifying of an individual to a reasonable degree of certainty. The Contractor agrees that the conditions set forth herein apply to any materials presented or submitted review and/or publication that contain individual identifying elements in the information obtained, as stated above, unless such information is presented in the aggregate.

Under no circumstance, shall the Contractor publicly disclose or present or submit any materials for review and/or publication that contains an individual’s social security number, in part or in whole. The Contractor is hereby notified that all initial data received from DHS is considered confidential by the State.

Contractor will inform the State of any change in its administrative, technical, or operational environment that could impact compliance with the terms of this Entire Agreement, including, but not limited to, compliance with 45 CFR § 155.260.

Contractor shall monitor, periodically assess, and update its security controls and related system risks to ensure the continued effectiveness of those controls in accordance with 45 CFR

§ 155.260(a)(5).

The Contractor shall not be required under the provisions of this Paragraph to keep confidential any Confidential Information or information which is or becomes legitimately publicly available or is rightfully obtained from third parties under no obligation of confidentiality.

Contractor shall establish and maintain, throughout the term of this Entire Agreement, policies and procedures to ensure the safekeeping of Confidential Information and to prevent unauthorized access to or use of such Confidential Information in compliance with ISO 27001 and ISO 27002 (or any replacement standard relating to information security), applicable regulatory requirements, and consistent with industry standards. In addition to its other obligations set forth in this Entire Agreement, whenever Contractor possesses, stores, processes or has access to the State’s Confidential Information, Contractor shall comply with those information security policies and procedures reasonably required by the State and updated from time to time.

Nothing herein shall limit the State’s ability to seek injunctive relief or any and all damages resulting from the Contractor’s negligent or intentional disclosure of Confidential

Information.

PAR. 11. MODIFICATION OF AGREEMENT

All modifications to the Entire Agreement are subject to 220-RICR-30-00-13.4(C)(1)(c).

PAR. 12. INTEREST OF CONTRACTOR

The Contractor covenants that it presently has no pecuniary interest and shall not acquire any such interest, direct or indirect, without first disclosing to the State in writing and then subsequently obtaining approval, in writing, from the State, that would conflict in any manner or degree with the performance of services required under this Entire Agreement. The

Contractor further covenants that no person having any such interest shall be employed by the

Contractor for the performance of any work associated with this Entire Agreement.

PAR. 13. OWNERSHIP

Any and all data, technical information, information systems, materials gathered, originated, developed, prepared, modified, used or obtained by the Contractor in performance of the Entire Agreement, including but not limited to, all hardware, software computer programs, data files, application programs, intellectual property, source code, documentation and manuals, regardless of state of completion shall be deemed to be owned and remain owned by the State

(“State Property”). However, each party will retain all rights in any software, ideas, concepts, know-how, development tools, techniques or any other proprietary material or information that it owned or developed prior to the date of this Entire Agreement or acquired or developed after the date of this Entire Agreement without reference to or use of the intellectual property of the other party. All software that is licensed by a party from a third-party vendor will be and remain the property of such vendor.

PAR. 14. NOTICES

No notice, approval or consent permitted or required to be given by this Entire

Agreement will be effective unless the same is in writing and sent postage prepaid, certified mail or registered mail, return receipt requested, or by reputable overnight delivery service to the other party at the address set forth below, or such other address as either party may direct by notice given to the other as provided, and shall be deemed to be given when received by the addressee.

Contractor: ___________________________

[Name] Authorized Agent Name

[Address] Authorized Agent Title

[Address] Date: _______________________

State: ___________________________

State of Rhode Island, Department of Health Jerome Larkin, MD

3 Capitol Hill Director of Health

Providence, RI 02908 Date: _________________________

EXHIBIT A

SCOPE OF WORK

Prescription Drug Monitoring Program (PDMP)

January 1, 2027 – April 30, 2028

EXHIBIT B

BUDGET

The Contractor estimates that the budget for allowable expenses for work to be performed under this Agreement is as follows:

Expense Category

Original

Agreement

1/1/2027 –

4/30/2028

1. Personnel $.00

2. Fringe Benefits $.00

3. Consultants $.00

4. In-State Travel $.00

5. Out-of-State Travel $.00

6. Printing/Copying $.00

7. Supplies $.00

8. Telephone/Internet $.00

9. Education/Resource

Materials $.00

10. Postage $.00

11. Other (listed separately)

12. Equipment $.00

13. Subcontracts $.00

Sub-Total $.00

Indirect/Administrative Cost

(10%) $.00

Total $.00

EXHIBIT C

BUDGET NARRATIVE

EXHIBIT D

PAYMENTS SCHEDULE

Request for Reimbursement

• Before payments are processed, agency invoices will be reviewed to ensure that all allowable costs are appropriately documented. All invoices will be reviewed to prevent deviation from approved contract budgets.

• Agencies will be paid based on actual expenditures and will be reimbursed on a monthly basis.

• Invoices must be submitted to the RIDOH Project Officer by the 10th of the month following the reporting period.

o One invoice per month o Invoices must be numbered in consecutive order (i.e., 1, 2, 3…) o The applicable purchase order number and current release must be included on the invoice when submitting for approval.

• Agencies will include the following required documentation as an attachment to submitted invoice:

o Name of employee, title, hours worked, rate of pay with time and effort tracking documentation o Consultant copies of bills submitted (must include rate of pay and number of hours) o In-state mileage - rate per mile (as indicated in contract) including number of miles o Out-of state mileage - Copy of receipts for all travel related expenses; e.g., travel itinerary, hotel detail bill, parking, taxi & shuttle receipts. Air Travel: include a copy of the boarding pass & receipt. Train Travel: copy of ticket and receipt. No documentation is necessary for per diem expenses, which include meals and incidentals capped at $30 per day.

o Copy of all receipts (i.e.; supply purchases, telephone document of expense, etc.)

• Request for Reimbursements that are completed incorrectly will be returned to the

Agency Project Coordinator for corrections.

• Prior written approval from the RIDOH Project Officer must be obtained before variations in the budget line item can be made. The Agency Project Director must submit requests in writing to the RIDOH Project Officer. Failure to have written approval for line-item changes will result in non-reimbursement of expenditures.