attachment-2-rfa-2027-ocom-02-multi-p37.pdf

Appendix B P-37 and Standard Exhibits DO NOT COMPLETE FORM NUMBER P-37 (version 2/23/2023)

Contractor Initials

Date

Notice: This agreement and all of its attachments shall become public upon submission to Governor and Executive Council for approval. Any information that is private, confidential or proprietary must be clearly identified to the agency and agreed to in writing prior to signing the contract.

Subject:

AGREEMENT

The State of New Hampshire and the Contractor hereby mutually agree as follows:

GENERAL PROVISIONS

1. IDENTIFICATION.

1.1 State Agency Name

New Hampshire Department of Health and Human Services

1.2 State Agency Address

129 Pleasant Street Concord, NH 03301-3857

1.3 Contractor Name 1.4 Contractor Address

1.5 Contractor Phone

Number

1.6 Account Unit and Class 1.7 Completion Date 1.8 Price Limitation

1.9 Contracting Officer for State Agency

Robert W. Moore, Director

1.10 State Agency Telephone Number

(603) 271-9631

1.11 Contractor Signature

Date:

1.12 Name and Title of Contractor Signatory

1.13 State Agency Signature

Date:

1.14 Name and Title of State Agency Signatory

1.15 Approval by the N.H. Department of Administration, Division of Personnel (if applicable)

By: Director, On:

1.16 Approval by the Attorney General (Form, Substance and Execution) (if applicable)

By: On:

1.17 Approval by the Governor and Executive Council (if applicable)

G&C Item number: G&C Meeting Date:

Appendix B P-37 and Standard Exhibits DO NOT COMPLETE

2. SERVICES TO BE PERFORMED. The State of New Hampshire, acting through the agency identified in block 1.1 (“State”), engages contractor identified in block 1.3 (“Contractor”) to perform, and the Contractor shall perform, the work or sale of goods, or both, identified and more particularly described in the attached EXHIBIT B which is incorporated herein by reference (“Services”).

3. EFFECTIVE DATE/COMPLETION OF SERVICES.

3.1 Notwithstanding any provision of this Agreement to the

contrary, and subject to the approval of the Governor and Executive Council of the State of New Hampshire, if applicable, this Agreement, and all obligations of the parties hereunder, shall become effective on the date the Governor and Executive Council approve this Agreement, unless no such approval is required, in which case the Agreement shall become effective on the date the Agreement is signed by the State Agency as shown in block 1.13 (“Effective Date”).

3.2 If the Contractor commences the Services prior to the Effective Date, all Services performed by the Contractor prior to the Effective Date shall be performed at the sole risk of the Contractor, and in the event that this Agreement does not become effective, the State shall have no liability to the Contractor, including without limitation, any obligation to pay the Contractor for any costs incurred or Services performed.

3.3 Contractor must complete all Services by the Completion Date specified in block 1.7.

4. CONDITIONAL NATURE OF AGREEMENT.

Notwithstanding any provision of this Agreement to the contrary, all obligations of the State hereunder, including, without limitation, the continuance of payments hereunder, are contingent upon the availability and continued appropriation of funds. In no event shall the State be liable for any payments hereunder in excess of such available appropriated funds. In the event of a reduction or termination of appropriated funds by any state or federal legislative or executive action that reduces, eliminates or otherwise modifies the appropriation or availability of funding for this Agreement and the Scope for Services provided in EXHIBIT B, in whole or in part, the State shall have the right to withhold payment until such funds become available, if ever, and shall have the right to reduce or terminate the Services under this Agreement immediately upon giving the Contractor notice of such reduction or termination. The State shall not be required to transfer funds from any other account or source to the Account identified in block 1.6 in the event funds in that Account are reduced or unavailable.

5. CONTRACT PRICE/PRICE LIMITATION/ PAYMENT.

5.1 The contract price, method of payment, and terms of payment are identified and more particularly described in EXHIBIT C which is incorporated herein by reference.

5.2 Notwithstanding any provision in this Agreement to the

contrary, and notwithstanding unexpected circumstances, in no event shall the total of all payments authorized, or actually made hereunder, exceed the Price Limitation set forth in block 1.8. The payment by the State of the contract price shall be the only and the complete reimbursement to the Contractor for all expenses, of whatever nature incurred by the Contractor in the performance hereof, and shall be the only and the complete compensation to the Contractor for the Services.

5.3 The State reserves the right to offset from any amounts

otherwise payable to the Contractor under this Agreement those liquidated amounts required or permitted by N.H. RSA 80:7 through RSA 80:7-c or any other provision of law.

5.4 The State’s liability under this Agreement shall be limited to monetary damages not to exceed the total fees paid. The Contractor agrees that it has an adequate remedy at law for any breach of this Agreement by the State and hereby waives any right to specific performance or other equitable remedies against the State.

6. COMPLIANCE BY CONTRACTOR WITH LAWS AND

REGULATIONS/EQUAL EMPLOYMENT

OPPORTUNITY.

6.1 In connection with the performance of the Services, the

Contractor shall comply with all applicable statutes, laws, regulations, and orders of federal, state, county or municipal authorities which impose any obligation or duty upon the Contractor, including, but not limited to, civil rights and equal employment opportunity laws and the Governor’s order on Respect and Civility in the Workplace, Executive order 2020-01. In addition, if this Agreement is funded in any part by monies of the United States, the Contractor shall comply with all federal executive orders, rules, regulations and statutes, and with any rules, regulations and guidelines as the State or the United States issue to implement these regulations. The Contractor shall also comply with all applicable intellectual property laws.

6.2 During the term of this Agreement, the Contractor shall not discriminate against employees or applicants for employment because of age, sex, sexual orientation, race, color, marital status, physical or mental disability, religious creed, national origin, gender identity, or gender expression, and will take affirmative action to prevent such discrimination, unless exempt by state or federal law. The Contractor shall ensure any subcontractors comply with these nondiscrimination requirements.

6.3 No payments or transfers of value by Contractor or its

representatives in connection with this Agreement have or shall be made which have the purpose or effect of public or commercial bribery, or acceptance of or acquiescence in extortion, kickbacks, or other unlawful or improper means of obtaining business.

6.4. The Contractor agrees to permit the State or United States access to any of the Contractor’s books, records and accounts for the purpose of ascertaining compliance with this Agreement and all rules, regulations and orders pertaining to the covenants, terms and conditions of this Agreement.

7. PERSONNEL.

7.1 The Contractor shall at its own expense provide all personnel necessary to perform the Services. The Contractor warrants that all personnel engaged in the Services shall be qualified to perform the Services, and shall be properly licensed and otherwise authorized to do so under all applicable laws.

7.2 The Contracting Officer specified in block 1.9, or any

successor, shall be the State’s point of contact pertaining to this Agreement.

8. EVENT OF DEFAULT/REMEDIES.

8.1 Any one or more of the following acts or omissions of the Contractor shall constitute an event of default hereunder (“Event of Default”):

8.1.1 failure to perform the Services satisfactorily or on schedule;

8.1.2 failure to submit any report required hereunder; and/or

8.1.3 failure to perform any other covenant, term or condition of this Agreement.

8.2 Upon the occurrence of any Event of Default, the State may take any one, or more, or all, of the following actions:

8.2.1 give the Contractor a written notice specifying the Event of Default and requiring it to be remedied within, in the absence of a greater or lesser specification of time, thirty (30) calendar days from the date of the notice; and if the Event of Default is not timely cured, terminate this Agreement, effective two (2) calendar days after giving the Contractor notice of termination;

8.2.2 give the Contractor a written notice specifying the Event of Default and suspending all payments to be made under this Agreement and ordering that the portion of the contract price which would otherwise accrue to the Contractor during the period from the date of such notice until such time as the State determines that the Contractor has cured the Event of Default shall never be paid to the Contractor;

8.2.3 give the Contractor a written notice specifying the Event of Default and set off against any other obligations the State may owe to the Contractor any damages the State suffers by reason of any Event of Default; and/or

8.2.4 give the Contractor a written notice specifying the Event of Default, treat the Agreement as breached, terminate the Agreement and pursue any of its remedies at law or in equity, or both.

9. TERMINATION.

9.1 Notwithstanding paragraph 8, the State may, at its sole

discretion, terminate the Agreement for any reason, in whole or in part, by thirty (30) calendar days written notice to the Contractor that the State is exercising its option to terminate the Agreement.

9.2 In the event of an early termination of this Agreement for any reason other than the completion of the Services, the Contractor shall, at the State’s discretion, deliver to the Contracting Officer, not later than fifteen (15) calendar days after the date of termination, a report (“Termination Report”) describing in detail all Services performed, and the contract price earned, to and including the date of termination. In addition, at the State’s discretion, the Contractor shall, within fifteen (15) calendar days of notice of early termination, develop and submit to the State a transition plan for Services under the Agreement.

10. PROPERTY OWNERSHIP/DISCLOSURE.

10.1 As used in this Agreement, the word “Property” shall mean all data, information and things developed or obtained during the performance of, or acquired or developed by reason of, this Agreement, including, but not limited to, all studies, reports, files, formulae, surveys, maps, charts, sound recordings, video recordings, pictorial reproductions, drawings, analyses, graphic representations, computer programs, computer printouts, notes, letters, memoranda, papers, and documents, all whether finished or unfinished.

10.2 All data and any Property which has been received from the State, or purchased with funds provided for that purpose under this Agreement, shall be the property of the State, and shall be returned to the State upon demand or upon termination of this Agreement for any reason.

10.3 Disclosure of data, information and other records shall be governed by N.H. RSA chapter 91-A and/or other applicable law.

Disclosure requires prior written approval of the State.

11. CONTRACTOR’S RELATION TO THE STATE. In the performance of this Agreement the Contractor is in all respects an independent contractor, and is neither an agent nor an employee of the State. Neither the Contractor nor any of its officers, employees, agents or members shall have authority to bind the State or receive any benefits, workers’ compensation or other emoluments provided by the State to its employees.

12. ASSIGNMENT/DELEGATION/SUBCONTRACTS.

12.1 Contractor shall provide the State written notice at least fifteen

(15) calendar days before any proposed assignment, delegation, or other transfer of any interest in this Agreement. No such assignment, delegation, or other transfer shall be effective without the written consent of the State.

12.2 For purposes of paragraph 12, a Change of Control shall

constitute assignment. “Change of Control” means (a) merger, consolidation, or a transaction or series of related transactions in which a third party, together with its affiliates, becomes the direct or indirect owner of fifty percent (50%) or more of the voting shares or similar equity interests, or combined voting power of the Contractor, or (b) the sale of all or substantially all of the assets of the Contractor.

12.3 None of the Services shall be subcontracted by the Contractor without prior written notice and consent of the State.

12.4 The State is entitled to copies of all subcontracts and

assignment agreements and shall not be bound by any provisions contained in a subcontract or an assignment agreement to which it is not a party.

13. INDEMNIFICATION. The Contractor shall indemnify, defend, and hold harmless the State, its officers, and employees from and against all actions, claims, damages, demands, judgments, fines, liabilities, losses, and other expenses, including, without limitation, reasonable attorneys’ fees, arising out of or relating to this Agreement directly or indirectly arising from death, personal injury, property damage, intellectual property infringement, or other claims asserted against the State, its officers, or employees caused by the acts or omissions of negligence, reckless or willful misconduct, or fraud by the Contractor, its employees, agents, or subcontractors. The State shall not be liable for any costs incurred by the Contractor arising under this paragraph 13. Notwithstanding the foregoing, nothing herein contained shall be deemed to constitute a waiver of the State’s sovereign immunity, which immunity is hereby reserved to the State. This covenant in paragraph 13 shall survive the termination of this Agreement.

14. INSURANCE.

14.1 The Contractor shall, at its sole expense, obtain and

continuously maintain in force, and shall require any subcontractor or assignee to obtain and maintain in force, the following insurance:

14.1.1 commercial general liability insurance against all claims of bodily injury, death or property damage, in amounts of not less than $1,000,000 per occurrence and $2,000,000 aggregate or excess;

and

14.1.2 special cause of loss coverage form covering all Property subject to subparagraph 10.2 herein, in an amount not less than 80% of the whole replacement value of the Property.

14.2 The policies described in subparagraph 14.1 herein shall be on policy forms and endorsements approved for use in the State of New Hampshire by the N.H. Department of Insurance, and issued by insurers licensed in the State of New Hampshire.

14.3 The Contractor shall furnish to the Contracting Officer

identified in block 1.9, or any successor, a certificate(s) of insurance for all insurance required under this Agreement. At the request of the Contracting Officer, or any successor, the Contractor shall provide certificate(s) of insurance for all renewal(s) of insurance required under this Agreement. The certificate(s) of insurance and any renewals thereof shall be attached and are incorporated herein by reference.

15. WORKERS’ COMPENSATION.

15.1 By signing this agreement, the Contractor agrees, certifies and warrants that the Contractor is in compliance with or exempt from, the requirements of N.H. RSA chapter 281-A (“Workers’ Compensation”).

15.2 To the extent the Contractor is subject to the requirements of N.H. RSA chapter 281-A, Contractor shall maintain, and require any subcontractor or assignee to secure and maintain, payment of Workers’ Compensation in connection with activities which the person proposes to undertake pursuant to this Agreement. The Contractor shall furnish the Contracting Officer identified in block 1.9, or any successor, proof of Workers’ Compensation in the manner described in N.H. RSA chapter 281-A and any applicable renewal(s) thereof, which shall be attached and are incorporated herein by reference. The State shall not be responsible for payment of any Workers’ Compensation premiums or for any other claim or benefit for Contractor, or any subcontractor or employee of Contractor, which might arise under applicable State of New Hampshire Workers’ Compensation laws in connection with the performance of the Services under this Agreement.

16. WAIVER OF BREACH. A State's failure to enforce its rights with respect to any single or continuing breach of this Agreement shall not act as a waiver of the right of the State to later enforce any such rights or to enforce any other or any subsequent breach.

17. NOTICE. Any notice by a party hereto to the other party shall be deemed to have been duly delivered or given at the time of mailing by certified mail, postage prepaid, in a United States Post Office addressed to the parties at the addresses given in blocks 1.2 and 1.4, herein.

18. AMENDMENT. This Agreement may be amended, waived or discharged only by an instrument in writing signed by the parties hereto and only after approval of such amendment, waiver or discharge by the Governor and Executive Council of the State of New Hampshire unless no such approval is required under the circumstances pursuant to State law, rule or policy.

19. CHOICE OF LAW AND FORUM.

19.1 This Agreement shall be governed, interpreted and construed in accordance with the laws of the State of New Hampshire except where the Federal supremacy clause requires otherwise. The wording used in this Agreement is the wording chosen by the parties to express their mutual intent, and no rule of construction shall be applied against or in favor of any party.

19.2 Any actions arising out of this Agreement, including the breach or alleged breach thereof, may not be submitted to binding arbitration, but must, instead, be brought and maintained in the Merrimack County Superior Court of New Hampshire which shall have exclusive jurisdiction thereof.

20. CONFLICTING TERMS. In the event of a conflict between the terms of this P-37 form (as modified in EXHIBIT A) and any other portion of this Agreement including any attachments thereto, the terms of the P-37 (as modified in EXHIBIT A) shall control.

21. THIRD PARTIES. This Agreement is being entered into for the sole benefit of the parties hereto, and nothing herein, express or implied, is intended to or will confer any legal or equitable right, benefit, or remedy of any nature upon any other person.

22. HEADINGS. The headings throughout the Agreement are for reference purposes only, and the words contained therein shall in no way be held to explain, modify, amplify or aid in the interpretation, construction or meaning of the provisions of this Agreement.

23. SPECIAL PROVISIONS. Additional or modifying provisions set forth in the attached EXHIBIT A are incorporated herein by reference.

24. FURTHER ASSURANCES. The Contractor, along with its agents and affiliates, shall, at its own cost and expense, execute any additional documents and take such further actions as may be reasonably required to carry out the provisions of this Agreement and give effect to the transactions contemplated hereby.

25. SEVERABILITY. In the event any of the provisions of this Agreement are held by a court of competent jurisdiction to be contrary to any state or federal law, the remaining provisions of this Agreement will remain in full force and effect.

26. ENTIRE AGREEMENT. This Agreement, which may be executed in a number of counterparts, each of which shall be deemed an original, constitutes the entire agreement and understanding between the parties, and supersedes all prior agreements and understandings with respect to the subject matter hereof.

Multidisciplinary Team

EXHIBIT A

Exhibit A - Revisions to Standard Contract Provisions Contractor Initials __________

Page 1 of 2 Date __________ Do Not Return

Revisions to Standard Agreement Provisions

1. Revisions to Form P-37, General Provisions

1.1. Paragraph 3, Subparagraph 3.1., Effective Date/Completion of Services, is amended as follows:

3.1. Notwithstanding any provision of this Agreement to the contrary, and subject to the approval of the Governor and Executive Council of the State of New Hampshire, this Agreement, and all obligations of the parties hereunder, shall become effective on July 1, 2026 (“Effective Date”).

1.2. Paragraph 3, Effective Date/Completion of Services, is amended by deleting subparagraph 3.3., in its entirety and replacing it as follows:

3.3. Contractor must complete all Services by the Completion Date specified in block

1.7. The parties may extend the Agreement for up to four (4) additional years from the Completion Date, contingent upon satisfactory delivery of services, available funding, agreement of the parties, and approval of the Governor and Executive Council.

1.3. Paragraph 6, Compliance by Contractor with Laws and Regulations/Equal Employment Opportunity, Subparagraph 6.1., is amended as follows:

6.1. In connection with the performance of the Services, the Contractor shall comply with all applicable statutes, laws, regulations, and orders of federal, state, county or municipal authorities which impose any obligation or duty upon the Contractor, including, but not limited to, RSA 151:21 Patients’ Bill of Rights, civil rights and equal employment opportunity laws, and the Governor’s order on Respect and Civility in the Workplace, Executive Order 2020-01. In addition, if this Agreement is funded in any part by monies of the United States, the Contractor shall comply with all federal executive orders, rules, regulations and statutes, and with any rules, regulations and guidelines as the State or the United States issue to implement these regulations. The Contractor shall also comply with all applicable intellectual property laws.

1.4. Paragraph 12, Assignment/Delegation/Subcontracts, is amended by adding subparagraph 12.5., as follows:

12.5. Subcontractors are subject to the same contractual conditions as the Contractor and the Contractor is responsible to ensure subcontractor compliance with those conditions. The Contractor shall have written agreements with all subcontractors, specifying the work to be performed, and if applicable, a Business Associate Agreement in accordance with the Health Insurance Portability and Accountability Act. Written agreements shall specify how corrective action shall be managed. The Contractor shall manage the subcontractor’s performance on an ongoing basis and take corrective action as necessary. The Contractor shall annually provide the State with a list of all subcontractors provided for under this Agreement and notify the State of any inadequate subcontractor performance.

1.5. Paragraph 14, Insurance, is amended by deleting subparagraph 14.1.1., in its entirety and replacing it as follows:

Appendix B - P37 and Standard ExhibitsDo Not Return

Multidisciplinary Team

EXHIBIT A

Exhibit A - Revisions to Standard Provisions Contractor Initials __________

Page 2 of 2 Date __________ Do Not Return

1.14.1.1. Professional liability insurance against wrongful act, occurrence, or personal injury offense, in amounts of not less than $1,000,000 each claim and $3,000,000 general aggregate; and

Appendix B - P37 and Standard ExhibitsDo Not Return

Appendix B - P37 and Standard Exhibits Do Not Return

EXHIBIT B

Scope of Services

See Appendix A – Scope of Services. The final Scope of Services is subject to modification based on the proposal submitted by the selected Vendor, as negotiated with the Department through the procurement process.

Vendor Name Page 1 of 1 Date

Appendix B - P37 and Standard Exhibits

EXHIBIT C

Payment Terms

To be drafted in accordance with the selected Vendor’s proposal, as negotiated with the Department through the procurement process.

Exhibit C Contractor Initials

Page 1 of 1 Date

Appendix B P-37 and Standard Exhibits

Exhibit D

DHHS Information Security Requirements

DO NOT COMPLETE

Contractor Initials

V5. Last update 10/09/18 Date Page 1 of 9

A. Definitions

The following terms may be reflected and have the described meaning in this document:

1. “Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic. With regard to Protected Health Information, “ Breach” shall have the same meaning as the term “Breach” in section 164.402 of Title 45, Code of Federal Regulations.

2. “Computer Security Incident” shall have the same meaning “Computer Security Incident” in section two (2) of NIST Publication 800-61, Computer Security Incident Handling Guide, National Institute of Standards and Technology, U.S. Department of Commerce.

3. “Confidential Information” or “Confidential Data” means all confidential information disclosed by one party to the other such as all medical, health, financial, public assistance benefits and personal information including without limitation, Substance Abuse Treatment Records, Case Records, Protected Health Information and Personally Identifiable Information.

Confidential Information also includes any and all information owned or managed by the State of NH - created, received from or on behalf of the Department of Health and Human Services (DHHS) or accessed in the course of performing contracted services

- of which collection, disclosure, protection, and disposition is governed by state or federal law or regulation. This information includes, but is not limited to Protected Health Information (PHI), Personal Information (PI), Personal Financial Information (PFI), Federal Tax Information (FTI), Social Security Numbers (SSN), Payment Card Industry (PCI), and or other sensitive and confidential information.

4. “End User” means any person or entity (e.g., contractor, contractor’s employee, business associate, subcontractor, other downstream user, etc.) that receives DHHS data or derivative data in accordance with the terms of this Contract.

5. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder.

6. “Incident” means an act that potentially violates an explicit or implied security policy, which includes attempts (either failed or successful) to gain unauthorized access to a system or its data, unwanted disruption or denial of service, the unauthorized use of a system for the processing or storage of data; and changes to system hardware, firmware, or software characteristics without the owner's knowledge, instruction, or consent. Incidents include the loss of data through theft or device misplacement, loss

Exhibit D

DHHS Information Security Requirements

Contractor Initials

V5. Last update 10/09/18 Date Page 2 of 9 or misplacement of hardcopy documents, and misrouting of physical or electronic mail, all of which may have the potential to put the data at risk of unauthorized access, use, disclosure, modification or destruction.

7. “Open Wireless Network” means any network or segment of a network that is not designated by the State of New Hampshire’s Department of Information Technology or delegate as a protected network (designed, tested, and approved, by means of the State, to transmit) will be considered an open network and not adequately secure for the transmission of unencrypted PI, PFI, PHI or confidential DHHS data.

8. “Personal Information” (or “PI”) means information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, personal information as defined in New Hampshire RSA 359-C:19, biometric records, etc., alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

9. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164, promulgated under HIPAA by the United States Department of Health and Human Services.

10. “Protected Health Information” (or “PHI”) has the same meaning as provided in the definition of “Protected Health Information” in the HIPAA Privacy Rule at 45 C.F.R. § 160.103.

11. “Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Part 164, Subpart C, and amendments thereto.

12. “Unsecured Protected Health Information” means Protected Health Information that is not secured by a technology standard that renders Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute.

I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR

A. Business Use and Disclosure of Confidential Information.

1. The Contractor must not use, disclose, maintain or transmit Confidential Information except as reasonably necessary as outlined under this Contract. Further, Contractor, including but not limited to all its directors, officers, employees and agents, must not use, disclose, maintain or transmit PHI in any manner that would constitute a violation of the Privacy and Security Rule.

Exhibit D

DHHS Information Security Requirements

DO NOT COMPLETE

Contractor Initials

V5. Last update 10/09/18 Date Page 3 of 9

2. The Contractor must not disclose any Confidential Information in response to a request for disclosure on the basis that it is required by law, in response to a subpoena, etc., without first notifying DHHS so that DHHS has an opportunity to consent or object to the disclosure.

3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additional restrictions over and above those uses or disclosures or security safeguards of PHI pursuant to the Privacy and Security Rule, the Contractor must be bound by such additional restrictions and must not disclose PHI in violation of such additional restrictions and must abide by any additional security safeguards.

4. The Contractor agrees that DHHS Data or derivative there from disclosed to an End User must only be used pursuant to the terms of this Contract.

5. The Contractor agrees DHHS Data obtained under this Contract may not be used for any other purposes that are not indicated in this Contract.

6. The Contractor agrees to grant access to the data to the authorized representatives of DHHS for the purpose of inspecting to confirm compliance with the terms of this Contract.

II. METHODS OF SECURE TRANSMISSION OF DATA

1. Application Encryption. If End User is transmitting DHHS data containing Confidential Data between applications, the Contractor attests the applications have been evaluated by an expert knowledgeable in cyber security and that said application’s encryption capabilities ensure secure transmission via the internet.

2. Computer Disks and Portable Storage Devices. End User may not use computer disks or portable storage devices, such as a thumb drive, as a method of transmitting DHHS data.

3. Encrypted Email. End User may only employ email to transmit Confidential Data if email is encrypted and being sent to and being received by email addresses of persons authorized to receive such information.

4. Encrypted Web Site. If End User is employing the Web to transmit Confidential Data, the secure socket layers (SSL) must be used and the web site must be secure. SSL encrypts data transmitted via a Web site.

5. File Hosting Services, also known as File Sharing Sites. End User may not use file hosting services, such as Dropbox or Google Cloud Storage, to transmit Confidential Data.

6. Ground Mail Service. End User may only transmit Confidential Data via certified ground mail within the continental U.S. and when sent to a named individual.

7. Laptops and PDA. If End User is employing portable devices to transmit Confidential Data said devices must be encrypted and password-protected.

Exhibit D

DHHS Information Security Requirements

DO NOT COMPLETE

Contractor Initials

V5. Last update 10/09/18 Date Page 4 of 9

8. Open Wireless Networks. End User may not transmit Confidential Data via an open wireless network. End User must employ a virtual private network (VPN) when remotely transmitting via an open wireless network.

9. Remote User Communication. If End User is employing remote communication to access or transmit Confidential Data, a virtual private network (VPN) must be installed on the End User’s mobile device(s) or laptop from which information will be transmitted or accessed.

10. SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. If End User is employing an SFTP to transmit Confidential Data, End User will structure the Folder and access privileges to prevent inappropriate disclosure of information. SFTP folders and sub-folders used for transmitting Confidential Data will be coded for 24-hour auto-deletion cycle (i.e. Confidential Data will be deleted every 24 hours).

11. Wireless Devices. If End User is transmitting Confidential Data via wireless devices, all data must be encrypted to prevent inappropriate disclosure of information.

III. RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS

The Contractor will only retain the data and any derivative of the data for the duration of this Contract. After such time, the Contractor will have 30 days to destroy the data and any derivative in whatever form it may exist, unless, otherwise required by law or permitted under this Contract. To this end, the parties must:

A. Retention

1. The Contractor agrees it will not store, transfer or process data collected in connection with the services rendered under this Contract outside of the United States. This physical location requirement shall also apply in the implementation of cloud computing, cloud service or cloud storage capabilities, and includes backup data and Disaster Recovery locations.

2. The Contractor agrees to ensure proper security monitoring capabilities are in place to detect potential security events that can impact State of NH systems and/or Department confidential information for contractor provided systems.

3. The Contractor agrees to provide security awareness and education for its End Users in support of protecting Department confidential information.

4. The Contractor agrees to retain all electronic and hard copies of Confidential Data in a secure location and identified in section IV. A.2

5. The Contractor agrees Confidential Data stored in a Cloud must be in a FedRAMP/HITECH compliant solution and comply with all applicable statutes and regulations regarding the privacy and security. All servers and devices must have currently-supported and hardened operating systems, the latest anti-viral, antihacker, anti-spam, anti-spyware, and anti-malware utilities. The environment, as a whole, must have aggressive intrusion-detection and firewall protection.

Exhibit D

DHHS Information Security Requirements

Contractor Initials

V5. Last update 10/09/18 Date Page 5 of 9

6. The Contractor agrees to and ensures its complete cooperation with the State’s Chief Information Officer in the detection of any security vulnerability of the hosting infrastructure.

B. Disposition

1. If the Contractor will maintain any Confidential Information on its systems (or its sub-contractor systems), the Contractor will maintain a documented process for securely disposing of such data upon request or contract termination; and will obtain written certification for any State of New Hampshire data destroyed by the Contractor or any subcontractors as a part of ongoing, emergency, and or disaster recovery operations. When no longer in use, electronic media containing State of New Hampshire data shall be rendered unrecoverable via a secure wipe program in accordance with industry-accepted standards for secure deletion and media sanitization, or otherwise physically destroying the media (for example, degaussing) as described in NIST Special Publication 800-88, Rev 1, Guidelines for Media Sanitization, National Institute of Standards and Technology, U. S. Department of Commerce. The Contractor will document and certify in writing at time of the data destruction, and will provide written certification to the Department upon request.

The written certification will include all details necessary to demonstrate data has been properly destroyed and validated. Where applicable, regulatory and professional standards for retention requirements will be jointly evaluated by the State and Contractor prior to destruction.

2. Unless otherwise specified, within thirty (30) days of the termination of this Contract, Contractor agrees to destroy all hard copies of Confidential Data using a secure method such as shredding.

3. Unless otherwise specified, within thirty (30) days of the termination of this Contract, Contractor agrees to completely destroy all electronic Confidential Data by means of data erasure, also known as secure data wiping.

IV. PROCEDURES FOR SECURITY

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and any derivative data or files, as follows:

1. The Contractor will maintain proper security controls to protect Department confidential information collected, processed, managed, and/or stored in the delivery of contracted services.

2. The Contractor will maintain policies and procedures to protect Department confidential information throughout the information lifecycle, where applicable, (from creation, transformation, use, storage and secure destruction) regardless of the media used to store the data (i.e., tape, disk, paper, etc.).

Exhibit D

DHHS Information Security Requirements

Contractor Initials

V5. Last update 10/09/18 Date Page 6 of 9

3. The Contractor will maintain appropriate authentication and access controls to contractor systems that collect, transmit, or store Department confidential information where applicable.

4. The Contractor will ensure proper security monitoring capabilities are in place to detect potential security events that can impact State of NH systems and/or Department confidential information for contractor provided systems.

5. The Contractor will provide regular security awareness and education for its End Users in support of protecting Department confidential information.

6. If the Contractor will be sub-contracting any core functions of the engagement supporting the services for State of New Hampshire, the Contractor will maintain a program of an internal process or processes that defines specific security expectations, and monitoring compliance to security requirements that at a minimum match those for the Contractor, including breach notification requirements.

7. The Contractor will work with the Department to sign and comply with all applicable State of New Hampshire and Department system access and authorization policies and procedures, systems access forms, and computer use agreements as part of obtaining and maintaining access to any Department system(s). Agreements will be completed and signed by the Contractor and any applicable sub-contractors prior to system access being authorized.

8. If the Department determines the Contractor is a Business Associate pursuant to 45 CFR 160.103, the Contractor will execute a HIPAA Business Associate Agreement (BAA) with the Department and is responsible for maintaining compliance with the agreement.

9. The Contractor will work with the Department at its request to complete a System Management Survey. The purpose of the survey is to enable the Department and Contractor to monitor for any changes in risks, threats, and vulnerabilities that may occur over the life of the Contractor engagement. The survey will be completed annually, or an alternate time frame at the Departments discretion with agreement by the Contractor, or the Department may request the survey be completed when the scope of the engagement between the Department and the Contractor changes.

10. The Contractor will not store, knowingly or unknowingly, any State of New Hampshire or Department data offshore or outside the boundaries of the United States unless prior express written consent is obtained from the Information Security Office leadership member within the Department.

11. Data Security Breach Liability. In the event of any security breach Contractor shall make efforts to investigate the causes of the breach, promptly take measures to prevent

Exhibit D

DHHS Information Security Requirements

Contractor Initials

V5. Last update 10/09/18 Date Page 7 of 9 future breach and minimize any damage or loss resulting from the breach. The State shall recover from the Contractor all costs of response and recovery from the breach, including but not limited to: credit monitoring services, mailing costs and costs associated with website and telephone call center services necessary due to the breach.

12. Contractor must, comply with all applicable statutes and regulations regarding the privacy and security of Confidential Information, and must in all other respects maintain the privacy and security of PI and PHI at a level and scope that is not less than the level and scope of requirements applicable to federal agencies, including, but not limited to, provisions of the Privacy Act of 1974 (5 U.S.C. § 552a), DHHS Privacy Act Regulations (45 C.F.R. §5b), HIPAA Privacy and Security Rules (45 C.F.R. Parts 160 and 164) that govern protections for individually identifiable health information and as applicable under State law.

13. Contractor agrees to establish and maintain appropriate administrative, technical, and physical safeguards to protect the confidentiality of the Confidential Data and to prevent unauthorized use or access to it. The safeguards must provide a level and scope of security that is not less than the level and scope of security requirements established by the State of New Hampshire, Department of Information Technology. Refer to Vendor Resources/Procurement at https://www.nh.gov/doit/vendor/index.htm for the Department of Information Technology policies, guidelines, standards, and procurement information relating to vendors.

14. Contractor agrees to maintain a documented breach notification and incident response process. The Contractor will notify the State’s Privacy Officer and the State’s Security Officer of any security breach immediately, at the email addresses provided in Section VI. This includes a confidential information breach, computer security incident, or suspected breach which affects or includes any State of New Hampshire systems that connect to the State of New Hampshire network.

15. Contractor must restrict access to the Confidential Data obtained under this Contract to only those authorized End Users who need such DHHS Data to perform their official duties in connection with purposes identified in this Contract.

16. The Contractor must ensure that all End Users:

a. comply with such safeguards as referenced in Section IV A. above, implemented to protect Confidential Information that is furnished by DHHS under this Contract from loss, theft or inadvertent disclosure.

b. safeguard this information at all times.

c. ensure that laptops and other electronic devices/media containing PHI, PI, or

PFI are encrypted and password-protected.

http://www.nh.gov/doit/vendor/index.htm

Exhibit D

DHHS Information Security Requirements

Contractor Initials

V5. Last update 10/09/18 Date Page 8 of 9

d. send emails containing Confidential Information only if encrypted and being sent to and being received by email addresses of persons authorized to receive such information.

e. limit disclosure of the Confidential Information to the extent permitted by law.

f. Confidential Information received under this Contract and individually identifiable data derived from DHHS Data, must be stored in an area that is physically and technologically secure from access by unauthorized persons during duty hours as well as non-duty hours (e.g., door locks, card keys, biometric identifiers, etc.).

g. only authorized End Users may transmit the Confidential Data, including any derivative files containing personally identifiable information, and in all cases, such data must be encrypted at all times when in transit, at rest, or when stored on portable media as required in section IV above.

h. in all other instances Confidential Data must be maintained, used and disclosed using appropriate safeguards, as determined by a risk-based assessment of the circumstances involved.

i. understand that their user credentials (user name and password) must not be shared with anyone. End Users will keep their credential information secure.

This applies to credentials used to access the site directly or indirectly through a third party application.

Contractor is responsible for oversight and compliance of their End Users. DHHS reserves the right to conduct onsite inspections to monitor compliance with this Contract, including the privacy and security requirements provided in herein, HIPAA, and other applicable laws and Federal regulations until such time the Confidential Data is disposed of in accordance with this Contract.

V. LOSS REPORTING

The Contractor must notify the State’s Privacy Officer and Security Officer of any Security Incidents and Breaches immediately, at the email addresses provided in Section VI.

The Contractor must further handle and report Incidents and Breaches involving PHI in accordance with the agency’s documented Incident Handling and Breach Notification procedures and in accordance with 42 C.F.R. §§ 431.300 - 306. In addition to, and notwithstanding, Contractor’s compliance with all applicable obligations and procedures, Contractor’s procedures must also address how the Contractor will:

1. Identify Incidents;

2. Determine if personally identifiable information is involved in Incidents;

3. Report suspected or confirmed Incidents as required in this Exhibit or P-37;

V5. Last update 10/09/18 Date Page 9 of 9

New Hampshire Department of Health and Human Services Exhibit D

DHHS Information Security Requirements

4. Identify and convene a core response group to determine the risk level of Incidents and determine risk-based responses to Incidents; and

5. Determine whether Breach notification is required, and, if so, identify appropriate Breach notification methods, timing, source, and contents from among different options, and bear costs associated with the Breach notice as well as any mitigation measures.

Incidents and/or Breaches that implicate PI must be addressed and reported, as applicable, in accordance with NH RSA 359-C:20.

VI. PERSONS TO CONTACT

A. DHHS Privacy Officer:

DHHSPrivacyOfficer@dhhs.nh.gov B.

DHHS Security Officer:

DHHSInformationSecurityOffice@dhhs.nh.gov mailto:DHHSPrivacyOfficer@dhhs.nh.gov mailto:DHHSInformationSecurityOffice@dhhs.nh.gov

Exhibit E

Contractor Initials Exhibit E

Health Insurance Portability Act Business Associate Agreement

Date

BUSINESS ASSOCIATE AGREEMENT

The Contractor identified in Section 1.3 of the General Provisions of the Agreement (Form P-37) (“Agreement”), and any of its agents who receive use or have access to protected health information (PHI), as defined herein, shall be referred to as the “Business Associate.” The State of New Hampshire, Department of Health and Human Services, ”Department” shall be referred to as the “Covered Entity,” The Contractor and the Department are collectively referred to as “the parties.”

The parties agree, to comply with the Health Insurance Portability and Accountability Act, Public Law 104-191, the Standards for Privacy and Security of Individually Identifiable Health Information, 45 CFR Parts 160, 162, and 164 (HIPAA), provisions of the HITECH Act, Title XIII, Subtitle D, Parts 1&2 of the American Recovery and Reinvestment Act of 2009, 42 USC 17934, et sec., applicable to business associates, and as applicable, to be bound by the provisions of the Confidentiality of Substance Use Disorder Patient Records, 42 USC s. 290 dd-2, 42 CFR Part 2, (Part 2), as any of these laws and regulations may be amended from time to time.

(1) Definitions.

a. The following terms shall have the same meaning as defined in HIPAA, the HITECH Act, and Part 2, as they may be amended from time to time:

“Breach,” “Designated Record Set,” “Data Aggregation,” Designated Record Set,” “Health Care Operations,” “HITECH Act,” “Individual,” “Privacy Rule,” “Required by law,” “Security Rule,” and “Secretary.”

b. Business Associate Agreement, (BAA) means the Business Associate Agreement that includes privacy and confidentiality requirements of the Business Associate working with PHI and as applicable, Part 2 record(s) on behalf of the Covered Entity under the Agreement.

c. “Constructively Identifiable,” means there is a reasonable basis to believe that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information.

d. “Protected Health Information” (“PHI”) as used in the Agreement and the BAA, means protected health information defined in HIPAA 45 CFR 160.103, limited to the information created, received, or used by Business Associate from or on behalf of Covered Entity, and includes any Part 2 records, if applicable, as defined below.

e. “Part 2 record” means any patient “Record,” relating to a “Patient,” and “Patient Identifying Information,” as defined in 42 CFR Part 2.11.

f. “Unsecured Protected Health Information” means protected health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute.

(2) Business Associate Use and Disclosure of Protected Health…