Attachment A - Model Contract~5.docx

ATTACHMENT A

MODEL CONTRACT BETWEEN

THE EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

AND

[CONTRACTOR]

FOR THE OPERATION OF

CLINICAL AND SAFETY RISK ASSESSMENT SITE,

STAFFING, AND RELATED SERVICES

This Contract is by and between the Massachusetts Executive Office of Health and Human Services (“EOHHS”) and [CONTRACTOR] (“Contractor”).

WHEREAS, EOHHS oversees 11 state agencies and is the single state agency responsible for the administration of the Medicaid program and the State Children’s Health Insurance Program within Massachusetts (collectively, MassHealth) and other health and human services programs designed to pay for medical services for eligible individuals pursuant to M.G.L. c. 118E, Title XIX of the Social Security Act (42 U.S.C. sec. 1396 et seq.), Title XXI of the Social Security Act (42 U.S.C. sec. 1397aa et seq.), and other applicable laws and waivers;

WHEREAS, there has been a sizable increase in the number of families and pregnant individuals seeking shelter as a result of increasing numbers of migrants coming to Massachusetts and challenging housing market conditions, among other factors;

WHEREAS, on Oct. 31, 2023, under 760 CMR 67.10, the Secretary of the Executive Office of Housing and Livable Communities (EOHLC) declared that the Emergency Assistance (EA) emergency family shelter system is no longer able to meet all current and projected demand for shelter from families and pregnant individuals eligible for EA and EOHLC has issued guidance to create a prioritization system and waitlist for eligible families and pregnant individuals;

WHEREAS, there is a need for eligible families and pregnant individuals to receive full Clinical Safety Risk Assessments to effectively prioritize and assist families and pregnant individuals eligible for EA;

WHEREAS, EOHHS issued a Request for Responses (RFR) on [DATE] for the operation of Clinical and Safety Risk Assessment Sites, Staffing, and Related Services;

WHEREAS, on [DATE], EOHHS selected the Contractor, based on the Contractor’s response to the RFR; and WHEREAS, the Contractor appears qualified and is willing to perform its duties as set forth herein subject to the terms and conditions hereof;

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, EOHHS and the Contractor agree to enter into the Contract and further agree that the terms stated herein are subject to all required state and federal approvals:

Definitions Clinical and Safety Risk Assessment (CSRA) – an assessment developed by DPH and approved by EOHHS to determine the Prioritization Score for EA eligible families with children under the age of 21 and/or pregnant individuals who have been prescreened by EOHLC personnel as requiring a full CSRA. The CSRA shall be conducted by a clinician, either virtually or at CSRA Site.

Clinical and Safety Risk Assessment (CSRA) Site (or CSRA Location) – a site, managed and funded by EOHHS, for families with children under the age of 21 years and pregnant individuals experiencing homelessness and referred to the site by a Family Welcome Center pursuant to EOHHS policy and guidance or by EOHLC pursuant to EA shelter program rules and regulations when a family or pregnant individual is entitled to immediate shelter under the EA program but no EA placement is available. Unless otherwise specified or agreed, references to CSRA Sites include both Limited and Full Service CSRA Locations.

Contract – the Contract between EOHHS and the Contractor for the staffing of Clinical and Safety Risk Assessment Sites and related services.

Contractor – the entity that enters into an agreement with EOHHS for the provision of services described in this Contract. All requirements described, herein, also shall be applicable to the Contractor’s employees and subcontractors.

Cultural Competence – a set of congruent behaviors, attitudes, and policies that come together in a system, agency, or among professionals that enables effective work in cross-cultural situations. “Culture” refers to integrated patterns of human behavior that include the language, thoughts, communications, actions, customs, beliefs, values, and institutions of racial, ethnic, religious, or social groups including, but not limited to, ASL-using deaf, hard-of-hearing, and deaf-blind persons. “Competence” implies having the capacity to function effectively as an individual and an organization within the context of the cultural beliefs, behaviors, and needs presented by consumers and their communities, as defined in the National Standards for Culturally and Linguistically Appropriate Services in Health Care.

Executive Office of Health and Human Services (EOHHS) – the Executive Office of Health and Human Services is responsible for coordinating the service delivery and policy development in the Commonwealth’s 11 health and human service agencies.

Executive Office of Housing and Livable Communities (EOHLC) – the Executive Office of Housing and Livable Communities, through its community and business partners, provides affordable housing options, shelter assistance, financial assistance, and other support to Massachusetts communities, individuals, and families. EOHLC oversees different types of assistance and funding for consumers, businesses, municipalities, and non-profit partners.

Family Guest – the member of a family with children under 21 years of age and pregnant individuals experiencing homelessness and referred to the CSRA Site by a Family Welcome Center pursuant to EOHHS policy and guidance or by EOHLC pursuant to EA shelter program rules and regulations when a family or pregnant individual is entitled to immediate shelter under the EA program but no EA placement is available.

Family Space – the space assigned to a Family Guest by the Contractor while in the CSRA Site.

Family Welcome Center (FWC) – a service facility developed, funded, and designated by EOHHS as a Family Welcome Center.

Full Service CSRA Site – a location that provides all services described in Section 2 that are not already otherwise immediately available at the CSRA Location.

Limited CSRA Site – a location that provides a subset of the services described in Section 2, as determined by agreement between EOHHS and the Contractor, that are not already otherwise immediately available at the CSRA Location.

Overflow Emergency Overnight Shelter – temporary shelter sites designated by EOHHS that provide emergency overnight overflow shelter services on a short-term basis.

Prioritization Score – a score of 1-4 (with 1 indicating highest priority and 4 indicating no priority) assigned to every EA eligible family or pregnant individual on the EA waitlist.

Program Plan – A document subject to EOHHS approval that details certain services described in Section 2. Upon EOHHS's approval, the Contractor shall provide the specific services detailed in the Program Plan. The Program Plan may be modified as needed without an amendment to the Contract, with EOHHS approval.

Shelter Diversion – service provided to support identification of and connection to safe, alternative housing for families at risk of or experiencing homelessness.

Trauma-informed Services – a program or service based on an understanding of the vulnerabilities or triggers of trauma survivors that traditional service delivery approaches may exacerbate, so that these services and programs can be more supportive and avoid re-traumatization.

Contractor Responsibilities The Contractor shall provide, manage, operate, and oversee staffing and related services at the CSRA Location(s) designated by EOHHS as specified herein and the Program Plan. The Contractor shall partner and collaborate with other EOHHS, EOHLC, and Office of Refugee and Immigrant (ORI) vendors, including but not limited to Family Welcome Centers, resettlement agencies, Overflow Emergency Overnight Shelter providers, legal service providers, healthcare providers, and any other emergency assistance providers to ensure non-duplication of services described in this Section 2 and the Program Plan. The Contractor must adjust service delivery to any Family Guest to avoid duplicative services discovered at any point while delivering services under this Contract.

The Fiscal Year Program Budget, Attachment 3 to the Contract, sets forth the costs and expenses for this program.

Service Location(s) and Population The Contractor shall operate a CSRA Site at the location(s) designated in Appendix A, twenty-four hours per day, seven days per week, in accordance with the requirements of this Contract.

The Contractor shall ensure that the CSRA Site provides shelter and sheltering services and supports to all families and pregnant individuals referred to by the FWCs and EOHLC.

Operational and Nursing Support Services The Contractor shall perform the services described in this Section 2.2 in accordance with the Program Plan.

The Contractor shall provide on-site and off-site operational and clinical support to stand up and operate the CSRA Site and provide services for Family Guests of the CSRA Site.

The Contractor shall provide the following operational services, to the extent such services are not already available at the CSRA Location as specified by EOHHS and as detailed in the Program Plan, to ensure the efficient, safe, and cleanly operation of the CSRA Site in accordance with EOHHS guidance:

1. Bedding and linens for each Family Space;

2. Furniture to furnish each Family Space, as further specified by EOHHS;

3. Regular housekeeping and cleaning services;

4. Laundry services;

5. Security;

6. Facilities and maintenance services;

7. Food services;

8. Clinical screening and triaging support;

9. Specific transportation services;

10. Wi-Fi connectivity; and

11. Other amenities as directed by EOHHS.

The Contractor shall provide three meals per day for each Family Guest residing in the CSRA Site.

The Contractor shall provide personal hygiene items for each Family Guest residing in the CSRA Site and shall ensure first aid supplies are available on-site at all times.

The Contractor shall provide Clinical and Safety Risk Assessments and related services, basic clinical services, health screenings, wellness checks and other supports to promote the health and wellbeing of Family Guests as directed by EOHHS. Services and supports shall include, but are not limited to:

12. All staff, equipment, supplies, and logistical support needed to provide clinical support and on-site monitoring of the wellbeing of Family Guests as outlined in the Program Plan. This includes but is not limited to all necessary personal protective equipment (PPE), equipment and supplies, biowaste management, refrigeration, hand hygiene stations, tables, chairs, laptops, cell phones, signage, and office supplies;

13. Nursing and on-site medical care as described in the Program Plan, which shall be available at the CSRA Location during a minimum of eight hours per day, seven days per week;

14. Transportation to and coordination of health care and behavioral health services, Family Welcome Center services, and housing programming;

15. Case management focused on immediate stabilization and discharge planning. Case management shall also include case management for medical, behavioral health, and housing processes. All case management shall be available eight hours per day, five days per week;

16. Translation services, including Haitian Creole and Spanish; and

17. Other related services and supports as directed by EOHHS, via mutually agreed modification to the Program Plan.

The Contractor shall maintain clinical and record keeping protocols that comply with the requirements of this Contract and applicable state requirements. The Medical Director provided pursuant to Section 2.4 herein shall approve such protocols. The Contractor shall update protocols as necessary to ensure compliance with updated guidance. The Contractor shall submit its protocols to EOHHS immediately upon request from EOHHS, and implement any modification directed by EOHHS.

The Contractor shall appropriately and expeditiously respond to any adverse events or other medical emergency and provide Family Guests with the appropriate level of care on-site or arrange for appropriate transportation for care off-site, including transportation by ambulance to the nearest hospital emergency department if necessary.

The Contractor shall maintain a written agreement with a licensed clinic (e.g. a community health center) in the geographic vicinity of the CSRA Site to provide follow-up care to Family Guests.

The Contractor shall partner with local and community agencies and organizations to offer enrichment and educational opportunities for Family Guests, as approved by EOHHS.

All work performed by the Contractor under this Contract, including any work performed by subcontractors, shall be performed in a manner that is Culturally Competent, Trauma-Informed, and targeted to the unique needs of Family Guests.

B. If applicable, the Contractor shall maintain a separate space to isolate families and individuals identified by EOHHS, DPH, or other related contractors as potentially contagious (i.e., testing positive for or presenting symptoms of the flu, RSV, COVID-19, or other infectious diseases) as directed by EOHHS. The Contractor shall ensure such families and individuals receive clinical care and other supports and services described in this Section 2.2 in a safe an appropriate manner.

Project and Facility Management The Contractor shall provide project and facility management to ensure the successful operation of the CSRA Site. The Contractor’s project and facility management shall include, but not be limited to:

Providing on-site and off-site overall project management support to stand up, operate, and provide services for the CSRA Site as follows and as further directed by EOHHS:

1. Serving as single point of contact between the CSRA Site and EOHHS, as well as other Commonwealth agencies, and any clinical staffing and operations partners, and other CSRA Location(s), to ensure careful coordination of managing the CSRA Sites;

2. Interfacing with Commonwealth representatives and, as directed by EOHHS, Commonwealth vendors, to establish, review, and revise EOHHS-approved policies and protocols for the CSRA Site;

3. Providing an on-site site leader at the CSRA Site who will be responsible for:

Standing up and running operations;

Ensuring the availability of on-site clinical, administrative, and maintenance staff;

Directly coordinating with the Family Welcome Centers, local clinical staffing, and operations partners;

Providing or coordinating the provision of all necessary services, including but not limited to medical, behavioral health, case management, and pharmacy services; and Elevating issues to other key personnel identified in this Contract.

4. Providing all necessary clinical, administrative, maintenance, and other necessary staff, whether directly or through subcontracts with vendors, for the creation, ongoing operations, and winddown of the CSRA Location(s);

5. Partnering with EOHHS to identify and resolve any barriers that arise in managing and operating the CSRA Site(s); and

6. Subcontracting with necessary vendors at the CSRA Site(s) and ensuring all necessary management and coordination of such vendors, such as vendors for services, security, support, equipment, meals, transportation, cleaning, and laundry.

As further directed by EOHHS, providing on-site and off-site facility management of the CSRA Site(s) including overseeing and managing the stand-up, set-up, ongoing operations, and wind-down process for the CSRA Site(s); and Providing other related services at the direction of EOHHS.

Staffing For each CSRA Location, the Contractor shall propose to EOHHS for approval, and employ once approved, individuals to serve in the roles described below. The individuals employed in these roles shall have the professional experience and capability to carry out effectively the functions described below. The individuals employed to fill the roles outlined below are key personnel for purposes of this contract. EOHHS reserves the right to identify or designate additional individuals or roles as key personnel. Key personnel shall include personnel critical to ensuring that Contract requirements are fulfilled.

7. Key personnel shall include:

Program Director (Bachelor’s degree or equivalent), which shall be a full-time position overseeing this Contract. This position shall serve as the liaison between the Contractor and EOHHS and be the single point of contact for all inquiries. This position shall direct all activities, including but not limited to the development of the policies and procedures for the CSRA Site, and ensuring all required services are made available to individuals at the CSRA Site as needed.

CSRA Site Operations Manager, which shall support the Program Director and CSRA Site Operations Supervisors by overseeing scheduling, CSRA Site staffing, transportation, and overall CSRA Site operations.

Operations Supervisor will oversee operational and administrative staff for the CSRA Site in partnership with the CSRA Site Operations Manager and Program Director.

Medical Director, which shall be filled by a physician or advanced practice registered nurse who holds a valid, current license issued by the Massachusetts Board of Registration in Medicine or Massachusetts Board of Registration in Nursing and responsible for oversight of nursing, overall medical support, and prescription of medications. As clinically appropriate and subject to EOHHS approval in its sole discretion, the Medical Director may perform their responsibilities through telehealth. The Medical Director shall approve all clinical and record keeping protocols.

Nursing, which shall be a position filled by nurses that hold a valid, current license issued by the Massachusetts Board of Registration in Nursing that will provide overall clinical support and on-site monitoring of the wellbeing of Family Guests.

Case Manager, which will be responsible for on-site coordination of services with the FWC, follow-up care, benefits enrollment, and discharge planning from the CSRA Site.

8. The Contractor shall submit for EOHHS approval of all key personnel upon execution of this Contract.

9. The Contractor shall immediately remove key personnel in the event that EOHHS notifies the Contractor that EOHHS does not approve of the employee’s performance.

10. The Contractor shall ensure that, for the duration of the Contract, key personnel are assigned to perform their job functions related to this Contract and the Contractor shall not remove any EOHHS-approved key personnel from her or his assigned duties under the Contract without prior written EOHHS approval.

11. For each position designated as key personnel, and other positions upon EOHHS request, the Contractor shall identify the individual(s) who will serve as successor(s) to these key personnel positions in the event the key personnel position becomes vacant.

12. In the event that a change in Program Director is necessary, the Contractor shall provide written notice to EOHHS. For a change not resulting from an emergency, the Contractor shall provide written notice at least one week prior to the change. For a change resulting from an emergency, the Contractor shall provide written notice within one business day of the change.

13. The Contractor shall notify EOHHS of any turnover of key personnel other than the Program Director within one business day of the change.

The Contractor shall submit to EOHHS for review and approval a staffing plan that includes all key personnel and other staff necessary to implement the requirements of this Contract for each CSRA location. The staffing plan(s) shall include the number of personnel to be assigned to each role, a summary of the responsibilities for each role, and the hourly rate for each role. The Contractor shall implement the staffing plan(s) only as approved by EOHHS and shall seek approval from EOHHS for any variations in staffing from the approved staffing plan(s). The Contractor shall update its staffing plan(s), as requested by EOHHS.

The Contractor shall ensure that all staff with direct contact with Family Guests are trained in de-escalation techniques.

Contract Management and Reporting The Contractor’s Program Director shall be the single point of contact with EOHHS throughout the term of the Contract.

The Contractor shall work collaboratively with EOHHS to ensure successful operation of each of the CSRA Location(s), including participating in meetings as requested by EOHHS, promptly responding to inquiries from EOHHS, and providing information requested by EOHHS.

The Contractor shall report to EOHHS on the following in a form and format specified by EOHHS:

14. Total number of individuals on-site (i.e., daily bed census), including the total number of families on-site;

15. Demographic information, including but not limited to: age, language, country of origin;

16. Number of completed CSRAs performed;

17. Prioritization Scores based on CSRAs;

18. Performance Metrics as defined in Attachment 2; and

19. Other Contract performance as specified by EOHHS.

The Contractor shall promptly escalate to EOHHS’ attention operational barriers encountered by the Contractor in the day-to-day operations of the CSRA Location and shall keep EOHHS apprised of the Contractor’s resolution of such barriers.

Minimum Performance Requirements Contractor is required to maintain a minimum performance standard of 75% of the Performance Measures (Attachment 2), as determined by EOHHS and provided to the Contractor. EOHHS may impose corrective action, with a timeline for improvement, where Contractor’s performance is not on track to meet the 75% requirement. Performance measures include any work to be performed by Subcontractors.

EOHHS reserves the right to reduce or recover payments to Contractor should the Contractor’s performance fall below 75% of performance measures. EOHHS reserves the right, at its sole discretion, to revise the Performance Measures during the Contract term.

Wind Down Obligations During the Contract Term and/or within three (3) months of the expiration, termination, or non-renewal of this Contract, the Contractor shall assist in the transition of services described in this Contract to EOHHS and any new vendor operating CSRA Sites on behalf of EOHHS, as applicable.

Such assistance may include, but is not limited to provision of information, data and documents, drafts, and reports prepared by the Contractor as part of work and services described in this Contract and communicating with EOHHS as reasonably necessary for clarification of said information, data and documents, drafts, and reports.

EOHHS Responsibilities EOHHS shall:

Designate a representative or representatives authorized and empowered to represent EOHHS regarding all aspects of the Contract;

Review for approval or modifications any policies, procedures, or other documents submitted by the Contractor for EOHHS approval as required under the Contract;

Provide agreed-upon data or information EOHHS deems necessary for the Contractor’s performance under the Contract; and Pay the Contractor in accordance with Section 4.

Payment Subject to appropriation and all necessary state and federal approvals, EOHHS’s satisfaction with the Contractor’s performance and other terms and conditions of this Contract, EOHHS shall pay the Contractor in accordance with the terms set forth in this Section 4.

EOHHS shall pay the Contractor in accordance with the budget attached hereto as Fiscal Year Program Budget, Attachment 3 to the Contract, which sets forth the costs and expenses for this program. Attachment 3 shall be subject to EOHHS’s approval. All billing must be against the agreed upon budget (Attachment 3: Fiscal Year Program Budget) and may not exceed the amounts set forth in Attachment 3 on a fiscal year basis.

EOHHS and the Contractor, via written confirmation, may agree to reallocate funds between budget line items to meet operational needs without amendment to the Contract. Any changes to the maximum obligation shall be set forth in an amendment to the Contract.

The Contractor shall submit invoices on a monthly basis. Invoices shall include only EOHHS approved program costs, staffing time at hourly rates set forth in the Contractor’s approved staffing plan(s), and other expenditures approved by EOHHS. Billed costs and expenditures shall be on a time and materials basis and may not contain more than a 10% mark-up over the Contractor’s actual incurred expenses. The Contractor’s budget and invoicing for the physical CSRA Sites, if applicable, shall not exceed the actual cost of the CSRA Site. Allowable expenditures include only those expenses reasonably necessary to satisfy the Contractor’s obligations under this Contract and the successful operation of the CSRA Site, as set forth in this Contract and in accordance with the EOHHS-approved budget.

Invoices shall be paid according to the Commonwealth’s bill payment terms and the terms below. Such invoices shall:

20. Be organized in a form and format specified by EOHHS;

21. Include information sufficient for EOHHS to identify the staff or expenses included in the invoice;

22. Be consistent with the fees agreed upon by EOHHS and the Contractor as set forth in this Contract and Contract budget; and

23. Be delivered by the Contractor to EOHHS staff specified by EOHHS.

EOHHS shall review all invoices and shall subsequently approve or reject each invoice in whole or in part. EOHHS shall notify the Contractor in writing of any rejected portions of any invoice no later than 15 days after receipt of invoice. Such rejected portions may be modified by the Contractor or EOHHS and subsequently approved by EOHHS. Upon approval, EOHHS shall pay Contractor in accordance with the Commonwealth’s bill paying policy.

The Contractor shall satisfy all obligations under the Contract for the amount invoiced and approved in accordance with this Section and in an amount not to exceed the maximum allowable amounts set forth in Attachment 3 or any subsequent mutually executed modification(s).

The Contractor shall maintain appropriate supporting documentation for all invoices and shall provide such documentation to EOHHS upon request.

Confidentiality Data Management and Statutory Requirements The Contractor recognizes that in the performance of this Contract it will collect, use, maintain, disclose, create and/or otherwise access “personal data,” as defined in M.G.L. c. 66A, and that in so doing it will become a “holder” of personal data under M.G.L. c. 66A. As a holder of personal data, Contractor agrees that it maintain the privacy and security of such personal data and otherwise comply with all requirements of M.G.L. c. 66A with respect to such personal data.

To the extent that the Contractor carries out an obligation of EOHHS under the Health Insurance Portability and Accountability Act (“HIPAA”) Rules (45 CFR Parts 160, 162, and 164, Subparts A & E) pursuant to this Section 5 or the Contract, the Contractor agrees that it shall comply with the requirements of such HIPAA Rules that apply to the Contractor as if the Contractor were an EOHHS’ business associate in the performance of such obligation.

To the extent the Contractor create, receive, use, disclose, maintain, transmit or otherwise obtain information concerning Medicaid applicants and beneficiaries, the Contractor agrees to do so and to otherwise perform the Contract, in compliance with the Medicaid Confidentiality Rule at 42 CFR 431 Part F including but not limited to the requirement that the Contractor shall restrict the use or disclosure of information concerning Medicaid applicants and beneficiaries to purposes directly connected with the administration of the Medicaid plan as described at 42 CFR 431.302.

To the extent the Contractor receives, stores, processes, uses, creates or transmits information that was obtained by a 42 CFR Part 2 Program, Lawful Holder, or EOHHS (as such terms are used in 42 CFR Part 2), the Contractor would be bound by 42 CFR Part 2 and shall not use or disclose information except as permitted under 42 CFR Part 2 by a contractor receiving such information under 42 CFR §2.33(b). For example, the Contractor shall not use such information for the purposes of treatment, care coordination, or case management, or further redisclosure such information to law enforcement, unless authorized under 42 CFR Part 2.

To the extent the Contractor in the course of its duties under the Contract performs activities that involve outreach to or other contact with consumers (including Individuals), such contact shall be compliant with all applicable federal and state laws and regulations, including the Telephonic Consumer Protection Act of 1991 (47 U.S.C. §227) and its attendant regulations. To the extent the Activities involve call recording activities, the Contractor shall comply with all federal and state wiretapping and recording laws and regulations, including M.G.L. c. 272 §99.

The Contractor agrees that it shall comply (and shall cause its employees and other workforce members to comply) with any other privacy and security obligation that is required as the result of EOHHS (or Executive Office of Technology Services and Security (“EOTSS”) or another third party, on EOHHS’ behalf) having entered into an agreement (any such agreement, a “Third Party Agreement”) with a third party to obtain or to access PI from a third party (any such PI, “Third Party Data”) or to access any system containing Third Party Data or through which Third Party Data could be accessed, including, by way of illustration and not limitation, signing a written compliance acknowledgment or confidentiality agreement, undergoing a background check or completing training. The Parties acknowledge and agree that Third Party Data includes, without limitation, all data that EOHHS receives or obtains from Massachusetts Department of Revenue, the Social Security Administration, the Internal Revenue Service, the Department of Homeland Security or through the Federal Data Services Hub and, notwithstanding anything herein to the contrary, the Contractor may not access any such Third Party Data unless disclosure of such data to the Contractor is permitted under the applicable Third Party Agreement(s), all conditions for disclosure under such agreement(s) have been satisfied and the Contractor’s access to such data is otherwise permitted under the terms of this Agreement. For purposes of this agreement, no Third Party Data Agreement is currently applicable.

The Contractor further agrees that it shall comply with all applicable state and federal regulatory, statutory, and other requirements, including EOHHS rules and regulations relating to or governing the confidentiality, privacy, and/or security of such personal data defined and any other data (including Protected Information, as defined below) received, used, created, maintained, disclosed or otherwise accessed in connection with this Contract, that may be in effect upon execution of, or as may be effective during the course of, this Contract. EOHHS may require specific written assurance and further agreements regarding the security and privacy of Protected Information.

For purposes of this Contract, “Protected Information” or “PI” means any “personal data,” as defined in M.G.L. c. 66A, any “personal information,” as defined in M.G.L. c. 93H, any “patient identifying information” as used in 42 CFR Part 2, to the extent applicable, any “personally identifiable information” as used in 45 CFR §155.260, to the extent applicable, Third Party Data to the extent applicable, and any other identifiable information that is treated as confidential under any federal or state law or regulation that Contractor (or its Subcontractor) uses, maintains, discloses, receives, creates or otherwise accesses under or in connection with this Contract. Unless authorized by EOHHS in writing, all information, including aggregate information, that Contractor or its Subcontractor uses, maintains, discloses, receives, creates or otherwise accesses in connection with this Contract is considered PI if it is not fully de-identified in accordance with 45 CFR §§164.514(a)-(c).

Further, EOHHS reserves the right to add any requirement during the course of the Contract that it determines it must include in the Contract in order for EOHHS to comply with M.G.L. c. 66A, 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, and other applicable laws, regulations, and policies. EOHHS is the lawful owner, lawful holder or license holder of all PI and Commonwealth Security Information provided to the Contractor in connection with the Contractor’s performance of the services contemplated under the Contract and has the right to permit the Contractor access to or use of the PI and Commonwealth Security Information in connection with its performance of the services, to the extent applicable, subject to the Contractor’s obligations under this Contract. The Contractor acknowledges that its access to, receipt, creation, use, disclosure, transmission and maintenance of any PI, and any data derived or extracted from such PI, arises from and is defined by the Contractor’s obligations under the Contract, and that the Contractor does not possess any independent rights of ownership to such data. Any PI and Commonwealth Security Information is provided “as is” and EOHHS hereby disclaims all warranties, whether express, implied, statutory, or otherwise. EOHHS specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or practice. EOHHS makes no warranty of any kind that the PI and Commonwealth Security Information, will be secure, accurate, complete, free of harmful code, or error free. In no event will EOHHS be liable under or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, regardless of whether licensor was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable.

The Contractor acknowledges that PI subject to this Contract is regulated and the Contractor and its subcontractors, agents, employees and other workforce members may be subject to penalties under state and federal law for accessing, using or disclosing PI in violation of this Contract or any applicable law.

Access to PI (including potential access) must be limited to subcontractors and agents approved by EOHHS, and employees and other workforce members who have been approved by the Contractor. Such individuals are only permitted to access PI if they require access to such data for purposes of carrying out the Contractor’s services under this Contract. Subcontractors, agents, employees and other workforce members with access to PI must receive appropriate privacy and security training, must be informed of the confidential nature of PI, must agree to comply with limitations of this Section 5 and other applicable terms required under the Contract and must be informed of the penalties for misuse or unauthorized disclosure of PI under applicable laws.

The Contractor shall comply with all applicable terms of CORI regulations, 101 CMR 15.00 et seq. in connection with the review and consideration of employee and applicant criminal records.

The Contractor is fully responsible for any subcontractor’s or agent’s performance and for meeting all terms and requirements of this Section 5. The Contractor shall not assign any of its rights or delegate any of its obligations under this Section 5 without the prior written consent of EOHHS. Any purported assignment or delegation in violation of this Section 5 is null and void. No assignment or delegation relieves Contractor of any of its obligations under this Agreement.

Permitted Use The Contractor may use PI and any data derived or extracted from PI only for purposes directly related to the Contractor’s performance under this Contract. In using PI for such permitted purposes, the Contractor shall limit access to the information only to those employees, agents, and authorized Subcontractors who need such information in order to perform their official duties in connection with the Contractor’s performance of its obligations under this Contract.

The Contractor shall not disclose or release any PI to any person or entity other than: (a) to its authorized Subcontractors in the performance of Contract responsibilities hereunder, if any; (b) to the subject of the PI, if such disclosure is specifically contemplated under this Contract or otherwise approved by EOHHS in writing; (c) as required by law, in accordance with the following paragraph; and (d) with the prior written authorization from EOHHS; provided that any such disclosure must otherwise comply with all applicable privacy laws and regulations, the terms of this Contract and the terms of any other Contract or agreement relating to the privacy or security of PI that the Contractor may enter into pursuant to this Contract; any such Contract or agreement will be referred to as a “Supplemental Confidentiality Agreement”.

The Contractor may use or disclose PI if and to the extent specifically required by federal or state law or regulation applicable to Contractor, provided that any such use or disclosure must be consistent with the restrictions of M.G.L. c. 66A, 801 CMR 3.00, M.G.L. c. 93H, 201 CMR 17, the HIPAA Rules (inclusive of 45 CFR Parts 160, 162, and 164), 42 CFR Part 431, to the extent applicable, Subpart F (Medicaid Confidentiality Rule), to the extent applicable, 42 CFR Part 2, 45 CFR §155.260, to the extent applicable, and any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, confidentiality, or security of PI or Commonwealth Security Information.

Data Security In addition to any other requirement in this Contract or the Commonwealth Terms and Conditions for Human and Social Services Contracts related to data security, as of the Contract effective date, the Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PI and any other confidential information and materials in the Contractor’s control and used by the Contractor under this Contract, and that prevent use or disclosure of such information and materials other than as provided for by and in accordance with the terms of this Contact. All such safeguards must meet, at a minimum, all applicable Commonwealth data security and information technology resource policies, procedures, processes, and mechanisms, including those established for access to PI or systems containing PI. For purposes of the foregoing sentence, “Commonwealth data security and information technology resource policies, procedures, processes, and mechanisms” shall include those established by, the EOTSS Enterprise Information Security Policies and Standards (found at https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards (hereinafter, the “Standards”).

The Contractor shall notify EOHHS of any change in its administrative, technical, or operational environments that compromise or otherwise impact the confidentiality, integrity, or availability of PI or any changes to the Contractor’s information controls which alters its conformance with the Standards.

In the event the Contractor is granted direct access into any EOHHS systems, databases, or other information technology resources, the Contractor shall comply with all security mechanisms and processes established for access to such databases, systems, and information technology resources, as well as all Commonwealth security and information technology resource policies, processes, and mechanisms established for access to PI. The Contractor shall protect from inappropriate use or disclosure any password, user ID, or other mechanism or code permitting access to any EOHHS system, database, or other information technology resource or any other system, database, or information technology resource containing PI. The Contractor shall give EOHHS prior notice of any change in personnel whenever the change requires a termination or modification of any such password, user ID, or other security mechanism or code to maintain the integrity of the system, database, or resource.

The Contractor agrees to allow representatives of EOHHS access to premises where PI is kept for the purpose of inspecting privacy and physical security arrangements implemented by the Contractor to protect such data.

Upon request, the Contractor shall provide EOHHS with copies of all written policies, procedure, standards, and guidelines of the Contractor related to the protection, security, use, and disclosure of PI or other confidential information and the security and integrity of the Contractor’s technology resources.

Commonwealth Security Information If, through this Contract, the Contractor obtains access to any Commonwealth Security Information (as defined below), the Contractor is prohibited from making any disclosures of or about such information, unless in accord with EOHHS’s express written instructions unless such disclosure is required by law and then only in accord with this Contract. If Contractor is granted access to such information in order to perform its obligations under this Contract, the Contractor may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Contractor shall limit access to the information only to those employees, agents, and authorized Subcontractors who need such information in order to perform their official duties in connection with the Contractor’s performance of its obligations under this Contract. While in possession of such information, the Contractor shall apply all privacy and security requirements set forth herein with respect to Commonwealth Security Information and PI, as applicable to maintain the confidentiality, security, integrity, and availability of such information. Notwithstanding any other provision in this Contract regarding termination, the Contractor may not retain any Commonwealth Security Information upon termination of this Contract unless such information is expressly identified in any retention permission. If retention is expressly permitted, all data protections stated herein survive termination of this Contract and shall apply for as long as the Contractor retains the information.

For purposes of this Contract, “Commonwealth Security Information” means any data or other information that pertains to the security of the Commonwealth’s information technology. Specifically, Commonwealth Security Information refers to information pertaining to the manner in which the Commonwealth protects its information technology systems against unauthorized access to or modification of information, whether in storage, processing, or transit, and against the denial of service to authorized users or the provision of service to authorized users, including those measures necessary to detect, document, and counter such threats.

Periodic Review The Contractor shall monitor, periodically assess, and update its security controls and related system risks to ensure the continued effectiveness of those controls. Contractor must represent its conformance to the Standards by conducting an internal review of its compliance with the Standards on an annual basis. Such internal review will include an industry-standard vulnerability of the Contractor’s environment. In the event Contractor is not compliant with some aspect of the Standards, Contractor agrees to remediate such gap(s) in compliance within a reasonable timeframe. If Contractor cannot remediate such gap(s) within a reasonable timeframe, EOHHS reserves the right to implement a reasonable pro-rated modification of payments to the Contractor until compliance is reached.

Notification of Breach or Unauthorized Use or Disclosure of Information If the Contractor knows or has reason to believe that any PI, Commonwealth Security Information, or other data related to this Contract has been improperly used, accessed, disseminated, copied, or removed, the Contractor shall immediately notify EOHHS, both orally and in writing, of such known or possible Event(s), as defined below, and take all commercially reasonably steps to retrieve any such information that was disclosed to or accessed, copied, or removed by a non-permitted third party and to mitigate any harm caused by such event(s). Event shall mean the following, either individually or collectively: 1) any use or disclosure of PI or Commonwealth Security Information not permitted under this Section 5; 2) any Security Incident defined as the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system; or 3) any other event that would trigger notification obligations under the Breach Notification Rule, if applicable, M.G.L. c. 93H, other similar applicable laws, or Third Party Agreement , if applicable, requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of PI or Commonwealth Security Information.

The Contractor shall provide a written report to EOHHS, as soon as possible, and no later than three (3) business days of the Contractor becoming aware of any improper use, access, dissemination, copy or removal of any PI, Commonwealth Security information, or other data related to this Contract of said improper use, access, dissemination, copy or removal. The report shall identify the circumstances surrounding the any improper use, access, dissemination, copy or removal, including the date of the event, a description of how the event occurred, type of any PI, Commonwealth Security Information, or other data involved, the number of individuals to which such any PI, Commonwealth Security Information, or other data pertains, and such other information as EOHHS determines appropriate. Such notice and other actions shall be in addition to any other notice or action that may be required in connection with such event(s) under this Contract, the Commonwealth Terms and Conditions for Human and Social Services Contracts, a Supplemental Confidentiality Agreement, or applicable law or regulation (including, for example, M.G.L. c. 93H).

If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, if applicable, M.G.L. c. 93H, other applicable laws, or Third Party Agreement, if applicable, as a result of the Event, the Contractor shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with the Breach Notification Rule, if applicable, M.G.L. c. 93H, other applicable laws, or Third Party Agreement, if applicable, but in no event shall the Contractor have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Contractor to do so in writing.

The Contractor shall reimburse and indemnify, defend and hold harmless EOHHS for all costs incurred or sustained by EOHHS in responding to, and mitigating damages caused by, any Event or third party claims, if applicable, or causes of action brought or asserted against EOHHS involving:

24. the Contractor’s failure to meet its responsibilities under, or in violation of, any provision of this Section or the Contract;

25. the Contractor’s violation of applicable privacy and security laws;

26. the Contractor’s negligence or the Contractor’s failure to protect data as required by applicable privacy and security laws; or

27. any activity or omission of the Contractor resulting in or contributing to an Event.

Such costs may include, for example and without limitation, losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees and the costs associated with any notification required under subsection 5(G), above, including staffing and materials costs. Alternatively, at EOHHS’ direction, in lieu of reimbursing EOHHS for such any such costs the Contractor shall, at Contractor’s expense, conduct any such notification or other mitigation related activity on EOHHS’ behalf. This provision shall apply in addition and separate to any generally applicable indemnification provision applicable to the Contractor.

Notification of and Response to Legal Process The Contractor shall report to EOHHS, both verbally and in writing, any instance where PI, Commonwealth Security Information, or any other data obtained under or in connection with this Contract is subpoenaed or becomes the subject of a court or administrative order or other legal process. The Contractor shall provide such notice as soon as possible upon receiving or otherwise becoming aware of such subpoena, order, or other legal process, and in no event later than five (5) business days before the response date applicable to such subpoena, order, or process. If EOHHS directs the Contractor to respond, the Contractor shall take all necessary legal steps, including objecting to the request when appropriate, to comply with M.G.L. c. 66A, 42 CFR § 431.306(f), if applicable, 42 CFR Part 2, if applicable, and any other applicable law or regulation. If EOHHS determines that it shall respond directly, the Contractor shall fully cooperate and assist EOHHS in its response.

Individual’s Rights of Access With respect to any relevant PI in the Contractor’s possession, the Contractor shall take such action as may be…