Attachments for Signature S2224.pdf

VENDOR INFORMATION RESPONSE

Revised: April 2021 Page 1 of 4

Vendors shall complete and return this form in their proposal.

If the proposal includes subcontractors, form must be completed for each subcontractor as well.

1. VENDOR CONTACT INFORMATION

COMPANY NAME AND CONTACT INFORMATION:

The information provided in the table below shall be used for development of the contract, if awarded.

Requested Information Response

Company Name:

Company Street Address:

City, State, Zip Code:

Telephone Number, including area code:

Toll Free Number, including area code:

Email Address:

CONTACT PERSON FOR QUESTIONS/CONTRACT NEGOTIATIONS

Name:

Title:

Address:

City, State, Zip Code:

Email Address:

Telephone Number, including area code:

Toll Free Number, including area code:

Revised: April 2021 Page 2 of 4

2. VENDOR INFORMATION

Vendors shall provide an overall company profile in the following table:

Question Response

Ownership (sole proprietor, partnership, etc.):

State of Incorporation:

Date of Incorporation:

# of years in business:

List of top officers:

Location of company headquarters, to include City and State:

Location(s) of the office that shall provide the services described in this RFP:

Number of employees locally with the expertise to support the requirements identified in this RFP:

Number of employees nationally with the expertise to support the requirements in this RFP:

Location(s) from which employees shall be assigned for this project:

VENDOR LICENSING

2.2.1 Please be advised: Pursuant to NRS 80.010, a corporation organized pursuant to the laws of another state shall register with the State of Nevada, Secretary of State’s Office as a foreign corporation before a contract can be executed between the State of Nevada and the awarded vendor, unless specifically exempted by NRS 80.015.

2.2.2 The selected vendor, prior to doing business in the State of Nevada, shall be appropriately licensed by the State of Nevada, Secretary of State’s Office pursuant to NRS 76. Information regarding the Nevada Business License can be located at http://nvsos.gov.

Nevada Business License Number:

Legal Entity Name:

Is the Legal Entity Name the same name as vendor is Doing Business As (DBA)? Yes No

If the answer is ‘No’, provide explanation below:

Revised: April 2021 Page 3 of 4

STATE OF NEVADA EXPERIENCE

Has the vendor ever been engaged under contract by any State of Nevada agency? Yes No

2.3.1 If ‘Yes’, complete the following table for each State agency for whom the work was performed.

2.3.2 Table can be duplicated for each contract being identified.

State Agency Name:

State Agency Contact Name:

Dates Services Were Performed:

Type of Duties Performed:

Total Dollar Value of the Contract:

CURRENT OR FORMER EMPLOYEE

Are you now or have you been within the last two (2) years an employee of the State of Nevada, or any of its agencies, departments, or divisions? Yes No

If ‘Yes’, please explain when the employee is planning to render services; i.e., while on annual leave, compensatory time, or on their own time?

2.4.1 If you employ (a) any person who is a current employee of an agency of the State of Nevada, or (b) any person who has been an employee of an agency of the State of Nevada within the past two (2) years, and if such person shall be performing or producing the services which you shall be contracted to provide under this contract, you shall disclose the identity of each such person in your response to this RFP, and specify the services that each person shall be expected to perform.

PRIOR OR ONGOING CONTRACTUAL ISSUES

2.5.1 Disclosure of any significant prior or ongoing contract failures, contract breaches, civil or criminal litigation in which the vendor has been alleged to be liable or held liable in a matter involving a contract with the State of Nevada or any other governmental entity.

2.5.2 Any pending claim or litigation occurring within the past six (6) years which may adversely affect the vendor’s ability to perform or fulfill its obligations if a contract is awarded as a result of this RFP shall also be disclosed.

Does any of the above apply to your company? Yes No

2.5.3 If ‘Yes’, please provide the information in the table below.

2.5.4 Table can be duplicated for each issue being identified.

Revised: April 2021 Page 4 of 4

Date of alleged contract failure or breach:

Parties involved:

Description of the contract failure, contract breach, or litigation, including the products or services involved:

Amount in controversy:

Resolution or current status of the dispute:

If the matter has resulted in a court case:

Court Case Number

Status of the litigation:

3. PAYMENT AUTHORIZATION FOR USE OF PROCUREMENT CARD

Using agencies may desire to use a Procurement Card as a method of payment to vendors.

PAYMENT AUTHORIZATION FOR USE OF PROCUREMENT CARD

Please indicate if you will accept this method of payment? Yes No

4. NAME OF INDIVIDUAL AUTHORIZED TO BIND THE ORGANIZATION

Name:

Title:

SIGNATURE OF INDIVIDUAL AUTHORIZED TO BIND THE VENDOR

Individual shall be legally authorized to bind the vendor per NRS 333.337

Signature:

Date:

VENDOR CERTIFICATIONS

Revised: April 2021 Page 1 of 1

Vendor agrees and shall comply with the following:

1. Any and all prices that may be charged under the terms of the contract do not and shall not violate any existing federal, State or municipal laws or regulations concerning discrimination and/or price fixing. The vendor agrees to indemnify, exonerate and hold the State harmless from liability for any such violation now and throughout the term of the contract.

2. All proposed capabilities can be demonstrated by the vendor.

3. The price(s) and amount of this proposal have been arrived at independently and without consultation, communication, agreement or disclosure with or to any other contractor, vendor or potential vendor.

4. All proposal terms, including prices, shall remain in effect for a minimum of 180 days after the proposal due date. In the case of the awarded vendor, all proposal terms, including prices, shall remain in effect throughout the contract negotiation process.

5. No attempt has been made at any time to induce any firm or person to refrain from proposing or to submit a proposal higher than this proposal, or to submit any intentionally high or noncompetitive proposal. All proposals shall be made in good faith and without collusion.

6. All conditions and provisions of this RFP are deemed to be accepted by the vendor and incorporated by reference in the proposal, except such conditions and provisions that the vendor expressly excludes in the proposal. Any exclusion shall be in writing and included in the proposal at the time of submission.

7. Each vendor shall disclose any existing or potential conflict of interest relative to the performance of the contractual services resulting from this RFP. Any such relationship that might be perceived or represented as a conflict shall be disclosed. By submitting a proposal in response to this RFP, vendors affirm that they have not given, nor intend to give at any time hereafter, any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant or any employee or representative of same, in connection with this procurement.

Any attempt to intentionally or unintentionally conceal or obfuscate a conflict of interest shall automatically result in the disqualification of a vendor’s proposal. An award shall not be made where a conflict of interest exists. The State shall determine whether a conflict of interest exists and whether it may reflect negatively on the State’s selection of a vendor. The State reserves the right to disqualify any vendor on the grounds of actual or apparent conflict of interest.

8. All employees assigned to the project are authorized to work in this country.

9. The company has a written equal opportunity policy that does not discriminate in employment practices with regard to race, color, national origin, physical condition, creed, religion, age, sex, marital status, sexual orientation, developmental disability or disability of another nature.

10. The company has a written policy regarding compliance for maintaining a drug-free workplace.

11. Vendor understands and acknowledges that the representations within their proposal are material and important and shall be relied on by the State in evaluation of the proposal. Any vendor misrepresentations shall be treated as fraudulent concealment from the State of the true facts relating to the proposal.

12. Vendor shall certify that any and all subcontractors comply with Sections 7, 8, 9, and 10, above.

The proposal shall be signed by the individual(s) legally authorized to bind the vendor per NRS 333.337.

Print Name:

Signature:

CONFIDENTIALITY AND CERTIFICATION OF INDEMNIFICATION

Submitted proposals, which are marked confidential in their entirety, or those in which a significant portion of the submitted proposal is marked confidential shall not be accepted by the State of Nevada. Pursuant to NRS 333.333, only proprietary information may be labeled a trade secret as defined in NRS 600A.030(5). All proposals are confidential until the contract is awarded; at which time, both successful and unsuccessful vendor proposals become public information.

In accordance with the submittal instructions of this RFP, vendors are requested to submit confidential information in separate files flagged as confidential in NevadaEPro.

The State shall not be responsible for any information contained within the proposal. If vendors do not comply with the labeling requirements, proposals shall be released as submitted. In the event a governing board acts as the final authority, there may be public discussion regarding the submitted proposals that shall be in an open meeting format, the proposals shall remain confidential.

By signing below, I understand it is my responsibility as the vendor to act in protection of the labeled information and agree to defend and indemnify the State of Nevada for honoring such designation. I duly realize failure to so act shall constitute a complete waiver, and all submitted information shall become public information; additionally, failure to label any information that is released by the State shall constitute a complete waiver of any and all claims for damages caused by the release of the information.

If this proposal contains Confidential Information, Trade Secrets and/or Proprietary information. Please initial the appropriate response in the boxes below and provide the justification for confidential status. Attached additional pages if necessary.

Proprietary Information Yes No

Justification for Confidential Status:

Company Name:

Signature:

Print Name:

CERTIFICATION REGARDING LOBBYING

Certification for Contracts, Grants, Loans, and Cooperative Agreements

The undersigned certifies, to the best of his or her knowledge and belief, that:

1. No Federal appropriated funds have been paid or shall be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.

2. If any funds other than Federally appropriated funds have been paid or shall be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure of Lobbying Activities,” in accordance with its instructions.

3. The undersigned shall require that the language of this certification be included in the award documents for all sub awards at all tiers (including subcontracts, sub grants, and contracts under grants, loans, and cooperative agreements) and that all sub recipients shall certify and disclose accordingly.

This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

Vendor Name:

Project Title:

Print Name of Official Authorized to Sign Application:

Signature of Official Authorized to Sign Application:

Page 1 of 7 NMH-3820 (01/19)

STATE OF NEVADA

DEPARTMENT OF HEALTH AND HUMAN SERVICES

BUSINESS ASSOCIATE ADDENDUM

BETWEEN

The Division of Health Care Financing and Policy

Herein after referred to as the “Covered Entity” and

Herein after referred to as the “Business Associate”

PURPOSE. In order to comply with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law 104-191, and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Public Law 111-5 this Addendum is hereby added and made part of the Contract between the Covered Entity and the Business Associate. This Addendum establishes the obligations of the Business Associate and the Covered Entity as well as the permitted uses and disclosures by the Business Associate of protected health information it may possess by reason of the Contract. The Covered Entity and the Business Associate shall protect the privacy and provide for the security of protected health information disclosed to the Business Associate pursuant to the Contract and in compliance with HIPAA, the HITECH Act, and regulation promulgated there under by the U.S.

Department of Health and Human Services (“HIPAA Regulations”) and other applicable laws.

WHEREAS, the Business Associate will provide certain services to the Covered Entity, and, pursuant to such arrangement, the Business Associate is considered a business associate of the Covered Entity as defined in HIPAA Regulations; and

WHEREAS, the Business Associate may have access to and/or create, receive, maintain or transmit certain protected health information from or on behalf of the Covered Entity, in fulfilling its responsibilities under such arrangement; and

WHEREAS, HIPAA Regulations require the Covered Entity to enter into a Contract containing specific requirements of the Business Associate prior to the disclosure of protected health information; and

THEREFORE, in consideration of the mutual obligations below and the exchange of information pursuant to this Addendum and to protect the interests of both Parties, the Parties agree to all provisions of this Addendum.

I. DEFINITIONS. The following terms in this Addendum shall have the same meaning as those terms in the HIPAA Regulations: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Health Record, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Subcontractor, Unsecured Protected Health Information, and Use.

1. Business Associate shall mean the name of the organization or entity listed above and shall have the meaning given to the term under the Privacy and Security Rule and the HITECH Act. For full definition refer to 45 CFR 160.103.

2. Contract shall refer to this Addendum and that particular contract to which this Addendum is made a part.

3. Covered Entity shall mean the name of the Division listed above and shall have the meaning given to such term under the Privacy Rule and the Security Rule, including, but not limited to 45 CFR 160.103.

4. Parties shall mean the Business Associate and the Covered Entity.

Page 2 of 7 NMH-3820 (01/19)

II. OBLIGATIONS OF THE BUSINESS ASSOCIATE

1. Access to Protected Health Information. The Business Associate will provide, as directed by the Covered Entity or an individual, access to inspect or obtain a copy of protected health information about the individual that is maintained in a designated record set by the Business Associate or its agents or subcontractors, in order to meet the requirements of HIPAA Regulations. If the Business Associate maintains an electronic health record, the Business Associate, its agents or subcontractors shall provide such information in electronic format to enable the Covered Entity to fulfill its obligations under HIPAA Regulations.

2. Access to Records. The Business Associate shall make its internal practices, books and records relating to the use and disclosure of protected health information available to the Covered Entity and to the Secretary for purposes of determining Business Associate’s compliance with HIPAA Regulations.

3. Accounting of Disclosures. Upon request, the Business Associate and its agents or subcontractors shall make available to the Covered Entity or the individual information required to provide an accounting of disclosures in accordance with HIPAA Regulations.

4. Agents and Subcontractors. The Business Associate must ensure all agents and subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree in writing to the same restrictions and conditions that apply to the Business Associate with respect to such information. The Business Associate must implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation as outlined under HIPAA Regulations.

5. Amendment of Protected Health Information. The Business Associate will make available protected health information for amendment and incorporate any amendments in the designated record set maintained by the Business Associate or its agents or subcontractors, as directed by the Covered Entity or an individual, in order to meet the requirements of HIPAA Regulations.

6. Audits, Investigations, and Enforcement. If the data provided or created through the execution of the Contract becomes the subject of an audit, compliance review, or complaint investigation by the Office of Civil Rights or any other federal or state oversight agency, the Business Associate shall notify the Covered Entity immediately and provide the Covered Entity with a copy of any protected health information that the Business Associate provides to the Secretary or other federal or state oversight agency concurrently, to the extent that it is permitted to do so by law. The Business Associate and individuals associated with the Business Associate are solely responsible for all civil and criminal penalties assessed as a result of an audit, breach or violation of HIPAA Regulations.

7. Breach or Other Improper Access, Use or Disclosure Reporting. The Business Associate must report to the Covered Entity, in writing, any access, use or disclosure of protected health information not permitted by the Contract, Addendum or HIPAA Regulations by Business Associate or its agents or subcontractors. The Covered Entity must be notified immediately upon discovery or the first day such breach or suspected breach is known to the Business Associate or by exercising reasonable diligence would have been known by the Business Associate in accordance with HIPAA Regulations. In the event of a breach or suspected breach of protected health information, the report to the Covered Entity must be in writing and include the following: a brief description of the incident; the date of the incident; the date the incident was discovered by the Business Associate; a thorough description of the unsecured protected health information that was involved in the incident; the number of individuals whose protected health information was involved in the incident; and the steps the Business Associate or its agent or subcontractor is taking to investigate the incident and to protect against further incidents. The Covered Entity will determine if a breach of unsecured protected health information has occurred and will notify the Business Associate of the determination. If a breach of unsecured protected health information is determined, the Business Associate must take prompt corrective action to cure any such deficiencies and mitigate any significant harm that may have occurred to individual(s) whose information was disclosed inappropriately.

8. Breach Notification Requirements. If the Covered Entity determines a breach of unsecured protected health information by the Business Associate, or its agents or

Page 3 of 7 NMH-3820 (01/19) subcontractors has occurred, the Business Associate will be responsible for notifying the individuals whose unsecured protected health information was breached in accordance with HIPAA Regulations. The Business Associate must provide evidence to the Covered Entity that appropriate notifications to individuals and/or media, when necessary, as specified in HIPAA Regulations has occurred. The Business Associate is responsible for all costs associated with notification to individuals, the media or others as well as costs associated with mitigating future breaches. The Business Associate must notify the Secretary of all breaches in accordance with HIPAA Regulations and must provide the Covered Entity with a copy of all notifications made to the Secretary.

9. Data Ownership. The Business Associate acknowledges that the Business Associate or its agents or subcontractors have no ownership rights with respect to the protected health information it creates, receives or maintains, or otherwise holds, transmits, uses or discloses.

10. Litigation or Administrative Proceedings. The Business Associate shall make itself, any subcontractors, employees, or agents assisting the Business Associate in the performance of its obligations under the Contract or Addendum, available to the Covered Entity, at no cost to the Covered Entity, to testify as witnesses, or otherwise, in the event litigation or administrative proceedings are commenced against the Covered Entity, its administrators or workforce members upon a claimed violation by Business Associate of HIPAA Regulations or other laws relating to security and privacy.

11. Minimum Necessary. The Business Associate and its agents and subcontractors shall request, use and disclose only the minimum amount of protected health information necessary to accomplish the purpose of the request, use or disclosure in accordance with HIPAA Regulations.

12. Policies and Procedures. The Business Associate must adopt written privacy and security policies and procedures and documentation standards to meet the requirements of HIPAA Regulations.

13. Privacy and Security Officer(s). The Business Associate must appoint Privacy and Security Officer(s) whose responsibilities shall include: monitoring the Privacy and Security compliance of the Business Associate; development and implementation of the Business Associate’s HIPAA Privacy and Security policies and procedures; establishment of Privacy and Security training programs; and development and implementation of an incident risk assessment and response plan in the event the Business Associate sustains a breach or suspected breach of protected health information.

14. Safeguards. The Business Associate must implement safeguards as necessary to protect the confidentiality, integrity and availability of the protected health information the Business Associate creates, receives, maintains, or otherwise holds, transmits, uses or discloses on behalf of the Covered Entity. Safeguards must include administrative safeguards (e.g., risk analysis and designation of security official), physical safeguards (e.g., facility access controls and workstation security), and technical safeguards (e.g., access controls and audit controls) to the confidentiality, integrity and availability of the protected health information, in accordance with HIPAA Regulations. Technical safeguards must meet the standards set forth by the guidelines of the National Institute of Standards and Technology (NIST). The Business Associate agrees to only use or disclose protected health information as provided for by the Contract and Addendum and to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate, of a use or disclosure, in violation of the requirements of this Addendum as outlined in HIPAA Regulations.

15. Training. The Business Associate must train all members of its workforce on the policies and procedures associated with safeguarding protected health information. This includes, at a minimum, training that covers the technical, physical and administrative safeguards needed to prevent inappropriate uses or disclosures of protected health information;

training to prevent any intentional or unintentional use or disclosure that is a violation of HIPAA Regulations; and training that emphasizes the criminal and civil penalties related to HIPAA breaches or inappropriate uses or disclosures of protected health information.

Workforce training of new employees must be completed within 30 days of the date of hire and all employees must be trained at least annually. The Business Associate must maintain written records for a period of six years. These records must document each employee that received training and the date the training was provided or received.

16. Use and Disclosure of Protected Health Information. The Business Associate must not use or further disclose protected health information other than as permitted or required by

Page 4 of 7 NMH-3820 (01/19) the Contract or as required by law. The Business Associate must not use or further disclose protected health information in a manner that would violate the requirements of HIPAA Regulations.

III. PERMITTED AND PROHIBITED USES AND DISCLOSURES BY THE BUSINESS ASSOCIATE

The Business Associate agrees to these general use and disclosure provisions:

1. Permitted Uses and Disclosures:

a. Except as otherwise limited in this Addendum, the Business Associate may use or disclose protected health information to perform functions, activities, or services for, or on behalf of, the Covered Entity as specified in the Contract, provided that such use or disclosure would not violate HIPAA Regulations, if done by the Covered Entity.

b. Except as otherwise limited in this Addendum, the Business Associate may use or disclose protected health information received by the Business Associate in its capacity as a Business Associate of the Covered Entity, as necessary, for the proper management and administration of the Business Associate, to carry out the legal responsibilities of the Business Associate, as required by law or for data aggregation purposes in accordance with HIPAA Regulations.

c. Except as otherwise limited by this Addendum, if the Business Associate discloses protected health information to a third party, the Business Associate must obtain, prior to making such disclosure, reasonable written assurances from the third party that such protected health information will be held confidential pursuant to this Addendum and only disclosed as required by law or for the purposes for which it was disclosed to the third party. The written agreement from the third party must include requirements to immediately notify the Business Associate of any breaches of confidentiality of protected health information to the extent it has obtained knowledge of such breach.

d. The Business Associate may use or disclose protected health information to report violations of law to appropriate federal and state authorities, consistent with HIPAA Regulations.

2. Prohibited Uses and Disclosures:

a. Except as otherwise limited in this Addendum, the Business Associate shall not disclose protected health information to a health plan for payment or health care operations purposes if the patient has required this special restriction and has paid out of pocket in full for the health care item or service to which the protected health information relates in accordance with HIPAA Regulations.

b. The Business Associate shall not directly or indirectly receive remuneration in exchange for any protected health information, unless the Covered Entity obtained a valid authorization, in accordance with HIPAA Regulations that includes a specification that protected health information can be exchanged for remuneration.

IV. OBLIGATIONS OF THE COVERED ENTITY

1. The Covered Entity will inform the Business Associate of any limitations in the Covered Entity’s Notice of Privacy Practices in accordance with HIPAA Regulations, to the extent that such limitation may affect the Business Associate’s use or disclosure of protected health information.

2. The Covered Entity will inform the Business Associate of any changes in, or revocation of, permission by an individual to use or disclose protected health information, to the extent that such changes may affect the Business Associate’s use or disclosure of protected health information.

3. The Covered Entity will inform the Business Associate of any restriction to the use or disclosure of protected health information that the Covered Entity has agreed to in accordance with HIPAA Regulations, to the extent that such restriction may affect the Business Associate’s use or disclosure of protected health information.

4. Except in the event of lawful data aggregation or management and administrative activities, the Covered Entity shall not request the Business Associate to use or disclose protected

Page 5 of 7 NMH-3820 (01/19) health information in any manner that would not be permissible under HIPAA Regulations, if done by the Covered Entity.

V. TERM AND TERMINATION

1. Effect of Termination:

a. Except as provided in paragraph (b) of this section, upon termination of this

Addendum, for any reason, the Business Associate will return or destroy all protected health information received from the Covered Entity or created, maintained, or received by the Business Associate on behalf of the Covered Entity that the Business Associate still maintains in any form and the Business Associate will retain no copies of such information.

b. If the Business Associate determines that returning or destroying the protected health information is not feasible, the Business Associate will provide to the Covered Entity notification of the conditions that make return or destruction infeasible. Upon a mutual determination that return or destruction of protected health information is infeasible, the Business Associate shall extend the protections of this Addendum to such protected health information and limit further uses and disclosures of such protected health information to those purposes that make return or destruction infeasible, for so long as the Business Associate maintains such protected health information.

c. These termination provisions will apply to protected health information that is in the possession of subcontractors, agents or employees of the Business Associate.

2. Term. The Term of this Addendum shall commence as of the effective date of this Addendum herein and shall extend beyond the termination of the contract and shall terminate when all the protected health information provided by the Covered Entity to the Business Associate, or accessed, maintained, created, retained, modified, recorded, stored or otherwise held, transmitted, used or disclosed by the Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity, or if it is not feasible to return or destroy the protected health information, protections are extended to such information, in accordance with the termination.

3. Termination for Breach of Contract. The Business Associate agrees that the Covered Entity may immediately terminate the Contract if the Covered Entity determines that the Business Associate has violated a material part of this Addendum.

VI. MISCELLANEOUS

1. Amendment. The parties agree to take such action as is necessary to amend this Addendum from time to time for the Covered Entity to comply with all the requirements of HIPAA Regulations.

2. Clarification. This Addendum references the requirements of HIPAA Regulations, as well as amendments and/or provisions that are currently in place and any that may be forthcoming.

3. Indemnification. Each party will indemnify and hold harmless the other party to this Addendum from and against all claims, losses, liabilities, costs and other expenses incurred as a result of, or arising directly or indirectly out of or in conjunction with:

a. Any misrepresentation, breach of warranty or non-fulfillment of any undertaking on the part of the party under this Addendum; and

b. Any claims, demands, awards, judgments, actions, and proceedings made by any person or organization arising out of or in any way connected with the party’s performance under this Addendum.

4. Interpretation. The provisions of this Addendum shall prevail over any provisions in the Contract that any conflict or appear inconsistent with any provision in this Addendum. This Addendum and the Contract shall be interpreted as broadly as necessary to implement and comply with HIPAA Regulations. The parties agree that any ambiguity in this Addendum shall be resolved to permit the Covered Entity and the Business Associate to comply with HIPAA Regulations.

5. Regulatory Reference. A reference in this Addendum to HIPAA Regulations means the sections as in effect or as amended.

Page 6 of 7 NMH-3820 (01/19)

6. Survival. The respective rights and obligations of Business Associate under Effect of Termination of this Addendum shall survive the termination of this Addendum.

Page 7 of 7 NMH-3820 (01/19)

IN WITNESS WHEREOF, the Business Associate and the Covered Entity have agreed to the terms of the above written agreement as of the effective date set forth below.

COVERED ENTITY BUSINESS ASSOCIATE

Division of Health Care Financing and Policy

1100 E. William Street, Suite 101

(Business Name)

Carson City, NV 89701

(Business Address)

(702) 668-4277

(City, State and Zip Code)

(775) 687-3735 (Business Phone Number)

(Business FAX Number)

(Authorized Signature) (Authorized Signature)

Suzanne Bierman

Administrator

(Print Name)

(Title)

(Date) (Date)