ATTACHMENT 001

SAP

IMPORTANT TAX NOTICE - NONRESIDENTS ONLY

Withholding Requirements for Payments to Nonresidents: Section 12-8-550 of the South Carolina Code of Laws requires persons hiring or contracting with a nonresident conducting a business or performing personal services of a temporary nature within South Carolina to withhold 2% of each payment made to the nonresident. The withholding requirement does not apply to (1) payments on purchase orders for tangible personal property when the payments are not accompanied by services to be performed in South Carolina, (2) nonresidents who are not conducting business in South Carolina, (3) nonresidents for contracts that do not exceed $10,000 in a calendar year, or (4) payments to a nonresident who (a) registers with either the S.C. Department of Revenue or the S.C. Secretary of State and (b) submits a Nonresident Taxpayer Registration Affidavit - Income Tax Withholding, Form I-312 to the person letting the contract.

The withholding requirement applies to every governmental entity that uses a contract ("Using Entity").

Nonresidents should submit a separate copy of the Nonresident Taxpayer Registration Affidavit - Income Tax Withholding, Form I-312 to every Using Entity that makes payment to the nonresident pursuant to this solicitation.

Once submitted, an affidavit is valid for all contracts between the nonresident and the Using Entity, unless the Using Entity receives notice from the Department of Revenue that the exemption from withholding has been revoked.

Section 12-8-540 requires persons making payment to a nonresident taxpayer of rentals or royalties at a rate of $1,200.00 or more a year for the use of or for the privilege of using property in South Carolina to withhold 7% of the total of each payment made to a nonresident taxpayer who is not a corporation and 5% if the payment is made to a corporation. Contact the Department of Revenue for any applicable exceptions.

For information about other withholding requirements (e.g., employee withholding), contact the Withholding Section at the South Carolina Department of Revenue at 803-898-5383 or visit the Department's website at:

https://dor.sc.gov

This notice is for informational purposes only. This agency does not administer and has no authority over tax issues.

All registration questions should be directed to the License and Registration Section at 803-898-5872 or to the South Carolina Department of Revenue, Registration Unit, Columbia, S.C. 29214-0140. All withholding questions should be directed to the Withholding Section at 803-896-1420.

PLEASE SEE THE "NONRESIDENT TAXPAYER REGISTRATION AFFIDAVIT INCOME TAX

WITHHOLDING" FORM (FORM NUMBER I-312) LOCATED AT: https://dor.sc.gov

[09-9005-4] https://dor.sc.gov/

ATTACHMENT 002 - OFFEROR'S CHECKLIST -- AVOID COMMON

BID/PROPOSAL MISTAKES

Review this checklist prior to submitting your bid/proposal.

If you fail to follow this checklist, you risk having your bid/proposal rejected.

- Do not include any of your standard contract forms!

- Unless expressly required, do not include any additional boilerplate contract clauses.

- Reread your entire bid/proposal to make sure your bid/proposal does not take exception to any of the state's mandatory requirements.

- Make sure you have properly marked all protected, confidential, or trade secret information in accordance with the instructions entitled: SUBMITTING CONFIDENTIAL INFORMATION. DO NOT mark your entire bid/proposal as confidential, trade secret, or protected! Do not include a legend on the cover stating that your entire response is not to be released!

- Have you properly acknowledged all amendments? Instructions regarding how to acknowledge an amendment should appear in all amendments issued.

- Make sure your bid/proposal includes a copy of the solicitation cover page. Make sure the cover page is signed by a person that is authorized to contractually bind your business.

- Make sure your Bid/proposal includes the number of copies requested.

- Check to ensure your Bid/proposal includes everything requested!

- If you have concerns about the solicitation, do not raise those concerns in your response! After opening, it is too late! If this solicitation includes a pre-bid/proposal conference or a question & answer period, raise your questions as a part of that process! Please see instructions under the heading "submission of questions" and any provisions regarding pre-bid/proposal conferences.

[09-9010-1]

ATTACHMENT 003 - Certification Regarding Debarment, Suspension, Ineligibility and Voluntary Exclusion – Lower Tier Covered Transactions

(To Be Supplied to Lower Tier Participants)

By signing and submitting this lower tier proposal, the prospective lower tier participant, as defined in 45 CFR Part 76, certifies to the best of its knowledge and belief that it and its principals:

a) are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction by any federal department or agency.

b) where the prospective lower participant is unable to certify to any of the above, such prospective participant shall attach an explanation to this proposal.

The prospective lower tier participant further agrees by submitting this proposal that it will include this clause entitled Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary Exclusion-Lower Tier Covered Transactions without modifications in all lower tier covered transactions and in all solicitations for lower tier covered transactions.

Authorized Signature

ATTACHMENT 004 - Disclosure and Control Interest Statement

ATTM 005 – 2017 VERSION

HIPAA BUSINESS ASSOCIATE AGREEMENT

A. Purpose

The South Carolina Department of Health and Human Services (Covered Entity) and Business Associate agree to the terms of this Agreement for the purpose of protecting the privacy of individually identifiable health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in performing the functions, activities, or services for, or on behalf of, Covered Entity as specified in the Contract between the parties.

B. Definitions

General Statement

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Specific definitions:

(a) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean [Insert Name of Business Associate].

(b) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean SCDHHS.

(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

(d) Security incident. “Security incident” shall generally have the same meaning as the term “security incident” at 45 CFR 164.304.

C. Obligations and Activities of Business Associate

Business Associate agrees to:

(a) Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;

(c) Report to Covered Entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware;

(d) Notwithstanding the requirements of 45 CFR 164.410, Business Associate shall notify Covered Entity of potential breaches within fifteen (15) calendar days of discovery and include Covered Entity’s designee in their breach determination process;

(e) Business Associate shall report security incidents on a quarterly basis, unless the severity of the security incident elevates the risk to a potential breach, in which case paragraph (d) takes precedence;

(f) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;

(g) Make available protected health information in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;

(h) Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45

CFR 164.526;

(i) Maintain and make available the information required to provide an accounting of disclosures to Covered Entity, or an individual if directed by Covered Entity, as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;

(j) Notify Covered Entity within five (5) business days of receipt of any request covered under paragraphs (h), (i) or (j) above;

(k) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and

(l) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

D. Permitted Uses and Disclosures by Business Associate

(a) Business associate may only use or disclose protected health information as necessary to perform the services set forth in the Contract to which this Agreement is appended, including, if applicable, authorization to use protected health information to de-identify the information in accordance with 45 CFR 164,514(a)-(c);

(b) Business Associate may use or disclose protected health information as required by law;

(c) Business Associate agrees to make uses and disclosures and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures;

(d) Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity;

(e) Business Associate may disclose protected health information for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Business Associate may not disclose or duplicate protected health information identified by Covered Entity as provided by the Social Security Administration (SSA) without written approval and permission from SSA. If the need for such disclosure and/or duplication arises, Business Associate must notify Covered Entity and work with Covered Entity to obtain approval and permission from SSA.

E. Term and Termination

(a) Term. The Term of this Agreement shall be effective as of and shall terminate on the effective and termination dates of the Contract to which this Agreement is appended, or on the date Covered Entity terminates for cause as authorized in paragraph (b) of this Section, whichever is sooner;

(b) Termination for Cause. Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not cured the breach or ended the violation within thirty (30) calendar days.

(c) Obligations of Business Associate Upon Termination.

(1) Upon termination of this Agreement for any reason, Business Associate shall return to Covered Entity, or, if agreed to by Covered Entity, destroy all protected health information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity that the Business Associate still maintains in any form. Business Associate shall retain no copies of the protected health information;

(2) In the event that Business Associate determines that returning or destroying the protected health information is not practical or possible, Business Associate shall notify Covered Entity of the conditions and reasons return of the protected health information is not practical or possible. Upon concurrence by Covered Entity that return is not practical, Business Associate shall:

(i) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section, for as long as Business Associate retains the protected health information;

(ii) Not use or disclose the protected health information retained by Business Associate other than for the purposes for which such protected health information was retained and subject to the same conditions set out at Section D of this Appendix.

(3) Business Associate shall obtain or ensure the destruction of protected health information created, received, or maintained by any subcontractors;

(4) Business Associate shall transmit the protected health information to another Business Associate of the Covered Entity at termination, upon receipt of a written request from the Covered Entity.

(d) Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement.

F. Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

(b) Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

ATTACHMENT 006 - Organizational Conflict of Interest Disclosure

I. INSTRUCTIONS

Read Part II carefully. If a disclosure statement is required, please provide a narrative statement in Part III. If a representation is submitted, please complete Part IV. Complete Part V in every case.

II. ORGANIZATIONAL CONFLICT OF INTEREST DISCLOSURE OR

REPRESENTATION

It is the policy of State of South Carolina (State) to avoid situations which place an Offeror in a position where its judgment may be biased because of any past, present, or currently planned interest, financial or otherwise, the Offeror may have which relates to the work performed pursuant to this solicitation or where the Offeror’s performance of such work may provide it with an unfair competitive advantage. (As used herein “Offeror” means the proposer or any of its affiliates or proposed consultants or subcontractors of any tier.)

Therefore:

(a) The Offeror shall provide a statement which describes in a concise manner all relevant facts concerning any past, present or currently planned interest (financial, contractual, organizational, or otherwise) relating to the work to be performed hereunder and bearing on whether the Offeror has a possible organizational conflict of interest with respect to (1) being able to render impartial, technically sound, and other objective assistance or advise, or (2) being given an unfair competitive advantage. The Offeror may also provide relevant facts that demonstrate how possible organizational conflict of interest relating to other divisions or sections of the organization(s) or its existing organizational structure or system might be avoided or mitigated. This information should be provided in narrative form in Part III.

(b) In the absence of any relevant interest referred to above, the Offeror shall submit a statement certifying that to its best knowledge and belief no such facts exist relevant to possible organizational conflicts of interest. The Offeror’s statement pursuant to this paragraph as well as any statement required to be submitted under (a) above shall include statements form proposed consultants and subcontractors at any tier if relevant.

Offeror is responsible for submitting all such information as part of its certification.

(c) The State will review the statement submitted and may require additional relevant information from the Offeror. All such information, and any other relevant information will be used by State to determine whether an award to the Offeror may create an organizational conflict of interest. If found to exist, State may (1) impose appropriate conditions which avoid such conflict, (2) disqualify the Offeror, or (3) determine that it is otherwise in the best interest of the State to contract with the Offeror by including appropriate conditions mitigating such conflict in the contract awarded.

(d) The refusal to provide the disclosure or representation of any additional information as required shall result in disqualification of the Offeror for award. The nondisclosure or misrepresentation of any relevant interest may also result in the disqualification of the

Offeror for award, or if such nondisclosure or misrepresentation is discovered after award, the State may terminate the contract for default, disqualify the contractor from subsequent related contracts, or subject the contractor to such other remedial actions as may be permitted or provided by law.

(e) No award shall be made until the disclosure or representation has been evaluated by State.

III. DISCLOSURE STATEMENT: (attach additional pages if more space is needed)

(Offeror to provide a concise narrative of any potential conflicts)

IV. REPRESENTATION

The Offeror, ___________________________________________________, hereby represents that it is aware of no past, present, or currently planned interest (financial, contractual, organizational, or otherwise) relating to the work to be performed under the contract resulting from Request for Proposal No. 54000XXXXX that would indicate any impingement upon its ability to render impartial, technically sound, and objective assistance or advice or result in it being given an unfair competitive advantage. This representation applies to all affiliates of the Offeror and its proposed consultants or subcontractors of any tier.

V. SIGNATURE

Offeror’s

Name___________________________________________________________________ RFP/Contract No. 54000XXXXX Signature___________________________________________________________________ Title_______________________________________________________________________ Date_______________________________________________________________________

ATTACHMENT 007 – CERTIFICATION FOR CONTRACTS, GRANTS, LOANS AND COOPERATIVE

AGREEMENTS

Instructions The attached form must be completed by all Providers/Contractors who receive $100,000 or more in federal funds through a contractual agreement with the South Carolina Department of Health and Human Services (SCDHHS).

The purpose of the attached form is to certify that none of the federal funds received through the contractual agreement will be used for any lobbying activities. This form is required by the Federal Government as a result of 31 U.S.C. 1352. A copy of this form must be completed and returned with all signed contractual agreements exceeding $100,000.

Additionally, should the Provider/Contractor enter into any Subcontracts in coordination with the contractual agreement with SCDHHS, the Provider/Contractor is required to have on file a signed copy of this form for any and all Subcontracts which exceed the $100,000 level. This requirement extends to all levels of subcontracting and sub subcontracting.

Should the Provider/Contractor (or any of its Subcontractors/ Sub-subcontractors) use any funds for lobbying activities, an additional form (Standard Form LLL) will be required. (See #2 below). It shall be the responsibility of the Provider/Contractor to notify SCDHHS of this activity and to request from SCDHHS a copy of this form for completion and proper filing.

Should there be any questions concerning this form or the Standard Form LLL, contact should be made with the Division of Contracts at SCDHHS.

CERTIFICATION FOR CONTRACTS, GRANTS, LOANS, AND COOPERATIVE AGREEMENTS

The undersigned certifies, to the best of his or her knowledge and belief, that

1. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement

2. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form LLL, "Disclosure Form to Report Lobbying" in accordance with its instructions.

3. The undersigned shall require that the language of this certification be included in the award documents for all sub awards at all tiers (including subcontracts, sub grants, and contracts under grants, loans, and cooperative agreements) and that all sub recipients shall certify and disclose accordingly.

This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed under Section 1352, Title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000.00 for such failure.

SIGNATURE: ___________________________________________

TITLE: ________________________________________________

DATE: ________________________________________________

2016 2017 2018 31,746 31,317 30,795 11,555 10,705 8,235

SCDHHS NURSE AIDE REGISTRATION STATISTICS

Candiates Certified Renewals Processed

NURSING FACILITY

Abbeville County Hospital - vent - Swing Bed Abbeville Nursing Home Allendale County Hospital Anchor Rehabilitation and Healthcare Center of Aiken, LLC Anchor Rehabilitation and Healthcare Center of Aiken, LLC - COMPLEX CARE Autumn Care of Saluda Bayview Manor, LLC South Carolina Baptist Ministries for the Aging, Inc. dba Bethea Baptist Healthcare Center Blue Ridge in Brookview House Blue Ridge in Brookview House - COMPLEX CARE Blue Ridge in Georgetown Blue Ridge in the Fields Blue Ridge of Sumter Blue Ridge of Sumter - COMPLEX CARE Brian Center of St. Andrews Brunswick Health and Rehab Brushy Creek Rehabilitation C. M. Tucker, Jr. Nursing Care Center - Roddey Pavillion C.M. Tucker, Jr. Nursing Care Center - Stone & Fewell & Dowdy Gardner Calhoun Convalescent Center Capstone Rehabiltiation and Healthcare Center, LLC Capstone Rehabiltiation and Healthcare Center, LLC - COMPLEX CARE Carlyle Senior Care of Aiken dba Azaleawoods Rehab & Nursing Center, LLC Carlyle Senior Care of Florence dba Florence Rehab and Nursing Carlyle Senior Care of Fork dba Sunny Acres Nursing Home Caryle Senior Care of Fountain Inn dba Fountain Inn Nursing Home Cheraw Healthcare, Inc.

Chester Nursing Center Chesterfield Convalescent Center Chesterfield Convalescent Center - COMPLEX CARE Commander Health Care Facility dba Commander Nursing Center Community Services for the Aging Inc DBA Mountainview Nursing Home Compass Post Acute Rehabilitation Compass Post Acute Rehabilitation - COMPLEX CARE Conway Hospital Long Term Care Services, Inc. dba Kingston Nursing Center Conway Hospital Long Term Care Services, Inc. dba Kingston Nursing Center - COMPLEX CARE Conway Manor, LLC Countrywood Nursing Center, LLC Dundee Manor, LLC Ellen Sagar Nursing Home Ellenburg Nursing Center Fairfield Mem. Hospital Fleetwood Rehabilitation and Healthcare Center, LLC Fleetwood Rehabilitation and Healthcare Center, LLC - COMPLEX CARE Florence Rehab & Nursing - COMPLEX CARE Fountain Inn Convalescent Ctr Fountain Inn Convalescent Ctr - COMPLEX CARE Golden Age-Inman, Inc.

Golden Age-Inman, Inc. - COMPLEX CARE Grand Strand Healthcare, Inc.

Greennville Health System dba GHS Lila Doyle Greenville Rehabiltiation and Healthcare Center, LLC Greenville Rehabiltiation and Healthcare Center, LLC - COMPLEX CARE Greer Rehabilitation and Healthcare Center, LLC Greer Rehabilitation and Healthcare Center, LLC - COMPLEX CARE HCR Manorcare dba Heartland of West Ashley Rehab. & Nursing Center Heartland Health Care Center -Greenville West Heartland Health Care Center of Hanahan Heartland Health Care Center-Greenville East Heartland of Columbia Rehab. & Nursing Center Heritage at Lowman Rehab. & Healthcare, The Heritage at Lowman Rehabilitation and Healthcare Heritage Home of Florence Honorage Nursing Home Inman Healthcare, Inc.

Inman Healthcare, Inc.

Iva Rehabiltiation and Healthcare Center, LLC Iva Rehabiltiation and Healthcare Center, LLC - COMPLEX CARE J. F. Hawkins Nursing Home John Edward Harter Nursing Center Johns Island Rehabilitation and Healthcare Center, LLC Johns Island Rehabilitation and Healthcare Center, LLC - COMPLEX CARE Kershaw Health Karesh Long Term Care dba Karesh Long Term Care Kershaw health Karesh LTC COMPLEX CARE Kingstree Nursing Facility Lake Marion Nursing Facility, Inc.

Lake Marion Nursing Facility, Inc. Complex Care Lake Moultrie Nursing Home Lake Moultrie Nursing Home Complex Care Lancaster Health Care dba Lancaster Convalescent Center Lancaster Health Care dba Lancaster Convalescent Center-Compex Care Laurel Baye Healthcare of Blackville Laurel Baye Healthcare of Williston, LLC Lexmed, Inc. dba Lexington Medical Center Extended Care Lexmed, Inc. dba Lexington Medical Center Extended Care-Complex Care Life Care Center of Charleston Life Care Center of Columbia Life Care Center of Hilton Head Linley Park Rehabiltiation and Healthcare Center, LLC Linley Park Rehabiltiation and Healthcare Center, LLC-complex care Loris Extended Care (McLeod) COMPLEX CARE Loris Extended Care Center (McLeod) Magnolia Manor-Greenville Magnolia Manor-Greenville COMPLEX CARE Magnolia Manor-Greenwood Magnolia Manor-Greenwood-Complex Care Magnolia Manor-Inman

Magnolia Manor-InmanTHI of South Carolina at Magnolia Place at Greenville, LLC dba Southpointe Healthcare and RehabilitationTHI of South Carolina at Magnolia Place at Greenville, LLC dba Southpointe Healthcare and RehabilitationManna Rehabilitation and Healthcare Center, LLC Manna Rehabilitation and Healthcare Center, LLC-complex care McCormick Rehabilitation and Healthcare Center, LLC McCormick Rehabiltation and Healthcare Center, LLC- COMPLEX CARE McCoy Memorial Nursing Center Cooke McLeod Medical Center (Wilson) McLeod Medical Center (Wilson)-Complex Care McNair, Dr. Ronald E. Memorial Nursing Center Medford Nursing Center, LLC Methodist Oaks, The Millennium Post Acute Rehabilitation Morrell Nursing Center, LLC Mountainview Nursing Home Mt. Pleasant Manor, LLC Mullins Nursing Center NHC Healthcare - Anderson NHC Healthcare - Bluffton NHC Healthcare - Clinton NHC Healthcare - Garden City NHC Healthcare - Greenville NHC Healthcare - Greenwood NHC Healthcare - Laurens NHC Healthcare - Lexington NHC Healthcare - Mauldin NHC Healthcare - N. Augusta NHC Healthcare - Parklane NHC Healthcare - Sumter Oakhaven Nursing Center, LLC Oakmont of Union, SC Palmetto Faith Healthcare Center Palmetto Hallmark Palmetto Jolley Acres Healthcare Center Palmetto Lake City-Scranton Healthcare Palmetto Oakbrook Health & Rehab. Center Palmetto Prince George Healthcare dba Prince George Healthcare Center Palmetto Springdale Healthcare Center St. George Health Care, LLC dba St. George Health Care Center Patewood Rehabilitation and Healthcare Center, LLC Patewood Rehabilitation and Healthcare Center, LLC-complex care Peachtree Operating Group LLC dba Peachtree Centre Pepper Hill Nursing Center Pepper Hill Nursing Center - COMPLEX CARE Physical Rehab and Wellness (Magnolia Manor-Spartanburg) - COMPLEX CARE Physical Rehab and Wellness (Magnolia Place, Inc. at Spartanburg) Poinsett Rehabilitation and Healthcare Center, LLC Poinsett Rehabilitation and Healthcare Center, LLC - COMPLEX CARE

Presbyterian Communities dba Presbyterian Home of South Carolina PruittHeallth - Orangeburg PruittHealth - Aiken PruittHealth - Bamberg Pruitthealth - Barnwell PruittHealth - Columbia PruittHealth - Moncks Corner Pruitthealth - Rock Hill Pruitthealth Dillon PruittHealth Estill - Low Country Pruitthealth Pickens PruittHealth Walterboro/Oakwood Pruitthealth-Blythewood PruittHealth-North Augusta PruittHealth-North Augusta vent PruittHealth-Ridgeway Richard M. Campbell Veterans Nursing Home Ridgeland Nursing Center River Falls Rehabilitation and Healthcare Center, LLC River Falls Rehabiltiation and Healthcare Center - COMPLEX CARE Riverside Health & Rehab Riverside Health & Rehab Riverside Rehabilitation and Healthcare Center, LLC Riverside Rehabilitation and Healthcare Center, LLC Rock Hill Post Acute Care Center Rock Hill Post Acute Care Center - COMPLEX CARE Saluda Nursing Center Sandpiper Convalescent Center Seneca Health & Rehab. Center Seneca Health & Rehab. Center - COMPLEX CARE Simpsonville Rehabilitation and Healthcare Center, LLC Simpsonville Rehabilitation and Healthcare Center, LLC - COMPLEX CARE South Carolina Baptist Ministries for the Aging, Inc. dba Martha Franks Baptist Retirement Center Southern Charm dba OPUS Post Acute Rehab Southern Charm dba OPUS Post Acute Rehab Southern Oaks Rehabiltiation and Healthcare Center, LLC Southern Oaks Rehabiltiation and Healthcare Center, LLC - COMPLEX CARE Southland Health Care Center Spartanburg Healthcare, Inc. dba Valley Falls Terrace SSC Sumter East Operating Company, LLC dba Sumter East Health & Rehab Center St. Lukes Hospital (N. Carolina) Sunny Acres NH - COMPLEX CARE The Ridge Rehabilitation and Healthcare Center, LLC The Ridge Rehabilitation and Healthcare Center, LLC - COMPLEX CARE THI of South Carolina at Camp Care LLC dba Lake Emory Post Acute Care THI of South Carolina at Camp Care LLC dba Lake Emory Post Acute - COMPLEX CARE THI of South Carolina at Columbia LLC DBA Midlands Health and Rehabilitation THI of South Carolina at Columbia, LLC dba Midlands Health and Rehabilitation - COMPLEX CARE THI of South Carolina at Rock Hill dba Magnolia Manor-Rock Hill

THI of South Carolina at Rock Hill dba Magnolia Manor-Rock Hill - COMPLEX CARE THI of South Carolina at Spartanburg dba Magnolia Manor of Spartanburg THI of South Carolina at Spartanburg dba Magnolia Manor-Spartanburg - COMPLEX CARE Veterans Victory House Wesley Commons White Oak at North Grove White Oak Estates White Oak Manor - Charleston White Oak Manor - Columbia White Oak Manor - Lancaster White Oak Manor - Newberry White Oak Manor - Rock Hill White Oak Manor - Spartanburg White Oak Manor - York Williamsburg Regional Hosp.

Windsor Manor Nursing Facility - COMPLEX CARE Windsor Manor, Inc.

Woodruff Manor, LLC dba Spartanburg Regional Health District Services

COUNTY CITY STATE

Abbeville Abbeville SC Abbeville Abbeville SC Allendale Fairfax SC Aiken Aiken SC Aiken Aiken SC Polk Co NC Saluda NC Beaufort Beaufort SC Darlington Darlington SC Cherokee Gaffney SC Cherokee Gaffney SC Georgetown Georgetown SC Fairfield Ridgeway SC Sumter Sumter SC Sumter Sumter SC Richland Columba SC Brunswick Co. North Carolina Ash NC Greenville Greer SC Richland Columbia SC Richland Columbia SC Calhoun St. Matthews SC Pickens Easley SC Pickens Easley SC Aiken Aiken SC Florence Florence SC Dillon Fork SC Greenville Fountain SC Chesterfield Cheraw SC Chester Chester SC Chesterfield Cheraw SC Chesterfield Cheraw SC Florence Florence SC Spartanburg Spartanburg SC Horry Conway SC Horry Conway SC Horry Conway SC Horry Conway SC Horry Conway SC Richland Hopkins SC Marlboro Bennettsville SC Union Union SC Anderson Anderson SC Fairfield Winnsboro SC Pickens Easley SC Pickens Easley SC Florence Florence SC Greenville Fountain Inn SC Greenville Fountain Inn SC Spartanburg Inman SC

Horry Myrtle Beach SC Oconee Seneca SC Greenville Greenville SC Greenville Greenville SC Greenville Greer SC Greenville Greer SC Charleston Charleston SC Greenville Greenville SC Berkeley Hanahan SC Greenville Greenville SC Richland Columbia SC Richland White Rock SC Richland White Rock SC Florence Florence SC Florence Florence SC Spartanburg Inman SC Spartanburg Inman SC Anderson Iva SC Anderson Iva SC Newberry Newberry SC Allendale Fairfax SC Charleston Johns Island SC Charleston Johns Island SC Kershaw Camden SC Kershaw Camden SC Williamsburg Kingstree SC Clarendon Manning SC Clarendon Manning SC Berkeley St. Stephens SC Berkeley St. Stephens SC Lancaster Lancaster SC Lancaster Lancaster SC Barnwell Blackville SC Barnwell Williston SC Lexington Lexington SC Lexington Lexington SC Charleston N. Charleston SC Richland Columbia SC Beaufort Hilton Head Island SC Anderson Anderson SC Anderson Anderson SC Horry Loris SC Horry Loris SC Greenville Greenville SC Greenville Greenville SC Greenwood Greenwood SC Greenwood Greenwood SC

Greenville Greenville SC Greenville Greenville SC Pickens Pickens SC Pickens Pickens SC McCormick McCormick SC McCormick McCormick SC Lee Bishopville SC Darlington Darlington SC Darlington Darlington SC Williamsburg Lake City SC Darlington Darlington SC Orangeburg Orangeburg SC Lexington W. Columbia SC Darlington Hartsville SC Spartanburg Spartanburg SC Charleston Mt. Pleasant SC Marion Mullins SC Anderson Anderson SC Beaufort Bluffton SC Laurens Clinton SC Georgetown Murrells Inlet SC Greenville Greer SC Greenwood Greenwood SC Laurens Laurens SC Lexington W. Columbia SC Greenville Mauldin SC Aiken N. Augusta SC Richland Columbia SC Sumter Sumter SC Darlington Darlington SC Union Union SC Florence Florence SC Dorchester Summerville SC Orangeburg Orangeburg SC Florence Scranton SC Dorchester Summerville SC Georgetown Georgetown SC Kershaw Camden SC Dorchester St. George SC Greenville Greenville SC Greenville Greenville SC Cherokee Gaffney SC Aiken Aiken SC Aiken Aiken SC Spartanburg Spartanburg SC Spartanburg Spartanburg SC

Lexington Lexington SC Orangeburg Orangeburg SC Aiken Aiken SC Bamberg Bamberg SC Barnwell Barnwell SC Richland Columbia SC Berkeley Monck Corner SC York Rock Hill SC Dillon Dillon SC Hampton Estill SC Pickens Six Miles SC Colleton Walterboro SC Richland Columbia SC Aiken N. Augusta SC Aiken N. Augusta SC Fairfield Ridgeway SC Anderson Anderson SC Jasper Ridgeway SC Greenville Marietta SC Greenville Marietta SC Charleston Charleston SC Charleston Charleston SC Orangeburg Orangeburg SC Orangeburg Orangeburg SC York Rock Hill SC York Rock Hill SC Saluda Saluda SC Charleston Mt. Pleasant SC Oconee Seneca SC Oconee Seneca SC Greenville Simpsonville SC Greenville Simpsonville SC Laurens Laurens SC Lexington West Columbia SC Lexington West Columbia SC Anderson Piedmont SC Anderson Piedmont SC Florence Florence SC Spartanburg Spartanburg SC Sumter Sumter SC NC Serv. Area Columbus NC Dillon Fork SC Edgefield Edgefield SC Edgefield Edgefield SC Spartanburg Inmam SC Spartanburg Inmam SC Richland Columbia SC Richland Columbia SC York Rock Hill SC

York Rock Hill SC Spartanburg Spartanburg SC Spartanburg Spartanburg SC Colleton Waterboro SC Greenwood Greenwood SC Spartanburg Spartanburg SC Spartanburg Spartanburg SC Charleston Charleston SC Richland Columbia SC Lancaster Lancaster SC Newberry Newberry SC York Rock Hill SC Spartanburg Spartanburg SC York York SC Willianmsburg Kingstree SC Clarendon Manning SC Clarendon Manning SC Spartanburg Woodruff SC

ATTACHMENT 011 - SERVICE PROVIDER SECURITY ASSESSMENT QUESTIONNAIRE

Instructions: (1) Attach additional pages or documents as appropriate and make sure answers cross reference to the questions below. (2) As used in this Questionnaire, the phrase "government information" shall have the meaning defined in the clause titled "Information Security." (3) This Questionnaire must be read in conjunction with both of the following two clauses (a) Service Provider Security Assessment Questionnaire - Required, and (b) Service Provider Security Representation.

1. Describe your policies and procedures that ensure access to government information is limited to only those of your employees and contractors who require access to perform your proposed services.

2. Describe your disaster recovery and business continuity plans.

3. What safeguards and practices do you have in place to vet your employees and contractors who will have access to government information?

4. Describe and explain your security policies and procedures as they relate to your use of your contractors and next-tier sub -contractors.

5. List any reports or certifications that you have from properly accredited third-parties that demonstrate that adequate security controls and assurance requirements are in place to adequately provide for the confidentiality, integrity, and availability of the information systems used to process, store, transmit, and access all government information. (For example, an ISO/IEC 27001 compliance certificate, an AICPA SOC 2 (Type 2) report, or perhaps an AICPA SOC 3 report (i.e., a SysTrust or WebTrust seal)). For each certification, describe the scope of the assessment performed. Will these reports / certifications remain in place for the duration of the contract? Will you provide the state with most recent and future versions of the applicable compliance certificate / audit report?

6. Describe the policies, procedures and practices you have in place to provide for the physical security of your data centers and other sites where government information will be hosted, accessed or maintained.

7. Will government information be encrypted at rest? Will government information be encrypted when transmitted?

Will government information be encrypted during data backups, and on backup media? Please elaborate.

8. Describe safeguards that are in place to prevent unauthorized use, reuse, distribution, transmission, manipulation, copying, modification, access or disclosure of government information.

9. What controls are in place to detect security breaches? What system and network activity do you log? How long do you maintain these audit logs?

10. How will government information be managed after contract termination? Will government information provided to the Contractor be deleted or destroyed? When will this occur?

11. Describe your incident response policies and practices.

12. Identify any third party which will host or have access to government information.

Offeror's response to this questionnaire includes any other information submitted with its offer regarding information or data security.

SIGNATURE OF PERSON AUTHORIZED TO REPRESENT THE ACCURACY OF THIS INFORMATION ON

BEHALF OF CONTRACTOR:

By: ____________________________________ (Authorized signature)

Its: ____________________________________ (Printed name of person signing above)

(Title of person signing above)

Date: ____________________________________

SPSAQ (FEB 2015) [09-9025-1]