Contract 2532-61760 Solid Ground.docx

Special Terms and Conditions

SERVICES CONTRACT

Community Assemblies & Community Compensation Distribution DSHS Contract Number:

2532-61760 Resulting From Procurement Number:

Contractor Contract Number:

CONTRACTOR NAME

Solid Ground Washington CONTRACTOR doing business as (DBA) Statewide Poverty Action Network

CONTRACTOR ADDRESS

1501 N 45th St Seattle, WA 98103

WASHINGTON UNIFORM BUSINESS IDENTIFIER (UBI)

600-147-686

DSHS INDEX NUMBER

CONTRACTOR CONTACT

Marcy Bowers

CONTRACTOR TELEPHONE

(206) 694-6794

CONTRACTOR FAX

(206) 694-6777

CONTRACTOR E-MAIL ADDRESS

marcy@povertyaction.org

DSHS ADMINISTRATION

Economic Services Administration

DSHS DIVISION

Office of the Assistant Secretary

DSHS CONTRACT CODE

3900PC-32

DSHS CONTACT NAME AND TITLE

Lindsay Tracy Chief

DSHS CONTACT ADDRESS

724 Quince Street SE

Olympia, WA 98504

DSHS CONTACT TELEPHONE

(720)346-8774

DSHS CONTACT FAX

Click here to enter text.

DSHS CONTACT E-MAIL ADDRESS

tracylm@dshs.wa.gov

IS THE CONTRACTOR A SUBRECIPIENT FOR PURPOSES OF THIS CONTRACT?

No

ASSISTANCE LISTING NUMBER(S)

CONTRACT START DATE

06/16/2025

CONTRACT END DATE

08/31/2025

CONTRACT MAXIMUM AMOUNT

$56,861.00

EXHIBITS. The following Exhibits are attached and are incorporated into this Contract by reference:

|_| Exhibits (specify): Exhibit A - Data Security Requirements |_| No Exhibits.

The terms and conditions of this Contract are an integration and representation of the final, entire and exclusive understanding between the parties superseding and merging all previous agreements, writings, and communications, oral or otherwise, regarding the subject matter of this Contract. The parties signing below represent that they have read and understand this Contract, and have the authority to execute this Contract. This Contract shall be binding on DSHS only upon signature by DSHS.

CONTRACTOR SIGNATURE

Draft - Please Do Not Sign

PRINTED NAME AND TITLE

DATE SIGNED

DSHS SIGNATURE

Draft - Please Do Not Sign

PRINTED NAME AND TITLE

DATE SIGNED

DSHS Central Contract Services 6013PF Custom Professional Service Contract (7-18-2024) Page 3 Definitions. The words and phrases listed below, as used in this Contract, shall each have the following definitions:

“Central Contracts and Legal Services” means the DSHS central headquarters contracting office, or successor section or office.

“Confidential Information” or “Data” means information that is exempt from disclosure to the public or other unauthorized persons under RCW 42.56 or other federal or state laws. Confidential Information includes, but is not limited to, Personal Information.

“Contract” or “Agreement” means the entire written agreement between DSHS and the Contractor, including any Exhibits, documents, or materials incorporated by reference. The parties may execute this contract in multiple counterparts, each of which is deemed an original and all of which constitute only one agreement. E-mail or Facsimile transmission of a signed copy of this contract shall be the same as delivery of an original.

“CCLS Chief” means the manager, or successor, of Central Contracts and Legal Services or successor section or office.

“Contractor” means the individual or entity performing services pursuant to this Contract and includes the Contractor’s owners, members, officers, directors, partners, employees, and/or agents, unless otherwise stated in this Contract. For purposes of any permitted Subcontract, “Contractor” includes any Subcontractor and its owners, members, officers, directors, partners, employees, and/or agents.

“Debarment” means an action taken by a Federal agency or official to exclude a person or business entity from participating in transactions involving certain federal funds.

“DSHS” or the “Department” means the state of Washington Department of Social and Health Services and its employees and authorized agents.

“Encrypt” means to encode Confidential Information into a format that can only be read by those possessing a “key;” a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available.

“Personal Information” means information identifiable to any person, including, but not limited to, information that relates to a person’s name, health, finances, education, business, use or receipt of governmental services or other activities, addresses, telephone numbers, Social Security Numbers, driver license numbers, other identifying numbers, and any financial identifiers.

“Physically Secure” means that access is restricted through physical means to authorized individuals only.

“Program Agreement” means an agreement between the Contractor and DSHS containing special terms and conditions, including a statement of work to be performed by the Contractor and payment to be made by DSHS.

“RCW” means the Revised Code of Washington. All references in this Contract to RCW chapters or sections shall include any successor, amended, or replacement statute. Pertinent RCW chapters can be accessed at http://apps.leg.wa.gov/rcw/.

“Regulation” means any federal, state, or local regulation, rule, or ordinance.

“Secured Area” means an area to which only authorized representatives of the entity possessing the Confidential Information have access. Secured Areas may include buildings, rooms or locked storage containers (such as a filing cabinet) within a room, as long as access to the Confidential Information is not available to unauthorized personnel.

“Subcontract” means any separate agreement or contract between the Contractor and an individual or entity (“Subcontractor”) to perform all or a portion of the duties and obligations that the Contractor is obligated to perform pursuant to this Contract.

“Tracking” means a record keeping system that identifies when the sender begins delivery of Confidential Information to the authorized and intended recipient, and when the sender receives confirmation of delivery from the authorized and intended recipient of Confidential Information.

“Trusted Systems” include only the following methods of physical delivery: (1) hand-delivery by a person authorized to have access to the Confidential Information with written acknowledgement of receipt; (2) United States Postal Service (“USPS”) first class mail, or USPS delivery services that include Tracking, such as Certified Mail, Express Mail or Registered Mail; (3) commercial delivery services (e.g. FedEx, UPS, DHL) which offer tracking and receipt confirmation; and (4) the Washington State Campus mail system. For electronic transmission, the Washington State Governmental Network (SGN) is a Trusted System for communications within that Network.

“WAC” means the Washington Administrative Code. All references in this Contract to WAC chapters or sections shall include any successor, amended, or replacement regulation. Pertinent WAC chapters or sections can be accessed at http://apps.leg.wa.gov/wac/.

Amendment. This Contract may only be modified by a written amendment signed by both parties. Only personnel authorized to bind each of the parties may sign an amendment.

Assignment. The Contractor shall not assign this Contract or any Program Agreement to a third party without the prior written consent of DSHS.

Billing Limitations.

DSHS shall pay the Contractor only for authorized services provided in accordance with this Contract.

DSHS shall not pay any claims for payment for services submitted more than twelve (12) months after the calendar month in which the services were performed.

The Contractor shall not bill and DSHS shall not pay for services performed under this Contract, if the Contractor has charged or will charge another agency of the state of Washington or any other party for the same services.

Compliance with Applicable Law and Washington State Requirements.

Applicable Law. Throughout the performance of this Agreement, Contractor shall comply with all federal, state, and local laws, regulations, and executive orders to the extent they are applicable to this Agreement.

Civil Rights and Nondiscrimination. Contractor shall comply with all federal and state civil rights and nondiscrimination laws, regulations, and executive orders to the extent they are applicable to this Agreement, including, but not limited to, and as amended, Titles VI and VII of the Civil Rights Act of 1964; Sections 503 and 504 of the Rehabilitation Act of 1973; the Americans with Disabilities Act (ADA); Executive Order 11246; the Health Insurance Portability and Accountability Act of 1996 (HIPAA); the Age Discrimination in Employment Act of 1967, the Age Discrimination Act of 1975, the Vietnam Era Veterans’ Readjustment Assistance Act of 1974, and Chapter 49.60 of the Revised Code of Washington, Washington’s Law Against Discrimination. These laws, regulations and executive orders are incorporated by reference herein to the extent that they are applicable to the Contract and required by law to be so incorporated.

In the event of the Contractor’s noncompliance or refusal to comply with any applicable nondiscrimination laws, regulations, and executive orders, this Agreement may be rescinded, canceled, or terminated in whole or in part.

Nondiscrimination.

Nondiscrimination Requirement. During the term of this Contract, Contractor, including any subcontractor, shall not discriminate on the bases enumerated at RCW 49.60.530(3). In addition, Contractor, including any subcontractor, shall give written notice of this nondiscrimination requirement to any labor organizations with which Contractor, or subcontractor, has a collective bargaining or other agreement.

Obligation to Cooperate. Contractor, including any subcontractor, shall cooperate and comply with any Washington state agency investigation regarding any allegation that Contractor, including any subcontractor, has engaged in discrimination prohibited by this Contract pursuant to RCW 49.60.530(3).

Certification Regarding Russian Government Contracts and/or Investments. Contractor shall abide by the requirements of Governor Jay Inslee’s Directive 22-03 and all subsequent amendments. The Contractor, by signature to this Contract, certifies that the Contractor is not presently an agency of the Russian government, an entity which is Russian-state owned to any extent, or an entity sanctioned by the United States government in response to Russia’s invasion of Ukraine. The Contractor also agrees to include the above certification in any and all Subcontracts into which it enters. The Contractor shall immediately notify DSHS if, during the term of this Contract, Contractor does not comply with this certification. DSHS may immediately terminate this Contract by providing Contractor written notice if Contractor does not comply with this certification during the term hereof.

Confidentiality.

The Contractor shall not use, publish, transfer, sell or otherwise disclose any Confidential Information gained by reason of this Contract for any purpose that is not directly connected with Contractor’s performance of the services contemplated hereunder, except:

as provided by law; or, in the case of Personal Information, with the prior written consent of the person or personal representative of the person who is the subject of the Personal Information.

The Contractor shall protect and maintain all Confidential Information gained by reason of this Contract against unauthorized use, access, disclosure, modification or loss. This duty requires the Contractor to employ reasonable security measures, which include restricting access to the Confidential Information by:

Allowing access only to staff that have an authorized business requirement to view the Confidential Information.

Physically Securing any computers, documents, or other media containing the Confidential Information.

Ensure the security of Confidential Information transmitted via fax (facsimile) by:

Verifying the recipient phone number to prevent accidental transmittal of Confidential Information to unauthorized persons.

Communicating with the intended recipient before transmission to ensure that the fax will be received only by an authorized person.

Verifying after transmittal that the fax was received by the intended recipient.

When transporting six (6) or more records containing Confidential Information, outside a Secured Area, do one or more of the following as appropriate:

Use a Trusted System.

Encrypt the Confidential Information, including:

Encrypting email and/or email attachments which contain the Confidential Information.

Encrypting Confidential Information when it is stored on portable devices or media, including but not limited to laptop computers and flash memory devices.

Note: If the DSHS Data Security Requirements Exhibit is attached to this contract, this item, 6.b.(4), is superseded by the language contained in the Exhibit.

Send paper documents containing Confidential Information via a Trusted System.

Following the requirements of the DSHS Data Security Requirements Exhibit, if attached to this contract.

Upon request by DSHS, at the end of the Contract term, or when no longer needed, Confidential Information shall be returned to DSHS or Contractor shall certify in writing that they employed a DSHS approved method to destroy the information. Contractor may obtain information regarding approved destruction methods from the DSHS contact identified on the cover page of this Contract.

Paper documents with Confidential Information may be recycled through a contracted firm, provided the contract with the recycler specifies that the confidentiality of information will be protected, and the information destroyed through the recycling process. Paper documents containing Confidential Information requiring special handling (e.g. protected health information) must be destroyed on-site through shredding, pulping, or incineration.

Notification of Compromise or Potential Compromise. The compromise or potential compromise of Confidential Information must be reported to the DSHS Contact designated on the contract within one (1) business day of discovery. Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DSHS.

Debarment Certification. The Contractor, by signature to this Contract, certifies that the Contractor is not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded by any Federal department or agency from participating in transactions (Debarred). The Contractor also agrees to include the above requirement in any and all Subcontracts into which it enters. The Contractor shall immediately notify DSHS if, during the term of this Contract, Contractor becomes Debarred. DSHS may immediately terminate this Contract by providing Contractor written notice if Contractor becomes Debarred during the term hereof.

E-Signature and Records. An electronic signature or electronic record of this Contract or any other ancillary agreement shall be deemed to have the same legal effect as delivery of an original executed copy of this Contract or such other ancillary agreement for all purposes.

Governing Law and Venue. This Contract shall be construed and interpreted in accordance with the laws of the state of Washington and the venue of any action brought hereunder shall be in Superior Court for Thurston County.

Independent Contractor. The parties intend that an independent contractor relationship will be created by this Contract. The Contractor and his or her employees or agents performing under this Contract are not employees or agents of the Department. The Contractor, his or her employees, or agents performing under this Contract will not hold himself/herself out as, nor claim to be, an officer or employee of the Department by reason hereof, nor will the Contractor, his or her employees, or agent make any claim of right, privilege or benefit that would accrue to such officer or employee.

Inspection. The Contractor shall, at no cost, provide DSHS and the Office of the State Auditor with reasonable access to Contractor’s place of business, Contractor’s records, and DSHS client records, wherever located. These inspection rights are intended to allow DSHS and the Office of the State Auditor to monitor, audit, and evaluate the Contractor’s performance and compliance with applicable laws, regulations, and these Contract terms. These inspection rights shall survive for six (6) years following this Contract’s termination or expiration.

Maintenance of Records. The Contractor shall maintain records relating to this Contract and the performance of the services described herein. The records include, but are not limited to, accounting procedures and practices, which sufficiently and properly reflect all direct and indirect costs of any nature expended in the performance of this Contract. All records and other material relevant to this Contract shall be retained for six (6) years after expiration or termination of this Contract.

Without agreeing that litigation or claims are legally authorized, if any litigation, claim, or audit is started before the expiration of the six (6) year period, the records shall be retained until all litigation, claims, or audit findings involving the records have been resolved.

Order of Precedence. In the event of any inconsistency or conflict between the General Terms and Conditions and the Special Terms and Conditions of this Contract or any Program Agreement, the inconsistency or conflict shall be resolved by giving precedence to these General Terms and Conditions. Terms or conditions that are more restrictive, specific, or particular than those contained in the General Terms and Conditions shall not be construed as being inconsistent or in conflict.

Severability. If any term or condition of this Contract is held invalid by any court, the remainder of the Contract remains valid and in full force and effect.

Survivability. The terms and conditions contained in this Contract or any Program Agreement which, by their sense and context, are intended to survive the expiration or termination of the particular agreement shall survive. Surviving terms include, but are not limited to: Billing Limitations; Confidentiality, Disputes; Indemnification and Hold Harmless, Inspection, Maintenance of Records, Notice of Overpayment, Ownership of Material, Termination for Default, Termination Procedure, and Treatment of Property.

Contract Renegotiation, Suspension, or Termination Due to Change in Funding.

If the funds DSHS relied upon to establish this Contract or Program Agreement are withdrawn, reduced or limited, or if additional or modified conditions are placed on such funding, after the effective date of this contract but prior to the normal completion of this Contract or Program Agreement:

At DSHS’s discretion, the Contract or Program Agreement may be renegotiated under the revised funding conditions.

At DSHS’s discretion, DSHS may give notice to Contractor to suspend performance when DSHS determines that there is reasonable likelihood that the funding insufficiency may be resolved in a timeframe that would allow Contractor’s performance to be resumed prior to the normal completion date of this contract.

During the period of suspension of performance, each party will inform the other of any conditions that may reasonably affect the potential for resumption of performance.

When DSHS determines that the funding insufficiency is resolved, it will give Contractor written notice to resume performance. Upon the receipt of this notice, Contractor will provide written notice to DSHS informing DSHS whether it can resume performance and, if so, the date of resumption. For purposes of this subsubsection, “written notice” may include email.

If the Contractor’s proposed resumption date is not acceptable to DSHS and an acceptable date cannot be negotiated, DSHS may terminate the contract by giving written notice to Contractor. The parties agree that the Contract will be terminated retroactive to the date of the notice of suspension. DSHS shall be liable only for payment in accordance with the terms of this Contract for services rendered prior to the retroactive date of termination.

DSHS may immediately terminate this Contract by providing written notice to the Contractor. The termination shall be effective on the date specified in the termination notice. DSHS shall be liable only for payment in accordance with the terms of this Contract for services rendered prior to the effective date of termination. No penalty shall accrue to DSHS in the event the termination option in this section is exercised.

Waiver. Waiver of any breach or default on any occasion shall not be deemed to be a waiver of any subsequent breach or default. Any waiver shall not be construed to be a modification of the terms and conditions of this Contract. Only the CCLS Chief or designee has the authority to waive any term or condition of this Contract on behalf of DSHS.

Additional General Terms and Conditions – Professional Service Contracts:

Advance Payment. DSHS shall not make any payments in advance or anticipation of the delivery of services to be provided pursuant to this Contract.

Construction. The language in this Contract shall be interpreted as to its fair meaning and not strictly for or against any party. Any rule of construction to the effect that ambiguities are to be resolved against the drafting party shall not apply in interpreting this Contract.

Contractor Certification Regarding Ethics. The Contractor certifies that the Contractor is now, and shall remain, in compliance with Chapter 42.52 RCW, Ethics in Public Service, throughout the term of this Contract.

DES Filing Requirement. Under RCW 39.26, sole source contracts and amendments must be filed with the State of Washington Department of Enterprise Services (DES). If this Contract is one that must be filed, it shall not be effective nor shall work commence or payment be made until the fifteenth (15th) working day following the date of filing subject to DES approval. In the event DES fails to approve the Contract or any amendment hereto, the Contract or amendment shall be null and void.

Health and Safety. Contractor shall perform any and all of its obligations under this Contract in a manner that does not compromise the health and safety of any DSHS client with whom the Contractor has contact.

Indemnification and Hold Harmless.

The Contractor shall be responsible for and shall indemnify, defend, and hold DSHS harmless from any and all claims, costs, charges, penalties, demands, losses, liabilities, damages, judgments, or fines, of whatsoever kind of nature, arising out of or relating to a) the Contractor’s or any Subcontractor’s performance or failure to perform this Contract, or b) the acts or omissions of the Contractor or any Subcontractor.

The Contractor’s duty to indemnify, defend, and hold DSHS harmless from any and all claims, costs, charges, penalties, demands, losses, liabilities, damages, judgments, or fines shall include DSHS’ personnel-related costs, reasonable attorney’s fees, court costs, and all related expenses.

The Contractor waives its immunity under Title 51 RCW to the extent it is required to indemnify, defend, and hold harmless the State and its agencies, officials, agents, or employees.

Nothing in this term shall be construed as a modification or limitation on the Contractor’s obligation to procure insurance in accordance with this Contract or the scope of said insurance.

Industrial Insurance Coverage. The Contractor shall comply with the provisions of Title 51 RCW, Industrial Insurance. If the Contractor fails to provide industrial insurance coverage or fails to pay premiums or penalties on behalf of its employees, as may be required by law, Agency may collect from the Contractor the full amount payable to the Industrial Insurance accident fund. The Agency may deduct the amount owed by the Contractor to the accident fund from the amount payable to the Contractor by the Agency under this contract, and transmit the deducted amount to the Department of Labor and Industries, (L&I) Division of Insurance Services. This provision does not waive any of L&I’s rights to collect from the Contractor.

Publicity. The Contractor shall not name DSHS as a customer, nor use any information related to this Contract, in any format or media, in any Contractor’s advertising or publicity without prior written consent from DSHS.

Notice of Overpayment. If the Contractor receives a vendor overpayment notice or a letter communicating the existence of an overpayment from DSHS, the Contractor may protest the overpayment determination by requesting an adjudicative proceeding. The Contractor’s request for an adjudicative proceeding must:

Be received by the Office of Financial Recovery (OFR) at Post Office Box 9501, Olympia, Washington 98507-9501, within twenty-eight (28) calendar days of service of the notice;

Be sent by certified mail (return receipt) or other manner that proves OFR received the request;

Include a statement as to why the Contractor thinks the notice is incorrect; and Include a copy of the overpayment notice.

Timely and complete requests will be scheduled for a formal hearing by the Office of Administrative Hearings. The Contractor may be offered a pre-hearing or alternative dispute resolution conference in an attempt to resolve the overpayment dispute prior to the hearing.

Failure to provide OFR with a written request for a hearing within twenty-eight (28) days of service of a vendor overpayment notice or other overpayment letter will result in an overpayment debt against the Contractor. DSHS may charge the Contractor interest and any costs associated with the collection of this overpayment. DSHS may collect an overpayment debt through lien, foreclosure, seizure and sale of the Contractor’s real or personal property; order to withhold and deliver; or any other collection action available to DSHS to satisfy the overpayment debt.

Site Security. While providing services at a DSHS location, the Contractor, its agents, employees, or Subcontractors shall conform in all respects with physical, fire, or other security regulations specific to the DSHS location.

Subcontracting. Except as otherwise provided in this Contract, the Contractor shall not Subcontract any of the contracted services without the prior written approval of DSHS. Contractor is responsible to ensure that all terms, conditions, assurances and certifications set forth in this Contract are included in any and all Subcontracts. Any failure of Contractor or its Subcontractors to perform the obligations of this Contract shall not discharge the Contractor from its obligations hereunder or diminish DSHS’ rights or remedies available under this Contract.

Subrecipients.

General. If the Contractor is a subrecipient of federal awards as defined by 2 CFR Part 200 and this Agreement, the Contractor shall:

Maintain records that identify, in its accounts, all federal awards received and expended and the federal programs under which they were received, by Assistance Listing Numbers (ALN) title and number, award number and year, name of the federal agency, and name of the pass-through entity;

Maintain internal controls that provide reasonable assurance that the Contractor is managing federal awards in compliance with laws, regulations, and provisions of contracts or grant agreements that could have a material effect on each of its federal programs;

Prepare appropriate financial statements, including a schedule of expenditures of federal awards;

Incorporate 2 CFR Part 200, Subpart F audit requirements into all agreements between the Contractor and its Subcontractors who are subrecipients;

Comply with the applicable requirements of 2 CFR Part 200, including any future amendments to 2 CFR Part 200, and any successor or replacement Office of Management and Budget (OMB) Circular or regulation; and Comply with the Omnibus Crime Control and Safe streets Act of 1968, Title VI of the Civil Rights Act of 1964, Section 504 of the Rehabilitation Act of 1973, Title II of the Americans with Disabilities Act of 1990, Title IX of the Education Amendments of 1972, The Age Discrimination Act of 1975, and The Department of Justice Non-Discrimination Regulations, 28 C.F.R. Part 42, Subparts C.D.E. and G, and 28 C.F.R. Part 35 and 39. (Go to https://ojp.gov/about/offices/ocr.htm for additional information and access to the aforementioned Federal laws and regulations.)

Single Audit Act Compliance. If the Contractor is a subrecipient and expends $750,000 or more in federal awards from any and/or all sources in any fiscal year, the Contractor shall procure and pay for a single audit or a program-specific audit for that fiscal year. Upon completion of each audit, the Contractor shall:

Submit to the DSHS contact person the data collection form and reporting package specified in 2 CFR Part 200, Subpart F, reports required by the program-specific audit guide (if applicable), and a copy of any management letters issued by the auditor;

Follow-up and develop corrective action for all audit findings; in accordance with 2 CFR Part 200, Subpart F; prepare a “Summary Schedule of Prior Audit Findings” reporting the status of all audit findings included in the prior audit's schedule of findings and questioned costs.

Overpayments. If it is determined by DSHS, or during the course of a required audit, that the Contractor has been paid unallowable costs under this or any Program Agreement, DSHS may require the Contractor to reimburse DSHS in accordance with 2 CFR Part 200.

Termination for Convenience. DSHS may terminate this Contract in whole or in part when it is in the best interest of DSHS by giving the Contractor at least thirty (30) calendar days’ written notice.

Termination for Default. The CCLS Chief may immediately terminate this Contract for default, in whole or in part, by written notice to the Contractor if DSHS has a reasonable basis to believe that the Contractor has:

Failed to meet or maintain any requirement for contracting with DSHS;

Failed to protect the health or safety of any DSHS client;

Failed to perform under, or otherwise breached, any term or condition of this Contract; and/or Violated any applicable law or regulation.

If it is later determined that the Contractor was not in default, the termination shall be considered a termination for convenience.

Termination or Expiration Procedure. The following terms and conditions apply upon Contract termination or expiration:

The Contractor shall cease to perform any services required by this Contract as of the effective date of termination or expiration.

If the Contract is terminated, the Contractor shall comply with all instructions contained in the termination notice.

The Contractor shall immediately deliver to the DSHS contact named on page one of this Contract, or to his or her successor, all DSHS property in the Contractor’s possession. The Contractor grants DSHS the right to enter upon the Contractor’s premises for the sole purpose of recovering any DSHS property that the Contractor fails to return within ten (10) calendar days of the effective date of termination or expiration of this Contract. Upon failure to return DSHS property within ten (10) calendar days, the Contractor shall be charged with all reasonable costs of recovery, including transportation.

DSHS shall be liable only for payment required under the terms of this Contract for service rendered up to the effective date of termination or expiration.

DSHS may withhold a sum from the final payment to the Contractor that DSHS determines necessary to protect DSHS against loss or additional liability.

The rights and remedies provided to DSHS in this Section are in addition to any other rights and remedies provided at law, in equity, and/or under this Contract, including consequential and incidental damages.

Treatment of Property. All property purchased or furnished by DSHS for use by the Contractor during this Contract term shall remain with DSHS. Title to all property purchased or furnished by the Contractor for which the Contractor is entitled to reimbursement by DSHS under this Contract shall pass to and vest in DSHS. The Contractor shall protect, maintain, and insure all DSHS property in its possession against loss or damage and shall return DSHS property to DSHS upon Contract termination or expiration.

Taxes.

Where required by statute or regulation, Contractor shall pay for and maintain in current status all taxes that are necessary for Contract performance. DSHS will pay sales or use taxes, if any, imposed on the services and materials acquired hereunder. Contractor must pay all other taxes including without limitation Washington Business and Occupation Tax, other taxes based on Contractor’s income or gross receipts, or personal property taxes levied or assessed on Contractor’s personal property. DSHS, as an agency of Washington State government, is exempt from property tax.

Contractor shall complete registration with the Washington State Department of Revenue and be responsible for payment of all taxes due on payments made under this Contract in accordance with the requirements of Title 82 RCW and Title 458 WAC. Out-of-state Contractors must contact the Department of Revenue to determine whether they meet criteria to register and establish an account with the Department of Revenue. Refer to WAC 458-20-101 (Tax registration and tax reporting) and call the Department of Revenue at 800-647-7706 for additional information. When out-of-state Contractors are not required to collect and remit sales tax, DSHS shall be responsible for paying use tax, if applicable, directly to the Department of Revenue.

All payments accrued on account of payroll taxes, unemployment contributions, any other taxes, insurance, or other expenses for Contractor or Contractor’s staff shall be Contractor’s sole responsibility.

HIPAA Compliance Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA.

Definitions “Business Associate,” as used in this Contract, means the “Contractor” and generally has the same meaning as the term “business associate” at 45 CFR 160.103. Any reference to Business Associate in this Contract includes Business Associate’s employees, agents, officers, Subcontractors, third party contractors, volunteers, or directors.

“Business Associate Agreement” means this HIPAA Compliance section of the Contract and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights.

“Breach” means the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected Health Information, with the exclusions and exceptions listed in 45 CFR 164.402.

“Covered Entity” means DSHS, a Covered Entity as defined at 45 CFR 160.103, in its conduct of covered functions by its health care components.

“Designated Record Set” means a group of records maintained by or for a Covered Entity, that is: the medical and billing records about Individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used in whole or part by or for the Covered Entity to make decisions about Individuals.

“Electronic Protected Health Information (EPHI)” means Protected Health Information that is transmitted by electronic media or maintained in any medium described in the definition of electronic media at 45 CFR 160.103.

“HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, as modified by the American Recovery and Reinvestment Act of 2009 (“ARRA”), Sec. 13400 – 13424, H.R. 1 (2009) (HITECH Act).

“HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and Part 164.

“Individual(s)” means the person(s) who is the subject of PHI and includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

“Minimum Necessary” means the least amount of PHI necessary to accomplish the purpose for which the PHI is needed.

“Protected Health Information (PHI)” means individually identifiable health information created, received, maintained or transmitted by Business Associate on behalf of a health care component of the Covered Entity that relates to the provision of health care to an Individual; the past, present, or future physical or mental health or condition of an Individual; or the past, present, or future payment for provision of health care to an Individual. 45 CFR 160.103. PHI includes demographic information that identifies the Individual or about which there is reasonable basis to believe can be used to identify the Individual. 45 CFR 160.103. PHI is information transmitted or held in any form or medium and includes EPHI. 45 CFR 160.103. PHI does not include education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USCA 1232g(a)(4)(B)(iv) or employment records held by a Covered Entity in its role as employer.

“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system.

“Subcontractor” as used in this HIPAA Compliance section of the Contract (in addition to its definition in the General Terms and Conditions) means a Business Associate that creates, receives, maintains, or transmits Protected Health Information on behalf of another Business Associate.

“Use” includes the sharing, employment, application, utilization, examination, or analysis, of PHI within an entity that maintains such information.

Compliance. Business Associate shall perform all Contract duties, activities and tasks in compliance with HIPAA, the HIPAA Rules, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Office of Civil Rights.

Use and Disclosure of PHI. Business Associate is limited to the following permitted and required uses or disclosures of PHI:

Duty to Protect PHI. Business Associate shall protect PHI from, and shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided for in this Contract or as required by law, for as long as the PHI is within its possession and control, even after the termination or expiration of this Contract.

Minimum Necessary Standard. Business Associate shall apply the HIPAA Minimum Necessary standard to any Use or disclosure of PHI necessary to achieve the purposes of this Contract. See 45 CFR 164.514 (d)(2) through (d)(5).

Disclosure as Part of the Provision of Services. Business Associate shall only Use or disclose PHI as necessary to perform the services specified in this Contract or as required by law, and shall not Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information) if done by Covered Entity, except for the specific uses and disclosures set forth below.

Use for Proper Management and Administration. Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

Disclosure for Proper Management and Administration. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached.

Impermissible Use or Disclosure of PHI. Business Associate shall report to DSHS in writing all Uses or disclosures of PHI not provided for by this Contract within one (1) business day of becoming aware of the unauthorized Use or disclosure of PHI, including Breaches of unsecured PHI as required at 45 CFR 164.410 (Notification by a Business Associate), as well as any Security Incident of which it becomes aware. Upon request by DSHS, Business Associate shall mitigate, to the extent practicable, any harmful effect resulting from the impermissible Use or disclosure.

Failure to Cure. If DSHS learns of a pattern or practice of the Business Associate that constitutes a violation of the Business Associate’s obligations under the terms of this Contract and reasonable steps by DSHS do not end the violation, DSHS shall terminate this Contract, if feasible. In addition, If Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate’s obligations under the terms of their contract and reasonable steps by the Business Associate do not end the violation, Business Associate shall terminate the Subcontract, if feasible.

Termination for Cause. Business Associate authorizes immediate termination of this Contract by DSHS, if DSHS determines that Business Associate has violated a material term of this Business Associate Agreement. DSHS may, at its sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause.

Consent to Audit. Business Associate shall give reasonable access to PHI, its internal practices, records, books, documents, electronic data and/or all other business information received from, or created or received by Business Associate on behalf of DSHS, to the Secretary of DHHS and/or to DSHS for use in determining compliance with HIPAA privacy requirements.

Obligations of Business Associate Upon Expiration or Termination. Upon expiration or termination of this Contract for any reason, with respect to PHI received from DSHS, or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of DSHS, Business Associate shall:

Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

Return to DSHS or destroy the remaining PHI that the Business Associate or any Subcontractors still maintain in any form;

Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respect to Electronic Protected Health Information to prevent Use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI;

Not Use or disclose the PHI retained by Business Associate or any Subcontractors other than for the purposes for which such PHI was retained and subject to the same conditions set out in the “Use and Disclosure of PHI” section of this Contract which applied prior to termination; and Return to DSHS or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

Survival. The obligations of the Business Associate under this section shall survive the termination or expiration of this Contract.

Individual Rights.

Accounting of Disclosures.

Business Associate shall document all disclosures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures.

Within ten (10) business days of a request from DSHS, Business Associate shall make available to DSHS the information in Business Associate’s possession that is necessary for DSHS to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and 164.528(b)(1).

At the request of DSHS or in response to a request made directly to the Business Associate by an Individual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for an accounting of disclosures of PHI.

Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested.

Access Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by DSHS or the Individual as necessary to satisfy DSHS’s obligations under 45 CFR 164.524 (Access of Individuals to Protected Health Information).

When the request is made by the Individual to the Business Associate or if DSHS asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164.524 (Access of Individuals to Protected Health Information) on form, time and manner of access. When the request is made by DSHS, the Business Associate shall provide the records to DSHS within ten (10) business days.

Amendment.

If DSHS amends, in whole or in part, a record or PHI contained in an Individual’s Designated Record Set and DSHS has previously provided the PHI or record that is the subject of the amendment to Business Associate, then DSHS will inform Business Associate of the amendment pursuant to 45 CFR 164.526(c)(3) (Amendment of Protected Health Information).

Business Associate shall make any amendments to PHI in a Designated Record Set as directed by DSHS or as necessary to satisfy DSHS’s obligations under 45 CFR 164.526 (Amendment of Protected Health Information).

Subcontracts and other Third Party Agreements. In accordance with 45 CFR 164.502(e)(1)(ii), 164.504(e)(1)(i), and 164.308(b)(2), Business Associate shall ensure that any agents, Subcontractors, independent contractors or other third parties that create, receive, maintain, or transmit PHI on Business Associate’s behalf, enter into a written contract that contains the same terms, restrictions, requirements, and conditions as the HIPAA compliance provisions in this Contract with respect to such PHI. The same provisions must also be included in any contracts by a Business Associate’s Subcontractor with its own business associates as required by 45 CFR 164.314(a)(2)(b) and 164.504(e)(5) .

Obligations. To the extent the Business Associate is to carry out one or more of DSHS’s obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information), Business Associate shall comply with all requirements that would apply to DSHS in the performance of such obligation(s).

Liability. Within ten (10) business days, Business Associate must notify DSHS of any complaint, enforcement or compliance action initiated by the Office for Civil Rights based on an allegation of violation of the HIPAA Rules and must inform DSHS of the outcome of that action. Business Associate bears all responsibility for any penalties, fines or sanctions imposed against the Business Associate for violations of the HIPAA Rules and for any imposed against its Subcontractors or agents for which it is found liable.

Breach Notification.

In the event of a Breach of unsecured PHI or disclosure that compromises the privacy or security of PHI obtained from DSHS or involving DSHS clients, Business Associate will take all measures required by state or federal law.

Business Associate will notify DSHS within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Contract or not authorized by HIPAA Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health Information as defined in 45 CFR 164.402 (Definitions).

Business Associate will notify the DSHS Contact shown on the cover page of this Contract within one (1) business day by telephone or e-mail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHI, type of Breach, origination and destination of PHI, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the name, address, telephone number, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the DSHS Contact. Business Associate will coordinate and cooperate with DSHS to provide a copy of its investigation and other information requested by DSHS, including advance copies of any notifications required for DSHS review before disseminating and verification of the dates notifications were sent.

If DSHS determines that Business Associate or its Subcontractor(s) or agent(s) is responsible for a Breach of unsecured PHI:

requiring notification of Individuals under 45 CFR § 164.404 (Notification to Individuals), Business Associate bears the responsibility and costs for notifying the affected Individuals and receiving and responding to those…