ESBD_357591_1714160976613_2024 TPC EHR RFP P2.pdf

Initial Plan of Care (IPC) for HCS/CFC (continued) - Revised

Initial Plan of Care (IPC) for TxHmL/CFC - Revised

Initial Plan of Care (IPC) for TxHmL/CFC (continued) Revised

Initial Plan of Care (IPC) for TxHmL/CFC (continued) Revised

User Requirements Supplement

Please complete this section in its entirety and include responses as part of the response to this RFP. A separate version of this section was provided that allows you to record responses along with each requirement.

For each requirement, respond using the following scale:

1 = System meets this requirement fully without additional programming required by Center and the functionality described by this requirement will be provided

2 = System can meet this requirement, but with modifications at an increased cost.

3 = System cannot meet this requirement.

4 = Requirement is not applicable based on the design of the system.

There is a notes field for each requirement that allows for clarifications to responses.

Form Requirements Supplement

Reference Form Requirements Supplement Rating

FRS-1 Please indicate whether the following forms are pre-defined in the system. If the system contains an alternate form that closely resembles the following form, please include a copy of this form.

See the Form Samples Supplement section for copies of the following forms.

N/A

Notes:

FRS-1.010 Authorization for Treatment/Application for Services - Revised

Notes:

FRS-1.020 Financial Assessment - Revised

Notes:

FRS-1.030 Client Agreement - Revised

Notes:

FRS-1.040 Crisis Intake Assessment and Recovery Plan Progress Note Template - Revised

Notes:

FRS-1.050 BMI Adult Screening and Follow-up Progress Note Template Revised

FRS-1.060 Child/Adolescent Weight Assessment and Counseling Progress Note Template - Revised

FRS-1.070 Tobacco Use: Screening and Cessation - Revised

Reference Form Requirements Supplement Rating

FRS-1.080 Wraparound Recovery Plan Child/Adolescent Services -

FRS-1.090 Youth Recovery Plan Revised

Notes:

FRS-1.100 Adult Recovery Plan Revised

Notes:

FRS-1.110 Comprehensive Nursing Assessment - Revised

Notes:

FRS-1.120 Initial Plan of Care (IPC) for HCS/CFC - Revised

Notes:

FRS-1.130 Initial Plan of Care (IPC) for TxHmL/CFC - Revised

Notes:

FRS-1.140 Social Determinants of Health

Notes:

FRS-1.150 Community Living Options

Notes:

FRS-1.160 Habilitation Assessment

Notes:

FRS-1.170 Habilitation Service Plan

Notes:

FRS-1.180 Referral for Probation and Substance Use Disorder

Notes:

FRS-1.190 Uniform Assessment

Notes:

FRS-1.200 Adult Behavioral Health Brief Recovery Plan

Notes:

FRS-1.210 CLAS Demographics

Notes:

FRS-1.220 Follow-up from State Facility Discharge

Notes:

FRS-1.230 PTSD Checklist

Miscellaneous Supplements

Reference Miscellaneous Supplements Rating

Clinical

CLS-1 Allow for the following additional search fields when searching for potential duplicate client records (see CL-060 for existing list):

N/A

Notes:

CLS-1.010 Race

Notes:

CLS-1.020 Phone number

Notes:

CLS-2 Vendor provides annual ICD-10 and DSM-5 updates that are and CMBHS systems. These ICD-10 and DSM-5 updates that are acceptable by HHSC can be automatically uploaded into system.

Service

SVS-1 Artificial Intelligence tools have been successfully implemented that assist staff in improving productivity for generating progress notes and improving the quality of these notes.

Please list the tools that have been implemented, Please list tools that are under consideration for implementation along with a projected timeframe for implementation, Please describe other types of Artificial Intelligence functionality being implemented aside from progress note productivity and quality.

SVS-2 For Group Services, multiple staff may participate in a given group service session. System has the ability to track multiple staff that participate in a given group service session with varying durations of time so that costs for this session can be accurately computed.

SVS-3

Another Type A has already been delivered to the client within the same calendar year/month

The duration of the service is less than 8 minutes If service was delivered by phone and the client does not have another IDD Type A or Type B service that was delivered face-to-face, lasted longer than 7 minutes and was dated within 90 days prior to the service begin entered.

Scheduler

SCS-1

additional criteria (see SC-120 for existing list).

N/A

Notes:

SCS-1.010 Gender Identification

Notes:

SCS-1.020 Sexual Orientation

Notes:

Billing

BLS-1 Ability to print a client statement that shows a client's billed services, payments, and adjustments applied towards those services and any unapplied payments. Note: a description of the service that was delivered is included. The statement includes Payer-related transactions as well as Client-related transactions. The Payer-related transactions include the CPT code that was billed.

BLS-2 On a more than one discount type for a given client based on the types of services the client is receiving (e.g., Substance Use sliding scale, Behavioral Health/IDD monthly ability to pay, Primary Care sliding scale, ECI - monthly ability to pay, etc.).

BLS-3 If a client has more than one discount type identified on their Financial Assessment and the client has received services that were discounted using the different discount types, group the services according to discount type on the client statement and show sub-totals by discount type

BLS-4 Ability to limit a client statement run to just those clients who have new client charges (as opposed to new insurance charges) within a user-defined number of days. For example, only create statements for clients who have gotten new charges within the last 30 days.

BLS-5 For the purpose of billing IDD Service Coordination, do not allow more than Type A service to bill for a given client within the same calendar month and year. Exceptions to this are reported to billing staff.

BLS-6 For billing certain services delivered by phone to Medicaid, confirm

An existing clinical relationship is one in which a person has received an eligible face to face or telemed service from the Center within the 6 months prior to the initial phone service and then annually thereafter. Exceptions to this are reported to billing staff.

BLS-7 Suspense and denial claim tracking module that tracks one or many follow-ups that may be performed for each suspended or denied claim. Staff are assigned responsibility for each follow-up and target completion dates are recorded. System notifies staff responsible for follow-ups of upcoming and past due target completion dates.

Reports Supplement

Reference Reports Supplement Rating

RPS-1 Collects the necessary data and generates the following Certified Community Behavioral Healthcare Center measures:

N/A

Notes:

RPS-1.010 Time to Initial Evaluation (I-SERV)

Notes:

RPS-1.020 Depression Remission at 6 Months

Notes:

RPS-1.030 Follow-up After Hospitalization: 7 day

RPS-1.040 Follow-up After Hospitalization: 30 day

Reference Reports Supplement Rating

Notes:

RPS-1.050 Controlling High Blood Pressure

Notes:

RPS-1.060 Screening for Social Drivers of Health

Notes:

RPS-2 Mainstream third party report-writing tools can be used by Center to write reports against production database tables.

Please list examples of these mainstream tools.

Technical - Supplement

Reference Technical Supplement Rating

TCS-1 Vendor-provided form development tool capabilities: N/A

Notes:

TCS-1.010 Pick lists can be defined where individual pick list values can be specific pick list value. For example, an Assessment Type pick list where a specific Assessment Type will be inactivated and for the Assessment Type table that populates the pick list.

TCS-1.015 Pick lists can be defined that contain a code and description as separate fields. The user has the option of jumping to different entries in the pick list by typing either the code or description.

TCS-1.020 For a single service session that may require the collection of multiple different forms, the user only enters a single start/stop time for the entire session rather than separate start/stop times for each form. Please describe any scenarios where the user will be required to record more than one start/stop time for a single service session.

TCS-1.030 Certain types of forms, such as the PHQ-9, may be collected through a variety of different service codes. A single interface allows the user to view the complete chronological history of a single form that was entered through different service codes.

TCS-1.040 Certain forms have sections that must support one to many relationships. For example, the IDD Person Directed Plan of Individual, Individual Plan of Care Date, Legally Authorized Representative, Provider Agency Name, etc. For a single PDP each with a series of fields such as Desired Service, Service Delivery Option, Outcome. There is no set limit for the number of Action Plans that can exist for a single PDP. The form development tool has the capability to build a form such as the PDP that has

- parent information with a section on the form to record an unlimited number of Action Plans that were created for the PDP.

TCS-1.050 To minimize form sizes in forms developed by the form development tool, a single field group containing a phone number field and phone type field can be placed on a form with some type of an add button that will dynamically add a second instance of the field group for clients that have more than one phone number and phone type. This second instance would also have an add button in case the client has a third phone number and phone type. The user can add an unlimited number of phone numbers and types using this interface.

TCS-1.060 Fields on forms developed by the form development tool can be

The following are a few examples of this requirement:

An answer to an assessment question that indicates a need may enable and conditionally require new fields to record additional details about the need.

Similarly, an answer to an assessment question that indicates no need may conditionally hide additional fields or make them optional.

A modified based on the Assessment Type of the prior assessment for the given client. Depending on the scenario, the determination of the appropriate Assessment Types for the pick list may occur as the form

TCS-1.070 The values of specific data entry fields on forms developed by the form development tool can be defaulted from values entered on prior forms of the same type. This requirement refers to all or just a subset of the fields on a form. For example, there may be forms where we want to default all fields from a prior form.

There may be other forms where we only want to default a portion of the fields from a prior form.

TCS-1.080 Some forms have validations and/or processing logic that occurs while the form is loaded. For example, a TRR assessment (ANSA or CANS) automatically computes a Recommended Level of Care based on fields that have been entered on the form. After seeing the Recommended Level of Care, the clinician can elect to override this recommendation and choose a different level of care. This override will cause a new required-entry Override Reason pick list to display and the contents of this pick list vary based on the combination of the recommended and overridden levels of care. The above logic occurs while the form is loaded. Forms developed by the form development tool can have validations and processing logic occur while the form is loaded to support scenarios such as the above example.

TCS-1.090 Forms developed by the form development tool are fully functional and can be entered using mobile devices.

TCS-1.100 Text fields on forms developed by the form development tool can have spell checking enabled.

TCS-2 We encounter situations where the same reporting CCBHC outcome measure may have different reporting specifications depending on who the measure is being reported to. System provides the capability to have multiple versions of the same measure so that specific specification.

TCS-3 Patient portal capabilities: N/A

TCS-3.010 Ability for clients to enter vendor-developed and Center-developed forms.

Please describe any limitations on the types of forms that can be entered in the patient portal.

Notes:

TCS-3.020 Ability for clients to make payments for outstanding balances.

Notes:

TCS-3.030 Ability for clients to electronically sign forms.

Notes:

TCS-3.040 Ability for clients to message their Care Team.

Notes:

TCS-3.050 Ability for clients to schedule appointments.

Notes:

TCS-3.060 Ability for clients to respond to appointment reminders.

Notes:

TCS-3.070 Ability for client to fill out pre-visit forms.

Notes:

TCS-3.080 Ability for clients to respond to surveys.

Notes:

TCS-3.090 Ability to publish content that targets certain populations of clients. For example, some sort of diagnosis-specific content published for clients that have certain diagnoses.

TCS-3.100 Ability to publish lab and testing results.

Notes:

TCS-3.110 Ability to view graphical representations of the same lab and/or test results over time periods so that trends can be identified.

TCS-3.120 Ability to view service visit notes.

Form Samples Supplement

Authorization for Treatment-Application for Services - Revised

Financial Assessment - Revised

Financial Assessment -Revised (continued)

Client Agreement - Revised

Crisis Intake Assessment and Recovery Plan Progress Note Template -

Crisis Intake Assessment and Recovery Plan Progress Note Template Revised (continued)

BMI Adult Screening and Follow-up Progress Note - Revised

Child-Adolescent Weight Assessment and Counseling Progress Note Revised

Tobacco Use Screening and Cessation - Revised Now Includes Alcohol and Drug Use

Wraparound Recovery Plan Child-Adolescent Services - Revised

Wraparound Recovery Plan Child-Adolescent Services- Revised

Youth Recovery Plan - Revised

Youth Recovery Plan Revised (continued)

Adult Recovery Plan Revised & Renamed Uniform Assessment

Adult Recovery Plan Revised and Renamed Uniform Assessment (continued)

Comprehensive Nursing Assessment - Revised

Initial Plan of Care for HCS-CFC - Revised

Initial Plan of Care for HCS-CFC Revised (continued)

Initial Plan of Care for TxHmL-CFC - Revised

Initial Plan of Care for TxHmL-CFC Revised (continued)

Initial Plan of Care for TxHmL-CFC Revised (continued)

Social Determinants of Health

Social Determinants of Health (continued)

Community Living Options

Community Living Options (continued)

Habilitation Assessment

Habilitation Assessment (continued)

Habilitation Service Plan

Habilitation Service Plan (continued)

Referral for Probation and Substance Use Disorder

Adult BH Recovery Plan

Adult BH Recovery Plan (continued)

Adult BH Recovery Plan (continued)

CLAS Standards Demographics

CLAS Standards Demographics (continued)

Follow-up from State Facility Discharge

PTSD Checklist

Adult BH Intake and Interview

Adult BH Intake and Interview (continued)

Additional Questions

Please provide responses to the following requirements and questions:

1. Provide minimum system requirements for the following:

a. Server(s)

b. Workstations

c. Laptops

d. Tablets

e. Mobile phones

2.

3. -user locations?

4. The User Requirements lists a requirement for single entry of data in the system. If there are cases where the same data may be entered in different places in the system, please list the instances where this occurs.

5.

6. The ability to run reports based on Program Assignments is important. Please identify which of the reports in the report catalog can be run for clients that are assigned to one or many specific Programs.

7. -defined dashboards.

8. Does the system provide the ability to assign either a subset or all dashboards to different users?

9. Do dashboards provide the capability to drill down to access the detailed data that defines the dashboard?

10. Does the system contain tools and methods that allow Center staff to create custom dashboards and assign them to users?

11. For Center-

12. Please describe any types of limits that the Center may encounter such as maximum number of concurrent users, maximum number of records in a table, maximum size of tables, or bandwidth maximums, etc. For each type of limit, describe what options the Center has to resolve the limit.

13. Please describe any system functions that if run concurrently, can cause system problems.

14. Please provide a brief description of database transaction processing controls that are implemented to protect transactions that may be processing at the time of a system outage.

15. Please describe the record locking approach used when two users are attempting to edit the same record at the same time.

16. When system is hosted by vendor, describe contingency plans in the event of system, hardware, or communications failures.

17. Does the System provide the ability to schedule resource intensive processes so that they run unattended after hours? If so, please provide examples of processes that are run using this capability.

18. Does the system support the import of externally provided service information such as laboratory charges? If so, please provide examples of the types of information that is imported.

19. Are there system or database maintenance activities that require downtime? If so, how often should these activities be performed? What is the typical length of the required downtime? What type of special expertise is required to perform the maintenance activities?

20. How is Center-developed functionality integrated into the system and how is this integration coordinated with modifications that proposer may be making in the same areas of the system?

21. Considering the requirement of having Live, Training, and Test versions of the system available and these separate versions will have differing versions of the system at any given point in time, how are updates to these versions scheduled? Will these updates be performed outside of normal working hours?

22. Has the proposer negotiated the ability to include any copyrighted data collection forms in the system? If so, please list these forms.

23. Describe the support structure that is included with monthly subscription fee.

24. Are there any limits on support requests in terms of time or counts of requests?

25. What is the guaranteed response time for non-critical support requests?

26. What is the guaranteed response time for critical support calls?

27. How are requests for additional training differentiated from support requests that are included with the monthly subscription fee?

28. How are requested enhancements to the system compliance requested, prioritized, and funded? If there is a backlog of these types of requested enhancements, how long is this backlog?

29. Are there guarantees for how long proposer would take to build a custom report based on existing data in the system? Some reports may be required sooner than others, but the Center would prefer a maximum period of 60 days from the date of the request.

30. The Center uses Incode by Tyler Technologies as its financial system. Please describe interfaces that the proposed system has with this financial system.

31. The Center uses ADP as its human resources system. Please describe interfaces that the proposed system has with this human resources system.

Implementation, Training, and Support

Please provide responses to the following requirements and questions:

1. 3/1/2025, include the proposed timelines for the work plan tasks to meet this

2. What types of Center expertise will be required for the implementation process? Based on experience with past implementations, please provide estimates of the amount of time, by type of staff, that will be required for the implementation.

3. How is implementation training structured so that users are fully prepared to

4.

one?

5. For several years, the Center has used a document scanning system to store various types of client data forms. How would these scanned forms be integrated with forms that would

6. Will the Center be able to retain the existing case numbers for clients that are converted

7. Is there a recommended amount of time for running parallel with the existing system? If so, what is this amount of time?

8. What should the Center anticipate as the most significant challenges with the implementation?

9. Are you willing to sign a Service Level Agreement with performance targets and penalties?

Required Documentation and Procedures for Submitting Proposal section of this RFP.

10. A critical need for the Center is compliance with state (Texas Health and Human Services Commission) and federal (Centers for Medicare and Medicaid Services, Substance Abuse and Mental Health Services Administration) funding sources. This compliance involves collecting certain types of data, validating the accuracy of this data, and providing this data in some form to the funding source. In addition, there are typically timeframes specified for achieving this compliance. What guarantees are provided to the Center in vendor contracts that these compliance needs are addressed within funding source timeframes?

Please describe how these compliance needs are identified, prioritized, and funded.

Business Associate Agreement Texas Panhandle Centers

BUSINESS ASSOCIATE AGREEMENT

Agreement Texas Panhandle Mental Health Mental Retardation dba Texas Panhandle Centers Covered Entity and Contractor Name Business Associate Party Parties

Recitals

WHEREAS, Covered Entity has engaged Business Associate to perform services and/or provide

Service Agreement

The purpose of this Agreement is to enable the parties to comply with the applicable requirements of HIPAA, the HIPAA Regulations, and the HITECH ACT (defined below) that

Protected

Business Associate (and/or any agent or Subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate or Covered Entity) in connection with services performed on behalf of Covered Entity pursuant to any oral or written agreement(s) for the provision of services to Covered Entity that has been or may be entered into

WHEREAS, Covered Entity possesses Individually Identifiable Health Information that is protected under HIPAA, the HIPAA Privacy Regulations, the HIPAA Security Regulations and the HITECH Standards and is permitted to use or disclose such information only in accordance with such laws and regulations;

NOW, THEREFORE, for good and valuable consideration, the sufficiency of which we hereby acknowledge, the Parties agree as follows:

Definitions

Terms used but not otherwise defined in this Agreement shall have the same meaning as the meaning ascribed to those terms in the Health Information Portability and Accountability Act of

HIPAA

HITECH

regulations promulgated under HIPAA or HITECH.

means safeguards consisting of administrative actions, policies, and procedures designed to protect the privacy of PHI from intentional or unintentional use or disclosure in violation of HIPAA and other legal requirements, and to manage the selection, development, implementation, and maintenance of security measures to protect Electronic PHI, as well as managing the conduct of the workforce relating to the protection of that information.

means the property that data or information is accessible and useable upon demand by an authorized person, as set forth at 45 C.F.R. §164.304.

shall mean the acquisition, access, use or disclosure of Protected Health Information ion.

(a) Any unintentional acquisition, access, or use of Protected Health Information by a workforce member or person acting under the authority of Covered Entity or Business Associate, if such acquisition, access or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Regulations; or

(b) Any inadvertent disclosure by a person who is authorized to access Protected Health Information at Covered Entity or Business Associate to another person authorized to access Protected Health Information at Covered Entity or Business Associate, respectively, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the HIPAA Privacy Regulations; or

(c) A disclosure of Protected Health Information where Covered Entity or Business

Associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

means the rules set forth primarily at 45 C.F.R. Part 164, Subpart D.

means the entity so designated in the preamble of this Agreement.

means the property that data or information is not made available or disclosed to unauthorized persons or processes, as set forth at 45 C.F.R. §164.304.

means the entity or entities as designated in the preamble to this Agreement.

means that Business Associate, or an employee, officer, or agent of Business Associate, has acquired actual knowledge of a Breach or by the exercise of reasonable diligence should have acquired knowledge of a Breach.

Electronic Protected Health Information Electronic PHI means PHI in include ePHI.

means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key, as set forth at 45 C.F.R. § 164.304 means the Health Insurance Portability and Accountability Act of 1996 Pub. L., No

104-191.

means the Privacy regulations, the Security Regulations, the Breach Notification Regulations and such other applicable regulations set forth in 45 C.F.R. Parts 160 and 164.

means the Health Information Technology for Economic and

Clinical Health Act privacy and security provisions of the Stimulus Act and implementing regulations.

means the identifiers listed in the HIPAA Privacy Rule at 45 C.F.R. section

164.514(b)(2), which include, among other identifiers: name, address, zip code, all elements of dates other than the year that directly relates to an individual (such as birthdate, admission date, discharge date, date of death), telephone numbers, email address, fax numbers, social security numbers, medical record numbers, vehicle identifiers, license numbers, and all other identifiers of an individual, or of the ind section 164.514(b)(2).

means the person who is the subject of PHI and shall include a person who qualifies as a personal representative under 45 C.F.R. Section 164.502(g).

means the property that data or information have not been altered or destroyed in an unauthorized manner, and that data from one system is consistently and accurately transferred to other systems, as set forth at 45 C.F.R §134.304.

means safeguards consisting of physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment, from natural and environmental hazards and unauthorized intrusion.

means individually identifiable health information created or received by Business Associate from or on behalf of a Covered Entity that relates to the past, present, or future physical or mental health condition of an individual, the provision of health care to an individual, as set forth at 45 C.F.R. §160.103. PHI can be oral, written, tronic Protected Health Information (ePHI).

means the rules set forth primarily at 45 C.F.R. Part 160 and Part 164, Subparts A and E.

means a mandate contained in law that compels an entity to use or disclose PHI and that is enforceable in a court of law, as set forth at 45 C.F.R. §164.103. Required by Law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.

means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an broad and includes attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations.

relates to the means (process and technology) by which a Covered Entity and or Business Associate protect the privacy and security of information, as set forth at 45 C.F.R. §164.304. Security measures keep information secured, and decrease the means of tampering, destruction, or inappropriate access. Security encompasses all of the administrative, physical and technical safeguards in an information system.

means the rules set forth primarily at 45 C.F.R. Part 160 and 164, Subparts A and C.

means a person or entity to whom the Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of the Business associate, whether by written agreement or otherwise.

means safeguards consisting of technology and the policy and procedures for the use of the technology that protect ePHI and control access.

Unsecured Protected Health Information the use of technology or methodology specified by the Secretary in regulations or as otherwise defined in section 13402(h)(2) of HITECH on the HHS Web site.

Section 1

Obligations and Activities of Business Associate

1.1.1 required by this Agreement or as Required by Law. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by this Agreement.

1.1.2 Business Associate and its agents or Subcontractors, if any, shall only request, use, and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure in accordance with HIPAA, the HIPAA Regulations and HITECH.

1.1.3 Business Associate agrees to use appropriate safeguards and comply with the applicable requirements of the HIPAA Regulations, including 45 CFR Subpart C, with respect to ePHI and Subpart E of 45 CFR with respect to PHI. This shall include, without limitation, using appropriate Security Measures and developing, implementing, maintaining and using appropriate and reasonable Administrative, Physical, and Technical Safeguards for the privacy and security of PHI to insure the integrity, Confidentiality and Availability of, and to prevent non-permitted uses and disclosures of PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate further acknowledges and agrees that pursuant to HITECH, it will implement and document its Security Measures and will comply with 45 CFR sections 164.306 (Security Standards), 164.308 (Administrative Safeguards), 164.310 (Physical Safeguards), 164.312 (Technical Safeguards), 164.314 (Organizational Safeguards) and 164.316 (Policy and Procedures and documentation requirements), and all other applicable requirements of HIPAA, the HIPAA Regulations, HITECH and other applicable privacy and security laws. Business Associate agrees to adopt the technology and methodology standards provided in guidance issued by the HHS secretary pursuant to HITECH.

1.1.4 Business Associate agrees to take prompt action to correct any deficiencies and to mitigate to the extent practicable, any harmful effect that is known to Business Associate of an access, use, disclosure, modification or destruction of PHI by Business Associate, its agents or Subcontractors, if any, in violation of the requirements of this Agreement.

1.1.5 Business Associate agrees to promptly notify Covered Entity within forty-eight (48) hours of any access, use, disclosure, modification, or destruction of PHI not provided for by this Agreement or that is in violation of the requirements of this Agreement, and to provide Covered Entity or its designee such information as may be reasonably requested by Covered Entity to investigate the violation. Business Associate shall report to Covered Entity any Security Incident of which it becomes aware. If Business Associate has been requested orally or in writing by law enforcement officials that notification of affected individuals of a Breach may impede a criminal investigation, Business Associate shall so inform Covered Entity.

1.1.6 Business Associate further agrees to provide a report in writing to Covered Entity within ten (10) days of, and to cooperate with Covered Entity in investigating and resolving, any of the following as they relate to PHI under this Agreement:

(i) Any unauthorized access, use, disclosure, modification or destruction of PHI of which Business Associate becomes aware;

(ii) Any Security Incident of which Business Associate becomes aware;

(iii) The receipt of a request from an Individual (or their authorized personal representative) for access to amendment to, an accounting of disclosures of, a copy or electronic copy of, or a restriction on the use of disclosure of PHI; or

(iv) Any Breach or potential Breach of Unsecured PHI of which Business Associate becomes aware. In such event, Business Associate will document its investigation and provide such additional information as may reasonably be requested to enable Covered Entity to determine the extent to which the PHI has been compromised.

Notice to affected Individuals will be made by or at the direction of Covered Entity

The written report from Business Associate required by this Section shall set forth the following:

(i) A brief description of what happened, including the date of any unauthorized access, use, disclosure, modification, or destruction, and, if known, the date of Discovery, the number of individuals affected, the time period involved, and the nature and extent of any harm resulting from the violation;

(ii) A description of the type(s) of PHI and Identifiers involved (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, and other types of information were involved);

(iii) Information regarding whether and to what extent the PHI was unsecured PHI, Encrypted, or was rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the HHS Secretary in the guidance issued under section 13402(h)(2) of HITECH on the HHS Website;

(iv) A description of the manner in which the PHI could be identified or, if known, how and whether the PHI could be re-identified;

(v) To the extent possible, the name of each individual whose PHI has been or is reasonably believed to have been accessed, used, disclosed, modified, or destroyed;

(vi) To the extent possible, the name of the unauthorized person and entity who used the PHI or to whom the disclosure was made;

(vii) To the extent possible, whether the unauthorized person or entity is another covered entity, business associate, employee of Business Associate, Subcontractor, or entity affiliated with Business Associate;

(viii) Whether any opportunity existed for an unauthorized person to acquire, view, transfer, or otherwise comprise the PHI;

(ix) Whether the PHI was actually acquired, viewed, transferred, or otherwise compromised by an unauthorized person;

(x) Any Steps individuals should take to protect themselves from potential harm resulting from the unauthorized access, use, disclosure, modification, or destruction of PHI; and

(xi) A description of what the Business Associate is doing to investigate, mitigate harm to individuals, and protect against any further unauthorized access, use, disclosure, modification or destruction of PHI;

1.1.7 Business Associate agrees that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of the Business Associate or Covered Entity will enter into an enforceable written HIPAA-compliant business associate agreement requiring that the Subcontractor:

(a) agrees to comply with the HIPAA Privacy Regulations, HIPAA Security

Regulations, HITECH law, and other applicable laws and regulations related to privacy and security of PHI, including ePHI;

(b) agrees to the same restrictions, reporting and contracting obligations and conditions that apply in this Agreement to Business Associate with respect to PHI including, by way of example and without limitation, that the Subcontractor develop, implement, maintain, and use appropriate and reasonable Security Measures and Administrative, Physical, and Technical safeguards for the privacy and security of PHI to insure the Integrity, confidentiality, and Availability of and prevent non-permitted access, use, disclosure, modification or destruction of PHI, including ePHI; that the Subcontractor enter into business associate agreements with its subcontractors that create, receive, maintain, or transmit PHI on behalf of Subcontractor, Business Associate or Covered Entity; and the Subcontractor adopt a HIPAA compliance program and policies and procedures.

If Business Associate becomes aware of a pattern of activity or practice of a Subcontractor that constitutes a material breach of their written business associate agreement, Business Associate shall take reasonable steps to cure the breach or end the violation, as applicable, and if such steps are unsuccessful, terminate the contract.

1.1.8 Business Associate agrees to provide access to and copies of PHI maintained in a

Designated Record Set to Covered Entity or, when requested in writing by Covered Entity, to an Individual in order for Covered Entity to meet the requirements of 45 CFR §164.524.

Business Associate shall provide access to and copies of PHI in a reasonable time, not to exceed fifteen (15) days (unless the parties reasonably agree otherwise in writing) and in a reasonable manner. If requested by Covered Entity or an Individual, Business Associate shall provide access to ePHI to Covered Entity or, when requested in writing by Covered Entity, to an Individual in the electronic form and format requested by Covered Entity or by the Individual, as applicable, if it is readily producible and if not, in a readable electronic form and format as agreed by the Covered Entity or Individual, as applicable.

1.1.9 Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate, on behalf of Covered Entity available to the Secretary in the time and manner designated by the Secretary, for purposes of the Secretary determining compliance with the HIPAA Regulations. Upon receipt of a request from the Secretary, Business Associate shall notify Covered Entity in writing unless such notification would be contrary to law.

1.1.10 Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity determines is required to enable Covered Entity to comply with 45 CFR §164.526. except for good cause shown in writing to Covered Entity, Business da

1.1.11 Business Associate agrees to identify, track and document disclosures of PHI and other information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528. Business Associate agrees to provide the information collected to Covered Entity or to an Individual when requested by Covered Entity, in writing and no later than thirty (30) days after receiving a request under this subsection, to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528. Upon written request, Business Associate shall furnish to Covered Entity a copy of its policies or procedures that it has, and will maintain, that describe how it carries out its obligations under this subsection.

1.1.12 Business Associate agrees that if it has a legal obligation to disclose any PHI, it will notify

Covered Entity as soon as reasonably practicable after it learns of such obligation, sufficiently in advance of the proposed release date such that the rights of Covered Entity and the Individual to whom the PHI relates would not be prejudiced. If Covered Entity or the Individual objects to the release of such PHI, Business Associate will allow Covered Entity and/or the Individual to exercise any legal rights or remedies Covered Entity and/or the Individual might have to object to the release of the PHI, and Business Associate agrees to provide such assistance as Covered Entity or the Individual may reasonably request in connection therewith.

Section 2

Permitted Used and Disclosures by Business Associate

2.1.1 General use and Disclosure Provision. Business Associate agrees to use or disclose PHI only as permitted or required for the purpose of performing its obligations under the Services Agreement, provided such use or disclosure of PHI would not violate the HIPAA Regulations if done by Covered Entity, including the minimum necessary requirements in the HIPAA Regulations and Subpart E of CFR Part 164, or violate the terms of this Agreement.

(i) Specific Use and disclosure Provisions. Except as otherwise limited in this

Agreement, Business Associate may use and disclose PHI for the proper management and administration of the Business Associate or to carry out its legal responsibilities, provided that disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law, or for the purpose for which it was disclosed to the person and the person notified the Business Associate of any instances of which it is aware in which the Confidentiality of the information has been breached.

(ii) Only when specifically authorized by Covered Entity in writing separate from this

Agreement or in accordance with a specific provision of the Services Agreement, Business Associate may use PHI: (a) to provide data aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B); or (b) to create de-identified health information in accordance with 45 CFR §164.514.

(iii) Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).

Section 3 Obligations of Covered Entity

3.1.1 Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices, prepared for compliance with 45 CFR §164.520, to the extent that such limitation may

3.1.2 Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business

3.1.3 Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such ure of PHI.

3.1.4 Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Regulations if done by Covered Entity.

Section 4 Term and Termination

4.1.1 Term. The Term of this Agreement shall be effective as of the Effective Date, and shall terminate after the exercise of any of the termination provisions set forth below and when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered entity, is destroyed or returned to Covered Entity and no copies of PHI are retained or, if it is infeasible to return or destroy PHI, protections are extended to such information in accordance with the termination provisions in this Section.

4.1.2 Termination by Covered Entity. Covered Entity may immediately terminate this Agreement and any Services Agreement if Covered Entity makes the determination that Business Associate has breached a material term of this Agreement. Alternatively, Covered Entity may provide Business Associate with thirty (30) days written notice of the existence of an alleged material breach and afford Business Associate an opportunity to cure upon mutually agreeable terms.

Nonetheless, in the event that mutually agreeable terms cannot be achieved within thirty (30) days, Business Associate must cure said breach to the satisfaction of the Covered Entity. Failure to cure in the manner set forth in this Section is grounds for the immediate termination of this

Agreement and any Services Agreement. Nothing contained herein shall be deemed to require Covered Entity to terminate this Agreement if termination is not feasible.

4.1.3 Termination by Business Associate. If Business Associate makes the determination that a condition material to the performance of this Agreement has changed under any Services Agreement or this Agreement, or that Covered Entity has breached a material term of this Agreement, Business Associate may provide thirty (30) days notice of its intention to terminate this Agreement, Business Associate agrees, however, to cooperate with Covered Entity to find a mutually satisfactory resolution to the matter prior to terminating and further agrees that, notwithstanding this provision, it shall not terminate this Agreement so long as any Services Agreement is in effect.

4.1.4 Automatic Termination. This Agreement will automatically terminate without any further action of the parties upon the termination or expiration of the last Service Agreement in effect between the parties.

4.1.5 Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall provide an opportunity for Business Associate to cure the breach or end the violation. Covered Entity may terminate this and any other Agreement between Covered Entity and Business Associate if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity. In addition, Covered Entity may immediately terminate this Agreement if Business Associate has breached a material term of this Agreement and cure is not possible.

4.1.6 Effect of Termination. Upon any termination pursuant to this section or otherwise, Business Associate shall return or destroy all PHI pursuant to 45 CFR §164.504(e)(2)(ii)(J) if it is feasible to do so and shall not retain any copies of the PHI. If return or destruction is not feasible, Business Associate will notify covered Entity in writing, including (i) a statement that Business Associate has determined that it is infeasible to return or destroy the PHI, and (ii) the specific reason(s) for such determination, which reason(s) must be agreed to by Covered Entity.

Business Associate further agrees to extend any and all protections, limitations, and restrictions ained after the termination of this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible. Business Associate further agrees to recover any PHI in the possession of its Subcontractors or agents and to return or destroy the PHI as set forth in this Section; if infeasible, Business Associate must provide a written explanation to Covered Entity and require the Subcontractors and agents to agree to extend any and all protections, limitations, and restrictions contained in this Agreement to the this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible.

Section 5 Indemnification

Business Associate shall indemnify, defend and hold harmless Covered Entity and its parent corporation, subsidiaries, and related entities, their directors, officers, agents, servants, and ims, causes of action, liabilities, judgments, fines, assessments, penalties, damages, awards, or other expenses of any kind of nature whatsoever, including without limitation, attorney fees, expert witness fees, and costs of investigation, litigation, or dispute resolution, incurred by the Indemnitees, and relating to or arising out of any breach or alleged breach of the terms of this agreement by Business Associate or any agent or Subcontractor of Business Associate.

Section 6 Notice

All notices, requests, demands, and other communications required or permitted to be given or made under this Agreement shall be in writing, shall be effective upon receipt of attempted delivery, and shall be sent by (a) personal delivery; (b) certified or registered United States mail, return receipt requested; (c) overnight delivery service with proof of delivery; or (d) facsimile with return facsimile acknowledging receipt. Except as otherwise herein, provided notices shall be sent to the address below. Neither party shall refuse delivery of any notice hereunder.

If to Covered Entity: Texas Panhandle Centers Attn: Contracts Manager P.O. Box 3250 Amarillo, Texas 79116

If to Business Associate: Contact Name (i.e. John Doe)

Contractor Company Name Address City, State Zip

Contact Phone #:

Section 7 Miscellaneous

7.1.1 No Warranty. PHI IS PROVIDED TO BUSINESS ASSOCIATE

COVERED ENTITY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS

OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF

MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE.

7.1.2 Regulatory References. A reference in this Agreement to a section in the Code of Federal Regulations (CFR) means the section is in effect as of the effective date of this Agreement or as thereafter amended.

7.1.3 Independent Contractor. The parties to this Agreement are independent contractors in carrying out the duties and obligations of this Agreement. This Agreement is not intended and shall not be construed to create any relationship between the parties that would allow one party to exercise direction or control over the manner or method by which the other party performs services, duties, or obligations under this Agreement

7.1.4 Equitable Relief. Business Associate understands and acknowledges that any disclosure or misappropriation of any PHI in violation of this Attachment will cause Covered Entity irreparable harm, the amount of which…