RFP 4007 Attach A B SECTION 6-10.docx

SECTION 6 – CONTRACTING WITH APPARENT SUCCESSFUL BIDDER

UW Medicine will review the Apparent Successful Bidder’s contract template (fully unlocked) with the following required Exhibits:

· The Additional UWM Terms and Conditions that will be part of the final Contract.

· Section 7 Exhibit B - BAA

· Section 8 Exhibit C - UW IT Security Term and UW Cyber Liability Rider;

· Section 9 Exhibit D – Accessibility Rider

· Section 10 Exhibit E – DPA

Additional UWM Term and Conditions listed below:

The University of Washington is an institution of higher education and an agency of the State of Washington. UW Medicine is an integrated clinical, research and learning health system comprised of multiple entities that are managed together as a health system. UW Medicine consists of the following components: Harborview Medical Center and its associated clinics (“HMC”) as managed by UW pursuant to a Hospital Services Contract between the UW and King County; Public Hospital District No. 1 dba Valley Medical Center and its associated clinics (“VMC”); Fred Hutchinson Cancer Center, a separate entity that serves as the Cancer Center of UW Medicine; the University of Washington Medical Center, operating at two separate campuses, Montlake and Northwest, and its associated clinics (“UWMC”); UW Physicians Network dba UW Medicine Primary Care (“UWMPC”); The Association of University Physicians dba UW Physicians (“UWP”), the University of Washington School of Medicine (“UW SoM”), and Airlift Northwest (“ALNW”) (each a “UW Medicine Component Unit” and collectively “UW Medicine Component Units”).

A. ATTORNEYS’ FEES – In the event of litigation or other action brought to enforce Contract terms, each party shall bear its own attorney’s fees and costs.

B. QUALITY ASSURANCE AND PERFORMANCE IMPROVEMENT (“QAPI”)

Quality Assessment and Performance Improvement: In accordance with The Joint Commission (T.J.C.) Leadership (LD.)04.03.09, Contractor agrees to work in collaboration with Hospital(s) in the review and development of relevant quality assurance plans as opportunities for performance improvement are identified. This may include participation in quality assurance activities including event reviews, studies, plans of corrective action for deficiencies identified by either signatory to this Contract or third-party regulatory agencies. Contractor agrees to provide periodic reporting on the outcome of process changes and corrective actions to Hospital(s) Business Manager/ Department Manager named in the CONTRACT MANAGEMENT Section below.

C. SITE SECURITY

1. Contractor shall register in the UW Medicine vendor management system and comply with all applicable UW Medicine policies and/or procedures defined during the registration process, including but not limited to, credentialing, immunizations, confidentiality and integrity;

2. Contractor shall be responsible to comply with any updated requirements as they become available;

3. Contractor shall be responsible to remain current with annual vendor management system fees;

4. Contractor representative(s) conducting business or visiting any of the Hospitals’ facilities must complete on-line credentialing registration prior to visiting any of the Hospital(s). Contractor representatives are required to do the following:

i. Pre-schedule all visits;

ii. Sign in on the day of the scheduled appointment at one of the vendor management system kiosks located at each Hospital;

iii. Wear the temporary badge produced by the vendor management system at all times on Hospital(s) property. This badge shall be valid for one-day only, the day of the scheduled appointment;

iv. Check out at a vendor management kiosk prior to departing the Hospital.

5. Contractor and/or Contractor Representative(s) must follow any additional security procedures required by specific departments, including but not limited to, Surgical Services, Pharmacy and Radiology;

6. Contractor and/or Contractor Representatives’ failure to follow any vendor management policies will result in disciplinary action up to and including permanent exclusion from all UW Medicine Component Unit facilities.

D. INVOICE REQUIREMENTS FOR GOODS AND SERVICES

UW Medicine requires all incoming invoices to meet our standard billing requirements to ensure accurate, efficient, and timely processing of vendor invoices. A purchase order is required for the acquisition of all goods and services. All incoming invoices must reference a valid purchase order. Our standard payment terms are Net30 after a correctly completed invoice is received in Accounts Payable. A separate invoice is required for each purchase order and must be received within 30 days of receipt of goods or services. As a general rule, UW Medicine does not pay from statements.

Invoice Requirements

· Valid UW Medicine purchase order

· Bill to must reflect UW Medicine entity from which the purchase order was issued

· Only UW Medicine purchase orders can be billed, tenants must be billed directly

· Delivery location, delivery date

· Remittance Detail

· Vendor/payee name, remittance address, and payment terms

· W9 or supplier registration form complete, consistent with payee/vendor name

· Tax id and name accurately matches with information on file with IRS

· Invoice number, invoice date, sub-total, tax (if applicable), grand total

· Purchase line detail – must mirror PO

· Description of item, purchase order line #, item catalog #, quantity, unit of measure, price per unit, tax, extended line amount

· Description of service, contract number, equipment serial number (if applicable), service date(s) Incorrectly completed invoices will be returned to vendor with a request to issue a new invoice with a current date and required information.

Paper invoices should be addressed correctly and mailed/emailed to the Accounts Payable department for the UW Medicine entity listed on the purchase order.

PO BOX 50014

Seattle, WA 98145 Invoices: uwashington@ghxinvoicing.com Inquiries: UWM-AP@uw.edu

UW Medicine is committed to pursuing GHX Electronic Data Interchange (EDI) invoicing with all our trading partners. For more information on utilizing this invoicing option, please contact Accounts Payable.

E. CONTRACT MANAGEMENT

1. Contacts for the Hospitals and the Contract Manager for the Contractor are listed below and shall be the contact persons for all communications regarding the performance of this Contract. The Contract Manager for the Contractor shall competently and efficiently supervise and coordinate the implementation and completion of all Contract requirements specified within this Contract;

2. Contractor shall immediately notify Hospital(s)’ contacts in writing of any change of its designated Contract Manager assigned to this Contract at the e-mail addresses of each participating Hospital and UW Medicine Supply Chain at scmhelp@uw.edu;

3. Any notice, demand, or any other communication required or permitted to be given under this Contract or applicable law, shall be effective only if it is in writing and signed by the applicable party, properly addressed, and either delivered in person, or by a recognized courier service, or deposited with the US Postal Service as first class mail, postage prepaid certified mail, return receipt requested, to the UW Medicine Supply Chain, 7543 63rd Ave. NE, Bldg. 5B, Seattle, WA 98115 or by electronic mail to scmhelp@uw.edu.

DEPARTMENT MANAGER /

BUSINESS MANAGER FOR UWM is:

CONTRACT MANAGER for CONTRACTOR is:

Staci Garrison 1001 4th Ave Ste 500 Seattle, Washington 98154 Phone: (206) 668-9879 E-mail: stacig1@uw.edu Contract Manager Name Address City, State Zip Code Phone: ( ) E-mail:

F. COMPLIANCE WITH APPLICABLE LAW – At all times during the term of this Contract, Contractor shall comply with all applicable federal, state, and local laws and regulations, including but not limited to, nondiscrimination laws and regulations. To the extent Contractor will provide performance to any UW Medicine entity, Contractor agrees to comply with all UW Medicine Compliance policies and the UW Medical Center Corporate Compliance Plan. For additional information: http://depts.washington.edu/comply/policies/ or contact comply@uw.edu. Any violation of this section would be considered a material breach of this Contract. Contractor agrees to indemnify and hold Hospital(s) harmless from any and all damages or claims caused by Contractor’s failure to comply with the law.

G. COMPLIANCE WITH CIVIL RIGHTS LAW – Contractor and Subcontractor shall abide by the requirements of 41 CFR§§ 60-1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability.

H. COMPLIANCE WITH NONDISCRIMINATION REQUIREMENT – During the term of this Contract, Contractor shall not discriminate on the bases enumerated at RCW 49.60.530(3). In addition, Contractor shall give written notice of this nondiscrimination requirements to any labor organization with which Contractor has a collective bargaining or other agreement. In the event Contractor enters into any subcontract, Contractor shall include this clause therein.

I. CONFIDENTIALITY – Contractor may use information gained by reason of this Contract only for the purpose of this Contract. Contractor shall not disclose, transfer, or sell any such information to any party, except as provided by law. Contractor shall maintain the confidentiality of all confidential information gained by reason of this Contract and shall return or certify the destruction of such information if requested in writing by Hospitals.

Nothing in this Contract shall prohibit any UW Medicine Component Unit from sharing confidential information with other UW Medicine Component Units as so defined in the UW Medicine recital and current UW Medicine affiliate and alliance partners.

J. DISPUTE RESOLUTION – If a dispute arises out of or relates to this Contract, or the breach thereof, and if the dispute cannot be settled through negotiation, the parties agree first to try in good faith to settle the dispute by mediation administered by the American Arbitration Association under its Commercial Mediation Procedures before resorting to litigation or some other dispute resolutions procedure.

K. FEDERAL EXCLUSION AND DEBARMENT – Contractor, by accepting the terms of this Contract, certifies that Contractor is not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded by any Federal department or agency from participating in transactions. Contractor shall include the above-mentioned requirement in any and all subcontracts into which it enters. In the event that Contractor becomes debarred, suspended or ineligible from participating in transactions, Contractor shall notify Hospital(s) and UW Medicine Supply Chain in writing within three (3) working days of an event. To the extent that Contractor will provide performance to any Hospitals, Contractor hereby represents and warrants that Contractor is not currently, and at no time has been sanctioned, debarred, suspended, or excluded by any federally funded healthcare program, including without limitation, Medicare and Medicaid. Contractor hereby agrees to immediately notify Hospital(s) and UW Medicine Supply Chain of any threatened, proposed, or actual sanctions, debarment action, suspension, or exclusion by or from any federally funded healthcare program during the term of this Contract.

L. GOVERNING LAW – This Contract shall be interpreted in accordance with the laws of the State of Washington, and the venue of any action brought hereunder shall be in the Superior Court for King County.

M. INDEMNIFICATION – Contractor shall indemnify, defend, and hold the UW, the Board of Regents of the University of Washington, Hospitals, and their officers, employees, students and agents, harmless from and against all claims for damages, costs (including attorney’s fees), or liability, relating to the death or injury to any persons or the damage of any property resulting from or arising out of the acts or omissions of Contractor or its employees, agents, or Subcontractors in connection with this Contract.

Contractor expressly agrees to indemnify, defend, and hold harmless Hospital(s) for any claim arising out of or incident to Contractor’s or any Subcontractor’s performance or failure to perform this Contract.

Contractor waives its immunity under Title 51 RCW to the extent it is required to indemnify Hospital(s), the Board of Regents of the UW, and their officers, employees, students and agents as provided herein.

Each Hospital shall indemnify, defend, and hold Contractor harmless against any damage, cost, or liability, including reasonable attorney's fees, for all injuries to persons or property arising from negligent acts or omissions attributable to that specific Hospital or its employees or agents.

In no event shall any Hospital be required to indemnify Contractor for any injury to person or property that is not attributable to an act or omission by that specific Hospital.

Any breach of security by Vendor, but only if and to the extent that such liability, damage, cost, or expense is adjudged to have been proximately caused by the acts or omissions of Vendor, its officers, employees, or agents, or Subcontractors, their officers, employees, or agents.

After such notice of a claim, Purchaser agrees to cooperate with Vendor in good faith to petition the Washington State Attorney General to authorize Vendor to litigate and/or settle any and all claims pursuant to this section.

N. INFRINGEMENTS – Contractor agrees to defend, indemnify and hold harmless Hospitals against all claims for patent, copyright, or franchising infringements arising from the purchase, installation, or use of material ordered under this Contract, and to assume all expense and damage arising from such claims.

O. PUBLICITY – Contractor shall submit to Hospitals all advertising and publicity matters relating to this Contract in which, Hospitals’ names or the names of other UW Medicine Component Units, including the name “UW Medicine”, is specifically named or implied. Contractor agrees not to publish or use such advertising and publicity matters without the prior written consent of UW Marketing and Communications. Hospitals’ names and the names of other UW Medicine Component Units, including “UW Medicine”, may be included in a company’s website, press release, brochure, presentation, or annual report on a customer list, so long as the listing does not include any descriptive language which could be interpreted as an endorsement by the UW and no logos are used.

O. RECORDS MAINTENANCE

To the extent that Contractor, on behalf of Hospitals/UWM Component Units, uses or retains any records/data subject to the requirements for preservation and destruction of records under RCW 40.14, Contractor shall retain records in accordance with the current, authorized UW Medicine records retention schedules. Additionally, after retention requirements for records/data received/produced under this Contract have been met, Contractor shall destroy the records/data at no cost. If any litigation, claim, or audit is started before the legal retention requirement has been met, the records/data shall be placed on legal hold until the litigation/claim/audit has been resolved. At end/termination of this Contract, Contractor shall, at no cost, return any remaining data/records (in any and all formats) still within legal retention period to Hospitals/UWM Component Units, at no cost. Additionally, at end/termination of Contract Contractor shall destroy any remaining records/data (in any and all formats) relating to this Contract, that are outside of the legal retention period, as well as any copies of records/data (in any and all formats) produced or received from Hospitals/UWM Component Units during this Contract. Questions regarding retention are addressed to UW Medicine Records and Information Governance at hrc@uw.edu.

P. REFERRALS NOT REQUIRED – This Contract does not impose an obligation on any party to refer patients to any other person or entity to maintain this Contract. No person shall receive any payment hereunder for referral of any patient or ordering of any item or services.

Q. TRAVEL REIMBURSEMENT: Contractor may receive reimbursement for expenses as identified in this Contract. All expenses including airfare (economy or coach class only), other transportation expenses, lodging and subsistence, phone calls, faxing or mail expenses shall be reimbursed at the current Washington State reimbursement rates which can be reviewed at https://ofm.wa.gov/accounting/administrative-accounting-resources/travel. To receive reimbursement for travel expenses, Contractor must provide a detailed breakdown of authorized expenses, identifying what was expensed and when, plus all original receipts with the invoice.

R. INSURANCE – If Contractor’s performance of this Contract will involve Work falling into any of the categories enumerated within this section, Contractor shall at its own expense maintain in force with insurance companies acceptable to the University the kinds of insurance and minimum amounts of coverage set forth in subsection “a” through “f.”

Cognizant of the variety of policy forms currently within the insurance industry, the coverages provided under this section may be maintained in one or more type of insurance policies. However, regardless of the types of types and forms all policies shall:

Upon request, Contractor shall, prior to the commencement of Work under this Contract, provide UW Medicine Supply Chain Contracting at scmhelp@uw.edu with a certificate of insurance evidencing proof of insurance coverage, and shall name the Board of Regents of the UW as an additional insured. The additional insured endorsement may be either specific to the UW or may be “blanket” or “automatic” addressing any person or entity as required by Contract.

Hospitals and UW reserve the right to require additional types of insurance, and/or higher insurance limits, as circumstances require.

Contractor shall maintain insurance of at least the following types and amounts:

a. Commercial General Liability Insurance For service Contracts in which Contractor will perform a significant portion of Work under this Contract on Hospitals’ campuses, within Hospitals’ or UW facilities, in contact with Hospitals’ employees or UW students, or upon request, Contractor shall maintain Commercial General Liability Insurance (“CGL”), and provide proof of such insurance, upon request, in no less than the following amounts:

For Contracts including services delivered pursuant to this Contract involving the use of vehicles, either owned, unowned or hired by Contractor, Contractor shall maintain Automobile Liability Insurance, and provide proof of such, in the following amount:

T. ORDER OF PRECEDENCE

Each of the Exhibits listed below is by this reference hereby incorporated into this Contract. In the event of an inconsistency in this Contract, the inconsistency shall be resolved by giving precedence in the following order:

· Federal, state, or local laws or regulations;

· Exhibit B: Business Associate Agreement(BAA)

· Exhibit C: UW IT Security Terms and Cyber Liability Rider

· Exhibit D: UW Accessibility Rider

· Exhibit E: UW Data Processing Agreement (DPA)

· UW Medicine’s Request for Proposal RFP# 4007 dated December 5, 2024 and incorporated herein by reference

· ASB’s Proposal incorporated herein by reference

· Final Contract

· Final Order Form (if applicable)

SECTION 7

UNIVERSITY OF WASHINGTON

BUSINESS ASSOCIATE AGREEMENT

To determine if a Business Associate Agreement (“BAA”) is applicable to this RFP, use the following criteria to evaluate if the other party will be a Business Associate:

If this RFP for goods or services meets all three (3) of the Business Associate Contract criteria listed above, then the following University of Washington Business Associate Agreement will be included in the final Contract.

Exhibit B

University of Washington Business Associate Agreement

This Agreement is entered into between the University of Washington (hereinafter “Covered Entity”) and _______________ (hereinafter “Business Associate”). The University of Washington is a hybrid entity and has designated its healthcare components and non-healthcare components as described in COMP.101 Patient Information Privacy and Security Compliance Program and Administrative Requirements. Pursuant to 45 CFR §164.103 and §164.105(a)(2)(iii)(C), the University’s designation includes the entities listed at http://depts.washington.edu/comply/docs/101_G1.pdf (hereinafter “Covered Entity”). Business Associate includes any agents and subcontractors of the Business Associate that receive, create, maintain or transmit protected health information on behalf of the business associate.

This Agreement is incorporated into all existing and current contract(s) between the parties (the “Underlying Contract(s)”) under which Business Associate is carrying out activities or functions involving the use of protected health information (PHI), as this term is defined in 45 CFR Parts 160 and 164, and it replaces any prior agreement(s) entered concerning such PHI. Business Associates must reasonably and appropriately implement the standards and implementation specifications for safeguarding PHI and ensure the confidentiality, integrity, and availability of all electronic protected health information the business associate creates, receives, maintains, or transmits under federal Privacy and Information Security regulations (45 CFR Parts 160 and 164 (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act) and are subject to the application of civil and criminal penalties under sections 1176 and 1177 of the Social Security Act and financial penalties under 45 CFR Sections 160.402, 160.404, 160.408, 160.410, 160.412, and 160.418. Business Associates must also comply with all requirements for protecting patient information under State Privacy regulations including but not limited to RCW 70.02. Covered Entity is committed to providing high quality patient care, education, and research.

In furtherance of its mission, Covered Entity wishes to conduct transactions involving the disclosure of PHI to Business Associate for the purpose of conducting the activities set forth in the Underlying Contract(s).

Some or all of the information to be disclosed is required by law to be protected against unauthorized use, disclosure, modification or loss. In order to comply with applicable legal requirements for the protection of information, the parties agree as follows:

A. ALLOWABLE USES OF PHI

Only the minimum necessary PHI to accomplish the intended purpose of this agreement can be used or disclosed only for the following purposes (accurately describe how and why PHI will be created, received, maintained, and/or transmitted):

1. __________________________________________________________

2. __________________________________________________________

3. __________________________________________________________

B. OBLIGATIONS OF BUSINESS ASSOCIATE

Section 1. Safeguarding Information.

A. Business Associate shall only use, store, disclose, or access PHI:

(1) In accordance with, and only to the extent permissible under the Underlying Contract; and

(2) In full compliance with all applicable laws, regulations, rules or standards, including, but without limitation HIPAA and RCW 70.02.

B. Business Associate shall have in place policies and procedures to implement and maintain all safeguards necessary to ensure the confidentiality, availability, and integrity of all Covered Entity data. Business Associate shall deploy appropriate safeguards to implement the Secretary of Health and Human Services’ annual guidance on the most effective and appropriate technical safeguards for use in carrying out security standards.

C. Where applicable Business Associate shall report to the Covered Entity possible existence of identity theft (The Federal Trade Commission has regulations known as the Red Flag Rules which are part of the Fair and Accurate Credit Transactions (FACT) Act of 2003).

Section 2. Use or disclosure of Protected Health Information. Business Associate shall not use or disclose PHI received from Covered Entity in any manner that would constitute a violation of federal law, including but not limited to the Health Insurance Portability and Accountability Act of 1996 and any regulations enacted pursuant to its provisions (“HIPAA Standards”), or applicable provisions of Washington state law.. Business Associate shall ensure that any use or disclosure by its directors, officers, employees, contractors, and agents of PHI received from Covered Entity, or created or received on behalf of Covered Entity is in accordance with the provisions of this Agreement and applicable federal and state law. Business Associate shall not use or disclose PHI in any manner other than that permitted or required by the Covered Entity for the purpose of accomplishing services to or on behalf of Covered Entity in accordance with the Underlying Contracts. Notwithstanding the foregoing, Business Associate may use PHI for the proper management and administration of the Business Associate and to carry out its legal responsibilities.

Section 3. Reporting Unauthorized Use or Disclosure of PHI.

A. Business Associate shall, within five (5) working days of becoming aware of an unauthorized use or disclosure of PHI by Business Associate, its officers, directors, employees, contractors, agents or by a third party to which Business Associate disclosed PHI, report any such disclosure to Covered Entity. Such notice shall be made to the following:

UW Medicine Compliance Box 358049 Seattle WA 98195-9210

(206) 543.3098 comply@uw.edu B. Business Associate shall report to the Covered Entity any Security Incident of which it becomes aware without unreasonable delay, but not later than ten (10) days, following Business Associate’s discovery of any such incident.

Section 4. Agreements by Third Parties. Business Associate shall enter into a contract or other arrangement with agents or subcontractor(s) to ensure that the same restrictions and conditions including the implementation of reasonable and appropriate safeguards to protect PHI that apply to the BA also apply to the agents or subcontractor(s).

Section 5. Access to Information. If Business Associate maintains Designated Record Set (DRS) documentation on behalf of Covered Entity, Business Associate agrees to provide access to the documentation maintained by the Covered Entity. Business Associate shall make available to Covered Entity such information for so long as it is maintained. If any individual requests access to PHI directly from Business Associate, Business Associate shall forward such request to the Covered Entity. Business Associate shall not deny any individual's request for access to the individual's PHI. A denial of access to PHI requested is the responsibility of the Covered Entity.

Section 6. Availability of PHI for Amendment. Within five days of a request from Covered Entity for the amendment of an individual’s PHI or a record regarding an individual contained in a DRS (for so long as the PHI is maintained in the DRS), Business Associate shall provide such information to Covered Entity for amendment and incorporate any such amendments in the PHI as required by 45 CFR. §164.526.

Section 7. Accounting of Disclosures. Business Associate agrees to implement an appropriate record keeping and reporting process to enable it to provide the following information regarding disclosures of PHI: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. If Business Associate receives a request for an accounting of disclosures, Business Associate shall forward such request to Covered Entity within a reasonable time frame to allow Covered Entity to prepare and deliver any required accounting of disclosures.

Section 8. Restrictions on Certain Disclosure of Health Information. Business Associate agrees to restrict the disclosure of the protected health information of an individual, if Covered Entity agrees to a requested restriction by an individual. If Business Associate receives a request for a restriction, Business Associate shall forward such request to Covered Entity within five business days to allow Covered Entity to respond to the requested restriction.

Section 9. Availability of Books and Records. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity, or created or received on behalf of Covered Entity, available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s and Business Associate’s compliance with the HIPAA Standards. Business Associate shall provide to Covered Entity a copy of any documentation that Business Associate provides to the Secretary within five business days.

Section 10. Return or Destruction of Information. At the termination of the Underlying Contract(s), Business Associate shall return or destroy all PHI received from Covered Entity, or created or received on behalf of Covered Entity, that Business Associate maintains in any form. Business Associate will retain no copies of PHI. If Business Associate determines that return or destruction of any PHI is not feasible, Business Associate shall notify Covered Entity of the reasons why return or destruction is not feasible. If destruction or return of PHI is not feasible, Business Associate shall not use PHI received from Covered Entity, or created or received on behalf of Covered Entity, in a manner other than those permitted or required by state and federal laws or for the purposes described herein.

Section 11. Electronic Protected Health Information (“ePHI”). If Business Associate creates, receives, maintains or transmits ePHI on behalf of Covered Entity, Business Associate agrees to (1) implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Covered Entity’s ePHI in accordance with 45 CFR Sections 164.308, 164.310, 164.312, and 164.316 of title 45; (2) ensure that any third party agent or subcontractor who receives Covered Entity’s ePHI from Business Associate agrees to implement equivalent administrative, physical and technical safeguards; and (3) deploy appropriate safeguards to implement the Secretary of Health and Human Services’ annual guidance on the most effective and appropriate technical safeguards for use in carrying out security standards; and (4) report any security breaches involving Covered Entity’s ePHI within five business days of discovery.

Section 12. Breaches Involving Unsecured PHI.

A. A breach is when unsecured PHI may have been used, accessed, disclosed, or acquired in a manner not permissible under the terms of this Agreement. Unsecured PHI means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111–5. If Business Associate has reason to believe that a breach has occurred, Business Associate will, within five business days of discovery, give Covered Entity notice.

A breach shall be treated as discovered by the Business Associate as of the first day on which such breach is known to the Business Associate, (which includes any person, other than the individual committing the breach, who is an employee, officer, or other agent of the Business Associate) or should reasonably have been known to the Business Associate to have occurred. Business Associate shall give highest priority to immediately mitigate and remediate any unauthorized access and shall devote such resources as may be required to accomplish that goal. The Business Associate shall cooperate with all Covered Entity efforts, including providing any and all information necessary to enable Covered Entity to fully understand the nature and scope of the breach including but not limited to identification of each individual who has been affected by the breach.

B. The Business Associate will investigate a breach of unsecured PHI to determine if the PHI has been compromised based upon a risk assessment in accordance with Section 164.402 (2).

C. If it is determined that the PHI has been compromised, Covered Entity is required to provide notice to any or all individuals affected. In such case, Business Associate shall consult with Covered Entity regarding appropriate steps required to notify third parties. In the event that the Business Associate’s assistance is required, such assistance shall be provided at no cost to Covered Entity and in accordance with the Covered Entity’s policies and standards. Business Associate must coordinate with Covered Entity any public notification to any individual, media outlet, or the Secretary of Health and Human Services.

D. If it is determined that notification is required, the Business Associate shall pay the full costs of notice to affected individuals, including the costs to retain an outside consulting firm to undertake the notification effort and will supply UW Medicine Compliance with the following information to make such notification:

(1) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.

(2) A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code).

(3) A brief description of what the Business Associate is doing to investigate the breach, to mitigate losses, and to protect against any further breaches.

Section 13. If the Underlying Contract does not include a provision for indemnification, then the Business Associate shall indemnify, hold harmless and defend Covered Entity from and against any penalties, claims, actions, loss, liability, damage, costs, or expenses, including but not limited to reasonable attorneys’ fees.

Section 14. Covered Entity has the right, at any time, to monitor, audit, and review activities and methods in implementing this Agreement in order to assure compliance therewith, within the limits of Business Associate’s technical capabilities.

C. MISCELLANEOUS

Section 15. Termination. Notwithstanding any provision to the contrary in the Underlying Contract(s), Covered Entity may terminate its participation in the Underlying Contract(s) immediately upon written notice to Business Associate without liability for such termination, in the event that Covered Entity determines that Business Associate has committed a material breach or violated a provision of this Agreement.

Section 16. Definitions. All terms herein shall be defined in accordance with 45 CFR Parts 160, 162, and 164 and state laws governing healthcare privacy including but not limited to Public Records - Personal Information – Notice of Security Breaches (RCW 42.56.590), the Uniform Healthcare Information Act (RCW 70.02), mental illness (RCW 71.05), mental health services for minors (RCW 71.34), drug and alcohol abuse (RCW 70.96A, 42 CRF part 2), and HIV/AID/STDs (RCW 70.24).

Exhibit C

SECTION 8

UNIVERSITY OF WASHINGTON IT SECURITY TERMS

INTRODUCTION, PARTIES, AND EFFECTIVE DATE

THESE IT SECURITY TERMS ARE HEREBY INCORPORATED INTO THE CONTRACT BETWEEN THE UNIVERSITY OF WASHINGTON (UNIVERSITY) AND CONTRACTOR, AS OF THE “EFFECTIVE DATE” OF THE CONTRACT. IN CONSIDERATION OF THE MUTUAL PROMISES IN THE CONTRACT AND OTHER GOOD AND VALUABLE CONSIDERATION, THE PARTIES AGREE AS FOLLOWS:

I. DEFINITIONS

1. “Incident” means, for the purposes of this Contract, any adverse event (including technical or

2. physical incidents) where there is harm to University Data, individuals, host(s), or network(s). This includes, but not by way of exclusion, events indicating that University Data may have been accessed, disclosed, or acquired without proper authorization, unlawfully, or contrary to the terms of the Contract.

3. “Malicious Code” refers to malware, spyware, adware, ransomware, rootkit, keylogger, virus, trojan, worm, bot, or other code or mechanism designed to, without consent collect information, gain access, assert control, alter, and/or cause harm to the systems or data of an affected host, network, or environment.

4. “University Data” means all records and information created, received, maintained, or transmitted by the University, which are accessed, created, used, stored, copied, or distributed by Contractor, in connection with the Work under the Contract. University Data which meets the criteria for the definition of University Personal Data, as defined within the University Data Processing Agreement (DPA), herein incorporated by reference, should be first interpreted under the DPA, and only interpreted as University Data to the extent that the DPA is not dispositive of the issue.

5. “Contractor Group” includes any person or entity appointed by or on behalf of the Contractor to carry out any portion of the Work.

6. “Work” is the solution as described in the underlying [name of contract], irrespective of whether the work product includes goods, a license, professional services, or any form of technology solution delivered as a service.

II. DECLARATIONS

Parties understand and acknowledge:

1. University retains all ownership, title, rights, and control over all forms of University Data. Any privileges or license granted to Contractor Group under these IT Security Terms, or the Contract shall be narrowly construed, to permit only the least amount of access, creation, use, storage, copying, and/or distribution of University Data that is necessary for the Work. University control over University Data specifically includes determining notification requirements in a potential Incident.

2. Contractor is in the best position to control the manner and means of how the Work is performed. Therefore, the express intent of the parties is to hold Contractor accountable for information security standards and practices of Contractor Group, but only as they pertain to the Work.

3. Contractor is already familiar with the compliance requirements of applicable information and security statutes, rules, and regulations related to the Work or University Data. Contractor conducts business consistent with leading principles and practices of information security.

4. University has a continuing valid interest in obtaining current records and information from Contractor as assurance that Contractor Group is meeting expected standards of performance, and to substantiate Contractor’s representations.

III. OPERATIVE PROVISIONS

1. STANDARD OF CARE

a. Contractor represents and warrants that, with regard to protecting the confidentiality, availability, and integrity of University Data, the Work shall be undertaken with all due care, skill and judgment…