RFP DBH-26-011 CBRSC Fillable Forms.docx

Request For Proposals for

Substance Use Disorder and Recovery Services Community-Based Recovery Service Centers

Joshua Dugas, Acting Director Department of Behavioral Health

San Bernardino County Department of Behavioral Health Contracts Administration 550 Hospitality Lane, 1st Floor San Bernardino, CA 92415-0026

RFP - DBH 26-011

ePro Bid ID # DBHE26-ADMN-6399

ATTACHMENT A

PROPOSAL SUBMISSION CHECKLIST

Use this checklist to ensure that all items have been included. This form is to be completed and included in the proposal.

Proposer Name:

Address:

Telephone No.: ( ) FAX No.: ( ) Email Address:

Federal Tax ID:

RFP Contact:

Name of Authorized Representative:

Title of Authorized Representative:

By signing below, the individual acknowledges that he/she has the authority to bind the Proposer to the terms of the Proposal. The individual further acknowledges that he/she has read and understands the RFP, the contents of the Proposal and the Attachments, and attests to the accuracy of the information submitted therein.

Signature of Authorized Representative:

Date:

ATTACHMENT B

TABLE OF CONTENTS

Item Page Number

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

ATTACHMENT C

STATEMENTS OF CERTIFICATION

(initial and explain in E- Exceptions)

Regions to be served:

□East Valley □West Valley □Central Valley Region □Desert/Mountain Region

Services to be provided:

□ Standalone Services Recovery Center Both

Population to be served:

□Adult □Adolescent □Both

Signature (Authorized Signer) Date

Print/Type Name

Company/Agency

Address

ATTACHMENT D

REPORTABLE CONDITIONS

(Initial and explain in Attachment E- Disclosures/Exceptions)

Does the Proposer or agency/organization have any former county administrative officials who are employees or representatives?

Has the Proposer or agency/organization had completed similar contracts or projects during the last five years?

Has the Proposer or agency/organization had any contracts terminated prior to the original termination date?

Does the Proposer or agency/organization have similar contracts currently in place?

Does the Proposer or agency/organization have controlling interest in any agencies providing equivalent or similar services?

Does the Proposer or agency/organization have any financial interest in other lines of business?

Does the Proposer or agency/organization have any pending litigation regarding crimes or offenses, financial misconduct, or fraud involving the Proposer’s business, or any of its officers, employees, and/or consultants thereof, in connection with contracts?

Does the Proposer or agency/organization have any convictions or adverse court rulings involving fraud and/or related acts of all officers, consultants, and employees?

Signature (Authorized Signer) Date

Print/Type Name

Company/Agency

Address

Address

ATTACHMENT E

DISCLOSURES, EXCEPTIONS, AND PUBLIC RECORDS ACT EXEMPTIONS TO RFP

DISCLOSURES

Proposer reports the following:

EXCEPTIONS

Proposer has reviewed the RFP and General Contract Terms in their entirety and has the following exceptions. (Please list your exceptions by indicating the section or paragraph number, and page number, as applicable. Be specific about your objections to content, language, or omissions. Add as many pages as required.)

PUBLIC RECORDS ACT EXEMPTIONS

Proposer requests that specific portions of the contents of this Proposal be held confidential and not subject to public disclosure pursuant to the Public Records Act. The specific portions are detailed below: (Please identify and list your exemptions by indicating the Section or Paragraph number, and Page number, of the Proposal where the content is contained.) Each stated exemption must include a citation to supporting legal authority, including statutory authority or case law, to support exemption from the Public Records Act. Requested exemptions that does not meet the requirements of this section will not be considered.

Name of Authorized Representative:

Signature of Authorized Representative:

Title: Date:

Name and Title of Proposer’s Contact Person:

Mailing Address:

Telephone Number:

Fax Number:

E-mail Address:

Federal Employer Identification Number:

Number of Years under Current Name:

Justification for Subcontracting: (Work)

Capacity to Perform the Required Services Statement:

Subcontractor’s Authorized Signature:

The undersigned hereby certifies that the information above is correct and agrees to serve as a subcontractor on and perform all work as indicated above and will comply with all items as indicated in Section IV of Substance Use Disorder Recovery Services Community-Based Recovery Service Centers, RFP DBH 26-011.

Signature: Date:

Print/Type Name: Title:

ATTACHMENT G

PROPOSER’S FINANCIAL CAPABILITY

Use this page as a cover sheet for financial documents.

Per Section XI, Sub-Section C, Item #8 of this RFP:

Proposer must provide the Company’s three most recent and complete annual audited financial statements; the most recent must be completed within the past 18 months.

If business has been in existence less than three years, and audited financial statements are not available, you must provide the most recent financial statements that have been audited by an independent, certified public accountant.

If you do not have audited financial statements, please submit unaudited financial statements for the three most current years (including balance sheet, income statement, and statement of cash flow).

You must also provide an unaudited financial statement to cover the period from the last audited statement to present, ending no more than 120 days prior to the date of submission of this Proposal.

ATTACHMENT H

Indemnification and Insurance Requirements Affidavit

THE PROPOSER’S INSURANCE COMPANY(S) OR INSURANCE AGENT MUST COMPLETE THIS FORM

AND

THE PROPOSER MUST SUBMIT THIS COMPLETED AFFIDAVIT WITH THE PROPOSAL.

I, the undersigned (Please check one box) underwriter agent/broker, certify that I and the Proposer listed below have jointly reviewed the “Insurance Requirements” in this Request for Proposal (RFP). If the San Bernardino County (“County”) awards the Proposer the Contract for this project, I will be able—within fourteen (14) calendar days after the Proposer is notified of the Contract’s award—to furnish the County with all the required, insurance certificate(s) and endorsement(s) as specified in Section V, Paragraph B. Indemnification and Insurance Requirements.

Insurance Broker / Agency Name Date

Insurance Broker’s / Agent’s Name (Printed) Insurance Broker’s / Agent’s Name (signature)

Address City State Zip Code

Telephone Number FAX Number Email Address

Proposer’s Name County RFP Name and Number Below State the Name of Insurance Company Providing Coverage:

DO NOT write “Will Provide,” “To Be Determined,” “When required,” or similar phrases.

Commercial/General Liability Automobile Liability

Workers’ Compensation Liability Professional Liability

Cyber Liability

Sexual Abuse Liability

[NOTE TO PROPOSER: See Section V, Paragraph B. Indemnification and Insurance Requirements, for details on the basic requirements and types of insurance for this agreement.]

NOTE TO THE UNDERWRITER / AGENT-BROKER: If the insurance forms that the Proposer submits to the County do not fully comply with the Insurance Requirements, and/or if the Proposer fails to submit the forms within the 14-day time limit, the County may: (1) declare the Proposer’s Proposal non-responsive, and (2) award the Contract to the next highest ranked Proposer.

If you have any questions about the Insurance Requirements, please contact San Bernardino County - Risk Management Department via e-mail Insurance.Questions@RM.sbcounty.gov (Please provide name of RFP with your email question(s)).

Rev 08/01/19

ATTACHMENT I

Budget Proposal - Sample Budget Proposal – Sample TBD

ATTACHMENT J

BUDGETS

Use this page as a cover sheet when submitting budgets.

Submit complete Budgets (Schedule A’s) for each program, for each fiscal year and for each site (if applicable). Electronic version will be e-mailed to each agency upon verification of mandatory proposal conference attendance or upon request, as appropriate.

NOTE: Failure to submit the Budget sheets for each program, for each year and for each proposed site as required WILL result in the elimination of the entire submitted proposal (if applicable); it will not move forward in the evaluation process.

ATTACHMENT K

REFERENCES

Name/Address

Provide a minimum of three (3) customer references Proposer has contracted with, providing the same service as requested in this RFP.

*Enter “Present” if still providing the services (Example: 10/08/13 - present).

Name of Authorized Representative:

Signature of Authorized Representative:

Title: Date:

ATTACHMENT L

LICENSES, PERMITS, and/or CERTIFICATIONS

TYPE (ie: License, Permit, Certifications) EXPIRATION Include DIR Registration No. of Contractor and Subcontractors

ATTACHMENT M

ATTACHMENT N

Provider Information Report

ORGANIZATIONAL INFORMATION

Today’s Date

DBH Contract Start Date

Administration Address

Administration Hours

E-mail Address Administrative Contact Phone Number

Title

E-mail Address Designated back-up Phone Number

Title

E-mail Address Fiscal Contact Phone Number

Title

FACILITY INFORMATION

Facility/Clinic Name

Facility/Clinic E-mail Address (if applicable)

Status of the Medical Director: ☐ Employee of the organization listed above ☐ Contracted Medical Director ☐ Memorandum of Understanding (MOU) between the Organization and the Medical Director

Facility/Clinic Hours

Are extended night/weekend and/or holiday clinic hours offered? ☐ Yes ☐ No (If yes, please list those hours above)

Drug Medi-Cal Certified? ☐ Yes ☐ No □ Pending, date Application Submitted:

If Yes, indicate Drug Medi-Cal Certification Effective Date (Attach copy of DMC Letter)

DHCS Residential License (If youth, CA Department of Public Health) (Attach copy of license)

Alcohol and other Drug (AOD) Certification ☐ Yes ☐ No □ Pending, date Application Submitted:

(Attach copy of AOD Certification)

Any other Accreditation (i.e. CARF, JACO, CCAPP) Enter they type of accreditation above and attach copy of most recent monitoring report

ASAM LEVEL OF CARE DESIGNATION AND POPULATION SERVED

Early Intervention/Outpatient/Intensive Outpatient/Recovery Services (check all that apply):

early Intervention ☐1.0 Outpatient

☐ 2.1 Intensive Outpatient

Residential Treatment Services (check all that apply):

☐ 3.1 Low – Intensity Residential ☐ 3.3 High – Intensity Residential (population specific) ☐ 3.5 High – Intensity Residential

Withdrawal Management (check all that apply):

☐ 1-WM

Evidenced Based Practices (EBPs)

Providers will implement at least two EBPs per service modality. Check the box for the specific EBPs your agency will provide for this contract.

☐ Motivational Interviewing: A patient-centered, empathic, but directive counseling strategy designed to explore and reduce a person’s ambivalence toward treatment. This approach frequently includes other problem solving or solution-focused strategies that build on patients’ past successes.

☐ Cognitive-Behavioral Therapy: Based on the theory that most emotional and behavioral reactions are learned and that new ways of reacting and behaving can be learned.

☐ Relapse Prevention: A behavioral self-control program that teaches individuals with substance addiction how to anticipate and cope with the potential for relapse. Relapse prevention can be used as a stand-alone substance use treatment program or as an aftercare program to sustain gains achieved during initial substance use treatment.

☐ Trauma-Informed Treatment: Services shall take into account and understanding of trauma, and place priority on trauma survivors’ safety, choice and control.

☐ Psycho-Education: Psycho-educational groups are designed to educate patients about substance use, and related behaviors and consequences. Psycho-educational groups provide information designed to have a direct application to patients’ lives, to instill self-awareness, suggest options for growth and change, identify community resources that can assist patients in recovery, develop an understanding of the process of recovery, and prompt people using substances to take action on their own behalf.

Evidenced-Based (EB) curriculum(s) utilized within your Program. (Specify name and author of the EB curriculum)

Do you provide curriculum in any other language? ☐ Yes ☐ No [If yes, specify language(s)]

Does your organization have a current Cultural Competency Plan? ☐ Yes ☐ No (If yes, please provide a copy of the plan

ATTACHMENT O

FEDERAL CONTRACTING PROVISIONS

[NOTE – The last term requires a signature by the Contractor if the term applies. Delete this note.] Contractor shall to comply with the following additional terms:

A. Davis Bacon Act (40 USC §§ 3141-3144 and 3146-3148) *** If Applicable - Applies to contractors and subcontractors performing on federally funded or assisted contracts in excess of $2,000 for the construction, alteration, or repair (including painting and decorating) of public buildings or public works.

[NOTE: A copy of the current prevailing wage determination issued by the Dept. of Labor must be placed in each solicitation. \. All suspected or reported violations must be reported to the federal awarding agency. Delete this note.]

1. All transactions regarding this Contract shall be done in compliance with the Davis-Bacon Act (40 U.S.C. 3141- 3144, and 3146-3148) and the requirements of 29 C.F.R. pt. 5 as may be applicable.

2. Contractor shall comply with 40 U.S.C. 3141-3144, and 3146-3148 and the requirements of 29 C.F.R. pt. 5 as applicable.

3. Contractor agrees that a condition of this Contract is acceptance of the Department of Labor wage determination.

4. Contractors are required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor.

5. Additionally, contractors are required to pay wages not less than once a week.

6. *** If Applicable The Contractor and all subcontractors and sub-subcontractors are required to pay their employees and workers a wage not less than the minimum wage for the work classification as specified in both the Federal and California wage decisions. See Exhibit “XXX” for additional information regarding California Prevailing Wage Rate Requirements and the applicable general prevailing wage determinations which are on file with the County and are available to any interested party on request. The higher of the two applicable wage determinations, either California prevailing wage or Davis-Bacon Federal prevailing wage, will be enforced for all applicable work/services under this Contract.

B. Copeland “Anti-Kick Back” Act *** If applicable - Applies to all contracts and subcontracts for the performance of work on contracts for the construction, prosecution, repair, or completion of public buildings, public works, or works which are financed in whole or in part by loans or grants from the Federal government.

1. Contractor. Contractor shall comply with 18 U.S.C. § 874, 40 U.S.C. § 3145, and the requirements of 29 C.F.R. pt. 3 as may be applicable, which are incorporated by reference into this Contract.

2. Subcontracts. Contractor or subcontractor shall insert in any subcontracts the clause above and such other clauses as the federal government may by appropriate instructions require, and also a clause requiring the subcontractors to include these clauses in any lower tier subcontracts. The prime contractor shall be responsible for the compliance by any subcontractor or lower tier subcontractor with all of these contract clauses.

Breach. A breach of the Davis Bacon Act and Copeland “Anti-Kick Back” Act provisions may be grounds for termination of the contract, and for debarment as a contractor and subcontractor as provided in 29 C.F.R. § 5.12.

C. Contract Work Hours and Safety Standards Act (40 USC § 3702) ***If applicable - Applies to any contract in excess of $100,000 that may require or involve the employment of laborers or mechanics which is financed in part or in whole by the Federal government. It does not apply to the purchase of supplies or materials or articles ordinarily available on the open market.

1. Overtime requirements. No contractor or subcontractor contracting for any part of the contract work which may require or involve the employment of laborers or mechanics shall require or permit any such laborer or mechanic in any workweek in which he or she is employed on such work to work in excess of forty hours in such workweek unless such laborer or mechanic receives compensation at a rate not less than one and one-half times the basic rate of pay for all hours worked in excess of forty hours in such workweek.

2. Violation; liability for unpaid wages; liquidated damages. In the event of any violation of the clause set forth in paragraph (C)(1) of this section Contractor and any subcontractor responsible therefor shall be liable for the unpaid wages. In addition, Contractor and any subcontractor shall be liable to the United States (in the case of work done under contract for the District of Columbia or a territory, to such District or to such territory), for liquidated damages. Such liquidated damages shall be computed with respect to each individual laborer or mechanic, including watchmen and guards, employed in violation of the clause set forth in paragraph (C)(1) of this section, in the sum of $[Amount Set By Federal Funding Source] for each calendar day on which such individual was required or permitted to work in excess of the standard workweek of forty hours without payment of the overtime wages required by the clause set forth in paragraph (C)(1) of this section.

3. Withholding for unpaid wages and liquidated damages. The County, shall upon its own action or upon written request of an authorized representative of the Department of Labor withhold or cause to be withheld, from any moneys payable on account of work performed by Contractor or subcontractor under any such contract or any other Federal contract with the same prime contractor, or any other federally-assisted contract subject to the Contract Work Hours and Safety Standards Act, which is held by the same prime contractor, such sums as may be determined to be necessary to satisfy any liabilities of such contractor or subcontractor for unpaid wages and liquidated damages as provided in the clause set forth in paragraph (2) of this section.

4. Subcontracts. Contractor or subcontractor shall insert in any subcontracts the clauses set forth in paragraph (1) through (3) of this section and also a clause requiring the subcontractors to include these clauses in any lower tier subcontracts. The prime contractor shall be responsible for compliance by any subcontractor or lower tier subcontractor with the clauses set forth in paragraphs (1) through (4) of this section.

D. Clean Air Act and the Federal Water Pollution Control Act (42 USC §§ 7401-7671q, 33 USC §§ 1251-1387.)

***If applicable - Applies to all federally funded contracts in excess of $150,000.

Clean Air Act

1. Contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act, as amended, 42 U.S.C. § 7401 et seq.

2. Contractor agrees to report each violation to the County and understands and agrees that the County will, in turn, report each violation as required to assure notification to the federal funding source, and the appropriate Environmental Protection Agency Regional Office.

3. Contractor agrees to include these requirements in each subcontract exceeding $150,000 financed in whole or in part with Federal assistance.

Federal Water Pollution Control Act

1. Contractor agrees to comply with all applicable standards, orders, or regulations issued pursuant to the Federal Water Pollution Control Act, as amended, 33 U.S.C. 1251 et seq.

2. Contractor agrees to report each violation to the County and understands and agrees that the County will, in turn, report each violation as required to assure notification to the federal funding source, and the appropriate Environmental Protection Agency Regional Office.

3. Contractor agrees to include these requirements in each subcontract exceeding $150,000 financed in whole or in part with Federal assistance.

E. Procurement of Recovered Materials (45 CFR § 75.331) ***If applicable - Applicable to all contracts funded using Federal funds.

1. Contractor shall comply with the provisions of section 6002 of the Federal Solid Waste Disposal Act, as amended by the federal Resource conservation and Recovery Act, as the same may be amended, which include (but are not necessarily limited to): procuring only items designated in guidelines of the Environmental Protection Agency at 40 CFR Part 247 (as the same may be amended) that contain the highest percentage of recovered materials practicable, consistent with maintaining a satisfactory level of competition, where the purchase price of the item exceeds $10,000 or the value of the quantity acquired by the preceding fiscal year exceeded $10,000; procuring solid waste management services in a manner that maximizes energy and resource recovery; and establishing an affirmative procurement program for procurement of recovered materials identified in the Environmental Protection Agency guidelines.

2. This provision does not apply if the items cannot be acquired—

a. Competitively within a timeframe providing for compliance with the contract performance schedule;

b. Meeting contract performance requirements; or

c. At a reasonable price.

3. Information about this requirement, along with the list of EPA- designated items, is available at EPA’s Comprehensive Procurement Guidelines web site, https://www.epa.gov/smm/comprehensive-procurement-guideline-cpg-program.

4. The Contractor also agrees to comply with all other applicable requirements of Section 6002 of the Solid Waste Disposal Act.

F. Prohibited Telecommunications and Video Surveillance Equipment and Services (2 C.F.R. §200.216)

Contractor certifies that it will not use contract funds to:

(1) Procure or obtain covered telecommunications equipment or services;

(2) Extend or renew a contract to procure or obtain covered telecommunications equipment or services; or

(3) Enter into a contract (or extend or renew a contract) to procure or obtain covered telecommunications equipment or services.

“Covered telecommunications equipment or services” means those equipment and services defined at 2 C.F.R. §200.16(b).

G. Domestic Preference for Procurements (2 C.F.R. § 200.322)

Contractor should, to the greatest extent practicable and consistent with law, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States (including but not limited to iron, aluminum, steel, cement, and other manufactured products). “Produced in the United States” means, for iron and steel products, that all manufacturing processes, from the initial melting stage through the application of coatings, occurred in the United States. “Manufactured products” means items and construction materials composed in whole or in party of non-ferrous metals such as aluminum; plastics and polymer-based products such as polyvinyl chloride pipe; aggregates such as concrete; glass, including optical fiber; and lumber.

H. Combatting Trafficking in Persons ***If applicable – Applies if using federal funds in excess of $550,000 for the purchase of supplies (other than off the shelf supplies) or services from outside of the United States.

Contractor shall not engage in any prohibited activities identified in paragraph (b) of Federal Acquisition Regulation 52.222-50, Combating Trafficking in Persons. The County has the right to monitor, detect, and terminate the Contract if it is determined Contractor is engaging in prohibited activities identified at paragraph (b) and to refer such activities to the applicable law enforcement or federal authorities. Contractor shall comply with all requirements in paragraph (c) of Regulation 52.222-50 and immediately notify the County of any activity described in paragraph (d) of Regulation 52.222-50.

I. Byrd Anti-Lobbying Amendment (31 U.S.C. § 1352 (as amended)) ***If applicable – Generally applies to contracts that are federally funded and exceed $100,000.

Contractor certifies that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 USC 1352. Contractor shall also disclose to the County any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award.

[certification continued on next page]

ANTI- LOBBYING CERTIFICATION

The undersigned certifies, to the best of his or her knowledge and belief, that:

1. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.

2. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure Form to Report Lobbying,” in accordance with its instructions.

3. The undersigned shall require that the language of this certification be included in the award documents for all subawards at all tiers (including subcontracts, subgrants, and contracts under grants, loans, and cooperative agreements) and that all subrecipients shall certify and disclose accordingly.

4. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352, title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

5. The Contractor, _______________________, certifies or affirms the truthfulness and accuracy of each statement of its certification and disclosure, if any. In addition, the Contractor understands and agrees that the provisions of 31 U.S.C. Chap. 38, Administrative Remedies for False Claims and Statements, apply to this certification and disclosure, if any.

Signature of Contractor’s Authorized Official

Name and Title of Contractor’s Authorized Official

Date

ATTACHMENT P

RESERVED

ATTACHMENT Q

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (Agreement) supplements and is made a part of the contract (Contract) by and between the San Bernardino County Department of Behavioral Health (hereinafter Covered Entity) and [INSERT CONSULTANT NAME HERE] (hereinafter Business Associate). This Agreement is effective as of the effective date of the Contract.

RECITALS

WHEREAS, Covered Entity (CE) wishes to disclose certain information to Business Associate (BA) pursuant to the terms of the Contract, which may include Protected Health Information (PHI); and

WHEREAS, CE and BA intend to protect the privacy and provide for the security of the PHI disclosed to BA pursuant to the Contract in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (HIPAA), the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (HITECH Act), their implementing regulations, and other applicable laws; and

WHEREAS, The Privacy Rule and the Security Rule require CE to enter into a contract containing specific requirements with BA prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, sections 164.314, subdivision (a), 164.502, subdivision (e), and 164.504, subdivision (e) of the Code of Federal Regulations (C.F.R.) and contained in this Agreement; and

WHEREAS, Pursuant to HIPAA and the HITECH Act, BA shall fulfill the responsibilities of this Agreement by being in compliance with the applicable provisions of the HIPAA Standards for Privacy of PHI set forth at 45 C.F.R. sections 164.308 (Administrative Safeguards), 164.310 (Physical Safeguards), 164.312 (Technical Safeguards), 164.316 (Policies and Procedures and Documentation Requirements), and, 164.400, et seq. and 42 United States Code (U.S.C.) section 17932 (Breach Notification Rule), in the same manner as they apply to a CE under HIPAA;

NOW THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows:

A. Definitions Unless otherwise specified herein, capitalized terms used in this Agreement shall have the same meanings as given in the Privacy Rule, the Security Rule, the Breach Notification Rule, and HITECH Act, as and when amended from time to time.

1. Breach shall have the same meaning given to such term under the HIPAA Regulations [45 C.F.R. §164.402] and the HITECH Act [42 U.S.C. §§17921 et seq.], and as further described in California Civil Code section 1798.82.

2. Business Associate (BA) shall have the same meaning given to such term under the Privacy Rule, the Security Rule, and the HITECH Act, including but not limited to 42 U.S.C. section 17921 and 45 C.F.R. section 160.103.

3. Covered Entity (CE) shall have the same meaning given to such term as under the Privacy Rule and Security Rule, including, but not limited to 45 C.F.R. section 160.103.

4. Designated Record Set shall have the same meaning given to such term under 45 C.F.R. section 164.501.

5. Electronic Protected Health Information (ePHI) means PHI that is maintained in or transmitted by electronic media as defined in the Security Rule, 45 C.F.R. section 164.103.

6. Individual shall have the same meaning given to such term under 45 C.F.R. section 160.103.

7. Privacy Rule means the regulations promulgated under HIPAA by the United States Department of Health and Human Services (HHS) to protect the privacy of Protected Health Information, including, but not limited to, 45 C.F.R. Parts 160 and 164, subparts A and E.

8. Protected Health Information (PHI) shall have the same meaning given to such term under 45 C.F.R. section 160.103, limited to the information received from, or created or received by Business Associate from or on behalf of, CE.

9. Security Rule means the regulations promulgated under HIPAA by HHS to protect the security of ePHI, including, but not limited to, 45 C.F.R. Part 160 and 45 C.F.R. Part 164, subparts A and C.

10. Unsecured PHI shall have the same meaning given to such term under the HITECH Act and any guidance issued pursuant to such Act, including, but not limited to 42 U.S.C. section 17932, subdivision (h).

B. Obligations and Activities of BA

1. Permitted Uses and Disclosures BA may disclose PHI: (i) for the proper management and administration of BA; (ii) to carry out the legal responsibilities of BA; (iii) for purposes of Treatment, Payment and Operations (TPO); (iv) as required by law; or (v) for Data Aggregation purposes for the Health Care Operations of CE. Prior to making any other disclosures, BA must obtain a written authorization from the Individual.

If BA discloses PHI to a third party, BA must obtain, prior to making any such disclosure, (i) reasonable written assurances from such third party that such PHI will be held confidential as provided pursuant to this Agreement and only disclosed as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify BA of any breaches of confidentiality of the PHI, to the extent it has obtained knowledge of such breach. [42 U.S.C. section 17932; 45 C.F.R. sections 164.504(e)(2)(i), 164.504(e)(2)(i)(B), 164.504(e)(2)(ii)(A) and 164.504(e)(4)(ii)]

2. Prohibited Uses and Disclosures

i. BA shall not use, access or further disclose PHI other than as permitted or required by this Agreement and as specified in the attached Contract or as required by law. Further, BA shall not use PHI in any manner that would constitute a violation of the Privacy Rule or the HITECH Act. BA shall disclose to its employees, subcontractors, agents, or other third parties, and request from CE, only the minimum PHI necessary to perform or fulfill a specific function required or permitted hereunder.

ii. BA shall not use or disclose PHI for fundraising or marketing purposes.

iii. BA shall not disclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the PHI solely relates. (42 U.S.C. section 17935(a) and 45 C.F.R. section 164.522(a)(1)(i)(A).)

iv. BA shall not directly or indirectly receive remuneration in exchange for PHI, except with the prior written consent of CE and as permitted by the HITECH Act (42 U.S.C. section 17935(d)(2); and 45 C.F.R. section 164.508); however, this prohibition shall not affect payment by CE to BA for services provided pursuant to this Agreement.

3. Appropriate Safeguards

i. BA shall implement appropriate safeguards to prevent the unauthorized use or disclosure of PHI, including, but not limited to, administrative, physical and technical safeguards that reasonably protect the confidentiality, integrity and availability of the PHI BA creates, receives, maintains, or transmits on behalf of the CE, in accordance with 45 C.F.R. sections 164.308, 164.310, 164.312 and 164.316. [45 C.F.R. sections 164.504(e)(2)(ii)(b) and 164.308(b).]

ii. In accordance with 45 C.F.R. section 164.316, BA shall maintain reasonable and appropriate written policies and procedures for its privacy and security program in order to comply with the standards, implementation specifications, or any other requirements of the Privacy Rule and applicable provisions of the Security Rule.

iii. BA shall provide appropriate training for its workforce on the requirements of the Privacy Rule and Security Rule as those regulations affect the proper handling, use confidentiality and disclosure of the CE’s PHI.

Such training will include specific guidance relating to sanctions against workforce members who fail to comply with privacy and security policies and procedures and the obligations of the BA under this Agreement.

4. Subcontractors BA shall enter into written agreements with agents and subcontractors to whom BA provides CE’s PHI that impose the same restrictions and conditions on such agents and subcontractors that apply to BA with respect to such PHI, and that require compliance with all appropriate safeguards as found in this Agreement.

5. Reporting of Improper Access, Use or Disclosure or Breach Every suspected and actual Breach shall be reported immediately, but no later than one (1) business day upon discovery, to CE’s Office of Compliance, consistent with the regulations under HITECH Act. Upon discovery of a Breach or suspected Breach, BA shall complete the following actions:

i. Provide CE’s Office of Compliance with the following information to include but not limited to:

a) Date the Breach or suspected Breach occurred;

b) Date the Breach or suspected Breach was discovered;

c) Number of staff, employees, subcontractors, agents or other third parties and the names and titles of each person allegedly involved;

d) Number of potentially affected Individual(s) with contact information; and

e) Description of how the Breach or suspected Breach allegedly occurred.

ii. Conduct and document a risk assessment by investigating without unreasonable delay and in no case later than five (5) calendar days of discovery of the Breach or suspected Breach to determine the following:

a) The nature and extent of the PHI involved, including the types of identifiers and likelihood of re-identification;

b) The unauthorized person who had access to the PHI;

c) Whether the PHI was actually acquired or viewed; and

d) The extent to which the risk to PHI has been mitigated.

iii. Provide a completed risk assessment and investigation documentation to CE’s Office of Compliance within ten (10) calendar days of discovery of the Breach or suspected Breach with a determination as to whether a Breach has occurred. At the discretion of CE, additional information may be requested.

a) If BA and CE agree that a Breach has not occurred, notification to Individual(s) is not required.

b) If a Breach has occurred, notification to the Individual(s) is required and BA must provide CE with affected Individual(s) name and contact information so that CE can provide notification.

iv. Make available to CE and governing State and Federal agencies in a time and manner designated by CE or governing State and Federal agencies, any policies, procedures, internal practices and records relating to a Breach or suspected Breach for the purposes of audit or should the CE reserve the right to conduct its own investigation and analysis.

6. Access to PHI To the extent BA maintains a Designated Record Set on behalf of CE, BA shall make PHI maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within ten (10) days of a request by CE to enable CE to fulfill its obligations under the Privacy Rule. If BA maintains ePHI, BA shall provide such information in electronic format to enable CE to fulfill its obligations under the HITECH Act. If BA receives a request from an Individual for access to PHI, BA shall immediately forward such request to CE.

7. Amendment of PHI If BA maintains a Designated Record Set on behalf of the CE, BA shall make any amendment(s) to PHI in a Designated Record Set that the CE directs or agrees to, pursuant to 45 C.F.R. section 164.526, or take other measures as necessary to satisfy CE’s obligations under 45 C.F.R. section 164.526, in the time and manner designated by the CE.

8. Access to Records BA shall make internal practices, books, and records, including policies and procedures, relating to the use, access and disclosure of PHI received from, or created or received by BA on behalf of, CE available to the Secretary of HHS, in a time and manner designated by the Secretary, for purposes of the Secretary determining CE’s compliance with the Privacy Rule and Security Rule and patient confidentiality regulations. Any documentation provided to the Secretary shall also be provided to the CE upon request.

9. Accounting for Disclosures BA, its agents and subcontractors shall document disclosures of PHI and information related to such disclosures as required by HIPAA. This requirement does not apply to disclosures made for purposes of TPO. BA shall provide an accounting of disclosures to CE or an Individual, in the time and manner designated by the CE. BA agrees to implement a process that allows for an accounting to be collected and maintained by BA and its agents or subcontractors for at least six (6) years prior to the request. At a minimum, the information collected and maintained shall include: (i) the date of disclosure; (ii) the name of the entity or person who received PHI and, if known, the address of the entity or person; (iii) a brief description of PHI disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the Individual’s authorization, or a copy of the written request for disclosure.

10. Termination CE may immediately terminate this agreement, and any related agreements, if CE determines that BA has breached a material term of this agreement. CE may, at its sole discretion, provide BA an opportunity to cure the breach or end the violation within the time specified by the CE.

11. Return of PHI Upon termination of this Agreement, BA shall return all PHI required to be retained by the BA or its subcontractors, employees or agents on behalf of the CE. In the event the BA determines that returning the PHI is not feasible, the BA shall provide the CE with written notification of the conditions that make return not feasible. Additionally, the BA must follow established policies and procedures to ensure PHI is safeguarded and disposed of adequately in accordance with 45 C.F.R. section 164.310, and must submit to the CE a certification of destruction of PHI. For destruction of ePHI, the National Institute of Standards and Technology (NIST) guidelines must be followed. BA further agrees to extend any and all protections, limitations, and restrictions contained in this Agreement, to any PHI retained by BA or its subcontractors, employees or agents after the termination of this Agreement, and to limit any further use, access or disclosures.

12. Breach by the CE Pursuant to 42 U.S.C. section 17934, subdivision (b), if the BA is aware of any activity or practice by the CE that constitutes a material Breach or violation of the CE’s obligations under this Agreement, the BA must take reasonable steps to address the Breach and/or end eliminate the continued violation, if the BA has the capability of mitigating said violation. If the BA is unsuccessful in eliminating the violation and the CE continues with non-compliant activity, the BA must terminate the Agreement (if feasible) and report the violation to the Secretary of HHS.

13. Mitigation BA shall have procedures in place to mitigate, to the extent practicable, any harmful effect that is known to BA of a use, access or disclosure of PHI by BA, its agents or subcontractors in violation of the requirements of this Agreement.

14. Costs Associated to Breach BA shall be responsible for reasonable costs associated with a Breach. Costs shall be based upon the required notification type as deemed appropriate and necessary by the CE and shall not be reimbursable under the Agreement at any time. CE shall determine the method to invoice the BA for said costs. Costs shall incur at the current rates and may include, but are not limited to the following:

· Postage;

· Alternative means of notice;

· Media notification; and

· Credit monitoring services.

15. Direct Liability BA may be held directly liable under HIPAA for impermissible uses and disclosures of PHI; failure to…