RFQ-PR24-016 Ultrasound-Radiology Technologist Services - Kyle Health Center.pdf

A. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice, FAR Part 12, Acquisition of Commercial Items (Title VIII of the Federal Acquisition Streamlining Act of 1994) (Public Law 103-355). This announcement constitutes the only solicitation;

quotes are being requested and a written solicitation will not be issued.

B. The Great Plains Area Indian Health Service (IHS) Pine Ridge Service Unit intends to award a Firm-Fixed Price, Non-Personal Service Type, Commercial Item, Purchase

Order in response to Request for Quote (RFQ) RFQ-PR24-016.

C. This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2024-05 04/22/2024.

D. This RFQ is issued as a 100% Buy Indian (IEE), Small Business Set-Aside, and the associated NAICS Code is 621512, which has a small business standard of $19.0.

E. The quoted unit pricing must be all inclusive (to include but not be limited to travel, lodging, per diem, fringe benefits, federal, state and local taxes) plus all other costs pertinent to the performance of this contract. Utilize your most competitive and reasonable rates.

Ultrasound and General Radiology Services -

Ultrasound Services will be one (1) day per week and General Radiology Services based upon urgent need for staff shortages. Work hours will be 8:00am to 4:30pm on scheduled days.

475 hours @ $___________________ per hour = $_______________________

F. To provide Ultrasound and General Radiology Services for the I H S Kyle Health

Center, 1000 Health Center Road, Kyle, South Dakota.

G. The period of performance will be August 18, 2024 through August 17, 2025.

H. FAR 52.212-1 Instructions to Offerors—Commercial Products and Commercial

Services (Sep 2023).

Quotes shall be submitted on company letterhead stationery, signed, dated and it shall include:

1. Solicitation number RFQ-PR24-016.

2. Closing Date: July 10, 2024 at 12:00 pm MST.

3. Name, address and telephone number of company and email address of contact person.

4. Technical description of the item/service being offered in sufficient detail to evaluate compliance with the requirements of the solicitation. This may include product literature, or other documents, if necessary.

5. Terms of any express warranty.

6. Price and any discount terms.

7. “Remit to” address, if different than mailing address.

8. A completed copy of the representations and certifications at FAR 52.212-3

(see FAR 52.212-3(b) for those representations and certifications that the offeror shall complete electronically).

9. Acknowledgment of Solicitation Amendments (if any issued)

10. Past performance information, when included as an evaluation factor, to include recent and relevant contracts for the same or similar items and other references (including contract numbers, points of contact with telephone numbers and other relevant information).

11. A statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation. Offerors that fail to furnish required representations or information, or reject the terms and conditions of the solicitation may be excluded from consideration.

Basis of award is Lowest Price Technically Acceptable “LPTA” factors in determining the successful contractor.

1. Ability to meet the requirements and qualification in the Statement of Work.

2. Ability to meet the performance schedule.

3. Reasonableness of Price.

4. Responsiveness to requirement

I. FAR 52.212-3 Offer Representations and Certifications-Commercial Products and

Commercial Services (May 2024). See attachment for full text.

The Offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) website accessed through https://www.sam.gov. If the

Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (v) of this provision.

J. FAR 52.212-4 Contract Terms and Conditions – Commercial Products and

Commercial Services (Nov 2023). See attachment; in by reference.

K. FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or

Executive Orders—Commercial Products and Commercial Services (May 2024). See attachment for full text.

L. Attached are the Federal Acquisition Regulations (FAR) & Health & Human Services

Acquisition Regulation (HHSAR) clauses that are applicable including below.

https://www.sam.gov/

M. Offers will be accepted electronically, submit via e-mail to the following:

Kim Carpio, Purchasing Agent email kim.carpio@ihs.gov

The quoter is hereby notified that they must be registered in System for Award

Management (SAM) before the Government will issue an award. You may do so by going to www.sam.gov to register and you are required to update this registration every year prior to the expiration date.

DUNS to Unique Entity ID (SAM) Transition

The DUNS Number is no longer valid for federal award identification. The Unique

Entity ID (UEI) is generated in SAM.gov. If you are registered in SAM.gov (active or not), you already have a Unique Entity ID. It is viewable at www.sam.gov.

No Questions in regards to this solicitation will be accepted.

ACCEPTANCE PERIOD: Your proposal must stipulate that it is predicated upon all the terms and conditions of this RFQ. In addition, it must contain a statement to the effect that it is firm for a period of at least 30 days from the date of receipt by the Government.

Quotation must set forth full, accurate and complete information as required by the Request for Quotation (RFQ) and be returned no later than the date stated above. All required information must be submitted in order to be considered responsive and eligible for award.

No contract award shall be made to any vendor listed on the OIG Exclusions List at http://exclusions.org.hhs.gov throughout the duration of the contract.

The Government reserves the right to accept or reject services, if the level of performance is unacceptable.

Invoice Processing Platform (IPP)

In compliance with the Office of Management and Budget (OMB) M-15-19 memorandum

“Improving Government Efficiency and Saving Taxpayer Dollars Through Electronic Invoicing” directing Federal agencies to adopt electronic invoicing as the primary means to disburse payment to vendors. Invoices submitted under any award resulting from this solicitation will be required to utilize the Invoice Processing Platform (IPP) in accordance with HHSAR

352.232-71, Electronic Submission and Processing of Payment Requests.

IPP is a secure, web-based electronic invoicing system provided by the U.S. Department of the Treasury’s Bureau of the Fiscal Service, in partnership with the Federal Reserve Bank of

St. Louis (FRSTL). Respondents to this solicitation are encouraged to register an account with IPP if they have not already done so. If your organization is already registered to use mailto:kim.carpio@ihs.gov http://www.sam.gov/ http://www.sam.gov/ http://exclusions.org.hhs.gov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-19.pdf

IPP, you will not be required to re-register- however, we encourage you make sure your organization and designated IPP user accounts are valid and up to date.

The IPP website address is: https://www.ipp.gov

If you require assistance registering or IPP account access, please contact the IPP Helpdesk at (866) 973-3131 (M-F 8AM to 6PM ET), or IPPCustomerSupport@fiscal.treasury.gov

Should the contractor feel that use of the IPP would be unduly burdensome, their response to this solicitation should include an explanation of this position for a determination by the contracting officer.

https://www.ipp.gov/ mailto:IPPCustomerSupport@fiscal.treasury.gov

DEPARTMENT OF HEALTH & HUMAN SERVICES

Indian Health Service Office of Management Services

Division of Acquisition Policy (DAP) 5600 Fishers Lane

Rockville, MD 20857

INDIAN HEALTH SERVICE

BUY INDIAN ACT

INDIAN ECONOMIC ENTERPRISE

REPRESENTATION FORM

SOLICITATION/SOURCES SOUGHT/RFI #: _________________________________________________

PROJECT TITLE: ________________________________________________________

DATE: ___________________________________________________________________

In accordance with 25 U.S.C. 47 the Buy Indian Act, the signature below constitutes self-certification that the Offeror meets the definition of an “Indian Economic Enterprise” (HHSAR 326.601) in response to this Sources Sought Notice, Request for Information (RFI) or Solicitation and resultant contract.

The enterprise must meet the definition of “Indian Economic Enterprise” throughout the following time periods:

(1) At the time an offer is made in response to this solicitation;

(2) At the time of contract award; and

(3) During the full term of the contract performance period. At any point during these periods, if the Contractor no longer meets the eligibility requirements, the contractor must provide immediate written notification to the Contracting Officer.

Individual Contracting Officers may require documentation of eligibility before awarding a set-aside or sole source contracts under the Buy Indian Act and awards may be subject to protest if the eligibility of the successful Offeror is in question. In addition to the self-certification requirements, successful Offerors must also be registered with the System of Award Management (SAM).

Any false or misleading information submitted by an enterprise when submitting an offer in consideration of an award set-aside under the authority of the Buy Indian Act is a violation of the law and punishable under 18 U.S.C. 1001.

False claims submitted as part of contract performance are subject to the penalties enumerated in 31 U.S.C. 3729 to 3731 and 18 U.S.C. 287.

REPRESENTATION

The Offeror represents as part of its offer that it does _____, does not _____ meet the definition of an “Indian Economic Enterprise” with “Indian Ownership” under the authority of the Buy Indian Act.

Name of the 51% owner of IEE Firm

Certifying Signature

Print Name

Name of Federally Recognized Tribal Entity

Business Name

DUNS Number

CONTRACTORS PERFORMANCE CONDITIONS & RESPONSIBILITES

1. Contractor is responsible for reporting all taxes from wages earned under this contract to the appropriate State and Federal Agencies, provided the awardee is an individual.

2. Contractor is responsible for his/her own reliable transportation in the performance of the contract.

3. Contractor is responsible for Fringe Benefits and other benefits such as health, retirement, etc. for his/her employees, if other than self.

4. Contractor is responsible for maintaining satisfactory standards of competence, conduct, appearance and integrity. The quality of work performance of the contract shall be subject to review.

5. Contractor is responsible for notifying the designated supervisor/director if he/she will be late, ill or unable to work for other reasons.

6. Contractor earns no leave and is compensated only for hours actually worked at the agreed compensatory rate.

7. Contractor is responsible for signing-in and signing-out of immediate work area, utilizing in-house system of accountability.

8. In accordance with Indian Health Service Circular No. 19-05, all Indian Health Service

(IHS) health care providers, including, but not limited to, employees, volunteers, and

CONTRACTORS shall review Chapter 20 – Protecting Children from Sexual Abuse by

Health Care Providers the policy can be found at https://www.ihs.gov/ihm/pc/part-

3/p3c20/. Also, review the training titled “Child Sexual Abuse Briefing-IHS June

2019” (training slides are available at Orientation or contact the Contacting Officer).

https://www.ihs.gov/ihm/pc/part-3/p3c20/ https://www.ihs.gov/ihm/pc/part-3/p3c20/

STATEMENT OF WORK FOR

ULTRASOUND/RADIOLOGY

TECHNOLOGIST SERVICES

FOR THE

KYLE INDIAN HEALTH CENTER

KYLE, SOUTH DAKOTA

BACKGROUND:

The X-Ray Department at the IHS Kyle Health Center is to be staffed by one full-time Radiology

Technician with skills in general radiology whose mission is to provide full-scope, quality radiological services to patients of the Oglala Sioux Tribe.

Patients requiring ultrasound and/or services are always seen first by a physician in the

Outpatient Department who then submits a requisition to the Radiology Department. The IHS

Kyle Health Center staff and Contractor shall work in close cooperation in order to meet the needs of the patient.

POTENTIAL CONTRACTOR STAFF FINGER PRINT CLEARANCE:

As stated in the October 2010 guidance from Dr. Roubideaux, no one is authorized to work without receiving proper fingerprint clearance. This will be interpreted as follows for contractors:

Fingerprints are provided and cleared prior to the start of the contract at any of our sites to perform work. Once the clearance is granted, the Active Directory account will be created and the Security Checklist will be provided to the acquisition official by the HSPD-12/Security office. Then an established purchase order for contract work performance can begin after this clearance notification is received at Kyle Health Center. If a potential contractor cannot get fingerprinted prior to contract start date at a location near their base, they may obtain finger printing at Pine Ridge Hospital or Kyle Health Center; however, they may not perform any duties and will not be paid for the travel to or time spent waiting for fingerprint clearance. This will be the responsibility of the contracted vendor to obtain prior fingerprinting or cover the cost of the 2-5 days to obtain clearance; thus it is highly recommended that fingerprint be obtained at a location closest to the home base of the vendor. Procurement department will assist with finding the closet location for federal fingerprinting access.

PURPOSE:

The primary purpose of this contract is for the provision of ultrasound and general radiology services to be provided at the IHS Kyle Health Center by a currently registered technician with credentials in Ultrasound and General Radiology. The Contractor shall provide specialized

Ultrasound care one (1) day per week every week for the duration of the contract and random day General Radiology services based upon urgent need for staffing shortages. Contractor receives instructions and supervision from the Department Supervisor and Clinical Director.

TASKS:

Ultrasound/Radiology Technologist services shall be provided in the IHS Kyle Health Center.

The services will include diagnostic care. In performance of this procurement the Contractor shall specifically carry out the tasks listed below:

1. Provide examination for all patients presenting to the Radiology Department after being examined by a Health Care Provider.

2. Independently operates a GE E9 and GE Proteus equipment to meet the needs of the department.

3. Receives patients, explains methods of procedures, positions and sets technical factors to attain a high quality sonograph and/or radiology exam.

4. Performs CR (Centricity) duties to include creating image, performing QC on images on the screen to verify films, uses the digital processor and prepare the images for transmittal to PACS at Pine Ridge or radiology. Performs film download to CD for patient referral.

5. Maintains a quality control system for the automatic film processor on a daily basis to meet all M/M, HIPAA and JCAHO standards. This includes using a sensitometer and densitometer on a daily basis and log results on the “Daily Log Sheet” in the appropriate manual.

6. Performs a variety of routine to complex examinations to meet the needs of the Medical

Staff, as well as, the needs of the specialty clinic physicians.

7. Assists the Radiology supervisor in maintaining records of all functions at this department and keeps documentation on file as required by HIPAA and CMS/JCAHO.

This includes any repairs of equipment, surveys, etc. Contractor shall abide by the

HIPAA and CMS/JCAHO standards.

8. Notifies staff (providers) of any repairs or downtime of equipment.

9. Maintains accurate records of patient workload examinations on a daily basis.

10. Monitors all of his/her sonographs and radiology exams taken to assure high quality.

11. Keeps accurate records for every sonograph and radiology exam, which has to be repeated and lists the reasons why.

12. Contractor must be able to assist in a cardiac arrest situation. This will include knowing

CPR and recognizing anaphylaxis and respond to other emergency situations with other staff members.

13. The Contractor shall provide coverage in the Radiology Department 1 days per week as determined by vendor and Radiology Supervisor to meet the needs of the patient volume for ultrasound requests and random day coverage of general radiology.

14. The Contractor shall agree to provide services to patients as they are referred from the

Outpatient Clinic. Work hours will be from 8:00 AM to 4:30 PM on 1 schedule day of week. Lunch will be from 12:00 PM to 12:30 PM.

PERIOD OF PERFORMANCE

This contract shall begin from AUGUST 18, 2024 THRU AUG 17, 2025 requested are used (475 hours maximum). Total contracted hours will be 475 hrs and shift will be 8:00AM to 4:30PM, at

Kyle Health Center. Total contract commitment will not exceed $ allocated. Kyle Health Center is not open on weekends or Federal government holidays.

QUALIFICATIONS:

Individual must be ARDMS eligible and be experienced to perform a wide range of ultrasounds and must be eligible ARRT dual modality to meet the requirement set for taking X-rays. Must have at least one year of experience in performing ultrasound examinations.

Pine Ridge Indian Health Service hospital policy requires all staff with direct patient contact, be able to provide proof of PPD and Tdap (Tetanus, Diphtheria, acellular Pertussis). This includes all permanent employees, volunteers, and contractors (for all contractors in this category, acceptable proof can be in the form of an immunization record or written documentation from a physician). Contractor personnel currently serving in a contract position can receive these immunizations from the facility.

Basic Life Support (BLS) certification is also a requirement for the location under the Pine Ridge

Service Unit Emergency Preparedness Plan.

GOVERNMENT-PROVIDED EQUIPMENT

The Service Unit shall provide office space including a desk, chair and office supplies. The

Contractor will be authorized to use all areas of the medical treatment facility available to civil service and commissioned corps personnel in similar positions. The same restrictions apply to the Contractor as any other Indian Health Service personnel to use these areas for official business activities only.

The Contractor will be authorized to use all administrative and professional support available to

Indian Health Service personnel. This will include but not be limited to copy machines, fax machines and telephone service. The same restrictions to use these items for official Indian

Health Service business apply.

The Contractor shall be provided with an orientation to the Indian Health Service. The initial orientation and continuing orientation shall be provided by health center personnel.

The health center shall provide all medical and nonmedical equipment and supplies used by the

IHS Kyle Health Center for the care and management of patients.

The health center shall provide all required blank government forms applicable to the Indian

Health Service. An appropriate orientation to the necessity of such forms will be provided by health center personnel.

The health center shall provide an ongoing method of monitoring and evaluation of the quality and appropriateness of patient care and identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

The health center will not provide transcription services. Legible handwritten documentation of medical records is acceptable in place of recorded dictation.

CONTRACTOR-PROVIDED EQUIPMENT

The Indian Health Service does not anticipate a need for contractor furnished equipment.

However, any instrument or piece of equipment specifically preferred or requested by Contractor may be allowed after approval by the Radiology Supervisor.

CONTRACTOR RESPONSIBILITIES

To obtain contractor staff fingerprinting and notice by Kyle Indian Health Center procurement staff of clearance prior to start date of contract so as not to delay direct patient care.

The Contractor shall comply with the following quality of care protocol:

1. It shall be understood that eligible patients under treatment will be rendered services that provide the best medical care within the Contractor's professional training and experience. All services rendered shall be in accordance with current standard medical practices to assure quality of care. Two weeks’ notice will be provided to the contractor by the Radiology supervisor prior to the dates a technologist is needed. In case of an emergency, shorter notice will be negotiated by each party.

2. Individuals providing services under this contract, which involve regular contact with, or control over, Indian children, are subject to a character investigation in accordance with the “Indian Child Protection and Family Violence Prevention

Act” P.L. 101-630. The Indian Health Service Personnel Office will conduct these investigations following award of a contract unless in the judgment of the

Contracting Officer, in consultation with the Personnel Officer, investigation may be waived based on prior investigations on file. Until the character investigation has been completed and the Contracting Officer notified, such individual shall not have unsupervised contact with Indian children.

3. The Contractor shall ensure that any potential candidates are fingerprinted and background cleared prior to start date of the contract work.

4. The Contractor understands that the IHS will not pay or withhold on behalf of the

Contractor any sums for federal or state income tax, any other federal or state tax, unemployment insurance, social security, worker’s compensation, or any other withholding pursuant to any law or requirement. All such payments and withholdings are the sole responsibility of Contractor.

QUALITY OF CARE

1. It shall be understood that eligible patients under treatment will be rendered services that provide the best medical care within the Contractor's professional training and experience. All services rendered shall be in accordance with current standard medical practices to assure quality of care. A Work Schedule will be provided to the contractor by the Radiology supervisor or Contract Officer Representative prior to the start date of the contract.

2. The Contractor shall be familiar and adhere to the policy and procedures of Radiology

Department at the Pine Ridge Service Unit, Kyle Health Center in South Dakota. The education and training (i.e the credentials) of the Contractor shall comply with the

Medical Staff By-laws of the service unit for all services provided in Public Health

Service clinics and the Statement of work requirements for this position. The Contractor shall agree to abide by the HIPAA and CMS standards.

3. The quality of work performed by the Contractor will be subject to review by chart audits, review by the Radiology Supervisor, Radiologist, and site visits by the Contract

Officer Technical Representative, Vendor Project Officer or designee as needed. The

Radiology Supervisor and/or Radiologist will conduct quality Review audits.

1. Deliverable 1: The Vendor will provide Curriculum Vitale and education documentation for candidates presented to fulfill the requirements of this contract.

The PRSU will review the Vendor for all background clearance actions for compliance. (See attachment 2a)

2. Deliverable 2: The Vendor for the Ultrasound/Sonographer Radiology Technician contract will provide documentation of current education and training, and will also support and participate in the ongoing Continuous Quality/ Performance

Improvement at the Pine Ridge Service Unit. Quality Assurance: The Program will consist of reporting the RPMS/PACS documentation. (Quality Activity 2b)

The Vendor will ensure timely completion of documentation of RPMS/ PACS

(electronic health record and digital radiologic program). Radiology Supervisor will ensure accuracy prior to signing timecards at the end of each week. If malicious discrepancies are identified, vendor will ensure timely correction of documentation and or replacement of candidate. Vendor will work with Radiology Supervisor to ensure quality care is provided. (See attachment 2b)

3. Deliverable 3 conducted by the Government: Compliance with CMS and/or JC accreditation surveys. PRSU will be conducting Environment of Care rounds, Internal Audits, Tracer activities, etc. Any deficiencies cited that involve contractor staff, will be addressed for correction with the Department Supervisor and Vendor as necessary. (See attachment 2c)

Appendix___: Business Associate Agreement

I. Authority:

Pursuant to 45 C.F.R. § 164.502(e), the Indian Health Service (IHS), as a covered entity, is required to enter into an agreement with a “business associate,” as defined by 45 C.F.R. § 160.103, under which the business associate must agree to appropriately safeguard Protected Health Information (PHI) that it will use and disclose when performing functions, activities or services pursuant to its contract with the IHS. By signing Contract No. ________ (Contract), _______________ agrees that it is a Business Associate and will comply with the terms below, in addition to other applicable Contract terms and conditions, and applicable law, relating to the safekeeping, use, and disclosure of PHI. This Appendix comprises the Business Associate Agreement (Agreement).

II. Definitions:

The following terms shall have the same meaning as those terms in 45 C.F.R. Part 160 and Part 164, which are the federal regulations implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended: Breach, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, PHI, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.

A. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and in reference to the party to this Agreement shall mean ____________.

B. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. § 160.103, and in reference to the party to this Agreement, shall mean the IHS.

C. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

D. Master Patient Index (MPI). The “Master Patient Index” or “MPI” is composed of a unique list of patients and a current list of medical centers where each patient has been seen. This enables the sharing of patient data between operationally and regionally diverse systems. Each record (or index entry) on the MPI contains a small amount of patient data used to identify individual entries.

The mission of the MPI is to uniquely identify a patient and to “link” that patient’s data throughout the IHS facilities using the Integration Control Number (ICN). The MPI is the authoritative source of a patient’s ICN, the enterprise-wide identifier for IHS facilities and the key to accessing a patient’s record. The accuracy of patient information and patient identification directly affects clinical, administrative, billing, and interdepartmental processes.

III. Obligations and Activities of Business Associate:

A. Compliance: Business Associate agrees not use or disclose PHI other than as authorized by the Agreement or as required by law. Business Associate acknowledges that it is directly liable under the HIPAA Rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of PHI that are not authorized by the Agreement or required by law. Business Associate agrees that it will require all of its agents, employees, subsidiaries, and affiliates, to whom Business Associate provides PHI, or who create or receive PHI on behalf of Business Associate for Covered Entity, to comply with the HIPAA Rules and to enter into written agreements with Business Associate that provide the same restrictions, terms, and conditions as set forth in the Agreement.

B. Subcontractors: In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and

164.308(b)(2), which govern relations with subcontractors, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, terms, and conditions that apply to Business Associate with respect to such PHI.

C. Safeguarding PHI: Business Associate shall develop and use appropriate procedural, physical, and electronic safeguards to protect against the use or disclosure of PHI in a manner not authorized by this Agreement or required by law. Business Associate will limit any use, disclosure, or request for use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request.

D. Safeguarding Electronic PHI: Business Associate agrees to use appropriate safeguards, as set forth in Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of electronic PHI other than as authorized by this Agreement or required by law.

E. Reporting Use or Disclosures Not Authorized By this Agreement or Required by Law: Business Associate agrees to report to Covered Entity any use or disclosure of PHI not authorized by this Agreement or required by law within thirty (30) days of discovering the use or disclosure, or any security incident of which it becomes aware. In addition, Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of the use, disclosure, or security incident.

F. Reporting of Breach: In accordance with the policy of the Department of Health and Human Services, Business Associate will report, within one hour of discovery, all suspected or confirmed breaches to Covered Entity.

G. Notification of Breach of Unsecured PHI: In addition to the above, Business

Associate shall notify Covered Entity of a breach, as set forth in 45 C.F.R. § 164.410, of the security of any unsecured PHI that Business Associate received from, or created or received on behalf of, Covered Entity within thirty (30) calendar days after the discovery of the breach by Business Associate, its employees, officers, and/or other agents, unless notification is specifically excepted by 45 C.F.R. § 164.412.

1. Requirements of Notice. Such notice shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of the circumstances of the breach of security, including the date of the breach and the date of Business Associate’s discovery of the breach; and the type of unsecured PHI involved in the breach. Business Associate agrees to provide any other available information that Covered Entity is required to include in notification to the individual under 45 §164.404(c). In the event notification is delayed, evidence demonstrating the necessity of the delay shall accompany the notification.

H. Individual Access to PHI: Business Associate shall maintain a designated record set for each individual for whom it maintains PHI. In accordance with an individual’s right to access his or her PHI, Business Associate shall make available all PHI in the individual’s designated record set to the individual to whom that information pertains, or, upon the request of the individual, to that individual’s authorized representative, as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524. Availability to access PHI shall be made within five (5) calendar days of receipt of a valid request.

I. Accounting of Disclosures: Business Associate shall maintain records of PHI received from, or created or received on behalf of, Covered Entity and shall document subsequent uses and disclosures of such information by Business Associate. Business Associate shall, within five (5) calendar days after receiving a request from Covered Entity, provide to Covered Entity such information as Covered Entity may require to fulfill its obligations to account for disclosures of PHI pursuant to 45 C.F.R. § 164.528.

J. Amendment of PHI: Business Associate shall, within five (5) calendar days of a request by Covered Entity, make PHI available to Covered Entity for Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526 to amend PHI and shall, as directed by Covered Entity, within five (5) calendar days of receipt of such direction, incorporate any amendments into PHI held by Business Associate. In addition, Business Associate shall ensure incorporation of any such amendments into PHI held by its agents or subcontractors within ten (10) days of such direction, and shall notify Covered Entity within five (5) calendar days of when those agents or subcontractors have completed the incorporation of the amendments. Business Associate shall forward to Covered Entity all requests to amend PHI that it receives directly from individuals within five (5) calendar days of its receipt of a request.

K. Carrying out Covered Entity’s Obligations: To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

L. Disclosures for Verifying Compliance: Upon request, Business Associate shall permit access by the Secretary and Covered Entity during normal business hours to its facilities, books, records, accounts, and any other sources of information, including PHI and any agreements that it has with subcontractors, vendors, and/or other agents relating to the use and disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, for purposes of determining both Business Associate’s and Covered Entity’s compliance with the HIPAA Rules.

IV. Permitted Uses and Disclosures by Business Associate:

A. Business Associate shall not use or disclose PHI except to perform functions, activities, or services on behalf of Covered Entity as provided for in the Contract, this Agreement, the HIPAA Rules, or other applicable law.

B. Business Associate agrees that it may use or disclose PHI on behalf of Covered Entity only:

1. Upon obtaining the authorization of the individual to whom the PHI pertains;

2. For the purposes of treatment, payment or health care operations unless Covered Entity has agreed to a restriction pursuant to 45 C.F.R. § 164.520(b)(iv)(A) or 45 C.F.R. § 164.522; or

3. Without an authorization or consent, if in accordance with 45 C.F.R. § 164.510, 45 C.F.R. § 164.512, 45 C.F.R. § 164.514(e), 45 C.F.R. § 164.514(f), or 45 C.F.R. § 164.514(g).

C. Business Associate shall use and disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), which section is fully incorporated herein.

D. Business Associate agrees to make uses, disclosures, and requests for PHI consistent with Covered Entity’s minimum necessary policies and procedures.

E. It is anticipated that Business Associate will have access to the MPI.

F. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth below.

1. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

V. Obligations of Covered Entity:

A. Covered Entity shall provide Business Associate with its Notice of Privacy

Practices and any changes to the Notice.

B. Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity’s Notice of Privacy Practices under 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

C. Covered Entity shall notify Business Associate of any change in, or revocation of, the permission by an individual to use or disclose his or her PHI to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

D. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

E. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as provided in Part IV, Subpart F, Section 1.

VI. Termination:

A. Term: The Term of this Agreement shall be effective as of the date Business

Associate signs the underlying Contract and shall terminate when the Contract ends or on the date covered entity terminates for cause as authorized in paragraph

(b) of this Section, whichever is sooner.

B. Termination for Cause: Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not ended the violation within the time specified by Covered Entity.

C. Obligations of Business Associate Upon Termination: Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

2. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the remaining PHI that Business Associate does not need to continue its proper management and administration or to carry out its legal responsibilities;

3. Continue to use appropriate safeguards, in compliance with Subpart C of 45 C.F.R. Part 164, with respect to electronic PHI to prevent use or disclosure of electronic PHI, other than as provided for in this Part, for as long as Business Associate retains the PHI;

4. Not use or disclose PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out above, at Part IV, Subpart F, Section 1 of the Agreement which applied prior to termination;

5. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities; and

6. If Business Associate or its agent or subcontractor destroys any PHI, Business Associate will provide Covered Entity with documentation evidencing such destruction within thirty (30) days of completion of destruction.

D. Survival: The obligations of Business Associate under this Part shall survive the termination of this Agreement.

VII. Indemnification:

In the event Business Associate is investigated and/or becomes a party to a civil or criminal cause of action in any forum relating to its failure to comply with the HIPAA Rules, Business Associate shall reimburse Covered Entity all reasonable costs and expenses Covered Entity may incur relating to such investigation and/or cause of action, and will otherwise hold Covered Entity harmless for any and all reasonable costs and expenses relating to the foregoing.

VIII. Miscellaneous:

A. Incorporation: This Agreement is attached to and fully incorporated into the Contract.

B. Notices: All notices under this Agreement shall be provided by certified mailing, and shall require proof of date of receipt.

C. Regulatory References: A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

D. Amendment: The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

E. Interpretation: Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

F. Successors and Assigns: This Agreement shall be binding upon, inure to the benefit of and be enforceable by and against the Parties and their successors and assigns.

G. Severability: If a court of competent jurisdiction deems any provision of this Agreement unenforceable, such provision shall be severed from this Agreement and every other provision of the Agreement shall remain in full force and effect.