Special_Terms_and_Conditions.pdf

EXHIBIT D

SPECIAL TERMS AND CONDITIONS

1. CONTRACT EXTENSION

Notwithstanding Sections 2 and 3 of the Standard Contract, and unless terminated by either party prior to contract termination date, at County’s sole election, this Contract may be extended for up to 90 days beyond the contract termination date to allow for continuation of services and sufficient time to complete a novation or renewal contract. In the event that this Contract is extended, compensation for the extension period shall not exceed (contract amount)

2. TERMINATION

A. Notwithstanding Section 4 in Exhibit C, this Contract may be terminated by County or Contractor, at any time, with good cause, upon 30 days written notice from one to the other.

3. ADDITIONAL INSURANCE

(1) Errors and Omissions insurance against loss due to negligent acts, errors and/or omissions, in an amount no less than one million dollars ($1,000,000) combined single limit per claim and in the aggregate. The policy shall be written on an occurrence form or shall remain in full force and effect for no less than 3 years following the completion of work under this Contract.

(2) Professional malpractice insurance of all activities of Contractor (and its subcontractors) arising out of or in connection with this Contract in an amount no less than one million dollars ($1,000,000) combined single limit for each occurrence. The policy shall be written on an occurrence form or shall remain in full force and effect for no less than 3 years following the completion of work under this Contract.

4. SPECIAL RESPONSIBILITIES OF CONTRACTOR

(1) Submit verification of non-profit status, if a requirement for the award of this Contract:

(2) Provide an audit report, including a management letter, to County annually;

(3) Conduct an audit, at Contractor’s expense, according to the requirements of OMB Circular A-133, which identifies all funds granted, received, disbursed and expended, and provide the audit to County within 30 days of completion;

(4) Provide an unaudited statement of revenue and expenditures to County within thirty (30) days of completion of the project if funds awarded to Contractor are $100,000 or less;

(5) Obtain a bond at, Contractor's sole expense, in an amount sufficient to cover start-up funds if any were provided to Contractor from County.

5. DRUG FREE WORKPLACE

Contractor shall execute the form attached as Exhibit " D-1 ".

6. CHILD/ADULT ABUSE

Contractor shall execute the form attached as Exhibit " D-2 and D-3 ".

7. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPPA)

County and Contractor each consider and represent themselves as covered entities as defined by the U.S. Health Insurance Portability and Accountability Act and agree to use and disclose protected health information as required by law. County and Contractor acknowledge that the exchange of protected health information between them is only for treatment, payment, and health care operations.

8. CHANGES AND AMENDMENTS

Amendments that are not State approved vendor agreement amendments shall be submitted to the State for prior approval at least 30 days before the effective date of any proposed changes governing compensation, services or term.

9. CONFIDENTIALITY OF MENTAL HEALTH RECORDS

Contractor warrants that Contractor is knowledgeable of Welfare and Institutions Code section 5328 respecting confidentiality of records. County and Contractor shall maintain the confidentiality of any information regarding clients (or their families) receiving Contractor's services. Contractor may obtain such information from application forms, interviews, tests or reports from public agencies, counselors or any other source. Without the client's written permission, Contractor shall divulge such information only as necessary for purposes related to the performance or evaluation of services provided pursuant to this Contract, and then only to those persons having responsibilities under this Contract, including those furnishing services under Contractor through subcontracts.

10. EARLIER DEFAULT

Services provided under this Contract are of a time-sensitive nature. Accordingly, notwithstanding the requirements of Section 10 in Exhibit D, the time period for notifying Contractor of default shall be ____ days. If Contractor fails to cure a default within ___ days after notification, or if the default requires more than __ days to cure and Contractor fails to commence to cure the default within __ days after notification, then Contractor's failure shall terminate this Contract.

11. INDEMNIFICATION FOR PHYSICIANS

Pursuant to Government Code section 800 et seq., County shall indemnify Contractor against all claims, losses and damages arising out of Contractor's performance to the extent that Contractor would be entitled to indemnification if Contractor were a County employee. County may indemnify either by self-insuring or by purchasing insurance for such purpose.

12. CONFIDENTIAL RECORDS

Contractor acknowledges that any information generated, received or disseminated pursuant to its performance under this Contract is confidential and shall not be disclosed in any manner unless authorized by law. Furthermore, Contractor warrants that Contractor is knowledgeable of Welfare and Institutions Code sections applicable to the subject of this Contract, particularly, sections 10850 and

11478.1 and will abide by its requirements.

13. FEDERAL/STATE HEALTH CARE PROGRAMS

Contractor shall execute Exhibit “ “ for services which may be reimbursed by Federal or State Health Care Programs (including, but not limited to, Medicare, MediCal and Grants), when such services are either provided on Solano County premises or for which County may seek reimbursement from Federal or State Health Care Programs or grants.

EXHIBIT D-1

SOLANO COUNTY

DRUG-FREE WORKPLACE CERTIFICATION

(rev-09/01/94)

COMPANY/ORGANIZATION NAME

The contractor or grant recipient named above certifies compliance with Government Code section 8355 in matters relating to providing a drug-free workplace. The above-named contractor will:

1. Publish a statement notifying employees that unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited and specifying actions to be taken against employees for violations, as required by Government Code Section 8355(a).

2. Establish a Drug-Free Awareness Program as required by Government Code section 8355(b), to inform employees about all of the following:

(a) The dangers of drug abuse in the workplace;

(b) The person's or organization's policy of maintaining a drug-free workplace;

(c) Any available counseling, rehabilitation and employee assistance programs; and

(d) Penalties that may be imposed upon employees for drug abuse violations.

3. Provide, as required by Government Code section 8355(c), that every employee who works on the proposed contract or grant:

(a) Will receive a copy of the company's drug-free policy statement; and

(b) Will agree to abide by the terms of the company's statement as a condition of employment on the contract or grant.

CERTIFICATION

I, the official named below, swear that I am duly authorized legally to bind the contractor or grant recipient to the above described certification. I am fully aware that this certification, executed on the date below, is made under penalty of perjury under the laws of the State of California.

Contractor or Grant Recipient Signature Date

Official's Name (type or print)

Title Federal Tax I.D. Number

EXHIBIT D-2

CHILD ABUSE REPORTING REQUIREMENTS

Section 11166 of the Penal Code requires any child care custodian, medical practitioner, nonmedical practitioner, or employee of a child protective agency who has knowledge of, or observes a child in his or her professional capacity or within the scope of his or her employment, whom he or she knows or reasonably suspects, has been the victim of a child abuse to report the known or suspected instance of child abuse to a child protective agency immediately or as soon as practically possible by telephone, and to prepare and send a written report thereof within 36 hours of receiving the information concerning the incident.

I, the undersigned, have read and understand the requirements of Penal Code Section 11166 and will comply with its provisions.

Thereof, I agree to report to my immediate supervisor any suspected child abuse situations of which I am aware and will report directly to the Child Protective Services as necessary.

Name:______________________________________________

Title:_______________________________________________

Date:_______________________________________________

EXHIBIT D-3

ADULT ABUSE REPORTING REQUIREMENTS

Welfare and Institutions Code section 15630 and following:

The undersigned, having read the statement below, signifies knowledge and understanding of its provisions:

Section 15630 of the Welfare and Institutions Code requires any care custodian, health practitioner, or employee of an adult protective services agency or a local law enforcement agency who has knowledge of, or observes a dependent adult, in his or her professional capacity or within the scope of his or her employment who he or she knows has been the victim of physical abuse, or who has injuries under circumstances which are consistent with abuse where the dependent adult's statements indicate, or in the case of a person with developmental disabilities, where his or her statements or other corroborating evidence indicates that abuse has occurred, to report the known or suspected instance of physical abuse to an adult protective services or a local law enforcement agency immediately or as soon as practically possible by telephone and to prepare and send a written report, thereof, within 36 hours of receiving the information concerning the incident.

"Care Custodian" means an administrator or an employee of any of the following public or private facilities:

1. Health facility 12. Licensing worker or evaluator

2. Clinic 13. Public assistance worker

3. Home health agency 14. Adult protective services agency

4. Educational institution 15. Patient's rights advocate

5. Sheltered workshop 16. Nursing home ombudsman ...

6. Camp 17. Legal guardian or conservator

7. Respite care facility 18. Skilled nursing facility

8. Residential care institution 19. Intermediate care facility including foster homes and 20. Local Law enforcement agency group homes 21. Any other person who provides

9. Community care facility goods or services necessary to

10. Adult day care facility, avoid physical harm or mental including adult day health suffering and who performs duties care facilities

11. Regional center for persons with developmental disabilities

"Health Practitioner" means a physician, surgeon, psychiatrist, psychologist, dentist, resident, intern, podiatrist, chiropractor, licensed nurse, dental hygienist, marriage, family and child counselor or any other person who is currently licensed under Division 2 (commencing with Section 500) of the Business and Professions Code, any emergency medical technician I or II, paramedic, a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code, or psychological assistant registered pursuant to Section 2913 of the Business and Professions Code, a marriage, family and child counselor trainee, as defined in subdivision (c) of Section 4980.03 of the Business and Professions Code, a state or county public health employee who treats a dependent adult for any condition, a coroner, or a religious practitioner who diagnoses, examines, or treats dependent adults.

I certify that a full copy of Welfare and Institutions Code section 15630 and following has been provided to me, and I have read and understand the above statement and will comply with its provisions.

Signature: _________________________

Date: _____________________________

Name: ______________________________

Title: _______________________________

Supervisor's Name: ____________________ Signature: _________________________

EXHIBIT D-4

SOLANO COUNTY

HIPAA CONTRACTOR AGREEMENT

(Contractor Name)

This Exhibit shall constitute the Business Associate Agreement (the “Agreement”) between the County of Solano (the “County”) and the Contractor or grant recipient (the “Contractor”) and applies to the functions Contractor will perform on behalf of the County (collectively, “Services”), that is identified in Exhibit A, Scope of Work.

A County wishes to disclose certain information to Contractor pursuant to the terms of the Agreement, some of which may constitute Protected Health Information (“PHI”) (defined below).

B County and its Contractor acknowledge that Contractor is subject to the Privacy and Security Rules (45 CFR parts 160 and 164) promulgated by the United States Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191 as amended by the Health Information Technology for Economic and Clinical Health Act as set forth in Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (“HITECH Act), in certain aspects of its operations performed on behalf of the County.

C As part of the HIPAA Regulations, the Privacy Rule and the Security Rule (defined below) require County to enter into an Agreement containing specific requirements with Contractor prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, sections 164.314(a), 164.502(e) and 164.504(e) of the Code of Federal Regulations (“C.F.R.”) and contained in this Agreement.

I. DEFINITIONS

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR parts 160 and 164.

1. Breach means the same as defined under the HITECH Act [42 U.S.C. section 17921].

2. Contractor means the same as defined under the Privacy Rule, the Security rule, and the HITECH Act, including, but not limited to, 42 U.S.C. section 17938 and 45 C.F.R. § 160.103.

3. Breach of the Security of the Information System means the unauthorized acquisition, including, but not limited to, access to, use, disclosure, modification or destruction, of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by or on behalf of the County. Good faith acquisition of personal information by an employee or agent of the information holder for the purposes of the information holder is not a breach of the security of the system;

provided, that the personal information is not used or subject to further unauthorized disclosure.

4. Commercial Use means obtaining protected health information with the intent to sell, transfer or use it for commercial, or personal gain, or malicious harm; sale to third party for consumption, resale, or processing for resale; application or conversion of data to make a profit or obtain a benefit contrary to the intent of this Agreement.

5. Covered Entity means the same as defined under the Privacy Rule and the Security rule, including, but not limited to, 45 C.F.R. § 160.103.

6. Designated Record Set means the same as defined in 45 C.F.R. § 164.501.

7. Electronic Protected Health Information (ePHI) means the same as defined in 45 C.F.R. § 160.103.

8. Electronic Health Record means the same as defined shall have the meaning given to such term in the HITECH Act, including, but not limited to, 42 U.S.C. § 17921.

9. Encryption means the process using publicly known algorithms to convert plain text and other data into a form intended to protect the data from being able to be converted back to the original plain text by known technological means.

10. Health Care Operations means the same as defined in 45 C.F.R. § 164.501.

11. Individual means the same as defined in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

12. Marketing means the same as defined under 45 CFR § 164.501 and the act or process of promoting, selling, leasing or licensing any patient information or data for profit without the express written permission of County.

13. Privacy Officer means the same as defined in 45 C.F.R. § 164.530(a)(1). The Privacy Officer is the official designated by a County or Contractor to be responsible for compliance with HIPAA/HITECH regulations.

14. Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR parts 160 and t 164, subparts A and E.

15. Protected Health Information or PHI means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.501. Protected Health Information includes Electronic Protected Health Information [45 C.F.R. §§ 160.103 and 164.501].

16. Required By Law means the same as defined in 45 CFR § 164.103.

17. Security Rule means the HIPAA Regulation that is codified at 45 C.F.R. parts 160 and 164, subparts A and C.

18. Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

19. Security Event means an immediately reportable subset of security incidents which incident would include:

a. a suspected penetration of Contractor’s information system of which the Contractor becomes aware of but for which it is not able to verify immediately upon becoming aware of the suspected incident that PHI was not accessed, stolen, used, disclosed, modified, or destroyed;

b. any indication, evidence, or other security documentation that the Contractor’s network resources, including, but not limited to, software, network routers, firewalls, database and application servers, intrusion detection systems or other security appliances, may have been damaged, modified, taken over by proxy, or otherwise compromised, for which Contractor cannot refute the indication of the time the Contractor became aware of such indication;

c. a breach of the security of the Contractor’s information system(s) by unauthorized acquisition, including, but not limited to, access to or use, disclosure, modification or destruction, of unencrypted computerized data and which incident materially compromises the security, confidentiality, or integrity of the PHI; and or,

d. the unauthorized acquisition, including but not limited to access to or use, disclosure, modification or destruction, of unencrypted PHI or other confidential information of the County by an employee or authorized user of Contractor’s system(s) which materially compromises the security, confidentiality, or integrity of PHI or other confidential information of the County.

If data acquired (including but not limited to access to or use, disclosure, modification or destruction of such data) is in encrypted format but the decryption key which would allow the decoding of the data is also taken, the parties shall treat the acquisition as a breach for purposes of determining appropriate response.

20. Security Rule means the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR parts 160 and 164, subparts A and C.

21. Unsecured PHI means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary. Unsecured PHI shall have the meaning given to such term under the HITECH Act and any guidance issued pursuant to such Act including, but not limited to, 42 U.S.C. section 17932(h).

II. OBLIGATIONS OF CONTRACTOR

1. Compliance with the Privacy Rule: Contractor agrees to fully comply with the requirements under the Privacy Rule applicable to “Business Associates” as defined in the Privacy Rule and not use or further disclose Protected Health Information other than as permitted or required by this agreement or as required by law.

2. Compliance with the Security Rule: Contractor agrees to fully comply with the requirements under the Security Rule applicable to “Business Associates” as defined in the Security Rule.

3. Compliance with the HITECH Act: Contractor hereby acknowledges and agrees it will comply with the HITECH provisions as proscribed in the HITECH Act.

III. USES AND DISCLOSURES

Contractor shall not use Protected Health Information except for the purpose of performing Contractor’s obligations under the Contract and as permitted by the Contract and this Agreement. Further, Contractor shall not use Protected Health Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so used by County.

1. Contractor may use Protected Health Information:

a. For functions, activities, and services for or on the Covered Entities’ behalf for purposes specified in the Contract and this Agreement.

b. As authorized for Contractor’s management, administrative or legal responsibilities as a Contractor of the County. The uses and disclosures of PHI may not exceed the limitations applicable to the County;

c. As required by law.

d. To provide Data Aggregation services to the County as permitted by 45 CFR § 164.504(e)(2)(i)(B).

e. To report violations of law to appropriate Federal and State authorities, consistent with CFR § 164.502(j)(1).

2. Any use of Protected Health Information by Contractor, its agents, or subcontractors, other than those purposes of the Agreement, shall require the express written authorization by the County and a Business Associate Agreement or amendment as necessary.

3. Contractor shall not disclose Protect Health Information to a health plan for payment or health care operations if the patient has requested this restriction and has paid out of pocket in full for the health care item or service to which the Protected Health information relates.

4. Contractor shall not directly or indirectly receive remuneration in exchange for Protected Health Information, except with the prior written consent of County and as permitted by the HITECH Act, 42 U.S.C. section 17935(d)(2); however, this prohibition shall not affect payment by the County to Contractor for services provided pursuant to the Contract.

5. Contractor shall not use or disclosed Protected Health Information for prohibited activities including, but not limited to, marketing or fundraising purposes.

6. Contractor agrees to adequately and properly maintain all Protected Health Information received from, or created, on behalf of County.

7. If Contractor discloses Protected Health Information to a third party, Contractor must obtain, prior to making any such disclosure, i) reasonable written assurances from such third party that such Protected Health Information will be held confidential as provided pursuant to this Agreement and only disclosed as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify Contractor of any breaches of confidentiality of the Protected Health Information, to the extent it has obtained knowledge of such breach [42 U.S.C. section 17932; 45 C.F.R. §§ 164.504(e)(2)(i), 164.504(e)(2)(i)(B), 164.504(e)(2)(ii)(A) and 164.504(e)(4)(ii)].

IV. MINIMUM NECESSARY

Contractor (and its agents or subcontractors) shall request, use and disclose only the minimum amount of Protected Health necessary to accomplish the purpose of the request, use or disclosure. [42 U.S.C. section 17935(b); 45 C.F.R. § 164.514(d)(3)]. Contractor understands and agrees that the definition of “minimum necessary” is in flux and shall keep itself informed of guidance issued by the Secretary with respect to what constitutes “minimum necessary.”

V. APPROPRIATE SAFEGUARDS

1. Contractor shall implement appropriate safeguards as are necessary to prevent the use or disclosure of Protected Health Information otherwise than as permitted by this Agreement, including, but not limited to, administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Protected Health Information in accordance with 45 C.F.R. §§ 164.308, 164.310, and 164.312. [45 C.F.R. § 164.504(e)(2)(ii)(B); 45 C.F.R. § 164.308(b)]. Contractor shall comply with the policies and procedures and documentation requirements of the HIPAA Security Rule, including, but not limited to, 45 C.F.R. § 164.316. [42 U.S.C. section 17931].

2. Contractor agrees to comply with Subpart 45 CFR part 164 with respect to Electronic Protected Health Information (ePHI). Contractor must secure all Electronic Protected Health Information by technological means that render such information unusable, unreadable, or indecipherable to unauthorized individuals and in accordance with the National Institute of Standards Technology (NIST) Standards and Federal Information Processing Standards (FIPS) as applicable.

3. Contractor agrees that destruction of Protected Health Information on paper, film, or other hard copy media must involve either cross cut shredding or otherwise destroying the Protected Health Information so that it cannot be read or reconstructed.

4. Should any employee or subcontractor of Contractor have direct, authorized access to computer systems of the County that contain Protected Health Information, Contractor shall immediately notify County of any change of such personnel (e.g. employee or subcontractor termination, or change in assignment where such access is no longer necessary) in order for County to disable previously authorized access.

VI. AGENT AND SUBCONTRACTOR’S OF CONTRACTOR

1. Contractor shall ensure that any agents and subcontractors to whom it provides Protected Health Information, agree in writing to the same restrictions and conditions that apply to Contractor with respect to such PHI and implement the safeguards required with respect to Electronic PHI [45 C.F.R. § 164.504(e)(2)(ii)(D) and 45 C.F.R. § 164.308(b)].

2. Contractor shall implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation (see 45 C.F.R. §§ 164.530(f) and 164.530(e)(I)).

3.

VII. ACCESS TO PROTECTED HEALTH INFORMATION

1. If Contractor receives Protected Health Information from the County in a Designated Record Set, Contractor agrees to provide access to Protected Health Information in a Designated Record Set to the County in order to meet its requirements under 45 C.F.R. § 164.524.

2. Contractor shall make Protected Health Information maintained by Contractor or its agents or subcontractors in Designated Record Sets available to County for inspection and copying within five (5) days of a request by County to enable County to fulfill its obligations under state law, [Health and Safety Code section 123110] the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.524 [45 C.F.R. § 164.504(e)(2)(ii)(E)]. If Contractor maintains an Electronic Health Record, Contractor shall provide such information in electronic format to enable County to fulfill its obligations under the HITECH Act, including, but not limited to, 42 U.S.C. section 17935(e).

3. If Contractor receives a request from an Individual for a copy of the individual’s Protected Health Information, and the Protected Health Information is in the sole possession of the Contractor, Contractor will provide the requested copies to the individual in a timely manner. If Contractor receives a request for Protected Health Information not in its possession and in the possession of the County, or receives a request to exercise other individual rights as set forth in the Privacy Rule, Contractor shall promptly forward the request to the County. Contractor shall then assist County as necessary in responding to the request in a timely manner. If a Contractor provides copies of Protected Health Information to the individual, it may charge a reasonable fee for the copies as the regulations shall permit.

4. Contractor shall provide copies of HIPAA Privacy and Security Training records and HIPAA policies and procedures within five (5) calendar days upon request from the County.

VIII. AMENDMENTOF PROTECTED HEALTH INFORMATION

Upon receipt of notice from County, promptly amend or permit the County access to amend any portion of Protected Health Information in the designated record set which Contractor created for or received from the County so that the county may meet its amendment obligations under 45 CFR § 164.526. If any individual requests an amendment of Protected Information directly from Contractor or its agents or subcontractors, Contractor must notify the County in writing within five (5) days of the request. Any approval or denial of amendment of Protected Information maintained by Contractor or its agents or subcontractors shall be the responsibility of the County [45 C.F.R. § 164.504(e)(2)(ii)(F)].

IX. ACCOUNTING OF DISCLOSURES

1. At the request of the County, and in the time and manner designed by the County, Contractor and its agents or subcontractors shall make available to the County, the information required to provide an accounting of disclosures to enable the County to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.528, and the HITECH Act, including but not limited to 42 U.S.C. § 17935. Contractor agrees to implement a process that allows for an accounting to be collected and maintained by the Contractor and its agents or subcontractors for at least six (6) years prior to the request. However, accounting of disclosures from an Electronic Health Record for treatment, payment or health care operations purposes are required to be collected and maintained for only three (3) years prior to the request, and only to the extent that Contractor maintains an electronic health record and is subject to this requirement.

2. At a minimum, the information collected and maintained shall include: (i) the date of disclosure; (ii) the name of the entity or person who received Protected Health Information and, if known, the address of the entity or person; (iii) a brief description of Protected Information disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual’s authorization, or a copy of the written request for disclosure.

3. In the event that the request for an accounting is delivered directly to Contractor or its agents or subcontractors, Contractor shall forward within five (5) calendar days a written copy of the request to the County. It shall be the County’s responsibility to prepare and deliver any such accounting requested. Contractor shall not disclose any Protected Information except as set forth in this Agreement [45 C.F.R. §§ 164.504(e)(2)(ii)(G) and 165.528]. The provisions of this paragraph shall survive the termination of this Agreement.

X. GOVERNMENTAL ACCESS TO RECORDS

Contractor shall make its internal practices, books and records relating to its use and disclosure of the protected health information it creates for or receives from the County, available to the County and to the Secretary of the U.S. Department of Health and Human for purposes of determining Contractors compliance with the Privacy rule [45 C.F.R. § 164.504(e)(2)(ii)(H)]. Contractor shall provide to the County a copy of any Protected Health Information that Contractor provides to the Secretary concurrently with providing such Protected Information to the Secretary.

XI. CERTIFICATION

To the extent that the County determines that such examination is necessary to comply with the Contractor’s legal obligations pursuant to HIPAA relating to certification of its security practices, County, or its authorized agents or contractors may, at the County’s expense, examine Contractor’s facilities, systems, procedures and records as may be necessary for such agents or contractors to certify to County the extent to which Contractor’s security safeguards comply with HIPAA Regulations, the HITECH Act, or this Agreement.

XII. BREACH OF UNSECURED PROTECTED HEALTH INFORMATION

1. In the case of a breach of unsecured Protected Health Information, Contractor shall comply with the applicable provisions of 42 U.S.C. § 17932 and 45 C.F.R. part 164, subpart D, including but not limited to 45 C.F.R. § 164.410.

2. Contractor agrees to notify County of any access, use or disclosure of Protected Health Information not permitted or provided for by this Agreement of which it becomes aware, including any breach as required in 45 45 C.F.R. § 164.410. or security incident immediately upon discovery by telephone at 707-784-2962 and Riskdepartment@solanocounty.com or 707-784-3199 and will include, to the extent possible, the identification of each Individual whose unsecured Protect Health Information has been, or is reasonably believed by the Contractor to have been accessed, acquired, used, or disclosed, a description of the Protected Health Information involved, the nature of the unauthorized access, use or disclosure, the date of the occurrence, and a description of any remedial action taken or proposed to be taken by Contractor. Contractor will also provide to County any other available information that the Covered entity requests.

3. A breach or unauthorized access, use or disclosure shall be treated as discovered by the Contractor on the first day on which such unauthorized access, use, or disclosure is known, or should reasonably have been known, to the Contractor or to any person, other than the individual committing the unauthorized disclosure, that is an employee, officer, subcontractor, agent or other representative of the Contractor.

4. Contractor shall mitigate, to the extent practicable, any harmful effect that results from a breach, security incident, or unauthorized access, use or disclosure of unsecured Protected Health Information by Contractor or its employees, officers, subcontractors, agents or representatives.

5. Following a breach, security incident, or any unauthorized access, use or disclosure of unsecured Protected Health Information, Contractor agrees to take any and all corrective action necessary to prevent recurrence, to document any such action, and to make all documentation available to the County.

6. Except as provided by law, Contractor agrees that it will not inform any third party of a breach or unauthorized access, use or disclosure of Unsecured Projected Health Information without obtaining the County’s prior written consent. County hereby reserves the sole right to determine whether and how such notice is to be provided to any individuals, regulatory agencies, or others as may be required by law, regulation or contract terms, as well as the contents of such notice. When applicable law requires the breach to be reported to a federal or state agency or that notice be given to media outlets, Contractor shall cooperate with and coordinate with County to ensure such reporting is in compliance with applicable law and to prevent duplicate reporting, and to determine responsibilities for reporting.

7. Contractor acknowledges that it is required to comply with the referenced rules and regulations and that Contractor (including its subcontractors) may be held liable and subject to penalties for failure to comply.

8. In meeting its obligations under this Agreement, it is understood that Contractor is not acting as the County’s agent. In performance of the work, duties, and obligations and in the exercise of the rights granted under this Agreement, it is understood and agreed that Contractor is at all times acting an independent contractor in providing services pursuant to this Agreement and Exhibit A, Scope of Work.

XIII. TERMINATION OF AGREEMENT

1. Upon termination of this Agreement for any reason, Contractor shall return or destroy, at County’s sole discretion, all other Protected Health Information received from the County, or created or received by Contractor on behalf of the County.

2. Contractor will retain no copies of Protected Health Information P in possession of subcontractors or agents of Contractor.

3. `Contractor shall provide the County notification of the conditions that make return or destruction not feasible, in the event that Contractor determines that returning or destroying the PHI is not feasible.

If the County agrees that the return of the Protected Health Information is not feasible, Contractor shall extend the protections of this Agreement to such Protected Health Information and limit further use and disclosures of such Protected Health Information for so long as the Contractor or any of its agents or subcontractor maintains such information.

4. Contractor agrees to amend this Exhibit as necessary to comply with any newly enacted or issued state or federal law, rule, regulation or policy, or any judicial or administrative decision affecting the use or disclosure of Protected Health Information.

5. Contractor agrees to retain records, minus any Protected Health Information required to be returned by the above section, for a period of at least 7 years following termination of the Agreement. The determining date for retention of records shall be the last date of encounter, transaction, event, or creation of the record.

CERTIFICATION

I, the official named below, certify that I am duly authorized legally to bind the Contractor or grant recipient to the above described certification. I am fully aware that this certification is made under penalty of perjury under the laws of the State of California.

Contractor or Grant Recipient Signature Date

Official’s Name (type or print)

Title Federal Tax ID Number

EXHIBIT D-5

SAMPLE CONTRACTOR ASSURANCES

This is a grant funded contract and as the duly authorized representative of the (Agency), I certify that (Agency):

Will assure that use of funds under this grant will support efforts related to supporting appropriate prevention, intervention, supervision, services and strategies to reduce recidivism in California’s mentally ill offender population, as well as improving outcomes for these offenders.

Will assure that funds are used for allowable, fair, and reasonable costs only and will not be transferred between programs (for example: Health and Social Services and the Sheriff’s Office).

Will assure that salaries and benefits are not also claimed or reimbursed under another separate agreement or funding stream.

Will establish a proper accounting system in accordance with generally accepted accounting standards and County directives.

Will maintain timesheets on all staff charged to this contract and, for split-funded positions, maintain functional timesheets or conduct time studies (estimates and/or percentages are not acceptable) that can be easily tied back to reimbursement invoices.

Will maintain and update service delivery logs for billing (e.g. client sign-in logs, time/duration of services).

Will give the State or County, through any authorized representatives, access to, and the right to examine, all paper or electronic records, books, and documents related to this contract, and will permit access to its facilities, personnel and other individuals and information as may be necessary, as required by the State or County through any authorized representative, with regard to examination of contract-related records, accounts, documents, information and staff.

Will comply with applicable provisions governing the County access to records, accounts, documents, information, facilities, and staff.

Cooperate with any compliance review or complaint investigation conducted by the County.

Give County access to and the right to examine and copy records, accounts, and other documents and sources of information related to the Contract and permit access to facilities, personnel, and other individuals and information as may be necessary, as required by State or County guidance, requirements, and applicable laws.

Comply with all other special reporting, data collection, and evaluation requirements, as prescribed by law or requested by the County and submit timely, complete, and accurate reports to the appropriate County officials and maintain appropriate backup documentation to support the reports.

Will comply with any other special reporting, assessments, national evaluation efforts, or information or data collection requests, including, but not limited to, the provision of any information required for the assessment or evaluation of any activities within this agreement.

Will provide timely notifications to County of any developments that have a significant impact on contract-supported activities, including changes to key program staff.

Will establish safeguards to prohibit employees from using their positions for a purpose that constitutes, or presents the appearance of, personal or organizational conflict of interest, or personal gain for themselves or others, particularly those with whom they have family, business, or other connections.

Will ensure that funds applied toward contract services do not replace (supplant) funds that have been budgeted for the same purpose through non-Federal sources.

Will ensure that the expenses submitted on Contractor’s invoices are true and correct, incurred in the course of delivering contracted services, and that no part has been paid or reimbursed from other sources.

Will comply with all federal and state laws and regulations relating to civil rights protections and nondiscrimination. These laws and regulations include, but are not limited to:

Title VI of the Civil Rights Act of 1964, Public Law 88-352, (42 U.S.C. § 2000d et seq.), codified at 6 CFR Part 21 and 44 CFR Part 7, which provides that no person in the United States will, on the grounds of race, color, or national origin, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity receiving Federal financial assistance.

Title IX of the Education Amendments of 1972, as amended (20 U.S.C. § 1681 et seq.), which prohibits discrimination on the basis of gender in educational programs and activities. These regulations are codified at 6 CFR Part 17 and 44 CFR Part 19.

The Age Discrimination Act of 1975, as amended (42 U.S.C. §§ 6101 et seq.), which prohibits discrimination on the basis of age in any program or activity receiving Federal financial assistance.

The Drug Abuse Office and Treatment Act of 1972 (P.L. 92-255), as amended, relating to nondiscrimination on the basis of drug abuse.

The Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970 (P.L. 91-616), as amended, relating to nondiscrimination on the basis of alcohol abuse or alcoholism.

Sections 523 and 527 of the Public Health Service Act of 1912 (42 U.S.C. § 290 dd-3 and 290 ee-3), as amended, relating to confidentiality of alcohol and drug abuse patient records.

Title VIII of the Civil Rights Act of 1968 (42 U.S.C. § 3601 et seq., as implemented by 24 CFR Part 100), as amended, relating to nondiscrimination in the sale, rental and financing of housing.

Title 44 of the Code of Federal Regulations (CFR) Parts 7, 16, and 19, relating to nondiscrimination.

Will comply with the minimum wage and maximum hour provisions of the Federal Fair Labor Standards Act (29 U.S.C. § 201), as they apply to employees of institutions of higher education, hospitals, and other non-profit organizations.

Will not make any award or permit any contract to any party if that party has been debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs under E.O.

12549 and E.O. 12689, “Debarment and Suspension.” E.O. 12549, 44 CFR Part 17, requires recipients of awards of Federal assistance to protect the public against waste, fraud and abuse by debarring or suspending those persons deemed irresponsible in their dealings with the Federal government. Contractor certifies that it and its principals:

Are not presently debarred, suspended, proposed for debarment, declared ineligible, sentenced to a denial of Federal benefits by a State or Federal court, or voluntarily excluded from covered transactions by any Federal department or agency.

Have not within a three-year period preceding this contract been convicted of or had a civil judgment rendered against them for commission of fraud or a criminal offense in connection with obtaining, attempting to obtain, or performing a public (Federal, State, or Local) transaction or contract under a public transaction, violation of Federal or State antitrust statutes or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, or receiving stolen property.

Are not presently indicted for or otherwise criminally or civilly charged by a governmental entity (Federal, State, or Local) with commission of any of the offenses enumerated in paragraph (1)(b) of this certification; and have not within a three-year period preceding this award had one or more public transactions (Federal, State, or Local) terminated for cause or default.

Will comply with the requirements of the Drug-Free Workplace Act of 1988 (41 U.S.C. § 701 et seq.), the Contractor must notify the County if an employee is convicted of violating a criminal drug statute. Failure to comply with these requirements may be cause for debarment. These regulations are codified at 2 CFR 3001.

Will comply with Title VI of the Civil Rights Act of 1964 prohibition against discrimination on the basis of national origin, which requires that reasonable steps be taken to provide meaningful access to their programs and services. “Meaningful access” may entail providing language assistance services, including oral and written translation, where necessary. The Contractor is encouraged to consider the need for language services for Limited English Proficiency (LEP) persons both in developing budgets and in conducting programs and activities.

Understands that failure to comply with any of these assurances may result in suspension or termination of contract.

Signature of Authorized Agent: ________________________________________________________

Printed Name of Authorized Agent: _____________________________________________________

Title: __________________________________________ Date: ______________________________