Loading...
HomeMy WebLinkAboutPR 21951: APPROVAL BETWEEN THE CITY OF PORT ARTHUR AND THE DEPARTMENT OF STATE HEALTH SERVICES, RLSS-LOCAL PUBLIC HEALTH SYSTEM. THERE IS NO CASH MATCH. Energy City of Cyn V?'1 rth u Texas Date: May 14, 2021 To: Ron Burton, City Manager From: Judith A. Smith,RN, BSN, Director of Health Services RE: Contract Approval between the City of Port Arthur and the Department of State Health Services, RLSS-Local Public Health System. There is no Cash Match. Nature of the Request: This contract renewal will allow the City's Health Department to continue a broad range of essential public health services by improving and/or strengthening local public health infrastructure through assessment, monitoring and evaluation of essential public health services. The total amount of the contract will not exceed $335,034.00 for two years. The contract term is from September 1, 2021 through August 31, 2023. Staff Analysis, Considerations: The grant funds 3 full-time employees. The employees include the Disease Intervention Specialist,the Tuberculosis Nurse, and an Administrative Clerk II. Recommendations: The Health Department recommends the City Council's approval of P.R. No.21951, FY 2022-2023, the two-year contract between the City of Port Arthur and the Department of State Health Services, RLSS-Local Public Health System in the amount of $335,034.00. The total allocation amount for FY 22 is $167,517.00 and the total amount for FY 23 is $167,517.00. Budget Considerations: This grant will cover a portion of the salaries and fringe for 3 full time employees. "REMEMBER WE ARE HERE TO SERVE THE CITIZENS OF PORT ARTHUR" P.O.BOX 1089•PORTARTHUR,TX 77641-1089.409/983-8101-FAX 409/982-6743 P.R.No. 21951 05/14/2021-js RESOLUTION NO. A RESOLUTION APPROVING FY 2022-2023 CONTRACT BETWEEN THE CITY OF PORT ARTHUR AND THE DEPARTMENT OF STATE HEALTH SERVICES, RLSS-LOCAL PUBLIC HEALTH SYSTEM IN THE NOT TO EXCEED AMOUNT OF $335,034.00. NO MATCH REQUIRED. WHEREAS, the contract between the City of Port Arthur and the Department of State Health Services provides financial assistance to the Port Arthur City Health Department to supplement the delivery of public health services; and, WHEREAS, this contract renewal will allow the City's Health Department to continue a broad range of essential public health services by improving and/or strengthening local public health infrastructure through assessment, monitoring and evaluation of essential public health services with a total grant award of $335,034 for the period of September 1, 2021 through August 31, 2023. The total allocation amount for FY 22 (September 1, 2021 through August 31, 2022) is $167,517.00, and the total amount for FY 23 (September 1, 2022 through August 31, 2023) is $167,517.00. NOW THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF PORT ARTHUR: Section 1. That,the facts and opinions in the preamble are true and correct. Section 2. That, the City Council of the City of Port Arthur hereby approves the contract renewal between the City of Port Arthur and the Department of State Health Services. Section 3. That, the City Council deems it is in the best interest of the City to approve and authorize the City Manager and the Director of the City's Health Department to P.R.No. 21951 05/14/2021-js execute the contract between the Department of State Health Services and the City of Port Arthur, Texas,to continue this preventive health program as delineated in Exhibit"A". Section 4. That, a copy of the caption of this Resolution be spread upon the Minutes of the City Council. READ, ADOPTED, AND APPROVED, this day of May 2021, A.D., at a Regular Meeting of the City Council of the City of Port Arthur, Texas by the following Vote: AYES: Mayor: Councilmembers: NOES: Mayor ATTEST: Sherri Bellard, City Secretary APPROVED AS TO FORM: AValTizen , City Attorney P.R.No. 21951 05/14/2021-js APPROVED FOR ADMINISTRATION: Ron Burton, City Manager Judith A. Smith, Director of Health Services EXHIBIT "A" DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 SIGNATURE DOCUMENT FOR DEPARTMENT OF STATE HEALTH SERVICES CONTRACT NO.HHS001028700001 UNDER THE REGIONAL LOCAL SERVICES SYSTEM/LOCAL PUBLIC HEALTH SERVICES GRANT PROGRAM I. PURPOSE The Department of State Health Services ("System Agency"), a pass-through entity, and City of Port Arthur ("Grantee") (each a "Party" and collectively the "Parties"), enter into the following grant contract to provide funding for Local Public Health Services to improve or strengthen local public health infrastructure within the State of Texas (the "Contract"). II. LEGAL AUTHORITY This Contract is authorized by and in compliance with the provisions of Texas Government Code Chapter 791 and The Texas Health and Safety Code Chapter 12. III. DURATION The Contract is effective on September 1, 2021 and terminates on August 31, 2023,unless renewed, extended, or terminated pursuant to the terms and conditions of the Contract. System Agency, at its sole discretion, may extend this Contract for any period(s) of time, provided the Contract term, including all extensions or renewals, does not exceed five years. Notwithstanding the limitation in the preceding sentence, System Agency,at its sole discretion, also may extend the Contract beyond five years as necessary to ensure continuity of service, for purposes of transition, or as otherwise determined by System Agency to serve the best interest of the State. IV. BUDGET The total amount of this Contract will not exceed THREE HUNDRED THIRTY-FIVE THOUSAND THIRTY-FOUR DOLLARS ($335,034.00). Grantee is not required to provide matching funds. All expenditures under the Contract will be in accordance with ATTACHMENT B,BUDGET. The total allocation amount for FY22(September 1,2021 through August 31,2022)is ONE HUNDRED SIXTY-SEVEN THOUSAND FIVE HUNDRED SEVENTEEN DOLLARS ($167,517.00). The total allocation amount for FY23 (September 1,2022 through August 31,2023)is ONE HUNDRED SIXTY-SEVEN THOUSAND FIVE HUNDRED SEVENTEEN DOLLARS ($167,517.00). V. CONTRACT REPRESENTATIVES The following will act as the representative authorized to administer activities under this Contract on behalf of their respective Party. Contract No.HHS001028700001 Page 1 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 System Agency Grantee Department of State Health Services City of Port Arthur 1100 West 49th Street, MC 1990 449 Austin Avenue Austin, Texas 78756 Port Arthur, Texas 77640 Attention: Elma Medina Attention: Judith Smith elma.medina@dshs.state.tx.us Judith.Smith(a,portrthurtx.gov VI. LEGAL NOTICES Any legal notice required under this Contract shall be deemed delivered when deposited by the System Agency either in the United States mail, postage paid, certified, return receipt requested; or with a common carrier, overnight, signature required,to the appropriate address below: System Agency Grantee Department of State Health Services City of Port Arthur Attention: General Counsel 449 Austin Avenue 1100 W. 49th Street, MC 1911 Port Arthur, Texas 77640 Austin, TX 78756 Attention: Ron Burton, City Manager ron.burtonLaportarthurtx.gov VII. NOTICE REQUIREMENTS Notice given by Grantee will be deemed effective when received by the System Agency. Either Party may change its address for notices by providing written notice to the other Party. All notices submitted to System Agency must: A. include the Contract number; B. be sent to the person(s) identified in the Contract; and, C. comply with all terms and conditions of the Contract. VIII. ADDITIONAL GRANT INFORMATION Grantee Data Universal Numbering System (DUNS) Number: 137134909 Federal Award Identification Number(FAIN): NB01 OT009365 Catalog of Federal Domestic Assistance (CFDA)Name and Number(list all that apply): Preventive Health and Health Services Block Grant—93.991 Federal Award Date: 09/14/2020 Federal Award Period:10/01/2019 through 09/30/2021 Name of Federal Awarding Agency: Centers for Disease Control and Prevention (CDC) Awarding Official Contact Information: Shirley K Byrd, Grants Management Officer 2939 Flowers Rd, Mailstop TV-2, Atlanta, GA 30341-5509, Phone: (770)488-2591 Any updates to the Additional Federal Grant Information will be incorporated into the Contract as of the effective date of the change. DSHS will send written notice of any updates to the Grantee. Any written updates provided by DSHS will control in the event of conflict with the grant information in the Contract. SIGNATURE PAGE FOLLOWS Contract No. HHS001028700001 Page 2 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 SIGNATURE PAGE FOR SYSTEM AGENCY CONTRACT No. HHS001028700001 DEPARTMENT OF STATE HEALTH SERVICES CITY OF PORT ARTHUR Signature Signature Date of Execution: Date of Execution: THE FOLLOWING ATTACHMENTS TO SYSTEM AGENCY CONTRACT No. HHS001028700001 ARE INCORPORATED BY REFERENCE: ATTACHMENT A—STATEMENT OF WORK ATTACHMENT B—BUDGET ATTACHMENT C—UNIFORM TERMS AND CONDITIONS-GRANT ATTACHMENT D—CONTRACT AFFIRMATIONS ATTACHMENT E—SUPPLEMENTAL AND SPECIAL CONDITIONS ATTACHMENT F—FEDERAL ASSURANCES ATTACHMENT G—FFATA CERTIFICATION FORM ATTACHMENT H—DATA USE AGREEMENT ATTACHMENTS FOLLOW Contract No.HHS001028700001 Page 3 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT A STATEMENT OF WORK I. GRANTEE RESPONSIBILITIES A. Grantee shall perform activities in support of the Preventive Health and Health Services Block Grant, Centers for Disease Control and Prevention("CDC"). B. Grantee shall perform the activities required under this Contract in the following county(ies): Jefferson County C. Grantee will work to improve or strengthen local public health infrastructure within the State of Texas by: 1. Developing objective(s) to address a public health issue; 2. Utilizing resources provided through this Contract to conduct activities and services that provide or support the delivery of essential public health services; 3. Assessing, monitoring, and evaluating the essential public health activities and services provided through this Contract; and 4. Developing strategies to improve the delivery of essential public health service(s) to service area identified in I(B) above. D. Grantee will assess, monitor and evaluate the essential public health activities in accordance with the following standards: the National Public Health Performance Standards,approved by the Centers for Disease Control and Prevention Healthy People 2030 (Healthy People) related goals and objectives; System Agency programmatic grant guidance and performance standards relative to the Grantee's identified scope of work; and federal, state or local laws or regulations governing the delivery of essential public health services. Other evaluation methods utilizing standards not listed in this section must be pre-approved in writing by System Agency. E. Grantee shall implement its approved Project Service Delivery Plan ("PSDP") contained in its FY22/23 Local Public Health Services Application, which is incorporated herein by reference and made a part of this Contract as if fully set forth herein. The PSDP must include a description of the public health issue(s) or public health program to be addressed by RLSS/LPHS funded staff and measurable objective(s)and activities for addressing the issue. The PSDP must also describe a clear method for evaluating the services that will be provided, as well as recommendations or plans for improving essential public health services delivery based on the results of an evaluation. Any changes to the approved PSDP will require System Agency's written approval. F. Grantee shall submit quarterly and final performance reports that describe progress toward achieving the objectives contained in approved Grantee's PSDP to the LocalPHTeam@dshs.texas.gov and to the System Agency Contract Manager. Grantee shall submit the performance reports by the end of the month following the end of each quarter. Failure to submit a required report of additional requested information by the due date specified in this Contract or upon request constitutes breach of Contract, and Contract No. HHS001028700001 Page 1 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT A STATEMENT OF WORK may result in delay payment, and may adversely affect evaluation of Grantee's future contracting opportunities with the department. G. Grantee will comply with all applicable regulations, standards, and guidelines in effect on the beginning date of this Contract and as amended. H. Contractor shall maintain an inventory of equipment, supplies (defined as Controlled Assets in the Property Inventory Report Instructions Tab), and real property, and submit an annual cumulative report of the equipment and other property on HHS System Agencies Grantee's Property Inventory Report to the assigned System Agency Contract Manager by email no later than October 15 of each year. I. Funding for this Contract is dependent on the award of the applicable federal grant.No FY2022 work may begin and no charges may be incurred until the System Agency issues a written Notice to Proceed to Grantee. This Notice to Proceed may include an amended or ratified budget which will be incorporated into this Contract by a subsequent amendment, as necessary. Notwithstanding the preceding, at the discretion of the System Agency, Grantee may be eligible to receive reimbursement for eligible expenses incurred during the period of performance as defined by 2 CFR §200.309. II. PERFORMANCE MEASURES The System Agency will monitor the Grantee's performance of the requirements in this Attachment A and compliance with the Contract's terms and conditions. IILINVOICE AND PAYMENT A. Grantee will request payment using the State of Texas Purchase Voucher (Form B-13) at http://www.System Agency.state.tx.us/grants /forms/b13form.doc. Voucher and any supporting documentation will be sent by electronic mail to the email address below. Department of State Health Services Claims Processing Unit, MC 1940 1100 West 49th Street P.O. Box 149347 Austin, TX 78714-9347 FAX: (512)458-7442 EMAIL: invoices@dshs.texas.gov and to CMS1nvoices(a,dshs.texas.gov B. Grantee will be paid on a monthly basis with acceptable supporting documentation for reimbursement of the required services/deliverables, and in accordance with the Budget in Attachment B of this Contract. C. System Agency reserves the right, where allowed by legal authority, to redirect funds in the event of financial shortfalls. System Agency will monitor Grantee's expenditures on a quarterly basis. If expenditures are below that projected in Grantee's total Contract Contract No. HHS001028700001 Page 2 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT A STATEMENT OF WORK amount, Grantee's budget may be subject to a decrease for the remainder of the Term of the Contract. Vacant positions existing after ninety days may result in a decrease in funds. Contract No. HHS001028700001 Page 3 of 3 HHSC Grant-v 2.14 Effective:February 1,2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT B BUDGET Budget Categories FY22 Budget FY23 Budget 2 Year Summary Summary Total Budget Personnel $119,655.00 $119,655.00 $239,310.00 Fringe Benefits $ 47,862.00 $ 47,862.00 $ 95,724.00 Travel $0 $0 $0 Equipment $0 $0 $0 Supplies $0 $0 $0 Contractual $0 $0 $0 Other $0 $0 $0 Sum of Direct Costs $167,517.00 $167,517.00 $335,034.00 Indirect Costs $0 $0 $0 Sum of Total Direct Costs and $167,517.00 $167,517.00 $335,034.00 Indirect Costs Match (Cash or In-Kind) $0 $0 $0 TOTAL $167,517.00 $167,517.00 $335,034.00 Contract No. HHS001028700001 Page 1 v. 11.15.2016 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 HHSC Uniform Terms and Conditions Version 2.16 Published and Effective: March 26, 2019 Responsible Office: Chief Counsel • to. vk TEXAS as� �i� + Health and Human Services Health and Human Services Commission HHSC Uniform Terms and Conditions - Grant Version 2.16.1 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 TABLE OF CONTENTS ARTICLE I. DEFINITIONS AND INTERPRETIVE PROVISIONS 4 1.1 Definitions 4 1.2 Interpretive Provisions 6 ARTICLE II. PAYMENT METHODS AND RESTRICTIONS 6 2.1 Payment Methods 6 2.2 Final Billing Submission 7 2.3 Financial Status Reports (FSRs) 7 2.4 Use of Funds 7 2.5 Use for Match Prohibited 7 2.6 Program Income 7 2.7 Nonsupplanting 8 2.8 Allowable Costs 8 2.9 Indirect Cost Rates 8 ARTICLE III. STATE AND FEDERAL FUNDING 8 3.1 Funding 8 3.2 No Debt Against the State 8 3.3 Debt and Delinquencies 8 3.4 Recapture of Funds 8 ARTICLE IV. ALLOWABLE COSTS AND AUDIT REQUIREMENTS 9 4.1 Allowable Costs. 9 4.2 Audits and Financial Statements 10 4.3 Submission of Audits and Financial Statements 11 ARTICLE V. AFFIRMATIONS, ASSURANCES AND CERTIFICATIONS 11 5.1 General Affirmations 11 5.2 Federal Assurances 11 5.3 Federal Certifications 11 ARTICLE VI. INTELLECTUAL PROPERTY 11 6.1 Ownership of Work Product 11 6.2 Grantees Pre-existing Works 12 6.3 Agreements with Employees and Subcontractors 12 6.4 Delivery Upon Termination or Expiration 12 6.5 Survival 12 HHSC Grantee Uniform Terms and Conditions Page 2 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ARTICLE VII. RECORDS, AUDIT,AND DISCLOSURE 13 7.1 Books and Records 13 7.2 Access to Records, Books, and Documents 13 7.3 Response/Compliance with Audit or Inspection Findings 13 7.4 SAO Audit 14 7.5 Confidentiality 14 ARTICLE VIII. CONTRACT MANAGEMENT AND EARLY TERMINATION 14 8.1 Contract Remedies 14 8.2 Termination for Convenience 14 8.3 Termination for Cause 14 ARTICLE IX. MISCELLANEOUS PROVISIONS 15 9.1 Amendment 15 9.2 Insurance 15 9.3 Legal Obligations 15 9.4 Permitting and Licensure 16 9.5 Indemnity 16 9.6 Assignments 16 9.7 Independent Contractor 17 9.8 Technical Guidance Letters 17 9.9 Dispute Resolution 17 9.10 Governing Law and Venue 17 9.11 Severability 17 9.12 Survivability 18 9.13 Force Majeure 18 9.14 No Waiver of Provisions 18 9.15 Publicity 18 9.16 Prohibition on Non-compete Restrictions 19 9.17 No Waiver of Sovereign Immunity 19 9.18 Entire Contract and Modification 19 9.19 Counterparts 19 9.20 Proper Authority 19 9.21 E-Verify Program 19 9.22 Civil Rights 19 9.23 System Agency Data 21 HHSC Grantee Uniform Terms and Conditions Page 3 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ARTICLE I. DEFINITIONS AND INTERPRETIVE PROVISIONS 1.1 DEFINITIONS As used in this Contract, unless the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below: "Amendment" means a written agreement, signed by the Parties, which documents changes to the Contract other than those permitted by Work Orders or Technical Guidance Letters. "Attachment" means documents, terms, conditions, or information added to this Contract following the Signature Document or included by reference, and made a part of this Contract. "Contract"means the Signature Document,these Uniform Terms and Conditions,along with any Attachments, and any Amendments, or Technical Guidance Letters that may be issued by the System Agency, to be incorporated by reference for all purposes. "Deliverable" means the work product(s), including all reports and project documentation, required to be submitted by Grantee to the System Agency. "Effective Date" means the date agreed to by the Parties as the date on which the Contract takes effect. "Federal Fiscal Year"means the period beginning October 1 and ending September 30 each year, which is the annual accounting period for the United States government. "GAAP" means Generally Accepted Accounting Principles. "GASB"means the Governmental Accounting Standards Board. "Grantee" means the Party receiving funds under this Contract. May also be referred to as "Contractor" in certain attachments. "Health and Human Services Commission" or "HHSC" means the administrative agency established under Chapter 531, Texas Government Code, or its designee. "HUB" means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code. "Intellectual Property Rights"means the worldwide proprietary rights or interests, including patent, copyright, trade secret, and trademark rights, as such right may be evidenced by or embodied in: i. any idea, design, concept, personality right, method, process, technique, apparatus, invention, discovery, or improvement; ii. any work of authorship, including any compilation, computer code, website or web page design, literary work, pictorial work, or graphic work; iii. any trademark, service mark, trade dress, trade name, branding, or other indicia of source or origin; iv. domain name registrations; and v. any other proprietary or similar rights. The Intellectual Property Rights of a Party include all worldwide proprietary rights or interests that the Party may have acquired by assignment,by exclusive license, or by license with the right to grant sublicenses. HHSC Grantee Uniform Terms and Conditions Page 4 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 "Mentor Protégé" means the Comptroller of Public Accounts' leadership program found at: http://www.window.state.tx.us/procurement/prog/hub/mentorprotege/. "Parties"means the System Agency and Grantee,collectively. "Party"means either the System Agency or Grantee,individually. "Program" means the statutorily authorized activities of the System Agency under which this Contract has been awarded. "Project"means specific activities of the Grantee that are supported by funds provided under this Contract. "Public Information Act" or"PIA"means Chapter 552 of the Texas Government Code. "Signature Document" means the document executed by both Parties that specifically sets forth all of the documents that constitute the Contract. "Solicitation" or "Request for Applications (RFA)" means the document (including all amendments and attachments) issued by the System Agency under which applications for Program funds were requested, which is incorporated by reference for all purposes in its entirety. "Solicitation. Response" or "Application" means Grantee's full and complete response (including any attachments and addenda) to the Solicitation, which is incorporated by reference for all purposes in its entirety. "State Fiscal Year" means the period beginning September 1 and ending August 31 each year, which is the annual accounting period for the State of Texas. "State of Texas Textravel" means Texas Administrative Code, Title 34, Part 1, Chapter 5, Subchapter C, Section 5.22, relative to travel reimbursements under this Contract, if any. "Statement of Work"means the description of activities performed in completing the Project, as specified in the Contract and as may be amended. "System Agency"means HHSC or any of the agencies of the State of Texas that are overseen by HHSC under authority granted under State law and the officers, employees, authorized representatives and designees of those agencies. These agencies include: HHSC and the Department of State Health Services. "Technical Guidance Letter" or "TGL" means an instruction, clarification, or interpretation of the requirements of the Contract, issued by the System Agency to the Grantee. "Work Product" means any and all works, including work papers, notes, materials, approaches, designs, specifications, systems, innovations, improvements, inventions, software, programs, source code, documentation, training materials, audio or audiovisual recordings, methodologies, concepts, studies, reports, whether finished or unfinished, and whether or not included in the deliverables, that are developed, produced, generated or provided by Grantee in connection with Grantee's performance of its duties under the Contract or through use of any funding provided under this Contract. "Uniform Grant Management Standards" or "UGMS" means uniform grant and contract administration procedures, developed under the authority of Chapter 783 of the Texas HHSC Grantee Uniform Terms and Conditions Page 5 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Government Code, to promote the efficient use of public funds in local government and in programs requiring cooperation among local, state, and federal agencies. 1.2 INTERPRETIVE PROVISIONS A. The meanings of defined terms include the singular and plural forms. B. The words "hereof," "herein," "hereunder," and similar words refer to this Contract as a whole and not to any particular provision, section, Attachment, or schedule of this Contract unless otherwise specified. C. The term "including" is not limiting and means "including without limitation" and, unless otherwise expressly provided in this Contract,(i)references to contracts(including this Contract) and other contractual instruments shall be deemed to include all subsequent Amendments and other modifications, but only to the extent that such Amendments and other modifications are not prohibited by the terms of this Contract, and (ii) references to any statute or regulation are to be construed as including all statutory and regulatory provisions consolidating, amending, replacing, supplementing, or interpreting the statute or regulation. D. Any references to "sections," "appendices," or"attachments" are references to sections, appendices, or attachments of the Contract. E. Any references to agreements, contracts, statutes, or administrative rules or regulations in the Contract are references to these documents as amended, modified, or supplemented from time to time during the term of the Contract. F. The captions and headings of this Contract are for convenience of reference only and do not affect the interpretation of this Contract. G. All Attachments, including those incorporated by reference, and any Amendments are considered part of the terms of this Contract. H. This Contract may use several different limitations, regulations, or policies to regulate the same or similar matters. All such limitations, regulations, and policies are cumulative and each will be performed in accordance with its terms. I. Unless otherwise expressly provided, reference to any action of the System Agency or by the System Agency by way of consent, approval, or waiver will be deemed modified by the phrase "in its sole discretion." J. Time is of the essence in this Contract. ARTICLE II. PAYMENT METHODS AND RESTRICTIONS 2.1 PAYMENT METHODS A. Except as otherwise provided by this Contract, the payment method will be one or more of the following: i. Cost Reimbursement. This payment method is based on an approved budget and submission of a request for reimbursement of expenses Grantee has incurred at the time of the request; ii. Unit rate/fee-for-service. This payment method is based on a fixed price or a specified rate(s) or fee(s) for delivery of a specified unit(s) of service and acceptable submission of all required documentation, forms and/or reports; or iii. Advance payment. This payment method is based on disbursal of the minimum necessary funds to carry out the Program or Project where the Grantee has HHSC Grantee Uniform Terms and Conditions Page 6 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 implemented appropriate safeguards. This payment method will only be utilized in accordance with governing law, state and federal regulations, and at the sole discretion of the System Agency. B. Grantee shall bill the System Agency in accordance with the Contract. Unless otherwise specified in the Contract, Grantee shall submit requests for reimbursement or payment monthly by the last business day of the month following the month in which expenses were incurred or services provided. Grantee shall maintain all documentation that substantiates invoices and make the documentation available to the System Agency upon request. 2.2 FINAL BILLING SUBMISSION Unless otherwise provided by the System Agency, Grantee shall submit a reimbursement or payment request as a final close-out invoice not later than forty-five (45) calendar days following the end of the term of the Contract. Reimbursement or payment requests received after the deadline may not be paid. 2.3 FINANCIAL STATUS REPORTS(FSRs) Except as otherwise provided, for contracts with categorical budgets, Grantee shall submit quarterly FSRs to System Agency by the last business day of the month following the end of each quarter for System Agency review and financial assessment. Grantee shall submit the final FSR no later than forty-five(45) calendar days following the end of the applicable term. 2.4 USE OF FUNDS Grantee shall expend funds under this Contract only for approved services and for reasonable and allowable expenses directly related to those services. 2.5 USE FOR MATCH PROHIBITED Grantee shall not use funds provided under this Contract for matching purposes in securing other funding without the written approval of the System Agency. 2.6 PROGRAM INCOME Income directly generated from funds provided under this Contract or earned only as a result of such funds is Program Income. Unless otherwise required under the Program, Grantee shall use Program Income, as provided in UGMS Section III, Subpart C, .25(g)(2), to further the Program, and Grantee shall spend the Program Income on the Project. Grantee shall identify and report Program Income in accordance with the Contract, applicable law, and any programmatic guidance. Grantee shall expend Program Income during the Contract term, when earned, and may not carry Program Income forward to any succeeding term. Grantee shall refund Program Income to the System Agency if the Program Income is not expended in the term in which it is earned. The System Agency may base future funding levels, in part, upon Grantee's proficiency in identifying, billing, collecting, and reporting Program Income, and in using Program Income for the purposes and under the conditions specified in this Contract. HHSC Grantee Uniform Terms and Conditions Page 7of21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 2.7 NONSUPPLANTING Grant funds may be used to supplement existing, new or corresponding programming and related activities. Grant funds may not be used to supplant (replace) existing funds in place to support current programs and related activities. 2.8 ALLOWABLE COSTS Allowable Costs are restricted to costs that comply with the Texas Uniform Grant Management Standards (UGMS) and applicable state and federal rules and law. The Parties agree that all the requirements of the UGMS apply to this Contract, including the criteria for Allowable Costs. Additional federal requirements apply if this Contract is funded, in whole or in part, with federal funds. 2.9 INDIRECT COST RATES The System Agency may acknowledge an indirect cost rate for Grantees that is utilized for all applicable contracts. Grantee will provide the necessary financial documents to determine the indirect cost rate in accordance with the Uniform Grant Guidance (UGG) and Uniform Grant Management Standards (UGMS). ARTICLE III. STATE AND FEDERAL FUNDING 3.1 FUNDING This Contract is subject to termination or cancellation, without penalty to System Agency, either in whole or in part, subject to the availability of state funds. System Agency is a state agency whose authority and appropriations are subject to actions of the Texas Legislature. If System Agency becomes subject to a legislative change,revocation of statutory authority, or lack of appropriated funds that would render either System Agency's or Grantee's delivery or performance under the Contract impossible or unnecessary, the Contract will be terminated or cancelled and be deemed null and void. In the event of a termination or cancellation under this Section, System Agency will not be liable to Grantee for any damages, that are caused or associated with such termination, or cancellation, and System Agency will not be required to give prior notice. 3.2 No DEBT AGAINST THE STATE This Contract will not be construed as creating any debt by or on behalf of the State of Texas. 3.3 DEBT AND DELINQUENCIES Grantee agrees that any payments due under the Contract shall be directly applied towards eliminating any debt or delinquency it has to the State of Texas including,but not limited to, delinquent taxes, delinquent student loan payments, and delinquent child support. 3.4 RECAPTURE OF FUNDS A. At its sole discretion, the System Agency may i) withhold all or part of any payments to Grantee to offset overpayments, unallowable or ineligible costs made to the Grantee, or if any required financial status report(s) is not submitted by the due date(s), or ii)require Grantee to promptly refund or credit-within thirty(30) calendar days of written notice - HHSC Grantee Uniform Terms and Conditions Page 8 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 any funds erroneously paid by System Agency which are not expressly authorized under the Contract. B. "Overpayments" as used in this Section include payments (i) made by the System Agency that exceed the maximum allowable rates; (ii)that are not allowed under applicable laws, rules, or regulations; or (iii) that are otherwise inconsistent with this Contract, including any unapproved expenditures. Grantee understands and agrees that it will be liable to the System Agency for any costs disallowed pursuant to financial and compliance audit(s) of funds received under this Contract. Grantee further understands and agrees that reimbursement of such disallowed costs shall be paid by Grantee from funds which were not provided or otherwise made available to Grantee under this Contract. ARTICLE IV. ALLOWABLE COSTS AND AUDIT REQUIREMENTS 4.1 ALLOWABLE COSTS A. System Agency will reimburse the allowable costs incurred in performing the Project that are sufficiently documented. Grantee must have incurred a cost prior to claiming reimbursement and within the applicable term to be eligible for reimbursement under this Contract. At its sole discretion, the System Agency will determine whether costs submitted by Grantee are allowable and eligible for reimbursement. The System Agency may take repayment (recoup) from funds available under this Contract in amounts necessary to fulfill Grantee's repayment obligations. Applicable cost principles, audit requirements, and administrative requirements include, but are not limited to: Applicable Entity Applicable Cost Audit Administrative Principles Requirements Requirements State, Local, and 2 CFR Part 200 and 2 CFR Part 200, 2 CFR Part 200 and Tribal UGMS Subpart F and UGMS Governments UGMS • Educational 2 CFR Part 200 and 2 CFR Part 200, 2 CFR Part 200 and Institutions UGMS Subpart F and UGMS UGMS Non-Profit 2 CFR Part 200 and 2 CFR Part 200, 2 CFR Part 200 and Organizations UGMS Subpart F and UGMS UGMS HHSC Grantee Uniform Terms and Conditions Page 9 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 For-profit 48 CFR Part 31, 2 CFR Part 200, 2 CFR Part 200 and Organization Contract Cost Subpart F and UGMS other than a Principles and UGMS hospital and an Procedures, or organization Uniform cost named in OMB accounting Circular A-122 standards that (2 CFR Part, comply with cost 230) as not principles subject to that acceptable to the circular. federal or state awarding agency B. OMB Circulars will be applied with the modifications prescribed by UGMS with effect given to whichever provision imposes the more stringent requirement in the event of a conflict. 4.2 AUDITS AND FINANCIAL STATEMENTS A. Audits i. HHS Single Audit Unit will notify Grantee to complete the Single Audit Determination Form. If Grantee fails to complete the form within thirty(30)calendar days after receipt of notice, Grantee will be subject to the sanctions and remedies for non-compliance with this Contract. ii. If Grantee,within Grantee's fiscal year, expends at least SEVEN HUNDRED FIFTY THOUSAND DOLLARS ($750,000) in federal funds awarded, Grantee shall have a single audit or program-specific audit in accordance with 2 CFR 200. The federal threshold amount includes federal funds passed through by way of state agency awards. iii. If Grantee,within Grantee's fiscal year, expends at least SEVEN HUNDRED FIFTY THOUSAND DOLLARS ($750,000) in state funds awarded, Grantee shall have a single audit or program-specific audit in accordance with UGMS, State of Texas Single Audit Circular.The audit must be conducted by an independent certified public accountant and in accordance with 2 CFR 200, Government Auditing Standards,and UGMS. iv. For-profit Grantees whose expenditures meet or exceed the federal or state expenditure thresholds stated above shall follow the guidelines in 2 CFR 200 or UGMS, as applicable, for their program-specific audits. v. Each Grantee that is required to obtain a single audit must competitively re-procure single audit services once every six years. Grantee shall procure audit services in compliance with this section, state procurement procedures, as well as with the provisions of UGMS. B. Financial Statements Each Grantee that does not meet the expenditure threshold for a single audit or program- specific audit, must provide financial statements. HHSC Grantee Uniform Terms and Conditions Page 10 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 4.3 SUBMISSION OF AUDITS AND FINANCIAL STATEMENTS A. Audits Due the earlier of 30 days after receipt of the independent certified public accountant's report or nine months after the end of the fiscal year, Grantee shall submit electronically one copy of the single audit or program-specific audit to the System Agency via: i. HHS portal at: or, https://hhsportal.hhs.state.tx.us/heartwebextr/hhscSau ii. Email to: single_audit_report@hhsc.state.tx.us. B. Financial Statements Due no later than nine months after the Grantee's fiscal year end, Grantees which are not required to submit an audit, shall submit electronically financial statements via: i. HHS portal at: https://hhsportal.hhs.state.tx.us/heartwebextr/hhscSau; or, ii. Email to: single_audit_report@hhsc.state.tx.us. ARTICLE V. AFFIRMATIONS, ASSURANCES AND CERTIFICATIONS 5.1 GENERAL AFFIRMATIONS Grantee certifies that, to the extent General Affirmations are incorporated into the Contract under the Signature Document, the Grantee has reviewed the General Affirmations and that Grantee is in compliance with all requirements. 5.2 FEDERAL ASSURANCES Grantee further certifies that, to the extent Federal Assurances are incorporated into the Contract under the Signature Document, the Grantee has reviewed the Federal Assurances and that Grantee is in compliance with all requirements. 5.3 FEDERAL CERTIFICATIONS Grantee further certifies that, to the extent Federal Certifications are incorporated into the Contract under the Signature Document, the Grantee has reviewed the Federal Certifications and that Grantee is in compliance with all requirements. In addition, Grantee certifies that it is in compliance with all applicable federal laws,rules, and regulations, as they may pertain to this Contract. ARTICLE VI. INTELLECTUAL PROPERTY 6.1 OWNERSHIP OF WORK PRODUCT All right, title, and interest in the Work Product, including all Intellectual Property Rights therein,is exclusively owned by System Agency. Grantee and Grantee's employees will have no rights in or ownership of the Work Product or any other property of System Agency. Any and all Work Product that is copyrightable under United States copyright law is deemed to be "work made for hire" owned by System Agency, as provided by Title 17 of the United States Code. To the extent that Work Product does not qualify as a "work made for hire" under applicable federal law, Grantee hereby irrevocably assigns and transfers to System Agency, its successors and assigns, the entire right, title, and interest in and to the Work Product, including any and all Intellectual Property Rights embodied therein or associated HHSC Grantee Uniform Terms and Conditions Page 11 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 therewith, and in and to all works based upon, derived from, or incorporating the Work Product, and in and to all income, royalties, damages, claims and payments now or hereafter due or payable with respect thereto, and in and to all causes of action, either in law or in equity for past,present or future infringement based on the copyrights, and in and to all rights corresponding to the foregoing. Grantee agrees to execute all papers and to perform such other property rights as System Agency may deem necessary to secure for System Agency or its designee the rights herein assigned. In the event that Grantee has any rights in and to the Work Product that cannot be assigned to System Agency, Grantee hereby grants to System Agency an exclusive, worldwide, royalty-free, transferable, irrevocable, and perpetual license, with the right to sublicense, to reproduce, distribute, modify, create derivative works of, publicly perform and publicly display, make, have made, use, sell and offer for sale the Work Product and any products developed by practicing such rights. 6.2 GRANTEE'S PRE-EXISTING WORKS To the extent that Grantee incorporates into the Work Product any works of Grantee that were created by Grantee or that Grantee acquired rights in prior to the Effective Date of this Contract ("Incorporated Pre-existing Works"), Grantee retains ownership of such Incorporated Pre-existing Works, and Grantee hereby grants to System Agency an irrevocable,perpetual,non-exclusive,royalty-free,transferable,worldwide right and license, with the right to sublicense, to use, modify, copy, create derivative works of, publish, publicly perform and display, sell, offer to sell, make and have made, the Incorporated Pre- existing Works, in any medium, with or without the associated Work Product. Grantee represents, warrants, and covenants to System Agency that Grantee has all necessary right and authority to grant the foregoing license in the Incorporated Pre-existing Works to System Agency. 6.3 AGREEMENTS WITH EMPLOYEES AND SUBCONTRACTORS Grantee shall have written, binding agreements with its employees and subcontractors that include provisions sufficient to give effect to and enable Grantee's compliance with Grantee's obligations under this Article VI. 6.4 DELIVERY UPON TERMINATION OR EXPIRATION No later than the first calendar day after the termination or expiration of the Contract or upon System Agency's request, Grantee shall deliver to System Agency all completed, or partially completed, Work Product, including any Incorporated Pre-existing Works, and any and all versions thereof Grantee's failure to timely deliver such Work Product is a material breach of the Contract. Grantee will not retain any copies of the Work Product or any documentation or other products or results of Grantee's activities under the Contract without the prior written consent of System Agency. 6.5 SURVIVAL The provisions and obligations of this Article VI survive any termination or expiration of the Contract. HHSC Grantee Uniform Terms and Conditions Page 12 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ARTICLE VII. RECORDS,AUDIT, AND DISCLOSURE 7.1 BOOKS AND RECORDS Grantee shall keep and maintain under GAAP or GASB, as applicable, full, true, and complete records necessary to fully disclose to the System Agency, the Texas State Auditor's Office, the United States Government, and their authorized representatives sufficient information to determine compliance with the terms and conditions of this Contract and all state and federal rules, regulations, and statutes. Unless otherwise specified in this Contract, Grantee shall maintain legible copies of this Contract and all related documents for a minimum of seven (7) years after the termination of the Contract period or seven (7) years after the completion of any litigation or dispute involving the Contract, whichever is later. 7.2 ACCESS TO RECORDS,BOOKS,AND DOCUMENTS In addition to any right of access arising by operation of law, Grantee and any of Grantee's affiliate or subsidiary organizations, or Subcontractors shall permit the System Agency or any of its duly authorized representatives, as well as duly authorized federal, state or local authorities, unrestricted access to and the right to examine any site where business is conducted or services are performed, and all records, which includes but is not limited to financial, client and patient records, books, papers or documents related to this Contract. If the Contract includes federal funds, federal agencies that shall have a right of access to records as described in this section include: the federal agency providing the funds, the Comptroller General of the United States, the General Accounting Office, the Office of the Inspector General, and any of their authorized representatives. In addition, agencies of the State of Texas that shall have a right of access to records as described in this section include: the System Agency, HHSC, HHSC's contracted examiners, the State Auditor's Office, the Office of the Texas Attorney General, and any successor agencies. Each of these entities may be a duly authorized authority. If deemed necessary by the System Agency or any duly authorized authority, for the purpose of investigation or hearing, Grantee shall produce original documents related to this Contract. The System Agency and any duly authorized authority shall have the right to audit billings both before and after payment, and all documentation that substantiates the billings. Grantee shall include this provision concerning the right of access to, and examination of, sites and information related to this Contract in any Subcontract it awards. 7.3 RESPONSE/COMPLIANCE WITH AUDIT OR INSPECTION FINDINGS A. Grantee must act to ensure its and its Subcontractors' compliance with all corrections necessary to address any finding of noncompliance with any law, regulation, audit requirement, or generally accepted accounting principle, or any other deficiency identified in any audit, review, or inspection of the Contract and the services and Deliverables provided. Any such correction will be at Grantee's or its Subcontractor's sole expense. Whether Grantee's action corrects the noncompliance shall be solely the decision of the System Agency. B. As part of the services, Grantee must provide to HHSC upon request a copy of those portions of Grantee's and its Subcontractors'internal audit reports relating to the services and Deliverables provided to the State under the Contract. HHSC Grantee Uniform Terms and Conditions Page 13 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 7.4 SAO AUDIT A. The state auditor may conduct an audit or investigation of any entity receiving funds from the state directly under the Contract or indirectly through a subcontract under the Contract. The acceptance of funds directly under the Contract or indirectly through a subcontract under the Contract acts as acceptance of the authority of the state auditor, under the direction of the legislative audit committee,to conduct an audit or investigation in connection with those funds. Under the direction of the legislative audit committee, an entity that is the subject of an audit or investigation by the state auditor must provide the state auditor with access to any information the state auditor considers relevant to the investigation or audit. B. Grantee shall comply with any rules and procedures of the state auditor in the implementation and enforcement of Section 2262.154 of the Texas Government Code. 7.5 CONFIDENTIALITY Grantee shall maintain as confidential, and shall not disclose to third parties without System Agency's prior written consent, any System Agency information including but not limited to System Agency's business activities, practices, systems, conditions and services. This section will survive termination or expiration of this Contract. ARTICLE VIII. CONTRACT REMEDIES AND EARLY TERMINATION 8.1 CONTRACT REMEDIES To ensure Grantee's full performance of the Contract and compliance with applicable law, the System Agency reserves the right to hold Grantee accountable for breach of contract or substandard performance and may take remedial or corrective actions, including, but not limited to: i. suspending all or part of the Contract; ii. requiring the Grantee to take specific actions in order to remain in compliance with the Contract; iii. recouping payments made by the System Agency to the Grantee found to be in error; iv. suspending, limiting, or placing conditions on the Grantee's continued performance of the Project; v. imposing any other remedies, sanctions or penalties authorized under this Contract or permitted by federal or state statute, law, regulation or rule. 8.2 TERMINATION FOR CONVENIENCE The System Agency may terminate the Contract at any time when, in its sole discretion, the System Agency determines that termination is in the best interests of the State of Texas. The termination will be effective on the date specified in HHSC's notice of termination. The System Agency's right to terminate the Contract for convenience is cumulative of all rights and remedies which exist now or in the future. 8.3 TERMINATION FOR CAUSE Except as otherwise provided by the U.S. Bankruptcy Code, or any successor law, the System Agency may terminate the Contract, in whole or in part,upon either of the following conditions: HHSC Grantee Uniform Terms and Conditions Page 14 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 i. Material Breach The System Agency will have the right to terminate the Contract in whole or in part if the System Agency determines, in its sole discretion, that Grantee has materially breached the Contract or has failed to adhere to any laws, ordinances, rules, regulations or orders of any public authority having jurisdiction and such violation prevents or substantially impairs performance of Grantee's duties under the Contract. Grantee's misrepresentation in any aspect of Grantee's Solicitation Response, if any, or Grantee's addition to the Excluded Parties List System (EPLS) will also constitute a material breach of the Contract. ii. Failure to Maintain Financial Viability The System Agency may terminate the Contract if, in its sole discretion, the System Agency has a good faith belief that Grantee no longer maintains the financial viability required to complete the services and Deliverables, or otherwise fully perform its responsibilities under the Contract. ARTICLE IX. MISCELLANEOUS PROVISIONS 9.1 AMENDMENT The Contract may only be amended by an Amendment executed by both Parties. 9.2 INSURANCE A. Unless otherwise specified in this Contract, Grantee shall acquire and maintain, for the duration of this Contract, insurance coverage necessary to ensure proper fulfillment of this Contract and potential liabilities thereunder with financially sound and reputable insurers licensed by the Texas Department of Insurance, in the type and amount customarily carried within the industry as determined by the System Agency. Grantee shall provide evidence of insurance as required under this Contract, including a schedule of coverage or underwriter's schedules establishing to the satisfaction of the System Agency the nature and extent of coverage granted by each such policy, upon request by the System Agency. In the event that any policy is determined by the System Agency to be deficient to comply with the terms of this Contract, Grantee shall secure such additional policies or coverage as the System Agency may reasonably request or that are required by law or regulation. If coverage expires during the term of this Contract, Grantee must produce renewal certificates for each type of coverage. B. These and all other insurance requirements under the Contract apply to both Grantee and its Subcontractors, if any. Grantee is responsible for ensuring its Subcontractors' compliance with all requirements. 9.3 LEGAL OBLIGATIONS Grantee shall comply with all applicable federal, state, and local laws, ordinances, and regulations, including all federal and state accessibility laws relating to direct and indirect use of information and communication technology. Grantee shall be deemed to have knowledge of all applicable laws and regulations and be deemed to understand them. HHSC Grantee Uniform Terms and Conditions Page 15 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 9.4 PERMITTING AND LICENSURE At Grantee's sole expense, Grantee shall procure and maintain for the duration of this Contract any state, county, city, or federal license, authorization, insurance, waiver, permit, qualification or certification required by statute, ordinance, law, or regulation to be held by Grantee to provide the goods or services required by this Contract. Grantee shall be responsible for payment of all taxes, assessments, fees, premiums, permits, and licenses required by law. Grantee shall be responsible for payment of any such government obligations not paid by its Subcontractors during performance of this Contract. 9.5 INDEMNITY A. GRANTEE SHALL DEFEND, INDEMNIFY AND HOLD HARMLESS THE STATE OF TEXAS AND SYSTEM AGENCY, AND/OR THEIR OFFICERS, AGENTS, EMPLOYEES, REPRESENTATIVES, CONTRACTORS, ASSIGNEES, AND/OR DESIGNEES FROM ANY AND ALL LIABILITY, ACTIONS, CLAIMS, DEMANDS, OR SUITS, AND ALL RELATED COSTS, ATTORNEY FEES, AND EXPENSES ARISING OUT OF OR RESULTING FROM ANY ACTS OR OMISSIONS OF GRANTEE OR ITS AGENTS, EMPLOYEES, SUBCONTRACTORS, ORDER FULFILLERS, OR SUPPLIERS OF SUBCONTRACTORS IN THE EXECUTION OR PERFORMANCE OF THE CONTRACT AND ANY PURCHASE ORDERS ISSUED UNDER THE CONTRACT. THE DEFENSE SHALL BE COORDINATED BY GRANTEE WITH THE OFFICE OF THE TEXAS ATTORNEY GENERAL WHEN TEXAS STATE AGENCIES ARE NAMED DEFENDANTS IN ANY LAWSUIT AND GRANTEE MAY NOT AGREE TO ANY SETTLEMENT WITHOUT FIRST OBTAINING THE CONCURRENCE FROM THE OFFICE OF THE TEXAS ATTORNEY GENERAL. GRANTEE AND SYSTEM AGENCY AGREE TO FURNISH TIMELY WRITTEN NOTICE TO EACH OTHER OF ANY SUCH CLAIM. B. THIS PARAGRAPH IS NOT INTENDED TO AND SHALL NOT BE CONSTRUED TO REQUIRE GRANTEE TO INDEMNIFY OR HOLD HARMLESS THE STATE OR THE SYSTEM AGENCY FOR ANY CLAIMS OR LIABILITIES RESULTING FROM THE NEGLEGENT ACTS OR OMISSIONS OF THE SYSTEM AGENCY OR ITS EMPLOYEES. C. For the avoidance of doubt, System Agency shall not indemnify Grantee or any other entity under the Contract. 9.6 ASSIGNMENTS A. Grantee may not assign all or any portion of its rights under, interests in, or duties required under this Contract without prior written consent of the System Agency, which may be withheld or granted at the sole discretion of the System Agency. Except where otherwise agreed in writing by the System Agency, assignment will not release Grantee from its obligations under the Contract. B. Grantee understands and agrees the System Agency may in one or more transactions assign, pledge, or transfer the Contract. This assignment will only be made to another State agency or a non-state agency that is contracted to perform agency support. HHSC Grantee Uniform Terms and Conditions Page 16 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 9.7 INDEPENDENT CONTRACTOR Grantee and Grantee's employees, representatives, agents, Subcontractors, suppliers, and third-party service providers shall serve as independent contractors in providing the services under the Contract. Neither Grantee nor System Agency is an agent of the other and neither may make any commitments on the other party's behalf. Should Grantee subcontract any of the services required in the Contract, Grantee expressly understands and acknowledges that in entering such subcontract(s), System Agency is in no manner liable to any Subcontractor(s) of Grantee. In no event shall this provision relieve Grantee of the responsibility for ensuring that the services performed under all subcontracts are rendered in compliance with the Contract. Grantee shall have no claim against System Agency for vacation pay, sick leave, retirement benefits, social security, worker's compensation, health or disability benefits, unemployment insurance benefits, or employee benefits of any kind. The Contract shall not create any joint venture, partnership, agency, or employment relationship between Grantee and System Agency. 9.8 TECHNICAL GUIDANCE LETTERS In the sole discretion of the System Agency, and in conformance with federal and state law, the System Agency may issue instructions, clarifications, or interpretations as may be required during work performance in the form of a Technical Guidance Letter (TGL). A TGL must be in writing, and may be delivered by regular mail, electronic mail, or facsimile transmission. Any TGL issued by the System Agency will be incorporated into the Contract by reference for all purposes when it is issued. 9.9 DISPUTE RESOLUTION A. The dispute resolution process provided for in Chapter 2260 of the Texas Government Code must be used to attempt to resolve any dispute arising under the Contract. B. If a contract dispute arises that cannot be resolved to the satisfaction of the Parties, either Party may notify the other Party in writing of the dispute. If the Parties are unable to satisfactorily resolve the dispute within fourteen(14) days of the written notification,the Parties must use the dispute resolution process provided for in Chapter 2260 of the Texas Government Code to attempt to resolve the dispute. This provision will not apply to any matter with respect to which either Party may make a decision within its respective sole discretion. 9.10 GOVERNING LAW AND VENUE The Contract shall be governed by and construed in accordance with the laws of the State of Texas, without regard to the conflicts of law provisions. The venue of any suit arising under the Contract is fixed in any court of competent jurisdiction of Travis County, Texas, unless the specific venue is otherwise identified in a statute which directly names or otherwise identifies its applicability to the System Agency. 9.11 SEVERABILITY If any provision contained in this Contract is held to be unenforceable by a court of law or equity, this Contract shall be construed as if such provision did not exist and the non- HHSC Grantee Uniform Terms and Conditions Page 17 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 enforceability of such provision shall not be held to render any other provision or provisions of this Contract unenforceable. 9.12 SURVIVABILITY Expiration or termination of the Contract for any reason does not release Grantee from any liability or obligation set forth in the Contract that is expressly stated to survive any such expiration or termination,that by its nature would be intended to be applicable following any such expiration or termination, or that is necessary to fulfill the essential purpose of the Contract, including without limitation the provisions regarding warranty, indemnification, confidentiality, and rights and remedies upon termination. 9.13 FORCE MAJEURE Neither Grantee nor System Agency shall be liable to the other for any delay in, or failure of performance, of any requirement included in the Contract caused by force majeure. The existence of such causes of delay or failure shall extend the period of performance until after the causes of delay or failure have been removed provided the non-performing party exercises all reasonable due diligence to perform. Force majeure is defined as acts of God, war, fires, explosions, hurricanes, floods, failure of transportation, or other causes that are beyond the reasonable control of either party and that by exercise of due foresight such party could not reasonably have been expected to avoid, and which, by the exercise of all reasonable due diligence, such party is unable to overcome. 9.14 No WAIVER OF PROVISIONS The failure of the System Agency to object to or to take affirmative action with respect to any conduct of the Grantee which is in violation or breach of the terms of the Contract shall not be construed as a waiver of the violation or breach, or of any future violation or breach. 9.15 PUBLICITY A. Except as provided in the paragraph below, Grantee must not use the name of, or directly or indirectly refer to, the System Agency, the State of Texas, or any other State agency in any media release, public announcement, or public disclosure relating to the Contract or its subject matter, including in any promotional or marketing materials, customer lists, or business presentations. B. Grantee may publish, at its sole expense, results of Grantee performance under the Contract with the System Agency's prior review and approval, which the System Agency may exercise at its sole discretion. Any publication (written, visual, or sound) will acknowledge the support received from the System Agency and any Federal agency, as appropriate. C. Contractor is prohibited from using the Work for any Contractor or third party marketing, advertising, or promotional activities, without the prior written consent of System Agency. The foregoing prohibition includes, without limitation, the placement of banners, pop-up ads, or other advertisements promoting Contractor's or a third party's products, services, workshops, trainings, or other commercial offerings on any website portal or internet-based service or software application hosted or managed by Contractor as part of the Work. HHSC Grantee Uniform Terms and Conditions Page 18 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 9.16 PROHIBITION ON NON-COMPETE RESTRICTIONS Grantee shall not require any employees or Subcontractors to agree to any conditions, such as non-compete clauses or other contractual arrangements that would limit or restrict such persons or entities from employment or contracting with the State of Texas. 9.17 NO WAIVER OF SOVEREIGN IMMUNITY Nothing in the Contract will be construed as a waiver of the System Agency's or the State's sovereign immunity. This Contract shall not constitute or be construed as a waiver of any of the privileges, rights, defenses, remedies, or immunities available to the System Agency or the State of Texas. The failure to enforce, or any delay in the enforcement, of any privileges, rights, defenses, remedies, or immunities available to the System Agency or the State of Texas under the Contract or under applicable law shall not constitute a waiver of such privileges, rights, defenses, remedies, or immunities or be considered as a basis for estoppel. System Agency does not waive any privileges, rights, defenses, or immunities available to System Agency by entering into the Contract or by its conduct prior to or subsequent to entering into the Contract. 9.18 ENTIRE CONTRACT AND MODIFICATION The Contract constitutes the entire agreement of the Parties and is intended as a complete and exclusive statement of the promises,representations,negotiations,discussions,and other agreements that may have been made in connection with the subject matter hereof. Any additional or conflicting terms in any future document incorporated into the Contract will be harmonized with this Contract to the extent possible. 9.19 COUNTERPARTS This Contract may be executed in any number of counterparts, each of which will be an original, and all such counterparts will together constitute but one and the same Contract. 9.20 PROPER AUTHORITY Each Party represents and warrants that the person executing this Contract on its behalf has full power and authority to enter into this Contract. 9.21 E-VERIFY PROGRAM Grantee certifies that it utilizes and will continue to utilize the U.S. Department of Homeland Security's E-Verify system to determine the eligibility of: i. all persons employed to perform duties within Texas during the term of the Contract; and ii. all persons, (including subcontractors) assigned by the Grantee to perform work pursuant to the Contract within the United States of America. 9.22 CIVIL RIGHTS A. Grantee agrees to comply with state and federal anti-discrimination laws, including: i. Title VI of the Civil Rights Act of 1964 (42 U.S.C. §2000d et seq.); ii. Section 504 of the Rehabilitation Act of 1973 (29 U.S.C. §794); iii. Americans with Disabilities Act of 1990 (42 U.S.C. §12101 et seq.); iv. Age Discrimination Act of 1975 (42 U.S.C. §§6101-6107); HHSC Grantee Uniform Terms and Conditions Page 19 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 v. Title IX of the Education Amendments of 1972 (20 U.S.C. §§1681-1688); vi. Food and Nutrition Act of 2008 (7 U.S.C. §2011 et seq.); and vii. The System Agency's administrative rules, as set forth in the Texas Administrative Code, to the extent applicable to this Contract. B. Grantee agrees to comply with all amendments to the above-referenced laws, and all requirements imposed by the regulations issued pursuant to these laws. These laws provide in part that no persons in the United States may, on the grounds of race, color, national origin, sex, age, disability, political beliefs, or religion, be excluded from participation in or denied any aid, care, service or other benefits provided by Federal or State funding, or otherwise be subjected to discrimination. C. Grantee agrees to comply with Title VI of the Civil Rights Act of 1964, and its implementing regulations at 45 C.F.R. Part 80 or 7 C.F.R. Part 15, prohibiting a contractor from adopting and implementing policies and procedures that exclude or have the effect of excluding or limiting the participation of clients in its programs, benefits, or activities on the basis of national origin. State and federal civil rights laws require contractors to provide alternative methods for ensuring access to services for applicants and recipients who cannot express themselves fluently in English. Grantee agrees to take reasonable steps to provide services and information, both orally and in writing, in appropriate languages other than English, in order to ensure that persons with limited English proficiency are effectively informed and can have meaningful access to programs, benefits, and activities. D. Grantee agrees to post applicable civil rights posters in areas open to the public informing clients of their civil rights and including contact information for the HHS Civil Rights Office. The posters are available on the HHS website at: http://hhscx.hhsc.texas.gov/system-support- services/civil-rights/publications E. Grantee agrees to comply with Executive Order 13279, and its implementing regulations at 45 C.F.R. Part 87 or 7 C.F.R. Part 16. These provide in part that any organization that participates in programs funded by direct financial assistance from the United States Department of Agriculture or the United States Department of Health and Human Services shall not discriminate against a program beneficiary or prospective program beneficiary on the basis of religion or religious belief. F. Upon request, Grantee shall provide HHSC's Civil Rights Office with copies of the Grantee's civil rights policies and procedures. G. Grantee must notify HHSC's Civil Rights Office of any civil rights complaints received relating to its performance under this Contract. This notice must be delivered no more than ten (10) calendar days after receipt of a complaint. Notice provided pursuant to this section must be directed to: HHSC Civil Rights Office 701 W. 51st Street, Mail Code W206 Austin, Texas 78751 Phone Toll Free: (888) 388-6332 Phone: (512) 438-4313 TTY Toll Free: (877)432-7232 Fax: (512) 438-5885. HHSC Grantee Uniform Terms and Conditions Page 20 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 9.23 SYSTEM AGENCY DATA As between the Parties, all data and information acquired, accessed, or made available to Contractor by or through System Agency or System Agency contractors, including all electronic data generated, processed, transmitted, or stored by Contractor in the course of providing data processing services in connection with Contractor's performance hereunder, (the "System Agency Data"), is owned solely by System Agency. Contractor has no right or license to use,analyze,aggregate,transmit,create derivatives of,copy,disclose,or process the System Agency Data except as required for Contractor to fulfill its obligations under the Contract or as authorized in advance in writing by System Agency. For the avoidance of doubt, Contractor is expressly prohibited from using, and from permitting any third party to use, System Agency Data for marketing,research, or other non-governmental or commercial purposes, without the prior written consent of System Agency. HHSC Grantee Uniform Terms and Conditions Page 21 of 21 v.2.16.1 Effective 03/26/2019 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 HEALTH AND HUMAN SERVICES ATTACHMENT D CONTRACT AFFIRMATIONS For purposes of these Contract Affirmations, HHS includes both the Health and Human Services Commission (HHSC) and the Department of State Health Services (DSHS). System Agency refers to HHSC, DSHS, or both, that will be a party to this Contract. These Contract Affirmations apply to all Contractors regardless of their business form (e.g., individual, partnership, corporation). By entering into this Contract, Contractor affirms, without exception, understands, and agrees to comply with the following items through the life of the Contract: 1. Contractor represents and warrants that these Contract Affirmations apply to Contractor and all of Contractor's principals,officers,directors,shareholders,partners,owners,agents, employees, subcontractors, independent contractors, and any other representatives who may provide services under,who have a financial interest in, or otherwise are interested in this Contract and any related Solicitation. 2. Complete and Accurate Information Contractor represents and warrants that all statements and information provided to HHS are current, complete, and accurate. This includes all statements and information in this Contract and any related Solicitation Response. 3. Public Information Act Contractor understands that HHS will comply with the Texas Public Information Act (Chapter 552 of the Texas Government Code) as interpreted by judicial rulings and opinions of the Attorney General of the State of Texas. Information, documentation, and other material prepared and submitted in connection with this Contract or any related Solicitation may be subject to public disclosure pursuant to the Texas Public Information Act. In accordance with Section 2252.907 of the Texas Government Code, Contractor is required to make any information created or exchanged with the State pursuant to the Contract, and not otherwise excepted from disclosure under the Texas Public Information Act, available in a format that is accessible by the public at no additional charge to the State. 4. Contracting Information Requirements Contractor represents and warrants that it will comply with the requirements of Section 552.372(a) of the Texas Government Code. Except as provided by Section 552.374(c) of the Texas Government Code, the requirements of Subchapter J (Additional Provisions Related to Contracting Information), Chapter 552 of the Government Code, may apply to the Contract and the Contractor agrees that the Contract can be terminated if the Contractor knowingly or intentionally fails to comply with a requirement of that subchapter. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 1 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 5. Assignment A. Contractor shall not assign its rights under the contract or delegate the performance of its duties under the contract without prior written approval from System Agency. Any attempted assignment in violation of this provision is void and without effect. B. Contractor understands and agrees the System Agency may in one or more transactions assign, pledge, or transfer the Contract. Upon receipt of System Agency's notice of assignment, pledge, or transfer, Contractor shall cooperate with System Agency in giving effect to such assignment,pledge, or transfer, at no cost to System Agency or to the recipient entity. 6. Terms and Conditions Contractor accepts the Solicitation terms and conditions unless specifically noted by exceptions advanced in the form and manner directed in the Solicitation, if any, under which this Contract was awarded. Contractor agrees that all exceptions to the Solicitation, as well as terms and conditions advanced by Contractor that differ in any manner from HHS' terms and conditions, if any, are rejected unless expressly accepted by System Agency in writing. 7. HHS Right to Use Contractor agrees that HHS has the right to use, produce, and distribute copies of and to disclose to HHS employees, agents, and contractors and other governmental entities all or part of this Contract or any related Solicitation Response as HHS deems necessary to complete the procurement process or comply with state or federal laws. 8. Release from Liability Contractor generally releases from liability and waives all claims against any party providing information about the Contractor at the request of System Agency. 9. Dealings with Public Servants Contractor has not given, has not offered to give, and does not intend to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with this Contract or any related Solicitation, or related Solicitation Response. 10. Financial Participation Prohibited Under Section 2155.004, Texas Government Code (relating to financial participation in preparing solicitations), Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive this Contract and acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate. 11. Prior Disaster Relief Contract Violation Under Sections 2155.006 and 2261.053 of the Texas Government Code (relating to convictions and penalties regarding Hurricane Rita, Hurricane Katrina, and other disasters), the Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive this Contract and Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 2 of 10 DocuSign Envelope ID:0C43C469-OA3F-4342-8E8D-BB21884C3931 acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate. 12. Child Support Obligation Under Section 231.006(d) of the Texas Family Code regarding child support, Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive the specified payment and acknowledges that the Contract may be terminated and payment may be withheld if this certification is inaccurate. 13. Suspension and Debarment Contractor certifies that it and its principals are not suspended or debarred from doing business with the state or federal government as listed on the State of Texas Debarred Vendor List maintained by the Texas Comptroller of Public Accounts and the System for Award Management (SAM) maintained by the General Services Administration. This certification is made pursuant to the regulations implementing Executive Order 12549 and Executive Order 12689, Debarment and Suspension, 2 C.F.R. Part 376, and any relevant regulations promulgated by the Department or Agency funding this project. This provision shall be included in its entirety in Contractor's subcontracts, if any, if payment in whole or in part is from federal funds. 14. Excluded Parties Contractor certifies that it is not listed in the prohibited vendors list authorized by Executive Order 13224, "Blocking Property and Prohibiting Transactions with Persons Who Commit, Threaten to Commit, or Support Terrorism,"published by the United States Department of the Treasury, Office of Foreign Assets Control.' 15. Foreign Terrorist Organizations Contractor represents and warrants that it is not engaged in business with Iran, Sudan, or a foreign terrorist organization, as prohibited by Section 2252.152 of the Texas Government Code. 16. Executive Head of a State Agency In accordance with Section 669.003 of the Texas Government Code,relating to contracting with the executive head of a state agency, Contractor certifies that it is not(1)the executive head of an HHS agency, (2) a person who at any time during the four years before the date of this Contract was the executive head of an HHS agency, or(3) a person who employs a current or former executive head of an HHS agency. 17. Human Trafficking Prohibition Under Section 2155.0061 of the Texas Government Code, Contractor certifies that the individual or business entity named in this Contract is not ineligible to receive this contract and acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 3 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 18. Franchise Tax Status Contractor represents and warrants that it is not currently delinquent in the payment of any franchise taxes owed the State of Texas under Chapter 171 of the Texas Tax Code. 19. Debts and Delinquencies Contractor agrees that any payments due under this Contract shall be applied towards any debt or delinquency that is owed to the State of Texas. 20. Lobbying Prohibition Contractor represents and warrants that payments to Contractor and Contractor's receipt of appropriated or other funds under this Contract or any related Solicitation are not prohibited by Sections 556.005, 556.0055,or 556.008 of the Texas Government Code(relating to use of appropriated money or state funds to employ or pay lobbyists, lobbying expenses, or influence legislation). 21. Buy Texas Contractor agrees to comply with Section 2155.4441 of the Texas Government Code, requiring the purchase of products and materials produced in the State of Texas in performing service contracts. 22. Disaster Recovery Plan Contractor agrees that upon request of System Agency, Contractor shall provide copies of its most recent business continuity and disaster recovery plans. 23. Computer Equipment Recycling Program If this Contract is for the purchase or lease of computer equipment,then Contractor certifies that it is in compliance with Subchapter Y, Chapter 361 of the Texas Health and Safety Code related to the Computer Equipment Recycling Program and the Texas Commission on Environmental Quality rules in 30 TAC Chapter 328. 24. Television Equipment Recycling Program If this Contract is for the purchase or lease of covered television equipment,then Contractor certifies that it is compliance with Subchapter Z, Chapter 361 of the Texas Health and Safety Code related to the Television Equipment Recycling Program. 25. Cybersecurity Training A. Contractor represents and warrants that it will comply with the requirements of Section 2054.5192 of the Texas Government Code relating to cybersecurity training and required verification of completion of the training program. B. Contractor represents and warrants that if Contractor or Subcontractors, officers, or employees of Contractor have access to any state computer system or database, the Contractor, Subcontractors, officers, and employees of Contractor shall complete cybersecurity training pursuant to and in accordance with Government Code, Section 2054.5192. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 4 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 26. Restricted Employment for Certain State Personnel Contractor acknowledges that, pursuant to Section 572.069 of the Texas Government Code, a former state officer or employee of a state agency who during the period of state service or employment participated on behalf of a state agency in a procurement or contract negotiation involving Contractor may not accept employment from Contractor before the second anniversary of the date the Contract is signed or the procurement is terminated or withdrawn. 27. No Conflicts of Interest A. Contractor represents and warrants that it has no actual or potential conflicts of interest in providing the requested goods or services to System Agency under this Contract or any related Solicitation and that Contractor's provision of the requested goods and/or services under this Contract and any related Solicitation will not constitute an actual or potential conflict of interest or reasonably create an appearance of impropriety. B. Contractor agrees that, if after execution of the Contract, Contractor discovers or is made aware of a Conflict of Interest, Contractor will immediately and fully disclose such interest in writing to System Agency. In addition, Contractor will promptly and fully disclose any relationship that might be perceived or represented as a conflict after its discovery by Contractor or by System Agency as a potential conflict. System Agency reserves the right to make a final determination regarding the existence of Conflicts of Interest, and Contractor agrees to abide by System Agency's decision. 28. Fraud, Waste, and Abuse Contractor understands that HHS does not tolerate any type of fraud, waste, or abuse. Violations of law, agency policies,or standards of ethical conduct will be investigated, and appropriate actions will be taken. Pursuant to Texas Government Code, Section 321.022, if the administrative head of a department or entity that is subject to audit by the state auditor has reasonable cause to believe that money received from the state by the department or entity or by a client or contractor of the department or entity may have been lost,misappropriated,or misused,or that other fraudulent or unlawful conduct has occurred in relation to the operation of the department or entity, the administrative head shall report the reason and basis for the belief to the Texas State Auditor's Office(SAO).All employees or contractors who have reasonable cause to believe that fraud,waste,or abuse has occurred (including misconduct by any HHS employee, Grantee officer, agent, employee, or subcontractor that would constitute fraud, waste, or abuse) are required to immediately report the questioned activity to the Health and Human Services Commission's Office of Inspector General. Contractor agrees to comply with all applicable laws,rules,regulations, and System Agency policies regarding fraud, waste, and abuse including, but not limited to, HHS Circular C-027. A report to the SAO must be made through one of the following avenues: • SAO Toll Free Hotline: 1-800-TX-AUDIT • SAO website: http://sao.fraud.state.tx.us/ All reports made to the OIG must be made through one of the following avenues: • OIG Toll Free Hotline 1-800-436-6184 Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 5 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 • OIG Website: ReportTexasFraud.com • Internal Affairs Email: InternalAffairsReferral@hhsc.state.tx.us • OIG Hotline Email: OIGFraudHotline@hhsc.state.tx.us. • OIG Mailing Address: Office of Inspector General Attn: Fraud Hotline MC 1300 P.O. Box 85200 Austin, Texas 78708-5200 29. Antitrust The undersigned affirms under penalty of perjury of the laws of the State of Texas that: A. in connection with this Contract and any related Solicitation Response, neither I nor any representative of the Contractor has violated any provision of the Texas Free Enterprise and Antitrust Act, Tex. Bus. & Comm. Code Chapter 15; B. in connection with this Contract and any related Solicitation Response, neither I nor any representative of the Contractor has violated any federal antitrust law; and C. neither I nor any representative of the Contractor has directly or indirectly communicated any of the contents of this Contract and any related Solicitation Response to a competitor of the Contractor or any other company, corporation, firm, partnership or individual engaged in the same line of business as the Contractor. 30. Legal and Regulatory Actions Contractor represents and warrants that it is not aware of and has received no notice of any court or governmental agency proceeding, investigation, or other action pending or threatened against Contractor or any of the individuals or entities included in numbered paragraph 1 of these Contract Affirmations within the five (5) calendar years immediately preceding execution of this Contract or the submission of any related Solicitation Response that would or could impair Contractor's performance under this Contract, relate to the contracted or similar goods or services, or otherwise be relevant to System Agency's consideration of entering into this Contract. If Contractor is unable to make the preceding representation and warranty, then Contractor instead represents and warrants that it has provided to System Agency a complete, detailed disclosure of any such court or governmental agency proceeding, investigation, or other action that would or could impair Contractor's performance under this Contract, relate to the contracted or similar goods or services, or otherwise be relevant to System Agency's consideration of entering into this Contract. In addition,Contractor acknowledges this is a continuing disclosure requirement. Contractor represents and warrants that Contractor shall notify System Agency in writing within five (5) business days of any changes to the representations or warranties in this clause and understands that failure to so timely update System Agency shall constitute breach of contract and may result in immediate contract termination. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 6 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 31. No Felony Criminal Convictions Contractor represents that neither Contractor nor any of its employees, agents, or representatives, including any subcontractors and employees, agents, or representative of such subcontractors, have been convicted of a felony criminal offense or that if such a conviction has occurred Contractor has fully advised System Agency in writing of the facts and circumstances surrounding the convictions. 32. Unfair Business Practices Contractor represents and warrants that it has not been the subject of allegations of Deceptive Trade Practices violations under Chapter 17 of the Texas Business and Commerce Code, or allegations of any unfair business practice in any administrative hearing or court suit and that Contractor has not been found to be liable for such practices in such proceedings. Contractor certifies that it has no officers who have served as officers of other entities who have been the subject of allegations of Deceptive Trade Practices violations or allegations of any unfair business practices in an administrative hearing or court suit and that such officers have not been found to be liable for such practices in such proceedings. 33. Entities that Boycott Israel Contractor represents and warrants that(1) it does not, and shall not for the duration of the Contract, boycott Israel or (2) the verification required by Section 2271.002 of the Texas Government Code does not apply to the Contract. If circumstances relevant to this provision change during the course of the contract,Contractor shall promptly notify System Agency. 34. E-Verify Contractor certifies that for contracts for services, Contractor shall utilize the U.S. Department of Homeland Security's E-Verify system during the term of this Contract to determine the eligibility of: 1. all persons employed by Contractor to perform duties within Texas; and 2. all persons, including subcontractors, assigned by Contractor to perform work pursuant to this Contract within the United States of America. 35. Former Agency Employees—Certain Contracts If this Contract is an employment contract, a professional services contract under Chapter 2254 of the Texas Government Code,or a consulting services contract under Chapter 2254 of the Texas Government Code, in accordance with Section 2252.901 of the Texas Government Code, Contractor represents and warrants that neither Contractor nor any of Contractor's employees including, but not limited to, those authorized to provide services under the contract, were former employees of an HHS Agency during the twelve (12) month period immediately prior to the date of the execution of the contract. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 7 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 36. Disclosure of Prior State Employment—Consulting Services If this Contract is for consulting services, A. In accordance with Section 2254.033 of the Texas Government Code, a Contractor providing consulting services who has been employed by, or employs an individual who has been employed by, System Agency or another State of Texas agency at any time during the two years preceding the submission of Contractor's offer to provide services must disclose the following information in its offer to provide services. Contractor hereby certifies that this information was provided and remains true,correct, and complete: 1. Name of individual(s) (Contractor or employee(s)); 2. Status; 3. The nature of the previous employment with HHSC or the other State of Texas agency; 4. The date the employment was terminated and the reason for the termination; and 5. The annual rate of compensation for the employment at the time of its termination. B. If no information was provided in response to Section A above, Contractor certifies that neither Contractor nor any individual employed by Contractor was employed by System Agency or any other State of Texas agency at any time during the two years preceding the submission of Contractor's offer to provide services. 37. Abortion Funding Limitation Contractor understands, acknowledges, and agrees that, pursuant to Article IX, Section 6.25 of the General Appropriations Act(the Act),to the extent allowed by federal and state law, money appropriated by the Texas Legislature may not be distributed to any individual or entity that, during the period for which funds are appropriated under the Act: 1. performs an abortion procedure that is not reimbursable under the state's Medicaid program; 2. is commonly owned, managed, or controlled by an entity that performs an abortion procedure that is not reimbursable under the state's Medicaid program; or 3. is a franchise or affiliate of an entity that performs an abortion procedure that is not reimbursable under the state's Medicaid program. The provision does not apply to a hospital licensed under Chapter 241,Health and Safety Code,or an office exempt under Section 245.004(2), Health and Safety Code. Contractor represents and warrants that it is not ineligible, nor will it be ineligible during the term of this Contract, to receive appropriated funding pursuant to Article IX, Section 6.25. 38. Funding Eligibility Contractor understands, acknowledges, and agrees that, pursuant to Chapter 2272 of the Texas Government Code, except as exempted under that Chapter, HHSC cannot contract with an abortion provider or an affiliate of an abortion provider. Contractor certifies that it is not ineligible to contract with HHSC under the terms of Chapter 2272 of the Texas Government Code. Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 8 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 39. Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment(2 CFR 200.216) Contractor certifies that the individual or business entity named in this Response or contract is not ineligible to receive the specified contract or funding pursuant to 2 CFR 200.216. 40. False Representation Contractor understands, acknowledges, and agrees that any false representation or any failure to comply with a representation, warranty, or certification made by Contractor is subject to all civil and criminal consequences provided at law or in equity including, but not limited to, immediate termination of this Contract. 41. False Statements Contractor represents and warrants that all statements and information prepared and submitted by Contractor in this Contract and any related Solicitation Response are current, complete, true, and accurate. Contractor acknowledges any false statement or material misrepresentation made by Contractor during the performance of this Contract or any related Solicitation is a material breach of contract and may void this Contract. Further, Contractor understands, acknowledges, and agrees that any false representation or any failure to comply with a representation, warranty, or certification made by Contractor is subject to all civil and criminal consequences provided at law or in equity including, but not limited to, immediate termination of this Contract. 42. Permits and License Contractor represents and warrants that it will comply with all applicable laws and maintain all permits and licenses required by applicable city, county, state, and federal rules, regulations, statutes, codes, and other laws that pertain to this Contract. 43. Drug-Free Workplace Contractor represents and warrants that it shall comply with the applicable provisions of the Drug-Free Work Place Act of 1988 (41 U.S.C. §701 et seq.) and maintain a drug-free work environment. 44. Equal Employment Opportunity Contractor represents and warrants its compliance with all applicable duly enacted state and federal laws governing equal employment opportunities. 45. Federal Occupational Safety and Health Law Contractor represents and warrants that all articles and services shall meet or exceed the safety standards established and promulgated under the Federal Occupational Safety and Health Act of 1970, as amended(29 U.S.C. Chapter 15). Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 9 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 46. Signature Authority Contractor represents and warrants that the individual signing this Contract Affirmations document is authorized to sign on behalf of Contractor and to bind the Contractor. Authorized representative on behalf of Contractor must complete and sign the following: Legal Name of Contractor Assumed Business Name of Contractor, if applicable (d/b/a or `doing business as') Texas County(s) for Assumed Business Name (d/b/a or `doing business as') Attach Assumed Name Certificate(s) filed with the Texas Secretary of State and Assumed Name Certificate(s), if any, for each Texas County Where Assumed Name Certificate(s) has been filed Signature of Authorized Representative Date Signed Judith Smith Director of Health Services Printed Name of Authorized Representative Title of Authorized Representative First, Middle Name or Initial, and Last Name Physical Street Address City. State. Zin Code Mailing Address, if different City, State, Zip Code Phone Number Fax Number Email Address DUNS Number Federal Employer Identification Number Texas Payee ID No.— 11 digits Texas Franchise Tax Number Texas Secretary of State Filing Number Health and Human Services Contract Affirmations v. 1.7 Effective November 2020 Page 10 of 10 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT E Supplemental Conditions THE FOLLOWING SUPPLEMENTAL CONDITIONS APPLY TO THIS CONTRACT AND MODIFY THE HHS UNIFORM TERMS AND CONDITIONS Attachment C, HHS Uniform Terms and Conditions—Grant-Version 2.16.1,of this Contract is revised as follows: 1. Section 3.3, Debt and Deliquesces. This section is deleted in its entirety. 2. Section 9.2, Insurance. This section is modified to add a new Subsection C as follows: C. Notwithstanding the forgoing subsections, if Grantee is a state agency or department, district, authority, county, municipality, or other political subdivision of the state, then nothing in the Contract should be construed to restrict the Grantee's right to self-insure in accordance with state law,or purchase insurance through the Texas Association of Counties or Texas Municipal League. 3. Section 9.5, Subsection A, Indemnity. This subsection is deleted in its entirety and replaced with the following: v. 11.15.2016 Page 1 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 A. TO THE EXTENT PERMITTED BY THE LAWS AND CONSTITUTION OF THE STATE OF TEXAS, IF GRANTEE IS A STATE AGENCY OR DEPARTMENT, DISTRICT, AUTHORITY, COUNTY, MUNICIPALITY, OR OTHER POLITICAL SUBDIVISION OF THE STATE, GRANTEE SHALL DEFEND, INDEMNIFY AND HOLD HARMLESS THE STATE OF TEXAS AND SYSTEM AGENCY, AND/OR THEIR OFFICERS, AGENTS, EMPLOYEES, REPRESENTATIVES, CONTRACTORS, ASSIGNEES, AND/OR DESIGNEES FROM ANY AND ALL LIABILITY, ACTIONS, CLAIMS, DEMANDS, OR SUITS, AND ALL RELATED COSTS, ATTORNEY FEES, AND EXPENSES ARISING OUT OF OR RESULTING FROM ANY ACTS OR OMISSIONS OF GRANTEE OR ITS AGENTS, EMPLOYEES, SUBCONTRACTORS, ORDER FULFILLERS, OR SUPPLIERS OF SUBCONTRACTORS IN THE EXECUTION OR PERFORMANCE OF THE CONTRACT AND ANY PURCHASE ORDERS ISSUED UNDER THE CONTRACT. THE DEFENSE SHALL BE COORDINATED BY GRANTEE WITH THE OFFICE OF THE TEXAS ATTORNEY GENERAL WHEN TEXAS STATE AGENCIES ARE NAMED DEFENDANTS IN ANY LAWSUIT AND GRANTEE MAY NOT AGREE TO ANY SETTLEMENT WITHOUT FIRST OBTAINING THE CONCURRENCE FROM THE OFFICE OF THE TEXAS ATTORNEY GENERAL.GRANTEE AND SYSTEM AGENCY AGREE TO FURNISH TIMELY WRITTEN NOTICE TO EACH OTHER OF ANY SUCH CLAIM. 4. Section 9.9,Dispute Resolution. This section is deleted in its entirety and replaced with the following: 9.9 Dispute Resolution The dispute resolution process provided in Chapter 2009 of the Texas Government Code is available to the parties to resolve any dispute arising under the agreement. SPECIAL CONDITIONS SECTION 1.01 NOTICE OF CONTRACT ACTION Grantee shall notify the assigned contract manager if Grantee has had any contract suspended or terminated for cause by any local, state or federal department or agency or nonprofit entity within five days of becoming aware of the action and include the following: a. Reason for such action; b. Name and contact information of the local, state or federal department or agency or entity; c. Date of the contract; d. Date of suspension or termination; and e. Contract or case reference number. SECTION 1.02 NOTICE OF BANKRUPTCY Grantee shall notify in writing to the assigned contract manager of its plan to seek v. 11.15.2016 Page 2 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 bankruptcy protection within five days of such action by Grantee. SECTION 1.03 NOTICE OF CRIMINAL ACTIVITY AND DISCIPLINARY ACTIONS a. Grantee shall immediately report in writing to the assigned contract manager when Grantee has knowledge or any reason to believe that they or any person with ownership or controlling interest in the organization/business, or their agent, employee, contractor or volunteer that is providing services under this Contract has: 1. Engaged in any activity that could constitute a criminal offense equal to or greater than a Class A misdemeanor or grounds for disciplinary action by a state or federal regulatory authority; or 2. Been placed on community supervision, received deferred adjudication, or been indicted for or convicted of a criminal offense relating to involvement in any financial matter, federal or state program or felony sex crime. b. Grantee shall not permit any person who engaged, or was alleged to have engaged, in any activity subject to reporting under this section to perform direct client services or have direct contact with clients, unless otherwise directed in writing by the System Agency. SECTION 1.04 GRANTEE'S NOTIFICATION OF CHANGE OF CONTACT PERSON OR KEY PERSONNEL The Grantee shall notify in writing the assigned contract manager within ten days of any change to the Grantee's Contact Person or Key Personnel. SECTION 1.05 DISASTER SERVICES In the event of a local, state, or federal emergency, including natural, man- made, criminal, terrorist, and/or bioterrorism events, declared as a state disaster by the Governor, or a federal disaster by the appropriate federal official, Grantee may be called upon to assist the System Agency in providing the following services: a. Health and medical assistance; b. Assessment of health and medical needs; c. Health surveillance; d. Medical care personnel; e. Health and medical equipment and supplies; f. Patient or community evacuation; g. In-hospital care and hospital facility status; h. Food, drug and medical device safety; i. Worker health and safety; j. Mental health and substance abuse; k. Public health information; 1. Vector control and veterinary services; and m. Victim identification and mortuary services. The Grantee has the authority to utilize approximately 5% of staff's time supporting this contract for response efforts. DSHS shall reimburse Grantee up to 5% of this contract funded by Center for Disease Control and Prevention (CDC) for personnel costs responding to an emergency event. Grantee shall maintain records to document the time spent on response efforts for auditing v. 11.15.2016 Page 3 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 purposes. Allowable activities also include participation of drills and exercises in the pre-event time period. Grantee shall notify the assigned contract manager in writing when this provision is implemented. SECTION 1.06 INTERIM EXTENSION AMENDMENT a. Prior to or on the expiration date of this Contract,the Parties agree that this Contract can be extended as provided under this Section. b. The System Agency shall provide written notice of interim extension amendment to the Grantee under one of the following circumstances: 1. Continue provision of services in response to a disaster declared by the governor; or 2. To ensure that services are provided to clients without interruption. c. The System Agency will provide written notice of the interim extension amendment that specifies the reason for it and period of time for the extension. d. Grantee will provide and invoice for services in the same manner that is stated in the Contract. e. An interim extension under Section (b)(1) above shall extend the term of the contract not longer than 30 days after governor's disaster declaration is declared unless the Parties agree to a shorter period of time. f. An interim extension under Section (b)(2) above shall be a one-time extension for a period of time determined by the System Agency. v. 11.15.2016 Page 4 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT F OMB Number:4040-0007 Expiration Date:01/31/2019 ASSURANCES - NON-CONSTRUCTION PROGRAMS Public reporting burden for this collection of information is estimated to average 15 minutes per response, including time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding the burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to the Office of Management and Budget, Paperwork Reduction Project(0348-0040),Washington, DC 20503. PLEASE DO NOT RETURN YOUR COMPLETED FORM TO THE OFFICE OF MANAGEMENT AND BUDGET. SEND IT TO THE ADDRESS PROVIDED BY THE SPONSORING AGENCY. NOTE: Certain of these assurances may not be applicable to your project or program. If you have questions, please contact the awarding agency. Further, certain Federal awarding agencies may require applicants to certify to additional assurances. If such is the case, you will be notified. As the duly authorized representative of the applicant, I certify that the applicant: 1. Has the legal authority to apply for Federal assistance Act of 1973, as amended (29 U.S.C. §794), which and the institutional, managerial and financial capability prohibits discrimination on the basis of handicaps; (d) (including funds sufficient to pay the non-Federal share the Age Discrimination Act of 1975, as amended (42 U. of project cost)to ensure proper planning, management S.C. §§6101-6107),which prohibits discrimination on and completion of the project described in this the basis of age; (e)the Drug Abuse Office and application. Treatment Act of 1972 (P.L. 92-255), as amended, relating to nondiscrimination on the basis of drug 2. Will give the awarding agency, the Comptroller General abuse; (f)the Comprehensive Alcohol Abuse and of the United States and, if appropriate,the State, Alcoholism Prevention,Treatment and Rehabilitation through any authorized representative, access to and Act of 1970 (P.L. 91-616), as amended, relating to the right to examine all records, books, papers, or nondiscrimination on the basis of alcohol abuse or documents related to the award; and will establish a alcoholism; (g)§§523 and 527 of the Public Health proper accounting system in accordance with generally Service Act of 1912 (42 U.S.C. §§290 dd-3 and 290 accepted accounting standards or agency directives. ee-3), as amended, relating to confidentiality of alcohol and drug abuse patient records; (h)Title VIII of the Civil 3. Will establish safeguards to prohibit employees from Rights Act of 1968 (42 U.S.C. §§3601 et seq.), as using their positions for a purpose that constitutes or amended, relating to nondiscrimination in the sale, presents the appearance of personal or organizational rental or financing of housing; (i)any other conflict of interest, or personal gain. nondiscrimination provisions in the specific statute(s) under which application for Federal assistance is being 4. Will initiate and complete the work within the applicable made; and, (j)the requirements of any other time frame after receipt of approval of the awarding nondiscrimination statute(s)which may apply to the agency. application. 5. Will comply with the Intergovernmental Personnel Act of 7 Will comply, or has already complied,with the 1970 (42 U.S.C. §§4728-4763)relating to prescribed requirements of Titles II and III of the Uniform standards for merit systems for programs funded under Relocation Assistance and Real Property Acquisition Policies Act of 1970 (P.L. 91-646)which provide for one of the 19 statutes or regulations specified in fair and equitable treatment of persons displaced or Appendix A of OPM's Standards for a Merit System of whose property is acquired as a result of Federal or Personnel Administration (5 C.F.R. 900, Subpart F). federally-assisted programs. These requirements apply to all interests in real property acquired for 6. Will comply with all Federal statutes relating to project purposes regardless of Federal participation in nondiscrimination. These include but are not limited to: purchases. (a)Title VI of the Civil Rights Act of 1964 (P.L. 88-352) which prohibits discrimination on the basis of race, color 8. Will comply, as applicable,with provisions of the or national origin; (b)Title IX of the Education Hatch Act(5 U.S.C. §§1501-1508 and 7324-7328) Amendments of 1972, as amended (20 U.S.C.§§1681- which limit the political activities of employees whose 1683, and 1685-1686), which prohibits discrimination on principal employment activities are funded in whole the basis of sex; (c)Section 504 of the Rehabilitation or in part with Federal funds. Previous Edition Usable Standard Form 424E(Rev.7-97) Authorized for Local Reproduction Prescribed by OMB Circular A-102 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 9. Will comply, as applicable,with the provisions of the Davis- 13. Will assist the awarding agency in assuring compliance Bacon Act(40 U.S.C.§§276a to 276a-7),the Copeland Act with Section 106 of the National Historic Preservation (40 U.S.C. §276c and 18 U.S.C. §874), and the Contract Act of 1966, as amended (16 U.S.C. §470), EO 11593 Work Hours and Safety Standards Act(40 U.S.C.§§327- (identification and protection of historic properties),and 333), regarding labor standards for federally-assisted the Archaeological and Historic Preservation Act of construction subagreements. 1974 (16 U.S.C. §§469a-1 et seq.). 10. Will comply, if applicable,with flood insurance purchase 14. Will comply with P.L.93-348 regarding the protection of requirements of Section 102(a)of the Flood Disaster human subjects involved in research, development, and Protection Act of 1973(P.L. 93-234)which requires related activities supported by this award of assistance. recipients in a special flood hazard area to participate in the program and to purchase flood insurance if the total cost of 15• Will comply with the Laboratory Animal Welfare Act of insurable construction and acquisition is$10,000 or more. 1966(P.L.89-544, as amended, 7 U.S.C. §§2131 et seq.)pertaining to the care, handling, and treatment of 11. Will comply with environmental standards which may be warm blooded animals held for research,teaching, or prescribed pursuant to the following: (a)institution of other activities supported by this award of assistance. environmental quality control measures under the National Environmental Policy Act of 1969(P.L.91-190)and 16. Will comply with the Lead-Based Paint Poisoning Executive Order(EO) 11514; (b)notification of violating Prevention Act(42 U.S.C.§§4801 et seq.)which facilities pursuant to EO 11738; (c)protection of wetlands prohibits the use of lead-based paint in construction or pursuant to EO 11990; (d)evaluation of flood hazards in rehabilitation of residence structures. floodplains in accordance with EO 11988; (e)assurance of 17. Will cause to be performed the required financial and project consistency with the approved State management compliance audits in accordance with the Single Audit program developed under the Coastal Zone Management Act Amendments of 1996 and OMB Circular No.A-133, Act of 1972(16 U.S.C. §§1451 et seq.); (f)conformity of "Audits of States, Local Governments, and Non-Profit Federal actions to State(Clean Air) Implementation Plans Organizations." under Section 176(c)of the Clean Air Act of 1955, as amended (42 U.S.C.§§7401 et seq.); (g)protection of 18. Will comply with all applicable requirements of all other underground sources of drinking water under the Safe Federal laws,executive orders, regulations, and policies Drinking Water Act of 1974, as amended (P.L.93-523); governing this program. and, (h) protection of endangered species under the Endangered Species Act of 1973,as amended (P.L.93- 19. Will comply with the requirements of Section 106(g)of 205). the Trafficking Victims Protection Act(TVPA)of 2000, as amended (22 U.S.C.7104)which prohibits grant award 12. Will comply with the Wild and Scenic Rivers Act of recipients or a sub-recipient from(1) Engaging in severe 1968 (16 U.S.C.§§1271 et seq.)related to protecting forms of trafficking in persons during the period of time components or potential components of the national that the award is in effect(2) Procuring a commercial wild and scenic rivers system. sex act during the period of time that the award is in effect or(3)Using forced labor in the performance of the award or subawards under the award. SIGNATURE OF AUTHORIZED CERTIFYING OFFICIAL TITLE Director of Health Services APPLICANT ORGANIZATION DATE SUBMITTED City of Port Arthur Standard Form 424B(Rev.7-97)Back DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 CERTIFICATION REGARDING LOBBYING Certification for Contracts,Grants, Loans,and Cooperative Agreements The undersigned certifies,to the best of his or her knowledge and belief,that: (1)No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned,to any person for influencing or attempting to influence an officer or employee of an agency,a Member of Congress,an officer or employee of Congress,or an employee of a Member of Congress in connection with the awarding of any Federal contract,the making of any Federal grant,the making of any Federal loan,the entering into of any cooperative agreement,and the extension,continuation,renewal,amendment,or modification of any Federal contract,grant, loan,or cooperative agreement. (2)If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency,a Member of Congress,an officer or employee of Congress,or an employee of a Member of Congress in connection with this Federal contract,grant, loan,or cooperative agreement,the undersigned shall complete and submit Standard Form-LLL,"Disclosure of Lobbying Activities,"in accordance with its instructions. (3)The undersigned shall require that the language of this certification be included in the award documents for all subawards at all tiers(including subcontracts,subgrants,and contracts under grants, loans, and cooperative agreements)and that all subrecipients shall certify and disclose accordingly.This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into.Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352,title 31, U.S.Code.Any person who fails to file the required certification shall be subject to a civil penalty of not less than$10,000 and not more than$100,000 for each such failure. Statement for Loan Guarantees and Loan Insurance The undersigned states,to the best of his or her knowledge and belief,that: If any funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency,a Member of Congress,an officer or employee of Congress,or an employee of a Member of Congress in connection with this commitment providing for the United States to insure or guarantee a loan,the undersigned shall complete and submit Standard Form-LLL,"Disclosure of Lobbying Activities,"in accordance with its instructions.Submission of this statement is a prerequisite for making or entering into this transaction imposed by section 1352,title 31, U.S.Code.Any person who fails to file the required statement shall be subject to a civil penalty of not less than$10,000 and not more than$100,000 for each such failure. *APPLICANT'S ORGANIZATION City of Port Arthur *PRINTED NAME AND TITLE OF AUTHORIZED REPRESENTATIVE Prefix: *First Name: .Judl tll Middle Name: *Last Name: Sml th Suffix: *Title: Di rector of Health Servi ces *SIGNATURE: *DATE: DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Attachment G Fiscal Federal Funding Accountability and Transparency Act (FFATA) CERTIFICATION The certifications enumerated below represent material facts upon which DSHS relies when reporting information to the federal government required under federal law. If the Department later determines that the Contractor knowingly rendered an erroneous certification, DSHS may pursue all available remedies in accordance with Texas and U.S. law. Signor further agrees that it will provide immediate written notice to DSHS if at any time Signor learns that any of the certifications provided for below were erroneous when submitted or have since become erroneous by reason of changed circumstances. if the Signor cannot certify all of the statements contained in this section, Signor must provide written notice to DSHS detailing which of the below statements it cannot certify and why. Legal Name of Contractor: FFATA Contact#1 Name, Email and Phone Number: Primary Address of Contractor: FFATA Contact#2 Name, Email and Phone Number: ZIP Code: 9-digits Required www.usps.com DUNS Number: 9-digits Required www.sam.gov State of Texas Comptroller Vendor Identification Number (VIN) 14 Digits Printed Name of Authorized Representative Signature of Authorized Representative Judith Smith Title of Authorized Representative Date Director of Health Services - 1 - Department of State Health Services Form 4734—June 2013 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Attachment G Fiscal Federal Funding Accountability and Transparency Act (FFATA) CERTIFICATION As the duly authorized representative (Signor) of the Contractor, I hereby certify that the statements made by me in this certification form are true, complete and correct to the best of my knowledge. Did your organization have a gross income, from all sources, of less than $300,000 in your previous tax year? Yes No If your answer is "Yes", skip questions "A", "B", and "C" and finish the certification. If your answer is "No", answer questions "A" and "B". A. Certification Regarding % of Annual Gross from Federal Awards. Did your organization receive 80% or more of its annual gross revenue from federal awards during the preceding fiscal year? Yes No B. Certification Regarding Amount of Annual Gross from Federal Awards. Did your organization receive $25 million or more in annual gross revenues from federal awards in the preceding fiscal year? Yes No If your answer is "Yes" to both question "A" and "B", you must answer question "C". If your answer is "No" to either question "A" or "B", skip question "C" and finish the certification. C. Certification Regarding Public Access to Compensation Information. Does the public have access to information about the compensation of the senior executives in your business or organization (including parent organization, all branches, and all affiliates worldwide) through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986? Yes No If your answer is "Yes" to this question, where can this information be accessed? If your answer is "No" to this question, you must provide the names and total compensation of the top five highly compensated officers below. For example: John Blum:500000;Mary Redd:50000;Eric Gant:400000;Todd Platt:300000; Sally Tom:300000 Provide compensation information here: - 2 - Department of State Health Services Form 4734—June 2013 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT H DATA USE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES SYSTEM AND CONTRACTOR This Data Use Agreement("DUA") is effective as of the date of the Base Contract into which it is incorporated("Effective Date"),by and between the Texas Health and Human Services System,which includes the Texas Health and Human Services Commission and the Department of State Health Services ("HHS")and Contractor(the "Base Contract"). ARTICLE 1. PURPOSE;APPLICABILITY;ORDER OF PRECEDENCE The purpose of this DUA is to facilitate access to, creation, receipt, maintenance, use, disclosure or transmission of Confidential Information with Contractor, and describe Contractor's rights and obligations with respect to the Confidential Information and the limited purposes for which the Contractor may create, receive, maintain, use, disclose or have access to Confidential Information. This DUA also describes HHS's remedies in the event of Contractor's noncompliance with its obligations under this DUA. This DUA applies to both HHS business associates, as "business associate" is defined in the Health Insurance Portability and Accountability Act (HIPAA), and contractors who are not business associates, who create, receive, maintain, use, disclose or have access to Confidential Information on behalf of HHS, its programs or clients as described in the Base Contract. As a best practice,HHS requires its contractors to comply with the terms of this DUA to safeguard all types of Confidential Information. As of the Effective Date of this DUA, if any provision of the Base Contract conflicts with this DUA,this DUA controls. ARTICLE 2. DEFINITIONS For the purposes of this DUA, capitalized,underlined terms have the following meanings: "Authorized Purpose"means the specific purpose or purposes described in the Base Contract for Contractor to full its obligations under the Base Contract, or any other purpose expressly authorized by HHS in writing in advance. "Authorized User"means a person: (1) Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze Confidential Information pursuant to this DUA; (2) For whom Contractor warrants and represents has a demonstrable need to create,receive, maintain,use, disclose or have access to the Confidential Information;and (3) Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA. "Breach" means an impermissible use or disclosure of electronic or non-electronic sensitive personal information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identity theft, or medical identity theft. Any acquisition, access, use, disclosure or loss of Confidential Information other than as permitted by this HHS Data Use Agreement v.8.5 October 23,2019 1 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 DUA shall be presumed to be a Breach unless Contractor demonstrates,based on a risk assessment,that there is a low probability that the Confidential Information has been compromised. "Confidential Information"means any communication or record(whether oral,written,electronically stored or transmitted,or in any other form)provided to or made available to Contractor or that Contractor may create,receive,maintain,use,disclose or have access to on behalf of HHS that consists of or includes any or all of the following: (1) Education records as defined in the Family Educational Rights and Privacy Act,20 U.S.C. §1232g; 34 C.F.R. Part 99 (2) Federal Tax Information as defined in Internal Revenue Code§6103 and Internal Revenue Service Publication 1075; (3) Personal Identifying Information(PII) as defined in Texas Business and Commerce Code, Chapter 521; (4) Protected Health Information (PHI) in any form including without limitation, Electronic Protected Health Information or Unsecured Protected Health Information as defined in 45 C.F.R. §160.103; (5) Sensitive Personal Information (SPI) as defined in Texas Business and Commerce Code, Chapter 521; (6) Social Security Administration Data, including, without limitation, Medicaid information means disclosures of information made by the Social Security Administration or the Centers for Medicare and Medicaid Services from a federal system of records for administration of federally funded benefit programs under the Social Security Act, 42 U.S.C., Chapter 7; (7) All privileged work product; (8) All information designated as confidential under the constitution and laws of the State of Texas and of the United States, including the Texas Health& Safety Code and the Texas Public Information Act,Texas Government Code, Chapter 552. "Destroy","Destruction",for Confidential Information,means: (1) Paper, film, or other hard copy media have been shredded or destroyed such that the Confidential Information cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction. (2) Electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88, "Guidelines for Media Sanitization," such that the Confidential Information cannot be retrieved. "Discover, Discovery" means the first day on which a Breach becomes known to Contractor, or, by exercising reasonable diligence would have been known to Contractor. "Legally Authorized Representative" of an individual, including as provided in 45 CFR 435.923 (authorized representative);45 CFR 164.502(g)(1)(personal representative);Tex.Occ.Code§ 151.002(6); Tex.H.&S.Code§166.164(medical power of attorney);and Texas Estates Code§22.031 (representative). "Required by Law" means a mandate contained in law that compels an entity to use or disclose Confidential Information that is enforceable in a court of law, including court orders, warrants, subpoenas or investigative demands. HHS Data Use Agreement v.8.5 October 23,2019 2 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 "Subcontractor"means a person who contracts with a prime contractor to work, to supply commodities, or to contribute toward completing work for a governmental entity. "Workforce"means employees,volunteers,trainees or other persons whose performance of work is under the direct control of a party,whether or not they are paid by that party. ARTICLE 3. CONTRACTOR'S DUTIES REGARDING CONFIDENTIAL INFORMATION Section 3.01 Obligations of Contractor Contractor agrees that: (A) With respect to PHI, Contractor shall: (1) Make PHI available in a designated record set if requested by HHS,if Contractor maintains PHI in a designated record set,as defined in HIPAA. (2) Provide to HHS data aggregation services related to the healthcare operations Contractor performs for HHS pursuant to the Base Contract, if requested by HHS, if Contractor provides data aggregation services as defined in HIPAA. (3) Provide access to PHI to an individual who is requesting his or her own PHI, or such individual's Legally Authorized Representative, in compliance with the requirements of HIPAA. (4) Make PHI available to HHS for amendment, and incorporate any amendments to PHI that HHS directs, in compliance with HIPAA. (5) Document and make available to HHS, an accounting of disclosures in compliance with the requirements of HIPAA. (6) If Contractor receives a request for access, amendment or accounting of PHI by any individual, promptly forward the request to HHS or, if forwarding the request would violate HIPAA, promptly notify HHS of the request and of Contractor's response. HHS will respond to all such requests, unless Contractor is Required by Law to respond or HHS has given prior written consent for Contractor to respond to and account for all such requests. (B) With respect to ALL Confidential Information,Contractor shall: (1) Exercise reasonable care and no less than the same degree of care Contractor uses to protect its own confidential, proprietary and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized Purpose or as Required by Law. Contractor will access, create, maintain, receive, use, disclose, transmit or Destroy Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses. (2) Establish, implement and maintain appropriate procedural, administrative, physical and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the Confidential Information, in accordance with applicable laws or regulations relating to Confidential Information, to prevent any unauthorized use or disclosure of Confidential Information as long as Contractor has such Confidential Information in its actual or constructive possession. (3) Implement,update as necessary,and document privacy,security and Breach notice policies and procedures and an incident response plan to address a Breach,to comply with the privacy,security and breach notice requirements of this DUA prior to conducting work under the Base Contract. Contractor HHS Data Use Agreement v.8.5 October 23,2019 3 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 shall produce, within three business days of a request by HHS, copies of its policies and procedures and records relating to the use or disclosure of Confidential Information. (4) Obtain HHS's prior written consent to disclose or allow access to any portion of the Confidential Information to any person, other than Authorized Users, Workforce or Subcontractors of Contractor who have completed training in confidentiality,privacy,security and the importance of promptly reporting any Breach to Contractor's management and as permitted in Section 3.01(A)(3),above.Contractor shall produce evidence of completed training to HHS upon request. HHS, at its election, may assist Contractor in training and education on specific or unique HHS processes, systems and/or requirements. All of Contractor's Authorized Users,Workforce and Subcontractors with access to a state computer system or database will complete a cybersecurity training program certified under Texas Government Code Section 2054.519 by the Texas Department of Information Resources. (5) Establish, implement and maintain appropriate sanctions against any member of its Workforce or Subcontractor who fails to comply with this DUA, the Base Contract or applicable law. Contractor shall maintain evidence of sanctions and produce it to HHS upon request. (6) Obtain prior written approval of HHS, to disclose or provide access to any Confidential Information on the basis that such act is Required by Law, so that HHS may have the opportunity to object to the disclosure or access and seek appropriate relief. If HHS objects to such disclosure or access, Contractor shall refrain from disclosing or providing access to the Confidential Information until HHS has exhausted all alternatives for relief (7) Certify that its Authorized Users each have a demonstrated need to know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose and that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in this DUA. Contractor and its Subcontractors shall maintain at all times an updated, complete, accurate list of Authorized Users and supply it to HHS upon request. (8) Provide, and shall cause its Subcontractors and agents to provide,to HHS periodic written confirmation of compliance with controls and the terms and conditions of this DUA. (9) Return to HHS or Destroy,at HHS's election and at Contractor's expense, all Confidential Information received from HHS or created or maintained by Contractor or any of Contractor's agents or Subcontractors on HHS's behalf upon the termination or expiration of this DUA, if reasonably feasible and permitted by law. Contractor shall certify in writing to HHS that all such Confidential Information has been Destroyed or returned to HHS, and that Contractor and its agents and Subcontractors have retained no copies thereof Notwithstanding the foregoing,Contractor acknowledges and agrees that it may not Destroy any Confidential Information if federal or state law, or HHS record retention policy or a litigation hold notice prohibits such Destruction. If such return or Destruction is not reasonably feasible, or is impermissible by law, Contractor shall immediately notify HHS of the reasons such return or Destruction is not feasible and agree to extend the protections of this DUA to the Confidential Information for as long as Contractor maintains such Confidential Information. (10) Complete and return with the Base Contract to HHS,attached as Attachment 2 to this DUA, the HHS Security and Privacy Initial Inquiry (SPI) at https://hhs.texas.gov/laws- regulations/forms/miscellaneous/hhs-information-security-privacy-initial-inquiry-spi. The SPI identifies basic privacy and security controls with which Contractor must comply to protect Confidential Information. Contractor shall comply with periodic security controls compliance assessment and monitoring by HHS as required by state and federal law,based on the type of Confidential Information Contractor creates,receives, maintains, uses, discloses or has access to and the Authorized Purpose and level of risk. Contractor's HHS Data Use Agreement v.8.5 October 23,2019 4 of 11 DocuSign Envelope ID:0G43C469-0A3F-4342-8E8D-BB21884C3931 security controls shall be based on the National Institute of Standards and Technology (NIST) Special Publication 800-53. Contractor shall update its security controls assessment whenever there are significant changes in security controls for HHS Confidential Information and shall provide the updated document to HHS. HHS also reserves the right to request updates as needed to satisfy state and federal monitoring requirements. (11) Comply with the HHS Acceptable Use Policy (AUP) and require each Subcontractor and Workforce member who has direct access to HHS Information Resources,as defined in the AUP,to execute an HHS Acceptable Use Agreement. (12) Only conduct secure transmissions of Confidential Information whether in paper, oral or electronic form. A secure transmission of electronic Confidential Information in motion includes secure File Transfer Protocol (SFTP) or encryption at an appropriate level as required by rule, regulation or law. Confidential Information at rest requires encryption unless there is adequate administrative,technical,and physical security as required by rule,regulation or law. All electronic data transfer and communications of Confidential Information shall be through secure systems. Contractor shall provide proof of system,media or device security and/or encryption to HHS no later than 48 hours after HHS's written request in response to a compliance investigation, audit, or the Discovery of a Breach. HHS may also request production of proof of security at other times as necessary to satisfy state and federal monitoring requirements. Deidentification of Confidential Information in accordance with HIPAA de-identification standards is deemed secure. (13) Designate and identify a person or persons, as Privacy Official and Information Security Official, each of whom is authorized to act on behalf of Contractor and is responsible for the development and implementation of the privacy and security requirements in this DUA. Contractor shall provide name and current address,phone number and e-mail address for such designated officials to HHS upon execution of this DUA and prior to any change. Upon written notice from HHS, Contractor shall promptly remove and replace such official(s)if such official(s) is not performing the required functions. (14) Make available to HHS any information HHS requires to fulfill HHS's obligations to provide access to,or copies of,Confidential Information in accordance with applicable laws,regulations or demands of a regulatory authority relating to Confidential Information. Contractor shall provide such information in a time and manner reasonably agreed upon or as designated by the applicable law or regulatory authority. (15) Comply with the following laws and standards if applicable to the type of Confidential Information and Contractor's Authorized Purpose: • Title 1,Part 10,Chapter 202, Subchapter B,Texas Administrative Code; • The Privacy Act of 1974; • OMB Memorandum 17-12; • The Federal Information Security Management Act of 2002 (FISMA); • The Health Insurance Portability and Accountability Act of 1996(HIPAA); • Internal Revenue Publication 1075 —Tax Information Security Guidelines for Federal, State and Local Agencies; • National Institute of Standards and Technology(NIST) Special Publication 800-66 Revision 1 — An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act(HIPAA) Security Rule; HHS Data Use Agreement v.8.5 October 23,2019 5 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 • NIST Special Publications 800-53 and 800-53A—Recommended Security Controls for Federal Information Systems and Organizations, as currently revised; • NIST Special Publication 800-47 — Security Guide for Interconnecting Information Technology Systems; • NIST Special Publication 800-88,Guidelines for Media Sanitization; • NIST Special Publication 800-111,Guide to Storage of Encryption Technologies for End User Devices containing PHI; • Family Educational Rights and Privacy Act • Texas Business and Commerce Code, Chapter 521; • Any other State or Federal law,regulation, or administrative rule relating to the specific HHS program area that Contractor supports on behalf of HHS. (16) Be permitted to use or disclose Confidential Information for the proper management and administration of Contractor or to carry out Contractor's legal responsibilities,except as otherwise limited by this DUA,the Base Contract, or law applicable to the Confidential Information, if: (a) Disclosure is Required by Law; (b) Contractor obtains reasonable assurances from the person to whom the information is disclosed that the person shall: 1. Maintain the confidentiality of the Confidential Information in accordance with this DUA; 2. Use or further disclose the information only as Required by Law or for the Authorized Purpose for which it was disclosed to the person; and 3. Notify Contractor in accordance with Section 4.01 of a Breach of Confidential Information that the person Discovers or should have Discovered with the exercise of reasonable diligence. (C) With respect to ALL Confidential Information,Contractor shall NOT: (1) Attempt to re-identify or further identify Confidential Information that has been deidentified,or attempt to contact any persons whose records are contained in the Confidential Information, except for an Authorized Purpose,without express written authorization from HHS. (2) Engage in prohibited marketing or sale of Confidential Information. (3) Permit, or enter into any agreement with a Subcontractor to,create,receive,maintain,use, disclose, have access to or transmit Confidential Information, on behalf of HHS without requiring that Subcontractor first execute either the Form Subcontractor Agreement, Attachment 1, or Contractor's own Subcontractor agreement that ensures that the Subcontractor shall comply with the same safeguards and restrictions contained in this DUA for Confidential Information. Contractor is directly responsible for its Subcontractors' compliance with, and enforcement of,this DUA. HHS Data Use Agreement v.8.5 October 23,2019 6 of 11 DocuSign Envelope ID:0C43C469-OA3F-4342-8E8D-BB21884C3931 ARTICLE 4. BREACH NOTICE,REPORTING AND CORRECTION REQUIREMENTS Section 4.01. Cooperation and Financial Responsibility. (A) Contractor shall, at Contractor's expense, cooperate fully with HHS in investigating, mitigating to the extent practicable, and issuing notifications as directed by HHS, for any Breach of Confidential Information. (B) Contractor shall make Confidential Information in Contractor's possession available pursuant to the requirements of HIPAA or other applicable law upon a determination of a Breach. (C) Contractor's obligation begins at the Discovery of a Breach and continues as long as related activity continues,until all effects of the Breach are mitigated to HHS's satisfaction(the"incident response period"). Section 4.02. Initial Breach Notice. For federal information obtained from a federal system of records,including Federal Tax Information and Social Security Administration Data (which includes Medicaid and other governmental benefit program Confidential Information), Contractor shall notify HHS of the Breach within the first consecutive clock hour of Discovery. The Base Contract shall specify whether Confidential Information is obtained from a federal system of records. For all other types of Confidential Information Contractor shall notify HHS of the Breach not more than 24 hours after Discovery, or in a timeframe otherwise approved by HHS in writing. Contractor shall initially report to HHS's Privacy and Security Officers via email at: privacy@HHSC.state.tx.us and to the HHS division responsible for the Base Contract. Contractor shall report all information reasonably available to Contractor about the Breach. Contractor shall provide contact information to HHS for Contractor's single point of contact who will communicate with HHS both on and off business hours during the incident response period. Section 4.03 Third Business Day Notice: No later than 5 p.m. on the third business day after Discovery, or a time within which Discovery reasonably should have been made by Contractor of a Breach of Confidential Information, Contractor shall provide written notification to HHS of all reasonably available information about the Breach,and Contractor's investigation,including,to the extent known to Contractor: a. The date the Breach occurred; b. The date of Contractor's and, if applicable, Subcontractor's Discovery; c. A brief description of the Breach, including how it occurred and who is responsible (or hypotheses, if not yet determined); d. A brief description of Contractor's investigation and the status of the investigation; e. A description of the types and amount of Confidential Information involved; f. Identification of and number of all individuals reasonably believed to be affected, including first and last name of the individual and if applicable,the Legally authorized representative,last known address, age,telephone number, and email address if it is a preferred contact method; g. Contractor's initial risk assessment of the Breach demonstrating whether individual or other notices are required by applicable law or this DUA for HHS approval, including an analysis of whether there is a low probability of compromise of the Confidential Information or whether any legal exceptions to notification apply; h. Contractor's recommendation for HHS's approval as to the steps individuals and/or Contractor on behalf of individuals, should take to protect the individuals from potential harm, including HHS Data Use Agreement v.8.5 October 23,2019 7 of 11 DocuSign Envelope ID:0C43C469-OA3F-4342-8E8D-BB21884C3931 Contractor's provision of notifications, credit protection, claims monitoring, and any specific protections for a Legally Authorized Representative to take on behalf of an individual with special capacity or circumstances; i. The steps Contractor has taken to mitigate the harm or potential harm caused(including without limitation the provision of sufficient resources to mitigate); j. The steps Contractor has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Breach; k. Identify, describe or estimate of the persons,Workforce, Subcontractor, or individuals and any law enforcement that may be involved in the Breach; 1. A reasonable schedule for Contractor to provide regular updates regarding response to the Breach, but no less than every three (3) business days, or as otherwise directed by HHS in writing,including information about risk estimations,reporting,notification,if any,mitigation, corrective action, root cause analysis and when such activities are expected to be completed; and m. Any reasonably available,pertinent information, documents or reports related to a Breach that HHS requests following Discovery. Section 4.04. Investigation,Response and Mitigation. (A) Contractor shall immediately conduct a full and complete investigation, respond to the Breach,commit necessary and appropriate staff and resources to expeditiously respond,and report as required to HHS for incident response purposes and for purposes of HHS's compliance with report and notification requirements,to the satisfaction of HHS. (B) Contractor shall complete or participate in a risk assessment as directed by HHS following a Breach, and provide the final assessment, corrective actions and mitigations to HHS for review and approval. (C) Contractor shall fully cooperate with HHS to respond to inquiries and/or proceedings by state and federal authorities,persons and/or individuals about the Breach. (D) Contractor shall fully cooperate with HHS's efforts to seek appropriate injunctive relief or otherwise prevent or curtail such Breach, or to recover or protect any Confidential Information, including complying with reasonable corrective action or measures, as specified by HHS in a Corrective Action Plan if directed by HHS under the Base Contract. Section 4.05. Breach Notification to Individuals and Reporting to Authorities. (A) HHS may direct Contractor to provide Breach notification to individuals, regulators or third-parties, as specified by HHS following a Breach. (B) Contractor must comply with all applicable legal and regulatory requirements in the time, manner and content of any notification to individuals, regulators or third-parties, or any notice required by other state or federal authorities,including without limitation,notifications required by Texas Business and Commerce Code, Chapter 521.053(b) and HIPAA. Notice letters will be in Contractor's name and on Contractor's letterhead, unless otherwise directed by HHS, and will contain contact information, including the name and title of Contractor's representative, an email address and a toll-free telephone number, for the individual to obtain additional information. (C) Contractor shall provide HHS with draft notifications for HHS approval prior to distribution and copies of distributed and approved communications. HHS Data Use Agreement v.8.5 October 23,2019 8 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 (D) Contractor shall have the burden of demonstrating to the satisfaction of HHS that any required notification was timely made. If there are delays outside of Contractor's control, Contractor shall provide written documentation to HHS of the reasons for the delay. (E) If HHS directs Contractor to provide notifications, HHS shall, in the time and manner reasonably requested by Contractor,cooperate and assist with Contractor's information requests in order to make such notifications. ARTICLE 5. GENERAL PROVISIONS Section 5.01 Ownership of Confidential Information Contractor acknowledges and agrees that the Confidential Information is and shall remain the property of HHS. Contractor agrees it acquires no title or rights to the Confidential Information. Section 5.02 HHS Commitment and Obligations HHS will not request Contractor to create,maintain,transmit,use or disclose PHI in any manner that would not be permissible under applicable law if done by HHS. Section 5.03 HHS Right to Inspection At any time upon reasonable notice to Contractor, or if HHS determines that Contractor has violated this DUA, HHS, directly or through its agent, will have the right to inspect the facilities, systems, books and records of Contractor to monitor compliance with this DUA. For purposes of this subsection, HHS's agent(s) include, without limitation, the HHS Office of the Inspector General, the Office of the Attorney General of Texas,the State Auditor's Office, outside consultants, legal counsel or other designee. Section 5.04 Term; Termination of DUA; Survival This DUA will be effective on the date on which Contractor executes the Base Contract and will terminate upon termination of the Base Contract and as set forth herein. If the Base Contract is extended,this DUA is extended to run concurrent with the Base Contract. (A) If HHS determines that Contractor has violated a material term of this DUA; HHS may in its sole discretion: (1) Exercise any of its rights including but not limited to reports, access and inspection under this DUA and/or the Base Contract; or (2) Require Contractor to submit to a corrective action plan, including a plan for monitoring and plan for reporting as HHS may determine necessary to maintain compliance with this DUA;or (3) Provide Contractor with a reasonable period to cure the violation as determined by HHS; or (4) Terminate the DUA and Base Contract immediately and seek relief in a court of competent jurisdiction in Travis County,Texas. Before exercising any of these options, HHS will provide written notice to Contractor describing the violation and the action it intends to take. (B) If neither termination nor cure is feasible,HHS shall report the violation to the applicable regulatory authorities. HHS Data Use Agreement v.8.5 October 23,2019 9 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 (C) The duties of Contractor or its Subcontractor under this DUA survive the expiration or termination of this DUA until all the Confidential Information is Destroyed or returned to HHS,as required by this DUA. Section 5.05 Injunctive Relief (A) Contractor acknowledges and agrees that HHS may suffer irreparable injury if Contractor or its Subcontractor fails to comply with any of the terms of this DUA with respect to the Confidential Information or a provision of HIPAA or other laws or regulations applicable to Confidential Information. (B) Contractor further agrees that monetary damages may be inadequate to compensate HHS for Contractor's or its Subcontractor's failure to comply. Accordingly, Contractor agrees that HHS will, in addition to any other remedies available to it at law or in equity,be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages, to enforce the terms of this DUA. Section 5.06 Indemnification Contractor shall indemnify,defend and hold harmless HHS and its respective Executive Commissioner, employees, Subcontractors, agents (including other state agencies acting on behalf of HHS) or other members of HHS' Workforce(each of the foregoing hereinafter referred to as"Indemnified Party")against all actual and direct losses suffered by the Indemnified Party and all liability to third parties arising from or in connection with any breach of this DUA or from any acts or omissions related to this DUA by Contractor or its employees,directors,officers, Subcontractors,or agents or other members of Contractor's Workforce. The duty to indemnify, defend and hold harmless is independent of the duty to insure. Upon demand, Contractor shall reimburse HHS for any and all losses, liabilities, lost profits, fines, penalties, costs or expenses (including costs of required notices, investigation, and mitigation of a Breach,fines or penalties imposed on an Indemnified Party by a regulatory authority, and reasonable attorneys' fees)which may be imposed upon any Indemnified Party to the extent caused by and which results from the Contractor's failure to meet any of its obligations under this DUA. Contractor's obligation to defend, indemnify and hold harmless any Indemnified Party will survive the expiration or termination of this DUA. Section 5.07 Insurance (A) In addition to any insurance required in the Base Contract, at HHS's option, HHS may require Contractor to maintain, at its expense,the special and/or custom first-and third-party insurance coverages,including without limitation data breach,cyber liability,crime theft and notification expense coverages,with policy limits sufficient to cover any liability arising under this DUA,naming the State of Texas, acting through HHS, as an additional named insured and loss payee, with primary and noncontributory status. (B) Contractor shall provide HHS with written proof that required insurance coverage is in effect,at the request of HHS. Section 5.08 Entirety of the Contract This DUA is incorporated by reference into the Base Contract and, together with the Base Contract, constitutes the entire agreement between the parties. No change,waiver,or discharge of obligations arising under those documents will be valid unless in writing and executed by the party against whom such change, waiver, or discharge is sought to be enforced. HHS Data Use Agreement v.8.5 October 23,2019 10 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Section 5.09 Automatic Amendment and Interpretation Upon the effective date of any amendment or issuance of additional regulations to any law applicable to Confidential Information,this DUA will automatically be amended so that the obligations imposed on HHS and/or Contractor remain in compliance with such requirements. Any ambiguity in this DUA will be resolved in favor of a meaning that permits HHS and Contractor to comply with laws applicable to Confidential Information. Section 5.10 Notices; Requests for Approval All notices and requests for approval related to this DUA must be directed to the HHS Chief Privacy Officer at privacy@hhsc.state.tx.us. HHS Data Use Agreement v.8.5 October 23,2019 11 of 11 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 ATTACHMENT 1. SUBCONTRACTOR AGREEMENT FORM HHS CONTRACT NUMBER The DUA between HHS and Contractor establishes the permitted and required uses and disclosures of Confidential Information by Contractor. Contractor has subcontracted with (Subcontractor) for performance of duties on behalf of CONTRACTOR which are subject to the DUA. Subcontractor acknowledges,understands and agrees to be bound by the same terms and conditions applicable to Contractor under the DUA,incorporated by reference in this Agreement,with respect to HHS Confidential Information. Contractor and Subcontractor agree that HHS is a third-party beneficiary to applicable provisions of the subcontract. HHS has the right, but not the obligation, to review or approve the terms and conditions of the subcontract by virtue of this Subcontractor Agreement Form. Contractor and Subcontractor assure HHS that any Breach as defined by the DUA that Subcontractor Discovers shall be reported to HHS by Contractor in the time,manner and content required by the DUA. If Contractor knows or should have known in the exercise of reasonable diligence of a pattern of activity or practice by Subcontractor that constitutes a material breach or violation of the DUA or the Subcontractor's obligations, Contractor shall: 1. Take reasonable steps to cure the violation or end the violation, as applicable; 2. If the steps are unsuccessful,terminate the contract or arrangement with Subcontractor, if feasible; 3. Notify HHS immediately upon Discovery of the pattern of activity or practice of Subcontractor that constitutes a material breach or violation of the DUA and keep HHS reasonably and regularly informed about steps Contractor is taking to cure or end the violation or terminate Subcontractor's contract or arrangement. This Subcontractor Agreement Form is executed by the parties in their capacities indicated below. CONTRACTOR SUBCONTRACTOR BY: BY: NAME: NAME: TITLE: TITLE: DATE ,201 . DATE: HHS Data Use Agreement v. 8.5 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Attachment 2- Security and Privacy Initial Inquiry [Attach Completed SPI Here] DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 TEXAS Texas HHS System -Data Use Agreement- Attachment 2 ©� SECURITY AND PRIVACY INQUIRY(SPI) 4_, Health and Human <' Services If you are a bidder for a new procurement/contract, in order to participate in the bidding process,you must have corrected any"No" responses(except A9a) prior to the contract award date. If you are an applicant for an open enrollment,you must have corrected any"No" answers(except A9a and All) prior to performing any work on behalf of any Texas HHS agency. For any questions answered "No" (except A9a and All),an Action Plan for Compliance with a Timeline must be documented in the designated area below the question.The timeline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed. Compliance with requirements related to other types of Confidential Information must be confirmed within 90 calendar days from the date the form is signed. SECTION A: APPLICANT/BIDDER INFORMATION (To be completed by Applicant/Bidder) 1. Does the applicant/bidder access, create, disclose, receive, transmit, maintain, or store Texas 0 Yes HHS Confidential Information in electronic systems (e.g., laptop, personal use computer, 0 No mobile device, database, server, etc.)? IF NO, STOP. THE SPI FORM IS NOT REQUIRED. 2. Entity or Applicant/Bidder Legal Name Legal Name: Legal Entity Tax Identification Number (TIN) (Last Four Numbers Only): Procurement/Contract#: Address: City: State: ZIP: Telephone #: Email Address: 3. Number of Employees, at all locations, in Total Employees: Applicant/Bidder's Workforce "Workforce"means all employees,volunteers,trainees,and other Persons whose conduct is under the direct control of Applicant/Bidder,whether or not they are paid by Applicant/ Bidder.If Applicant/Bidder is a sole proprietor,the workforce may be only one employee. 4. Number of Subcontractors Total Subcontractors: (if Applicant/Bidder will not use subcontractors,enter"0") 5. Name of Information Technology Security Official A. Security Official: and Name of Privacy Official for Applicant/Bidder Legal Name: (Privacy and Security Official may be the same person.) Address: City: State: ZIP: Telephone #: Email Address: B. Privacy Official: Legal Name: Address: City: State: ZIP: Telephone #: Email Address: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 1 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 6. Type(s) of Texas HHS Confidential Information the HIPAA CJIS IRS FTI CMS SSA PII Applicant/Bidder will create, receive, maintain, use, El El ❑ El El El disclose or have access to: (Check all that apply) Other (Please List) •Health Insurance Portability and Accountability Act(HIPAA)data •Criminal Justice Information Services(CJIS)data •Internal Revenue Service Federal Tax Information(IRS FTI)data •Centers for Medicare&Medicaid Services(CMS) •Social Security Administration(SSA) •Personally Identifiable Information(PII) 7. Number of Storage Devices for Texas HHS Confidential Information (as defined in the Total # Texas HHS System Data Use Agreement (DUA)) (Sum a-d) Cloud Services involve using a network of remote servers hosted on the Internet to store, 0 manage, and process data, rather than a local server or a personal computer. A Data Center is a centralized repository, either physical or virtual,for the storage, management, and dissemination of data and information organized around a particular body of knowledge or pertaining to a particular business. a. Devices. Number of personal user computers, devices or drives, including mobile devices and mobile drives. b. Servers. Number of Servers that are not in a data center or using Cloud Services. c. Cloud Services. Number of Cloud Services in use. d. Data Centers. Number of Data Centers in use. 8. Number of unduplicated individuals for whom Applicant/Bidder reasonably expects to Select Option handle Texas HHS Confidential Information during one year: (a-d) a. 499 individuals or less 0 a. b. 500 to 999 individuals 0 b. c. 1,000 to 99,999 individuals 0 c. d. 100,000 individuals or more 0 d. 9. HIPAA Business Associate Agreement a. Will Applicant/Bidder use, disclose, create, receive, transmit or maintain protected 0 Yes health information on behalf of a HIPAA-covered Texas HHS agency for a HIPAA- 0 No covered function? b. Does Applicant/Bidder have a Privacy Notice prominently displayed on a Webpage or a 0 Yes Public Office of Applicant/Bidder's business open to or that serves the public? (This is a 0 No HIPAA requirement. Answer "N/A" if not applicable, such as for agencies not covered 0 N/A by HIPAA.) Action Plan for Compliance with a Timeline: Compliance Date: 10. Subcontractors. If the Applicant/Bidder responded "0" to Question 4 (indicating no subcontractors), check "N/A" for both 'a.' and 'b.' a. Does Applicant/Bidder require subcontractors to execute the DUA Attachment 1 0 Yes Subcontractor Agreement Form? 0 No 0 N/A Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 2 of 18 DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 b. Will Applicant/Bidder agree to require subcontractors who will access Confidential 0 Yes Information to comply with the terms of the DUA, not disclose any Confidential Q No Information to them until they have agreed in writing to the same safeguards and to 0 N/A discontinue their access to the Confidential Information if they fail to comply? Action Plan for Compliance with a Timeline: Compliance Date: 11. Does Applicant/Bidder have any Optional Insurance currently in place? 0 Yes Optional Insurance provides coverage for: (1) Network Security and Privacy;(2)Data Breach;(3)Cyber ONO Liability(lost data,lost use or delay/suspension in business,denial of service with e-business,the Internet, networks and informational assets,such as privacy,intellectual property,virus transmission,extortion, O N/A sabotage or web activities);(4)Electronic Media Liability;(5)Crime/Theft; (6)Advertising Injury and Personal Injury Liability;and(7)Crisis Management and Notification Expense Coverage. SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 3 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 SECTION B: PRIVACY RISK ANALYSIS AND ASSESSMENT(To be completed by Applicant/Bidder) For any questions answered "No," an Action Plan for Compliance with a Timeline must be documented in the designated area below the question. The timeline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed. Compliance with requirements related to other types of Confidential Information must be confirmed within 90 calendar days from the date the form is signed. 1. Written Policies & Procedures. Does Applicant/Bidder have current written privacy and Yes or No security policies and procedures that, at a minimum: a. Does Applicant/Bidder have current written privacy and security policies and 0 Yes procedures that identify Authorized Users and Authorized Purposes (as defined in the No DUA) relating to creation, receipt, maintenance, use, disclosure, access or transmission of Texas HHS Confidential Information? Action Plan for Compliance with a Timeline: Compliance Date: b. Does Applicant/Bidder have current written privacy and security policies and 0 Yes procedures that require Applicant/Bidder and its Workforce to comply with the Q No applicable provisions of HIPAA and other laws referenced in the DUA, relating to creation, receipt, maintenance, use, disclosure, access or transmission of Texas HHS Confidential Information on behalf of a Texas HHS agency? Action Plan for Compliance with a Timeline: Compliance Date: C. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that limit use or disclosure of Texas HHS Confidential Information to the minimum that is No necessary to fulfill the Authorized Purposes? Action Plan for Compliance with a Timeline: Compliance Date: d. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that respond to an actual or suspected breach of Texas HHS Confidential Information, to O include at a minimum (if any responses are "No" check "No" for all three): No i. Immediate breach notification to the Texas HHS agency, regulatory authorities, and other required Individuals or Authorities, in accordance with Article 4 of the DUA; ii. Following a documented breach response plan, in accordance with the DUA and applicable law; & iii. Notifying Individuals and Reporting Authorities whose Texas HHS Confidential Information has been breached, as directed by the Texas HHS agency? SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 4 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Action Plan for Compliance with a Timeline: Compliance Date: e. Does Applicant/Bidder have current written privacy and security policies and procedures © Yes that conduct annual workforce training and monitoring for and correction of any training delinquencies? No Action Plan for Compliance with a Timeline: Compliance Date: f. Does Applicant/Bidder have current written privacy and security policies and Yes procedures that permit or deny individual rights of access, and amendment or correction, when appropriate? 0 No Action Plan for Compliance with a Timeline: Compliance Date: g. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that permit only Authorized Users with up-to-date privacy and security training, and 0 No with a reasonable and demonstrable need to use, disclose, create, receive, maintain, access or transmit the Texas HHS Confidential Information, to carry out an obligation under the DUA for an Authorized Purpose, unless otherwise approved in writing by a Texas HHS agency? Action Plan for Compliance with a Timeline: Compliance Date: h. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that establish, implement and maintain proof of appropriate sanctions against any 0 No Workforce or Subcontractors who fail to comply with an Authorized Purpose or who is not an Authorized User, and used or disclosed Texas HHS Confidential Information in violation of the DUA, the Base Contract or applicable law? Action Plan for Compliance with a Timeline: Compliance Date: i. Does Applicant/Bidder have current written privacy and security policies and 0 Yes procedures that require updates to policies, procedures and plans following major 0 No changes with use or disclosure of Texas HHS Confidential Information within 60 days of identification of a need for update? Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 5 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 j. Does Applicant/Bidder have current written privacy and security policies and 0 Yes procedures that restrict permissions or attempts to re-identify or further identify 0 No de-identified Texas HHS Confidential Information, or attempt to contact any Individuals whose records are contained in the Texas HHS Confidential Information, except for an Authorized Purpose, without express written authorization from a Texas HHS agency or as expressly permitted by the Base Contract? Action Plan for Compliance with a Timeline: Compliance Date: k. If Applicant/Bidder intends to use, disclose, create, maintain, store or transmit Texas HHS 0 Yes Confidential Information outside of the United States, will Applicant/Bidder obtain the No express prior written permission from the Texas HHS agency and comply with the Texas HHS agency conditions for safeguarding offshore Texas HHS Confidential Information? Action Plan for Compliance with a Timeline: Compliance Date: I. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that require cooperation with Texas HHS agencies' or federal regulatory inspections, 0 No audits or investigations related to compliance with the DUA or applicable law? Action Plan for Compliance with a Timeline: Compliance Date: M. Does Applicant/Bidder have current written privacy and security policies and 0 Yes procedures that require appropriate standards and methods to destroy or dispose of O No Texas HHS Confidential Information? Action Plan for Compliance with a Timeline: Compliance Date: n. Does Applicant/Bidder have current written privacy and security policies and procedures 0 Yes that prohibit disclosure of Applicant/Bidder's work product done on behalf of Texas HHS 0 No pursuant to the DUA, or to publish Texas HHS Confidential Information without express prior approval of the Texas HHS agency? Action Plan for Compliance with a Timeline: Compliance Date: 2. Does Applicant/Bidder have a current Workforce training program? 0 Yes Training of Workforce must occur at least once every year,and within 30 days of date of hiring a new O No Workforce member who will handle Texas HHS Confidential Information.Training must include:(1)privacy and security policies,procedures,plans and applicable requirements for handling Texas HHS Confidential Information, (2)a requirement to complete training before access is given to Texas HHS Confidential Information,and(3)written proof of training and a procedure for monitoring timely completion of training. SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 6 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Action Plan for Compliance with a Timeline: Compliance Date: 3. Does Applicant/Bidder have Privacy Safeguards to protect Texas HHS Confidential 0 Yes Information in oral, paper and/or electronic form? 0 No "Privacy Safeguards" means protection of Texas HHS Confidential Information by establishing, implementing and maintaining required Administrative, Physical and Technical policies,procedures, processes and controls, required by the DUA, HIPAA(45 CFR 164.530),Social Security Administration, Medicaid and laws, rules or regulations, as applicable.Administrative safeguards include administrative protections, policies and procedures for matters such as training, provision of access,termination, and review of safeguards, incident management,disaster recovery plans,and contract provisions.Technical safeguards include technical protections, policies and procedures,such as passwords, logging,emergencies, how paper is faxed or mailed, and electronic protections such as encryption of data. Physical safeguards include physical protections, policies and procedures,such as locks, keys, physical access,physical storage and trash. Action Plan for Compliance with a Timeline: Compliance Date: 4. Does Applicant/Bidder and all subcontractors (if applicable) maintain a current list of 0 Yes Authorized Users who have access to Texas HHS Confidential Information, whether oral, 0 No written or electronic? Action Plan for Compliance with a Timeline: Compliance Date: 5. Does Applicant/Bidder and all subcontractors (if applicable) monitor for and remove 0 Yes terminated employees or those no longer authorized to handle Texas HHS 0 No Confidential Information from the list of Authorized Users? Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 7 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-OA3F-4342-8E8D-BB21884C3931 • g • v • A A AID A V T(to be completed by Applicant/Bidder) This section is about your electronic system. If your business DOES NOT store, access, or No Electronic transmit Texas HHS Confidential Information in electronic systems (e.g., laptop, personal Systems use computer, mobile device, database, server, etc.) select the box to the right, and "YES" will be entered for all questions in this section. For any questions answered "No," an Action Plan for Compliance with a Timeline must be documented in the designated area below the question. The timeline for compliance with HIPAA-related items is 30 calendar days, PII-related items is 90 calendar days. 1. Does the Applicant/Bidder ensure that services which access, create, disclose, receive, O Yes transmit, maintain, or store Texas HHS Confidential Information are maintained IN the O No United States (no offshoring) unless ALL of the following requirements are met? a. The data is encrypted with FIPS 140-2 validated encryption b. The offshore provider does not have access to the encryption keys c. The Applicant/Bidder maintains the encryption key within the United States d. The Application/Bidder has obtained the express prior written permission of the Texas HHS agency For more information regarding FIPS 140-2 encryption products,please refer to: http://csrc.nist.gov/publications/fips Action Plan for Compliance with a Timeline: Compliance Date: 2. Does Applicant/Bidder utilize an IT security-knowledgeable person or company to maintain 0 Yes or oversee the configurations of Applicant/Bidder's computing systems and devices? 0 No Action Plan for Compliance with a Timeline: Compliance Date: 3. Does Applicant/Bidder monitor and manage access to Texas HHS Confidential Information 0 Yes (e.g., a formal process exists for granting access and validating the need for users to access D No Texas HHS Confidential Information, and access is limited to Authorized Users)? Action Plan for Compliance with a Timeline: Compliance Date: 4. Does Applicant/Bidder a) have a system for changing default passwords, b) require user Dyes password changes at least every 90 calendar days, and c) prohibit the creation of weak 0 No passwords (e.g., require a minimum of 8 characters with a combination of uppercase, lowercase, special characters, and numerals, where possible) for all computer systems that access or store Texas HHS Confidential Information. If yes, upon request must provide evidence such as a screen shot or a system report. Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 8 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 5. Does each member of Applicant/Bidder's Workforce who will use, disclose, create, receive, 0 Yes transmit or maintain Texas HHS Confidential Information have a unique user name Q No (account) and private password? Action Plan for Compliance with a Timeline: Compliance Date: 6. Does Applicant/Bidder lock the password after a certain number of failed attempts and Q Yes after 15 minutes of user inactivity in all computing devices that access or store Texas Q No HHS Confidential Information? Action Plan for Compliance with a Timeline: Compliance Date: 7. Does Applicant/Bidder secure, manage and encrypt remote access (including wireless Q Yes access) to computer systems containing Texas HHS Confidential Information? (e.g., a formal Q No process exists for granting access and validating the need for users to remotely access Texas HHS Confidential Information, and remote access is limited to Authorized Users). Encryption is required for all Texas HHS Confidential Information. Additionally,F1PS 140-2 validated encryption is required for Health Insurance Portability and Accountability Act(HIPAA)data, Criminal Justice Information Services(CJIS)data, Internal Revenue Service Federal Tax Information(IRS FTI)data,and Centers for Medicare&Medicaid Services(CMS)data. For more information regarding FIPS 140-2 encryption products,please refer to: http://csrc.nist.qov/publications/fips Action Plan for Compliance with a Timeline: Compliance Date: 8. Does Applicant/Bidder implement computer security configurations or settings for all 0 Yes computers and systems that access or store Texas HHS Confidential Information? Q No (e.g., non-essential features or services have been removed or disabled to reduce the threat of breach and to limit exploitation opportunities for hackers or intruders, etc.) Action Plan for Compliance with a Timeline: Compliance Date: 9. Does Applicant/Bidder secure physical access to computer, paper, or other systems 0 Yes containing Texas HHS Confidential Information from unauthorized personnel and theft 0 No (e.g., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.)? Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 9 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 10. Does Applicant/Bidder use encryption products to protect Texas HHS Confidential 0 Yes Information that is transmitted over a public network (e.g., the Internet, WiFi, etc.)? a No If yes, upon request must provide evidence such as a screen shot or a system report. Encryption is required for all HHS Confidential Information. Additionally,FIPS 140-2 validated encryption is required for Health Insurance Portability and Accountability Act(HIPAA)data,Criminal Justice Information Services(CJIS)data,Internal Revenue Service Federal Tax Information(IRS FTI)data,and Centers for Medicare&Medicaid Services(CMS)data. For more information regarding FIPS 140-2 encryption products,please refer to: http://csrc.nist.gov/publications/fips Action Plan for Compliance with a Timeline: Compliance Date: 11. Does Applicant/Bidder use encryption products to protect Texas HHS Confidential 0 Yes Information stored on end user devices (e.g., laptops, USBs, tablets, smartphones, external o No hard drives, desktops, etc.)? If yes, upon request must provide evidence such as a screen shot or a system report. Encryption is required for all Texas HHS Confidential Information. Additionally,FIPS 140-2 validated encryption is required for Health Insurance Portability and Accountability Act(HIPAA)data,Criminal Justice Information Services(UIS)data, Internal Revenue Service Federal Tax Information(IRS FTI)data,and Centers for Medicare&Medicaid Services(CMS)data. For more information regarding FIPS 140-2 encryption products,please refer to: http://csrc.nist.qov/publications/fips Action Plan for Compliance with a Timeline: Compliance Date: 12. Does Applicant/Bidder require Workforce members to formally acknowledge rules outlining 0 Yes their responsibilities for protecting Texas HHS Confidential Information and associated 0 No systems containing HHS Confidential Information before their access is provided? Action Plan for Compliance with a Timeline: Compliance Date: 13. Is Applicant/Bidder willing to perform or submit to a criminal background check on 0 Yes Authorized Users? O No Action Plan for Compliance with a Timeline: Compliance Date: 14. Does Applicant/Bidder prohibit the access, creation, disclosure, reception, transmission, 0 Yes maintenance, and storage of Texas HHS Confidential Information with a subcontractor 0 No (e.g., cloud services, social media, etc.) unless Texas HHS has approved the subcontractor agreement which must include compliance and liability clauses with the same requirements as the Applicant/Bidder? Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 10 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0G43G469-0A3F-4342-8E8D-BB21884C3931 - 15. Does Applicant/Bidder keep current on security updates/patches (including firmware, 0 Yes software and applications) for computing systems that use, disclose, access, create, O No transmit, maintain or store Texas HHS Confidential Information? Action Plan for Compliance with a Timeline: Compliance Date: 16. Do Applicant/Bidder's computing systems that use, disclose, access, create, transmit, O Yes maintain or store Texas HHS Confidential Information contain up-to-date anti- O No malware and antivirus protection? Action Plan for Compliance with a Timeline: Compliance Date: 17. Does the Applicant/Bidder review system security logs on computing systems that access 0 Yes or store Texas HHS Confidential Information for abnormal activity or security concerns on o No a regular basis? Action Plan for Compliance with a Timeline: Compliance Date: 18. Notwithstanding records retention requirements, does Applicant/Bidder's disposal O Yes processes for Texas HHS Confidential Information ensure that Texas HHS Confidential 0 No Information is destroyed so that it is unreadable or undecipherable? Action Plan for Compliance with a Timeline: Compliance Date: 19. Does the Applicant/Bidder ensure that all public facing websites and mobile 0 Yes applications containing Texas HHS Confidential Information meet security testing 0 No standards set forth within the Texas Government Code (TGC), Section 2054.516; including requirements for implementing vulnerability and penetration testing and addressing identified vulnerabilities? For more information regarding TGC,Section 2054.516 DATA SECURITY PLAN FOR ONLINE AND MOBILE APPLICATIONS,please refer to: https://legiscan.com/TX/text/HB8/2017 Action Plan for Compliance with a Timeline: Compliance Date: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 11 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 SECTION D: SIGNATURE AND SUBMISSION (to be completed by Applicant/Bidder) Please sign the form digitally, if possible. If you can't, provide a handwritten signature. 1. I certify that all of the information provided in this form is truthful and correct to the best of my knowledge. If I learn that any such information was not correct, I agree to notify Texas HHS of this immediately. 2. Signature 3. Title 4. Date: To submit the completed,signed form: • Email the form as an attachment to the appropriate Texas HHS Contract Manager(s). Section E: To Be Completed by Texas HHS Agency Staff: Agency(s): Requesting Department(s): HHSC: DFPS: DSHS: Legal Entity Tax Identification Number(TIN) (Last four Only): PO/Contract(s)#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: Contract Manager: Contract Manager Email Address: Contract Manager Telephone#: SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 12 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 'NJ i Kut.I iui113 run wivirLc i mu THE SECURITY AND PRIVACY INQUIRY (SPI) Below are instructions for Applicants, Bidders and Contractors for Texas Health and Human Services requiring the Attachment 2, Security and Privacy Inquiry (SPI) to the Data Use Agreement (DUA). Instruction item numbers below correspond to sections on the SPI form. If you are a bidder for a new procurement/contract, in order to participate in the bidding process,you must have corrected any"No" responses(except A9a) prior to the contract award date. If you are an applicant for an open enrollment,you must have corrected any"No" answers(except A9a and All) prior to performing any work on behalf of any Texas HHS agency. For any questions answered "No" (except A9a and All), an Action Plan for Compliance with a Timeline must be documented in the designated area below the question.The timeline for compliance with HIPAA-related requirements for safeguarding Protected Health Information is 30 calendar days from the date this form is signed. Compliance with requirements related to other types of Confidential Information must be confirmed within 90 calendar days from the date the form is signed. SECTION A. APPLICANT /BIDDER INFORMATION Item#1. Only contractors that access, transmit, store, and/or maintain Texas HHS Confidential Information will complete and email this form as an attachment to the appropriate Texas HHS Contract Manager. Item#2. Entity or Applicant/Bidder Legal Name. Provide the legal name of the business(the name used for legal purposes, like filing a federal or state tax form on behalf of the business, and is not a trade or assumed named "dba"), the legal tax identification number(last four numbers only)of the entity or applicant/bidder, the address of the corporate or main branch of the business, the telephone number where the business can be contacted regarding questions related to the information on this form and the website of the business, if a website exists. Item#3. Number of Employees, at all locations,in Applicant/Bidder's workforce.Provide the total number of individuals, including volunteers,subcontractors, trainees, and other persons who work for the business. If you are the only employee,please answer"1." Item#4. Number of Subcontractors. Provide the total number of subcontractors working for the business. If you have none,please answer"0"zero. Item#5. Number of unduplicated individuals for whom Applicant/Bidder reasonably expects to handle HHS Confidential Information during one year. Select the radio button that corresponds with the number of clients/consumers for whom you expect to handle Texas HHS Confidential Information during a year. Only count clients/consumers once, no matter how many direct services the client receives during a year. Item#5. Name of Information Technology Security Official and Name of Privacy Official for Applicant/Bidder.As with all other fields on the SPI, this is a required field. This may be the same person and the owner of the business if such person has the security and privacy knowledge that is required to implement the requirements of the DUA and respond to questions related to the SPI. In 4.A. provide the name, address, telephone number, and email address of the person whom you have designated to answer any security questions found in Section C and in 4.8. provide this information for the person whom you have designated as the person to answer any privacy questions found in Section B. The business may contract out for this expertise;however, designated individual(s)must have knowledge of the business's devices, systems and methods for use, disclosure, creation, receipt, transmission and maintenance of Texas HHS Confidential Information and be willing to be the point of contact for privacy and security questions. Item#6. Type(s)of HHS Confidential Information the Entity or Applicant/Bidder Will Create, Receive, Maintain, Use, Disclose or Have Access to: Provide a complete listing of all Texas HHS Confidential Information that the Contractor will create, receive, maintain, use, disclose or have access to. The DUA section Article 2, Definitions, defines Texas HHS Confidential Information as: "Confidential Information"means any communication or record(whether oral, written, electronically stored or transmitted, or in any other form)provided to or made available to CONTRACTOR or that CONTRACTOR may create, receive, maintain, use, disclose or have access to on behalf of Texas HHS that consists of or includes any or all of the following: (1)Client Information; (2)Protected Health Information in any form including without limitation, Electronic Protected Health Information or Unsecured Protected Health Information; (3)Sensitive Personal Information defined by Texas Business and Commerce Code Ch. 521; SPI Version 2.1 (06/2018) Texas HHS System- Data Use Agreement-Attachment 2: Page 13 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 (4)reaerai I ax information; (5)Personally Identifiable Information; (6)Social Security Administration Data, including, without limitation, Medicaid information; (7)All privileged work product; (8)All information designated as confidential under the constitution and laws of the State of Texas and of the United States, including the Texas Health &Safety Code and the Texas Public Information Act, Texas Government Code, Chapter 552. Definitions for the following types of confidential information can be found the following sites: • Health Insurance Portability and Accountability Act(HIPAA)-http://www.hhs.gov/hipaa/index.html • Criminal Justice Information Services(CJIS)-https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center • Internal Revenue Service Federal Tax Information(IRS FTI)-https://www.irs.gov/pub/irs-pdf/p1075.pdf • Centers for Medicare& Medicaid Services(CMS)-https://www.cros.gov/Regulations-and-Guidance/Regulations-and- Guidance.html •Social Security Administration (SSA)-https://www.ssa.gov/requlations/ • Personally Identifiable Information (PII)-http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf Item#7. Number of Storage devices for Texas HHS Confidential Information. The total number of devices is automatically calculated by exiting the fields in lines a-d. Use the<Tab>key when exiting the field to prompt calculation, if it doesn't otherwise sum correctly. • Item 7a.Devices. Provide the number of personal user computers, devices, and drives(including mobile devices, laptops, USB drives, and external drives)on which your business stores or will store Texas HHS Confidential Information. • Item 7b.Servers. Provide the number of servers not housed in a data center or "in the cloud,"on which Texas HHS Confidential Information is stored or will be stored. A server is a dedicated computer that provides data or services to other computers. It may provide services or data to systems on a local area network(LAN)or a wide area network(WAN)over the Internet. If none, answer"0"(zero). • Item 7c. Cloud Services. Provide the number of cloud services to which Texas HHS Confidential Information is stored. Cloud Services involve using a network of remote servers hosted on the Internet to store, manage, and process data, rather than on a local server or a personal computer. If none, answer"0"(zero.) • Item 7d. Data Centers. Provide the number of data centers in which you store Texas HHS Confidential Information.A Data Center is a centralized repository, either physical or virtual,for the storage, management, and dissemination of data and information organized around a particular body of knowledge or pertaining to a particular business. If none, answer"0"(zero). Item#8. Number of unduplicated individuals for whom the Applicant/Bidder reasonably expects to handle Texas HHS Confidential Information during one year. Select the radio button that corresponds with the number of clients/consumers for whom you expect to handle Confidential Information during a year. Only count clients/consumers once, no matter how many direct services the client receives during a year. Item#9. HIPAA Business Associate Agreement. • Item#9a. Answer "Yes"if your business will use, disclose, create, receive, transmit, or store information relating to a client/consumer's healthcare on behalf of the Department of State Health Services, the Department of Disability and Aging Services, or the Health and Human Services Commission for treatment, payment, or operation of Medicaid or Medicaid clients. If your contract does not include HIPAA covered information, respond "no."If"no,"a compliance plan is not required. • Item#9b. Answer "Yes"if your business has a notice of privacy practices(a document that explains how you protect and use a client/consumer's healthcare information)displayed either on a website(if one exists for your business)or in your place of business(if that location is open to clients/consumers or the public). If your contract does not include HIPAA covered information, respond "N/A." Item#10. Subcontractors. If your business responded "0"to question 4 (number of subcontractors),Answer "N/A"to Items 10a and 10b to indicate not applicable. • Item#10a.Answer "Yes"if your business requires that all subcontractors sign Attachment 1 of the DUA. • Item#10b. Answer "Yes"if your business obtains Texas HHS approval before permitting subcontractors to handle Texas HHS Confidential Information on your business's behalf. Item#11. Optional Insurance.Answer "yes"if applicant has optional insurance in place to provide coverage for a Breach or any Texas HHS System-Data Use Agreement-Attachment 2: Page 14 of 18 SPI Version 2.1 (06/2018) SECURITY AND PRIVACY INQUIRY(SPI) g DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 other situations listed in this question. if you are not required to have this optional coverage, answer "N/A"A compliance plan is not required. SECTION B. PRIVACY RISK ANALYSIS AND ASSESSMENT Reasonable and appropriate written Privacy and Security policies and procedures are required, even for sole proprietors who are the only employee,to demonstrate how your business will safeguard Texas HHS Confidential Information and respond in the event of a Breach of Texas HHS Confidential Information.To ensure that your business is prepared, all of the items below must be addressed in your written Privacy and Security policies and procedures. Item#1. Answer "Yes" if you have written policies in place for each of the areas (a-o). • Item#1a. Answer"yes" if your business has written policies and procedures that identify everyone, including subcontractors, who are authorized to use Texas HHS Confidential Information.The policies and procedures should also identify the reason why these Authorized Users need to access the Texas HHS Confidential Information and this reason must align with the Authorized Purpose described in the Scope of Work or description of services in the Base Contract with the Texas HHS agency. • Item#1b. Answer "Yes" if your business has written policies and procedures that require your employees (including yourself), your volunteers, your trainees, and any other persons whose work you direct,to comply with the requirements of HIPAA, if applicable, and other confidentiality laws as they relate to your handling of Texas HHS Confidential Information. Refer to the laws and rules that apply, including those referenced in the DUA and Scope of Work or description of services in the Base Contract. • Item#1c. Answer"Yes" if your business has written policies and procedures that limit the Texas HHS Confidential Information you disclose to the minimum necessary for your workforce and subcontractors (if applicable)to perform the obligations described in the Scope of Work or service description in the Base Contract. (e.g., if a client/consumer's Social Security Number is not required for a workforce member to perform the obligations described in the Scope of Work or service description in the Base Contract,then the Social Security Number will not be given to them.) If you are the only employee for your business, policies and procedures must not include a request for, or use of, Texas HHS Confidential Information that is not required for performance of the services. • Item #1d. Answer "Yes" if your business has written policies and procedures that explain how your business would respond to an actual or suspected breach of Texas HHS Confidential Information. The written policies and procedures, at a minimum, must include the three items below. If any response to the three items below are no, answer "no." O Item#1di.Answer"Yes" if your business has written policies and procedures that require your business to immediately notify Texas HHS, the Texas HHS Agency, regulatory authorities, or other required Individuals or Authorities of a Breach as described in Article 4, Section 4 of the DUA. Refer to Article 4, Section 4.01: Initial Notice of Breach must be provided in accordance with Texas HHS and DUA requirements with as much information as possible about the Event/Breach and a name and contact who will serve as the single point of contact with HHS both on and off business hours. Time frames related to Initial Notice include: • within one hour of Discovery of an Event or Breach of Federal Tax Information, Social Security Administration Data, or Medicaid Client Information • within 24 hours of all other types of Texas HHS Confidential Information 48-hour Formal Notice must be provided no later than 48 hours after Discovery for protected health information, sensitive personal information or other non-public information and must include applicable information as referenced in Section 4.01 (C)2. of the DUA. O Item #1dii. Answer"Yes" if your business has written policies and procedures require you to have and follow a written breach response plan as described in Article 4 Section 4.02 of the DUA. O Item#ldiii.Answer"Yes" if your business has written policies and procedures require you to notify Reporting Authorities and Individuals whose Texas HHS Confidential Information has been breached as described in Article 4 Section 4.03 of the DUA. • Item#1e. Answer "Yes" if your business has written policies and procedures requiring annual training of your entire workforce on matters related to confidentiality, privacy, and security, stressing the importance of promptly reporting any Event or Breach, outlines the process that you will use to require attendance and track completion for employees who failed to complete annual training. SPI Version 2.1 (06/2018) Texas HHS System- Data Use Agreement-Attachment 2: Page 15 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 • Item #1f. Answer "Yes" if your business has written policies and procedures requiring you to allow individuals (clients/consumers)to access their individual record of Texas HHS Confidential Information, and allow them to amend or correct that information, if applicable. • Item #1g. Answer"Yes" if your business has written policies and procedures restricting access to Texas HHS Confidential Information to only persons who have been authorized and trained on how to handle Texas HHS Confidential Information • Item#1h. Answer"Yes" if your business has written policies and procedures requiring sanctioning of any subcontractor, employee, trainee,volunteer, or anyone whose work you direct when they have accessed Texas HHS Confidential Information but are not authorized to do so, and that you have a method of proving that you have sanctioned such an individuals. If you are the only employee, you must demonstrate how you will document the noncompliance, update policies and procedures if needed, and seek additional training or education to prevent future occurrences. • Item #1i. Answer "Yes" if your business has written policies and procedures requiring you to update your policies within 60 days after you have made changes to how you use or disclose Texas HHS Confidential Information. • Item #1j. Answer"Yes" if your business has written policies and procedures requiring you to restrict attempts to take de-identified data and re-identify it or restrict any subcontractor, employee,trainee, volunteer, or anyone whose work you direct, from contacting any individuals for whom you have Texas HHS Confidential Information except to perform obligations under the contract, or with written permission from Texas HHS. • Item #1k.Answer"Yes" if your business has written policies and procedures prohibiting you from using, disclosing, creating, maintaining, storing or transmitting Texas HHS Confidential Information outside of the United States. • Item #11. Answer "Yes" if your business has written policies and procedures requiring your business to cooperate with HHS agencies or federal regulatory entities for inspections, audits, or investigations related to compliance with the DUA or applicable law. • Item#1m. Answer "Yes" if your business has written policies and procedures requiring your business to use appropriate standards and methods to destroy or dispose of Texas HHS Confidential Information. Policies and procedures should comply with Texas HHS requirements for retention of records and methods of disposal. • Item #1n. Answer"Yes" if your business has written policies and procedures prohibiting the publication of the work you created or performed on behalf of Texas HHS pursuant to the DUA, or other Texas HHS Confidential Information, without express prior written approval of the HHS agency. Item#2. Answer "Yes" if your business has a current training program that meets the requirements specified in the SPI for you,your employees,your subcontractors, your volunteers, your trainees, and any other persons under you direct supervision. Item#3. Answer "Yes" if your business has privacy safeguards to protect Texas HHS Confidential Information as described in the SPI. Item #4. Answer"Yes" if your business maintains current lists of persons in your workforce, including subcontractors (if applicable),who are authorized to access Texas HHS Confidential Information. If you are the only person with access to Texas HHS Confidential Information, please answer "yes." Item #5. Answer "Yes" if your business and subcontractors (if applicable) monitor for and remove from the list of Authorized Users, members of the workforce who are terminated or are no longer authorized to handle Texas HHS Confidential Information. If you are the only one with access to Texas HHS Confidential Information, please answer"Yes." SECTION C. SECURITY RISK ANALYSIS AND ASSESSMENT This section is about your electronic systems. If you DO NOT store Texas HHS Confidential Information in electronic systems (e.g., laptop, personal computer, mobile device, database, server, etc.), select the "No Electronic Systems" box and respond "Yes" for all questions in this section. Item#1. Answer "Yes" if your business does not "offshore" or use, disclose, create, receive,transmit or maintain Texas HHS Confidential Information outside of the United States. If you are not certain, contact your provider of technology services (application, cloud, data center, network, etc.) and request confirmation that they do not off- shore their data. SPI Version 2.1 (06/2018) Texas HHS System-Data Use Agreement-Attachment 2: Page 16 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-OA3F-4342-8E8D-BB21884C3931 item g1. Answer "Yes It your business uses a person or company who is knowledgeable in IT security to maintain or oversee the configurations of your business's computing systems and devices. You may be that person, or you may hire someone who can provide that service for you. Item#3. Answer"Yes" if your business monitors and manages access to Texas HHS Confidential Information (i.e., reviews systems to ensure that access is limited to Authorized Users; has formal processes for granting,validating, and reviews the need for remote access to Authorized Users to Texas HHS Confidential Information, etc.). If you are the only employee, answer "Yes" if you have implemented a process to periodically evaluate the need for accessing Texas HHS Confidential Information to fulfill your Authorized Purposes. Item #4. Answer "Yes" if your business has implemented a system for changing the password a system initially assigns to the user (also known as the default password), and requires users to change their passwords at least every 90 days, and prohibits the creation of weak passwords for all computer systems that access or store Texas HHS Confidential Information (e.g., a strong password has a minimum of 8 characters with a combination of uppercase, lowercase, special characters, and numbers, where possible). If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/pass word-policy Item #5. Answer "Yes" if your business assigns a unique user name and private password to each of your employees, your subcontractors, your volunteers,your trainees and any other persons under your direct control who will use, disclose, create, receive,transmit or maintain Texas HHS Confidential Information. Item #6. Answer "Yes" if your business locks the access after a certain number of failed attempts to login and after 15 minutes of user inactivity on all computing devices that access or store Texas H H S Confidential Information. If your business uses a Microsoft Windows system, refer to the Microsoft website on how to do this, see example: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-policy Item #7. Answer"Yes" if your business secures, manages, and encrypts remote access, such as: using Virtual Private Network(VPN) software on your home computer to access Texas HHS Confidential Information that resides on a computer system at a business location or, if you use wireless, ensuring that the wireless is secured using a password code. If you do not access systems remotely or over wireless, answer"Yes." Item #8. Answer "Yes" if your business updates the computer security settings for all your computers and electronic systems that access or store Texas HHS Confidential Information to prevent hacking or breaches (e.g., non-essential features or services have been removed or disabled to reduce the threat of breach and to limit opportunities for hackers or intruders to access your system). For example, Microsoft's Windows security checklist: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/how-to-con figure-security-policy-settings Item #9. Answer "Yes" if your business secures physical access to computer, paper, or other systems containing Texas HHS Confidential Information from unauthorized personnel and theft (e.g., door locks, cable locks, laptops are stored in the trunk of the car instead of the passenger area, etc.). If you are the only employee and use these practices for your business, answer "Yes." Item#10. Answer"Yes" if your business uses encryption products to protect Texas HHS Confidential Information that is transmitted over a public network (e.g., the Internet, WIFI,etc.) or that is stored on a computer system that is physically or electronically accessible to the public(FIPS 140-2 validated encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data.) For more information regarding FIPS 140-2 encryption products, please refer to: http://csrc.nist.gov/publications/fips). Item#11. Answer "Yes" if your business stores Texas HHS Confidential Information on encrypted end-user electronic devices (e.g., laptops, USBs,tablets, smartphones, external hard drives, desktops, etc.) and can produce evidence of the encryption, such as, a screen shot or a system report (FIPS 140-2 encryption is required for Health Insurance Portability and Accountability Act (HIPAA) data, Criminal Justice Information Services (CJIS) data, Internal Revenue Service Federal Tax Information (IRS FTI) data, and Centers for Medicare & Medicaid Services (CMS) data). For more information regarding FIPS 140-2 validated encryption products, please refer to: http://csrc.nist.qov/publications/fips). If you do not utilize end-user electronic devices for storing Texas HHS Confidential Information, answer"Yes." SPI Version 2.1 (06/2018) Texas HHS System- Data Use Agreement-Attachment 2: Page 17 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Envelope ID:0C43C469-0A3F-4342-8E8D-BB21884C3931 Item#12.Answer "Yes" if your business requires employees, volunteers, trainees and other workforce members to sign a document that clearly outlines their responsibilities for protecting Texas HHS Confidential Information and associated systems containing Texas HHS Confidential Information before they can obtain access. If you are the only employee answer "Yes" if you have signed or are willing to sign the DUA, acknowledging your adherence to requirements and responsibilities. Item #13. Answer "Yes" if your business is willing to perform a criminal background check on employees, subcontractors, volunteers, or trainees who access Texas HHS Confidential Information. If you are the only employee, answer "Yes" if you are willing to submit to a background check. Item#14. Answer"Yes" if your business prohibits the access, creation, disclosure, reception,transmission, maintenance, and storage of Texas HHS Confidential Information on Cloud Services or social media sites if you use such services or sites, and there is a Texas HHS approved subcontractor agreement that includes compliance and liability clauses with the same requirements as the Applicant/Bidder. If you do not utilize Cloud Services or media sites for storing Texas HHS Confidential Information, answer"Yes." Item#15. Answer"Yes" if your business keeps current on security updates/patches (including firmware, software and applications) for computing systems that use, disclose, access, create,transmit, maintain or store Texas HHS Confidential Information. If you use a Microsoft Windows system, refer to the Microsoft website on how to ensure your system is automatically updating, see example: https://portal.msrc.microsoft.com/en-us/ Item#16. Answer"Yes" if your business's computing systems that use, disclose, access, create,transmit, maintain or store Texas HHS Confidential Information contain up-to-date anti-malware and antivirus protection. If you use a Microsoft Windows system, refer to the Microsoft website on how to ensure your system is automatically updating, see example: https://docs.microsoft.com/en-us/windows/security/threat-protection/ Item #17. Answer "Yes" if your business reviews system security logs on computing systems that access or store Texas HHS Confidential Information for abnormal activity or security concerns on a regular basis. If you use a Microsoft Windows system, refer to the Microsoft website for ensuring your system is logging security events, see example: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-security-audit-policies Item#18. Answer"Yes" if your business disposal processes for Texas HHS Confidential Information ensures that Texas HHS Confidential Information is destroyed so that it is unreadable or undecipherable. Simply deleting data or formatting the hard drive is not enough; ensure you use products that perform a secure disk wipe. Please see NIST SP 800-88 R1, Guidelines for Media Sanitization and the applicable laws and regulations for the information type for further guidance. Item#19.Answer"Yes" if your business ensures that all public facing websites and mobile applications containing HHS Confidential Information meet security testing standards set forth within the Texas Government Code (TGC), Section 2054.516 SECTION D. SIGNATURE AND SUBMISSION Click on the signature area to digitally sign the document. Email the form as an attachment to the appropriate Texas HHS Contract Manager. SPI Version 2.1 (06/2018) Texas HHS System- Data Use Agreement-Attachment 2: Page 18 of 18 SECURITY AND PRIVACY INQUIRY(SPI) DocuSign Certificate Of Completion Envelope Id:0C43C4690A3F43428E8DBB21884C3931 Status: Sent Subject: New$335,034; HHS001028700001;City of Port Arthur;DSHS/RLSS/LPHS Source Envelope: Document Pages:95 Signatures:0 Envelope Originator: Certificate Pages:2 Initials:0 Texas Health and Human Services Commission AutoNav:Enabled 1100 W.49th St. Envelopeld Stamping:Enabled Austin,TX 78756 Time Zone: (UTC-06:00)Central Time(US&Canada) PCS_DocuSign@hhsc.state.tx.us IP Address: 167.137.1.11 Record Tracking Status:Original Holder:Texas Health and Human Services Location: DocuSign 5/6/2021 5:24:16 PM Commission PCS_DocuSign@hhsc.state.tx.us Signer Events Signature Timestamp Judith Smith Sent:5/10/2021 11:22:27 PM Judith.smith@portarthurtx.gov Viewed:5/10/2021 11:30:18 PM Director of Health Services City of Port Arthur Security Level:Email,Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign Ron Burton Sent: 5/10/2021 11:22:26 PM ron.burton@portarthurtx.gov City Manager City of Port Arthur Security Level:Email,Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign David Gruber david.gruber@dshs.texas.gov Security Level: Email,Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign In Person Signer Events Signature Timestamp Editor Delivery Events Status Timestamp Agent Delivery Events Status Timestamp Intermediary Delivery Events Status Timestamp Certified Delivery Events Status Timestamp Carbon Copy Events Status Timestamp CMS Inbox COPIED Sent: 5/10/2021 11:22:26 PM cmucontracts@dshs.texas.gov Security Level: Email,Account Authentication (None) Carbon Copy Events Status Timestamp Electronic Record and Signature Disclosure: Not Offered via DocuSign Elma Medina COPIED Sent:5/10/2021 11:22:25 PM elma.medina@dshs.texas.gov Security Level: Email,Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign Erika Flores COPIED Sent: 5/10/2021 11:22:26 PM erika.flores@portrthurtx.org Security Level:Email,Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign Witness Events Signature Timestamp Notary Events Signature Timestamp Envelope Summary Events Status Timestamps Envelope Sent Hashed/Encrypted 5/10/2021 11:22:26 PM Payment Events Status Timestamps