Loading...
The URL can be used to link to this page
Your browser does not support the video tag.
Home
My WebLink
About
PR 18331: AMENDMENT SEVEN TO THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM
Memorandum City of Port Arthur, Texas Health Department TO: John Comeaux, P.E., Interim City Manager FROM: Judith Smith, RN, BSN, Director of Health V DATE: July 25, 2014 SUBJECT: Proposed Resolution No. 18331 Approval of Amendment Seven to the Texas Nurse-Family Partnership Agreement for FY 2015 grant program RECOMMENDATION It is recommended that the City Council approve P.R. No.18331, authorizing approval of Amendment Seven to the Texas Nurse-Family Partnership Program Agreement between the Health and Human Services Commission and the City of Port Arthur for a Nurse-Family Partnership grant in the amount of$516,850.00. This amendment is the grant renewal contract for FY 2015 with a 10% local cash match of$51,685.00. BACKGROUND The Nurse-Family Partnership (NFP) program provides educational, health, guidance, and other resources for low-income, Medicaid eligible, first-time pregnant women during pregnancy, and during the first two years of their infant's life through visits by highly trained registered nurses. This grant provides for five (5) full-time registered nurses, one full-time clerical support person, and a maximum caseload of 100 families. Currently, the program is servicing about 85 families. BUDGETARY AND FISCAL EFFECT This grant covers personnel and fringe benefits, supplies, training, education, and travel. The total grant award is $516,850.00. One of the requirements of the grant is that the remaining 10% cash match will come from local funds. The City's 10% match for this grant award is $51,685.00. The following request for the 10%match of$51,685 has been included in the health department's budget request for FY 2015, and is pending approval: 001-1301-541.21-00 $ 9,000 001-1301-541.27-00 $ 2,700 001-1301-541.29-00 $ 2,000 001-1301-541.56-00 $29,985 001-1301-541.61-03 $ 8,000 $51,685 • P.R. No. 18331 Page 2 STAFFING EFFECT For FY 2015, staff will consist of six (6) full-time employees (5 nurses and 1 data/entry support person) contingent upon the availability of grant funding. SUMMARY It is recommended that the City Council approve P.R. No. 18331, authorizing approval of Amendment Seven to the Texas Nurse-Family Partnership Program Agreement between the Health and Human Services Commission and the City of Port Arthur for a Nurse-Family Partnership grant in the amount of $516,850.00. This amendment is the grant renewal contract for FY 2015 with a 10% local cash match of$51,685.00. 0 P. R. NO. 18331 7/25/2014-js RESOLUTION NO. A RESOLUTION APPROVING AMENDMENT SEVEN (7) TO THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM AGREEMENT BETWEEN THE HEALTH AND HUMAN SERVICES COMMISSION AND THE CITY OF PORT ARTHUR FOR FY 2015 FOR THE AMOUNT OF $516,850.00 WHEREAS, the State of Texas, by and through the Texas Health and Human Services Commission (HHSC) awarded grant funds to eligible entities to support the establishment and operation of local Nurse-Family Partnership (NFP) programs to provide educational, health, guidance, and other resources for low-income, first-time pregnant women during pregnancy, and during the first two years of their infant's life through visits by highly trained registered nurses; and, WHEREAS, the City of Port Arthur has had an agreement with HHSC for FY 2009 per Resolution No. 08-327 dated July 29, 2008; FY 2010, Resolution No. 09-395 dated September 8, 2009; FYs 2011 and 2012, per Resolution No. 10-286; FY 2013, per Resolution No. 12-381 dated August 7, 2012 and FY 2014, per Resolution No. 13-389 dated September 3, 2013; and, WHEREAS, this Amendment provides for five (5) full-time registered nurses, one (1) full-time clerical support person, and will allow for a caseload of 100 families; and, WHEREAS, HHSC will award grant funds for approximately 90% of the total annual base budget for the Nurse-Family Partnership grant and the City is expected to contribute the remaining 10% from local match funds. P.R. NO. 18331 Page 2-7/25/2014 NOW THEREFORE BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF PORT ARTHUR: Section 1. That, the facts and opinions in the preamble are true and correct. Section 2. That, the City Council of the City of Port Arthur hereby authorizes Amendment seven to the Texas Nurse-Family Partnership Agreement to allow for the grant award for FY 2015 in the amount of$516,850.00 as delineated in Exhibit"A," with the understanding that the grant requires a 10% local match or$51,685.00. Section 3. That the 10%match of$51,685.00 is contingent upon approval of the health department's budget request for FY 2015, which approval is pending adoption of the budget. Section 4. That, a copy of the caption of this Resolution be spread upon the Minutes of the City Council. READ, ADOPTED, AND APPROVED, this day of August 2014, A.D., at a Regular Meeting of the City Council of the City of Port Arthur, Texas by the following Vote: AYES: Mayor: Councilmembers: NOES: P. R. NO. 18331 Page 3—7/25/2014 Mayor ATTEST: Sherri Bellard, City Secretary APPROVED AS TO FORM: Val Tizeno, itylorney APPROVED FOR ADMINISTRATION: u(1L, Jnvtk. f?tY edit, JohnA. Comeaux, P.E. .h.felith Smith, RN, BSN Interim City Manager Director of Health Services APPROVED FOR AVAILABILITY OF FUNDS: Deborah Echols, 'A, Director of Finance EXHIBIT "A" AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT A UNIFORM CONTRACT TERMS&CONDITIONS,VERSION 1.4.1 HHSC's Uniform Contract Terms and Conditions, Version 1.4.1 issued February 4, 2011, can be found at: http://www.hhsc.state.tx.us/about hit sc/Contracting/rfps attch/General TC.pdf. Includes Section 16.01 (HIPAA); Section 16.03 (Member Records); and Section 16.07(Insurance Coverage). 4 FIHSC 529-08-0110-00008G STATE OF TEXAS COUNTY OF TRAVIS AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM ARTICLE I. INTRODUCTION 1 ARTICLE II.AUTHORITY AND OBJECTIVES 1 SECTION 2.01 AUTHORITY. 1 SECTION 2.02 OBJECTIVES. 1 SECTION 2.03 MODIFICATIONS TO AGREEMENT 1 SECTION 2.04 EFFECTIVE DATE. 1 ARTICLE III. AMENDMENT TO THE OBLIGATIONS OF THE PARTIES 2 SECTION 3.01 MODIFICATIONS. 2 ARTICLE IV.AUTHORITY TO EXECUTE 3 Exhibit A: Uniform Contract Terms and Conditions,Version 1.4.1 Exhibit B: Contract Budget Exhibit C: Implementing Agency Obligations Exhibit D: Data Use Agreement,Version 7.4 HHSC 529-08-01.10-00008G STATE OF TEXAS COUNTY OF TRAVIS AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM Article I. INTRODUCTION This Amendment Seven to the HHSC Contract No 529-08-0110-00008 (the"Agreement")is between the Health and Human Services Commission("HHSC"), an administrative agency within the executive department of the State of Texas,having its principal office at 4900 North Lamar Boulevard, Austin, Texas, 78751,and City of Port Arthur("CONTRACTOR"), having its principal office at 449 Austin Ave, Port Arthur, Texas. HHSC and CONTRACTOR may be referred to in this Agreement individually as "Party"and collectively as the"Parties." The Parties agree to amend the Agreement, as amended, HHSC contract number 529-08-0110- 00008, subject to the following terms and conditions. The Parties agree that the modified terms and conditions will apply to the Services and Deliverables to be provided by CONTRACTOR unless further modified or amended by the Parties. Article II. AUTHORITY AND OBJECTIVES. Section 2.01 Authority. The Parties in accordance with Section 6.03(b)(3)of the Agreement execute this Amendment Seven. Section 2.02 Objectives. HHSC contracted with City of Port Arthur to establish and operate a Texas Nurse-Family Partnership Program utilizing the program model developed by and in accordance with Nurse Family Partnership National Service Office. The purpose of this Amendment is to modify certain terms of the original Agreement. Section 2.03 Modifications to Agreement. The Contract is modified for the following purpose: o To extend the term of the contract; o To incorporate HHSC's Uniform Contract Terms and Conditions,Version 1.4.1 (Exhibit A); o To modify General Payment Terms and increase funding for FY 15 (Exhibit B); o To identify the source of funding for this contract; o To incorporate"Implementing Agency Obligations"(Exhibit C); and o To incorporate the Data Use Agreement version 7.4 (Exhibit D). Section 2.04 Effective Date. This agreement is effective September 1, 2014. Article III. AMENDMENT TO THE OBLIGATIONS OF THE PARTIES Section 3.01 Modifications. The original Agreement, as modified by prior Amendments, remains in effect except as modified as listed below under this Amendment G. (1) The term of this Agreement will begin on September 1,2014 and will expire on August 31, 2015. (2) HHSC's Uniform Contract Terms and Conditions, Version 1.4.1, including Section 16.01 (HIPAA); Section 16.03 (Member Records); and Section 16.07(Insurance Coverage), are attached and incorporated as Exhibit A; (3) Amendment of Contract Section 4.02 General Payment Terms. Under this Amendment Seven,HHSC will provide an additional $516,850.00 dollars to the $3,066,520.00 provided under the original agreement,as amended, for a total not to exceed amount of$3,583,370.00. Furthermore, the total cost of the services and deliverables supplied by CONTRACTOR to HHSC during the term beginning September 1, 2014 and ending August 31, 2015 will not exceed$516,850.00. (4) Exhibit`B"Contract Budget is incorporated from September 1, 2014 through August 31, 2015. (5) Contractor is funded with general revenue funds only. (6) To make the duties listed in"Implementing Agency Obligations"applicable to CONTRACTOR(attached and incorporated as Exhibit C). (7) Exhibit"D" incorporates the Data Use Agreement. 2 Article IV. AUTHORITY TO EXECUTE The Parties have executed this contract in their capacities as stated below with authority to bind their organizations on the dates set forth by their signatures. IN WITNESS HEREOF,HHSC and CONTRACTOR have each caused this Agreement to be signed and delivered by its duly authorized representative. HEALTH&HUMAN SERVICES CITY OF PORT ARTHUR COMMISSION KYLE L JANEK,MD JOHN CORNEAUX EXECUTIVE COMMISSIONER INTERIM CITY MANAGER DATE: DATE: 3 AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT B CONTRACT BUDGET 5 EXHIBIT B FY 15 BUDGET Contractor City of Port Arthur HHSC Program Texas Nurse Family Partnership l-HSAS Dept ID MNFP Grant Period 09/01/14 to 08/31/15 FY15 Budget Methodology Justification(if necessary) SALARIES pe $ 64,380 12 months x$5365 FICA 7.65%Retirement 13.99%workers comp 1.37% Medical 22.9% Nurse Supervisor other 2.2% Nurse Supervisor Nurse Home Visitor-I $ 58,527 12 months x $4877 Nurse Home Visitor-2 $ 58,527 12 months x $4877 Nurse Home Visitor-3 $ 58,527 12 months x $4877 Nurse Home Visitor-4 $ 58,527 12 months x$4877 Nurse Home Visitor-5 Nurse Home Visitor-6 Nurse Home Visitor-7 Nurse Home Visitor-8 Admin Assistant $ 30,070 12 months x 2506 Other TOTAL.S4/4R!F,Q $ 328,558. FRINGE Social Security(FICA) $ 25,135 Retirement $ 45,998 Insurance-Medical $ 75,568 Insurance-Dental Insurance-Vision Insurance-Worker's Compensation $ 4,534 Insurance-Unemployment Insurance-Disability Other Longevity/Terminating Pay $ 7,387 7Y)TA!.FRINr,F $ 138622, TRAVEL Mileage @$6 per mile (all nurses combined) $ 1,227 A portion of the mileage cost for 4 nurses to cover 4 counties Statewide Conference Regional Meeting conference for 4 nurse ($500 per Nurse&Supv&Admin) $ 3,000 visiotrs,1 nurse sup,and 1 data entry clerk.(500 x 6) Face to Face Nurse Supervisor Meetings $ 1,000 500 x 2 meetings NSO-Annual Supervisor Meeting $ 1,600 (Denver,CO) NSO Training- Nurse Air fare 550,Hotel 850,food g $ 2,000 400,taxi 100,baggage 1100 This is in case a new nurse will have to be trained in Denver NSO Training-other DANCE re-certification SO Trainin 8 $ 165 f (55x3) Reecerification cost for 3 murses/required by NSO Other $ 926 DANCE training in Houston 463x2. IOTA!TR4YFjs $ 9,918 EQUIPMENT Cell Phone Cellular Usage Fees $ 4,692 391/mth x 12 Cell phone monthly charges for 4 nurses Computers(desktop,laptop,iPad) $ 1,200 600 x2 Cost for 2 Computers. We will need to repalce 2 computers during the next fiscal year. iPad monthly Data Fces $ 2,279 37.99/mth x 5 x12 Copier Rental Client Support(car seats,potty chairs, safety gates,play pens,breast pumps, booster seats..) Other IOTA!.FQU(PMFNT $ 8,171 SUPPLIES Office Supplies $ 4,835 Includes pens,pencils,copier paper,etc Postage and Copies Assessment Tools Program Supplies(diapers...) $ 3,746 Client supplies:teaching videos(english and spanish),pamphlets, educational tools,etc. Marketing Supplies Items purchased to promote NFP. EXHIBIT B FY 15 BUDGET Contractor City of Port Arthur HHSC Program Texas Nurse Family Partnership HHSAS Dept ID MNFP Grant Period 09/01/14 to 08/31/15 FY15 Budget Methodology Justification(if necessary) Other IOTA!,SUPPLJF5 $ 8,581 CONTRACTUAL 2 3 Other TOTAL.CONTRACTUL4/. $ OTHER Facility(rent) Utilities(electric,phone,water...) Professional Development $ 3,000 CEU's or educational meetings Memberships and Dues Other TOTAL OTHER $ 3,000 TOTAL BUDGET PROPOSAL I $ 516,850 Preparer: Charlie Brown,Staff Accountant Approver: Lucy Schroeder,CFO MATCH&IN-KIND SALARIES-Cash $ - SALARIES-In-Kind FRINGE-Cash FRINGE-In-Kind TRAVEL-Cash $ 29,685 TRAVEL-[n-Kind EQUIPMENT -Cash $ 8,000 EQUIPMENT-In-Kind SUPPLIES-Cash $ 13,000 SUPPLIES In-Kind CONTRACTUAL-Cash $ 1,000 CONTRACTUAL-In-Kind OTHER(rent...)-Cash OTHER(rent...)-In-Kind 5 51,685 • AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT C IMPLEMENTING AGENCY OBLIGATIONS Implementing Agency will take all appropriate steps to maintain client confidentiality and obtain any necessary written client consents for data analysis or disclosure of protected health information, in accordance with applicable federal and state laws, including,but not limited to,authorizations, data use agreements,business associate agreements, as necessary. Implementing Agency assumes responsibility for knowledge of and compliance with the State Nurse Practice Act of its state, state laws,regulations,and licensing requirements pertaining to nursing practice and state laws and regulations pertaining to mandatory reporting. Implementing Agency will ensure that nurses whom it employs to implement that Program are able to provide care to clients in a manner consistent with the NFP Visit-to-Visit Guidelines. When requested by NFP through HHSC, Implementing Agency will make reasonable efforts to collect additional data and/or participate in Research approved by HHSC and intended to improve the NFP model or implementation of the model. In order to avoid becoming involved in Research that conflicts with implementing the Program with Fidelity to the Model, Implementing Agency will request HHSCs permission prior to participating in any Research that is(I) initiated by a party other than HHSC and(2)that involves Program staff or explicitly targets the families that are enrolled in the Program. HHSC, in consultation with NFP will review and approve or disapprove Agency's request for participation in such Research on a timely basis and will not unreasonably withhold such approval. Implementing Agency will inform HHSC and NFP of Agency proposals to publish or present NFP- related information in research reports,books,book chapters,peer-reviewed journal articles, and at academic or professional conferences. Results of the Program herein outlined may be published by Implementing Agency, or jointly by Implementing Agency, HHSC and NFP, always giving due credit to the Parties involved and recognizing the rights of the individuals doing the work. Implementing Agency is authorized to reproduce certain published materials specified below and used in the implementation of the Program so long as(1)this Agreement is in effect, (2)Implementing Agency uses the reproductions solely for Program implementation, and (3) Implementing Agency does not sell or otherwise distribute the reproductions to any third party not involved in Agency's implementation of the Program. 6 The published materials covered by this authorization are delivered to Nurse Home Visitors as part of the Nurse-Family Partnership Home Visitor education materials in sets referred to as follows: Pregnancy Facilitators and Handouts Infancy Facilitators and Handouts Toddler Facilitators and Handouts The handouts bear notices indicating copyright by any of the following: University of Colorado University of Colorado Health Sciences Center University of Colorado at Denver and Health Sciences Center Nurse-Family Partnership NFP has the right to grant permission to reproduce materials specified above and that bear the University copyright notice under the terms of a Memorandum of Understanding("MOU") dated March 31, 2003,between the University of Colorado Health Sciences Center, now known as University of Colorado at Denver and Health Sciences Center, and NFP. The MOU gives NFP an exclusive, perpetual, royalty-free right and license to use copyrighted materials and other materials used in the Program for the purpose of implementing the Program to serve low-income, first-time mothers and their families. The corresponding Spanish-language versions of these materials are also covered by this authorization. Implementing Agency may not authorize any other entity to reproduce the materials without prior written permission from NFP. Implementing Agency understands and agrees that all Proprietary Property is owned exclusively by NFP and its licensors, including all intellectual property rights therein. Implementing Agency shall use the Proprietary Property solely for the purpose of carrying out Agency's obligations under this Agreement and shall not modify any Proprietary Property without the prior express written permission of NFP. .Implementing Agency shall protect all Proprietary Property that belongs to NFP or its licensors. Implementing Agency shall not duplicate and shall prohibit distribution of or access to Visit-to-Visit Guidelines and the ETO to any individual or organization not party to the implementation,administration, and operation of the Program,except as authorized by this Agreement. Implementing Agency shall not change or alter the ETO software, and shall allow only trained, NFP-authorized users to access the ETO Website. If a person leaves Implementing Agency's employ, Implementing Agency shall retrieve all Proprietary Property that the person may have in his or her possession. Upon termination of this Agreement, regardless of the timing,cause,or mechanism of such termination: Implementing Agency will no longer have access to ETO or the ETO Website; All software and ETO Website content, excluding data which has been collected by Implementing Agency in the course of implementing the Program, shall remain the sole property of NFP; NFP may retain a record of all data which has been collected by Implementing Agency in the course of implementing the Program and may use that data and reports derived from it to evaluate the overall progress in national replication of the Program; 7 Implementing Agency and NFP will continue to comply with all relevant state, federal laws and all other provisions of this Agreement with respect to maintaining Client confidentiality; All materials in Implementing Agency's possession that utilize the Nurse-Family Partnership logo,tag line,or other protected marks must be returned to NFP or destroyed; All copies of Proprietary Property that have been provided to Implementing Agency by NFP or that have come into Implementing Agency's possession from other sources must be returned to NFP or destroyed; and Implementing Agency will cease to implement the Program and will cease to represent that it is implementing the Program. s AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT D DATA USE AGREEMENT 9 HHSC Contract No.529-08-0 1 1 0-00008G HEALTH AND HUMAN SERVICES COMMISSION DATA USE AGREEMENT DOCUMENT HISTORY LOG STATUS DOCUMENT EFFECTIVE DESCRIPTION REVISION DATE VERSION 1. BASELINE n/a 05/03/2013 Initial HIPAA Omnibus Rule- Version 7 Compliant Version 2. Revision 7.1 06/11/13 1. Updated Information Security Guidelines and Procedures,Attachment 7, adding EISSP, EISSC and "at a minimum" language. 2. Updated Attachment 1, A1.05(5), Method of Confidential Information Access or Transfer, regarding data at rest. 3. Revision 7.2 06/27/13 1. Clarified Attachment 1, A1.05(5), Method of Confidential Information Access or Transfer, regarding data at rest. 2. Revised definition of Business Associates to clarify those without regular PHI access are not BA's. 3. Changed"contract"to "DUA"in Article 4. 4. Revised that HHSC will not sign subcontractor agreement form,Attachment 1,Article A1.03(8)and Attachment 9. 5. Minor, non-substantive punctuation and typographical corrections. 4. Revision 7.3 9/26/12 1. Adding"and"to limitation on data held at rest without encryption, requiring adequate administrative, technical,and physical security. 2. Removed phrases "Business Associate Agreement"and"BAA"in favor of"Data Use Agreement"or"DUA"to clarify that the agreement extends beyond HIPAA compliance. 3. Removed unsuccessful network hacking or pinging attempts from duty to notify by eliminating those from the definition of"Event." 4. Clarify that CPO and CISO are meant to be two FIISC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 1 of 13 HI-1SC Contract No.529-08-01 10-00008G persons, not one person with both titles. 5. Updated breach notice email contact address to: privacv(a.hhsc.state.tx.us 6. Minor,non-substantive punctuation and typographical corrections. 5. Revision 7.4 3/4/13 1. Revised definition of "Legally Authorized Representative"to add • limited powers under Durable POA and add protection and advocacy representative authority. 2. Revised Attachment 1, A1.05(5),to require proof of system,media or device secure and/or encryption when requested by HHSC. 3. Corrected typographical error by insertion of "Event"definition on first page on some 7.3 version forms in use. 4. Minor, non-substantive formative, punctuation and/or typographical corrections. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 2 of 13 HHSC Contract No.529-08-01 I0-00008G DATA USE AGREEMENT BETWEEN HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR("CONTRACTOR") ARTICLE 1. PURPOSE 4 ARTICLE 2. DEFINITIONS 4 Section 2.01 Definition of Confidential Information 4 Section 2.02 Other Definitions 5 ARTICLE 3. Data Use Terms and Conditions 12 ARTICLE 4. Authority To Execute 13 ATTACHMENT 1.Access, Use, Disclosure of Confidential Information 1 Section A1.01 Ownership of Confidential Information 1 Section A 1.02 General Obligations of CONTRACTOR 1 Section A1.03 Specific Duties and Obligations of CONTRACTOR 1 Section A1.04 Other Permissible Uses and Disclosures of PHI by CONTRACTOR 2 Section A 1.05 Security Requirements for Confidential Information 3 Section A1.06 Breach Notification, Report and Mitigation Requirements 5 ATTACHMENT 2.Scope of Work 1 ATTACHMENT 3.Other Obligations of CONTRACTOR 1 Section A3.01 Location of Confidential Information; Custodial Responsibility '1 Section A3.02 PHI in Designated Record Set 1 Section A3.03 CONTRACTOR Recordkeeping,Accounting and Disclosure Tracking 1 ATTACHMENT 4.Disposition of Confidential Information 1 Section A4.01 CONTRACTOR's Duty in General 1 Section A4.02 Return or Destruction of Confidential Information 1 ATTACHMENT 5.General Provisions 1 Section A5.01 HHSC commitment and obligations 1 Section A5.02 HHSC Right to Inspection 1 Section A5.03 Access to PHI 1 Section A5.04 Term of DUA 1 Section A5.05 Publication 2 Section A5.06 Governing Law, Venue and Litigation 2 Section A5.07 Injunctive Relief 2 Section A5.08 Indemnification 3 Section A5.09 Insurance 3 Section A5.10 Fees and Costs 3 Section A5.11 Entirety of the Base Contract 4 Section A5.12 Automatic Amendment and Interpretation 4 ATTACHMENT 6.Confidential Information 1 ATTACHMENT 7.Security Guidelines and Procedures 1 ATTACHMENT 8.List of Authorized Users 1 ATTACHMENT 9.Subcontractor Agreement Form 1 HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 3 of 13 HHSC Contract No.529-08-01 I 0-00008G STATE OF TEXAS COUNTY OF TRAVIS DATA USE AGREEMENT BETWEEN HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR("CONTRACTOR") This Data Use Agreement("DUA"), effective as of the date signed below("Effective Date"), is entered into by and between Health and Human Services Commission ("HHSC") and City of Port Arthur ("CONTRACTOR"), and incorporated into the terms of the "Base Contract" entered into by these parties, HHSC Contract No.529-08-0110-00008. ARTICLE 1.PURPOSE CONTRACTOR must create, receive, maintain, or have access to information about HHSC programs and/or its clients for HHSC program benefits and services, as described in the Base Contract. This information is deemed confidential under the Base Contract and state and federal law. CONTRACTOR acknowledges the sensitive and confidential nature of this information and agrees that it will take all necessary and reasonable measures to preserve and protect the confidentiality,privacy,security, integrity,and availability of the HHSC information. The purpose of this DUA is to facilitate creation, receipt, maintenance and access to Confidential Information with CONTRACTOR, and clarify CONTRACTOR's obligations with respect to the Confidential Information. This DUA expressly describes the limited purposes for which the CONTRACTOR may create, receive, maintain, or have access to Confidential Information, and establishes CONTRACTOR's rights and responsibilities concerning the information. This DUA also describes HHSC's remedies in the event of CONTRACTOR's noncompliance with its obligations under this DUA. As of the Effective Date of this DUA, if Article 10, Section 16.01 of HHSC's UNIFORM TERMS AND CONDITIONS conflicts with this DUA,this DUA controls. ARTICLE 2. DEFINITIONS For the purposes of this DUA,the following terms below have the meanings set forth below. Section 2.01 Definition of Confidential Information For the purposes of this DUA,the term"Confidential Information"and other terms have the meaning set forth below. Capitalized terms included have the meanings set forth in Section 2.02 below. "Confidential Information" means any communication or record (whether oral, written, electronically stored or transmitted,or in any other form)that consists of or includes any or all of the following: (1) Client Information; (2) Protected Health Information in any form including without limitation, Electronic Protected Health Information or Unsecured Protected Health Information; (3) Sensitive Personal Information as defined by Texas Business and Commerce Code Ch. 521; HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 4 of 13 HHSC Contract No.529-08-01 10-00008G (4) Federal Tax Information; (5) Personally Identifiable Information; (6) Social Security Administration Data; (7) All non-public budget,expense,payment and other financial information; (8) All privileged work product; (9) All information designated as confidential under the laws of the State of Texas and of the United States; (10) To the extent permitted under the laws and constitution of the State of Texas, all information designated by HHSC or any other State agency as confidential, including but not limited all information designated as confidential under the Texas Public Information Act,Texas Government Code, Chapter 552; (11) Information that CONTRACTOR has access to or that is created, utilized, developed, received, or maintained by HHSC, the CONTRACTOR, or participating State agencies for the purpose of fulfilling a duty or obligation under this DUA and that has not been publicly disclosed; (12) Information identified in Attachment 6 attached to this DUA and to which CONTRACTOR specifically seeks to obtain access for an Authorized Purpose. Section 2.02 Other Definitions For the purposes of this DUA,the following terms have the meanings set forth below. "Authorized Purpose" means the specific purpose or purposes described in the Scope of Work of the Base Contract for Contractor to fulfill its obligations under the Base Contract,or any other purpose expressly authorized by HHSC in writing in advance. "Authorized User"means a Person: (1) Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze Confidential Information pursuant to this DUA; (2) For whom CONTRACTOR warrants and represents has a demonstrable need to know and have access to the Confidential Information; and (3) Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA, such agreement evidenced by each Authorized User's signature on the form attached to this DUA as Attachment 8. "Business Associate" means a Person or organization, other than a member of HHSC's workforce,that performs, on behalf of HHSC, certain functions, activities, or services that create, receive, maintain, have access to or transmit Protected Health Information ("PHI") such as without limitation activities listed in the HIPAA definition and regulation of Business Associates. CONTRACTOR and CONTRACTOR's Subcontractor(s), to the extent applicable to the Base Contract, are "Business Associates" of HHSC for purposes of this DUA, if a Business Associate subcontracts part of its business associate function requiring the Subcontractor to create,receive,maintain,have access to or transmit PHI,except to the extent Contractors are on an HHSC site and treated as Workforce or are conduits as described by HIPAA. "Business Associate" excludes a mere conduit that does not require access to PHI. Business Associates are entities, for example and without limitation and to the extent applicable to the Base Contract: entities that provide data transmission services to HHSC and require access on a routine basis to PHI; entities that offer a personal health record on behalf of a covered entity; a Subcontractor, if a business associate subcontracts part of its HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 5 of 13 HHSC Contract No.529-08-0 I I 0-00008G function subject to this Agreement; a Person who creates, receives, maintains or transmits PHI on behalf of HHSC; or physical storage facilities or companies that store paper or electronic PHI. Business Associates do not include entities, for example and without limitation and to the extent applicable to the Base Contract: a telecommunications company or mail courier without regular access to PHI. The meaning,application of and regulation of Business Associates are more fully described in the HIPAA Privacy, Security and Breach Regulations. "Breach" means any unauthorized acquisition, access, use, or disclosure of Confidential Information in a manner not permitted by this DUA,the Base Contract or applicable law. Additionally: (1) HIPAA Breach of PHI. With respect to Protected Health Information ("PHI")pursuant to HIPAA Privacy and Breach Notification Regulations and regulatory guidance, any unauthorized acquisition, access, use, or disclosure of PHI in a manner not permitted by the HIPAA Privacy Regulations is presumed to be a Breach unless CONTRACTOR, as applicable, demonstrates that there is a low probability that the PHI has been compromised. Compromise will be determined by a documented Risk Assessment including at least the following factors: 1. The nature and extent of the Confidential Information involved, including the types of identifiers and the likelihood of re-identification of PHI; 2. The unauthorized person who used or to whom PHI was disclosed; 3. Whether the Confidential Information was actually acquired or viewed;and 4. The extent to which the risk to PHI has been mitigated. With respect to PHI, a"breach," pursuant to HIPAA Breach Regulations and regulatory guidance excludes: (A) Any unintentional acquisition, access or use of PHI by a workforce member or person acting under the authority of HHSC or CONTRACTOR if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Regulations. (B) Any inadvertent disclosure by a person who is authorized to access PHI at HHSC or CONTRACTOR to another person authorized to access PHI at the same HHSC or CONTRACTOR location, or organized health care arrangement, as defined by, in which HHSC participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the HIPAA Privacy Regulations. (C) A disclosure of PHI where CONTRACTOR demonstrates a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information, pursuant to HIPAA Breach Regulations and regulatory guidance. (2) Texas Breach. Breach means "Breach of System Security," applicable to electronic Sensitive Personal Information (SPI) as defined by the Texas Breach Law. The currently undefined phrase in the Texas Breach Law, "compromises the security,confidentiality, or integrity of sensitive personal information," will be interpreted in HHSC's sole discretion, including without limitation, directing CONTRACTOR to document a Risk Assessment of any reasonably likelihood of harm or loss to an individual, taking into consideration relevant fact-specific information about the breach, including without limitation, any legal requirements the unauthorized person is subject to regarding Confidential Information to protect and further safeguard the data from unauthorized use or disclosure, or the receipt of satisfactory assurance from the person that the person HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 6 of 13 HHSC Contract No.529-08-01 10-00008G agrees to further protect and safeguard, return and/or destroy the data to the satisfaction of HHSC. Breached SPI that is also PHI will be considered a HIPAA breach, to the extent applicable. (3) Any unauthorized use or disclosure as defined by any other law and any regulations adopted there under regarding Confidential Information. "Client Information" means Personally Identifiable Information about or concerning recipients of benefits under one or more public assistance programs administered by HHSC. "De-Identified Information" means health information, as defined in the HIPAA Privacy Regulations as not PHI regarding which there is no reasonable basis to believe that the information can be used to identify an individual. HHSC has determined that health information is not individually identifiable and there is no reasonable basis to believe that the information can be used to identify an individual only if: (1) The following identifiers of the Individual or of relatives, employers, or household members of the individual,are removed from the information: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county,precinct,zip code,and their equivalent geocodes,except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (i) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (ii) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an Individual, including birth date, admission date,discharge date,date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers (including without limitation, Medicaid Identification Number); (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators(URLs); HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 7 of 13 HHSC Contract No.529-08-01 10-00008G (0) Internet Protocol(IP)address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph(C)of this section; and (2) Neither HHSC nor CONTRACTOR has actual knowledge that the information could be used alone or in combination with other information to identify an Individual who is a subject of the information." "Designated Record Set" means a group of records maintained by or for a covered entity that is: (i)the medical records and billing records about Individuals maintained by or for a covered health care provider;(ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or(iii)used, in whole or in part,by or for the covered entity to make decisions about individuals. For purposes of this definition, "record"means any item, collection, or grouping of information that includes PHI and is maintained,collected,used,or disseminated by or for a covered entity. "Destroy" for Confidential Information means,as specified in the HIPAA Security Rule Regulations: (1) Paper, film, or other hard copy media have been shredded or destroyed such that the Confidential Information without limitation including PHI cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction. (2) Electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88, "Guidelines for Media Sanitization," such that the Confidential Information without limitation including PHI cannot be retrieved. "Discovery" means the first day on which an Event or Breach becomes known to CONTRACTOR, or, by exercising reasonable diligence would have been known to CONTRACTOR, and includes Events or Breaches discovered by or reported to CONTRACTOR by its officers, directors, employees, agents, work force members,Subcontractors or third-parties(such as legal authorities and/or Individuals). "Electronic Health Record" means an electronic record of health-related information on an Individual that is created,gathered,managed,and consulted by authorized health care clinicians and staff. "Electronic Protected Health Information" ("EPHI") means any PHI which is maintained or transmitted by"Electronic Media"as defined in HIPAA,45 C.F.R. §160.102. "Encryption" of Confidential Information means, as described in HIPAA, 45 C.F.R. §164.304 of the HIPAA Security Regulations, the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without the use of a confidential process or key and such confidential process or key that might enable decryption has not been Breached. To avoid a Breach of the confidential process or key,these decryption tools will be stored on a device or at a location separate from the data they are used to encrypt or decrypt. "Event" means a potential, suspected or attempted unauthorized access, use, disclosure, modification, loss or destruction of Confidential Information, which has the potential for jeopardizing the confidentiality, integrity or availability of the Confidential Information, but excludes completed, unsuccessful hacking events using common tools such as PING .netstat, telnet, tracert, etc. An Event becomes a Breach when the event involves actual unauthorized access, use, disclosure, modification, loss or destruction of Confidential HHSC Data Use Agreement V.7.4. HIPAA Omnibus Compliant April 23,2014 Page 8 of 13 HHSC Contract No.529-08-0 110-00008G Information, which has the potential for jeopardizing the confidentiality, integrity or availability of the Confidential Information. "Federal Tax Information" has the meaning assigned in the Internal Revenue Code, Title 26 of the United States Code and regulations adopted under that code. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH ACT and regulations thereunder including without limitation HIPAA Omnibus Rules, in 45 CFR Parts 160 and 164. Public Law 104-191 (42 U.S.C. §1320d, etseq.); Public Law 111-5 (42 U.S.C. §13001 et. seq.);including without limitation regulations and guidance issued by the Secretary,such as 65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 74 FR 19006, April 27,2009;75 FR 40868,July 14,2010;and 78 FR 5695,Jan.25,2013. "HIPAA Breach Regulations" means the HIPAA Breach Notification Regulations codified at 45 C.F.R. Part 160 and 45 C.F.R.Part 164, Subpart D relating to unsecured PHI. "HIPAA Omnibus Rules" means the rule modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules under the HITECH Act and the Genetic Information Nondiscrimination Act; and other modifications published in Federal Register Vol.78,January 25,2013 which include: (1) Final modifications to the HIPAA regulations mandated by the HITECH Act, and certain other modifications of the Rules to improve the HIPAA rules; (2) Final rule adopting changes to the HIPAA Enforcement Rule; (3) Final rule on HIPAA Breach Regulations for unsecured PHI under the HITECH Act;and (4) Final rule modifying the HIPAA Privacy Regulations as required by the Genetic Information Nondiscrimination Act of 2008(GINA). "HIPAA Privacy Regulations" means the HIPAA Privacy Regulations codified at 45 C.F.R. Part 160 and 45 C.F.R.Part 164,Subpart A,Subpart D and Subpart E. "HIPAA Security Regulations" means the HIPAA Security Regulations codified at 45 C.F.R. Part 160 and 45 C.F.R.Part 164 Subpart A and Subpart C,and Subpart D. "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act(P.L. 111-5),and regulations adopted under that act. "Individual" means the subject of the Confidential Information, including without limitation PHI, and who will include the subject's Legally authorized representative who qualifies under the HIPAA Privacy Regulation as a Legally authorized representative of the Individual wherein HIPAA defers to Texas law for determination, for example, without limitation as provided in Tex. Occ. Code § 151.002(6); Tex. H. & S. Code§166.164; Texas Prob.Code§3 and Tex.Estates Code§§752.051,752.112. "Legally authorized representative" of the Individual, as defined by Texas law, for example, without limitation as provided in Tex. Occ. Code § 151.002(6); Tex. H. & S. Code §166.164; Estates Code Ch. 752 and Texas Prob. Code§3,includes: (1) A parent or legal guardian if the Individual is a minor; (2) A legal guardian if the Individual has been adjudicated incompetent to manage the Individual's personal affairs; HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 9 of 13 HHSC Contract No.529-08-01 I0-00008G (3) An agent of the Individual authorized under a Medical Power of Attorney; (4) An agent of the Individual authorized under a Durable, Statutory or non-medical Power of Attorney, limited to certain powers over benefits from certain governmental programs, including without limitation Medicaid, as defined by Texas Estates Code §752.112, effective Jan. 1,2014. (5) An attorney ad litem appointed for the Individual; (6) A guardian ad litem appointed for the Individual; (7) A personal representative or statutory beneficiary if the Individual is deceased; (8) An attorney retained by the Individual or by another person listed herein; (9) If an individual is deceased, their personal representative must be the executor, independent executor, administrator, independent administrator, or temporary administrator of the estate; pr (10) To a state-designated Protection and Advocacy system to the extent that such disclosure is Required by Law and the disclosure complies with the requirements of that law. "Information Security Guidelines and Procedures" means the information security guidelines, procedures,protocols,and other documents or information identified in Attachment 7 to this DUA. "Limited Data Set" means PHI that excludes the following direct identifiers of the Individual or of relatives,employers,or household members of the individual as defined at 45 CFR 164.514(e)(2): (1) names; (2) postal address information, other than town or city, State, and zip code; (3) telephone numbers; (4) fax numbers; (5) electronic mail addresses; (6) Social Security numbers; (7) medical record numbers; (8) health plan beneficiary numbers; (9) account numbers; (10) certificate/license numbers; (11) vehicle identifiers and serial numbers, including license plate numbers; (12) device identifiers and serial numbers; (13) web universal resource locators(URLs); (14) internet protocol(IP)address numbers; (15) biometric identifiers, including finger and voice prints;and (16) full face photographic images and any comparable images. HHSC Data Use Agreement V.7.4. HIPAA Omnibus Compliant April 23,2014 Page 10 of 13 HHSC Contract No.529-08-01 10-00008G "Person" means without limitation, an employee, agent, representative, firm, corporation, organization, Subcontractor,a member of the general public,or a consumer. "Personally Identifiable Information" or "PII" means information that can be used to uniquely identify,contact, or locate a single Individual or can be used with other sources to uniquely identify a single Individual. "Protected Health Information" or "PHI" means individually identifiable health information in any form that is created or received by a HIPAA covered entity, and relates to the individual's healthcare condition, provision of healthcare, or payment for the provision of healthcare, as further described and defined in the HIPAA. PHI includes demographic information unless such information is De-identified, as defined above. PHI includes without limitation,"Electronic Protected Health Information"as defined above, and unsecure PHI. PHI includes PHI of a deceased individual within 50 years of the date of death. "Required by Law"shall have the same meaning as the term"required by law" in 45 CFR 164.103 but applies to all Confidential Information,not only PHI. "Scope of Work" means the services and deliverables to be performed or provided by CONTRACTOR, or on behalf of CONTRACTOR by its Subcontractors or agents for HHSC that are described in Attachment 2 attached to this DUA. If the Scope of Work includes or consists of a written proposal by the CONTRACTOR, any conflict between such proposal and the other terms of the Base Contract or this DUA will be resolved, in HHSC's sole discretion, by giving effect to the other terms of the Base Contract or this DUA. "Secretary" means the United States Secretary of the Department of Health and Human Services or designee. "Social Security Administration Data" means disclosures of records, information,or data made by the Social Security Administration to HHSC for its administration of federally funded benefit programs under various provisions of the Social Security Act, such as Section 1137 (42 U.S.C. §§ 1320b-7), including the state-funded state supplementary payment programs under Title XVI of the Act, in accordance with the requirements of the Privacy Act of 1974,as amended by the Computer Matching and Privacy Protection Act of 1988,5 U.S.C. § 552a. "Subcontractor" means a Person or who is not the Workforce of a Business Associate to whom a Business Associate delegates a function, activity or services conducted on behalf of HHSC, as more fully described in HIPAA Regulations. "Texas Breach Law" means the Texas Identity Theft Enforcement and Protection Act, Texas Business &Commerce Code Ch.521 and Texas Government Code §2054.1125. "Unsecured Protected Health Information" means Protected Health Information that is not rendered unusable, unreadable, or indecipherable to unauthorized Persons through the use of a technology or methodology specified by the Secretary in HITECH Act regulations and HIPAA Security Regulations. Unsecured Protected Health Information does not include: (1) Encrypted Electronic Protected Health Information;or (2) Destruction of the media on which the PHI is stored. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 11 of 13 HHSC Contract No.529-08-01 10-00008G All terms used in this DUA that are not otherwise defined in this DUA have the same meaning as those terms in HIPAA or other applicable law relating to CONTRACTOR's use or disclosure of Confidential Information on behalf of HHSC. "Workforce" means employees, volunteers, trainees, and other Persons whose conduct, in the performance of work for HHSC, is under the direct control of HHSC,whether or not they are paid by HHSC. ARTICLE 3.DATA USE TERMS AND CONDITIONS The Data Use Terms and Conditions are described in attachments to this DUA and are incorporated by reference. Requirements to create, receive, maintain, use, disclose, have access to or transmit Confidential Information are described in Attachment 1. The Scope of Work is described in Attachment 2. Other Obligations of CONTRACTOR are described in Attachment 3. CONTRACTOR obligations regarding disposition of Confidential Information are described in Attachment 4. General provisions related to this DUA are described in Attachment 5. A description of Confidential Information related to this DUA is provided in Attachment 6. Information Security Guidelines and Procedures are described in Attachment 7. The List of CONTRACTOR's Authorized Users under this DUA is provided in Attachment 8. The Form Subcontractor Agreement is provided in Attachment 9. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Page 12 of 13 l{11SC Contract No.529-08-0110-00008G ARTICLE 4. AUTHORITY To EXECUTE The Parties have executed this DUA in their capacities as stated below with authority to bind their organizations on the dates set forth by their signatures. IN WITNESS HEREOF, HHSC and CONTRACTOR have each caused this DUA to be signed and delivered by its duly authorized representative: HEALTH AND HUMAN SERVICES COMMISSION CONTRACTOR BY: BY: NAME: NAME: TITLE: TITLE: DATE ,201 . HHSC Data Use Agreement V.7.4. HIPAA Omnibus Compliant April 23,2014 Page 13 of 13 HHSC Contract No. 529-08-0110-00008G ATTACHMENT 1. ACCESS, USE, DISCLOSURE OF CONFIDENTIAL INFORMATION Section A1.01 Ownership of Confidential Information CONTRACTOR acknowledges and agrees that the Confidential Information is and will remain the property of HHSC. CONTRACTOR agrees it acquires no title or rights to the Confidential Information, including without limitation, PHI, Limited Data Sets and/or De-identified information, as a result of this DUA. Section A1.02 General Obligations of CONTRACTOR CONTRACTOR acknowledges and agrees that it may create, receive, maintain, use, disclose, have access to or transmit Confidential Information only for an Authorized Purpose, and that it may not disclose any Confidential Information to a third party except as may be expressly authorized under this DUA or as Required by Law. HHSC will allow CONTRACTOR to create,receive, maintain,use,disclose,have access to or transmit Confidential Information for an Authorized Purpose, provided CONTRACTOR complies in all respects with the terms and conditions of this DUA and law applicable to the Confidential Information. Section A1.03 Specific Duties and Obligations of CONTRACTOR (1) CONTRACTOR agrees, in consideration of HHSC's allowing CONTRACTOR to create, receive,maintain,use,disclose,have access to or transmit Confidential Information, that: (A) CONTRACTOR will hold the Confidential Information in trust and in strictest confidence; (B) CONTRACTOR will take all measures necessary to prevent any portion of the Confidential Information from: (i) Being used in a manner that is not expressly an Authorized Purpose under this DUA or as Required by Law; (ii) Falling into the public domain; or (iii) Falling into the possession of Persons not bound to maintain the confidentiality of the Confidential Information. (C) The minimum measures taken by CONTRACTOR pursuant to this Section include the exercise of reasonable care and at least the same degree of care as CONTRACTOR protects its own confidential, proprietary and trade secret information. (D) CONTRACTOR will not, without HHSC's prior written consent, disclose or allow access to any portion of the Confidential Information to any Person or other entity, other than Authorized User employees or Subcontractors of CONTRACTOR. (E) CONTRACTOR will, where provided, comply with the applicable provisions of HIPAA and other law applicable to Confidential Information relating to CONTRACTOR's creation, receipt, maintenance, use, disclosure, access to or transmission of Confidential Information on behalf of HHSC. (2) CONTRACTOR will have the limited right to create, receive,maintain,use,disclose,have access to or transmit the Confidential Information solely and exclusively for an Authorized Purpose, provided that such would not violate HIPAA or other applicable law relating to Confidential Information if such use or disclosure had been made by HHSC. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 1 of 7 HHSC Contract No. 529-08-01 10-00008G (3) CONTRACTOR will allow access to or disclose Confidential Information only to those Subcontractors or Workforce who are Authorized Users trained in data privacy and security and who have a reasonable and demonstrable need to create, receive, maintain, use, disclose, have access to or transmit the Confidential Information to carry out CONTRACTOR's obligations in connection with the Authorized Purpose. (4) CONTRACTOR will establish, implement and maintain appropriate sanctions against any Workforce or Subcontractor who fails to comply with an Authorized Purpose in violation of this DUA,the Base Contract or applicable law. (5) CONTRACTOR will not, without prior written approval of HHSC, disclose or provide access to any Confidential Information on the basis that such act is Required by Law without notifying HHSC so that HHSC may have the opportunity to object to the disclosure or access and seek appropriate relief. If HHSC objects to such disclosure or access, CONTRACTOR will refrain from disclosing or providing access to the Confidential Information until HHSC has exhausted all alternatives for relief. Such disclosures of PHI are also addressed in Section 3.04(3),below. (6) CONTRACTOR will limit creation, receipt, maintenance, use, disclosure, access to or transmission of Confidential Information to the minimum necessary to accomplish an Authorized Purpose. (7) CONTRACTOR will not attempt to re-identify or further identify Confidential Information or De-identified Information, or attempt to contact any Individuals whose records are contained in the Confidential Information, except for an Authorized Purpose, without express written authorization from HHSC or as expressly permitted by the Base Contract. (8) CONTRACTOR will not permit or enter into any agreement with a Subcontractor to create,receive, maintain,use, disclose,have access to or transmit Confidential Information, on behalf of CONTRACTOR without express written approval of HHSC, in advance. HHSC prior approval, at a minimum will require that: (A) Subcontractor and CONTRACTOR execute the Form Subcontractor Agreement, Attachment 9, which ensures the subcontract contains identical terms, conditions, safeguards and restrictions as contained in this DUA for PHI and any other relevant Confidential Information and which permits more strict limitations: (B) The Subcontractor is approved by HHSC through the official Base Contract correspondence process; and (C) HHSC will be a third-party beneficiary to any agreement between the CONTRACTOR and a Subcontractor or third-party related to the Confidential Information, and HHSC will have the right but not the obligation to enforce the terms of any such agreement directly against the Subcontractor or third party. (9) The obligations of CONTRACTOR under this section are in addition to the duties of CONTRACTOR with respect to Confidential Information described elsewhere in the DUA,the Base Contract or applicable law. Section A1.04 Other Permissible Uses and Disclosures of PHI by CONTRACTOR Except as otherwise limited by this DUA, the Base Contract or law applicable to the Confidential Information, CONTRACTOR, as a HIPAA Business Associate of HHSC„ without limiting other requirements applicable to HHSC Confidential Information, such as PHI,may: HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment I Page 2 of 7 HHSC Contract No.529-08-0110-00008G (1) Create, receive, maintain, use, disclose, have access to or transmit PHI to perform the Services and Deliverables of the Base Contract,provided that such: (A) is not a violation of HIPAA if done by HHSC; (B) is limited to the minimum necessary to accomplish Authorized Purposes; and (C) is done in compliance with applicable privacy and security standards for the Confidential Information. (2) Use PHI for the proper management and administration of CONTRACTOR or to carry out CONTRACTOR's legal responsibilities. (3) Disclose PHI for the proper management and administration of CONTRACTOR or to carry out CONTRACTOR's legal responsibilities if: (A) Disclosure is Required by Law, provided CONTRACTOR complies with Section A1.03(5); (B) CONTRACTOR obtains reasonable assurances from the Person to whom the information is disclosed that the Person will: (i) Maintain the confidentiality of the Confidential Information; (ii) Only use or further disclose the information only as Required by Law or for the Authorized Purpose for which it was disclosed to the Person;and (iii) Notify CONTRACTOR of any Event or Breach of Confidential Information of which the Person discovers or should have discovered with the exercise of reasonable diligence,as described in Section A1.06. (4) Use PHI to provide data aggregation services to HHSC, as that term is defined in the HIPAA, 45 C.F.R. §164.501 and permitted by 45 C.F.R. §164.504(e)(2)(i)(B) and other applicable provisions of HIPAA. Section A1.05 Security Requirements for Confidential Information (1) Secure creation, maintenance, use, disclosure or transmission. CONTRACTOR will create, maintain, use, disclose, transmit or destroy Confidential Information in a secure fashion. CONTRACTOR must: (A) Ensure the confidentiality, integrity,and availability of all Confidential Information including without limitation electronic PHI that CONTRACTOR creates,receives,maintains,or transmits; (B) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information; (C) Protect against any reasonably anticipated uses or disclosures of such information that are unauthorized; (D) Ensure security compliance by training or and sanctions for violations against CONTRACTOR'S Workforce; and (E) Review and modify the security measures implemented as needed to continue provision of reasonable and appropriate protection of Confidential Information, and update documentation of such security measures. (2) Safeguards. CONTRACTOR will establish, implement and maintain any and all appropriate procedural, administrative, physical and technical safeguards to preserve and HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 3 of 7 HHSC Contract No. 529-08-0110-00008G maintain the confidentiality, integrity, and availability of the Confidential Information, and with respect to PHI, as described in the HIPAA Privacy and Security Regulations, or other applicable laws or regulations relating to Confidential Information,to prevent any unauthorized use or disclosure of Confidential Information as long as CONTRACTOR has such Confidential Information in its actual or constructive possession. (3) Security Program. CONTRACTOR will establish, implement and maintain an ongoing security program for Confidential Information, including without limitation for PHI in compliance with the HIPAA Security Regulations that must: (A) Address administrative,physical,and technical safeguards that reasonably and appropriately protects the confidentiality, integrity, and availability of the Confidential Information,including without limitation PHI,that it creates, receives,maintains,or transmits on behalf of HHSC as in specified. (B) Address systems of risk assessment and periodic assessments,risk management security measures and information system activity risk reviews. (C) Designate and identify two Persons,as 1) Chief Privacy Officer and 2)Chief Information Security Officer, each of whom are considered Key Personnel in the Base Contract subject to HHSC approval or rejection,responsible for the development and implementation of the privacy and security requirements in this DUA. (D) Require Workforce training and sanctions for any CONTRACTOR Director, Officer,Workforce,employee, Subcontractor,or agent who violates the requirements regarding Confidential Information in this DUA,the Base Contract, or laws or regulations applicable to the Confidential Information. (E) Implement, update as necessary and document reasonable and appropriate policies and procedures to comply with the privacy and security requirements of this DUA. (F) Implement update as necessary and document policies,procedures,and an Incident Response Plan, in advance of conducting work under the DUA,for mitigating,to the maximum extent practicable, any harmful effect of an unauthorized use or disclosure of Confidential Information or a breach, including without limitation, PHI. (4) Security Policies and Procedures Production and Approval. CONTRACTOR will produce copies of its information security and privacy policies and procedures for HHSC's review and approval upon request by HHSC the following business day or other agreed upon time frame, and make available to the Secretary, in a time and manner reasonably agreed upon or designated by the Secretary, for purposes of the Secretary determining HHSC's or CONTRACTOR's compliance with HIPAA. (5) Method of Confidential Information Access or Transfer. All transmissions of Confidential Information by CONTRACTOR will be conducted securely. Secure transmissions of electronic Confidential Information in motion include secure File Transfer Protocol (SFTP) or Encryption at an appropriate level or otherwise protected as required by rule, regulation or law. Secure transmissions of electronic HHSC Confidential Information at rest requires Encryption unless there is adequate administrative, technical, and physical security, or as otherwise protected as required by rule, regulation or law. All electronic data transfer and communications of Confidential Information will be through secure systems. Proof of system, media or device security and/or Encryption must be produced to HHSC no later than 48 hours after HHSC's written request in response to the Discovery of an Event or Breach. Otherwise, requested HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 4 of 7 HHSC Contract No. 529-08-0110-00008G production of such proof will be made as agreed upon by the parties. Redaction is specifically excluded as a means to ensure security. De-identification of HHSC Confidential Information is a means of security. With respect to de-identification of PHI, "secure" means de-identified according to HIPAA Privacy standards and regulatory guidance. (6) Information Security Guidelines and Procedures. CONTRACTOR will comply with the requirements and guidelines identified in Attachment 7 of this DUA to ensure the security and confidentiality of the Confidential Information. Section A1.06 Breach Notification,Report and Mitigation Requirements (1) Breach or Event Notification to HHSC. (A) Because HHSC is subject to one-hour reporting under Internal Revenue Services, Social Security Administration and CMS Medicaid requirements, CONTRACTOR will immediately, within the first, consecutive clock hour, or in a timeframe otherwise approved by HHSC in writing, initially report to HHSC's Privacy and Security Officers via email at: privacy @hhsc.state.tx.us, and report as required by the Base Contract all available information about the Discovery of an Event or a Breach of the privacy or security of Confidential Information which is not in compliance with the terms of the DUA, the Base Contract or other laws applicable to Confidential Information. (B) CONTRACTOR will cooperate fully with HHSC in investigating,mitigating to the extent practicable and issuing notifications directed by HHSC, for any Event or Breach of Confidential Information to the extent and in the manner determined by HHSC. (C) CONTRACTOR'S obligation begins at the Discovery of an Event or Breach and continues as long as related activity continues, until all effects of the Event are mitigated to HHSC's satisfaction. (D) No later than 48 consecutive clock hours after Discovery, or a time within Discovery reasonably should have been made of an Event or Breach of Confidential Information, or within a timeframe otherwise approved by HHSC in writing, provide formal notification to the State. Such notice will include all reasonably available information about the Event or Breach, including without limitation and to the extent available: 1) The date the Event or Breach occurred; 2) The date of CONTRACTOR's and if applicable Subcontractor's Discovery; 3) A brief description of the Event or Breach; 4) A description of the types and amount of Confidential Information involved; 5) Identification of and number of all Individuals reasonably believed to be affected, including first and last name of the individual and if applicable the, legally authorized representative, last known address,age,telephone number, and email address if it is a preferred contact method, to the extent known or can be reasonably determined by CONTRACTOR; 6) CONTRACTOR's initial Risk Assessment of the Event or Breach required by applicable law or this DUA for HHSC approval; HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 5 of 7 HHSC Contract No. 529-08-01 10-00008G 7) CONTRACTOR's recommendation for HHSC's approval as to the steps Individuals and/or CONTRACTOR on behalf of Individuals, should take to protect the Individuals from potential harm, including without limitation CONTRACTOR's provision of notifications, credit protection, claims monitoring, and any specific protections for a legally authorized representative to take on behalf of an Individual with special capacity or circumstances; 8) Contact procedures for Individual to ask questions or learn additional information,including the name and title of a CONTRACTOR representative and a toll free telephone number, an e-mail address and website or postal address; 9) The status of CONTRACTOR's investigation; 10) The steps CONTRACTOR has taken to mitigate the harm or potential harm caused (including without limitation the provision of sufficient resources to mitigate); 11) The steps CONTRACTOR has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Event or Breach; 12) A description of how the Event or Breach occurred, who is responsible for the occurrence, or estimations thereof; 13) Identify, describe or estimate of the Persons, Workforce, Subcontractor, or Individuals and any law enforcement that may be involved in the Event or Breach; 14) Name a single point of contact and a back-up for CONTRACTOR, with applicable full contact information for both on and off business hours for HHSC to communicate with during the incident response; 15) A reasonable schedule for CONTRACTOR to provide regular updates to the foregoing in the future, as directed by and approved by HHSC for response to the Event or Breach, but no less than every three (3) business days or as otherwise directed by HHSC, including estimation date investigation, reporting, if any, notification, if any, mitigation and root cause analysis is expected to be completed;and 16) Any reasonably available, pertinent information, documents or reports related to an Event or Breach that HHSC requests following Discovery. (2) Investigation,Response and Mitigation. (A) CONTRACTOR will immediately conduct a full and complete investigation, respond to the Event or Breach, will commit necessary and appropriate staff and resources to expeditiously respond, and report as required to and by HHSC for incident response purposes and for purposes of HHSC's compliance with report and notification requirements,to the satisfaction of HHSC. (B) CONTRACTOR will have implemented policies, procedures and processes to respond to an Event or Breach, prior to start of work under the Base Contract, including investigation, response, root cause analysis, notifications, reporting and mitigation to the maximum extent practicable, any harmful effect of unauthorized use or disclosure of Confidential Information. H ISC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 6 of 7 HHSC Contract No. 529-08-01 10-00008G (C) CONTRACTOR will update as necessary, policies, procedures and processes to detect, investigate, mitigate losses, and prevent or reduce the likelihood of recurrence of a similar Event or Breach, and to provide these to HHSC for review and approval of the policies, procedures, processes, and the specific findings and actions taken in the time and manner reasonably requested by HHSC. (D) CONTRACTOR will complete or participate in a Risk Assessment as directed by HHSC following an Event or Breach, and provide the final assessment and mitigations to HHSC for review and approval. (E) CONTRACTOR will fully cooperate with HHSC to respond to inquiries and/or proceedings by state and federal authorities,Persons and/or Individuals. (F) CONTRACTOR will fully cooperate with HHSC's efforts to seek appropriate injunctive relief or otherwise prevent or curtail such Event or Breach, or to recover or protect any Confidential Information, including complying with reasonable corrective action or measures,as specified by HHSC in a Corrective Action Plan if directed by HHSC under Article 11 of HHSC Uniform Contract Terms and Conditions. (3) Breach Notification to Individuals and Reporting to Authorities. (A) Whether legally required or not, HHSC may direct CONTRACTOR to provide breach notification to Individuals, regulators or third-parties, as specified by HHSC following a breach. (B) CONTRACTOR must obtain HHSC's prior written approval of the time, manner and content of any notification to Individuals, regulators or third-parties, or any notice required by other state or federal authorities. CONTRACTOR will provide HHSC with copies of distributed and approved communications. (C) CONTRACTOR will have the burden of demonstrating to the satisfaction of HHSC that any notification required by HHSC was timely made. If there are delays outside of CONTRACTOR's control, CONTRACTOR will provide evidence demonstrating the reasons for the delay. (D) If HHSC delegates such requirements to Contractor, HHSC shall, in the time and manner reasonably requested by Contractor, cooperate and assist with Contractor's information requests in order to make such notifications and reports. (4) Training and Education. CONTRACTOR will ensure its officers,directors,employees, agents, Subcontractors and Workforce are adequately trained and educated and annually refresher or retrained on confidentiality,privacy, security and the importance of promptly reporting any Event or Breach and of the consequences of failing to do so, including without limitation: employment disciplinary action, employer sanctions or enforcement actions for legal noncompliance, potential loss of HHSC's Federal Financial Participation, and risks to third-party agreements. HHSC, at its election, may assist CONTRACTOR in training and education on specific or unique HHSC processes, systems and/or requirements. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 1 Page 7 of 7 HI-{SC Contract No. 529-08-0110-00008G ATTACHMENT 2. SCOPE OF WORK The Scope of Work is set forth in detail in Article III of the Base Contract, HHSC Contract No.529-08-0110-00008, as amended, between HHSC and CONTRACTOR and is incorporated by reference as if set out word-for-word in this document. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 2 Page 1 of 1 HHSC Contract No. 529-08-01 10-00008G ATTACHMENT 3. OTHER OBLIGATIONS OF CONTRACTOR Section A3.01 Location of Confidential Information; Custodial Responsibility CONTRACTOR is designated as the custodian of the records to which it may be entrusted and that contain Confidential Information, and is responsible for compliance with and enforcement of all conditions for creation, maintenance, use, disclosure, transmission and destruction of confidentiality, privacy and Subcontractor agreements as specified in this DUA or as may be reasonably necessary to prevent unauthorized use. CONTRACTOR will store all Confidential Information in a secure area and,subject to the terms of this DUA,will destroy any paper material in a secure manner in accordance with the requirements of the Information Security Guidelines and Procedures in Attachment 7 and Disposition of Confidential Information in Attachment 4. Section A3.02 PHI in Designated Record Set (I) CONTRACTOR will make PHI in a Designated Record Set available to HHSC or, as directed by HHSC, provide PHI to the Individual, or legally authorized representative of the Individual, in compliance with the requirements of the HIPAA Privacy Regulations, and make other Confidential Information in CONTRACTOR's possession available pursuant to the requirements of the HIPAA in case of a need for notification by HHSC upon a determination of a Breach of Unsecured PHI as defined in HIPAA. (2) CONTRACTOR will make PHI in a Designated Record Set available to HHSC for amendment and incorporate any amendments to this information that HHSC directs or agrees to pursuant to the HIPAA. Section A3.03 CONTRACTOR Recordkeeping,Accounting and Disclosure Tracking (I) Accounting, Access or Amendment. Contractor will document and make available to HHSC the PHI required to provide access,an accounting of disclosures or amendment in compliance with the requirements of the HIPAA Privacy Regulations. (2) If CONTRACTOR receives a request for access, amendment or accounting of PHI by any Individual subject to this DUA, it will promptly forward the request to HHSC; however, if it would violate HIPAA to forward the request, CONTRACTOR will promptly notify HHSC of the request and of CONTRACTOR's response. Unless CONTRACTOR is prohibited by law from forwarding a request, HHSC will respond to all such requests. (3) DHHS Inspection. Make internal practices, books, and records relating to the use or disclosure of PHI received from, or created or received by the CONTRACTOR on behalf of HHSC, available to the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee for purposes of determining compliance with HIPAA. (4) Compliance Certification. CONTRACTOR will provide, and will cause its Subcontractors and agents to provide, to HHSC periodic written certifications of compliance with controls and provisions relating to information privacy, security and breach notification, including without limitation information related to data transfers and the handling and disposal of Confidential Information, including without limitation, PHI. EPHI, Unsecured PHI and PII. Written evidence of compliance must be acceptable to HHSC in its sole discretion. Such evidence may include but is not necessarily limited to the following: HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 3 Page 1 of 2 HHSC Contract No.529-08-0110-00008G (A) Statement on Standards for Attestation Engagements(SSAE) No. 16„Reporting on Controls at a Service Organization, issued by the Auditing Standards Board of the American Institute of Certified Public Accountants(AICPA)in April 2010. (B) General security controls audit conducted in accordance with generally-accepted industry standards by a qualified and independent auditor that is acceptable to HHSC; (C) Application controls audit conducted in accordance with generally-accepted industry standards by a qualified and independent auditor that is acceptable to HHSC; (D) Vulnerability assessment conducted in accordance with generally-accepted industry standards by a qualified and independent expert in telecommunications and information security that is acceptable to HHSC; (E) Network/systems penetration test conducted in accordance with generally-accepted industry standards by a qualified and independent expert in telecommunications and information security that is acceptable to HHSC; and (F) Risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity,and availability of ePHI subject to this DUA. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23.2014 Attachment 3 Page 2 of 2 HHSC Contract No. 529-08-0110-00008G ATTACHMENT 4. DISPOSITION OF CONFIDENTIAL INFORMATION Section A4.01 CONTRACTOR'S Duty in General CONTRACTOR will return, destroy, or continue to maintain appropriate safeguards for Confidential Information,including without limitation all PHI received from HHSC or created,received or maintained on behalf of HHSC,as directed by HHSC,upon termination of the DUA or Base Contract. Section A4.02 Return or Destruction of Confidential Information (1) CONTRACTOR agrees that on the termination or expiration of this DUA, CONTRACTOR will, at its expense, return to HHSC or destroy, at HHSC's election, and to the extent reasonably feasible and permissible by law, all Confidential Information received from HHSC or created or maintained by CONTRACTOR or any of CONTRACTOR's agents or Subcontractors on HHSC's behalf if that data contains Confidential Information. CONTRACTOR will certify in writing to HHSC that all the Confidential Information that has been created, received, maintained, used by or disclosed to CONTRACTOR, has been destroyed or returned to HHSC, and that CONTRACTOR and its agents and Subcontractors have retained no copies thereof. Notwithstanding the foregoing, CONTRACTOR acknowledges and agrees that it may not destroy any Confidential Information if federal or state law prohibits such destruction. (2) If such return or destruction is not reasonably feasible, or is impermissible by law, immediately notify HHSC of the reasons such return or destruction is not feasible, and agree to extend indefinitely the protections of this DUA to the Confidential Information and limit its further uses and disclosures to the purposes that make the return of the Confidential Information not feasible for as long as CONTRACTOR maintains such Confidential Information. HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 4 Page 1 of 1 HHSC Contract No. 529-08-01 I0-00008G ATTACHMENT 5. GENERAL PROVISIONS Section A5.01 HHSC commitment and obligations H-ISC will not request CONTRACTOR to create,maintain,transmit, use or disclose PHI in any manner that would not be permissible under HIPAA if done by HHSC. Section A5.02 HHSC Right to Inspection At any time upon reasonable notice to CONTRACTOR, or if HHSC determines that CONTRACTOR has violated this DUA, HHSC,through its agent, will have the right to inspect the facilities, systems, books and records of CONTRACTOR to monitor compliance with this DUA. For purposes of this subsection, HHSC's agent(s) include, without limitation,the HHSC Office of the Inspector General or the Office of the Attorney General of Texas or other designee. H-ISC's failure to inspect or failure to detect any noncompliance with the DUA or through its agent's inspection does not relieve CONTRACTOR of its responsibility to comply with this DUA. Section A5.03 Access to PHI CONTRACTOR will make available to HHSC any information HHSC requires to fulfill HHSC's obligations to provide access to,and copies of, PHI in accordance with HIPAA and other applicable laws and regulations of Confidential Information. Section A5.04 Term of DUA This DUA will be effective on the date on which CONTRACTOR executes the DUA,and will expire on the date specified in the DUA. (1) Either party may terminate this DUA at any time upon 30 days written notice to the other party. (2) HHSC may immediately terminate this DUA on: (A) A material violation of this DUA. "Material"means: (i) any violation by CONTRACTOR of a material term of this DUA will be considered a breach of contract if the CONTRACTOR knew of or reasonably should have known of the violation and failed to immediately take reasonable steps to cure it and notify HHSC,as required by the DUA; (ii) CONTRACTOR fails to timely notify HHSC of an Event or Breach, or take corrective action required; (iii) CONTRACTOR's repeated or flagrant violation of the obligations under the DUA; (iv) CONTRACTOR's failure to respond to a demand letter concerning penalties under the DUA or Base Contract; (v) CONTRACTOR being named as a defendant in a criminal proceeding for a violation of HIPAA, or other applicable laws and regulations of Confidential Information;and/or (vi) a finding or stipulation that CONTRACTOR has violated any standard or requirement of HIPAA other laws and regulations of Confidential HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 5 Page 1 of 4 HHSC Contract No. 529-08-01 l 0-00008G Information; or other security or privacy law in an administrative or civil proceeding which CONTRACTOR has been joined. (vii) If neither termination nor cure is feasible, HHSC shall report the violation to the Secretary. (3) Termination of this DUA will not relieve CONTRACTOR of its duties with regards to the return or disposition of the Confidential Information as set forth in this DUA. (4) Termination Options. If HHSC determines that CONTRACTOR has violated a material term of this DUA; HHSC may in its sole discretion: (A) Exercise any of its rights including but not limited to reports, access and inspection under this DUA and/or the Base Contract; and/or (B) Require CONTRACTOR to submit to a Corrective Action Plan under Article 14 of the HHSC Uniform Contract Terms and Conditions, plan for monitoring and plan for reporting, as HHSC may determine necessary to maintain compliance with this DUA; and/or (i) Provide CONTRACTOR with a reasonable period to cure the violation as determined by HHSC; or (ii) Terminate the DUA and Base Contract immediately, and seek relief in a court of competent jurisdiction in Travis County,Texas; and (iii) Before exercising any of these options, HHSC will provide written notice to CONTRACTOR describing the violation and the action it intends to take. Section A5.05 Publication CONTRACTOR may not publish or otherwise disclose to a third party any results of work under the DUA or Base Contract unless HHSC expressly approved in writing of such disclosure in advance of such publication. Section A5.06 Governing Law, Venue and Litigation (1) The validity,construction and performance of this DUA and the legal relations among the Parties to this DUA will be governed by and construed in accordance with the laws of the State of Texas. (2) The Parties agree that the courts of Travis County, Texas, will be the exclusive venue for any litigation, special proceeding or other proceeding as between the parties that may be brought,or arise out of,or in connection with, or by reason of this DUA. Section A5.07 Injunctive Relief (1) CONTRACTOR understands and agrees that HHSC may suffer irreparable injury if CONTRACTOR or its Subcontractor fails to comply with any of the terms of this DUA with respect to the Confidential Information or a provision of HIPAA or other laws or regulations applicable to Confidential Information. (2) CONTRACTOR further agrees that monetary damages may be inadequate to compensate HHSC for CONTRACTOR'S or its Subcontractor's failure to comply. Accordingly, CONTRACTOR agrees that HHSC will, in addition to any other remedies available to it at law or in equity, be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages,to enforce the terms of this DUA. HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 5 Page 2 of 4 HHSC Contract No. 529-08-0110-00008G (3) The duties of CONTRACTOR or its Subcontractor under this DUA survive the expiration of this DUA until all the Confidential Information is destroyed or returned to HHSC,as required by this DUA. Section A5.08 Indemnification CONTRACTOR will indemnify, defend and hold harmless HHSC and its respective Executive Commissioner,employees, Subcontractors,agents(including other state agencies acting on behalf of HHSC) or other members of its workforce (each of the foregoing hereinafter referred to as "Indemnified Party") against all actual and direct losses suffered by the Indemnified Party and all liability to third parties arising from or in connection with any breach of this DUA or from any acts or omissions related to this DUA by CONTRACTOR or its employees, directors, officers, Subcontractors, or agents or other members of its workforce. The duty to indemnify, defend and hold harmless is independent of the duty to insurer, and continues to apply even in the event insurance coverage required, if any, in the DUA or Base Contract is denied,or coverage rights reserved by any insurance carrier. Upon demand,CONTRACTOR will reimburse H-ISC for any and all actual and direct losses, liabilities, lost profits, fines, penalties, costs or expenses (including reasonable attorneys' fees)which may for any reason be imposed upon any Indemnified Party by reason of any suit,claim, action,proceeding or demand by any third party to the extent caused by and which results from the CONTRACTOR's failure to meet any of its obligations under this DUA. CONTRACTOR's obligation to defend, indemnify and hold harmless any Indemnified Party will survive the expiration or termination of this DUA. Section A5.09 Insurance (1) In addition to any insurance required in the Base Contract, at HHSC's option and as directed, HHSC may require CONTRACTOR to maintain, at its expense, the following special and/or custom first- and third-party insurance coverages, naming the State of Texas, acting through HHSC, as an additional named insured and loss payee, with primary and non-contributory status, with required insurance coverage, by the Effective Date of the request, or as required by HHSC: (A) Network Security and Privacy; (B) Data Breach; (C) Cyber Liability (lost data, lost use or delay/suspension in business, denial of service with e-business, the Internet, networks and informational assets, such as privacy, intellectual property, virus transmission, extortion, sabotage or web activities); (D) Electronic Media Liability; (E) Crime/Theft; (F) Advertising Injury and Personal Injury Liability; and (G) Crisis Management and Notification Expense Coverage. (2) CONTRACTOR will provide HHSC with proof of policy part (as opposed to merely a certificate of coverage or binder),at the request of HHSC. Section A5.10 Fees and Costs Except as otherwise specified in this DUA or the Base Contract, including but not limited to requirements to insure and/or indemnify HHSC, if any legal action or other proceeding is brought for the enforcement of this DUA, or because of an alleged dispute, contract violation, Event. Breach, default, HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 5 Page 3 of 4 HHSC Contract No. 529-08-0110-00008G misrepresentation,or injunctive action, in connection with any of the provisions of this DUA,each party will bear their own legal expenses and the other cost incurred in that action or proceeding. Section A5.11 Entirety of the Base Contract The Base Contract consists of this Business Associate Agreement and the Base Contract and constitutes the entire agreement between the parties. There are no understandings or agreements relating to this DUA or the Base Contract that are not fully expressed therein and no change, waiver, or discharge of obligations arising under those documents will be valid unless in writing and executed by the party against whom such change,waiver,or discharge is sought to be enforced. To the extent of any conflicts exist between this DUA and the Base Contract,this DUA controls. Section A5.12 Automatic Amendment and Interpretation Upon the effective date of any amendment or issuance of additional regulations to HIPAA, or any other law applicable to Confidential Information, this DUA will automatically amended so that the obligations imposed on HHSC and/or CONTRACTOR remain in compliance with such requirements. Any ambiguity in this DUA will be resolved in favor of a meaning that permits HHSC and CONTRACTOR to comply with HIPAA or any other law applicable to Confidential Information. HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 5 Page 4 of 4 HHSC Contract No. 529-08-0110-00008G ATTACHMENT 6. CONFIDENTIAL INFORMATION Any information under the terms of the Base Contract, HHSC Contract No.529-08-0110-00008 between HHSC and CONTRACTOR, as amended, that HHSC may provide or make available to CONTRACTOR, or that CONTRACTOR may create, receive, maintain or have access to on behalf of HHSC that is defined as Confidential above. HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014Attachment 6 Page 1 of 1 HHSC Contract No. 529-08-0110-00008G ATTACHMENT 7. SECURITY GUIDELINES AND PROCEDURES CONTRACTOR and all Subcontractors, consultants, or agents under the DUA (collectively "CONTRACTOR") must comply at a minimum with the following Information Security Guidelines and Procedures currently in effect: • HHS Circular C-021,Health and Human Services Enterprise Information Security Standards and Guidelines; • HHS Enterprise Information Security Standards and Guidelines(EISSG); • HHS Enterprise Information Security Controls Catalog(EISSC); and • Title 1, Sections 202.1 and 202.3,and Subchapter B,Texas Administrative Code. CONTRACTOR must comply with at least the following,as applicable: • The Federal Information Security Management Act of 2002 (FISMA); • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) as defined in the DUA; • Internal Revenue Publication 1075 —Tax Information Security Guidelines for Federal, State and Local Agencies; • National Institute of Standards and Technology (NISI) Special Publication 800-66 Revision 1 — An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act(HIPAA)Security Rule; • NIST Special Publication 800-53 —Recommended Security Controls for Federal Information Systems and Organizations,as currently revised; • NIST Special Publication 800-47 — Security Guide for Interconnecting Information Technology Systems; and • NIST Special Publication 800-88,Guidelines for Media Sanitization In addition to the requirements expressly stated in this Section, CONTRACTOR must comply with any other State or Federal law,regulation,or administrative rule relating to the specific HHSC program area that CONTRACTOR supports on behalf of HHSC. HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 7 Page 1 of 1 HHSC Contract No. 529-08-0110-00008G ATTACHMENT 8. LIST OF AUTHORIZED USERS CONTRACTOR represents and warrants that each of those Workforce below have a demonstrated need to know and have access to Confidential Information pursuant to this DUA and the Base Contract, and further, that each agree to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in the DUA. CONTRACTOR must maintain an updated, complete, accurate and numbered list of Authorized Users at all times and supply it to HHSC, as directed, to the extent those identified below change: 1. Signature: Name: 9. Signature: Title: Name: Date: Title: Date: 2. Signature: Name: 10. Signature: Title: Name: Date: Title: Date: 3. Signature: Name: 11. Signature: Title: Name: Date: Title: Date: 4. Signature: Name: 12. Signature: Title: Name: Date: Title: Date: 5. Signature: Name: 13. Signature: Title: Name: Date: Title: Date: 6. Signature: 14. Signature: Name: Name: Title: Title: Date: Date: 15. Signature: 7. Signature: Name: Name: Title: Title: Date: Date: 16. Signature: Name: 8. Signature: Title: Name: Date: Title: Date: 17. Signature: HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 8 Page 1 of 2 HHSC Contract No. 529-08-0110-00008G Name: Title: 27. Signature: Date: Name: Title: 18. Signature: Date: Name: Title: 28. Signature: Date: Name: Title: 19. Signature: Date: Name: Title: 29. Signature: Date: Name: Title: 20. Signature: Date: Name: Title: 30. Signature: Date: Name: Title: 21. Signature: Date: Name: Title: 31. Signature: Date: Name: Title: 22. Signature: Date: Name: Title: 32. Signature: Date: Name: Title: 23. Signature: Date: Name: Title: 33. Signature: Date: Name: Title: 24. Signature: Date: Name: Title: 34. Signature: Date: Name: Title: 25. Signature: Date: Name: Title: 35. Signature: Date: Name: Title: 26. Signature: Date: Name: 36. Signature: Title: Name: Date: Title: Date: HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 8 Page 2 of 2 HHSC Contract No.529-08-0110-00008G ATTACHMENT 9. SUBCONTRACTOR AGREEMENT FORM The DUA between HHSC and CONTRACTOR establishes the permitted and required uses and disclosures of Confidential Information by CONTRACTOR. CONTRACTOR has subcontracted with (SUBCONTRACTOR)for performance of duties on behalf of CONTACTOR which are subject to the DUA [describe SUBCONTRACTOR's duties which fall under the terms and conditions of the DUA or attach a Scope of Work or Subcontract and incorporate it by reference in this Form]: SUBCONTRACTOR acknowledges,understands and agrees to be bound by the terms and conditions applicable to CONTRACTOR under the DUA, incorporated by reference in this Agreement,with respect to HHSC Confidential Information. CONTRACTOR and SUBCONTRACTOR assure HHSC that SUBCONTRACTOR will only create,receive,maintain,or transmit Confidential Information on behalf of CONTRACTOR under, at a minimum, the identical terms and conditions of the DUA applicable to CONTRACTOR. The DUA represents minimum requirements over HHSC Confidential Information. CONTRACTOR may apply stricter requirements over HHSC Confidential Information to SUBCONTRACTOR than apply to CONTRACTOR in the DUA CONTRACTOR may also contract with SUBCONTRACTOR to engage in activities not subject to the DUA,if not prohibited by the Base Contract. SUBCONTRACTOR acknowledges receipt, understanding of and agrees to be bound by the terms and conditions applicable to SUBCONTRACTOR under the DUA with respect to HHSC Confidential Information,which is incorporated by reference for purposes of SUBCONTRACTOR's agreement as if fully set forth herein. CONTRACTOR and SUBCONTRACTOR agree that HHSC is a third-party beneficiary to applicable provisions of the subcontract. HHSC has the right but not the obligation to review or approve the terms and conditions of the subcontract by virtue of this Subcontractor Agreement Form. CONTRACTOR and SUBCONTRACTOR assure HHSC that any Breach or Event as defined by the DUA that SUBCONTRACTOR discovers will be reported to HHSC by CONTRACTOR in the time, manner and content required by the DUA. If CONTRACTOR knows or should have known in the exercise of reasonable diligence of a pattern of activity or practice by SUBCONTRACTOR that constitutes a material breach or violation of the DUA or the SUBCONTRACTOR'S obligations CONTRACTOR will: 1. Take reasonable steps to cure the violation or end the violation, as applicable; 2. If the steps are unsuccessful,terminate the contract or arrangement with SUBCONTRACTOR, if feasible; 3. Notify HHSC immediately upon reasonably discovery of the pattern of activity or practice of SUBCONTRACTOR that constitutes a material breach or violation of the DUA and keep HHSC reasonably and regularly informed about steps CONTRACTOR is taking to cure or end the violation or terminate SUBCONTACTOR's contract or arrangement. HHSC Data Use Agreement V.7.4.HIPAA Omnibus Compliant April 23,2014 Attachment 9 Page 1 of 2 HHSC Contract No 529-08-0110-00008G This Subcontractor Agreement Form is executed by the parties in their capacities indicated below. CONTRACTOR BY: NAME: TITLE: DATE ,201 SUBCONTRACTOR BY: NAME: TITLE: DATE ,201 . iE HHSC Data Use Agreement V.7.4 HIPAA Omnibus Compliant April 23,2014 Attachment 9 Page 2 of 2 AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT D DATA USE AGREEMENT 9 AMENDMENT SEVEN TO THE AGREEMENT BETWEEN THE TEXAS HEALTH AND HUMAN SERVICES COMMISSION AND CITY OF PORT ARTHUR FOR THE TEXAS NURSE-FAMILY PARTNERSHIP PROGRAM EXHIBIT C IMPLEMENTING AGENCY OBLIGATIONS Implementing Agency will take all appropriate steps to maintain client confidentiality and obtain any necessary written client consents for data analysis or disclosure of protected health information,in accordance with applicable federal and state laws,including,but not limited to,authorizations,data use agreements,business associate agreements,as necessary. Implementing Agency assumes responsibility for knowledge of and compliance with the State Nurse Practice Act of its state, state laws,regulations,and licensing requirements pertaining to nursing practice and state laws and regulations pertaining to mandatory reporting. Implementing Agency will ensure that nurses whom it employs to implement that Program are able to provide care to clients in a manner consistent with the NFP Visit-to-Visit Guidelines. When requested by NFP through HHSC, Implementing Agency will make reasonable efforts to collect additional data and/or participate in Research approved by HHSC and intended to improve the NFP model or implementation of the model. In order to avoid becoming involved in Research that conflicts with implementing the Program with Fidelity to the Model, Implementing Agency will request HHSCs permission prior to participating in any Research that is(1)initiated by a party other than HHSC and(2)that involves Program staff or explicitly targets the families that are enrolled in the Program. HHSC, in consultation with NFP will review and approve or disapprove Agency's request for participation in such Research on a timely basis and will not unreasonably withhold such approval. Implementing Agency will inform HHSC and NFP of Agency proposals to publish or present NFP- related information in research reports,books,book chapters,peer-reviewed journal articles,and at academic or professional conferences. Results of the Program herein outlined may be published by Implementing Agency, or jointly by Implementing Agency,HHSC and NFP, always giving due credit to the Parties involved and recognizing the rights of the individuals doing the work. Implementing Agency is authorized to reproduce certain published materials specified below and used in the implementation of the Program so long as(1)this Agreement is in effect,(2) Implementing Agency uses the reproductions solely for Program implementation,and(3)Implementing Agency does not sell or otherwise distribute the reproductions to any third party not involved in Agency's implementation of the Program. 6 The published materials covered by this authorization are delivered to Nurse Home Visitors as part of the Nurse-Family Partnership Home Visitor education materials in sets referred to as follows: Pregnancy Facilitators and Handouts Infancy Facilitators and Handouts Toddler Facilitators and Handouts The handouts bear notices indicating copyright by any of the following: University of Colorado University of Colorado Health Sciences Center University of Colorado at Denver and Health Sciences Center Nurse-Family Partnership NFP has the right to grant permission to reproduce materials specified above and that bear the University copyright notice under the terms of a Memorandum of Understanding("MOU") dated March 31,2003,between the University of Colorado Health Sciences Center,now known as University of Colorado at Denver and Health Sciences Center,and NFP. The MOU gives NFP an exclusive,perpetual,royalty-free right and license to use copyrighted materials and other materials used in the Program for the purpose of implementing the Program to serve low-income, first-time mothers and their families. The corresponding Spanish-language versions of these materials are also covered by this authorization. Implementing Agency may not authorize any other entity to reproduce the materials without prior written permission from NFP. Implementing Agency understands and agrees that all Proprietary Property is owned exclusively by NFP and its licensors,including all intellectual property rights therein. Implementing Agency shall use the Proprietary Property solely for the purpose of carrying out Agency's obligations under this Agreement and shall not modify any Proprietary Property without the prior express written permission of NFP. Implementing Agency shall protect all Proprietary Property that belongs to NFP or its licensors. Implementing Agency shall not duplicate and shall prohibit distribution of or access to Visit-to-Visit Guidelines and the ETO to any individual or organization not party to the implementation,administration,and operation of the Program,except as authorized by this Agreement. Implementing Agency shall not change or alter the ETO software,and shall allow only trained,NFP-authorized users to access the ETO Website. If a person leaves Implementing Agency's employ, Implementing Agency shall retrieve all Proprietary Property that the person may have in his or her possession. Upon termination of this Agreement,regardless of the timing,cause,or mechanism of such termination: Implementing Agency will no longer have access to ETO or the ETO Website; All software and ETO Website content,excluding data which has been collected by Implementing Agency in the course of implementing the Program, shall remain the sole property of NFP; NFP may retain a record of all data which has been collected by Implementing Agency in the course of implementing the Program and may use that data and reports derived from it to evaluate the overall progress in national replication of the Program; 7 Implementing Agency and NFP will continue to comply with all relevant state,federal laws and all other provisions of this Agreement with respect to maintaining Client confidentiality; All materials in Implementing Agency's possession that utilize the Nurse-Family Partnership logo,tag line,or other protected marks must be returned to NFP or destroyed; All copies of Proprietary Property that have been provided to Implementing Agency by NFP or that have come into Implementing Agency's possession from other sources must be returned to NFP or destroyed; and Implementing Agency will cease to implement the Program and will cease to represent that it is implementing the Program. 8 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions �., ' Ari Health & Human Services Commission Enterprise Project Office Contractual Document HHSC Uniform Contract Terms & Conditions Version 1.4.1 CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contracting/rfp attch/General TC.pdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions DOCUMENT HISTORY LOG STATUS DOCUMENT EFFECTIVE DESCRIPTION3 REVISION DATE Baseline n/a 07/30/03 Initial version of the Uniform Terms and Conditions Revision 1.1 8/25/03 Revised HIPAA language. Revision 1.2 10/13/03 Added Section 8.06,relating to State Auditor's Office audits. Revision 1.3 3/17/04 Revised conflict of interest language in Section 12.02, and added new Section 12.03,regarding organizational conflicts of interest. Revision 1.4 1/15/07 Revised anti-discrimination language in Section 5.04, and HIPAA language in Section 16.01. Added anti- trust provision in Section 12.09. Revision 1.4.1 2/03/11 Added Section 10.07 Information Security and Section 16.08 Historically Underutilized Business Requirements. 1 Status should be represented as"Baseline"for initial issuances,"Revision"for changes to the Baseline version,and "Cancellation"for withdrawn versions 2 Revisions should be numbered in accordance according to the version of the issuance and sequential numbering of the revision—e.g.,"1.2"refers to the first version of the document and the second revision. 3 Brief description of the changes to the document made in the revision. CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contractinq/rfp attch/General TC.pdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions CONTENTS Article 1. Introduction 1 Section 1.01 Inducements. 1 Section 1.02 Construction of Agreement. 1 (a) Scope of Introductory Article. 1 (b) References to the"State." 1 (c) Severability. 1 (d) Survival of terms. 1 (e) Headings. 1 (f) Global drafting conventions. 1 Section 1.03 No implied authority. 2 Section 1.04 Legal Authority. 2 Article 2. Definitions 2 Article 3. General Terms and Conditions 3 Section 3.01 Agreement elements 3 (a) Agreement documentation. 3 (b) Order of documents 3 Section 3.02 Funding. 3 Section 3.03 Delegation of authority. 4 Section 3.04 No waiver of sovereign immunity 4 Section 3.05 Force majeure 4 Section 3.06 Other Health and Human Services Agencies' participation in the Agreement. 4 Section 3.07 Most favored customer. 4 Section 3.08 Publicity 4 Section 3.09 Assignment. 4 (a) Assignment by CONTRACTOR. 4 (b) Assignment by HHSC 4 (c) Assumption. 4 Section 3.10 Cooperation with other vendors and prospective vendors. 5 Section 3.11 Renegotiation and reprocurement rights. 5 (a) Renegotiation of Agreement terms 5 (b) Reprocurement of the services or procurement of additional services. 5 (c) Termination rights upon reprocurement. 5 Section 3.12 RFP errors and omissions. 5 Section 3.13 Attorneys' fees. 5 Section 3.14 Preferences under service contracts. 5 Section 3.15 Time of the essence. 5 Article 4. Contractor Personnel Management 5 Section 4.01 Qualifications, retention and replacement of CONTRACTOR employees. 5 Section 4.02 Responsibility for CONTRACTOR personnel. 5 Section 4.03 Cooperation with HHSC and state administrative agencies. 6 (a) Cooperation with HHSC contractors. 6 (b) Cooperation with state and federal administrative agencies 6 Section 4.04 Conduct of and responsibility for CONTRACTOR personnel. 6 Section 4.05 Responsibility for subcontractors 7 Section 4.06 HHSC's ability to contract with subcontractors 7 Article 5. Governing Law and Regulations 7 CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contracting/rfp attch/General TC.pdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Section 5.01 Governing law and venue. 7 Section 5.02 CONTRACTOR responsibility for compliance with laws and regulations 7 Section 5.03 Immigration Reform and Control Act of 1986. 7 Section 5.04 Compliance with state and federal anti-discrimination laws. 8 Section 5.05 Environmental protection laws 8 (a) Pro-Children Act of 1994. 8 (b) National Environmental Policy Act of 1969. 8 (c) Clean Air Act and Water Pollution Control Act regulations. 9 (d) State Clean Air Implementation Plan. 9 (e) Safe Drinking Water Act of 1974. 9 Article 6. Service Levels and Performance Measurement 9 Section 6.01 Performance measurement. 9 Article 7.Amendments, Modifications,and Change Orders 9 Section 7.01 Amendments and modifications 9 (a) Amendments and modifications resulting from changes in law or contract. 9 (b) Modifications resulting from imposition of remedies. 9 Section 7.02 Required compliance with amendment modification procedures. 9 Article 8.Audit and Financial Compliance 9 Section 8.01 Financial record retention and audit. 9 Section 8.02 Access to records, books, and documents. 9 Section 8.03 Audits of Services, Deliverables and inspections. 10 Section 8.04 Response/compliance with audit or inspection findings. 10 Section 8.05 Audit of CONTRACTOR fees. 10 Section 8.06 SAO Audit 11 Article 9. Terms and Conditions of Payment 11 Section 9.01 Rights of set-off 11 (a) General right of set-off 11 (b) Duty to make payments 11 Section 9.02 Expenses. 11 Section 9.03 Disputed fees. 11 Section 9.04 Liability for taxes. 11 Section 9.05 Liability for employment-related charges and benefits. 11 Section 9.06 No additional consideration. 11 Section 9.07 No increase in charges. 12 Article 10. Disclosure and Confidentiality of Information 12 Section 10.01 Confidentiality. 12 Section 10.02 Disclosure of HHSC's Confidential Information. 12 Section 10.03 Requests for public information. 13 Section 10.04 Privileged Work Product. 13 Section 10.05 Unauthorized acts. 13 Section 10.06 Legal action 13 Section 10.07 Information Security 13 Article 11. Remedies and Disputes 14 Section 11.01 Understanding and expectations. 14 Section 11.02 Tailored remedies. 14 (a) Understanding of the Parties. 14 CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contracting/rfp attch/General TC.pdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (b) Notice and opportunity to cure for non-material breach. 14 (c) Corrective action plan 15 (d) Administrative remedies. 15 (e) Damages. 16 (f) Equitable Remedies 16 (g) Suspension of Agreement 16 Section 11.03 Termination of Agreement. 17 (a) Termination by mutual agreement of the Parties. 17 (b) Termination in the best interest of the State 17 (c) Termination for cause 17 Section 11.04 Effective date of termination. 18 Section 11.05 Extension of termination effective date 18 Section 11.06 Payment and other provisions at Agreement termination. 18 Section 11.07 Modification of Agreement in the event of remedies. 19 Section 11.08 Turnover assistance. 19 Section 11.09 Rights upon termination or expiration of Agreement. 19 Section 11.10 CONTRACTOR responsibility for associated costs 19 Section 11.11 Dispute resolution. 19 (a) General agreement of the Parties. 19 (b) Duty to negotiate in good faith 19 (c) Claims for breach of Agreement 19 Section 11.12 Liability of CONTRACTOR. 20 Article 12.Assurances and Certifications 20 Section 12.01 Proposal certifications 20 Section 12.02 Conflicts of interest. 20 (a) Representation. 20 (b) General duty regarding conflicts of interest 20 Section 12.03 Organizational conflicts of interest 21 (a) Definition 21 (b) Warranty. 21 (c) Continuing duty to disclose. 21 (d) Remedy. 21 (e) Flow down obligation. 21 Section 12.04 HHSC personnel recruitment prohibition. 21 Section 12.05 Anti-kickback provision. 21 Section 12.06 Debt or back taxes owed to the State of Texas 21 Section 12.07 Certification regarding status of license, certificate, or permit. 21 Section 12.08 Outstanding debts and judgments. 22 Section 12.09 Anti-trust 22 Article 13. Representations and Warranties 22 Section 13.01 Authorization. 22 Section 13.02 Ability to perform. 22 Section 13.03 Workmanship and performance 22 Section 13.04 Warranty of deliverables. 22 Section 13.05 Manufacturers'warranties. 22 Section 13.06 Compliance with Agreement 22 Article 14. Intellectual Property 23 Section 14.01 Infringement and misappropriation. 23 Section 14.02 Exceptions. 23 CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contracting/rfp attch/General TCpdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Article 15. Liability 23 Section 15.01 Property damage. 23 Section 15.02 Risk of Loss. 23 Section 15.03 Limitation of HHSC's Liability 23 Article 16. Special Terms and Conditions 24 Section 16.01 HIPAA. 24 (a) Definitions 24 (b) Background. 24 (c) Uses and disclosures. 24 (d) Contractor's commitment and obligations. 24 (e) Ownership of Protected Health Information. 25 (f) Injunctive relief; survival of terms. 25 Section 16.02 Technology access. 26 Section 16.03 Member records 26 Section 16.04 Financial/performance audits 26 Section 16.05 Audit software. 27 Section 16.06 Ownership and licenses 27 (a) Custom Software. 27 (b) Ownership rights 27 (c) License Rights 27 (d) Proprietary Notices 27 (e) Third Party Software and Documentation Licenses 28 (f) State and Federal Governments 28 Section 16.07 Insurance Coverage. 28 (a) Required Coverage. 28 (b) Proof of Insurance Coverage 28 Section 16.08 Historically Underutilized Business Participation Requirements 29 This Subsection applies if HHSC identified that there are sub-contracting opportunities for this contract. 29 (a) Definitions. 29 (b) HUB Requirements. 29 CHECK THE MASTER LIST AT http://www.hhsc.state.tx.us/about hhsc/Contracting/rfp attch/General TC.pdf TO VERIFY THAT THIS IS THE CORRECT VERSION BEFORE USE Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions the plain meaning of the terms and conditions of the Article 1. Introduction Agreement. Section 1.01 Inducements. (b) References to the "State." References in the Agreement to the"State"shall In making the award of this Agreement, the mean the State of Texas unless otherwise specifically Health and Human Services Commission (HHSC) indicated and shall be interpreted, as appropriate, to relies on CONTRACTOR's assurances of the mean or include HHSC and other agencies of the following: State of Texas that may participate in the (1)CONTRACTOR and its subcontractors administration of HHSC Programs, provided, are established providers of the types of services however,that no provision will be interpreted to described in the Request for Proposals(RFP); include any entity other than HHSC as the contracting (2)CONTRACTOR and its subcontractors agency. have the skills, qualifications, expertise, financial (c) Severability. resources and experience necessary to perform If any provision of this Agreement is construed to the services described in the RFP, be illegal or invalid, such interpretation will not affect CONTRACTOR's Proposal, and this Agreement in the legality or validity of any of its other provisions. an efficient, cost-effective manner,with a high The illegal or invalid provision will be deemed stricken degree of quality and responsiveness, and has and deleted to the same extent and effect as if never performed similar services for other public or incorporated in this Agreement, but all other private entities; provisions will remain in full force and effect. (3) CONTRACTOR has thoroughly reviewed, (d) Survival of terms. analyzed, and understood the RFP, has timely Termination or expiration of this Agreement for raised all questions or objections to the RFP, and any reason will not release either Party from any has had the opportunity to review and fully liabilities or obligations set forth in this Agreement understand the HHSC's current program and that: operating environment for the activities that are (1)The Parties have expressly agreed shall the subject of the Agreement and the needs and survive any such termination or expiration; or requirements of the State during the Agreement term; (2) Remain to be performed or by their nature (4)CONTRACTOR has had the opportunity would be intended to be applicable following any to review and understand the State's stated such termination or expiration. objectives in entering into this Agreement and, (e) Headings. based on such review and understanding, The article and section headings in this CONTRACTOR currently has the capability to Agreement are for reference and convenience only perform in accordance with the terms and and may not be considered in the interpretation of this conditions of this Agreement; Agreement. (5)CONTRACTOR also has reviewed and (f) Global drafting conventions. understands the risks associated with the HHSC (1)The terms"include,""includes,"and Programs as described in the Request for "including"are terms of inclusion, and where used in Proposals, including the risk of non-appropriation this Agreement, are deemed to be followed by the of funds. words"without limitation." Accordingly, on the basis of the terms and (2)Any references to"sections,""appendices,"or conditions of this Agreement, HHSC desires to "attachments"are deemed to be references to engage CONTRACTOR to perform the services sections, appendices, or attachments to this described in this Agreement under the terms and Agreement. conditions set forth in this Agreement. (3)Any references to agreements, contracts, Section 1.02 Construction of Agreement. statutes, or administrative rules or regulations in this (a) Scope of Introductory Article. Agreement are deemed references to these documents as amended, modified, or supplemented The provisions of any introductory article to the from time to time during the term of this Agreement. Agreement are intended to be a general introduction and are not intended to expand the scope of the Parties'obligations under the Agreement or to alter 1 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Section 1.03 No implied authority. "Change Order"means an authorization to The authority delegated to CONTRACTOR by make a change in the Services or Deliverables under HHSC is limited to the terms of this Agreement. this Agreement. HHSC is the state agency designated by the Texas "Children's Health Insurance Program"or Legislature to administer the HHSC Programs, and no "CHIP"means the health insurance program other agency of the State grants CONTRACTOR any authorized and funded pursuant to Title XXI, Social authority related to this program unless directed Security Act(42 U.S.C. §§ 1397aa-1397jj)and through HHSC. CONTRACTOR may not rely upon administered by HHSC. implied authority, and specifically is not delegated "Confidential Information"means any authority under this Agreement to: communication or record (whether oral, written, (1) make public policy; electronically stored or transmitted, or in any other (2)promulgate, amend or disregard form)that consists of: administrative regulations or program policy decisions (1) Confidential Client information, including made by State and federal agencies responsible for Protected Health Information; administration of HHSC Programs; or (2) All non-public budget, expense, payment (3)unilaterally communicate or negotiate with and other financial information; any federal or state agency or the Texas Legislature (3) All Privileged Work Product; on behalf of HHSC regarding the HHSC Programs. (4) All information designated by HHSC or CONTRACTOR is required to cooperate to the any other State agency as confidential, including fullest extent possible to assist HHSC in all information designated as confidential under communications and negotiations with state and the Texas Public Information Act, Texas federal governments and agencies as directed by Government Code, Chapter 552; HHSC. (5) Unless publicly disclosed by HHSC or Section 1.04 Legal Authority. the State,the pricing, payments, and terms and conditions of the Agreement; and (a)HHSC is authorized to enter into this (6) Information that is utilized, developed, Agreement under Chapter 531, Texas Government received, or maintained by HHSC,the Code; Section 2155.144, Texas Government Code; CONTRACTOR, or participating State agencies and/or Chapter 62, Texas Health&Safety Code. for the purpose of fulfilling a duty or obligation CONTRACTOR is authorized to enter into this under this Agreement and that has not been Agreement pursuant to the authorization of its publicly disclosed. governing board or controlling owner or officer. "Corrective Action Plan" means the detailed (b)The person or persons signing and executing the Parties,and written plan required by HHSC to correct or resolve a this Agreement on behalf representing themselves as signing and executing deficiency a event ga ni t the assessment of a this Agreement on behalf of the Parties, warrant and liquidated damage against CONTRACTOR. guarantee that he, she, or they have been duly "Deliverable"means a written or recorded work authorized to execute this Agreement and to validly product prepared, developed, or procured by and legally bind the Parties to all of its terms, CONTRACTOR as part of the Services under this performances, and provisions. Agreement for the use or benefit of HHSC or the State of Texas. Article 2. Definitions "Disability" means a physical or mental As used in this Agreement, the following terms impairment that substantially limits one or more of the and conditions shall have the meanings assigned major life activities of an individual. below: "Effective Date" means the date of complete "Agreement"or"Contract"means this formal, execution of this Agreement. For purposes of this written, and legally enforceable agreement and Agreement,the term includes any period under which amendments thereto between the Parties. work is performed in accordance with a properly "Change"means any alteration, adjustment, executed Letter of Intent between HHSC and exchange, substitution, or modification of the Services CONTRACTOR. under this Agreement that are authorized in "Force maieure event"means any failure or accordance with Article 7 of this Agreement. delay in performance of a duty by a Party under this Agreement that is caused by fire, flood, hurricane, tornadoes, earthquake, an act of God, an act of war, riot, civil disorder, or any similar event beyond the 2 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions reasonable control of such Party and without the fault described in this Agreement transfers to another or negligence of such Party. vendor. The Turnover Plan describes "Health and Human Services Commission"or CONTRACTOR's policies and procedures that will "HHSC" means the administrative agency within the assure: executive department of Texas state government (1)The least disruption in the delivery of established under Chapter 531,Texas Government services during the transition to a substitute Code or its designee, including, but not limited to, the vendor; and Texas Health and Human Services Agencies. (2)Cooperation with HHSC and the substitute "HHSC Programs"means the public health and vendor in transferring information and services to human service programs administered by HHSC, a substitute vendor. including but not limited to Medicaid and CHIP. Article 3.General Terms and Conditions "Initial Term"means the period between the Effective Date and the original Expiration Date of this Section 3.01 Agreement elements. Agreement. (a) Agreement documentation. "Medicaid"means the medical assistance The agreement between the Parties will consist entitlement program authorized and funded pursuant of this Agreement, the RFP, and CONTRACTOR's to Title XIX, Social Security Act(42 U.S.C. §1396 et Proposal. seq.)and administered by HHSC. "Parties"means HHSC and CONTRACTOR, (b) Order of documents. collectively. In the event of any conflict or contradiction "Party"means either HHSC or CONTRACTOR, between or among these documents,the documents individually. shall control in the following order of precedence: "Public information"means information that: (1)The final executed Agreement, and all amendments thereto; (1) Is collected, assembled, or maintained under (2)The Agreement Exhibits, and all a law or ordinance or in connection with the amendments thereto; transaction of official business by a governmental body or for a governmental body; and (3)The RFP, as clarified by the vendor (2)The governmental body owns or has a right of questions and HHSC's official responses thereto, access to. which are incorporated for all purposes into this Agreement as Exhibit A to this Agreement; and "Request for Proposals"or"RFP"means the (4)CONTRACTOR's Proposal, which is procurement solicitation instrument issued by HHSC incorporated for all purposes into this Agreement under which this Agreement was awarded and is as Exhibit B to this Agreement. executed. "Scope of Work"means the description of Section 3.02 Funding. Services and Deliverables specified in this This Agreement is expressly conditioned on the Agreement,the RFP, and any agreed modifications availability of state and federal appropriated funds. thereto. CONTRACTOR will have no right of action against "Services"means the tasks, functions, and HHSC in the event that HHSC is unable to perform its responsibilities assigned and delegated to obligations under this Agreement as a result of the CONTRACTOR under this Agreement. suspension,termination,withdrawal, or failure of "Software" means all operating system and funding to HHSC or lack of sufficient funding of HHSC applications software used by CONTRACTOR to for any activities or functions contained within the provide the Services under this Agreement. scope of this Agreement. If funds become "Subcontract"means any written agreement unavailable,the provisions of Article 11 (Remedies to fulfill the and Disputes)will apply. HHSC will use all reasonable between CONTRACTOR and other party requirements of this Agreement. All subcontracts are efforts to ensure that such funds are available, and required to be in writing. will negotiate in good faith with CONTRACTOR to resolve any CONTRACTOR claims for payment that "Subcontractor"means any individual or entity represent accepted Services or Deliverables that are that has entered into a subcontract with pending at the time funds become unavailable. CONTRACTOR. HHSC shall make best efforts to provide reasonable "Turnover Plan"means the written plan written advance notice to CONTRACTOR upon developed by CONTRACTOR,,approved by HHSC, learning that funding for this Agreement may be and to be employed in the event that the work discontinued. 3 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Section 3.03 Delegation of authority. Section 3.08 Publicity. Whenever, by any provision of this Agreement, (a) Except as provided in the paragraphs below, any right, power, or duty is imposed or conferred on CONTRACTOR must not use the name of HHSC,the HHSC, the right, power, or duty so imposed or State of Texas, or any other State agency, or refer to conferred is possessed and exercised by the HHSC or any such agency directly or indirectly in any Commissioner unless any such right, power, or duty is media release, public announcement, or public specifically delegated to the duly appointed agents or disclosure relating to the Agreement or its subject employees of HHSC. The Commissioner will reduce matter, including, but not limited to, in any promotional any such delegation of authority to writing and provide or marketing materials, customer lists, or business a copy to CONTRACTOR on request. presentations(other than proposals or reports Section 3.04 No waiver of sovereign immunity. submitted to HHSC, an administrative agency of the State of Texas, or a governmental agency or unit of The Parties expressly agree that no provision of another state or the Federal government). this Agreement is in any way intended to constitute a (b) CONTRACTOR may publish, at its sole waiver by HHSC or the State of Texas of any expense, results of CONTRACTOR performance immunities from suit or from liability that HHSC or the under the Agreement with HHSC's prior review and State of Texas may have by operation of law. approval, which HHSC may exercise at its sole Section 3.05 Force majeure. discretion. Any publication (written, visual, or sound) will acknowledge the support received from HHSC Neither Party will be liable for any failure or delay and any Federal agency, as appropriate. in performing its obligations under the Agreement if CONTRACTOR will provide HHSC at least three(3) such failure or delay is due to any cause beyond the copies of any such publication prior to public release. reasonable control of such Party, including, but not CONTRACTOR will provide additional copies at the limited to, unusually severe weather, strikes, natural request of HHSC. disasters, fire, civil disturbance, epidemic, war, court (c) CONTRACTOR may include information order, or acts of God. The existence of such causes concerning the Agreement's terms, subject matter, of delay or failure will extend the period of and estimated value in any report to a governmental performance in the exercise of reasonable diligence body to which the CONTRACTOR is required by law until after the causes of delay or failure have been to report such information. removed. Each Party must inform the other in writing with proof of receipt within five(5)business days of Section 3.09 Assignment. the existence of a force majeure event or otherwise (a) Assignment by CONTRACTOR. waive this right as a defense. Section 3.06 Other Health and Human Services CONTRACTOR shall not assign all or any Agencies'participation in the Agreement, portion of its rights under or interests in the Agreement or delegate any of its duties without prior In addition to providing the Services specified for written consent of HHSC. Any written request for HHSC, CONTRACTOR agrees to allow other Health assignment or delegation must be accompanied by and Human Service Agencies the option to participate written acceptance of the assignment or delegation by in the Agreement under the same terms and the assignee or delegation by the delegate. Except conditions. where otherwise agreed in writing by HHSC, Each agency that elects to obtain services under assignment or delegation will not release this section will issue a purchase order to CONTRACTOR from its obligations pursuant to the CONTRACTOR, referring to, and incorporating by Agreement. reference, the terms and conditions specified in the (b) Assignment by HHSC. Agreement. CONTRACTOR understands and agrees HHSC Section 3.07 Most favored customer, may in one or more transactions assign, pledge, transfer, or hypothecate the Agreement. This The CONTRACTOR agrees that if during the assignment will only be made to another State agency term of the Agreement, the CONTRACTOR enters or a non-State agency that is contracted to perform into any agreement with any other governmental agency support. customer, or any non-affiliated commercial customer (c) Assumption. by which it agrees to provide equivalent services at Each party to whom a transfer is made(an lower prices, or additional services at comparable "Assignee")must assume all or any part of prices,the Agreement will, at HHSC's option, be CONTRACTOR'S or HHSC's interests in the amended to accord equivalent advantage to HHSC. Agreement,the product, and any documents 4 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions executed with respect to the Agreement, including, Section 3.12 RFP errors and omissions. without limitation, its obligation for all or any portion of CONTRACTOR will not take advantage of any the purchase payments, in whole or in part. errors and/or omissions in the RFP or the resulting Section 3.10 Cooperation with other vendors and Agreement. CONTRACTOR must promptly notify prospective vendors. HHSC of any such errors and/or omissions that are (a) HHSC may award supplemental contracts discovered. for work related to the Agreement, or any portion Section 3.13 Attorneys'fees. thereof. HHSC reserves the right to award the contract as a joint venture between two or more In the event of any litigation, appeal, or other potential vendors, if such an arrangement is in the legal action to enforce any provision of the best interest of HHSC. CONTRACTOR will agree to Agreement, CONTRACTOR agrees to pay all cooperate with such other vendors, and will not expenses of such action, including attorneys'fees and commit or permit any act that may interfere with the costs if HHSC is the prevailing Party. performance of work by any other vendor. Section 3.14 Preferences under service contracts. (b) CONTRACTOR agrees that when HHSC so CONTRACTOR is required in performing the requests,the CONTRACTOR will allow parties Agreement to purchase products and materials interested in bidding for HHSC contracts, during the produced in the State of Texas when they are competitive procurement,to have reasonable access available at a price and time comparable to products during normal business hours to software, systems and materials produced outside the State. documentation, and site visits to the CONTRACTOR's facilities. All such parties inspecting the facilities and Section 3.15 Time of the essence. software and systems documentation may be In consideration of the need to ensure required to agree to use the information so obtained only in the State of Texas and only for the purpose of uninterrupted and continuous HHSC Program bidding on the contract. services, time is of the essence in the performance of the Services under the Agreement. Section 3.11 Renegotiation and reprocurement rights. Article 4.Contractor Personnel Management (a) Renegotiation of Agreement terms. Section 4.01 Qualifications, retention and replacement of CONTRACTOR employees. Notwithstanding anything in the Agreement to the contrary, HHSC may at any time during the term CONTRACTOR agrees to maintain the of the Agreement exercise the option to notify organizational and administrative capacity and CONTRACTOR that HHSC has elected to renegotiate capabilities to carry out all duties and responsibilities certain terms of the Agreement. Upon under this Agreement. The personnel CONTRACTOR's receipt of any notice pursuant to CONTRACTOR assigns to perform the duties and this Section, CONTRACTOR and HHSC will responsibilities under this Agreement will be properly undertake good faith negotiations of the subject terms trained and qualified for the functions they are to of the Agreement. perform. CONTRACTOR does not warrant the quality (b) Reprocurement of the services or procurement of of training for which the State is responsible. additional services. Notwithstanding transfer or turnover of personnel, CONTRACTOR remains obligated to perform all Notwithstanding anything in the Agreement to duties and responsibilities under this Agreement the contrary,whether or not HHSC has accepted or without degradation and in accordance with the terms rejected CONTRACTOR's Services provided during of this Agreement. any period of the Agreement, HHSC may at any time issue requests for proposals or offers to other Section 4.02 Responsibility for CONTRACTOR potential contractors for performance of any portion of personnel. the Services covered by the Agreement or services (a)CONTRACTOR's employees and similar or comparable to the Services performed by subcontractors will not in any sense be considered CONTRACTOR under the Agreement. employees of HHSC or the State of Texas, but will be (c) Termination rights upon reprocurement. considered CONTRACTOR's employees for all If HHSC elects to procure the Services or any purposes. portion of the Services from another vendor in (b) Except as expressly provided in this accordance with this Section, HHSC will have the Agreement, neither CONTRACTOR nor any of termination rights set forth in Article 11 of the CONTRACTOR's employees or subcontractors may Agreement. 5 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions act in any sense as agents or representatives of (3)Testimony in judicial or quasi-judicial HHSC or the State of Texas. proceedings relating to the Services under this (c)CONTRACTOR's employees must be paid Agreement or other delivery of information to exclusively by CONTRACTOR for all services HHSC or other agencies' investigators or legal performed. CONTRACTOR is responsible for and staff. must comply with all requirements and obligations Section 4.04 Conduct of and responsibility for related to such employees under local, state or CONTRACTOR personnel. federal law, including minimum wage, social security, unemployment insurance, state and federal income (a) While performing the Services, tax and workers'compensation obligations. CONTRACTOR's personnel and subcontractors must: (d)CONTRACTOR assumes sole and full (1) Comply with applicable State rules, and responsibility for its acts and the acts of its personnel regulations and HHSC's requests regarding and subcontractors. personal and professional conduct generally (e) CONTRACTOR agrees that any claim on applicable to the service locations, and behalf of any person arising out of employment or (2) Otherwise conduct themselves in a alleged employment(including, but not limited to, businesslike and professional manner. claims of discrimination against CONTRACTOR, its (b) If HHSC determines in good faith that a officers, or its agents)are the sole responsibility of particular employee or subcontractor is not CONTRACTOR and are not the responsibility of conducting himself or herself in accordance with this HHSC, and that CONTRACTOR will indemnify and Section, HHSC may provide CONTRACTOR with hold harmless the State from any and all such claims notice and documentation concerning such conduct. asserted against the State. CONTRACTOR Upon receipt of such notice, CONTRACTOR must understands that any person who alleges a claim promptly investigate the matter and take appropriate arising out of employment or alleged employment by action that may include: CONTRACTOR will not be entitled to any (1) Removing the employee from the compensation, rights, or benefits from HHSC project; (including, but not limited to, tenure rights, medical and hospital care, sick and annual/vacation leave, (2) Providing HHSC with written notice of severance pay, or retirement benefits). such removal; and Section 4.03 Cooperation with HHSC and state (3) Replacing the employee with a similarly qualified individual acceptable to HHSC. administrative agencies. (c) Nothing in the Agreement will prevent (a) Cooperation with HHSC contractors. CONTRACTOR, at the request of HHSC, from CONTRACTOR agrees to reasonably cooperate replacing any personnel who are not adequately with and work with the State's contractors, performing their assigned responsibilities or who, in subcontractors and third-party representatives as the reasonable opinion of HHSC's Project Director, requested by HHSC. To the extent permitted by after consultation with CONTRACTOR, are unable to HHSC's financial and personnel resources, HHSC work effectively with the members of the HHSC's agrees to reasonably cooperate with CONTRACTOR staff. In such event, CONTRACTOR will provide and to use its best efforts to ensure that HHSC's other replacement personnel with equal or greater skills and HHSC Programs contractors reasonably cooperate qualifications as soon as reasonably practicable. with CONTRACTOR. Replacement of Key Personnel will be subject to (b) Cooperation with state and federal administrative HHSC review and approval. The Parties will work agencies. together in the event of any such required replacement so as not to disrupt the overall project CONTRACTOR must ensure that schedule. CONTRACTOR personnel will cooperate with HHSC or other state or federal administrative agency (d) CONTRACTOR agrees that anyone personnel at no charge to HHSC for purposes relating employed by CONTRACTOR to fulfill the terms of the to the administration of HHSC programs including, but Agreement is an employee of CONTRACTOR and not limited to the following purposes: remains under CONTRACTOR's sole direction and control. (1)The investigation and prosecution of fraud, abuse, and waste in the HHSC programs; (e) CONTRACTOR agrees to be responsible for the following in respect to its employees: (2)Audit, inspection, or other investigative (1) Any and all employment taxes and/or purposes; and other payroll withholding; 6 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (2)Damages incurred by CONTRACTOR's must submit a copy of the agreement to HHSC. employees within the scope of their duties under HHSC reserves the right to(1) reject the agreement the Agreement; and or require changes to any provisions that do not (3) Determination of the hours to be worked comply with the requirements or duties and and the duties to be performed by responsibilities of this Agreement or create significant CONTRACTOR's employees. barriers for HHSC in monitoring compliance with this CONTRACTOR agrees and will inform its Agreement, and(2)object to the selection of the subcontractor. employees and subcontractor(s)that there is no right of action against HHSC for any duty owed by Section 4.06 HHSC's ability to contract with CONTRACTOR pursuant to this Agreement. subcontractors. CONTRACTOR understands that HHSC does not The CONTRACTOR may not limit or restrict, assume liability for the actions of, or judgments rendered against,the CONTRACTOR, its employees, through a covenant not to compete, employment agents or subcontractors. CONTRACTOR agrees agreement or other contractual arrangement, HHSC's that it has no right to indemnification or contribution ability to contract with subcontractors or former from HHSC for any judgments rendered against employees of the CONTRACTOR. CONTRACTOR or its subcontractors. HHSC's Article 5.Governing Law and Regulations liability to the CONTRACTOR's employees, agents and subcontractors, if any,will be governed by the Section 5.01 Governing law and venue. Texas Tort Claims Act, as amended or modified (Tex. This Agreement is governed by the laws of the Civ. PRACT.&REM.CODE§101.001 et seq.). State of Texas and interpreted in accordance with Section 4.05 Responsibility for subcontractors. Texas law. Provided CONTRACTOR first complies with the procedures set forth in Section 11.12, (a) CONTRACTOR remains fully responsible for Dispute Resolution, proper venue claim arising from obligations, services, and functions performed by its this Agreement will be in a court of competent subcontractors to the same extent as if such jurisdiction in Travis County, Texas. obligations, services, and functions were performed by CONTRACTOR'S employees, and for purposes of Section 5.02 CONTRACTOR responsibility for this Agreement such work will be deemed work compliance with laws and regulations. performed by CONTRACTOR. HHSC reserves the (a) CONTRACTOR is responsible for right to require the replacement of any subcontractor compliance with all laws, regulations, and found by HHSC to be unacceptable. administrative rules that govern the performance of (b) CONTRACTOR must not disclose the Services including, but not limited to, all State and Confidential Information of HHSC or the State of Federal tax laws, State and Federal employment Texas to a subcontractor unless and until such laws, State and Federal regulatory requirements, and subcontractor has agreed in writing to protect the licensing provisions. confidentiality of such Confidential Information in the (b) CONTRACTOR is responsible for ensuring manner required of CONTRACTOR under this each of its employees, agents or subcontractors who Agreement. provide Services under the Agreement are properly (c) CONTRACTOR must identify any licensed, certified, and/or have proper permits to subcontractor that is a newly-formed subsidiary or perform any activity related to the Services. entity,whether or not an affiliate of CONTRACTOR, (c) CONTRACTOR warrants that the Services substantiate the proposed subcontractor's ability to comply with all applicable Federal, State, and County perform the subcontracted Services, and certify to laws, regulations, codes, ordinances, guidelines, and HHSC that no loss of service will occur as a result of policies. CONTRACTOR will indemnify HHSC from the performance of such subcontractor. The and against any losses, liability, claims, damages, CONTRACTOR will assume responsibility for all penalties, costs, fees, or expenses arising from or in contractual responsibilities whether or not the connection with CONTRACTOR's failure to comply CONTRACTOR performs them. Further, HHSC with or violation of any such law, regulation, code, considers the CONTRACTOR to be the sole point of ordinance, or policy. contact with regard to contractual matters, including payment of any and all charges resulting from the Section 5.03 Immigration Reform and Control Act Agreement. of 1986. (d) At least 30 days prior to executing a CONTRACTOR shall comply with the subcontract or other agreement with a third party with requirements of the Immigration Reform and Control a value greater than$100,000.00, CONTRACTOR Act of 1986 and the Immigration Act of 1990(8 U.S.C. 7 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions §1101, et seq.) regarding employment verification and in order to ensure that persons with limited English retention of verification forms for any individual(s) proficiency are effectively informed and can have hired on or after November 6, 1986,who will perform meaningful access to programs, benefits, and any labor or services under this Agreement. activities. Section 5.04 Compliance with state and federal (c)CONTRACTOR agrees to comply with anti-discrimination laws. Executive Order 13279, and its implementing regulations at 45 C.F.R. Part 87 or 7 C.F.R. Part 16. (a)CONTRACTOR agrees to comply with state and These provide in part that any organization that federal anti-discrimination laws, including without participates in programs funded by direct financial limitation: assistance from the United States Department of (1)Title VI of the Civil Rights Act of 1964(42 Agriculture or the United States Department of Health U.S.C. §2000d et seq.); and Human Services shall not, in providing services, discriminate against a program beneficiary or (2)Section 504 of the Rehabilitation Act of prospective program beneficiary on the basis of 1973(29 U.S.C. §794); religion or religious belief. (3)Americans with Disabilities Act of 1990 (42 U.S.C. §12101 et seq.); (d) Upon request, CONTRACTOR will provide (4)Age Discrimination Act of 1975(42 HHSC with copies of all of the CONTRACTOR'S civil U.S.C. §§6101-6107); rights policies and procedures. (5)Title IX of the Education Amendments of (e)CONTRACTOR must notify HHSC's Civil 1972(20 U.S.C. §§1681-1688); Rights Office of any civil rights complaints received (6) Food Stamp Act of 1977(7 U.S.C. §200 relating to its performance under this Agreement. et se This notice must be delivered no more than ten(10) q.); and calendar days after receipt of a complaint. Notice (7)HHSC's administrative rules, as set forth provided pursuant to this section must be directed to: in the Texas Administrative Code,to the extent applicable to this Agreement. HHSC Civil Rights Office CONTRACTOR agrees to comply with all 701 W.51st Street, Mail Code W206 amendments to the above-referenced laws, and all Austin,Texas 78751 requirements imposed by the regulations issued Phone Toll Free: (888)388-6332 pursuant to these laws. These laws provide in part Phone: (512)438-4313 that no persons in the United States may, on the TTY Toll Free: (877)432-7232 grounds of race, color, national origin, sex, age, Fax: (512)438-5885. disability, political beliefs, or religion, be excluded Section 5.05 Environmental protection laws. from participation in or denied any aid, care, service or other benefits provided by Federal or State funding, CONTRACTOR agrees to comply with the or otherwise be subjected to discrimination. applicable provisions of federal environmental protection laws as described in this Section: (b)CONTRACTOR agrees to comply with Title VI of (a) Pro-Children Act of 1994. the Civil Rights Act of 1964, and its implementing regulations at 45 C.F.R. Part 80 or 7 C.F.R. Part 15, CONTRACTOR agrees to comply with the Pro- prohibiting a contractor from adopting and Children Act of 1994(20 U.S.C. §6081 et seq.), as implementing policies and procedures that exclude or applicable, regarding the provision of a smoke-free have the effect of excluding or limiting the workplace and promoting the non-use of all tobacco participation of clients in its programs, benefits, or products. activities on the basis of national origin.Applicable (b) National Environmental Policy Act of 1969. state and federal civil rights laws require contractors CONTRACTOR agrees to comply with any to provide alternative methods for ensuring access to applicable provisions relating to the institution of services for applicants and recipients who cannot environmental quality control measures contained in express themselves fluently in English. the National Environmental Policy Act of 1969(42 CONTRACTOR agrees to ensure that its policies do U.S.C. §4321 et seq.)and Executive Order 11514 not have the effect of excluding or limiting the ("Protection and Enhancement of Environmental participation of persons in its programs, benefits, and Quality"). activities on the basis of national origin. CONTRACTOR also agrees to take reasonable steps to provide services and information, both orally and in writing, in appropriate languages other than English, 8 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (c) Clean Air Act and Water Pollution Control Act or state laws, rules, regulations, policies, guidelines or regulations. circumstances affect the performance of the work. CONTRACTOR agrees to comply with any The Parties will develop a business plan for applicable provisions relating to required notification negotiating appropriate change order and amendment of facilities violating the requirements of Executive procedures. Order 11738("Providing for Administration of the (b) Modifications resulting from imposition of Clean Air Act and the Federal Water Pollution Control remedies. Act with Respect to Federal Contracts, Grants, or This Agreement may be modified under the Loans"). terms of Article 11 (relating to Remedies and (d) State Clean Air Implementation Plan. Disputes). CONTRACTOR agrees to comply with any Section 7.02 Required compliance with applicable provisions requiring conformity of federal amendment modification procedures. actions to State(Clean Air) Implementation Plans under§176(c)of the Clean Air Act of 1955, as No different or additional services,work, or amended(42 U.S.C. §740 et seq.). products will be authorized or performed except (e) Safe Drinking Water Act of 1974. pursuant to an amendment or modification of this Agreement that is executed in compliance with this CONTRACTOR agrees to comply with article. No waiver of any term, covenant, or condition applicable provisions relating to the protection of of this Agreement will be valid unless executed in underground sources of drinking water under the Safe compliance with this article. CONTRACTOR will not Drinking Water Act of 1974, as amended(21 U.S.C. § be entitled to payment for any services,work or 349;42 U.S.C. §§300f to 300j-9). products that are not authorized by a properly Article 6.Service Levels and Performance executed Agreement amendment or modification, or Measurement through the express authorization of HHSC. Section 6.01 Performance measurement. Article 8.Audit and Financial Compliance Satisfactory performance of this Agreement will Section 8.01 Financial record retention and audit. be measured by: CONTRACTOR agrees to maintain, and require (a)Adherence to this Agreement, including all its subcontractors to maintain, supporting financial representations and warranties; information and documents that are adequate to (b)Compliance with project work plans, ensure that claims are made in accordance with schedules, and milestones as proposed by applicable Federal and State requirements, and are CONTRACTOR in its Proposal and as revised by sufficient to ensure the accuracy and validity of CONTRACTOR and finally approved by HHSC; CONTRACTOR invoices. Such documents, including ( ed Deliverables ll original claims forms, will be maintained and c) Delivery of the Se rvices an Des in retained by CONTRACTOR or its subcontractors for a accordance with these Services levels and live availability proposed in its Proposal and as finally approved or period of seven(7)years after the date of submission accepted in by its Proposal of the final billing or until the resolution of all litigation, claim,financial management review or audit (d) Results of audits performed by HHSC or its pertaining to this Agreement, whichever is longer. representatives in accordance with Article 8; CONTRACTOR agrees to timely repay any (e)Timeliness, completeness, and accuracy of undisputed audit exceptions taken by HHSC in any required reports; and audit of the Agreement. (f)Achievement of performance measures Section 8.02 Access to records,books,and developed by CONTRACTOR and HHSC and as documents. modified from time to time by written agreement during the Initial Term of this Agreement. (a) Upon reasonable notice, CONTRACTOR must provide, and cause its subcontractors to provide, Article 7.Amendments, Modifications,and Change the officials and entities identified in this Section with Orders prompt, reasonable, and adequate access to any Section 7.01 Amendments and modifications. records, books, documents, and papers that are directly pertinent to the performance of the Scope of (a) Amendments and modifications resulting from Work. changes in law or contract. (b) CONTRACTOR and its subcontractors must This Agreement may be amended by mutual provide the access described in this Section upon written agreement of the Parties if changes in federal 9 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions HHSC's request. This request may be for, but is not inspectors reasonably may require to complete such limited to, the following purposes: audits or inspections. (1) Examination; Section 8.04 Response/compliance with audit or (2) Audit; inspection findings. (3) Investigation; (a) CONTRACTOR must take action to ensure (4) Contract administration; or its or a subcontractor's compliance with or correction (5)The making of copies, excerpts, or of any finding of noncompliance with any law, transcripts. regulation, audit requirement, or generally accepted (c) The access required must be provided to the accounting principle relating to the Services and following officials access ss and/or required must Deliverables or any other deficiency contained in any audit, review, or inspection conducted under this (1) The United States Department of Health Article. This action will include CONTRACTOR'S and Human Services or its designee; delivery to HHSC, for HHSC'S approval, a Corrective (2) The Comptroller General of the United Action Plan that addresses deficiencies identified in States or its designee; any audit(s), review(s), or inspection(s)within thirty (3) Medicaid program personnel from HHSC (30)calendar days of the close of the audit(s), or its designee; review(s), or inspection(s). (4) The Office of Investigations and (b) CONTRACTOR must bear the expense of Enforcement of HHSC; compliance with any finding of noncompliance under this Section that is: (5) Any independent verification and (1) Required by a Texas or Federal law, validation contractor or quality assurance regulation, rule or other audit requirement relating contractor, when acting on behalf of HHSC; to CONTRACTOR's business; (6) The Office of the State Auditor of Texas or its designee; (2) Performed by CONTRACTOR as part of the Services; or (7) A State or Federal law enforcement (3) Necessary due to CONTRACTOR's agency; noncompliance with any law, regulation, rule or (8) A special or general investigating audit requirement imposed on CONTRACTOR. committee of the Texas Legislature or its designee; and (c) As part of the Services, CONTRACTOR must provide to HHSC upon request a copy of those (9) Any other entity identified by HHSC. portions of CONTRACTOR's and its subcontractors' (d) CONTRACTOR agrees to provide the internal audit reports relating to the Services and access described wherever CONTRACTOR Deliverables provided to the State under the maintains such books, records, and supporting Agreement. documentation. CONTRACTOR further agrees to Section 8.05 Audit of CONTRACTOR fees. provide such access in reasonable comfort and to provide any furnishings, equipment, or other (a) CONTRACTOR will provide, and will cause conveniences deemed reasonably necessary to fulfill its subcontractors to provide,to HHSC and its the purposes described in this Section. designees access to such financial records and CONTRACTOR will require its subcontractors to supporting documentation reasonably requested by provide comparable access and accommodations. HHSC. Section 8.03 Audits of Services, Deliverables and (b) In addition to the normal monthly review and inspections. payment of administrative vouchers, HHSC may audit the Fees charged to HHSC to determine that such (a) Upon notice from HHSC, CONTRACTOR Fees are accurate and in accordance with the will provide, and will cause its subcontractors to Agreement. provide, such auditors and inspectors as HHSC may (c) If, as a result of such audit, HHSC from time to time designate,with access to: determines that CONTRACTOR has overcharged the (1) CONTRACTOR service locations, State, HHSC will notify CONTRACTOR of the amount facilities, or installations; and of such overcharge and CONTRACTOR will promptly (2) CONTRACTOR Software and pay to HHSC the amount of the overcharge, plus Equipment. interest. Interest on such overpayment amount will be (b) CONTRACTOR must provide as part of the calculated from the date of receipt by the Services any assistance that such auditors and CONTRACTOR of the overcharged amount until the 10 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions date of payment to HHSC, and will be calculated at Section 9.03 Disputed fees. the Department of Treasury's Median Rate(resulting If HHSC disputes payment of all or any portion of from the Treasury's auction of 13 week bills)for the an invoice from the CONTRACTOR, HHSC will notify week in which liability is assessed, but in no event to the CONTRACTOR of such dispute and both Parties exceed the highest lawful rate of interest. In the event will attempt in good faith to resolve the dispute. HHSC any such audit reveals an overcharge to HHSC, shall not be required to pay any disputed portion of a CONTRACTOR will reimburse HHSC for the cost of CONTRACTOR invoice. Notwithstanding any such such audit. dispute, the CONTRACTOR must continue to perform Section 8.06 SAO Audit the Services and produce Deliverables in compliance with the terms of this Agreement pending resolution of The CONTRACTOR understands that such dispute so long as all undisputed amounts acceptance of funds under this Contract acts as acceptance of the authority of the State Auditor's continue to be paid to CONTRACTOR. Office("SAO"), or any successor agency,to conduct Section 9.04 Liability for taxes. an investigation in connection with those funds. The HHSC is not responsible in any way for the CONTRACTOR further agrees to cooperate fully with payment of any Federal, state or local taxes related to the SAO or its successor in the conduct of the audit or or incurred in connection with the CONTRACTOR'S investigation, including providing all records performance of this Agreement. CONTRACTOR must requested. The CONTRACTOR will ensure that this pay and discharge any and all such taxes, including clause concerning the authority to audit funds received indirectly by subcontractors through any penalties and interest. In addition, HHSC is CONTRACTOR and the requirement to cooperate is exempt from Federal excise taxes, and will not pay for included in any subcontract it awards. any personal property taxes or income taxes levied on CONTRACTOR or on any taxes levied on employee Article 9.Terms and Conditions of Payment wages. Section 9.01 Rights of set-off. Section 9.05 Liability for employment-related (a) General right of set-off charges and benefits. With respect to any undisputed amount that a CONTRACTOR will perform work under this Party in good faith determines should be reimbursed Agreement as an independent contractor and not as to it or is otherwise payable to it by the other Party agent or representative of HHSC. CONTRACTOR is pursuant to this Agreement, the Party seeking the set- solely and exclusively liable for all taxes and off may deduct the entire amount owed against the employment-related charges incurred in connection charges otherwise payable or expenses owed to it with the performance of this Agreement. HHSC will under this Agreement until such time as the entire not be liable for any employment-related charges or amount determined to be owed has been paid. benefits of CONTRACTOR, such as workers (b) Duty to make payments. compensation benefits, unemployment insurance and benefits, or fringe benefits. HHSC will be relieved of its obligation to make any payments to the CONTRACTOR until such time Section 9.06 No additional consideration. as all such amounts have been credited to HHSC and CONTRACTOR will not be entitled to nor receive the CONTRACTOR will be relieved of its obligation to from HHSC any additional consideration, make any payments to HHSC until such time as such compensation, salary,wages, or any other type of amounts have been credited to the CONTRACTOR. remuneration for services rendered under the Section 9.02 Expenses. Agreement. Specifically, CONTRACTOR will not be entitled by virtue of the Agreement to consideration in Except as provided in its Cost Proposal, all other the form of overtime, health insurance benefits, expenses incurred by the CONTRACTOR in retirement benefits, disability retirement benefits, sick connection with its provision of the Services or leave, vacation time, paid holidays, or other paid Deliverables will not be reimbursed by HHSC unless leaves of absence of any type or kind whatsoever. In agreed upon by HHSC. CONTRACTOR will be addition, the costs associated with transportation, responsible for payment of all expenses related to delivery, and insurance relating to the salaries, benefits, employment taxes, and insurance CONTRACTOR'S performance of this Agreement will for its Staff. In addition,the costs associated with be paid for by the CONTRACTOR. transportation, delivery, and insurance for each Deliverable will be paid for by CONTRACTOR. 11 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Section 9.07 No increase in charges. provide the disclosing Party certificates evidencing CONTRACTOR will not increase Charges during such destruction. the term of the Agreement,except as specifically (g) The obligations in this Section shall not authorized in Article 7. restrict any disclosure by a Party pursuant to any applicable law, or by order of any court or government Article 10. Disclosure and Confidentiality agency, provided that the disclosing Party shall give of Information prompt notice to the non-disclosing Party of such Section 10.01 Confidentiality. order. (h) With the exception of confidential HHSC (a) CONTRACTOR and all subcontractors, Program recipient or client information, Confidential consultants, or agents under the Agreement must Information of a Party shall not be afforded the treat all information that is obtained through protection of the Agreement if such data was: performance of the Services under the Agreement, (1) Already known to the receiving Party including, but not limited to, information relating to without restrictions at the time of its disclosure by applicants or recipients of HHSC Programs as the furnishing Party; Confidential Information to the extent that confidential treatment is provided under law and regulations. (2) Independently developed by the (b) CONTRACTOR is responsible for receiving Party without reference to the furnishing understanding the degree to which information Party's Confidential Information; obtained through performance of this Agreement is (3) Rightfully obtained by the other Party confidential under State and Federal law, regulations, without restriction from a third party after its or administrative rules. disclosure by the furnishing Party; (c) CONTRACTOR and all subcontractors, (4) Publicly available other than through the consultants, or agents under the Agreement may not fault or negligence of the other Party; or use any information obtained through performance of (5) Released without restriction to anyone. this Agreement in any manner except as is necessary to the proper discharge of obligations and securing of Section 10.02 Disclosure of HHSC's Confidential rights under the Agreement. Information. (d) CONTRACTOR must have a system in (a) CONTRACTOR will immediately report to effect to protect all records and all other documents HHSC any and all unauthorized disclosures or uses of deemed confidential under this Agreement that are HHSC's Confidential Information of which it or its maintained in connection with the activities funded subcontractor(s), consultant(s), or agent(s)is aware under the Agreement. Any disclosure or transfer of or has knowledge. CONTRACTOR acknowledges Confidential Information by CONTRACTOR, including that any publication or disclosure of HHSC's information required by HHSC, will be in accordance Confidential Information to others may cause with applicable law. If the CONTRACTOR receives a immediate and irreparable harm to HHSC and may request for information deemed confidential under this constitute a violation of State or federal laws. If Agreement,the CONTRACTOR will immediately CONTRACTOR, its subcontractor(s), consultant(s), or notify the State of such request, and will make agent(s)should publish or disclose such Confidential reasonable efforts to protect the information from Information to others without authorization, HHSC will public disclosure. immediately be entitled to injunctive relief or any other (e) In addition to the requirements expressly remedies to which it is entitled under law or equity stated in this Section, CONTRACTOR must comply without requiring a cure period as described in Article with any policy, rule, or reasonable requirement of 11. HHSC will have the right to recover from HHSC that relates to the safeguarding or disclosure of CONTRACTOR all damages and liabilities caused by information relating to HHSC Programs recipients, or arising from CONTRACTOR's, its subcontractors', CONTRACTOR'S operations, or the CONTRACTOR consultants', or agents'failure to protect HHSC's performance of the Agreement. Confidential Information. Contractor will defend with (f) In the event of the expiration of the counsel approved by HHSC, indemnify and hold and expenses HHSC from all g damages, costs, liabilities, Agreement or termination of the Agreement for any reason, all Confidential Information of a Party and expenses(including without limitation reasonable disclosed to and all copies thereof made by the other attorneys'fees and costs)caused or arising from Party shall be returned to the disclosing Party or, at CONTRACTOR's or its subcontractors',ntracttoo rs'', consultants' or agents'failure to protect HHSC's Confidential the disclosing Party's option,erased or destroyed. Information. The recipient of the Confidential Information shall 12 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (b) CONTRACTOR will require its (2) Use all reasonable efforts to resist subcontractor(s), consultant(s), and agent(s)to providing such access. comply with the terms of this provision. (d) If CONTRACTOR resists disclosure of Section 10.03 Requests for public information. HHSC's Privileged Work Product in accordance with this Section, HHSC will,to the extent authorized (a) HHSC agrees that it will promptly notify under Civil Practices and Remedies Code or other CONTRACTOR of a request for disclosure of public applicable State law, have the right and duty to information filed in accordance with the Texas Public represent CONTRACTOR in such resistance or to Information Act, Chapter 552 of the Texas retain counsel to so represent CONTRACTOR or to Government Code, that consists of the reimburse CONTRACTOR for reasonable attorneys' CONTRACTOR'S Confidential Information, including fees and expenses incurred in resisting such access. data to which CONTRACTOR has a proprietary or (e) If a court of competent jurisdiction orders commercial interest. HHSC will deliver a copy of the CONTRACTOR to produce documents, disclose data, request for public information to CONTRACTOR. or otherwise breach the confidentiality obligations (b)With respect to any information that is the imposed in the Agreement, or otherwise with respect subject of a request for disclosure, CONTRACTOR is to maintaining the confidentiality, proprietary nature, required to demonstrate to the Texas Office of and secrecy of Privileged Work Product, Attorney General the specific reasons why the CONTRACTOR will not be liable for breach of such requested information is confidential or otherwise obligation. excepted from required public disclosure under law. CONTRACTOR will provide HHSC with copies of all Section 10.05 Unauthorized acts. such communications. Each Party agrees to (c) To the extent authorized under the Texas (1) Notify the other Party promptly of any Public Information Act, HHSC agrees to safeguard unauthorized possession, use, or knowledge, or from disclosure information received from attempt thereof, of any Confidential Information by CONTRACTOR that the CONTRACTOR believes to any person or entity that may become known to it; be Confidential Information. CONTRACTOR must (2) Promptly furnish to the other Party full details clearly mark such information as Confidential of the unauthorized possession, use, or knowledge, or Information or provide written notice to HHSC that it attempt thereof, and use reasonable efforts to assist considers the information confidential. the other Party in investigating or preventing the Section 10.04 Privileged Work Product. reoccurrence of any unauthorized possession, use, or (a) CONTRACTOR acknowledges that HHSC knowledge, or attempt thereof, of Confidential Information; asserts that Privileged Work Product may be prepared in anticipation of litigation and that (3)Cooperate with the other Party in any CONTRACTOR is performing the Services with litigation and investigation against third Parties respect of Privileged Work Product as an agent of deemed necessary by such Party to protect its HHSC, and that all matter related thereto is protected proprietary rights; and from disclosure by the Texas Rules of Civil (4) Promptly prevent a reoccurrence of any such Procedure, Texas Rules of Evidence, Federal Rules unauthorized possession, use, or knowledge of of Civil Procedure, or Federal Rules of Evidence. Confidential Information. (b) HHSC will notify CONTRACTOR of any Section 10.06 Legal action. Privileged Work Product to which CONTRACTOR has or may have access. After the CONTRACTOR is Neither party may commence any legal action or notified or otherwise becomes aware that such proceeding in respect to any unauthorized documents, data, database, or communications are possession, use, or knowledge, or attempt thereof, of Privileged Work Product, only CONTRACTOR Confidential Information by any person or entity, personnel for whom such access is necessary for the which action or proceeding identifies the other Party purposes of providing the Services may have access or its Confidential Information without such Party's to Privileged Work Product. consent. (c) If CONTRACTOR receives notice of any Section 10.07 Information Security judicial or other proceeding seeking to obtain access to HHSC's Privileged Work Product, CONTRACTOR (a) CONTRACTOR and all subcontractors, will: consultants, or agents under the Agreement (1) Immediately notify HHSC; and (collectively "CONTRACTOR") must comply with the following: 13 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (6) CONTRACTOR security violation reports; (1) Health and Human Services Enterprise (7) CONTRACTOR employee security Information Security Standards and acknowledgement agreements; and Guidelines and (8) Lists of CONTRACTOR's employees with (2) Title 1, Sections 202.1 and 202.3 through authorized access to HHSC confidential 202.28,Texas Administrative Code. information. (b) CONTRACTOR must comply with the Items (1) through (5) above are subject to HHSC's following, as applicable: review and approval. Neither HHSC's review or approval, nor its fail to review or approve, will relieve, (1) The Federal Information Security waive or satisfy any of CONTRACTOR's obligations Management Act of 2002(FISMA); under this Agreement. (2) The Health Insurance Portability and Accountability Act of 1996(HIPAA); (e)CONTRACTOR will provide, and will cause its (3) The Health Information Technology for subcontractors and agents to provide, to HHSC Economic and Clinical Health Act (HITECH periodic written certifications of compliance with Act); controls and provisions relating to information (4) Publication 1075 — Tax Information Security security, including but not limited, those related to Guidelines for Federal, State and Local confidential data transfers and the handling and Agencies; disposal of Protected Health Information (PHI), (5) National Institute of Standards and Electronic Protected Health Information (EPHI), and Technology (NIST) Special Publication 800- Personally Identifiable Information (PII). Acceptable 66 Revision 1 — An Introductory Resource forms of written compliance may be, but are not Guide for Implementing the Health Insurance limited to: Portability and Accountability Act (HIPAA) Security Rule; (1) Statement on Auditing Standards No.70, (6) NIST Special Publication 800-53 Revision 3 Service Organizations(SAS-70) Report; — Recommended Security Controls for (2) General Security Controls Audit; Federal Information Systems and (3) Application Controls Audit; Organizations; and (4) Vulnerability Assessment; and (7) NIST Special Publication 800-47 — Security (5) Network/Systems Penetration Test. Guide for Interconnecting Information Technology Systems. Article 11. Remedies and Disputes Section 11.01 Understanding and expectations. (c) In addition to the requirements expressly stated in this Section, CONTRACTOR must comply The remedies described in this Section are with any other State or Federal law, regulation, or directed to CONTRACTOR's timely and responsive administrative rule relating to the specific HHSC performance of the Services and production of program area that CONTRACTOR supports. Deliverables, and to the creation of a flexible and responsive relationship between the Parties. (d) Upon reasonable notice, CONTRACTOR Section 11.02 Tailored remedies. must provide, and cause its subcontractors and agents to provide, HHSC or its designee, prompt, (a) Understanding of the Parties. reasonable, and adequate access to any information CONTRACTOR agrees and understands that security records, books, documents, and papers that HHSC may pursue tailored contractual remedies for are directly pertinent to the performance of the Scope noncompliance with the Agreement. At any time and of Work including, but not limited to: at its discretion, HHSC may impose or pursue one or more remedies for each item of noncompliance and (1) CONTRACTOR information security policies; will determine remedies on a case-by-case basis. (2) CONTRACTOR information security HHSC's pursuit or non-pursuit of a tailored remedy procedures; does not constitute a waiver of any other remedy that (3) CONTRACTOR information security HHSC may have at law or equity. standards; (b) Notice and opportunity to cure for non-material (4) CONTRACTOR information security breach. guidelines; (5) CONTRACTOR security plan in compliance (1) HHSC will notify CONTRACTOR in writing of with NIST Special Publication 800-53 specific areas of CONTRACTOR performance that fail Revision 3; to meet performance expectations, standards, or 14 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions schedules, but that, in the determination of HHSC, do (5) At any time during this process, HHSC not result in a material deficiency or delay in the reserves the right to: implementation or operation of the Services. (A) Suspend all, or part of,the (2) CONTRACTOR will,within three(3)business Agreement, and to withhold further payment days(or another date approved by HHSC)of receipt for the suspended portions of the of written notice of a non-material deficiency, provide Agreement; or the HHSC Project Manager a written response that: (B) Prohibit CONTRACTOR from (A) Explains the reasons for the deficiency, incurring additional obligations of funds CONTRACTOR's plan to address or cure the during investigation of the alleged breach deficiency, and the date and time by which the and pending corrective action, if necessary, deficiency will be cured; or by CONTRACTOR or a decision by HHSC to (B) If CONTRACTOR disagrees with terminate for cause. HHSC's findings, its reasons for disagreeing with (6) If HHSC rejects CONTRACTOR's written HHSC's findings. explanation or proposed Corrective Action Plan, (3) CONTRACTOR's proposed cure of a non- HHSC may issue a Stop Work Order to material deficiency is subject to the approval of CONTRACTOR or any of its subcontractors or HHSC. CONTRACTOR's repeated commission of suppliers. HHSC may delay the implementation of non-material deficiencies or repeated failure to the Stop Work Order if it affects the completion of any resolve any such deficiencies may be regarded by of the Services in accordance with the approved HHSC as a material deficiency and entitle HHSC to Schedule or Work Plan. pursue any other remedy provided in the Agreement (7) HHSC's acceptance of a Corrective Action or any other appropriate remedy HHSC may have at Plan under this Section will not: law or equity. (A) Excuse CONTRACTOR's prior (c) Corrective action plan. substandard performance; (1) At its option, HHSC may require (B) Relieve CONTRACTOR of its duty CONTRACTOR to submit to HHSC a detailed written to comply with performance standards; or plan (the"Corrective Action Plan")to correct or (C) Prohibit HHSC from assessing resolve a material breach of this Agreement. additional tailored remedies or pursuing (2) The Corrective Action Plan must provide: other appropriate remedies for continued (A) A detailed explanation of the substandard performance. reasons for the cited deficiency; (d) Administrative remedies. (B) CONTRACTOR's assessment or (1) At its discretion, HHSC may impose one or diagnosis of the cause; and more of the following remedies for each item of (C) A specific proposal to cure or noncompliance and will determine the scope and resolve the deficiency. severity of the remedy on a case-by-case basis: (3) The Corrective Action Plan must be (A) Assess liquidated damages in submitted by the deadline set forth in HHSC's request accordance with the terms of this for a Corrective Action Plan. The Corrective Action Agreement; Plan is subject to approval by HHSC,which will not (B) Conduct accelerated monitoring of unreasonably be withheld. the CONTRACTOR. Accelerated monitoring (4) HHSC will notify CONTRACTOR in writing of includes more frequent or more extensive HHSC's final disposition of HHSC's concerns. If monitoring by HHSC or its agent; HHSC accepts CONTRACTOR's proposed Corrective (C) Require additional, more detailed, Action Plan, HHSC may: financial and/or programmatic reports to be (A) Condition such approval on submitted by CONTRACTOR; completion of tasks in the order or priority (D) Decline to renew or extend the that HHSC may prescribe; Agreement; or (B) Disapprove portions of (E) Terminate the Agreement in CONTRACTOR's proposed Corrective accordance with Section 11.03. Action Plan; or (2) For purposes of the Agreement, an item of (C) Require additional or different noncompliance means a specific action of corrective action(s). CONTRACTOR that: 15 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (A) Violates a provision of the perform in accordance with the Agreement, HHSC Agreement; may assess liquidated damages as provided in this (B) Fails to meet an agreed measure of Section. performance; or (3) If CONTRACTOR fails to perform any of the (C) Represents a failure of Services described in the Agreement, HHSC may CONTRACTOR to be reasonably responsive assess liquidated damages for each occurrence of a to a reasonable request of HHSC relating to liquidated damages event,to the extent consistent the Services for information, assistance, or with HHSC's tailored approach to remedies and support within the timeframe specified by Texas law. HHSC. (4) HHSC may elect to collect liquidated (3) HHSC will provide notice to CONTRACTOR damages: of the imposition of an administrative remedy in (A) Through direct assessment and accordance with this Section,with the exception of demand for payment delivered to accelerated monitoring,which may be unannounced. CONTRACTOR; or HHSC may require CONTRACTOR to file a written (B) By deduction of amounts assessed response in accordance with this Section. as liquidated damages as set-off against (4) The Parties agree that a State or Federal payments then due to CONTRACTOR for statute, rule, regulation, or Federal guideline will the Services or Deliverables or that become prevail over the provisions of this Section unless the due at any time after assessment of the statute, rule, regulation, or guidelines can be read liquidated damages. HHSC will make together with this Section to give effect to both. deductions until the full amount payable by (e) Damages. the CONTRACTOR is received by the State. (1) HHSC will be entitled to actual and (f) Equitable Remedies consequential damages resulting from the (1) CONTRACTOR acknowledges that, if CONTRACTOR'S failure to comply with any of the CONTRACTOR breaches(or attempts or threatens to terms of the Agreement. In some cases, the actual breach)its obligation under this Agreement, the State damage to HHSC or the State of Texas as a result of will be irreparably harmed. In such a circumstance, CONTRACTOR'S failure to meet any aspect of the HHSC may proceed directly to court. responsibilities of the Agreement and/or to meet (2) If a court of competent jurisdiction finds that specific performance standards set forth in the CONTRACTOR breached (or attempted or threatened Agreement are difficult or impossible to determine to breach)any such obligations, CONTRACTOR with precise accuracy. Therefore, liquidated damages agrees that without any additional findings of will be assessed in writing against and paid by the irreparable injury or other conditions to injunctive CONTRACTOR for failure to meet any aspect of the relief, it will not oppose the entry of an appropriate responsibilities of the Agreement and/or to meet the order compelling performance by CONTRACTOR and specific performance standards identified by the restraining it from any further breaches(or attempted HHSC. Liquidated damages will be assessed if or threatened breaches). HHSC determines such failure is the fault of the CONTRACTOR(including the CONTRACTOR'S (g) Suspension of Agreement subcontractors and/or consultants)and is not (1) HHSC may suspend performance of all or materially caused or contributed to by HHSC or its any part of the Agreement if: agents. If at any time, HHSC determines the (A) HHSC determines that CONTRACTOR has not met any aspect of the CONTRACTOR has committed a material responsibilities of the Agreement and/or the specific breach of the Agreement; performance standards due to mitigating (B) HHSC has reason to believe that circumstances, HHSC reserves the right to waive all CONTRACTOR has committed, assisted in or part of the liquidated damages. All such waivers the commission of, or failed to take must be in writing, contain the reasons for the waiver, appropriate action concerning fraud, abuse, and be signed by the appropriate executive of HHSC. malfeasance, misfeasance, or nonfeasance (2) The liquidated damages prescribed in this by any party concerning the Agreement; or Section are not intended to be in the nature of a (C) HHSC determines that suspension penalty, but are intended to be reasonable estimates of the Agreement in whole or in part is of HHSC's projected financial loss and damage convenient or in the best interests of the resulting from the CONTRACTOR's nonperformance, State of Texas or the HHSC Programs. including financial loss as a result of project delays. Accordingly, in the event CONTRACTOR fails to 16 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (2) HHSC will notify CONTRACTOR in writing of HHSC may terminate this Agreement if a its intention to suspend the Agreement in whole or in court of competent jurisdiction finds part. Such notice will: CONTRACTOR failed to adhere to any laws, (A) Be delivered in writing to ordinances, rules, regulations or orders of any CONTRACTOR; public authority having jurisdiction and such de a concise description the violation prevents or substantially impairs (B) Include iption of facts or matter leading concise HHSC's decision; performance of CONTRACTOR's duties under this Agreement. and (C) Unless HHSC is suspending the (3) Breach of confidentiality. contract for convenience, request a HHSC may terminate this Agreement if Corrective Action Plan from CONTRACTOR CONTRACTOR breaches confidentiality laws or describe actions that CONTRACTOR may with respect to the Services and Deliverables take to avoid the contemplated suspension provided under this Agreement. of the Agreement. (4) Failure to maintain adequate personnel Section 11.03 Termination of Agreement. or resources. HHSC may terminate this Agreement if, after In addition to other provisions of this article providing notice and an opportunity to correct, allowing termination,this Agreement will terminate HHSC determines that CONTRACTOR has failed upon the Expiration Date unless extended in to supply personnel or resources and such failure accordance with the terms of this Agreement, or results in CONTRACTOR's inability to fulfill its terminated sooner under the terms of this Agreement. duties under this Agreement. Prior to completion of the Initial Term and any (5) Termination for gifts and gratuities. extensions or renewal thereof, all or a part of this Agreement may be terminated for any of the following (A)HHSC may terminate this reasons: Agreement following the determination by a (a) Termination by mutual agreement of the Parties. competent judicial or quasi-judicial authority and CONTRACTOR's exhaustion of all legal This Agreement may be terminated by mutual remedies that CONTRACTOR, its agreement of the Parties. Such agreement must be employees, agents or representatives have in writing. either offered or given any thing of value an (b) Termination in the best interest of the State. officer or employee of HHSC or the State of HHSC may terminate the Agreement at any time Texas in violation of state law. when, in its sole discretion, HHSC determines that (B)CONTRACTOR must include a termination is in the best interests of the State of similar provision in each of its subcontracts Texas. The termination will be effective on the date and shall enforce this provision against a specified in HHSC's notice of termination. subcontractor who has offered or given any (c) Termination for cause. thing of value to any of the persons or entities described in this Section,whether or HHSC reserves the right to terminate this not the offer or gift was in CONTRACTOR's Agreement, in whole or in part, upon the following behalf. conditions: (C) Termination of a subcontract by (1) Assignment for the benefit of creditors, CONTRACTOR pursuant to this provision appointment of receiver, or inability to pay debts. will not be a cause for termination of the HHSC may terminate this Agreement if Agreement unless: CONTRACTOR: (1) CONTRACTOR fails to replace (A)Makes an assignment for the benefit such terminated subcontractor within a of its creditors; reasonable time; and (B)Admits in writing its inability to pay (2) Such failure constitutes Cause its debts generally as they become due; or as described in this Section. (C)Consents to the appointment of a (D) For purposes of this Section, a receiver, trustee, or liquidator of "thing of value" means any item of tangible CONTRACTOR or of all or any part of its or intangible property that has a monetary property. value of more than$50.00 and includes, but (2) Failure to adhere to laws, rules, is not limited to, cash, food, lodging, ordinances, or orders. entertainment, and charitable contributions. 17 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions The term does not include contributions to (B) CONTRACTOR agrees to pay for all holders of public office or candidates for reasonable expenses of HHSC including the cost public office that are paid and reported in of counsel, incident to: accordance with State and/or Federal law. (1) The enforcement of payment of all (6) Termination for non-appropriation of funds. obligations of the CONTRACTOR by any Notwithstanding any other provision of action or participation in, or in connection this Agreement, if funds for the continued with a case or proceeding under Chapters 7, fulfillment of this Agreement by HHSC are at 11, or 13 of the United States Bankruptcy any time not forthcoming or are insufficient, Code, or any successor statute; through failure of any entity to appropriate (2) A case or proceeding involving a funds or otherwise, then HHSC will have the receiver or other similar officer duly right to terminate this Agreement at no appointed to handle the CONTRACTOR's additional cost and with no penalty business; or whatsoever by giving prior written notice (3) A case or proceeding in a State documenting the lack of funding. court initiated by HHSC when previous (7) Judgment and execution. collection attempts have been unsuccessful. (A) HHSC may terminate the Agreement if (9) Termination for CONTRACTOR'S material judgment for the payment of money in excess of breach of the Agreement. $500,000.00 that is not covered by insurance, is HHSC will have the right to terminate the rendered by any court or governmental body Agreement in whole or in part if HHSC against CONTRACTOR, and CONTRACTOR determines, at its sole discretion, that does not: CONTRACTOR has materially breached the (1) Discharge the judgment or provide Agreement. for its discharge in accordance with the terms of the judgment; Section 11.04 Effective date of termination. (2) Procure a stay of execution of the Except as otherwise provided in this Agreement, judgment within 30 days from the date of termination will be effective as of the date specified in entry thereof; or the notice of termination. (3) Perfect an appeal of such judgment Section 11.05 Extension of termination effective and cause the execution of such judgment to date. be stayed during the appeal, providing such financial reserves as may be required under HHSC may extend the effective date of generally accepted accounting principles. termination one or more times as it elects, in its sole (B) If a writ or warrant of attachment or any discretion. similar process is issued by any court against all Section 11.06 Payment and other provisions at or any material portion of the property of Agreement termination. CONTRACTOR, and such writ or warrant of attachment or any similar process is not released (a) If HHSC terminates this Agreement, HHSC or bonded within 30 days after its entry, HHSC will pay CONTRACTOR on the effective date of may terminate the Agreement in accordance with termination (or as soon as possible thereafter taking this Section. into account appropriation and fund accounting requirements)any undisputed amounts due for all (8) Termination for insolvency. completed, approved, and accepted Services or (A) HHSC may terminate the Agreement if Deliverables. CONTRACTOR: (b) HHSC further agrees to negotiate in good (1) Files for bankruptcy; faith with CONTRACTOR to equitably adjust and (2) Becomes or is declared insolvent, or settle any accrued or outstanding liabilities for any is the subject of any proceedings related to unaccepted Service or deliverable and Change Order its liquidation, insolvency, or the appointment that of a receiver or similar officer for it; (1) Is due or delivered prior to or upon (3) Makes an assignment for the benefit contract termination; of all or substantially all of its creditors; or (2) Is complete or substantially complete, or (4) Enters into an Agreement for the for which CONTRACTOR can document to the composition, extension, or readjustment of satisfaction of HHSC substantial progress; and substantially all of its obligations. 18 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (3) Benefits HHSC or the State of Texas, best served when the Parties employ all reasonable notwithstanding its unaccepted status. and informal means to resolve any dispute under this (c)CONTRACTOR must provide HHSC all Agreement. The Parties express their mutual reasonable access to records, facilities, and commitment to using all reasonable and informal documentation as is required to efficiently and means of resolving disputes prior to invoking a expeditiously close out the Services under this remedy provided elsewhere in this Section. Agreement. (b) Duty to negotiate in good faith. (d)CONTRACTOR must prepare a turnover Any dispute that in the judgment of any Party to plan,which is acceptable to and approved by HHSC. this Agreement may materially or substantially affect That turnover plan will be implemented during the the performance of any Party will be reduced to time period between receipt of notice and the writing and delivered to the other Party. The Parties termination date. must then negotiate in good faith and use every reasonable effort to resolve such dispute and the Section 11.07 Modification of Agreement in the S Parties shall not resort to any formal proceedings event n of remedies. unless they have reasonably determined that a HHSC may propose a modification of this negotiated resolution is not possible. The resolution of Agreement in response to the imposition of a remedy any dispute disposed of by agreement between the under this article.Any modifications under this Parties shall be reduced to writing and delivered to all Section must be reasonable, limited to the matters Parties within ten(10)business days. causing the exercise of a remedy, and in writing. (c) Claims for breach of Agreement. CONTRACTOR must negotiate such proposed modifications in good faith. (1) General requirement.As required by Chapter 2260, Government Code, CONTRACTOR's Section 11.08 Turnover assistance. claim for breach of this Agreement must resolved in accordance with the dispute resolution process Upon receipt of notice of termination of the established by HHSC in accordance with Chapter Agreement by HHSC, CONTRACTOR will provide 2260, Government Code. any turnover assistance reasonably necessary to enable HHSC or its designee to effectively close out (2) Negotiation of claims. The Parties expressly the Agreement and move the work to another vendor agree that the CONTRACTOR's claim for breach of or to perform the work by itself. this Agreement that the Parties cannot resolve in the ordinary course of business or through the use of all Section 11.09 Rights upon termination or reasonable and informal means will be submitted to expiration of Agreement. the negotiation process provided in Chapter 2260, In the event that the Agreement is terminated for Subchapter B, Government Code. any reason, or upon its expiration, HHSC will, at (A)To initiate the process, CONTRACTOR HHSC's discretion, retain ownership of any and all must submit written notice to HHSC that associated work products, Deliverables and/or specifically states that CONTRACTOR invokes Documentation in whatever form that they exist. the provisions of Chapter 2260, Subchapter B, Government Code. The notice must comply with Section 11.10 CONTRACTOR responsibility for the requirements of Title 1, Chapter 392, associated costs. Subchapter B of the Texas Administrative Code. If HHSC terminates the Agreement for Cause, (B)The Parties expressly agree that the the CONTRACTOR will be responsible to HHSC for CONTRACTOR's compliance with Chapter 2260, all costs incurred by HHSC,the State of Texas, or any Subchapter B, Government Code, will be a of its administrative agencies to replace the condition precedent to the filing of a contested CONTRACTOR. These costs include, but are not case proceeding under Chapter 2260, limited to, the costs of procuring a substitute vendor Subchapter C, of the Government Code. and the cost of any claim or litigation that is (3) Contested case proceedings. The contested reasonably attributable to CONTRACTOR's failure to case process provided in Chapter 2260, Subchapter perform any Service in accordance with the terms of C, Government Code, will be CONTRACTOR's sole the Agreement and exclusive process for seeking a remedy for any Section 11.11 Dispute resolution. and all alleged breaches of contract by HHSC if the Parties are unable to resolve their disputes under (a) General agreement of the Parties. Subsection (c)(2)of this Section. The Parties mutually agree that the interests of (A) The Parties expressly agree that fairness, efficiency, and good business practices are compliance with the contested case process 19 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions provided in Chapter 2260, Subchapter C, instructions given by HHSC in accordance with Government Code,will be a condition precedent Section 1.03(relating to implied authority)and to seeking consent to sue from the Texas Section 3.03(relating to delegation of authority) Legislature under Chapter 107, Civil Practices& of this Agreement. Remedies Code. Neither the execution of this (d) CONTRACTOR will ship all Equipment and Agreement by HHSC nor any other conduct of Software purchased and Third Party Software any representative of HHSC relating to this licensed pursuant to the Agreement, freight prepaid, Agreement shall be considered a waiver of the FOB HHSC's destination. The method of shipment State's sovereign immunity to suit. will be consistent with the nature of the Equipment (4) HHSC rules. The submission, processing and Software and hazards of transportation. and resolution of CONTRACTOR's claim is governed Regardless of FOB point, CONTRACTOR agrees to by the rules adopted by HHSC pursuant to Chapter bear all risks of loss, damage, or destruction of 2260, Government Code, found at Title 1, Chapter Deliverables, in whole or in part, ordered hereunder 392, Subchapter B of the Texas Administrative Code. that occurs prior to Acceptance, except loss or (5) CONTRACTOR's duty to perform. Neither damage attributable to HHSC's fault or negligence; the occurrence of an event constituting an alleged and such loss, damage, or destruction will not release breach of contract nor the pending status of any claim CONTRACTOR from any obligation hereunder. After for breach of contract is grounds for the suspension of Acceptance, the risk of loss or damage will be borne performance, in whole or in part, by CONTRACTOR by HHSC, except loss or damage attributable to of any duty or obligation with respect to the CONTRACTOR's fault or negligence. performance of this Agreement. Any changes to the Article 12.Assurances and Certifications Agreement as a result of a Dispute Resolution will be implemented in accordance with Article 8, Section 12.01 Proposal certifications. Amendments, Modifications and Change Orders. CONTRACTOR acknowledges its continuing Section 11.12 Liability of CONTRACTOR. obligation to comply with the requirements of the following certifications contained in its Proposal, and (a) CONTRACTOR bears all risk of loss or will immediately notify HHSC of any changes in damage due to: circumstances affecting these certifications: (1) Defects in products, Services or (1) Federal lobbying; Deliverables; (2) Unfitness or obsolescence of products, (2) Debarment and suspension; Services or Deliverables; or (3) Child support; and (3) The negligence or intentional misconduct (4) Nondisclosure statement. of CONTRACTOR or its employees, agents, Section 12.02 Conflicts of interest. subcontractors, or representatives. (b) CONTRACTOR must, at the (a) Representation. CONTRACTOR's own expense, defend with counsel CONTRACTOR agrees to comply with approved by the State, indemnify, and hold harmless applicable state and federal laws, rules, and the State and State employees, officers, directors, regulations regarding conflicts of interest in the contractors and agents from and against any losses, performance of its duties under this Agreement. liabilities, damages, penalties, costs,fees, including CONTRACTOR warrants that it has no interest and without limitation reasonable attorneys'fees, and will not acquire any direct or indirect interest that expenses from any claim or action for property would conflict in any manner or degree with its damage, bodily injury or death, to the extent caused performance under this Agreement. by or arising from the negligence or intentional (b) General duty regarding conflicts of interest. misconduct of the CONTRACTOR and its CONTRACTOR will establish safeguards to employees, officers, agents, or subcontractors. prohibit employees from using their positions for a (c) CONTRACTOR will not be liable to HHSC purpose that constitutes or presents the appearance for any loss,damages or liabilities attributable to or of personal or organizational conflict of interest, or arising from: personal gain. CONTRACTOR will operate with (1)The failure of HHSC or any state agency complete independence and objectivity without actual, or HHSC CONTRACTOR to perform a service or potential or apparent conflict of interest with respect to activity in connection with this Agreement; or the activities conducted under this Agreement with the (2)CONTRACTOR's prudent and diligent State of Texas. performance of the Services in compliance with 20 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Section 12.03 Organizational conflicts of interest. officer, such nondisclosure will be considered a (a) Definition. material breach of the Agreement. Furthermore, such An organizational conflict of interest is a set of breach may be submitted to the Office of the Attorney facts or circumstances, a relationship, or other General, Texas Ethics Commission, or appropriate situation under which a contractor, or a subcontractor State or Federal law enforcement officials for further has past, present, or currently planned personal or action. financial activities or interests that either directly or (e) Flow down obligation. indirectly: CONTRACTOR must include the provisions of (1)Impairs or diminishes the offeror's, this Section 12.03 in all subcontracts for work to be contractor's, or subcontractor's ability to render performed similar to the service provided by impartial or objective assistance or advice to CONTRACTOR, and the terms"Agreement," HHSC; or "CONTRACTOR,"and"project manager"modified (2)Provides the contractor or subcontractor appropriately to preserve the State's rights. an unfair competitive advantage in future HHSC Section 12.04 HHSC personnel recruitment procurements. prohibition. (b) Warranty. Except as otherwise disclosed and approved by CONTRACTOR has not retained or promised to HHSC prior to the Effective Date of the Contract, retain any person or company, or utilized or promised CONTRACTOR warrants that, as of the Effective to utilize a consultant that participated in HHSC's Date and to the best of its knowledge and belief,there development of specific criteria of the Agreement or are no relevant facts or circumstances that could give who participated in the selection of the rise to organizational conflict of interest affecting this CONTRACTOR for this Agreement. Agreement. CONTRACTOR affirms that it has CONTRACTOR will not recruit or employ any neither given, nor intends to give, at any time HHSC professional or technical personnel who have hereafter, any economic opportunity, future worked on projects relating to the subject matter of employment,gift, loan, gratuity, special discount,trip, this Agreement, or who have had any influence on favor, or service to a public servant or any employee decisions affecting the subject matter of this or representative of same, at any time during the Agreement, for two(2)years following the completion procurement process or in connection with the of this Agreement. procurement process except as allowed under relevant state and federal law. Section 12.05 Anti-kickback provision. (c) Continuing duty to disclose. CONTRACTOR certifies that it will comply with (1)CONTRACTOR agrees that, if after the the Anti-Kickback Act of 1986,41 USC§51-58 and Effective Date, CONTRACTOR discovers is Federal Acquisition Regulation 52.203-7. made aware of an organizational conflict of interest, CONTRACTOR will immediately and Section 12.06 Debt or back taxes owed to the fully disclose such interest in writing to the HHSC State of Texas. project manager. In addition, CONTRACTOR must promptly disclose any relationship that In accordance with Section 403.055 of the might be perceived or represented as a conflict Government Code, CONTRACTOR agrees that any after its discovery by CONTRACTOR or by payments due to CONTRACTOR under the HHSC as a potential conflict. HHSC reserves Agreement will be first applied toward any debt and/or the right to make a final determination regarding back taxes CONTRACTOR owes the State of Texas. the existence of conflicts of interest, and CONTRACTOR further agrees that payments will be CONTRACTOR agrees to abide by HHSC's so applied until such debts and back taxes are paid in decision. full. (2)The disclosure will include a description Section 12.07 Certification regarding status of of the action(s)that CONTRACTOR has taken or license, certificate, or permit. proposes to take to avoid or mitigate such Article IX, Section 163 of the General conflicts. (d) Remedy. Appropriations Act for the 1998/1999 state fiscal If HHSC determines that an organizational biennium prohibits an agency that receives an conflict of interest exists, HHSC may, at its discretion, appropriation under either Article II or V of the terminate the contract. If HHSC determines that General Appropriations Act from awarding a CONTRACTOR was aware of an organizational Agreement with the owner, operator, or administrator conflict of interest before the award of this Agreement of a facility that has had a license, certificate, or and did not disclose the conflict to the contracting permit revoked by another Article II or V agency. 21 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions CONTRACTOR certifies it is not ineligible for an CONTRATOR will maintain all required certifications, award under this provision. licenses, permits, and authorizations during the term Section 12.08 Outstanding debts and judgments. of this Agreement. CONTRACTOR certifies that it is not presently Section 13.02 Ability to perform. indebted to the State of Texas, and that CONTRACTOR warrants that it has the financial CONTRACTOR is not subject to an outstanding resources to fund the capital expenditures required judgment in a suit by the State of Texas against under the Agreement without advances by HHSC or CONTRACTOR for collection of the balance. For assignment of any payments by HHSC to a financing purposes of this Section, an indebtedness is any source. amount sum of money that is due and owing to the Section 13.03 Workmanship and performance. State of Texas and is not currently under dispute.A false statement regarding CONTRACTOR's status will (a)All Services and Deliverables provided under be treated as a material breach of this Agreement and this Agreement will be provided in a manner may be grounds for termination at the option of consistent with the standards of quality and integrity HHSC. as outlined in this Agreement, the RFP, and Section 12.09 Anti-trust. CONTRACTOR's Proposal. In submitting a proposal, and in accepting the (b)All Services and Deliverables must meet or Contract or purchase proposal, Contractor certifies the exceed the required levels of performance specified in Contract t follows: or pursuant to this Agreement, and will meet or agrees exceed HHSC's Missions and Objectives, as set forth (1)Neither the CONTRACTOR, nor the person in the RFP. represented by the CONTRACTOR, nor any person (c)CONTRACTOR will perform the Services in a acting for the represented person has: workmanlike manner, in accordance with best practices and high professional standards used in (a)violated the antitrust laws codified by well-managed operations performing services similar Chapter 15, Business&Commerce Code, or the to the services described in this Agreement. federal antitrust laws; or Section 13.04 Warranty of deliverables. (b)directly or indirectly communicated the bid/offer associated with this contract to a CONTRACTOR warrants that Deliverables competitor or other person engaged in the same developed and delivered under this Agreement will line of business. meet the Specifications as described in the Agreement during the period following its acceptance (2)CONTRACTOR hereby assigns to HHSC any by HHSC,through the term of the Agreement, and all claims for overcharges associated with this including any extensions as provided in the contract arising under the anti-trust laws of the United Agreement, that are subsequently negotiated by States, 15 U.S.C.A. Section 1, et seq. (1973), as CONTRACTOR and HHSC. CONTRACTOR will amended, and the anti-trust laws of the State of promptly repair or replace any such Deliverables not Texas, TEX. Bus.&Comm.CODE ANN. Section 15.01, in compliance with this warranty at no charge to et seq. (1967), as amended. HHSC. Article 13.Representations and Warranties Section 13.05 Manufacturers'warranties. Section 13.01 Authorization. CONTRACTOR assigns to HHSC all of the (a)The execution, delivery and performance of manufacturers'warranties and indemnities relating to this Agreement execution, been duly authorized by all products, including without limitation,Third Party CONTRACTOR and been approval,m authorized or zedzation or Software to the extent CONTRACTOR is permitted by to consent of any governmental or regulatory agency is the C. Such assignment n make such assignments all of the e required to be obtained in order for CONTRACTOR to HHSC. Such imposed by is subject f all re the terms enter into this Agreement and perform its obligations and conditions imposed by the manufacturers with under this Agreement. respect thereto. (b)CONTRACTOR has obtained all licenses, Section 13.06 Compliance with Agreement. certifications, permits, and authorizations necessary CONTRACTOR will not take any action to perform the Services under this Agreement and substantially or materially inconsistent with any of the currently is in good standing with all regulatory terms and conditions set forth in this Agreement agencies that regulate any or all aspects of without the express written approval of HHSC. CONTRACTOR's performance of this Agreement. 22 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions Article 14. Intellectual Property Article 15. Liability Section 14.01 Infringement and misappropriation. Section 15.01 Property damage. (a) CONTRACTOR warrants that all (a) CONTRACTOR will protect HHSC's real and Deliverables provided by CONTRACTOR will not personal property from damage arising from infringe or misappropriate any right of, and will be free CONTRACTOR's, its agent's, employees'and of any claim of, any third person or entity based on subcontractors'performance of the Agreement, and copyright, patent, trade secret, or other intellectual CONTRACTOR will be responsible for any loss, property rights. destruction, or damage to HHSC's property that (b) CONTRACTOR will, at its expense, defend results from or is caused by CONTRACTOR's, its with counsel approved by HHSC, indemnify, and hold agents', employees'or subcontractors' negligent or harmless HHSC, its employees, officers, directors, wrongful acts or omissions. Upon the loss of, contractors, and agents from and against any losses, destruction of, or damage to any property of HHSC, liabilities,damages, penalties, costs,fees, including CONTRACTOR will notify the HHSC Project Manager without limitation reasonable attorneys'fees and thereof and, subject to direction from the Project expenses,from any claim or action against HHSC Manager or her or his designee, will take all that is based on a claim of breach of the warranty set reasonable steps to protect that property from further forth in the preceding paragraph. HHSC will promptly damage. notify CONTRACTOR in writing of the claim, provide (b) CONTRACTOR agrees to observe and CONTRACTOR a copy of all information received by encourage its employees and agents to observe HHSC with respect to the claim, and cooperate with safety measures and proper operating procedures at CONTRACTOR in defending or settling the claim. HHSC sites at all times. (c) In case the Deliverables, or any one or part (c) CONTRACTOR will distribute a policy thereof, is in such action held to constitute an statement to all of its employees and agents that infringement or misappropriation, or the use thereof is directs the employee or agent to immediately report to enjoined or restricted or if a proceeding appears to HHSC or to CONTRACTOR any special defect or CONTRACTOR to be likely to be brought, unsafe condition encountered while on HHSC CONTRACTOR will, at its own expense, either: premises. CONTRACTOR will immediately report to (1) Procure for HHSC the right to continue HHSC any special defect or an unsafe condition it using the Deliverables; or encounters or otherwise learns about. (2) Modify or replace the Deliverables to Section 15.02 Risk of Loss. comply with the Specifications and to not violate During the period Deliverables are in transit and any intellectual property rights. in possession of CONTRACTOR, its carriers or HHSC If neither of the alternatives set forth in (1)or(2) prior to being accepted by HHSC, CONTRACTOR above are available to the CONTRACTOR on will bear the risk of loss or damage thereto, unless commercially reasonable terms, CONTRACTOR may such loss or damage is caused by the negligence or require that HHSC return the allegedly infringing intentional misconduct of HHSC. After HHSC accepts Deliverable(s)in which case CONTRACTOR will a Deliverable, the risk of loss or damage to the refund all amounts paid for all such Deliverables. Deliverable will be borne by HHSC, except loss or Section 14.02 Exceptions. damage attributable to the negligence or intentional misconduct of CONTRACTOR's agents, employees CONTRACTOR is not responsible for any or subcontractors. claimed breaches of the warranties set forth in Section 14.01 to the extent caused by Section 15.03 Limitation of HHSC's Liability. (a) Modifications made to the item in question HHSC WILL NOT BE LIABLE FOR ANY by anyone other than CONTRACTOR or its INCIDENTAL, INDIRECT, SPECIAL, OR subcontractors or HHSC or its Contractors working at CONSEQUENTIAL DAMAGES UNDER CONTRACT, CONTRACTOR's direction or in accordance with the TORT(INCLUDING NEGLIGENCE), OR OTHER specifications; or LEGAL THEORY. THIS WILL APPLY (b) The combination, operation, or use of the REGARDLESS OF THE CAUSE OF ACTION AND item with other items if CONTRACTOR did not supply EVEN IF HHSC HAS BEEN ADVISED OF THE or approve for use with the item; or POSSIBILITY OF SUCH DAMAGES. (c) HHSC's failure to use any new or corrected HHSC'S LIABILITY TO CONTRACTOR UNDER versions of the item made available by THE AGREEMENT WILL NOT EXCEED THE TOTAL CONTRACTOR. CHARGES TO BE PAID BY HHSC TO 23 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions CONTRACTOR UNDER THE AGREEMENT, respect to HHSC Confidential Information described INCLUDING CHANGE ORDER PRICES AGREED elsewhere in this Agreement. TO BY THE PARTIES OR OTHERWISE ADJUDICATED. (c) Uses and disclosures. Article 16.Special Terms and Conditions Except as otherwise limited by this Agreement, CONTRACTOR may: If checked,the following provisions apply to this contract. (1) Use or disclose Protected Health Information Note: Section 16.08 Historically Underutilized to perform the Services and accomplish the purposes Business Participation Requirements APPLIES IF of this Agreement, provided that: HHSC determined that sub-contracting opportunities (A)Such use or disclosure would not violate were probable for the procurement/contract. the Privacy Rule if the disclosure were made by © Section 16.01 HIPAA. HHSC; and (B)Such use or disclosure is limited to the (a) Definitions. minimum necessary to accomplish the purposes of the use or disclosure; For purposes of this Section: (2) Use Protected Health Information for the (1)"Business Associate" has the meaning proper management and administration of given the term under 45 C.F.R. §160.103. CONTRACTOR or to carry out Contractor's legal responsibilities; (2) "HIPAA"means the Health Insurance Portability and Accountability Act of 1996 (3)Disclose Protected Health Information for the ("HIPAA")(42 U.S.C. §§1320d-1320d-8). proper management and administration of CONTRACTOR or to carry out Contractor's legal (3) "Protected Health Information" has the responsibilities if: meaning given the term in 45 C.F.R. §164.501, limited to the information created or received by (A) Disclosure is required by law; or CONTRACTOR from or on behalf of HHSC. (B)Contractor obtains assurances from the All terms used in this Section that are not otherwise person to whom the information is disclosed that defined in this Agreement have the same meaning as the person will: those terms in the Privacy Rule, 45 C.F.R. parts 160 (i) Maintain the confidentiality of the and 164 Protected Health Information; (b) Background. (ii) Use or further disclose the (1)Under the terms of this Agreement, HHSC information only as required by law or for the may provide or make available to Contractor, or purpose for which it was disclosed to the Contractor may create or receive on behalf of HHSC, person; and certain HHSC Confidential Information that is and (iii)Notify Contractor of any breaches must be afforded special treatment and protection of confidentiality of which the person is under HIPAA in conjunction with Services or aware; and Deliverables that are being provided to HHSC by Contractor. (4) Use Protected Health Information to provide (2)Contractor will have access to or receive data aggregation services to HHSC, as that term is defined at 45 C.F.R. §164.501 and permitted by 45 from HHSC, or create or receive on behalf of HHSC, certain electronic Protected Health Information that C.F.R. §164.504(e)(2)(i)(B). must be safeguarded in accordance with this (d) Contractor's commitment and obligations. Agreement and the security rules adopted by the U.S. Department of Health and Human Services(HHS) Contractor agrees that it will: under HIPAA, 45 C.F.R. §§ 164.302-.318. (1) Not use or disclose Protected Health (3)Contractor is a Business Associate of HHSC. Information provided by, made available by, or created or received on behalf of HHSC other than as (4)The obligations of Contractor under this permitted or required by this Agreement or as section are in addition to the duties of Contractor with required by law; 24 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (2)Establish and maintain appropriate (A) If Contractor destroys the information, it safeguards to prevent any use or disclosure of must certify to HHSC that the information has Protected Health Information other than as provided been destroyed; for by this Agreement; (B)Contractor may not elect to destroy (3) Have procedures in place for mitigating,to information that must be retained under federal the maximum extent practicable, any harmful effect of or state law; and a use or disclosure of Protected Health Information that is contrary to this Agreement or the Privacy Rule; (C)Contractor must maintain appropriate safeguards for the information as long as (4) Immediately report to HHSC any use or Contractor has such Protected Health disclosure of Protected Health Information not Information; provided for or allowed by this Agreement of which Contractor becomes aware; (11) Develop and implement a system of sanctions for any Subcontractor or Contractor (5)Enter into a subcontract anytime Contractor Personnel that violate this Agreement or the Privacy proposes to provide or make available Protected Rule. Health Information to any subcontractor or agent. (12) Implement administrative, physical, and Such subcontract or agreement must: technical safeguards that reasonably and (A)Contain the same terms, conditions, appropriately protect the confidentiality, integrity, and and restrictions on the use and disclosure of availability of the electronic Protected Health Protected Health Information and restrictions on Information that it creates, receives, maintains, or the security of information as contained in this transmits on behalf of HHSC as required by 45 C.F.R. Agreement; and §§ 164.302-.318. (B) Be approved as to the form of the terms, (13)Immediately report to HHSC any security conditions, and restrictions by HHSC prior to incident of which it becomes aware. entering into any such agreement; (14) Make internal practices, books, and records (6)Make Protected Health Information in a relating to the security of information received from or designated records set available to HHSC or, as created or received by Contractor on behalf of HHSC directed by HHSC,to the subject of the Protected available to the Secretary of Health and Human Health Information, in compliance with the Services or the Secretary's designee for purposes of requirements of 45 C.F.R. §164.524. determining compliance with the security rules. (7)Make Protected Health Information in a (15) Develop and implement a system of designated records set available for amendment and sanctions for any Subcontractor or Contractor will incorporate any amendments to this information Personnel that violate this Agreement or the security that HHSC directs or agrees to pursuant to 45 C.F.R. rules. §164.526. (e) Ownership of Protected Health Information. (8) Document and make available to HHSC the (1)The Protected Health Information shall be Protected Health Information required to provide an and remain the property of HHSC. accounting of disclosures, in accordance with 45 C.F.R. §164.528. (2)Contractor agrees it acquires no title or rights to the information, including any de-identified (9)Make internal practices, books, and records information, as a result of this Agreement. relating to the use or disclosure of Protected Health Information received from, or created or received by (f) Injunctive relief,-survival of terms. the Contractor on behalf of HHSC, available to the (1) Notwithstanding any rights or remedies Secretary of Health and Human Services or the provided for in this Agreement, HHSC retains all Secretary's designee for purposes of determining rights to seek injunctive relief to prevent or stop the compliance with the privacy regulations. unauthorized use or disclosure of Protected Health (10) Return, destroy, or continue to maintain Information or a violation of the security rules by appropriate safeguards for all Protected Health Contractor or any Subcontractor, Contractor Information received from HHSC or created or Personnel, or third party that received information received on behalf of HHSC once Contractor finishes from Contractor. providing Services or Deliverables under this Agreement: 25 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (2)The duties and obligations imposed on authorized to act on his or her behalf; however, HHSC Contractor under this section of this Agreement may require CONTRACTOR, or any subcontractor,to willsurvive the expiration of the Agreement until all transfer a Member record to another agency or to Protected Health Information provided by HHSC to HHSC if the transfer is necessary to protect either the Contractor, or created or received by Contractor on confidentiality of the record or the health and welfare behalf of HHSC, is destroyed or returned to HHSC. of the Member. If at any time during the Initial Term,this n Section 16.02 Technology access. Agreement is terminated, HHSC may require the transfer of Member records, upon written notice to (a) The CONTRACTOR expressly CONTRACTOR, to another entity that agrees to acknowledges that State funds may not be expended continue performance of the Agreement, as in connection with the purchase of an automated consistent with federal and state laws and applicable information system unless that system meets certain releases. statutory requirements relating to accessibility by The term"Member Record"for this Section persons with visual impairments. Accordingly, the 16.03 means only those administrative, enrollment, CONTRACTOR represents and warrants to HHSC case management and other such records maintained that the technology provided to HHSC for purchase is by CONTRACTOR and is not intended to include capable, either by virtue of features included within patient records maintained by participating network the technology or because it is readily adaptable by providers. use with other technology, of: (1) Providing equivalent access for effective use by both visual and non-visual n Section 16.04 Financial/performance means; audits. (2) Presenting information, including (a) The State of Texas Health and Safety Code prompts used for interactive communications, Section 12.0123 directs HHSC to contract with an in formats intended for non-visual use; and independent auditor to perform annual independent (3) Being integrated into networks for external financial and performance audits of any obtaining, retrieving, and disseminating Medicaid vendor used by HHSC in HHSC's operation information used by individuals who are not of a part of the State Medicaid program. "Medicaid blind or visually impaired. vendor"means an entity that, under a contract with or (b) For purposes of this Section,the phrase otherwise on behalf of HHSC, performs one or more administrative services in relation to HHSC's "equivalent access"means a substantially similar operation of a part of the State Medicaid program, ability to communicate with or make use of the such as claims processing, utilization review, client technology,either directly by features incorporated enrollment, provider enrollment, quality monitoring, or within the technology or by other reasonable means payment of claims. The independent auditor will such as assistive devices or services that would deliver to the CONTRACTOR and to HHSC a report constitute reasonable accommodations under the of the findings and recommendations within thirty(30) Americans with Disabilities Act or similar State or calendar days of the close of each audit. The report Federal laws. Examples of methods by which will be prepared in accordance with generally equivalent access may be provided include, but are accepted auditing standards. not limited to, keyboard alternatives to mouse commands and other means of navigating graphical (b) CONTRACTOR agrees to deliver to HHSC, displays, and customizable display appearance. for HHSC's approval, a Corrective Action Plan that (c) In addition, all technological solutions addresses deficiencies identified in the audit within offered by the CONTRACTOR must comply with the independent end nt audit days of the delivery of the requirements of Texas Government Code§531.0162. independent auditor's report. This includes, but is not limited to providing (c) CONTRACTOR understands that the technological solutions that meet federal accessibility independent auditor("the auditor')will make specific standards for persons with disabilities, as applicable. inquiries of CONTRACTOR'S management for information, including but not limited to information © Section 16.03 Member records. concerning the representations embodied in the financial statements and reports CONTRACTOR is CONTRACTOR and any subcontractor shall not required to furnish the State as per the"Financial transfer an identifiable Member record, including a Report Requirements" portion of Section 6 of this patient record,to another entity or person without RFP. CONTRACTOR understands that as part of the written consent from the Member or someone auditor's audit procedures, the auditor will request, 26 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel(OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions and CONTRACTOR'S management will provide to Acceptance or as otherwise provided in the the auditor a representation letter; Agreement. (1) Acknowledging management's (2)CONTRACTOR will furnish such Custom responsibility for the preparation of the financial Software and Documentation, upon request of statements and reports; HHSC, in accordance with applicable State law. All (2) Acknowledging management's Deliverables, in whole and in part, will be deemed responsibility for compliance with laws and works made for hire of HHSC for all purposes of regulations; and copyright law, and copyright will belong solely to (3) Affirming management's belief that the HHSC. To the extent that any such Deliverable does effects of any uncorrected financial statement or not to the as a t that for the under le includes law, report misstatements aggregated by the auditor and to the extent that the Deliverable includes during the current audit engagement and materials subject to copyright, patent,trade secret, or pertaining r during te c rre t audit presented are immaterial, other proprietary right protection, CONTRACTOR both individually and in the aggregate,immaterial, to the agrees to assign, and hereby assigns, all right, title, both individually iduall pans and reports aggregate, as a and interest in and to Deliverables, including without whole. limitation all copyrights, inventions, patents,trade secrets, and other proprietary rights therein(including (d) CONTRACTOR understands and agrees renewals thereof)to HHSC. that the auditor will also request that (3) CONTRACTOR will, at the expense of CONTRACTOR's management confirm certain HHSC, assist HHSC or its nominees to obtain representations made to the auditor during the audit. copyrights,trademarks, or patents for all such The responses to those inquiries, and the related Deliverables in the United States and any other written representations of management required by countries. CONTRACTOR agrees to execute all generally accepted auditing standards, are part of the papers and to give all facts known to it necessary to evidential matter that the auditor will rely on in forming secure United States or foreign country copyrights its opinion on the CONTRACTOR'S financial and patents, and to transfer or cause to transfer to statements and reports. HHSC all the right, title, and interest in and to such n Section 16.05 Audit software. Deliverables. CONTRACTOR also agrees not to assert any moral rights under applicable copyright law As part of the Services, CONTRACTOR must with regard to such Deliverables. operate and maintain such audit software as HHSC or (c) License Rights its designees may provide to CONTRACTOR from HHSC will have ownership and unlimited rights time to time during the Term of the Agreement. to use, disclose, duplicate, or publish all information and data developed,derived, documented, or ❑ Section 16.06 Ownership and licenses. furnished by CONTRACTOR under or resulting from the Agreement. Such data will include all results, technical information, and materials developed for (a) Custom Software. and/or obtained by HHSC from CONTRACTOR in the The Parties agree that any Deliverable, including performance of the Services hereunder, including but without limitation any software, developed by not limited to all reports, surveys, plans, charts, CONTRACTOR in connection with the Agreement recordings(video and/or sound), pictures, drawings, (the"Custom Software"), will be the exclusive analyses, source and object code, graphic property of HHSC. representations, computer programs and printouts, (b) Ownership rights. notes and memoranda, and documents whether (1) HHSC will own all right,title, and interest in finished or unfinished, which result from or are and to its Confidential HHSC will wnfarmght, tle, the prepared in connection with the Services performed Deliverables provided by CONTRACTOR, including as a result of the Agreement. without limitation the Specifications,the Work Plan, (d) Proprietary Notices and the Custom Software, except that the CONTRACTOR will reproduce and include Deliverables will not include the third party software HHSC's copyright and other proprietary notices and and the associated Documentation for purposes of product identifications provided by CONTRACTOR on this Section. CONTRACTOR will take all actions such copies, in whole or in part, or on any form of the necessary and transfer ownership of the Deliverables Deliverables. to HHSC, including, without limitation,the Custom Software and associated Documentation on Final 27 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (e) Third Party Software and Documentation Licenses I Section 16.07 Insurance Coverage. (1) CONTRACTOR grants HHSC a non (a) Required Coverage. exclusive, perpetual, license for HHSC to use the Third Party Software and its associated (1) CONTRACTOR will procure, at Documentation for its internal business purposes. CONTRACTOR's own expense, during the Term of HHSC will be entitled to use the Third Party the Agreement and until final acceptance of all Software on the Equipment or any replacement Services and Deliverables, the following insurance equipment used by HHSC, and with any coverage. CONTRACTOR will provide HHSC with replacement Third Party Software chosen by proof of the following insurance coverage within HHSC, without additional Charges. Terms in any ten (10)calendar days after the Agreement is licenses for Third Party Software will be consistent awarded: with the requirements of this Section. (A) Standard Worker's Compensation (2) The licenses hereunder are granted as of Insurance coverage; the date when such Third Party Software is (B) Automobile Liability; and installed and certified by CONTRACTOR as (C) Comprehensive Liability Insurance operational, and the licenses will continue until including Bodily Injury coverage of HHSC permanently discontinues the use of the Third Party Software. $100,000.00 per each occurrence and Property Damage Coverage of$25,000.00 per (3) Prior to utilizing any Third Party Software each occurrence. product that may be included as part of a Software (2) If CONTRACTOR's current Deliverable to HHSC, CONTRACTOR will provide Comprehensive General Liability insurance to HHSC copies of the license agreement from the coverage does not meet the above stated licensor of the Third Party Software to allow HHSC requirements, CONTRACTOR will obtain excess to pre-approve the license agreement that must, at liability insurance to compensate for the difference a minimum, provide HHSC with necessary rights in the coverage amounts. consistent with the short and long-term goals of the Agreement. CONTRACTOR will assign to HHSC (3) CONTRACTOR is responsible for any and the licenses for the Third Party Software upon all deductibles stated in the policies. Insurance will Final Acceptance. be maintained at all times during the performance (4) CONTRACTOR will, during the Project, of the Agreement. Insurance coverage will be issued by insurance companies authorized by maintain any and all Third Party Software products at applicable law to conduct business in the State of t their most current version or no more than one Texas, and must name HHSC as an additional version back from the most current version. insured. However, CONTRACTOR will not maintain any Third Party Software versions, including one (4) The policy will have an extended version back, if any such version would prevent reporting period of two years. When policies are HHSC from using any functions, in whole or in part, renewed or replaced,the policy retroactive date or would cause Deficiencies in the System. must coincide with, or precede, start of work on the (f) State and Federal Governments Agreement. In accordance with 45 CFR Part 95.617, all (b) Proof of Insurance Coverage appropriate State and Federal agencies will have a (1) CONTRACTOR will furnish the HHSC Project royalty-free, nonexclusive, and irrevocable license to Manager original Certificates of Insurance evidencing reproduce, publish,translate, or otherwise use, and to the required coverage to be in force on the date of authorize others to use for Federal Government award, and renewal certificates of insurance, or such purposes all materials,the Custom Software and similar evidence, if the coverages have an expiration modifications thereof, and associated documentation or renewal date occurring during the term of the designed, developed, or installed with Federal Agreement. CONTRACTOR will submit evidence of Financial Participation under the Agreement, including insurance prior to Agreement award. The failure of but not limited to those materials covered by HHSC to obtain such evidence from CONTRACTOR copyright, all Software source and object code, before permitting CONTRACTOR to commence work instructions, files, and Documentation composing the will not be deemed to be a waiver by HHSC and System. CONTRACTOR will remain under continuing obligation to maintain and provide proof of the insurance coverage. 28 of 29 Contractual Document(CD) Responsible Office: HHSC Office of General Counsel (OGC) Version 1.4.1 Subject: HHSC Uniform Contract Terms & Conditions (2) The insurance specified above will be Section 16.08 Historically Underutilized carried until all services required to be performed ® Business Participation Requirements under the terms of the Agreement are satisfactorily completed. Failure to carry or keep such insurance This Subsection applies if HHSC determined that in force will constitute a violation of the Agreement, sub-contracting opportunities were probable for the and HHSC maintains the right to stop work until procurement/contract. proper evidence of insurance is provided. (3) The insurance will provide for thirty(30) (a) Definitions. calendar days prior written Notice to be given to For purposes of this Section: HHSC in the event coverage is substantially changed, canceled, or non-renewed. (1)"Historically Underutilized Business"or CONTRATOR must submit a new coverage binder "HUB"means a minority or women-owned business to HHSC to ensure no break in coverage. as defined by Texas Government Code, Chapter (4) CONTRACTOR will require all 2161. subcontractors operating in Texas to carry (2)"HSP" means a HUB Subcontracting Plan. Worker's Compensation coverage in the amounts required by Texas law. CONTRACTOR will also (b) HUB Requirements. require subcontractors to carry Comprehensive Liability Insurance including Bodily Injury coverage (1)Contractor must submit an HSP for HHSC's or$100,000.00 per occurrence and Property approval. Damage Coverage of$25,000.00 per occurrence. (2)Contractor must report to HHSC's contract CONTRACTOR may provide the coverage for any manager and HUB Office monthly, in the format or all subcontractors, and, if so, the evidence of required by the HUB Office, its use of HUB insurance submitted will so stipulate. subcontractors to fulfill the subcontracting (5) The Parties expressly understand and opportunities identified in the HSP. agree that any insurance coverages and limits furnished by CONTRACTOR will in no way expand (3) If the Parties amend the Agreement to or limit CONTRACTOR's liabilities and include additional funds or a change to the responsibilities specified within the Contract Scope of Work, the Contractor must submit a documents or by applicable law. revised HSP to the HHSC HUB Office,when a (6) CONTRACTOR and each subcontractor determination is made for additional agree that insurer will waive their rights of subcontracting opportunities. All proposed subrogation against HHSC. changes to the HSP must comply with the (7) CONTRACTOR expressly understands requirements of Section 16.08(b)(4). and agrees that any insurance maintained by (4)Contractor shall obtain prior written approval HHSC will apply in excess of and not contribute from the HHSC HUB Office before making any with insurance provided by CONTRACTOR under changes to the HSP. The proposed changes the Agreement. must comply with HHSC's good faith effort (8) If CONTRACTOR, or its subcontractor(s), requirements relating to the development and desire additional coverage, higher limits of liability, submission of HSPs. or other modifications for its own protection, (5) HHSC will determine if the value of CONTRACTOR and each of its subcontractors will Subcontracts to HUBs meet or exceed the HUB be responsible for the acquisition and cost of such subcontracting provisions specified in the additional protection. Contractor's HSP. If HHSC determines that the Contractor's subcontracting activity does not demonstrate a good faith effort, the Contractor may be subject to provisions in the Vendor Performance and Debarment Program (34 T.A.C., Part 1, Chapter 20, Subchapter C), and subject to remedies for Breach. 29 of 29 Form Number: CPP0430 Texas Health and Human Services Commission Vendor Information Form (VIF) Instructions: This form must be completed and submitted with each new contract, amendment, renewal, and/or extension. (Please type or print information.) SECTION 1: Contractor's General Information Legal Contractor's Name: CITY OF PORT ARTHUR Legal Doing Business As (DBA) Name: Physical Address: 449 AUSTIN AVENUE, PORT ARTHUR, TX 77640 Remit To(Payment)Address: SAME AS ABOVE ['Texas Identification Number(TIN): Enter one of the following: Federal Employer Identification Number(FEIN): 7460018850 ❑Social Security Number(SSN): Select the Legal Status: ❑ For-profit Entity ® Non-profit Entity ❑ Corporation ❑ Joint Venture ❑ Partnership* ❑ Limited (Liability) Company ❑ Limited (Liability) Partnership ❑ Sole Proprietorship 0 Governmental Entity (must specify): Select the Business Structure: ❑ Other(must specify): * If Partnership, must provide SSN or TIN for minimum of two partners Partner Name: TIN or SSN: Partner Name: TIN or SSN: If applicable, enter State of Incorporation: Texas Charter Number: Name of Parent Entity: appropriate information: SECTION 2: Contractor's Contact Information Person Who Will Sign the Contract Point of Contact for Contract Name: JOHN COMEAUX, P.E. Name: JUDITH SMITH, RN, BSN Title: INTERIM CITY MANAGER Title: DIRECTOR OF HEALTH Mailing Address: P.O. BOX 1089 Mailing Address: 449 AUSTIN AVENUE Telephone: 409-983-8101 Telephone: 409-983-8832 Fax: 409-982-6743 Fax: 409-983-1530 E-mail: john.comeaux @portarthurtx.gov E-mail: judith.smith @portarthurtx.gov SECTION 3: Contractor's Authorized Signature (or HHSC Contract Manager) Printed Name Signature Date Phone Number JUDITH SMITH, RN, BSN UGW1bi-lakkdb Rk SN 409-983-8832 SECTION 4: ECPS Contract and dministration Office Use Only Contractor to Receive Payment: ❑ No ❑Yes Contract Number: Effective Date: June, 2006 Revision Date: January 28, 2013