The URL can be used to link to this page

Home My WebLink AboutALTC 2020 Footcare AgreementALTCCOG 2020-46 PERFORMANCE AGREEMENT NO. 2020 COP (FOOTCARE) ADMINISTRATION OF AGREEMENT THIS AGREEMENT is entered into by and between Southeast Washington Aging and Long Term Care Council of Governments hereinafter denominated "SE WA ALTC COG", whose address is P.O. Box 8349, Yakima, Washington 98908, and City of Pasco, whose address is P.O. Box 293, Pasco, Washington, 99301, hereinafter denominated the "Contractor", whose duly authorized representatives are named in documents on file at the Southeast Washington Aging and Long Term Care Council of Governments Administrative office. The parties agree that this contract agreement becomes effective at the time of execution by the Southeast Washington Aging and Long Term Care Council of Governments Director and/or Governing Board. THE PURPOSE of this Agreement is to provide for the delivery of Footcare services in accordance with the terms and conditions set forth in the provisions as listed below. The Parties also agree to the terms in the contained Basic Agreement, identified herein as Attachment A. The purpose of this document is to establish a Basic Agreement containing General Terms that shall be incorporated by reference into any Contract executed between SE WA ALTC COG and the Contractor. Location Funding Allocation Pasco $18,492 Burbank $2,052 Total $20,544 Period of Agreement: January 1, 2020 to December 31, 2020 CONTRACTOR SIGNATURES N. Zach Rat i, Director Administrative and Community Services City of Pasco Date: it I z-& 1 i< Ap roved As To Legal Form: 6 �JA Daniel Clarlf, WSRA #35901 Yakima County Senior Deputy Prosecuting Attorney And Civil Legal Counsel for SE WA ALTC COG Lori 3. rown, PYector SE Washington Aging and Long Term Care Council of Governments Date: 1Z~' bta ALTCCOG 2020-46 STANDARD TERMSAND PAYMENTPROVISIONS CITYOFPASCO FOOTCARE SPECIFIC PROVISIONS APPLICABLE LAWS AND REGULATIONS The Contractor agrees that services contemplated or delivered within the terms of this Agreement and funds administered in the delivery of the specified services shall be provided in accordance with all applicable Federal, State, and local laws and regulations, in particular the following: A. CFR Title 45, Subtitle A, Part 74, (Administration of Grants) B. CFR Title 45, Chapter XIII, Subchapter C, Part 1321 (Older Americans Act) C. WAC 388-106-1100 through 1120 (Senior Citizens Services Act) D. Older American Act (PL 109-365) E. WAC 246-840-700, 710; RCW 18.79 (Standards of Nursing Conduct) II PROJECT DEFINITION Geriatric Preventive Foot Care services are intended to provide early detection of existing and potential foot problems and provide maintenance of feet and nails. Services include foot inspection and palpation, nail trimming, treatment of calluses and dry skin, instructions in foot care and health maintenance. Services are provided in a community setting. Foot Care service in the home is not allowed. Referrals for follow-up treatment are made to local physicians and podiatrists as necessary III PARTICIPANTS The Contractor agrees that: A. Target population for geriatric preventative foot care services are the individuals age 60 and over who: 1. Need one or more of the program services to avoid additional health problems or assist with activities of daily living, thereby reducing the need for other services; AND Are not eligible for or have exhausted other sources of payment for similar services (Medicare, Medicaid, insurance) or similar services are not available. As stated in the Geriatric Preventative Foot Care Program Standards, a copy of which has been provided to the Contractor all persons served should be considered vulnerable based on the criteria listed below. B. There will be written assessment procedures utilized by the Contractor to determine if clients meet the program target population criteria. C. To the degree feasible, Contractor shall ensure that preference is given to those individuals aged 60 and over who meet the vulnerability criteria listed below with further preference given to low-income, limited English proficiency and minority individuals and to those with the greatest economic and social need. A person is considered vulnerable if s/he: Is unable to perform one or more of the activities of daily living below without assistance due to physical, cognitive, emotional, psychological or social impairment: ALTCCOG 2020-46 • Eating • Toileting Personal hygiene & grooming • Bathing • Cooking • Dressing or undressing • Housework • Walking • Managing medical treatments (prescribed exercises, change of dressing, injections, etc.) Manage medications (what to take, when to take it, how to store it properly, etc.) • Telephoning • Transfer (getting in and out of bed/wheelchair) • Transportation • Managing money (budgeting, check writing, etc.) • Preparing Meals 2. Has behavioral or mental health problems that could result in premature institutionalization, is unable to perform activities on daily activities listed above, or is unable to provide for his/her own health and safety primarily due to cognitive, behavioral, psychological, or emotional conditions which inhibit decisions making and threaten the ability to remain independent. 3. Lacks an informal support system: The person has no family, friends, neighbors or others who are willing and able to perform the services needed or whose informal support system needs to be temporarily or permanently supplemented. The Contractor must report on clients served in these categories. D. The foot care RN shall complete annual continuing education in foot care or related subjects. E. Clinics will be held monthly at each designated facility that will include, but not be limited to, low- income housing facilities and senior centers. F. Participants shall be referred to the Information and Assistance/Case Management Program as needed. G. Contractor shall establish a system through which clients of services under this approved Agreement may present grievances as outlined in the Basic Agreement, Section XXIV. H. Services shall be provided throughout Franklin County and in the City of Burbank in Walla Walla County. IV SERVICE SPECIFICATION The Contractor agrees that services provided within the terms of this Agreement shall meet the following specifications: A. Efforts will be made to assure access of service to the target population, to include at least the following: 1. Accessible office or site location; 2. Home visits or home delivery of services (if applicable); 3. Multicultural, bilingual persons to assist multicultural, bilingual clients in receiving services; 4. Publicity of program through public service announcements, brochures, etc. 5. Meeting with other service providers/agencies to explain services the Contractor provides and how referral can be made; 6. Ability to serve individuals with disabilities. B. Services shall be delivered in accordance with the Southeast Washington Aging & Long Term Geriatric Preventative Foot Care Program Standards and information in the Request for Proposal. The Contractor acknowledges receipt of a copy of said standards. Services provided shall comply with said standards as presently constituted or subsequently modified. ALTCCOC 2020-46 V ANTICIPATED SERVICE LEVELS AND EXPENDITURE RATE The Contractor agrees that: A. The levels of service to be provided shall be as described in the Payment Provisions: Section IV — Units of Service of this Agreement. Failure to meet the service levels as defined in the Payment Provisions: Section IV — Units of Service may result in a renegotiation of the funding levels provided under the terms of this Agreement. B. SE WA ALTC COG may unilaterally reduce the Agreement budget within thirty (30) days of the close of a quarter by the amount of the projected quarterly expenditures left unspent at the end of that quarter. SE WA ALTC COG shall submit to the Contractor notification of intent to recapture unspent funds and a modification to the budget reflecting the adjusted changes in the Agreement. VI ADMINISTRATIVE AGREEMENTS A. ACCESS, BY DSHS: The Contractor shall provide access at all reasonable times for DSHS to monitor and/or evaluate the provision of services under this Agreement in recognition of the responsibility of DSHS of the effective statewide operation of this program. Nothing herein contained shall be interpreted to imply a privy to a contract between DSHS and the Contractor or to diminish in any manner the responsibility and authority of the Contractor in administering this Agreement. B. ACCESS BY SE WA ALTC COG: The Contractor shall provide access at all reasonable times for SE WA ALTC COG to monitor and/or evaluate the provisions of services under this Agreement. SE WA ALTC COG may, with prior permission from the participant and knowledge of the Contractor, interview a certain percentage of participants to ascertain their experience with the program. C. RECORDS AND REPORTS: The Contractor agrees to: Maintain program records and reports, including statistical information, and to make such records available for inspection by SE WA ALTC COG in order for SE WA ALTC COG to be assured that contracted activities remain consistent with the terms of this Agreement and the currently approved SE WA ALTC COG Area Plan which shall be kept on file at the SE WA ALTC COG Administrative office. The Contractor further agrees to provide such information as requested by SE WA ALTC COG within the time limitations established by SE WA ALTC COG; 2. Submit an agreed upon monthly service unit report (sign in sheets) by the tenth day of each month. Contract payment requests will not be processed until service unit reporting is complete. Contractor shall attach the report to the invoice submission to verify service recording is complete. a. The following information shall be collected. In the event that information cannot be obtained, Contractor shall notify SE WA ALTC COG. i. Full name including first, middle initial and last ii. Street and mailing address (if different) iii. Home telephone number including the area code iv. Units of Service for Current Month v. Gender vi. Date of Birth vii. Urban/rural viii. Race and Ethnicity ix. Primary language spoken x. Household composition (lives alone) A. Yes or No — is household income at or below 100% Federal Poverty Level ALTCCOG 2020-46 3. Submit the Quarterly financial report upon request to SE WA ALTC COG; 4. Complete and submit such additional reports as are required by SE WA ALTC COG within the specified time frames, providing the Contractor is given a written request for the reports thirty (30) days prior to the due date. D. CONTRACTORS MEETING: The Contractor agrees to have a representative attend the SE WA ALTC COG Annual Contractor's meeting and Long Term Care Planning Committee meetings. E. PROGRAM PUBLICATION: The Contractor agrees that: 1. The program shall be publicized on a regular basis, with all publicity and printed material identifying the SE WA ALTC COG as a funding agency; 2. All material distributed with regards to publicizing the program contain a statement assuring non-discrimination. Following is the wording suggested: The City of Pasco does not discriminate in providing services on the grounds of race, creed, color, religion, national origin, gender, age, marital status, or the presence of any sensory, mental, or physical disability. 3. Materials publicizing the program must be printed in other appropriate languages in counties that have a specific minority 60+ population of three (3%) percent or more of the general 60+ population. ADDITIONAL REMUNERATION PROHIBITED: Neither the Contractor nor any of its officers, employees, agents or representatives, shall solicit, impose any fees, or accept any remuneration whatsoever from dients, friends, relatives, or representatives of any clients for services performed for that dient under this Agreement other than the client matching monies or donations (see Section I). In the event that this provision is violated, SE WA ALTC COG shall have the right to assert a claim against the Contractor on its own behalf and/or on behalf of the client. G. PRIVATE PAY: The Contractor, who offers to the general public on a private pay basis a service comparable to the service described in this Agreement, must assure that SE WA ALTC COG is not charged more for the service than the private pay fee. The responsibility lies with the Contractor to justify that a service provided at a different rate is not comparable to this service. H. MAINTENANCE OF FUNDING SOURCES: The Contractor agrees that: 1. SE WA ALTC COG funds are not used to replace funds from any other existing program funding; 2. It will continue or initiate efforts to obtain support from private sources and other public organizations for this service; 3. It will utilize new funding sources for this service if they become available through SE WA ALTC COG and it will make any changes necessary to meet the requirements of the new funding sources. I. FEES AND DONATIONS: The Contractor agrees that: 1. It will assure that older persons have the opportunity to contribute to all or part of the cost of the service, but service will not be denied if participant cannot or does not wish to contribute; 2. It shall utilize client donations to meet project expenses before using State or Federal funds; ALTCCOG 2020-46 3. It shall provide that the methods of receiving fees, donations and contributions from individuals shall be handled in such a manner so as not to publicly differentiate among individuals; 4. All project income derived from the provision of services described herein or incorporated by reference herein or derived or generated through program fund-raising activities or profits earned from fixed rate service shall stay with the project and shall be used to provide increased levels or improved quality of service to the target population. The state requires that rates charged to others cannot be less than the program charges the state for the same services (usual and customary fee). The unit rate charged to SE WA ALTC COG must equal or exceed the rate billed the state for the same service or the state must be charged the lower rate. J. MONITORING/ASSESSMENT PROCEDURES: The Contractor agrees to: 1. Monitor both its fiscal and program status monthly and assess its performance on program objectives and activities covered under this Agreement on an ongoing basis; 2. Monitor and assess on an ongoing basis the performance of any subcontracting agencies, and insure that funds made available are expended only in accordance with the specific provisions of this Agreement; 3. Recognize that SE WA ALTC COG will monitor and assess the activities and progress of all programs covered under this Agreement on an ongoing basis. Said monitoring and assessment will be accomplished through, but not limited to, review of program and financial reports, on-site visits (service delivery and administrative sites), conference with program administrators and staff, and visits by members of the SE WA ALTC COG staff and SE WA ALTC COG Advisory Council. Monitoring may include assessing performance based on information submitted in Request for Proposal (RFP). Prior notice of all such visits will be provided; 4. Authorize and/or participate in any program or fiscal evaluations or studies conducted by SE WA ALTC COG or DSHS. Prior notice will be provided as well as final reports of evaluations or studies; 5. Conduct a self-evaluation of the program annually. The self-evaluation shall include a survey of at least 10% of clients utilizing the service. The Contractor shall take steps to correct deficiencies found during the internal monitoring. Monitoring reports shall be made available to SE WA ALTC COG upon request. 'A YMENT PROVISIONS CONSIDERATION Payment shall be based on claims for reimbursement as reported on the SE WA ALTC COG invoice and support documentation and shall be contingent upon the receipt of all required financial and program reports by the respectively assigned due dates. SE WA ALTC COG shall not be held responsible for any financial loss suffered by the Contractor as a result of performance of services as outlined in this Agreement in the mutually agreed budget, service delivery standards, units of service and payment standards. II GENERAL PAYMENTS CONDITIONS The Contractor agrees to the following standards in satisfactorily performing the terms and conditions of this Agreement: ALTCCOG 2020-46 A. No payment shall be made for any contracted activity rendered by the Contractor which is not identified within the terms and conditions of this Agreement and set forth within a category of the budget. B. Upon request, the Contractor shall submit to SE WA ALTC COG a written request for approval of budget revision when: 1. The revision would change the scope or objectives of any contracted activity category; 2. Additional revenue is received for contracted activities within the terms of this Agreement. C. Payments shall be based on SE WA ALTC COG's receipt of all fiscal and programmatic reports required by this Agreement to substantiate claims for reimbursement. SE WA ALTC COG expressly reserves the right to withhold payment in whole or in part when: 1. The Contractor fails to submit all required documentation, or 2. In SE WA ALTC COG's judgment, additional information is required to substantiate the basis upon which claims for reimbursement are made, provided the request for such additional information is consistent with the requirements of this Agreement; or 3. Claims for reimbursement are inconsistent with the terms and conditions of this Agreement. D. Program Income - Gross income received by the contractor and/or subcontractors directly generated by state funds, federal funds or a federal grant supported activity or earned as the result of the grant and/or federal contract. 1. Program income may include, but is not limited to, income from: fees for services performed, proceeds from the sale, lease or rent of assets which were acquired using state funds, federal funds, contributions/donations from clients, honorariums, consultant fees, training fees, and the like, earned by staff when time spent earning such honorarium or fee was charged to federal funds, and revenue generated from sale of fabricated items. 2. Use program income in accordance with the Department of Health and Human Services Administration of Grants, 45 CFR, Part 74. Costs borne by the program income must be used to satisfy cost sharing or matching requirements. SE WA ALTC COG agrees to promptly notify the Contractor of any proposed reduction in funding by State, Federal, or other officials. The Contractor agrees that upon receipt of such notice it shall take appropriate and reasonable action to reduce its spending in the affected funding area so that expenditures do not exceed the funding level which would result if said proposed reduction became effective. III BILLING PROCEDURES A. The Contractor shall submit written claims for reimbursement of contracted activities provided on the appropriate forms. All payments will be based on contracted activities provided unless otherwise approved in writing by SE WA ALTC COG. B. SE WA ALTC COG agrees to make payment for contracted activities provided as approved by SE WA ALTC COG with warrants within thirty (30) working days. This is contingent upon the availability of funds and receipt of the Contractor's claims for reimbursement by SE WA ALTC COG by the tenth day of each month following the month during which the services were provided. No payment shall be made in the month services are rendered unless otherwise approved by SE WA ALTC COG. C. End of year invoices will be accepted until February 28a' following the contract period unless otherwise noted in the contract. Any invoices received after February 28a' will not be processed for payment. ALTCCOG 2020-46 IV. UNITS OF SERVICE A. Definition: A unit of Geriatric Preventative Foot Care service shall consist of one (1) foot care treatment. B. Minimum Anticipated Service Level by Contract: county Units Franklin County 1,000 Burbank, Walla Walla County so, V. PAYMENT CONSIDERATIONS As consideration for services, as described in the Specific Provisions of this Agreement, SE WA ALTC COG agrees to pay the Contractor a sum not to exceed $18,492 from available funds. These funds shall be used to provide Geriatric Preventative Foot Care services. Of this total sum $2,052 is for foot care services in Burbank, Walla Walla County. This sum shall be available during the period January 1, 2020 through December 31, 2020. Payment to the Contractor for this unit rate price Agreement shall be based on the unit rate of $30.22 per unit of Foot Care services (less client donations). ALTCCOG 2020-46 ATTACHMENT A Basic Agreement THIS BASIC AGREEMENT is entered into by and between Southeast- Washington Aging and Long Term Care Council of Governments hereinafter called "Southeast Washington Aging and Long Term Care, or SE WA ALTC COG" and City of Pasco hereinafter called "the Contractor". PURPOSE The purpose of this document is to establish a Basic Agreement containing General Terms that shall be incorporated by reference into any Contract executed between Southeast Washington Aging and Long Term Care and the Contractor. II AUTHORITY OF THE DIRECTOR OF SOUTHEAST WASHINGTON AGING AND LONG TERM CARE Southeast Washington Aging & Long Term Care hereby appoints and the Contractor hereby accepts the Director of Southeast Washington Aging and Long Term Care or a designee, as the Southeast Washington Aging and Long Term Care's representative for the purpose of administering the provisions of this Basic Agreement and subsequent Contracts, including Southeast Washington Aging and Long Term Care's right to inspect facilities and records, to receive and act on reports and documents, to request and receive additional information from the Contractor, to approve budget revisions and payment changes, to approve fee schedules for services, to assess the general performance of the Contractor, to determine if contracted services are being delivered in accordance with Federal, State, and local laws and regulations, to approve subcontracts, and to suspend this Basic Agreement or any Contract. All actions taken by the Director shall be subject to approval by the Southeast Washington Aging and Long Term Care. Southeast Washington Aging and Long Term Care reserves the right to terminate this Basic Agreement or any Contract and to commence civil action for its enforcement. III EXTENT OF AGREEMENT The Basic Agreement and Contract(s) contain all the terms agreed upon by the parties. No other understandings, written or oral, regarding the subject matter of this Basic Agreement or any Contract shall bind the parties. IV PERIOD OF AGREEMENT The terms of this Basic Agreement shall commence upon the date of execution and shall remain in full force and effect until specifically modified or terminated by mutual assent of the parties regardless of the modification or termination in whole or in part of any Contract. This Basic Agreement supersedes any prior Basic Agreement executed between Southeast Washington Aging and Long Term Care and the Contractor. V COMPLIANCE WITH LAWS The Contractor, in performance of this Basic Agreement and any Contract, shall comply with all applicable Federal, State, and local laws and regulations including HIPAA. VI ORDER OF PRECEDENCE Unless otherwise provided in a Contract, any inconsistency in the Basic Agreement or a Contract shall be resolved by giving precedence in the following order: A. Applicable Federal and State laws and Regulations; B. The terms and conditions of a Contract; C. The terms and conditions of the Basic Agreement; D. Any other provisions incorporated in writing into the Basic Agreement or Contract. E. The terms contained in the Statement of Work. COP BA Page 1 of 20 ALTCCOG 2020-46 VII RELATIONSHIP OF THE PARTIES The parties agree that the Contractor is an independent contractor and not an agent or employee of Southeast Washington Aging and Long Term Care. Agents, employees, or representatives of the Contractor shall neither claim to be nor present themselves as employees, agents, or representatives of Southeast Washington Aging and Long Term Care for any purpose. Employees of the Contractor are not entitled to any benefits Southeast Washington Aging and Long Term Care provides for its employees. VIII DEFINITIONS Terms used throughout this Basic Agreement shall have meanings as defined in the Washington Administrative Code (WAC). Additionally, the following words shall have the meanings as indicated: Aging and Long Term Care — Southeast Washington Aging and Long Term Care. Basic Agreement - This Agreement, which identifies the Contractor and the general terms that apply when and if Southeast Washington Aging and Long Term Care and the Contractor execute a Contract. The terms of the Basic Agreement are applicable to a Contract. Business Associate - means the "Contractor" and generally has the same meaning as the term "Business Associate" as defined in 45 CFR 160.103 which means a Business Associate who performs or assists in the performance of an activity for or on behalf of the Covered Entity that involves the use or disclosure of protected health information (PHI). Any reference to Business Associate Under this Agreement includes Business Associate's employees, agents, officers, subcontractors, third party contractors, volunteers, or directors. Business Associate Agreement - means the HIPAA Compliance section of the Agreement and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights. Breach - means the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted underthe HIPAA Privacy Rule which compromises the security or privacy of the Protected Health Information, with the exclusions and exceptions listed in 45 CFR 164.402. Client - An individual applying for or receiving goods, services or benefits under a Contract. The terms Consumer, Customer, and Participant are synonymous. Contract - A document consisting of terms specific to contracted services, including Specific Provisions, Payment Provisions, and a Budget. Contracted Services - Those services to be provided by the Contractor under the terms of a Contract. Contractor - The individual or entity entering into this Basic Agreement with Southeast Washington Aging and Long Term Care. If a Contract is subsequently executed, the Contractor will deliver contracted services. Contractor includes authorized representatives and subcontractors retained to deliver contracted services. The term Business Associate is synonymous. Director - The Director of the Southeast Washington Aging and Long Term Care or designee. HIPAA — Health Insurance Portability and Accountability Act of 1996, 45 CFR 160, 164, privacy and security standards for Private Health Information. PHI — Private Health Information means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual. Subcontract - An agreement between the Contractor and a subcontractor, or between a subcontractor and another subcontractor, for the delivery of contracted services. The term subcontract does not include the purchase of supplies or support services that do not directly affect the client's health or welfare. The term subcontract means subcontract in any tier. COP BA Page 2 of 20 ALTCCOG 2020-46 Subcontractor - An individual or other entity delivering contracted services under a separate agreement with the Contractor or another subcontractor. The individual or entity is bound by the same HIPAA restrictions and conditions as SE WA ALTC COG and Contractor. The term "subcontractor" means subcontractor in any tier. IX MAINTENANCE OF RECORDS & SAFEGUARDING OF INFORMATION Maintenance of Records. During the term of the Agreement and for six (6) years following termination or expiration of this Agreement, both parties shall maintain records sufficient to: A. Document performance of all acts required by law, regulation, or this Agreement. B. Demonstrate accounting procedures, practices and records that sufficiently and properly document the Contractor's invoices to SE WA ALTC COG and all expenditures made by the Contractor to perform as required by this Agreement. C. For the same period, the Contractor shall maintain records sufficient to substantiate the Contractor's statement of its organization's structure, tax status, capabilities and performance. Public Information. All notices, informational brochures, press releases, research reports, and similar public notices prepared and released by the Contractor for the services described in this Agreement shall include a statement indicating the funding source as awarded under this Agreement with the SE WA ALTC COG. Failure to comply with the requirements of this section may result in the termination or suspension of this Agreement and/or non -reimbursement for the costs of said brochures, advertising etc. Information Requirements. The Contractor shall provide to SE WA ALTC COG the following documents, as applicable A. The Contractor's Liability Insurance; B. Signature Authorization Forms; C. Roster of Board of Directors, Board of Trustees, and/or Advisory Board members (if applicable). D. Licenses and certifications,- E. ertifications; E. Annual Operating Budget; (if applicable). F. Staffing plan; G. Personnel policies and procedures; H. Job description; I. By-laws, (if applicable), and J. Articles of incorporation (if applicable). All documents listed above must be submitted annually and/or as changes occur throughout the term of this Agreement, with any changes made from previous documents on file with SE WA ALTC COG indicated with an asterisk, along with the date changes were formally adopted. All of the above documents are subject to review and approval by SE WA ALTC COG. Should such changes affect the scope of this Agreement, SE WA ALTC COG reserves the right to amend or terminate this Agreement. Confidential/PHI Information. The use or disclosure by the Contractor of confidential information and PHI concerning a client is prohibited without the written consent/authorization of the client, their designee, or responsible parent or guardian if the client is incompetent or a minor, or as otherwise provided by law, except: A. The Director or the Contractor may disclose information to each other, the State of Washington, or the Federal government for purposes directly connected with the administration of this Basic Agreement or any Contract. Such information includes determining eligibility, delivering services, and participating in an audit. B. The Director or the Contractor may disclose information to appropriate Federal agencies and the State of Washington for research, monitoring, statistical, and evaluation purposes. COP BA Page 3 of 20 ALTCCOG 2020-46 C. The Director and the Contractor may disclose PHI to each other for data aggregation services, treatment, payment or health care operations. D. The contractor agrees to develop and use appropriate procedural, physical, and electronic safeguards to prevent misuse of PHI. The contractor must limit any use or disclosure to the minimum amount necessary to accomplish the intended purpose. X TREATMENT OF ASSETS Real and personal property shall not be purchased under this Basic Agreement or any Contract without prior written approval from the Director. An inventory of such property shall be completed annually and submitted to the Director A. Definitions: 1. Nonexpendable Personal Property means tangible personal property having a useful life of more than one year and an acquisition cost of $5,000.00 or more per unit, unless defined otherwise by Contract. 2. Personal Property means property of any kind except real property. 3. Acquisition Cost means the amount expended for property, excluding interest and the book value (acquisition cost less depreciation) of any trade-in. 4. Useful Life of property means that useful service life as based on the U. S. Department of Treasury, Internal Revenue Service, policies on depreciation for tax purposes, unless the Contractor can document to the written satisfaction of the Director some different period. B. Title to all property furnished by Southeast Washington Aging and Long Term Care with County, State, or Federal funds shall remain with Southeast Washington Aging and Long Term Care, the State of Washington, or the Federal Government as their respective interests may appear. C. Title to all nonexpendable personal property purchased by the Contractor, the cost of which the Contractor is entitled to be reimbursed as a direct item of cost under a Contract, shall pass to and vest in Southeast Washington Aging and Long Term Care or State of Washington, or Federal Government as their respective interests may appear, upon delivery of such property. D. Nonexpendable personal property purchased by the Contractor under the terms of any Contract in which title is vested in Southeast Washington Aging and Long Term Care, State, or Federal Government shall not be rented, loaned, or otherwise passed to any person, partnership, corporation, association or organization without the prior written approval of the Southeast Washington Aging and Long Term Care, State, or Federal Government. E. Nonexpendable personal property furnished to or purchased by the Contractor, which is vested in Southeast Washington Aging and Long Term Care, State, or Federal Government, shall be used only for the delivery of contracted services. F. As a condition precedent to reimbursement for the purchase of nonexpendable personal property, title to which shall vest in Southeast Washington Aging and Long Term Care, State, or Federal Government, the Contractor agrees to execute such security agreements and other documents as shall be necessary for Southeast Washington Aging and Long Term Care, State, or Federal Government to protect their respective interests in such property in accordance with the Uniform Commercial Code -Secured Transactions as codified in Article 9, Title 62A, RCW. G. The Contractor shall be responsible: 1. For loss or damage to property of Southeast Washington Aging and Long Term Care, State, or Federal Government that results from negligence, willful misconduct, or lack of good faith on the part of the Contractor; 2. To maintain and administer property in accordance with sound management practices; and COP BA Page 4 of 20 ALTCCOG 2020-46 To ensure that the property shall be returned to Southeast Washington Aging and Long Term Care, State, or Federal Government in condition as good as when acquired, reasonable wear and tear expected. H. Upon the loss or destruction of or damage to Southeast Washington Aging and Long Term Care, State, or Federal Government property, the Contractor shall notify the Director thereof and shall take all reasonable steps to protect that property from further damage. I. The Contractor shall surrender to the Director all property of Southeast Washington Aging and Long Term Care, State, or Federal Government within 30 days after settlement upon rescission, termination, or completion of this Basic Agreement or the Contract(s) for which the property was purchased, unless otherwise mutually agreed between the Contractor and the Director. J. The Director may, at his or her discretion, abandon in place property in which title is vested in Southeast Washington Aging and Long Term Care, State, or Federal Government under the terms of this Basic Agreement insofar as permitted by law, rule, or regulation, and thereupon all rights and obligations of Southeast Washington Aging and Long Term Care, State, or Federal Government regarding such abandoned property shall cease. XI LICENSING AND PROGRAM STANDARDS The Contractor shall comply with all applicable Federal, State, and local laws and regulations for licensing, certification and operation of facilities and programs, and accreditation and licensing of individuals, and other standards or criteria as described in this Basic Agreement or any Contract to assure quality of services. XII STANDARDS FOR FISCAL ACCOUNTABILITY A. The Contractor's fiscal management system shall: 1. Provide accurate, current, and complete disclosure of the financial status of each Contract; 2. Identify the source and application of all funds received for contracted services, distinguish costs of contracted services delivered under the terms of the Contract from all other costs and provide for accounting separation of all funds received; and 3. Report all revenue and expenditures to the Director in a manner consistent with generally accepted accounting principles. B. The Contractor agrees to maintain written accounting procedures. C. The Contractor agrees to: Maintain records and documents that accurately reflect all direct and indirect costs related to the delivery of contracted services; and Retain all fiscal and program records and other material relevant to a Contract according to the federal or state program guidelines. Fiscal records must be retained until all audits are resolved. XIII INSPECTION A. The Contractor shall give access to its facilities and records to any authorized officer, employee or agent of Southeast Washington Aging and Long Term Care, the State of Washington or the Federal Government at all reasonable times. Authorized persons shall have the right to examine the Contractor's performance, financial records, and HIPAA documentation and perform other activities to determine the Contractor's compliance with the terms of this Basic Agreement, any Contract, and H I PAA. The Director shall give the Contractor reasonable notice of monitoring, auditing, observation and other visits by its officers and employees to the Contractor's place of business. COP BA Page 5 of 20 ALTCCOG 2020-46 B. The Director may require the Contractor to make reasonable changes in the contracted services and HIPAA practices, as completed or to be completed, if the contracted services fail to conform to the standards and specifications set forth in the Contract. C. The Contractor shall notify the Director immediately of inspections, audits, accreditations, or program reviews related to the delivery of contracted services. The Contractor agrees to provide the Director copies of written reports of inspections, audits, accreditations or program reviews within 72 hours. XIV HOLD HARMLESS A. Indemnification, Defense, and Hold Harmless: To the fullest extent permitted by law including RCW 4.24.115, the Contractor shall indemnify, defend, and save harmless Southeast Washington Aging and Long Term Care and its officers, employees, agents, and volunteers from all claims, suits, or actions brought for injuries to, or death of, any persons, or damages arising from or relating to the Contractor's performance of this Agreement or in consequence of any negligence or breach of contract related to the Contractor's performance of this Agreement caused in whole or in part by any act or omission by the Contractor or the agents or employees of the Contractor related to performance of this Agreement. B. Contractor's Waiver of Employer's Immunity under Title 51 RCW: Contractor intends that its obligations to indemnify, defend, and hold harmless set forth above in section 15 shall operate with full effect regardless of any provision to the contrary in Title 51 RCW, Washington's Industrial Insurance Act. Accordingly, the Contractor specifically assumes all potential liability for actions brought by employees of the Contractor against Southeast Washington Aging and Long Term Care and its officers, employees, agents, and volunteers, and, solely for the purpose of enforcing the Contractor's obligations to indemnify, defend, and hold harmless set forth above in section 15, the Contractor specifically waives any immunity granted under the state industrial insurance law, Title 51 RCW. The parties have mutually negotiated this waiver. C. The Contractor shall similarly require that any subcontractor it retains in connection with its performance of this Agreement shall comply with the terms of this paragraph, waive any immunity granted under Title 51 RCW, and assume all liability for actions brought by employees of the subcontractor. XV AUDIT REQUIREMENTS A. Definitions Single Audit means an audit that will encompass the entirety of the financial operations of the Contractor and shall determine and report whether: 1. The financial statements of the Contractor present fairly its financial position and the results of its financial operations in accordance with generally accepted accounting principles, and whether the Contractor has complied with laws and regulations that may have a material effect upon the financial statements,- 2. tatements;2. The Contractor has internal control systems to provide reasonable assurance that it is managing Federal financial assistance programs in compliance with applicable laws and regulations; and 3. The Contractor has complied with laws and regulations that may have a material effect upon each major Federal assistance program. In testing compliance for this section the auditor must select and test a representative number of transactions from each major Federal assistance program. Program -Specific Audit means an audit of one Federal program in accordance with Federal laws, regulations, or audit guides relative to that particular program. COP BA Page 6 of 20 ALTCCOG 2020-46 When a Contractor expends Federal Financial Assistance under only one Federal program and the Federal program's laws, regulations, or grant agreements do not require a financial statement audit of the Contractor, the Contractor may elect to have a program -specific audit. Subrecipient means any person or government department, agency, or establishment that receives federal financial assistance to carry out or administer a program but not an individual who is a beneficiary of such a program. Distinguishing characteristics of a Subrecipient include such items as responsibility to meet compliance requirements, performance measured against meeting the objectives of a program, responsibility for programmatic decision making, and determining eligibility for assistance. Vendor means an entity responsible for providing goods or services that are required for the conduct of a Federal program. Distinguishing characteristics of a vendor include such items as providing the goods or services within normal business operations, operating for a profit, providing similar goods or services to many different purchasers, operating in a competitive environment, and not having responsibility for adherence to program compliance requirements. Federal Financial Assistance means assistance provided by a Federal agency in the form of grants, contracts, cooperative agreements, loans, loan guarantees, property, interest subsidies, insurance, food commodities, direct appropriations, and other assistance. It does not include direct Federal cash assistance to individuals. It includes awards received directly from Federal agencies or indirectly through other units of state and local governments. B. The Contractor, if a Subrecipient of Federal Financial Assistance and expends (from all sources) $750,000 or more a year in Federal Financial Assistance, shall purchase annually a single or program - specific audit conducted for that year by a government auditor or public accountant who meets the standards for independence specified in the Government Auditing Standards. The Contractor agrees to: 1. Adhere to the Office of Management and Budget (OMB) Circular A-133 and other relevant Federal and State Requirements,- 2. equirements; 2. Provide access to independent auditors to its financial records; and 3. Maintain accounting records that will enable identification of all federal funds received and expended by the OMB Catalog of Federal Domestic Assistance number. C. The Contractor, if a Subrecipient of Federal Financial Assistance and expends (from all sources) less than $750,000 per year in Federal awards is exempt from Federal audit requirements for that year, but records must be available for review or audit by appropriate officials of the Federal Agency, pass-through entity and the General Accounting Office (GAO). D. The Contractor, if a vendor, is exempt from Federal audit requirements but records must be available for review by appropriate officials of the Federal agency, pass-through entity, and the General Accounting Office. The Contractor agrees to: 1. Ensure that transactions are in compliance with laws, regulations, and the provisions of the Contract or grant agreements; 2. Maintain accounting records that will enable identification of all federal funds received and expended; and 3. Provide access to its financial records by appropriate officials of Southeast Washington Aging and Long Term Care, State, Federal Government or their authorized representative to determine program compliance. E. The Contractor shall ensure that the audit report, with management letter, is submitted to the Director within nine months after the end of the audit period but no later than 30 -days after its receipt. COP BA Page 7 of 20 ALTCCOG 2020-46 XVI INSURANCE AND BONDING A. Southeast Washington Aging and Long Term Care certifies that it is insured as a member of Enduris, and can pay for losses for which it is found liable. B. The Contractor shall, maintain occurrence based comprehensive general liability insurance and automobile liability insurance with minimum limits of $1,000,000 per occurrence and $2,000,000 aggregate, as well as Workers Compensation Contingent Employers Liability with minimum limits of $1,000,000 each accident or disease for each employee. Such insurance shall provide that Southeast Washington Aging and Long Term Care, its officers, employees, agents and volunteers are Primary Additional Insured's under such insurance. The coverage provided under such insurance for such Primary Additional Insured's shall be primary and not contributory to any other coverage that may be available to such Primary Additional Insured's. Prior to commencement of any work under this Agreement, the Contractor shall, provide proof of such insurance including all Certificates of Insurance and endorsements pertaining to such insurance, and if requested, any policy pertaining to insurance required under this Agreement. C. The Contractor agrees to maintain, without interruption during the term of a Contract, a Fidelity Bond in a minimum amount of $50,000, unless specified otherwise in the contract, which covers all individuals responsible for the administration of funds provided within the terms of a Contract. Certification of bonding shall be submitted to the Director within thirty days after execution of a Contract. D. The Contractor shall notify the Director immediately if either insurance or bonding coverage is terminated during the term of a Contract or is reduced below contractual requirements. XVII NONDISCRIMINATION A. The Contractor shall develop or adopt a nondiscrimination plan consistent with the Washington State Law Against Discrimination (RCW 49.60). B. The Contractor agrees that it shall not discriminate against any person on the grounds of race, creed, color, religion, national origin, sex, sexual orientation, age, marital status, political affiliation or belief, or the presence of any sensory, mental or physical handicap in violation of the Washington State Law Against Discrimination (RCW Chapter 49.60) or the Americans with Disabilities Act (42 USC 12101 et seq). In the event the Contractor violates this provision, SE WA ALTC COG may terminate this Agreement immediately and bar the Contractor from performing any services for SE WA ALTC COG in the future. The Contractor shall not: 1. Deny an individual contracted services or benefits; 2. Provide contracted services or benefits to an individual that are different, or are provided in a different manner, from those provided to others; 3. Subject an individual to segregation or separate treatment in any manner related to the receipt of contracted services or benefits; or 4. Deny an individual an opportunity to participate in any program or afford an opportunity to do so that is different from that afforded others. C. The Contractor shall not use criteria or methods of administration that have the effect of subjecting individuals to discrimination because of race, creed, color, religion, national origin, sex, sexual orientation, age, marital status, political affiliation or belief, or the presence of any sensory, mental or physical handicap or have the effect of defeating or substantially impairing the delivery of contracted services to the class of individuals mentioned above through the selection of: 1. The types of contracted services or other benefits to be provided; 2. The class of individuals to whom, or the situation in which, such contracted services or other benefits shall be provided; or COP BA Page 8 of 20 ALTCCOG 2020-46 3. The class of individuals to be afforded an opportunity to receive contracted services or other benefits; In accordance of the Washington State Law Against Discrimination (RCW Chapter 49.60) or the Americans with Disabilities Act (42 USC 12101 et seq). In the event the Contractor violates this provision, Southeast Washington Aging and Long Term Care may terminate this Agreement immediately and bar the Contractor from performing any services for SE WA ALTC COG in the future. D. The Contractor shall comply with all Federal and State nondiscrimination rules, including: 1. The Americans with Disabilities Act (ADA) of 1990, which prohibits discrimination against qualified individuals with disabilities and requires reasonable accommodations to the known physical or mental limitations of an otherwise qualified individual. 2. Title VI of the Civil Rights Act of 1964 as amended. 3. Section 504 of the Rehabilitation Act 1973 as amended. 4. The Age Discrimination Act of 1975 as amended. 5. The Washington State Law Against Discrimination, RCW 49.60. E. The Contractor shall have a written procedure for resolving complaints that allege a violation of Federal laws against discrimination. A copy shall be made available to clients and applicants for contracted services. Such procedures should include time frames for Contractor response or action. Persons wishing to file a complaint shall be advised in writing of their right to file their complaint within 180 days of the alleged act of discrimination directly with the Washington State Human Rights Commission, the U.S. Equal Employment Opportunity Commission, the U.S. Department of Health and Human Services Office for Civil Rights, or the U.S. Department of Labor Office of Contract Compliance. F. Equal Employment Opportunity: The Contract agrees that they will comply with all equal employment opportunity requirements as applicable with State and Federal laws. G. The Contractor shall require subcontractors to fully comply with the provisions of this section, including sanctions for noncompliance. XVIII INCIDENT REPORTING The Contractor agrees to report any extraordinary incident to the Director, in writing, within three working days of the occurrence of an incident. A reportable incident is one that occurs or arises under this Basic Agreement or any Contract, and that involves: A. A death or injury, requiring inpatient hospital care, of a client or person under the care, supervision, or control of the Contractor at the time of the incident; B. An act of violence or serious crime in which the victim or the perpetrator is a client or person employed by or under the care, supervision, or control of the Contractor at the time of the incident; C. An incident of such public concern that the Director or the Southeast Washington Aging and Long Term Care Council of Government Governing Board may have a need to know, or D. A loss of funding so great as to jeopardize the Contractor's ability to fulfill the terms of this Basic Agreement or any Contract. E. Any unauthorized uses/disclosures of which it becomes aware, and shall take all reasonable steps to mitigate the potentially harmful effects of such breach. XIX ASSIGNMENT AND SUBCONTRACTING The Contractor shall not assign or subcontract any portion of contracted services unless the written subcontract has been reviewed and approved by the Director prior to the start of the subcontract. COP BA Page 9 of 20 ALTCCOG 2020-46 All contracted services that are not delivered directly by the Contractor must be delivered according to the terms of this Basic Agreement and the Contract. XX SEVERABILITY If any provision of this Basic Agreement shall be held invalid, the invalidity shall not affect the other provisions of the Agreement. To that end, the provisions of this Basic Agreement are severable. XXI MODIFICATION No modification or waiver of any clause or condition of this Basic Agreement is binding upon either parry unless such modification or waiver is in writing and executed by both parties. XXII SUSPENSION, TERMINATION AND CLOSEOUT If the Contractor fails to comply with the terms of this Basic Agreement, any Contract or HIPAA, the Director may pursue such remedies as are legally available including the suspension or termination of this Basic Agreement or the Contract in whole or in part in the manner specified herein. A. Suspension - If the Contractor fails to comply or is unable to substantiate full compliance with the terms of this Basic Agreement or any Contract, the Director may suspend this Basic Agreement or the Contract in whole or in part pending corrective action or investigation, effective no less than seven days following written notification to the Contractor. The suspension shall remain in force until the Contractor complies to the satisfaction of the Director and is able to substantiate its full compliance with the terms of this Basic Agreement and the Contract. No obligation incurred by the Contractor during the period of suspension shall be allowable under this Basic Agreement except: 1. Reasonable, proper, and otherwise allowable costs that the Contractor could not avoid during the period of suspension; and 2. Discretionary costs that the Contractor incurred during the period of suspension if the Contractor is able to substantiate complete compliance with the terms of this Basic Agreement and the Contract. B. Termination for Cause - The Director may, by written notice, terminate this Basic Agreement or any Contract in whole or in part for substantial breach by the Contractor of duties under this Basic Agreement, any Contract or HIPAA. In such an event, the Contractor shall be liable for reasonable damages, including the reasonable cost of procuring similar services actually procured by the Director to fully execute the Contractor's duties under this Basic Agreement and the Contract(s). C. Termination for Other Grounds - This Basic Agreement or any Contract may be terminated in whole or in part by: 1. Either party, upon thirty days advance written request, in which case the two parties shall devise by mutual agreement the conditions of termination including the effective date and in case of termination in part, the portion to be terminated. 2. The Director, immediately upon written notice, if funding is withdrawn or reduced to the extent that the continuation is not in the best interest of Southeast Washington Aging and Long Term Care. D. Termination Procedure. The following provisions apply in the event this Agreement is terminated: 1. The Contractor shall cease to perform any services required by this Agreement as of the effective date of termination, and shall comply with all reasonable instructions contained in the notice of termination which are related to the transfer of clients, distribution of property, and termination of services. 2. The Contractor shall promptly deliver to SE WA ALTC COG, all SE WA ALTC COG assets (personal property) in the Contractor's possession, including any material created under this Agreement. COP BA Page 10 of 20 ALTCCOG 2020-46 Upon failure to return SE WA ALTC COG property within ten (10) business days of the Agreement termination, the contractor shall be charged with all reasonable costs of recovery, including transportation. The Contractor shall take all commercially reasonable steps to protect and preserve any property of SE WA ALTC COG that is in the possession of the Contractor pending return to SE WA ALTC COG. 3. SE WA ALTC COG shall be liable for and shall pay for only those services authorized and provided through the effective date of termination. SE WA ALTC COG may pay an amount mutually agreed by the parties for partially completed work and services, if work products are useful to or useable by SE WA ALTC COG. 4. If SE WA ALTC COG terminates this Agreement for default, SE WA ALTC COG may withhold a sum from the final payment to the Contractor that SE WA ALTC COG determines necessary to protect/SE WA ALTC COG against loss or additional liability. SE WA ALTC COG shall be entitled to all remedies available at law, in equity, or under this Agreement. If it is later determined the Contractor was not in default, or if the Contractor terminated this Agreement for default, the Contractor shall be entitled to all remedies available at law, in equity, or under this Agreement. E. Closeout - Upon expiration or termination of a Contract, in whole or in part, the following provisions shall apply: 1. Southeast Washington Aging and Long Term Care shall pay to the Contractor all allowable reimbursable costs not covered by previous payment upon submittal of a final invoice, subject only to the right reserved to the parties in the event of a dispute as provided in subparagraph 9" below. 2. The Contractor shall pay to Southeast Washington Aging and Long Term Care moneys received from Southeast Washington Aging and Long Term Care in excess of allowable costs, subject only to the right reserved to the parties in the event of a dispute as provided in subparagraph "3" below. 3. In the event the Director and the Contractor are unable to agree upon amounts due as provided in subparagraphs 1" or "2" above, either party shall have the right to withhold the disputed amount from final payment pending a final audit, and then pay such amounts as the audit determines are payable. 4. The Contractor shall submit all required financial and performance reports and claims for payment within thirty days after the end of the contract unless a different period is set by Southeast Washington Aging and Long Term Care. 5. At the option of the Director, the contractor shall return or destroy all PHI created or received from or on behalf of Southeast Washington Aging and Long Term Care and provide appropriate documentation evidencing procedure. The contractor agrees that it will not retain any copies of PHI except as required by law. If return or destruction of all PHI, and all copies of PHI, is not feasible, contractor agrees to extend the protections of this Contract to such information for as long as it is maintained. F. Notices shall be delivered by U.S. mail to the address stated in the first paragraph of this Agreement or such other address provided by the Contractor in writing to the Director. XXIII INDIVIDUAL RIGHTS AND HIPAA The contractor shall make all PHI and related information in its possession available: A. To the individual or his/her personal representative or to Southeast Washington Aging and Long Term Care, for inspection and copying. COP BA Page 11 of 20 ALTCCOG 2020-46 B. To the individual or his/her personal representative or to SE WA ALTC COG to fulfill any obligation to account for disclosures of PHI. C. To Southeast Washington Aging and Long Term Care to fulfill any obligation to amend PHI and related information and shall incorporate any amendments or related statements into the information the contractor holds and notify any subcontractors or agents of amendments. D_ HIPAA Compliance. This section of the Agreement is considered the Business Associate Agreement as required by HIPAA. 1. Compliance Business Associate shall perform all Contract duties, activities and tasks in compliance with HIPAA, the HIPAA Rules, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Office of Civil Rights. 2. Use and Disclosure of PHI Business Associate is limited to the following permitted and required uses or disclosures of PHI: a) Duty to Protect PHI. Business Associate shall protect PHI from, and shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided for in this Contract or as required by law, for as long as the PHI is within its possession and control, even after the termination or expiration of this Contract. b) Minimum Necessary Standard. Business Associate shall apply the HIPAA Minimum Necessary standard to any Use or disclosure of PHI necessary to achieve the purposes of this Contract. See 45 CFR 164.514 (d)(2) through (d)(5). c) Disclosure as Part of the Provision of Services. Business Associate shall only Use or disclose PHI as necessary to perform the services specified in this Contract or as required by law, and shall not Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information) if done by Covered Entity, except for the specific uses and disclosures set forth below. d) Use for Proper Management and Administration. Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. e) Disclosure for Proper Management and Administration. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached. f) Impermissible Use or Disclosure of PHI. Business Associate shall report to SE WA ALTC COG in writing all uses or disclosures of PHI not provided for by this Contract within one (1) business day of becoming aware of the unauthorized use or disclosure of PHI, including Breaches of unsecured PHI as required at 45 CFR 164.410 (Notification by a Business Associate), as well as any Security Incident of which it becomes aware. COP BA Page 12 of 20 ALTCCOG 2020-46 Upon request by SE WA ALTC COG, Business Associate shall mitigate, to the extent practicable, any harmful effect resulting from the impermissible Use or disclosure. g) Failure to Cure. If SE WA ALTC COG learns of a pattern or practice of the Business Associate that constitutes a violation of the Business Associate's obligations under the terms of this Contract and reasonable steps by SE WA ALTC COG do not end the violation, SE WA ALTC COG shall terminate this Contract, if feasible. In addition, If Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate's obligations under the terms of their contract and reasonable steps by the Business Associate do not end the violation, Business Associate shall terminate the Subcontract, if feasible. h) Termination for Cause. Business Associate authorizes immediate termination of this Contract by SE WA ALTC COG, if SE WA ALTC COG determines that Business Associate has violated a material term of this Business Associate Agreement. SE WA ALTC COG may, at its sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause. i) Consent to Audit. Business Associate shall give reasonable access to PHI, its internal practices, records, books, documents, electronic data and/or all other business information received from, or created or received by Business Associate on behalf of SE WA ALTC COG, to SE WA ALTC COG for use in determining compliance with HIPAA privacy requirements. j) Obligations of Business Associate upon Expiration or Termination. Upon expiration or termination of this Contract for any reason, with respect to PHI received from SE WA ALTC COG, or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of SE WA ALTC COG, Business Associate shall: (i) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration orto carryout its legal responsibilities, - (i i) esponsibilities;(ii) Return to SE WA ALTC COG or destroy the remaining PHI that the Business Associate or any Subcontractors still maintain in any form; (iii) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respectto Electronic Protected Health Information to prevent Use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI; (iv) Not Use or disclose the PHI retained by Business Associate or any Subcontractors other than for the purposes for which such PHI was retained and subject to the same conditions set out in the "Use and Disclosure of PHI" section of this Contract which applied prior to termination; and (v) Return to SE WA ALTC COG or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities. k) Survival. The obligations of the Business Associate under this section shall survive the termination or expiration of this Contract. 3. Individual Rights a) Accounting of Disclosures. COP BA Page 13 of 20 ALTCCOG 2020-46 (i) Business Associate shall document all disclosures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures. (ii) Within ten (10) business days of a request from SE WA ALTC COG, Business Associate shall make available to SE WA ALTC COG the information in Business Associate's possession that is necessary for SE WA ALTC COG to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and 164.528(b)(1). (iii) At the request of SE WA ALTC COG or in response to a request made directly to the Business Associate by an Individual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for an accounting of disclosures of PHI. (iv) Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested. b) Access (i) Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by SE WA ALTC COG or the Individual as necessary to satisfy SE WA ALTC COG's obligations under 45 CFR 164.524 (Access of Individuals to Protected Health Information). (ii) When the request is made by the Individual to the Business Associate or if SE WA ALTC COG asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164.524 (Access of Individuals to Protected Health Information) on form, time and manner of access. When the request is made by SE WA ALTC COG, the Business Associate shall provide the records to DSHS within ten (10) business days. c) Amendment. (i) If SE WA ALTC COG amends, in whole or in part, a record or PHI contained in an Individual's Designated Record Set and SE WA ALTC COG has previously provided the PHI or record that is the subject of the amendment to Business Associate, then SE WA ALTC COG will inform Business Associate of the amendment pursuant to 45 CFR 164.526(c)(3) (Amendment of Protected Health Information). (ii) Business Associate shall make any amendments to PHI in a Designated Record Set as directed by SE WA ALTC COG or as necessary to satisfy SE WA ALTC COG's obligations under 45 CFR 164.526 (Amendment of Protected Health Information). 4. Subcontracts and Other Third Party Agreements In accordance with 45 CFR 164.502(e)(1)(ii), 164.504(e)(1)(i), and 164.308(b)(2), Business Associate shall ensure that any agents, Subcontractors, independent contractors or other third parties that create, receive, maintain, or transmit PHI on Business Associate's behalf, enter into a written contract that contains the same terms, restrictions, requirements, and conditions as the HIPAA compliance provisions in this Contract with respect to such PHI. The same provisions must also be included in any contracts by a Business Associate's Subcontractor with its own business associates as required by 45 CFR 164.314(a)(2)(b) and 164.504(e)(5) . 5. Obligations COP BA Page 14 of 20 ALTCCOG 2020-46 To the extent the Business Associate is to carry out one or more of SE WA ALTC COG's obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information), Business Associate shall comply with all requirements that would apply to SE WA ALTC COG in the performance of such obligation(s). 6. Liability Within ten (10) business days, Business Associate must notify SE WA ALTC COG of any complaint, enforcement or compliance action initiated by the Office for Civil Rights based on an allegation of violation of the HIPAA Rules and must inform DSHS of the outcome of that action. Business Associate bears all responsibility for any penalties, fines or sanctions imposed against the Business Associate for violations of the HIPAA Rules and for any imposed against its Subcontractors or agents for which it is found liable. 7. Breach Notification a) In the event of a Breach of unsecured PHI or disclosure that compromises the privacy or security of PHI obtained from SE WA ALTC COG or involving SE WA ALTC COG clients, Business Associate will take all measures required by state or federal law. b) Business Associate will notify SE WA ALTC COG within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Contract or not authorized by HIPAA Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health Information as defined in 45 CFR 164.402 (Definitions). c) Business Associate will notify the SE WA ALTC COG Contact shown on the cover page of this Contract within one (1) business day by telephone or e-mail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHI, type of Breach, origination and destination of PHI, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the name, address, telephone number, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the SE WA ALTC COG Contact. Business Associate will coordinate and cooperate with SE WA ALTC COG to provide a copy of its investigation and other information requested by SE WA ALTC COG, including advance copies of any notifications required for SE WA ALTC COG review before disseminating and verification of the dates notifications were sent. d) If SE WA ALTC COG determines that Business Associate or its Subcontractor(s) or agent(s) is responsible for a Breach of unsecured PHI: i. requiring notification of Individuals under 45 CFR § 164.404 (Notification to Individuals), Business Associate bears the responsibility and costs for notifying the affected Individuals and receiving and responding to those Individuals' questions or requests for additional information; ii. requiring notification of the media under 45 CFR § 164.406 (Notification to the media), Business Associate bears the responsibility and costs for notifying the media and receiving and responding to media questions or requests for additional information; COP BA Page 15 of 20 ALTCCOG 2020-46 iii. requiring notification of the U.S. Department of Health and Human Services Secretary under 45 CFR § 164.408 (Notification to the Secretary), Business Associate bears the responsibility and costs for notifying the Secretary and receiving and responding to the Secretary's questions or requests for additional information; and iv. SE WA ALTC COG will take appropriate remedial measures up to termination of this Contract 8. Miscellaneous Provisions a) Regulatory References. A reference in this Contract to a section in the HIPAA Rules means the section as in effect or amended. b) Interpretation. Any ambiguity in this Contract shall be interpreted to permit compliance with the HIPAA Rules. XXIV GRIEVANCE PROCEDURES The Contractor shall have a written procedure for resolving grievances. A copy shall be made available to clients and applicants for contracted services. Such procedures should include time frames for filing a grievance and provide opportunities for informal and formal resolution. For grievances arising from the delivery of contracted services, the grievance procedures must include the right of the grievant to appeal to the Director. Applicants and clients shall be advised of the grievance procedures and their right to due process if they feel they have been wrongfully denied or terminated from services. XXV DEBARMENT AND EXCLUSION A. The Contractor, by signature to this Agreement, certifies that the Contractor is not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participating in this Agreement by any Federal department of agency. B. The Contractor shall provide immediate written notice to the Director if at any time the Contractor learns that its certification was erroneous when submitted or has become erroneous by reason of changed circumstances. C. The Contractor shall not knowingly assign or subcontract any portion of contracted services to a person who is debarred, suspended, declared ineligible, orvoluntarily excluded from participation. XXVI CONFLICT OF INTEREST The Director may, by written notice to the Contractor, terminate this Basic Agreement in whole or in part if it is found after due notice and hearing that any of the following laws have been violated in obtaining or amending this Basic Agreement or any Contract or in making determinations with respect to this Basic Agreement or any Contract: A. RCW 42.20, Misconduct of Public Officers,- B. fficers;B. RCW 42.23, Code of Ethics for Municipal Officers -Contract Interests. C. RCW 42.52, Ethics in Public Service Southeast Washington Aging and Long Term Care shall not be liable for payment for services rendered under any Contract to the extent this Basic Agreement or the Contract was entered into in violation of this clause. XXVII COVENANT AGAINST CONTINGENT FEES The Contractor shall assure that no person or agency has been employed or retained on a contingent fee for the purpose of seeking or obtaining a Contract. COP BA Page 16 of 20 ALTCCOG 2020-46 This does not apply to legitimate employees or an established commercial or selling agency maintained by the Contractor for the purpose of securing business. In the event of breach of this clause by the Contractor, the Director may: A. Annul this Basic Agreement or the Contract in whole or in part without any liability; or B. Deduct, or similarly recover from the consideration of the Contract, the amount of the contingent fee. XXVIII LOBBYING A. Federal requirements (U.S.C. Title 31,0§1352): 1. No Federal appropriated funds may be paid, by or on behalf of the Contractor, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress or an employee of a Member of Congress in connection with the making of any Federal grant, the entering into of any cooperative agreement and the extension, continuation, renewal, amendment, or modification of any Federal grant or cooperative agreement. If non -Federal funds are used, the Contractor shall complete and submit Standard Form -LLL, "Disclosure Form to Report Lobbying," in accordance with its instructions. 2. The Contractor, if a recipient of a grant or cooperative agreement over $100,000, shall and does certify that it did and will comply with these Federal requirements. The Certification will be signed and submitted to the Director before the execution of this Basic Agreement. B. State requirements (RCW 42.17.020 (27); RCW 42.17.190; RCW 34.05): No public funds may be used directly or indirectly to attempt to influence the passage or defeat of any legislation by the legislature of the State of Washington, or the adoption or rejection of any rule, standard, rate, or other legislative enactment of any State agency under the State Administrative Procedure Act. Provided, this does not prevent the Contractor from communicating with a member of the legislature on the request of that member or requesting legislative action or appropriations through appropriate channels. C. Contractor agrees that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or any person or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. Section 1352. Contractor shall agree to provide a certificate to SE WA ALTC COG with verification of the above. XXIX PROHIBITION OF POLITICAL ACTIVITIES No funds, material, property or contracted services provided under the terms of this Basic Agreement or any Contract shall be used for partisan political activity or to further the election or defeat of any candidate for public office. XXX DISPUTES Any dispute arising under this Basic Agreement or any Contract, including a disputed complaint or grievance resolution, shall, unless otherwise provided in this Basic Agreement or the Contract, be submitted in writing to the Director for settlement under Southeast Washington Aging and Long Term Care's Dispute Resolution Procedures. XXXI DRUG-FREE WORKPLACE A. The Contractor shall and does certify, by signature of this Agreement that it provides a drug-free workplace in compliance with the Drug -Free Workplace Act (Public Law 100-690 Title V, Subtitle D). COP BA Page 17 of 20 ALTCCOG 2020-46 B. The Contractor shall publish a statement notifying employees of prohibitions against use, manufacture, distribution or possession of controlled substances in the workplace and specific actions that will be taken in the event of non-compliance. Employees shall be notified that, as a condition of employment, they must abide by the terms of the statement and notify the employer in writing of any conviction for a criminal drug statute occurring in the workplace within five calendar days after such conviction. This statement shall at a minimum be distributed to all employees engaged in the delivery of contracted services. C. The Contractor shall establish an on-going drug-free awareness program to inform employees about: 1. The dangers of drug abuse in the workplace; 2. The contractor's policy of maintaining a drug-free workplace; 3. The availability of drug counseling, rehabilitation, and employee assistance programs; and 4. The penalties that may be imposed upon employees for drug abuse violations occurring in the workplace. XXXII REIMBURSEMENT LIMITS The sum of payments to the Contractor for a contracted service shall not exceed the contracted unit rate or the contracted amount whichever is greater. In the event payments to the Contractor exceed this limit, the overpayment shall be returned to Southeast Washington Aging and Long Term Care or deducted from the next Claim for Payment submitted by the Contractor. XXXIII VENUE This Basic Agreement and all Contracts shall be governed by the laws of the State of Washington. Any action, suit, orjudicial proceeding for the enforcement of this Basic Agreement or any Contract shall be brought in the Superior Court for the State of Washington in Yakima County, Washington. XXXIV CONDITION PRECEDENT This Basic Agreement shall not be binding upon the Contractor until signature on behalf of SE WA ALTC COG and the Contractor is authorized by the Governing Board of Southeast Washington Aging and Long Term Care Council of Governments. XXXV GENERAL FEDERAL REQUIREMENTS In addition to the above, the Contractor agrees to the following terms if applicable: A. Clean Air Act (42 U.S.C. 7401-7671q and the Federal Water Pollution Contract Act (33 U.S.C. 1251- 1387) as amended. Contractor agrees that if the Contract and subaward is in excess of the amount of $100,000 or more consideration that the contractor shall agree to comply with all applicable standards, orders or regulations issued pursuant to the Clean Water Act (42 U.S.C. 7401 set seq.) and the Federal Water Pollution Control Act, as amended (33 U.S.C. 1251 et. seq.). Violations shall be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency, also known as the "EPA". B. Right to Intervention: The Contractor agrees that if this contract is for the performance of experimental, developmental, or research work shall provide for the rights of the Federal Government and SE WA ALTC COG in any resulting invention in accordance with 37 CFR part 401, "Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements," and any implementing regulations issued by the awarding agency. COP BA Page 18 of 20 ALTCCOG 2020-46 C. Contract Work Hours & Safety Standard Act (40 U.S.C. 327-333): The Contractor agrees that if the consideration for the contract exceeds $100,000 for contracts that involve the employment of mechanics or laborers shall include a provision for compliance with 40 U.S.C. 3702 and 3704, as supplemented by Department of Labor regulation (29 CFR part 5). Under 40 U.S.C. 3702 of the Act, each contractor must be required to compute the wages of every mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the standard work week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and provide that no laborer or mechanic must be required to work in surroundings or under working conditions which are unsanitary, hazardous or dangerous. These requirements do not apply to the purchasers of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence. D. Remedies: The Contractor agrees that if applicable for the small purchase threshold fixed at 41.U.S.C. 403(11), which is currently $150,000 but subject to potential change), that Contractor will comply with the provisions of this State. The parties agree that in the event of non-compliance that SE WA ALTC COG may take appropriate administrative, contractual, or administrative remedies for such violation, including and up to termination of the contract. E. Davis -Bacon Act, as amended (40 U.S.C. 3141-3148): When required by Federal program legislation the Contractor agrees that it shall comply with all provisions of the Davis -Bacon Act as supplemented by Department of Labor regulations (29 CFR Part 5, "Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction"). The contractor also agrees to comply with the Copeland "Anti -Kickback" Act (40 U.S.C. 3145), as supplemented by the Department of Labor regulations (29 CFR Part 3). F. Background Checks. The Contractor shall ensure that hiring practices for stall who will have unsupervised access to clients are in accordance with RCW 43.20A.710. A Washington State Patrol criminal history background check is required every two years for all service providers who will have unsupervised contact with vulnerable adults. This applies to individual contractors, as well as employees and/or volunteers of a contracting entity. SE WA ALTC COG will complete required background checks on their own employees, volunteers, and subcontractors. Background checks must be conducted through Washington State Patrol's Washington Access to Criminal History (WATCH) system, DSHS's Background Check Central Unit (BCCU), or a company accredited by a national association of background screeners. Those who have disqualifying crimes or negative actions per RCW 43.20A.710 cannot have unsupervised access to vulnerable adults served through this contract. G. Client Abuse. The Contractor shall report all instances of suspected client abuse to DSHS, in accordance with RCW 74.34. H. Data Security. The Contractor shall perform the services as set forth in accordance with Appendix 1, Data Security Requirements. I. Emergency Plan: The Contractor shall have a plan for serving currently authorized clients during periods when normal services may be disrupted. This may include earthquakes, floods, snowstorms, pandemic flu, etc. The Contractor's plan should include the maintenance of lists, including the identification of those clients who are at most risk, as well as emergency provisions for service delivery. J. Whistleblowing: The Contractor shall comply with all State and/or Federal applicable laws pertaining to employee whistleblowing rights and protections afforded under applicable law. COP BA Page 19 of 20 AUCCOG 2020-46 K. Compliance with State & Federal Law. The Contractor hereby agrees to comply with all applicable State and Federal law and requirements during performance of this agreement. Failure to do so may result in suspension, nonpayment and/or immediate termination of this agreement. XXXVI ORIGINALS AND BEST EVIDENCE This agreement may be executed in any number of counterparts, each of which so executed shall be deemed an original and constitute one and the same agreement. PDF, Facsimile, and/or electronic communication (email) copies with signatures shall be given the same legal effect as an original. The parties further agree for purposes of Washington State Evidence rules, ER 901, ER 1001(c), ER 1002, ER 1003, and ER 1004, that a signed copy of this agreement delivered by facsimile, e-mail or other means of electronic communication shall be deemed to have the same legal force and effect as delivery of an original copy signature of this agreement. COP BA Page 20 of 20 ALTCCOG 2020-46 Appendix 1 Data Security Requirements City of Pasco 1. Definitions. The words and phrases listed below, as used in this Appendix, shall each have the following definitions: a. "AES" means the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology. (http:/jnvlpubs.nist.aov/nistpubs/FIPS/NIST.FIPS.197.p_df b. "Authorized Users(s)" means an individual or individuals with a business need to access DSHS/SE WA ALTC COG Confidential Information, and who has or have been authorized to do so. c. "Business Associate Agreement" means an agreement between SE WA ALTC COG and a contractor who is receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability and Accountability Act of 1996. The agreement establishes permitted and required uses and disclosures of protected health information (PHI) in accordance with HIPAA requirements and provides obligations for business associates to safeguard the information. d. "Category 4 Data" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. Data classified as Category 4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §1232g; 34 CFR Part 99,- Internal 9;Internal Revenue Service Publication 1075 (https://www.irs.gov/pub/irs-pdf/pl075.pdf); Substance Abuse and Mental Health Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20. e. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iTunes, Dropbox, Box.com, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace. f. "CLC" means Community Living Connections, Washington State's name for its No -Wrong - Door access network of Area Agencies on Aging and their state, regional and local partners. g. "CLC-GetCare" means a version of RTZ's GetCare product modified to support Washington State's Community Living Connections. It is used for managing programs funded bythe Older Americans Act, CMS, state general fund, local resources, and federal grants, including Medicaid Alternative Care (MAC) and Tailored Supports for Older Adults (TSOA). It supports reporting for the National Aging Program Information System and Medicare Improvements for Providers Act. It also supports the CLC public website with a consumer portal and a resource directory. COP DS Page 1 of 11 ALTCCOG 2020-46 h. "Encrypt" means to encode Confidential Information into a format that can only be read by those possessing a "key"; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. i. "Fed RAMP" means the Federal Risk and Authorization Management Program (see www.fedramp.gov), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services. j. "GetCare" is a secure cloud -based platform for client and program management. It is a product of RTZ Systems. k. "Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. I. "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. m. "Multi -factor Authentication" means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PIN" means a personal identification number, a series of numbers which act as a password for a device. Since PINs are typically only four to six characters, PINs are usually used in conjunction with another factor of authentication, such as a fingerprint. n. "Portable Device" means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device. o. "Portable Media" means any machine readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device. p. "Secure Area" means an area to which only authorized representatives of the entity possessing the Confidential Information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access to the Confidential Information is not available to unauthorized personnel. q. In otherwise Secure Areas, such as an office with restricted access, the Data must be secured in such a way as to prevent access by non -authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non -authorized staff cannot access it. COP DS Page 2 of 11 ALTCCOG 2020-46 r. "Trusted Network" means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DSHS Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data. s. "Unique User ID" means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. 2. Systems Access and Method of Access. The Contractor may request permission to access the following: a. Provider One payment system, or successor payment system, for payment data; and b. The Community Living Connections (CLC)/GetCare System in order to manage, record, and report service provision and utilization, demographic, resource directory, and consumer website information. 3. Access and Disclosure Information. The Contractor shall not disclose the contents of any client records, files, papers and communications except as necessary for the administration of programs to provide services to clients as required by law. a. The Contractor shall limit access to client data to staff whose duties specifically require access to such data in the performance of their assigned duties. Contractor staff shall not access any individual client data for personal purposes. Clients shall only be permitted to access their own data b. The Contractor shall ensure each employee with access to data systems signs the Contractor Agreementon Nondisclosure of Confidentiallnformationform, provided by SE WA ALTC COG, to acknowledge the data access requirements prior to SE WA ALTC COG granting access. Access will be given only to data necessary to the performance of this Agreement. The Contractor shall retain the original Nondisclosure form on file. The Contractor shall have the form available for SE WA ALTC COG review upon request. The Contactor must provide an annual written reminder of the Nondisclosure requirements to all employees with access to data to remind them of the limitations, use or publishing of data. The Contractor shall retain documentation of such reminder on file for monitoring purposes. c. The Contractor shall not use or disclose any information concerning any client for any purpose not directly connected with the administration of the Contractor's responsibilities under this Agreement except by prior written consent of the client, his/her attorney, parent or guardian. d. SE WA ALTC COG and the Contractor may disclose information to each other or to DSHS for purposes directly connected with the administration of DSHS/SE WA ALTC COG programs. This includes, but is not limited to, determining eligibility, providing services, and participation in an audit. e. The Contractor shall disclose information for research, statistical, monitoring and evaluation purposes conducted by appropriate federal agencies, DSHS and SE WA ALTC COG. SE WA ALTC COG must authorize in writing the disclosure of this information to any other party not identified in this section. f. The Contractor shall not link the data with personal data or individually identifiable data from any other source nor re -disclose the data unless specifically authorized in this Agreement or by the prior written consent of SE WA ALTC COG. COP DS Page 3 of 11 ALTCCOG 2020-46 g. The Contractor shall notify SE WA ALTC COG within five business days when a User leaves employment or otherwise no longer requires system access. Upon notification, the system Administrator will deactivate the User ID and terminate access to the applicable application(s). h. The Contractor shall ensure that only registered system Users access and use the systems in this Agreement, use only their own User ID and password to access the systems and do not allow employees who are not registered to borrow a User ID or password to access any systems. i. Access to systems may be continuously tracked and monitored. SE WA ALTC COG and DSHS reserve the right at any time to conduct audits of systems access and use, and to investigate possible violations of this Agreement and/or violations of federal and state laws and regulations governing access to protected health information. 4. Dissemination to Staff. Prior to making information available to new staff and annually thereafter, the Contractor shall ensure that staff accessing the Personal Information or PHI under this Agreement are trained in HIPAA use and disclosure of PHI requirements and understand: a. Confidentiality of Client Data (1) Client data is confidential and is protected by various state and federal laws. The basis for this protection is the individual's right to privacy as outlined in the HIPAA Privacy Rule- 45 CFR 160 to 45 CFR 164. (2) Personal Information means demographic and financial information about a particular individual that is obtained through one or more sources (such as name, address, SSN, and phone numbers). RCW 42.56.210 lists the information that is exempted from public inspection and copying. b. Use of Client Data (1) Client data may be used only for purposes of these contracted services, directly related to providing services to the client or for the operation of aging and long-term care programs. (2) Any personal use of client information is strictly prohibited. (3) Access to data must be limited to those staff whose duties specifically require access to such data in the performance of their assigned duties. c. Disclosure of Information (1) Client information may be provided to the client, client's authorized guardian, or a client - authorized 3rd party per WAC 388-01. (2) Client information may be disclosed to other individuals or agencies only for purposes of administering DSHS/SE WA ALTC COG programs. (3) Questions related to disclosure are to be directed to the SE WA ALTC COG Contracts Manager. (4) Any disclosure of information contrary to this section is unauthorized and is subject to penalties identified in law 5. Security of Data. a. The Contractor shall take reasonable precautions to secure against unauthorized physical and electronic access to data, which shall be protected in a manner that prevents unauthorized persons, including the general public, from retrieving data by means of computer, remote terminal, or other means. COP DS Page 4 of 11 ALTCCOG 2020-46 The Contractor shall take due care to ensure the Contractor and its subcontractors protect said data from unauthorized physical and electronic access. The Contractor is authorized to store data on portable devices and media. The data will be stored on computers with security systems that require individual user IDs and hardened passwords. Only persons who have signed the Contractor Agreement on Nondisclosure of Confidential Information form will be able to access the data that Washington State shares with SE WA ALTC COG and the Contractor under this Agreement. b. The Contractor shall ensure disks and/or documents generated in printed form from the electronic file are properly returned, destroyed or shredded when no longer needed so unauthorized individuals cannot access client information. Data destroyed shall include all copies of any data sets in possession after the data has been used for the purpose specified herein or within 30 days of the date of termination, and certify such destruction to SE WA ALTC COG. SE WA ALTC COG shall be responsible for destroying the returned documents to ensure confidentiality is maintained. The Data provided by DSHS/SE WA ALTC COG will remain the property of DSHS/SE WA ALTC COG and will be promptly destroyed when the Contractor and its subcontractors have completed the work for which the information was required, as fully described herein. c. The Contractor shall protect information according to state and federal laws including the following incorporated by reference: (1) Privacy Act 1974 5 USC subsection 552a, - (2) 52a; (2) Chapter 40.14 RCW Preservation and Destruction of Public Records; (3) Chapter 74.04 RCW General Provisions — Administration; (4) Chapter 42.56.210 RCW Certain Personal & Other Records Exempt; (5) 45 CFR 205.50 provides for safeguarding information for the financial assistance programs and identifies limitations to disclosure of said information; and (6) Public Law 99-508 (18 USC section 2510et. Seq. Electronic Communications Privacy Act of 1986) Part A of Title IV of the Social Security Act authorizes disclosure of client information and provides for safeguards, which restrict the use or disclosure of information concerning applicants or recipients to purposes directly connected with administration of the program. 6. Administrative Controls. The Contractor must have the following controls in place: a. A documented security policy governing the secure use of its computer network and systems, and which defines sanctions that may be applied to Contractor staff for violating that policy. b. If the Data shared under this agreement is classified as Category 4, the Contractor must be aware of and compliant with the applicable legal or regulatory requirements for that Category 4 Data. c. If Confidential Information shared under this agreement is classified as Category 4, the Contractor must have a documented risk assessment for the system(s) housing the Category 4 Data. 7. Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to authorized staff, the Contractor must: a. Have documented policies and procedures governing access to systems with the shared Data. b. Restrict access through administrative, physical, and technical controls to authorized staff. c. Ensure that user accounts are unique and that any given user account logon ID and password combination is known only to the one employee to whom that account is assigned. COP DS Page 5 of 11 ALTCCOG 2020-46 d. For purposes of non -repudiation, it must always be possible to determine which employee performed a given action on a system housing the Data based solely on the logon ID used to perform the action. e. Ensure that only authorized users are capable of accessing the Data. f. Ensure that an employee's access to the Data is removed immediately: (1) Upon suspected compromise of the user credentials. (2) When their employment, or the contract under which the Data is made available to them, is terminated. (3) When they no longer need access to the Data to fulfill the requirements of thecontract. g. Have a process to periodically review and verify that only authorized users have access to systems containing DSHS/SE WA ALTC COG Confidential Information. h. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Contractor's network, including: (1) A minimum length of 8 characters, and containing at least three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. (2) That a password does not contain a user's name, logon ID, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words. (4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. i. When accessing Confidential Information from an external location (the Data will traverse the Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: (1) Ensuring mitigations applied to the system don't allow end-user modification. (2) Not allowing the use of dial-up connections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network. (5) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than 30 minutes of inactivity. (6) Ensuring use of Multi -factor Authentication to connect from the external end point to the internal end point. Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: (1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor COP DS Page 6 of 11 ALTCCOG 2020-46 (2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable) (3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable) k. If the contract specifically allows for the storage of Confidential Information on a Mobile Device, passcodes used on the device must: (1) Be a minimum of six alphanumeric characters. (2) Contain at least three unique character classes (upper case, lower case, letter,number). (3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. I. Render the device unusable after a maximum of 10 failed logon attempts. 8. Protection of Data. The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For DSHS/SE WA ALTC COG Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section 7 Data Disposition, may be deferred until the disks are retired, replaced, or otherwise taken out of the Secure Area. c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by SEWAALTC COG on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be Stored in a Secure Area. Workstations which access DSHS/SE WA ALTC COG Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by SE WA ALTC COG on optical discs which will be attached to network servers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. COP DS Page 7 of 11 ALTCCOG 2020-46 Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e. Paper documents. Any paper records must be protected by storing the records in a Secure Area which is only accessible to authorized personnel. When not in use, such records must be stored in a Secure Area. f. Remote Access. Access to and use of the Data over the State Governmental Network (SGN) or Secure Access Washington (SAW) will be controlled by DSHS staff who will issue authentication credentials (e.g. a Unique User ID and Hardened Password) to Authorized Users on Contractor's staff. Contractor will notify the SE WA ALTC COG Contracts Manager immediately whenever an Authorized User in possession of such credentials is terminated or otherwise leaves the employ of the Contractor, and whenever an Authorized User's duties change such that the Authorized User no longer requires access to perform work for this Contract. Data storage on portable devices or media. (1) Except where otherwise specified herein, DSHS/SE WA ALTC COG Data shall not be stored by the Contractor on portable devices or media unless specifically authorized within the terms and conditions of the Contract. If so authorized, the Data shall be given the following protections: (a) Encrypt the Data. (b) Control access to devices with a Unique User ID and Hardened Password or stronger authentication method such as a physical token orbiometrics. (c) Manually lock devices whenever they are left unattended and set devices to lock automatically after a period of inactivity, if this feature is available. Maximum period of inactivity is 20 minutes. (d) Apply administrative and physical security controls to Portable Devices and Portable Media by: i. Keeping them in a Secure Area when not in use, ii. Using check-in/check-out procedures when they are shared, and iii. Taking frequent inventories. (2) When being transported outside of a Secure Area, Portable Devices and Portable Media with DSHS Confidential Information must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. g. Data stored for backup purposes. (1) DSHS/SE WA ALTC COG Confidential Information may be stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. Such storage is authorized until such time as that media would be reused during the course of normal backup operations. If backup media is retired while DSHS/SE WA ALTC COG Confidential Information still exists upon it, such media will be destroyed at that time in accordance with the disposition requirements below in Section 7 Data Disposition. (2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. COP DS Page 8 of 11 ALTCCOG 2020-46 If so, such media will be protected as otherwise described in this exhibit. If this media is retired while DSHS/SE WA ALTC COG Confidential Information still exists upon it, the data will be destroyed at that time in accordance with the disposition requirements below in Section 7 Data Disposition. h. Cloud storage. DSHS/SE WA ALTC COG Confidential Information requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither SE WA ALTC COG nor the Contractor has control of the environment in which the Data is stored. For this reason: (1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed. (b) The Data will be Encrypted while within the Contractor network. (c) The Data will remain Encrypted during transmission to the Cloud. (d) The Data will remain Encrypted at all times while residing within the Cloud storage solution. (e) The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DSHS/SE WA ALTC COG. (f) The Data will not be downloaded to non -authorized systems, meaning systems that are not on either the DSHS or Contractor networks. (g) The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within either the DSHS or Contractor's network. (2) Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub -Contractor, and agrees in writing to all of the requirements within this exhibit; or, (b) The Cloud storage solution used is Fed RAMP certified. (3) If the Data includes Protected Health Information covered by the Health Insurance Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. 9. System Protection. To prevent compromise of systems which contain DSHS/SE WA ALTC COG Data orthrough which that Data passes: a. Systems containing DSHS Data must have all security patches or hotfixes applied within three months of being made available. b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes. c. Systems containing DSHS/SE WA ALTC COG Data shall have an Anti-Malware application, if available, installed. d. Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware database the system uses, will be no more than one update behind current. 10. Data Segregation. COP D5 Page 9 of 11 ALTCCOG 2020-46 a. DSHS/SE WA ALTC COG Data must be segregated or otherwise distinguishable from non- DSHS/SE WA ALTC COG data. This is to ensure that when no longer needed by the Contractor, all DSHS/SE WA ALTC COG Data can be identified for return or destruction. It also aids in determining whether DSHS/SE WA ALTC COG Data has or may have been compromised in the event of a security breach. As such, one or more of the following methods will be used for data segregation. (1) DSHS/SE WA ALTC COG Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non-DSHS/SE WA ALTC COG Data; and/or (2) DSHS/SE WA ALTC COG Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to DSHS/SE WA ALTC COG Data; and/or (3) DSHS/SE WA ALTC COG Data will be stored in a database which will contain no non- DSHS/SE WA ALTC COG data; and/or (4) DSHS/SE WA ALTC COG Data will be stored within a database and will be distinguishable from non- DSHS/SE WA ALTC COG data by the value of a specific field or fields within database records. (5) When stored as physical paper documents, DSHS/SE WA ALTC COG Data will be physically segregated from non-DSHS/SE WA ALTC COG data in a drawer, folder, or other container. b. When it is not feasible or practical to segregate DSHS/SE WA ALTC COG Data from non- DSHS/SE WA ALTC - COG data, then both the DSHS/SE WA ALTC COG Data and the non- DSHS/SE WA ALTC COG data with which it is commingled must be protected as described in this Exhibit. COP DS Page 10 of 11 ALTCCOG 2020-46 11. Data Disposition. When the contracted work has been completed or when the Data is no longer needed, except as noted above in Section 4.b, Data shall be returned to SE WA ALTC COG or destroyed. Media on which Data may be stored and associated acceptable methods of destruction are as follows: Data Stored On: Will Be Destroyed By: Server or workstation hard disks, or Using a "wipe" utility which will overwrite the Removable media (e.g. floppies, USB flash Data at least three (3) times using either drives, portable hard disks) excluding optical random or single character data, or discs Degaussing sufficiently to ensure that the Data cannot be reconstructed, or Physically destroying the disk. Paper documents with sensitive or Recycling through a contracted firm, provided Confidential Information the contract with the recycler assures that the confidentiality of Data will be protected. Paper documents containing Confidential On-site shredding, pulping, or incineration Information requiring special handling (e.g. protected health information) Optical discs (e.g. CDs or DVDs) Incineration, shredding, or completely defacing the readable surface with a coarse abrasive Magnetic tape Degaussing, incinerating or crosscut shredding — 12. Notification of Compromise or Potential Compromise. The compromise or potential compromise of DSHS/SE WA ALTC COG shared Data must be reported to the SE WA ALTC COG Contact Person designated in the Agreement within one (1) business day of discovery. Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DSHS/SE WA ALTC COG. 13. Data sharedwith Subcontractors. If DSHS/SE WA ALTC COG Data provided under this Agreement is to be shared with a subcontractor, the Agreement with the subcontractor must include all of the data security provisions within this Agreement and within any amendments, attachments, or exhibits within this Agreement. If the Contractor cannot protect the Data as articulated within this Agreement, then the contract with the Subcontractor must be submitted to the SE WA ALTC COG Contact Person specified for this Agreement for review and approval. COP DS Page 11 of 11 Aging&� Long_Term ALTCcare Southeast Washington ALTO Council of Governments December 16, 2019 RE.- Performance Agreement Noz 2020 COP (FOOTCARE), -At TC Contract No.: AL TCCO6 2019-74 Dear SE WA Aging and Long Term Care (SE WA ALTC COG) Contractor: Enclosed for your file is a fully executed original of the above mentioned Performance Agreement recently signed and approved by the Governing Board and/or Director of SE WA Aging and Long Term Care Council of Governments. Thank You! Sincerely, Kathleen Coffey, Clerk of the Board SE WA ALTC COG www.altcwashington.com Enclosure