HomeMy WebLinkAboutALTC Foot Care Agreement 2021ALTCCOG 2021-27
PERFORMANCE AGREEMENT NO, 2021 COP (FOOTCARE)
ADMINISTRATION OF AGREEMENT
THIS AGREEMENT is entered into by and between Southeast Washington Aging and Long Term Care
Council of Governments hereinafter denominated "SE WA ALTC COG", whose address is P.O. Box 8349, Yakima,
Washington 98908, and City of Pasco, whose address is P.O. Box 293, Pasco, Washington, 99301, hereinafter
denominated the "Contractor", whose duly authorized representatives are named in documents on file at the
Southeast Washington Aging and Long Term Care Council of Governments Administrative office.
The parties agree that this contract agreement becomes effective at the time of execution by the Southeast
Washington Aging and Long Term Care Council of Governments Director and/or Governing Board,
THE PURPOSE of this Agreement is to provide for the delivery of Footcare services in accordance with the terms
and conditions set forth in the provisions as listed below.
The Parties also agree to the terms contained in the Basic Agreement, identified herein as Attachment A. The
purpose of this document is to establish a Basic Agreement containing General Terms that shall be incorporated
by reference into any Contract executed between SE WA ALTC COG and the Contractor -
Location _ Funding Allocation
Pasco $18,492
Burbank $2,052
Total $20,5"
Period of A roeenuene —�_ _Janus 1y , 2021 to December 31w 2021
J AUi',7` ORIZED CONTRA CM SICYA i E
N. ch Ratkai, ector, City of Pasco Lori J. Brown, 10rector
Administrative and Community Services SE Washington Aging and Long Term Care
Council of Governments
Date: - _ ! 17 -4D z O
Approved As To Legal Form:
Ltlii6lel Clark, WS A #35901
Yakima County Senior Deputy Prosecuting Attorney
and Civil Legal Counsel for SE WA ALTC COG
Date: l
ALTCCOG 2021-27
57ANDARD TERMS AND PAYMENT PROVISIONS
FOOTCARE
SPECIFIC PROVISIONS
APPLICABLE LAWS AND REGLILATM
The Contractor agrees that services contemplated or delivered within the terms of this Agreement and
funds administered in the delivery of the specified services shall be provided in accordance with all
applicable Federal, State, and local laws and regulations, in particular the following:
A. CFR Title 45, Subtitle A, Part 74, (Administration of Grants)
B. CFR Title 45, Chapter XIII, Subchapter C, Part 1321 (Older Americans Act)
C. WAC 388-106-1100 through 1120 (Senior Citizens Services Act)
D. Older American Act (PL 109-365)
E. WAC 246-840-700, 710; RCW 18.79 (Standards of Nursing Conduct)
PROJECT QEFINITION
Geriatric Preventive Foot Care services are intended to provide early detection of existing and potential
foot problems and provide maintenance of feet and nails. Services include foot inspection and
palpation, nail trimming, treatment of calluses and dry skin, instructions in foot care and health
maintenance. Services are provided in a community setting. Foot Care service in the home is not allowed.
Referrals for follow-up treatment are made to local physicians and podiatrists as necessary
Ili PARTICIPANTS
The Contractor agrees that:
A. Target population for geriatric preventative foot care services are the individuals age 60 and
over who:
1. Need one or more of the program services to avoid additional health problems or assist
with activities of daily living, thereby reducing the need for other services; AND
2. Are not eligible for or have exhausted other sources of payment for similar services
(Medicare, Medicaid, insurance) or similar services are not available.
As stated in the Geriatric Preventative Foot Care Program Standards, a copy of which has
been provided to the Contractor all persons served should be considered vulnerable
based on the criteria listed below.
B. There will be written assessment procedures utilized by the Contractor to determine if clients
meet the program target population criteria.
C. To the degree feasible, Contractor shall ensure that preference is given to those individuals aged
60 and over who meet the vulnerability criteria listed below with further preference given to low-
income, limited English proficiency and minority individuals and to those with the greatest
economic and social need.
A person is considered vulnerable if s/he:
ALTCCOG 2021-27
1. Is unable to perform one or more of the activities of daily living below without assistance
due to physical, cognitive, emotional, psychological or social impairment;
• Eating
• Toileting
• Personal hygiene & grooming
• Bathing
• Cooking
• Dressing or undressing
• Housework
• Walking
• Managing medical treatments (prescribed exercises, change of dressing,
injections, etc.)
■ Manage medications (what to take, when to take it, how to store it properly, etc.)
■ Telephoning
• Transfer (getting in and out of bed/wheelchair)
• Transportation
• Managing money (budgeting, check writing, etc.)
• Preparing Meals
2. Has behavioral or mental health problems that could result in premature
institutionalization, is unable to perform activities on daily activities listed above, or is
unable to provide for his/her own health and safety primarily due to cognitive, behavioral,
psychological, or emotional conditions which inhibit decisions making and threaten the
ability to remain independent.
3. Lacks an informal support system; The person has no family, friends, neighbors or others
who are willing and able to perform the services needed or whose informal support system
needs to be temporarily or permanently supplemented.
The Contractor must report on clients served in these categories.
D. The foot care RN shall complete annual continuing education in foot care or related subjects.
E. Clinics will be held monthly at each designated facility that will include, but not be limited to,
low-income housing facilities and senior centers.
F. Participants shall be referred to the Information and Assistance/Case Management Program as
needed.
G. Contractor shall establish a system through which clients of services under this approved
Agreement may present grievances as outlined in the Basic Agreement, Section XXIV.
H_ Services shall be provided throughout Franklin County and in the City of Burbank in Walla Walla
County.
IV SE11_.RVICE PE�� C_ I ATION_
The Contractor agrees that services provided within the terms of this Agreement shall meet the following
specifications:
A. Efforts will be made to assure access of service to the target population, to include at least the
following:
Accessible office or site location;
3
A13CCOG 2021-27
2. Home visits or home delivery of services (if applicable);
3. Multicultural, bilingual persons to assist multicultural, bilingual clients in receiving
services;
4. Publicity of program through public service announcements, brochures, etc.
S. Meeting with other service providers/agencies to explain services the Contractor
provides and how referral can be made;
6. Ability to serve individuals with disabilities.
B. Services shall be delivered in accordance with the Southeast Washington Aging & Long Term
Geriatric Preventative Foot Care Program Standards and information in the Request for Proposal.
The Contractor acknowledges receipt of a copy of said standards. Services provided shall comply
with said standards as presently constituted or subsequently modified.
V ANTICIPATED SERVICE LEVELS AND EXPENDITURE RAT
The Contractor agrees that
A. The levels of service to be provided shall be as described in the Payment Provisions: Section IV —
Units of Service of this Agreement_ Failure to meet the service levels as defined in the Payment
Provisions: Section IV— Units of Service may result in a renegotiation of the funding levels provided
under the terms of this Agreement.
B. SE WA ALTC COG may unilaterally reduce the Agreement budget within thirty (30) days of the
close of a quarter by the amount of the projected quarterly expenditures left unspent at the end
of that quarter. SE WA ALTC COG shall submit to the Contractor notification of intent to recapture
unspent funds and a modification to the budget reflecting the adjusted changes in the Agreement.
VI ADMINISTRATIVE AGREEMENT
A. ACCESS BY DSHS: The Contractor shall provide access at all reasonable times for DSHS to monitor
and/or evaluate the provision of services under this Agreement in recognition of the responsibility
of DSHS of the effective statewide operation of this program. Nothing herein contained shall be
interpreted to imply a privy to a contract between DSHS and the Contractor or to diminish in any
manner the responsibility and authority of the Contractor in administering this Agreement.
B. !kC( SS BY E5 WA ALTC COG: The Contractor shall provide access at all reasonable times for SE
WA ALTC COG to monitor and/or evaluate the provisions of services under this Agreement. SE
WA ALTC COG may, with prior permission from the participant and knowledge of the Contractor,
interview a certain percentage of participants to ascertain their experience with the program.
C. RECORDS AND REPORTS: The Contractor agrees to:
Maintain program records and reports, including statistical information, and to make
such records available for inspection by SE WA ALTC COG in order for SE WA ALTC COG
to be assured that contracted activities remain consistent with the terms of this
Agreement and the currently approved SE WA ALTC COG Area Plan which shall be kept
on file at the SE WA ALTC COG Administrative office. The Contractor further agrees to
provide such information as requested by SE WA ALTC COG within the time limitations
established by SE WA ALTC COG;
AUCCOG 2021-27
2. Submit an agreed upon monthly service unit report (sign in sheets) by the tenth day of
each month. Contract payment requests will not be processed until service unit
reporting is complete. Contractor shall attach the report to the invoice submission to
verify service recording is complete.
a. The following information shall be collected. In the event that information
cannot be obtained, Contractor shall notify SE WA ALTC COG.
i. Full name including first, middle initial and last
ii. Street and mailing address (if different)
iii. Home telephone number including the area code
iv. Units of Service for Current Month
v. Gender
vi. Date of Birth
vii. Urban/rural
viii. Race and Ethnicity
ix. Primary language spoken
x. Household composition (lives alone)
A. Yes or No — is household income at or below 100% Federal Poverty Level
3. Submit the Quarterly financial report upon request to SE WA ALTC COG;
4. Complete and submit such additional reports as are required by SE WA ALTC COG within
the specified time frames, providing the Contractor is given a written request for the
reports thirty (30) days prior to the due date.
D. CONTRACTORS MEETING: The Contractor agrees to have a representative attend the SE WA
ALTC COG Annual Contractor's meeting and Long Term Care Planning Committee meetings,
E. PROGRAM PUBLICA IO : The Contractor agrees that:
1. The program shall be publicized on a regular basis, with all publicity and printed material
identifying the SE WA ALTC COG as a funding agency;
2. All material distributed with regards to publicizing the program contain a statement
assuring non-discrimination. Following is the wording suggested:
The City of Pasco does not discriminate in providing services on the grounds of race,
creed, color, religion, national origin, gender, age, marital status, or the presence of any
sensory, mental, or physical disability.
3. Materials publicizing the program must be printed in other appropriate languages in
counties that have a specific minority 60+ population of three (3%) percent or more of
the general 60+ population.
F_ ADDITIONAL REMUNERATION PROHIBITED: Neither the Contractor nor any of its officers,
employees, agents or representatives, shall solicit, impose any fees, or accept any remuneration
whatsoever from clients, friends, relatives, or representatives of any clients for services performed
for that client under this Agreement other than the client matching monies or donations (see
Section 1). In the event that this provision is violated, SE WA ALTC COG shall have the right to
assert a claim against the Contractor on its own behalf and/or on behalf of the client.
ALTCCOG 2021-27
G. PRIVATE PAY: The Contractor, who offers to the general public on a private pay basis a service
comparable to the service described in this Agreement, must assure that SE WA ALTC COG is not
charged more for the service than the private pay fee. The responsibility lies with the Contractor
to justify that a service provided at a different rate is not comparable to this service.
H MAINTENANCE OF F-UNDING soURCES: The Contractor agrees that:
1. SE WA ALTC COG funds are not used to replace funds from any other existing program
funding;
2. It will continue or initiate efforts to obtain support from private sources and other public
organizations for this service;
3. It will utilize new funding sources for this service if they become available through SE WA
ALTC COG and it will make any changes necessary to meet the requirements of the new
funding sources,
FEES AND DONATIONS: The Contractor agrees that:
1. It will assure that older persons have the opportunity to contribute to all or part of the
cost of the service, but service will not be denied if participant cannot or does not wish
to contribute;
2. It shall utilize client donations to meet project expenses before using State or Federal
funds;
3. It shall provide that the methods of receiving fees, donations and contributions from
individuals shall be handled in such a manner so as not to publicly differentiate among
individuals;
4. All project income derived from the provision of services described herein or
incorporated by reference herein or derived or generated through program fund-raising
activities or profits earned from fixed rate service shall stay with the project and shall be
used to provide increased levels or improved quality of service to the target population.
The state requires that rates charged to others cannot be less than the program charges
the state for the same services (usual and customary fee). The unit rate charged to SE WA
ALTC COG must equal or exceed the rate billed the state for the same service or the state
must be charged the lower rate.
J. MONITORINGIASSESSM_E_NLROCEQUKE_S: The Contractor agrees to:
1, Monitor both its fiscal and program status monthly and assess its performance on
program objectives and activities covered under this Agreement on an ongoing basis;
2. Monitor and assess on an ongoing basis the performance of any subcontracting
agencies, and insure that funds made available are expended only in accordance with
the specific provisions of this Agreement;
3. Recognize that SE WA ALTC COG will monitor and assess the activities and progress of
all programs covered under this Agreement on an ongoing basis. Said monitoring and
assessment will be accomplished through, but not limited to, review of program and
financial reports, on -site visits (service delivery and administrative sites), conference with
program administrators and staff, and visits by members of the SE WA ALTC COG staff
and SE WA ALTC COG Advisory Council.
ALTCCOG 2021-27
Monitoring may include assessing performance based on information submitted in
Request for Proposal (RFP). Prior notice of all such visits will be provided;
4. Authorize and/or participate in any program or fiscal evaluations or studies conducted
by SE WA ALTC COG or DSHS, Prior notice will be provided as well as final reports of
evaluations or studies;
5. Conduct a self -evaluation of the program annually. The self -evaluation shall include a
survey of at least 10% of clients utilizing the service. The Contractor shall take steps to
correct deficiencies found during the internal monitoring. Monitoring reports shall be
made available to SE WA ALTC COG upon request.
PA i'MENT PROVISIONS
CONSIDERATION
Payment shall be based on claims for reimbursement as reported on the SE WA ALTC COG invoice and
support documentation and shall be contingent upon the receipt of all required financial and program
reports by the respectively assigned due dates.
SE WA ALTC COG shall not be held responsible for any financial loss suffered by the Contractor as a
result of performance of services as outlined in this Agreement in the mutually agreed budget, service
delivery standards, units of service and payment standards.
II GENERAL PAYMENTS CONDITIONS
The Contractor agrees to the following standards in satisfactorily performing the terms and conditions
of this Agreement:
A. No payment shall be made for any contracted activity rendered by the Contractor which is not
identified within the terms and conditions of this Agreement and set forth within a category of
the budget.
B. Upon request, the Contractor shall submit to SE WA ALTC COG a written request for approval of
budget revision when:
1. The revision would change the scope or objectives of any contracted activity category;
2. Additional revenue is received for contracted activities within the terms of this
Agreement.
C. Payments shall be based on SE WA ALTC COG's receipt of all fiscal and programmatic reports
required by this Agreement to substantiate claims for reimbursement. SE WA ALTC COG
expressly reserves the right to withhold payment in whole or in part when:
1. The Contractor fails to submit all required documentation, or
2. In SE WA ALTC COG's judgment, additional information is required to substantiate the
basis upon which claims for reimbursement are made, provided the request for such
additional information is consistent with the requirements of this Agreement; or
3. Claims for reimbursement are inconsistent with the terms and conditions of this
Agreement.
7
ALTCCOG 2021-27
D. Program Income - Gross income received by the contractor and/or subcontractors
directly generated by state funds, federal funds or a federal grant supported activity or
earned as the result of the grant and/or federal contract.
1. Program income may include, but is not limited to, income from: fees for services performed,
proceeds from the sale, lease or rent of assets which were acquired using state funds, federal
funds, contributions/donations from clients, honorariums, consultant fees, training fees, and
the like, earned by staff when time spent earning such honorarium or fee was charged to
federal funds, and revenue generated from sale of fabricated items.
2. Use program income in accordance with the Department of Health and Human Services
Administration of Grants, 45 CFR, Part 74. Costs borne by the program income must be used
to satisfy cost sharing or matching requirements.
SE WA ALTC COG agrees to promptly notify the Contractor of any proposed reduction in funding by
State, Federal, or other officials. The Contractor agrees that upon receipt of such notice it shall take
appropriate and reasonable action to reduce its spending in the affected funding area so that
expenditures do not exceed the funding level which would result if said proposed reduction became
effective.
III BILLING PROCEDURES
A. The Contractor shall submit written claims for reimbursement of contracted activities provided
on the appropriate forms. All payments will be based on contracted activities provided unless
otherwise approved in writing by SE WA ALTC COG.
B. SE WA ALTC COG agrees to make payment for contracted activities provided as approved by
SE WA ALTC COG with warrants within thirty (30) working days. This is contingent upon the
availability of funds and receipt of the Contractor's claims for reimbursement by SE WA ALTC
COG by the tenth day of each month following the month during which the services were
provided.
No payment shall be made in the month services are rendered unless otherwise approved by
SE WA ALTC COG.
C. End of year invoices will be accepted until February loth following the contract period
unless otherwise noted in the contract. Any invoices received after February loth will not
be processed for payment.
IV. UNITS OF 5> RVICE
Definition: A unit of Geriatric Preventative Foot Care service shall consist of one (1) foot care treatment.
A. Minimum Anticipated Service Level by Contract:
County Units
Franklin County 612
Burbank, Walla Walla County 80
V. PAYMENT CONSIDERATIONS
As consideration for services, as described in the Specific Provisions of this Agreement, SE WA ALTC COG
agrees to pay the Contractor a sum not to exceed $18,492 from available funds. These funds shall be
used to provide Geriatric Preventative Foot Care services. Of this total sum $2,052 is for foot care services
AI.TCCOG 2021-27
in Burbank, Walla Walla County. Payment to the Contractor for this unit rate price Agreement shall be
based on the unit rate of $30.22 per unit of Foot Care services (less client donations).
ALTCCOG 2021-27
ATTACHMENT A
Basic Agreem—nt
THIS BASIC AGREEMENT is entered into by and between Southeast Washington Aging and Long
Term Care Council of Governments hereinafter called "Southeast Washington Aging and Long Term
Care, or SE WA ALTC COG" and CITY OF PASCO, hereinafter called "the Contractor".
PURPOSE
The purpose of this document is to establish a Basic Agreement containing General Terms that shall
be incorporated by reference into any Contract executed between Southeast Washington Aging and
Long Term Care and the Contractor.
AUTHORITY OF THE DIRECTOR OF SOUTHEAST WASHINGTON AGING AND LONG TERM CARE
Southeast Washington Aging & Long Term Care hereby appoints and the Contractor hereby accepts
the Director of Southeast Washington Aging and Long Term Care or a designee, as the Southeast
Washington Aging and Long Term Care's representative for the purpose of administering the provisions
of this Basic Agreement and subsequent Contracts, including Southeast Washington Aging and Long
Term Care's right to inspect facilities and records, to receive and act on reports and documents, to
request and receive additional information from the Contractor, to approve budget revisions and
payment changes, to approve fee schedules for services, to assess the general performance of the
Contractor, to determine if contracted services are being delivered in accordance with Federal, State,
and local laws and regulations, to approve subcontracts, and to suspend this Basic Agreement or any
Contract. All actions taken by the Director shall be subject to approval by the Southeast Washington
Aging and Long Term Care. Southeast Washington Aging and Long Term Care reserves the right to
terminate this Basic Agreement or any Contract and to commence civil action for its enforcement.
III EXTENT OF AGREEMENT
The Basic Agreement and Contract(s) contain all the terms agreed upon by the parties. No other
understandings, written or oral, regarding the subject matter of this Basic Agreement or any Contract
shall bind the parties.
IV COMPLIANCE WITH LAWS
The Contractor, in performance of this Basic Agreement and any Contract, shall comply with all
applicable Federal, State, and local laws and regulations including HIPAA.
V ORDER OF PRECEDENCE
Unless otherwise provided in a Contract, any inconsistency in the Basic Agreement or a Contract shall
be resolved by giving precedence in the following order.
A. Applicable Federal and State laws and Regulations;
B. The terms and conditions of a Contract;
C. The terms and conditions of the Basic Agreement;
D. Any other provisions incorporated in writing into the Basic Agreement or Contract.
E. The terms contained in the Statement of Work.
VI RELATIONSHIP OF THE PARTIES
The parties agree that the Contractor is an independent contractor and not an agent or employee of
Southeast Washington Aging and Long Term Care.
ALTCCOG 2021-27
Agents, employees, or representatives of the Contractor shall neither claim to be nor present themselves
as employees, agents, or representatives of Southeast Washington Aging and Long Term Care for any
purpose. Employees of the Contractor are not entitled to any benefits Southeast Washington Aging
and Long Term Care provides for its employees.
VII DEFINITIONS
Terms used throughout this Basic Agreement shall have meanings as defined in the Washington
Administrative Code (WAC). Additionally, the following words shall have the meanings as indicated:
Aging and Long Term Care — Southeast Washington Aging and Long Term Care.
Basic Agreement - This Agreement, which identifies the Contractor and the general terms that apply
when and if Southeast Washington Aging and Long Term Care and the Contractor execute a Contract.
The terms of the Basic Agreement are applicable to a Contract.
Business Associate - means the "Contractor" and generally has the same meaning as the term
"Business Associate" as defined in 45 CFR 160.103 which means a Business Associate who performs or
assists in the performance of an activity for or on behalf of the Covered Entity that involves the use or
disclosure of protected health information (PHI). Any reference to Business Associate Under this
Agreement includes Business Associate's employees, agents, officers, subcontractors, third party
contractors, volunteers, or directors.
Business Associate Agreement - means the HIPAA Compliance section of the Agreement and includes
the Business Associate provisions required by the U.S. Department of Health and Human Services, Office
for Civil Rights.
Breach - means the acquisition, access, use, or disclosure of Protected Health Information in a manner
not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected
Health Information, with the exclusions and exceptions listed in 45 CFR 164.402.
Client - An individual applying for or receiving goods, services or benefits under a Contract. The terms
Consumer, Customer, and Participant are synonymous.
Contract - A document consisting of terms specific to contracted services, including Specific Provisions,
Payment Provisions, and a Budget.
Contracted Services - Those services to be provided by the Contractor under the terms of a Contract,
Contractor - The individual or entity entering into this Basic Agreement with Southeast Washington
Aging and Long Term Care. If a Contract is subsequently executed, the Contractor will deliver contracted
services. Contractor includes authorized representatives and subcontractors retained to deliver
contracted services. The term Business Associate is synonymous.
Director - The Director of the Southeast Washington Aging and Long Term Care or designee.
HIPAA — Health Insurance Portability and Accountability Act of 1996, 45 CFR 160, 164, privacy and
security standards for Private Health Information.
PHI — Private Health Information means individually identifiable information relating to the past, present
or future physical or mental health or condition of an individual, provision of health care to an individual,
or the past, present or future payment for health care provided to an individual.
Subcontract - An agreement between the Contractor and a subcontractor, or between a subcontractor
and another subcontractor, for the delivery of contracted services.
The term subcontract does not include the purchase of supplies or support services that do not directly
affect the client's health or welfare. The term subcontract means subcontract in any tier
ALTCCOG 2021-27
Subcontractor - An individual or other entity delivering contracted services under a separate
agreement with the Contractor or another subcontractor. The individual or entity is bound by the same
HIPAA restrictions and conditions as SE WA ALTC COG and Contractor. The term "subcontractor" means
subcontractor in any tier.
VIII MAINTENANCE OF RECORDS & SAFEGUARDING OF INFORMATION
Maintenance of Records. During the term of the Agreement and for six (6) years following termination
or expiration of this Agreement, both parties shall maintain records sufficient to:
A. Document performance of all acts required by law, regulation, or this Agreement,
B. Demonstrate accounting procedures, practices and records that sufficiently and properly
document the Contractor's invoices to SE WA ALTC COG and all expenditures made by the
Contractor to perform as required by this Agreement.
C. For the same period, the Contractor shall maintain records sufficient to substantiate the
Contractor's statement of its organization's structure, tax status, capabilities and performance.
Public Information. All notices, informational brochures, press releases, research reports, and similar
public notices prepared and released by the Contractor for the services described in this Agreement
shall include a statement indicating the funding source as awarded under this Agreement with the SE
WA ALTC COG. Failure to comply with the requirements of this section may result in the termination
or suspension of this Agreement and/or non -reimbursement for the costs of said brochures, advertising
etc.
Information Requirements. The Contractor shall provide to SE WA ALTC COG the following
documents, as applicable
A. The Contractor's Liability Insurance;
B. Signature Authorization Forms;
C. Roster of Board of Directors, Board of Trustees, and/or Advisory Board members (if applicable).
D. Licenses and certifications;
E. Annual Operating Budget; (if applicable).
F. Staffing plan;
G. Personnel policies and procedures,-
H. Job description;
I. By-laws, (if applicable), and
J. Articles of incorporation (if applicable),
All documents listed above must be submitted annually and/or as changes occur throughout the term
of this Agreement, with any changes made from previous documents on file with SE WA ALTC COG
indicated with an asterisk, along with the date changes were formally adopted. All of the above
documents are subject to review and approval by SE WA ALTC COG. Should such changes affect the
scope of this Agreement, SE WA ALTC COG reserves the right to amend or terminate this Agreement.
Confidential/PHI Information. The use or disclosure by the Contractor of confidential information
and PHI concerning a client is prohibited without the written consent/authorization of the client, their
designee, or responsible parent or guardian if the client is incompetent or a minor, or as otherwise
provided by law, except:
A. The Director or the Contractor may disclose information to each other, the State of Washington,
or the Federal government for purposes directly connected with the administration of this Basic
Agreement or any Contract. Such information includes determining eligibility, delivering services,
ALTCCOG 2021-27
and participating in an audit.
B. The Director or the Contractor may disclose information to appropriate Federal agencies and the
State of Washington for research, monitoring, statistical, and evaluation purposes.
C. The Director and the Contractor may disclose PHI to each other for data aggregation services,
treatment, payment or health care operations.
D. The contractor agrees to develop and use appropriate procedural, physical, and electronic
safeguards to prevent misuse of PHI. The contractor must limit any use or disclosure to the
minimum amount necessary to accomplish the intended purpose.
IX TREATMENT OF ASSETS
Real and personal property shall not be purchased under this Basic Agreement or any Contract without
prior written approval from the Director. An inventory of such property shall be completed annually
and submitted to the Director
A. Definitions:
1. Nonexpendable Personal Property means tangible personal property having a useful life
of more than one year and an acquisition cost of $5,000.00 or more per unit, unless defined
otherwise by Contract.
2. Personal Property means property of any kind except real property.
3. Acquisition Cost means the amount expended for property, excluding interest and the
book value (acquisition cost less depreciation) of any trade-in.
4. Useful Life of property means that useful service life as based on the U. S. Department of
Treasury, Internal Revenue Service, policies on depreciation for tax purposes, unless the
Contractor can document to the written satisfaction of the Director some different period.
B. Title to all property furnished by Southeast Washington Aging and Long Term Care with County,
State, or Federal funds shall remain with Southeast Washington Aging and Long Term Care, the
State of Washington, or the Federal Government as their respective interests may appear.
C. Title to all nonexpendable personal property purchased by the Contractor, the cost of which the
Contractor is entitled to be reimbursed as a direct item of cost under a Contract, shall pass to and
vest in Southeast Washington Aging and Long Term Care or State of Washington, or Federal
Government as their respective interests may appear, upon delivery of such property.
D. Nonexpendable personal property purchased by the Contractor under the terms of any Contract
in which title is vested in Southeast Washington Aging and Long Term Care, State, or Federal
Government shall not be rented, loaned, or otherwise passed to any person, partnership,
corporation, association or organization without the prior written approval of the Southeast
Washington Aging and Long Term Care, State, or Federal Government.
E. Nonexpendable personal property furnished to or purchased by the Contractor, which is vested
in Southeast Washington Aging and Long Term Care, State, or Federal Government, shall be used
only for the delivery of contracted services.
F. As a condition precedent to reimbursement for the purchase of nonexpendable personal
property, title to which shall vest in Southeast Washington Aging and Long Term Care, State, or
Federal Government, the Contractor agrees to execute such security agreements and other
documents as shall be necessary for Southeast Washington Aging and Long Term Care, State, or
Federal Government to protect their respective interests in such property in accordance with the
Uniform Commercial Code -Secured Transactions as codified in Article 9, Title 62A, RCW.
ALTCCOG 2021-27
G. The Contractor shall be responsible:
1. For loss or damage to property of Southeast Washington Aging and Long Term Care, State,
or Federal Government that results from negligence, willful misconduct, or lack of good
faith on the part of the Contractor;
2. To maintain and administer property in accordance with sound management practices; and
3. To ensure that the property shall be returned to Southeast Washington Aging and Long
Term Care, State, or Federal Government in condition as good as when acquired,
reasonable wear and tear expected.
H. Upon the loss or destruction of or damage to Southeast Washington Aging and Long Term Care,
State, or Federal Government property, the Contractor shall notify the Director thereof and shall
take all reasonable steps to protect that property from further damage.
I. The Contractor shall surrender to the Director all property of Southeast Washington Aging and
Long Term Care, State, or Federal Government within 30 days after settlement upon rescission,
termination, or completion of this Basic Agreement or the Contract(s) for which the property was
purchased, unless otherwise mutually agreed between the Contractor and the Director.
J. The Director may, at his or her discretion, abandon in place property in which title is vested in
Southeast Washington Aging and Long Term Care, State, or Federal Government under the terms
of this Basic Agreement insofar as permitted by law, rule, or regulation, and thereupon all rights
and obligations of Southeast Washington Aging and Long Term Care, State, or Federal
Government regarding such abandoned property shall cease.
X LICENSING AND PROGRAM STANDARDS
The Contractor shall comply with all applicable Federal, State, and local laws and regulations for
licensing, certification and operation of facilities and programs, and accreditation and licensing of
individuals, and other standards or criteria as described in this Basic Agreement or any Contract to
assure quality of services.
XI STANDARDS FOR FISCAL ACCOUNTABILITY
A. The Contractor's fiscal management system shall:
1, Provide accurate, current, and complete disclosure of the financial status of each Contract;
2. Identify the source and application of all funds received for contracted services, distinguish
costs of contracted services delivered under the terms of the Contract from all other costs
and provide for accounting separation of all funds received; and
3. Report all revenue and expenditures to the Director in a manner consistent with generally
accepted accounting principles.
B. The Contractor agrees to maintain written accounting procedures.
C. The Contractor agrees to:
1. Maintain records and documents that accurately reflect all direct and indirect costs related
to the delivery of contracted services; and
2. Retain all fiscal and program records and other material relevant to a Contract according
to the federal or state program guidelines. Fiscal records must be retained until all audits
are resolved.
XII INSPECTION
A. The Contractor shall give access to its facilities and records to any authorized officer, employee
or agent of Southeast Washington Aging and Long Term Care, the State of Washington or the
ALTCCOG 2021-27
Federal Government at all reasonable times.
Authorized persons shall have the right to examine the Contractor's performance, financial
records, and HIPAA documentation and perform other activities to determine the Contractor's
compliance with the terms of this Basic Agreement, any Contract, and HIPAX
The Director shall give the Contractor reasonable notice of monitoring, auditing, observation and
other visits by its officers and employees to the Contractor's place of business.
B. The Director may require the Contractor to make reasonable changes in the contracted services
and HIPAA practices, as completed or to be completed, if the contracted services fail to conform
to the standards and specifications set forth in the Contract.
C. The Contractor shall notify the Director immediately of inspections, audits, accreditations, or
program reviews related to the delivery of contracted services. The Contractor agrees to provide
the Director copies of written reports of inspections, audits, accreditations or program reviews
within 72 hours.
XIII HOLD HARMLESS
A. Indemnification, Defense, and Hold Harmless: To the fullest extent permitted by law including
RCW 4.24.115, the Contractor shall indemnify, defend, and save harmless Southeast Washington
Aging and Long Term Care and its officers, employees, agents, and volunteers from all claims,
suits, or actions brought for injuries to, or death of, any persons, or damages arising from or
relating to the Contractors performance of this Agreement or in consequence of any negligence
or breach of contract related to the Contractor's performance of this Agreement caused in whole
or in part by any act or omission by the Contractor or the agents or employees of the Contractor
related to performance of this Agreement.
B. Contractor's Waiver of Employer's Immunity under Title 51 RCW: Contractor intends that its
obligations to indemnify, defend, and hold harmless set forth above in section 15 shall operate
with full effect regardless of any provision to the contrary in Title 51 RCW, Washington's Industrial
Insurance Act. Accordingly, the Contractor specifically assumes all potential liability for actions
brought by employees of the Contractor against Southeast Washington Aging and Long Term
Care and its officers, employees, agents, and volunteers, and, solely for the purpose of enforcing
the Contractor's obligations to indemnify, defend, and hold harmless set forth above in section
15, the Contractor specifically waives any immunity granted under the state industrial insurance
law, Title 51 RCW. The parties have mutually negotiated this waiver.
C. The Contractor shall similarly require that any subcontractor it retains in connection with its
performance of this Agreement shall comply with the terms of this paragraph, waive any
immunity granted under Title 51 RCW, and assume all liability for actions brought by employees
of the subcontractor
XIV AUDIT REQUIREMENTS
A. Definitions
Single Audit means an audit that will encompass the entirety of the financial operations of the
Contractor and shall determine and report whether:
1. The financial statements of the Contractor present fairly its financial position and the results
of its financial operations in accordance with generally accepted accounting principles, and
whether the Contractor has complied with laws and regulations that may have a material
effect upon the financial statements;
ALTCCOG 2021-27
2. The Contractor has internal control systems to provide reasonable assurance that it is
managing Federal financial assistance programs in compliance with applicable laws and
regulations; and
The Contractor has complied with laws and regulations that may have a material effect
upon each major Federal assistance program. In testing compliance for this section the
auditor must select and test a representative number of transactions from each major
Federal assistance program,
Program -Specific Audit means an audit of one Federal program in accordance with Federal
laws, regulations, or audit guides relative to that particular program. When a Contractor expends
Federal Financial Assistance under only one Federal program and the Federal program's laws,
regulations, or grant agreements do not require a financial statement audit of the Contractor, the
Contractor may elect to have a program -specific audit.
Subrecipient means any person or government department, agency, or establishment that
receives federal financial assistance to carry out or administer a program but not an individual
who is a beneficiary of such a program. Distinguishing characteristics of a subrecipient include
such items as responsibility to meet compliance requirements, performance measured against
meeting the objectives of a program, responsibility for programmatic decision making, and
determining eligibility for assistance.
Vendor means an entity responsible for providing goods or services that are required for the
conduct of a Federal program. Distinguishing characteristics of a vendor include such items as
providing the goods or services within normal business operations, operating for a profit,
providing similar goods or services to many different purchasers, operating in a competitive
environment, and not having responsibility for adherence to program compliance requirements.
Federal Financial Assistance means assistance provided by a Federal agency in the form of
grants, contracts, cooperative agreements, loans, loan guarantees, property, interest subsidies,
insurance, food commodities, direct appropriations, and other assistance.
It does not include direct Federal cash assistance to individuals. It includes awards received
directly from Federal agencies or indirectly through other units of state and local governments.
B. The Contractor, if a subrecipient of Federal Financial Assistance and expends (from all
sources) $750,000 or more a year in Federal Financial Assistance, shall purchase annually a
single or program -specific audit conducted for that year by a government auditor or public
accountant who meets the standards for independence specified in the Government Auditing
Standards. The Contractor agrees to:
1. Adhere to the Office of Management and Budget (OMB) Circular A-133 and other relevant
Federal and State Requirements;
2. Provide access to independent auditors to its financial records; and
3. Maintain accounting records that will enable identification of all federal funds received and
expended by the OMB Catalog of Federal Domestic Assistance number.
C. The Contractor, if a subrecipient of Federal Financial Assistance and expends (from all
sources) less than $750,000 per year in Federal awards is exempt from Federal audit
requirements for that year, but records must be available for review or audit by appropriate
officials of the Federal Agency, pass -through entity and the General Accounting Office (GAO).
ALTCCOG 2021-27
D. The Contractor, if a vendor, is exempt from Federal audit requirements but records must be
available for review by appropriate officials of the Federal agency, pass -through entity, and the
General Accounting Office. The Contractor agrees to:
1. Ensure that transactions are in compliance with laws, regulations, and the provisions of the
Contract or grant agreements;
2. Maintain accounting records that will enable identification of all federal funds received and
expended; and
3. Provide access to its financial records by appropriate officials of Southeast Washington
Aging and Long Term Care, State, Federal Government or their authorized representative
to determine program compliance.
The Contractor shall ensure that the audit report, with management letter, is submitted to the
Director within nine months after the end of the audit period but no later than 30-days after its
receipt.
XV INSURANCE AND BONDING
GENERAL LIABILITY INSURANCE
A. Southeast Washington Aging and Long Term Care certifies that it is insured as a member of
Enduris, and can pay for losses for which it is found liable.
B. Such insurance shall provide that Southeast Washington Aging and Long Term Care, its officers,
employees, agents and volunteers are Primary Additional Insured's under such insurance. The
coverage provided under such insurance for such Primary Additional Insured's shall be primary
and not contributory to any other coverage that may be available to such Primary Additional
Insured's. Prior to commencement of any work under this Agreement, the Contractor shall,
provide proof of such insurance including all Certificates of Insurance and endorsements
pertaining to such insurance, and if requested, any policy pertaining to insurance required under
this Agreement.
C. The Contractor agrees to maintain, without interruption during the term of a Contract, a Fidelity
Bond in a minimum amount of $50,000, unless specified otherwise in the contract, which covers
all individuals responsible for the administration of funds provided within the terms of a Contract.
Certification of bonding shall be submitted to the Director within thirty days after execution of a
Contract.
D. The Contractor shall notify the Director immediately if either insurance or bonding coverage is
terminated during the term of a Contract or is reduced below contractual requirements.
SOLE PROPRIETOR
In lieu of general liability insurance mentioned above, if the contractor is a sole proprietor,
the contractor may choose one (1) of the following three (3) general liability policies but only if
attached to a professional liability policy, and if selected the policy shall be maintained for the
life of the contract:
A. Supplemental Liability Insurance, including coverage for bodily injury and property damage
that will cover the contractor wherever the service is performed with the following
minimum limits: Each Occurrence - $1,000,000; General Aggregate - $1,000,000. Southeast
Washington Aging & Long Term Care — Council of Governments, its elected and appointed
officials, agents, and employees shall be named as additional insured's. OR
B. Workplace Liability Insurance, including coverage for bodily injury and property damage
that provides coverage wherever the service is performed with the following minimum
ALTCCOG 2021-27
limits: Each Occurrence - $1,000,000; General Aggregate - $1,000,000.
The State of Southeast Washington Aging & Long Term Care — Council of Governments, its
elected and appointed officials, agents, and employees of the state, shall be named as
additional insureds. OR
C. Premises Liability Insurance and provide services only at their recognized place of business,
including coverage for bodily injury, property damage with the following minimum limits:
Each Occurrence - $1,000,000; General Aggregate - $1,000,000. Southeast Washington
Aging & Long Term Care — Council of Governments, its elected and appointed officials,
agents, and employees of the state, shall be named as additional insured.
BUSINESS AUTOMOBILE LIABILITY INSURANCE
The Contractor shall maintain a Business Automobile Policy on all vehicles used to transport clients
or if the Contractor is receiving reimbursement for mileage by means of this contract, including
vehicles hired by the Contractor or owned by the Contractor's employees, volunteers or others, with
the following minimum limits: $1,000,000 per incident and a $2,000,000 aggregate minimum,
combined single limit. The Contractor's carrier shall provide Southeast Washington Aging & Long
Term Care — Council of Governments with a waiver of subrogation or name Southeast Washington
Aging & Long Term Care — Council of Governments as an additional insured.
WORKER'S COMPENSTATION
The Contractor shall comply with all applicable Worker's Compensation, occupational disease, and
occupational health and safety laws and regulations. The State of Washington and DSHS shall not be
held responsible for claims filed for Worker's Compensation under RCW 51 by the Contractor or its
employees under such laws and regulations.
PROFESSIONAL LIABILITY INSURANCE (PL)
The Contractor shall maintain Professional Liability Insurance or Errors & Omissions insurance,
including coverage for losses caused by errors and omissions, with the following minimum limits:
Each Occurrence - $1,000,000; Aggregate - $1,000,000.
XVI NONDISCRIMINATION
A. The Contractor shall develop or adopt a nondiscrimination plan consistent with the Washington
State Law Against Discrimination (RCW 49.60).
B. The Contractor agrees that it shall not discriminate against any person on the grounds of race,
creed, color, religion, national origin, sex, sexual orientation, age, marital status, political affiliation
or belief, or the presence of any sensory, mental or physical handicap in violation of the
Washington State Law Against Discrimination (RCW Chapter 49.60) or the Americans with
Disabilities Act (42 USC 12101 et seq). In the event the Contractor violates this provision, SE WA
ALTC COG may terminate this Agreement immediately and bar the Contractor from performing
any services for SE WA ALTC COG in the future, The Contractor shall not:
1. Deny an individual contracted services or benefits;
2. Provide contracted services or benefits to an individual that are different, or are provided
in a different manner, from those provided to others;
3. Subject an individual to segregation or separate treatment in any manner related to the
receipt of contracted services or benefits; or
4. Deny an individual an opportunity to participate in any program or afford an opportunity
ALTCCOG 2021-27
to do so that is different from that afforded others.
C. The Contractor shall not use criteria or methods of administration that have the effect of
subjecting individuals to discrimination because of race, creed, color, religion, national origin, sex,
sexual orientation, age, marital status, political affiliation or belief, or the presence of any sensory,
mental or physical handicap or have the effect of defeating or substantially impairing the delivery
of contracted services to the class of individuals mentioned above through the selection of:
1. The types of contracted services or other benefits to be provided;
2. The class of individuals to whom, or the situation in which, such contracted services or other
benefits shall be provided; or
3. The class of individuals to be afforded an opportunity to receive contracted services or
other benefits;
In accordance of the Washington State Law Against Discrimination (RCW Chapter 49.60) or
the Americans with Disabilities Act (42 USC 12101 et seq). In the event the Contractor
violates this provision, Southeast Washington Aging and Long Term Care may terminate
this Agreement immediately and bar the Contractor from performing any services for SE
WA ALTC COG in the future.
D. The Contractor shall comply with all Federal and State nondiscrimination rules, including:
1. The Americans with Disabilities Act (ADA) of 1990, which prohibits discrimination against
qualified individuals with disabilities and requires reasonable accommodations to the
known physical or mental limitations of an otherwise qualified individual.
2. Title VI of the Civil Rights Act of 1964 as amended.
3. Section 504 of the Rehabilitation Act 1973 as amended.
4. The Age Discrimination Act of 1975 as amended.
5. The Washington State Law Against Discrimination, RCW 49.60.
E. The Contractor shall have a written procedure for resolving complaints that allege a violation of
Federal laws against discrimination. A copy shall be made available to clients and applicants for
contracted services. Such procedures should include time frames for Contractor response or
action. Persons wishing to file a complaint shall be advised in writing of their right to file their
complaint within 180 days of the alleged act of discrimination directly with the Washington
State Human Rights Commission, the U.S. Equal Employment Opportunity Commission, the U.S.
Department of Health and Human Services Office for Civil Rights, or the U.S. Department of Labor
Office of Contract Compliance.
F. Equal Employment Opportunity: The Contract agrees that they will comply with all equal
employment opportunity requirements as applicable with State and Federal laws.
G. The Contractor shall require subcontractors to fully comply with the provisions of this section,
including sanctions for noncompliance.
XVII INCIDENT REPORTING
The Contractor agrees to report any extraordinary incident to the Director, in writing, within three
working days of the occurrence of an incident, A reportable incident is one that occurs or arises under
this Basic Agreement or any Contract, and that involves:
A. A death or injury, requiring inpatient hospital care, of a client or person under the care,
supervision, or control of the Contractor at the time of the incident;
B. An act of violence or serious crime in which the victim or the perpetrator is a client or person
ALTCCOG 2021-27
employed by or under the care, supervision, or control of the Contractor at the time of the
incident;
C. An incident of such public concern that the Director or the Southeast Washington Aging and
Long Term Care Council of Government Governing Board may have a need to know; or
D. A loss of funding so great as tojeopardize the Contractor's ability to fulfill the terms of this Basic
Agreement or any Contract.
E. Any unauthorized uses/disclosures of which it becomes aware, and shall take all reasonable steps
to mitigate the potentially harmful effects of such breach.
XIII ASSIGNMENT AND SUBCONTRACTING
The Contractor shall not assign or subcontract any portion of contracted services unless the written
subcontract has been reviewed and approved by the Director prior to the start of the subcontract. All
contracted services that are not delivered directly by the Contractor must be delivered according to the
terms of this Basic Agreement and the Contract.
XIX SEVERABILITY
If any provision of this Basic Agreement shall be held invalid, the invalidity shall not affect the other
provisions of the Agreement. To that end, the provisions of this Basic Agreement are severable.
XX MODIFICATION
No modification or waiver of any clause or condition of this Basic Agreement is binding upon either
party unless such modification or waiver is in writing and executed by both parties.
XXI SUSPENSION, TERMINATION AND CLOSEOUT
If the Contractor fails to comply with the terms of this Basic Agreement, any Contract or HIPAA, the
Director may pursue such remedies as are legally available including the suspension or termination of
this Basic Agreement or the Contract in whole or in part in the manner specified herein.
A. Suspension - If the Contractor fails to comply or is unable to substantiate full compliance with
the terms of this Basic Agreement or any Contract, the Director may suspend this Basic
Agreement or the Contract in whole or in part pending corrective action or investigation,
effective no less than seven days following written notification to the Contractor. The suspension
shall remain in force until the Contractor complies to the satisfaction of the Director and is able
to substantiate its full compliance with the terms of this Basic Agreement and the Contract. No
obligation incurred by the Contractor during the period of suspension shall be allowable under
this Basic Agreement except:
1. Reasonable, proper, and otherwise allowable costs that the Contractor could not avoid
during the period of suspension; and
2. Discretionary costs that the Contractor incurred during the period of suspension if the
Contractor is able to substantiate complete compliance with the terms of this Basic
Agreement and the Contract.
B. Termination for Cause - The Director may, by written notice, terminate this Basic Agreement
or any Contract in whole or in part for substantial breach by the Contractor of duties under this
Basic Agreement, any Contract or HIPAA. In such an event, the Contractor shall be liable for
reasonable damages, including the reasonable cost of procuring similar services actually
procured by the Director to fully execute the Contractor's duties under this Basic Agreement
and the Contract(s).
C. Termination for Other Grounds - This Basic Agreement or any Contract may be terminated
in whole or in part by:
ALTCCOG 2021-27
1. Either party, upon thirty days advance written request, in which case the two parties shall
devise by mutual agreement the conditions of termination including the effective date
and in case of termination in part, the portion to be terminated.
2. The Director, immediately upon written notice, if funding is withdrawn or reduced to the
extent that the continuation is not in the best interest of Southeast Washington Aging
and Long Term Care.
D. Termination Procedure. The following provisions apply in the event this Agreement is
terminated:
1. The Contractor shall cease to perform any services required by this Agreement as of the
effective date of termination, and shall comply with all reasonable instructions contained
in the notice of termination which are related to the transfer of clients, distribution of
properly, and termination of services.
2. The Contractor shall promptly deliver to SE WA ALTC COG, all SE WA ALTC COG assets
(personal property) in the Contractor's possession, including any material created under
this Agreement. Upon failure to return SE WA ALTC COG property within ten (10)
business days of the Agreement termination, the contractor shall be charged with all
reasonable costs of recovery, including transportation. The Contractor shall take all
commercially reasonable steps to protect and preserve any property of SE WA ALTC COG
that is in the possession of the Contractor pending return to SE WA ALTC COG.
3. SE WA ALTC COG shall be liable for and shall pay for only those services authorized and
provided through the effective date of termination. SE WA ALTC COG may pay an
amount mutually agreed by the parties for partially completed work and services, if work
products are useful to or useable by SE WA ALTC COG.
4. If SE WA ALTC COG terminates this Agreement for default, SE WA ALTC COG may
withhold a sum from the final payment to the Contractor that SE WA ALTC COG
determines necessary to protect/SE WA ALTC COG against loss or additional liability. SE
WA ALTC COG shall be entitled to all remedies available at law, in equity, or under this
Agreement.
If it is later determined the Contractor was not in default, or if the Contractor terminated
this Agreement for default, the Contractor shall be entitled to all remedies available at
law, in equity, or under this Agreement.
E. Closeout - Upon expiration or termination of a Contract, in whole or in part, the following
provisions shall apply:
Southeast Washington Aging and Long Term Care shall pay to the Contractor all
allowable reimbursable costs not covered by previous payment upon submittal of a final
invoice, subject only to the right reserved to the parties in the event of a dispute as
provided in subparagraph "Y below.
2. The Contractor shall pay to Southeast Washington Aging and Long Term Care moneys
received from Southeast Washington Aging and Long Term Care in excess of allowable
costs, subject only to the right reserved to the parties in the event of a dispute as
provided in subparagraph " Y below.
3. In the event the Director and the Contractor are unable to agree upon amounts due as
provided in subparagraphs 1" or "2" above, either party shall have the right to withhold
the disputed amount from final payment pending a final audit, and then pay such
amounts as the audit determines are payable.
ALTCCOG 2021-27
4. The Contractor shall submit all required financial and performance reports and claims for
payment within thirty days after the end of the contract unless a different period is set
by Southeast Washington Aging and Long Term Care.
5. At the option of the Director, the contractor shall return or destroy all PHI created or
received from or on behalf of Southeast Washington Aging and Long Term Care and
provide appropriate documentation evidencing procedure. The contractor agrees that it
will not retain any copies of PHI except as required by law. If return or destruction of all
PHI, and all copies of PHI, is not feasible, contractor agrees to extend the protections of
this Contract to such information for as long as it is maintained.
F. Notices shall be delivered by U.S. mail to the address stated in the first paragraph of this
Agreement or such other address provided by the Contractor in writing to the Director.
XXII INDIVIDUAL RIGHTS AND HIPAA
The contractor shall make all PHI and related information in its possession available:
A. To the individual or his/her personal representative or to Southeast Washington Aging and
Long Term Care, for inspection and copying.
B. To the individual or his/her personal representative or to SE WA ALTC COG to fulfill any
obligation to account for disclosures of PHI.
C. To Southeast Washington Aging and Long Term Care to fulfill any obligation to amend PHI and
related information and shall incorporate any amendments or related statements into the
information the contractor holds and notify any subcontractors or agents of amendments.
D. HIPAA Comuliangg, This section of the Agreement is considered the Business Associate
Agreement as required by HIPAA.
Compliance
Business Associate shall perform all Contract duties, activities and tasks in compliance
with HIPAA, the HIPAA Rules, and all attendant regulations as promulgated by the U.S.
Department of Health and Human Services, Office of Civil Rights.
2. Use and Disclosure of PHI
Business Associate is limited to the following permitted and required uses or disclosures
of PHI:
a) Duty to Protect PHI. Business Associate shall protect PHI from, and shall use
appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security
Standards for the Protection of Electronic Protected Health Information) with
respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than
as provided for in this Contract or as required by law, for as long as the PHI is within
its possession and control, even after the termination or expiration of this Contract.
b) Minimum Necessary Standard. Business Associate shall apply the HIPAA Minimum
Necessary standard to any Use or disclosure of PHI necessary to achieve the
purposes of this Contract. See 45 CFR 164.514 (d)(2) through (d)(5).
c) Disclosure as Part of the Provision of Services. Business Associate shall only Use or
disclose PHI as necessary to perform the services specified in this Contract or as
required by law, and shall not Use or disclose such PHI in any manner that would
violate Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health
ALTCCOG 2021-27
Information) if done by Covered Entity, except for the specific uses and disclosures
set forth below.
d) Use for Proper Management and Administration. Business Associate may Use PHI
for the proper management and administration of the Business Associate or to
carry out the legal responsibilities of the Business Associate.
e) Disclosure for Proper Management and Administration. Business Associate may
disclose PHI for the proper management and administration of Business Associate
or to carry out the legal responsibilities of the Business Associate, provided the
disclosures are required by law, or Business Associate obtains reasonable
assurances from the person to whom the information is disclosed that the
information will remain confidential and used or further disclosed only as required
by law or for the purposes for which it was disclosed to the person, and the person
notifies the Business Associate of any instances of which it is aware in which the
confidentiality of the information has been Breached.
f) Impermissible Use or Disclosure of PHI. Business Associate shall report to SE WA
ALTC COG in writing all uses or disclosures of PHI not provided for by this Contract
within one (1) business day of becoming aware of the unauthorized use or
disclosure of PHI, including Breaches of unsecured PHI as required at 45 CFR
164.410 (Notification by a Business Associate), as well as any Security Incident of
which it becomes aware. Upon request by SE WA ALTC COG, Business Associate
shall mitigate, to the extent practicable, any harmful effect resulting from the
impermissible Use or disclosure.
g) Failure to Cure. If SE WA ALTC COG learns of a pattern or practice of the Business
Associate that constitutes a violation of the Business Associate's obligations under
the terms of this Contract and reasonable steps by SE WA ALTC COG do not end
the violation, SE WA ALTC COG shall terminate this Contract, if feasible. In addition,
If Business Associate learns of a pattern or practice of its Subcontractors that
constitutes a violation of the Business Associate's obligations under the terms of
their contract and reasonable steps by the Business Associate do not end the
violation, Business Associate shall terminate the Subcontract, if feasible.
h) Termination for Cause. Business Associate authorizes immediate termination of this
Contract by SE WA ALTC COG, if SE WA ALTC COG determines that Business
Associate has violated a material term of this Business Associate Agreement.
SE WA ALTC COG may, at its sole option, offer Business Associate an opportunity
to cure a violation of this Business Associate Agreement before exercising a
termination for cause.
Consent to Audit. Business Associate shall give reasonable access to PHI, its internal
practices, records, books, documents, electronic data and/or all other business
information received from, or created or received by Business Associate on behalf
of SE WA ALTC COG, to SE WA ALTC COG for use in determining compliance with
HIPAA privacy requirements.
j) Obligations of Business Associate upon Expiration or Termination. Upon expiration
or termination of this Contract for any reason, with respect to PHI received from
SE WA ALTC COG, or created, maintained, or received by Business Associate, or any
Subcontractors, on behalf of SE WA ALTC COG, Business Associate shall:
ALTCCOG 2021-27
(i) Retain only that PHI which is necessary for Business Associate to continue its
proper management and administration or to carry out its legal
responsibilities;
(ii) Return to SE WA ALTC COG or destroy the remaining PHI that the Business
Associate or any Subcontractors still maintain in any form;
(iii) Continue to use appropriate safeguards and comply with Subpart C of 45
CFR Part 164 (Security Standards for the Protection of Electronic Protected
Health Information) with respect to Electronic Protected Health Information
to prevent use or disclosure of the PHI, other than as provided for in this
Section, for as long as Business Associate or any Subcontractors retain the
PHI;
(iv) Not Use or disclose the PHI retained by Business Associate or any
Subcontractors other than for the purposes for which such PHI was retained
and subject to the same conditions set out in the "Use and Disclosure of PHI"
section of this Contract which applied prior to termination; and
(v) Return to SE WA ALTC COG or destroy the PHI retained by Business
Associate, or any Subcontractors, when it is no longer needed by Business
Associate for its proper management and administration or to carry out its
legal responsibilities.
k) Survival. The obligations of the Business Associate under this section shall survive
the termination or expiration of this Contract.
3. Individual Rights
a) Accounting of Disclosures.
(i) Business Associate shall document all disclosures, except those disclosures
that are exempt under 45 CFR 164.528, of PHI and information related to
such disclosures.
(ii) Within ten (10) business days of a request from SE WA ALTC COG, Business
Associate shall make available to SE WA ALTC COG the information in
Business Associate's possession that is necessary for SE WA ALTC COG to
respond in a timely manner to a request for an accounting of disclosures of
PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and
164.528(b)(1).
(iii) At the request of SE WA ALTC COG or in response to a request made directly
to the Business Associate by an Individual, Business Associate shall respond,
in a timely manner and in accordance with HIPAA and the HIPAA Rules, to
requests by Individuals for an accounting of disclosures of PHI.
(iv) Business Associate record keeping procedures shall be sufficient to respond
to a request for an accounting under this section for the six (6) years prior to
the date on which the accounting was requested.
b) Access
(i) Business Associate shall make available PHI that it holds that is part of a
Designated Record Set when requested by SE WA ALTC COG or the
Individual as necessary to satisfy SE WA ALTC COG's obligations under 45
CFR 164.524 (Access of Individuals to Protected Health Information).
ALTCCOG 2021-27
(ii) When the request is made by the Individual to the Business Associate or if
SE WA ALTC COG asks the Business Associate to respond to a request, the
Business Associate shall comply with requirements in 45 CFR 164.524 (Access
of Individuals to Protected Health Information) on form, time and manner of
access. When the request is made by SE WA ALTC COG, the Business
Associate shall provide the records to DSHS within ten (10) business days.
c) Amendment.
(i) If SE WA ALTC COG amends, in whole or in part, a record or PHI contained
in an Individual's Designated Record Set and SE WA ALTC COG has
previously provided the PHI or record that is the subject of the amendment
to Business Associate, then SE WA ALTC COG will inform Business Associate
of the amendment pursuant to 45 CFR 164.526(c)(3) (Amendment of
Protected Health Information).
(ii) Business Associate shall make any amendments to PHI in a Designated
Record Set as directed by SE WA ALTC COG or as necessary to satisfy SE WA
ALTC COG's obligations under 45 CFR 164.526 (Amendment of Protected
Health Information).
4. Subcontracts and Other Third Party Agreements
In accordance with 45 CFR 164.502(e)(1)(ii), 164.504(e)(1)(i), and 164.308(b)(2), Business
Associate shall ensure that any agents, Subcontractors, independent contractors or other
third parties that create, receive, maintain, or transmit PHI on Business Associate's behalf,
enter into a written contract that contains the same terms, restrictions, requirements, and
conditions as the HIPAA compliance provisions in this Contract with respect to such PHI.
The same provisions must also be included in any contracts by a Business Associate's
Subcontractor with its own business associates as required by 45 CFR 164.314(a)(2)(b)
and 164.504(e)(5) .
5. Obligations
To the extent the Business Associate is to carry out one or more of SE WA ALTC COG's
obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable
Health Information), Business Associate shall comply with all requirements that would
apply to SE WA ALTC COG in the performance of such obligation(s).
6. Liability
Within ten (10) business days, Business Associate must notify SE WA ALTC COG of any
complaint, enforcement or compliance action initiated by the Office for Civil Rights based
on an allegation of violation of the HIPAA Rules and must inform DSHS of the outcome
of that action. Business Associate bears all responsibility for any penalties, fines or
sanctions imposed against the Business Associate for violations of the HIPAA Rules and
for any imposed against its Subcontractors or agents for which it is found liable.
7. Breach Notification
a) In the event of a Breach of unsecured PHI or disclosure that compromises the
privacy or security of PHI obtained from SE WA ALTC COG or involving SE WA ALTC
COG clients, Business Associate will take all measures required by state or federal
law.
b) Business Associate will notify SE WA ALTC COG within one (1) business day by
telephone and in writing of any acquisition, access, Use or disclosure of PHI not
allowed by the provisions of this Contract or not authorized by HIPAA Rules or
ALITCCOG 2021-27
required by law of which it becomes aware which potentially compromises the
security or privacy of the Protected Health Information as defined in 45 CFR
164.402 (Definitions).
c) Business Associate will notify the SE WA ALTC COG Contact shown on the cover
page of this Contract within one (1) business day by telephone or e-mail of any
potential Breach of security or privacy of PHI by the Business Associate or its
Subcontractors or agents. Business Associate will follow telephone or e-mail
notification with a faxed or other written explanation of the Breach, to include the
following: date and time of the Breach, date Breach was discovered, location and
nature of the PHI, type of Breach, origination and destination of PHI, Business
Associate unit and personnel associated with the Breach, detailed description of
the Breach, anticipated mitigation steps, and the name, address, telephone
number, fax number, and e-mail of the individual who is responsible as the primary
point of contact. Business Associate will address communications to the SE WA
ALTC COG Contact. Business Associate will coordinate and cooperate with SE WA
ALTC COG to provide a copy of its investigation and other information requested
by SE WA ALTC COG, including advance copies of any notifications required for SE
WA ALTC COG review before disseminating and verification of the dates
notifications were sent.
d) If SE WA ALTC COG determines that Business Associate or its Subcontractor(s) or
agent(s) is responsible for a Breach of unsecured PHI:
i, requiring notification of Individuals under 45 CFR § 164.404 (Notification to
Individuals), Business Associate bears the responsibility and costs for
notifying the affected Individuals and receiving and responding to those
Individuals' questions or requests for additional information;
ii. requiring notification of the media under 45 CFR § 164.406 (Notification to
the media), Business Associate bears the responsibility and costs for
notifying the media and receiving and responding to media questions or
requests for additional information;
iii. requiring notification of the U.S. Department of Health and Human Services
Secretary under 45 CFR § 164.408 (Notification to the Secretary), Business
Associate bears the responsibility and costs for notifying the Secretary and
receiving and responding to the Secretary's questions or requests for
additional information; and
iv. SE WA ALTC COG will take appropriate remedial measures up to termination
of this Contract
8. Miscellaneous Provisions
a) Regulatory References. A reference in this Contract to a section in the HIPAA Rules
means the section as in effect or amended.
b) Interpretation. Any ambiguity in this Contract shall be interpreted to permit
compliance with the HIPAA Rules.
XXIII GRIEVANCE PROCEDURES
The Contractor shall have a written procedure for resolving grievances. A copy shall be made available
to clients and applicants for contracted services. Such procedures should include time frames for filing
a grievance and provide opportunities for informal and formal resolution.
ALTCCOG 2021-27
For grievances arising from the delivery of contracted services, the grievance procedures must include
the right of the grievant to appeal to the Director. Applicants and clients shall be advised of the
grievance procedures and their right to due process if they feel they have been wrongfully denied or
terminated from services.
XXIV DEBARMENT AND EXCLUSION
A. The Contractor, by signature to this Agreement, certifies that the Contractor is not presently
debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded
from participating in this Agreement by any Federal department of agency.
B. The Contractor shall provide immediate written notice to the Director if at any time the
Contractor learns that its certification was erroneous when submitted or has become erroneous
by reason of changed circumstances.
C. The Contractor shall not knowingly assign or subcontract any portion of contracted services to
a person who is debarred, suspended, declared ineligible, or voluntarily excluded from
participation.
XXV CONFLICT OF INTEREST
The Director may, by written notice to the Contractor, terminate this Basic Agreement in whole or in
part if it is found after due notice and hearing that any of the following laws have been violated in
obtaining or amending this Basic Agreement or any Contract or in making determinations with respect
to this Basic Agreement or any Contract:
A. RCW 42.20, Misconduct of Public Officers;
B. RCW 42.23, Code of Ethics for Municipal Officers -Contract Interests,
C. RCW 42.52, Ethics in Public Service
Southeast Washington Aging and Long Term Care shall not be liable for payment for services rendered
under any Contract to the extent this Basic Agreement or the Contract was entered into in violation of
this clause.
XXVI COVENANT AGAINST CONTINGENT FEES
The Contractor shall assure that no person or agency has been employed or retained on a contingent
fee for the purpose of seeking or obtaining a Contract. This does not apply to legitimate employees or
an established commercial or selling agency maintained by the Contractor for the purpose of securing
business. In the event of breach of this clause by the Contractor, the Director may:
A. Annul this Basic Agreement or the Contract in whole or in part without any liability; or
B. Deduct, or similarly recover from the consideration of the Contract, the amount of the
contingent fee.
XXVII LOBBYING
A. Federal requirements (U.S.C. Title 31,0 §1352):
1. No Federal appropriated funds may be paid, by or on behalf of the Contractor, to any
person for influencing or attempting to influence an officer or employee of any agency,
a Member of Congress, an officer or employee of Congress or an employee of a Member
of Congress in connection with the making of any Federal grant, the entering into of any
cooperative agreement and the extension, continuation, renewal, amendment, or
modification of any Federal grant or cooperative agreement. If non -Federal funds are
ALTCCOG 2021-27
used, the Contractor shall complete and submit Standard Form-LLL, "Disclosure Form to
Report Lobbying," in accordance with its instructions.
2. The Contractor, if a recipient of a grant or cooperative agreement over $100,000, shall
and does certify that it did and will comply with these Federal requirements. The
Certification will be signed and submitted to the Director before the execution of this
Basic Agreement.
B. State requirements (RCW 42.17.020 (27); RCW 42,17.190; RCW 34.05):
No public funds may be used directly or indirectly to attempt to influence the passage or defeat
of any legislation by the legislature of the State of Washington, or the adoption or rejection of
any rule, standard, rate, or other legislative enactment of any State agency under the State
Administrative Procedure Act.
Provided, this does not prevent the Contractor from communicating with a member of the
legislature on the request of that member or requesting legislative action or appropriations
through appropriate channels.
C. Contractor agrees that it will not and has not used Federal appropriated funds to pay any
person or organization for influencing or attempting to influence an officer or any person or
employee of any agency, a member of Congress, officer or employee of Congress, or an
employee of a member of Congress in connection with obtaining any Federal contract, grant
or any other award covered by 31 U.S.C. Section 1352. Contractor shall agree to provide a
certificate to SE WA ALTC COG with verification of the above.
XXVI PROHIBITION OF POLITICAL ACTIVITIES
No funds, material, property or contracted services provided under the terms of this Basic Agreement
or any Contract shall be used for partisan political activity or to further the election or defeat of any
candidate for public office.
XXIX DISPUTES
Any dispute arising under this Basic Agreement or any Contract, including a disputed complaint or
grievance resolution, shall, unless otherwise provided in this Basic Agreement or the Contract, be
submitted in writing to the Director for settlement under Southeast Washington Aging and Long Term
Care's Dispute Resolution Procedures.
XXX DRUG -FREE WORKPLACE
A. The Contractor shall and does certify, by signature of this Agreement that it provides a drug -
free workplace in compliance with the Drug -Free Workplace Act (Public Law 100-690 Title V,
Subtitle D),
B. The Contractor shall publish a statement notifying employees of prohibitions against use,
manufacture, distribution or possession of controlled substances in the workplace and specific
actions that will be taken in the event of non-compliance. Employees shall be notified that, as
a condition of employment, they must abide by the terms of the statement and notify the
employer in writing of any conviction for a criminal drug statute occurring in the workplace
within five calendar days after such conviction. This statement shall at a minimum be distributed
to all employees engaged in the delivery of contracted services.
C. The Contractor shall establish an on -going drug -free awareness program to inform employees
about:
1. The dangers of drug abuse in the workplace;
2. The contractor's policy of maintaining a drug -free workplace;
3. The availability of drug counseling, rehabilitation, and employee assistance programs;
and
ALTCCOG 2021-27
4. The penalties that may be imposed upon employees for drug abuse violations occurring
in the workplace.
XXXI REIMBURSEMENT LIMITS
The sum of payments to the Contractor for a contracted service shall not exceed the contracted unit
rate or the contracted amount whichever is greater. In the event payments to the Contractor exceed
this limit, the overpayment shall be returned to Southeast Washington Aging and Long Term Care or
deducted from the next Claim for Payment submitted by the Contractor.
XXXII VENUE
This Basic Agreement and all Contracts shall be governed by the laws of the State of Washington. Any
action, suit, orjudicial proceeding for the enforcement of this Basic Agreement or any Contract shall be
brought in the Superior Court for the State of Washington in Yakima County, Washington.
XXXIII CONDITION PRECEDENT
This Basic Agreement shall not be binding upon the Contractor until signature on behalf of SE WA ALTC
COG and the Contractor is authorized by the Governing Board of Southeast Washington Aging and
Long Term Care Council of Governments,
XXXIV GENERAL FEDERAL REQUIREMENTS
In addition to the above, the Contractor agrees to the following terms if applicable:
A. Clean Air Act (42 U.S.C. 7401-7671q and the Federal Water Pollution Contract Act (33
U.S.C. 1251-1387) as amended. Contractor agrees that if the Contract and subaward is in
excess of the amount of $100,000 or more consideration that the contractor shall agree to
comply with all applicable standards, orders or regulations issued pursuant to the Clean Water
Act (42 U.S.C. 7401 set seq.) and the Federal Water Pollution Control Act, as amended (33 U.S.C.
1251 et. seq.). Violations shall be reported to the Federal awarding agency and the Regional
Office of the Environmental Protection Agency, also known as the "EPA".
B. Right to Intervention: The Contractor agrees that if this contract is for the performance of
experimental, developmental, or research work shall provide for the rights of the Federal
Government and SE WA ALTC COG in any resulting invention in accordance with 37 CFR part
401, 'Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under
Government Grants, Contracts and Cooperative Agreements," and any implementing
regulations issued by the awarding agency.
C. Contract Work Hours & Safety Standard Act (40 U.S.C. 327-333): The Contractor agrees
that if the consideration for the contract exceeds $100,000 for contracts that involve the
employment of mechanics or laborers shall include a provision for compliance with 40 U.S.C.
3702 and 3704, as supplemented by Department of Labor regulation (29 CFR part 5). Under 40
U.S.C. 3702 of the Act, each contractor must be required to compute the wages of every
mechanic and laborer on the basis of a standard work week of 40 hours. Work in excess of the
standard work week is permissible provided that the worker is compensated at a rate of not
less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours
in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and
provide that no laborer or mechanic must be required to work in surroundings or under
working conditions which are unsanitary, hazardous or dangerous.
These requirements do not apply to the purchasers of supplies or materials or articles ordinarily
available on the open market, or contracts for transportation or transmission of intelligence.
ALTCCOG 2021-27
D. Remedies: The Contractor agrees that if applicable for the small purchase threshold fixed at
41.U.S.C. 403(11), which is currently $150,000 but subject to potential change), that Contractor
will comply with the provisions of this State.
The parties agree that in the event of non-compliance that SE WA ALTC COG may take
appropriate administrative, contractual, or administrative remedies for such violation, including
and up to termination of the contract.
E. Davis -Bacon Act, as amended (40 U.S.C. 3141-3148): When required by Federal program
legislation the Contractor agrees that it shall comply with all provisions of the Davis -Bacon Act
as supplemented by Department of Labor regulations (29 CFR Part 5, "Labor Standards
Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction").
The contractor also agrees to comply with the Copeland "Anti -Kickback" Act (40 U.S.C. 3145),
as supplemented by the Department of Labor regulations (29 CFR Part 3).
XXXV BACKGROUND CHECKS
The Contractor shall ensure that hiring practices for staff who will have unsupervised access to
clients are in accordance with RCW 43.20A.710. A Washington State Patrol criminal history
background check is required every two years for all service providers who will have unsupervised
contact with vulnerable adults. This applies to individual contractors, as well as employees and/or
volunteers of a contracting entity. SE WA ALTC COG will complete background checks on all
individual Contractors. Contracting entities are responsible to complete required background
checks on their own employees, volunteers, and subcontractors. Background checks must be
conducted through Washington State Patrol's Washington Access to Criminal History (WATCH)
system, DSHS's Background Check Central Unit (BCCU), or a company accredited by a national
association of background screeners. Those who have disqualifying crimes or negative actions per
RCW 43.20A.710 cannot have unsupervised access to vulnerable adults served through this
contract.
XXXVI CLIENT ABUSE
The Contractor shall report all instances of suspected client abuse to DSHS, in accordance with RCW
74.34.
XXXVII DATA SECURITY
The Contractor shall perform the services as set forth in accordance with Appendix 1, Data
Security Requirements.
XXVIII EMERGENCY PLANNING
The Contractor shall have a plan for serving currently authorized clients during periods when normal
services may be disrupted. This may include earthquakes, floods, snowstorms, pandemic flu, etc.
The Contractor's plan should include the maintenance of lists, including the identification of those
clients who are at most risk, as well as emergency provisions for service delivery.
XXIX WHISTLEBLOWING
The Contractor shall comply with all State and/or Federal applicable laws pertaining to employee
whistleblowing rights and protections afforded under applicable law.
XXX COMPLIANCE WITH STATE AND FEDERAL LAW
ALTCCOG 2021-27
The Contractor hereby agrees to comply with all applicable State and Federal law and requirements
during performance of this agreement. Failure to do so may result in suspension, nonpayment
and/or immediate termination of this agreement.
XXXI ORIGINALS AND BEST EVIDENCE
This agreement may be executed in any number of counterparts, each of which so executed shall
be deemed an original and constitute one and the same agreement. PDF, Facsimile, and/or
electronic communication (email) copies with signatures shall be given the same legal effect as an
original. The parties further agree for purposes of Washington State Evidence rules, ER 901, ER
1001(c), ER 1002, ER 1003, and ER 1004, that a signed copy of this agreement delivered by facsimile,
e-mail or other means of electronic communication shall be deemed to have the same legal force
and effect as delivery of an original copy signature of this agreement.
ALTCCOG 2021-27
Appendix 1
Data Security Requirements
CITY OF PASCO
Definitions. The words and phrases listed below, as used in this Appendix, shall each have the
following definitions:
"AES" means the Advanced Encryption Standard, a specification of Federal Information
Processing Standards Publications for the encryption of electronic data issued by the National
Institute of Standards and Technology.
Jl.. L-_.Y+:.:.' `.stJFIFS�! xi i li'`, 1`�7 1�rif
a. "Authorized Users(s)" means an individual or individuals with a business need to access
DSHS/SE WA ALTC COG Confidential Information, and who has or have been authorized
to do so.
b. "Business Associate Agreement" means an agreement between SE WA ALTC COG and
a contractor who is receiving Data covered under the Privacy and Security Rules of the
Health Insurance Portability and Accountability Act of 1996. The agreement establishes
permitted and required uses and disclosures of protected health information (PHI) in
accordance with HIPAA requirements and provides obligations for business associates to
safeguard the information.
c. "Category 4 Data" is data that is confidential and requires special handling due to
statutes or regulations that require especially strict protection of the data and from which
especially serious consequences may arise in the event of any compromise of such data.
Data classified as Category 4 includes but is not limited to data protected by: the Health
Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191 as amended by the
Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), 45
CFR Parts 160 and 164; the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C.
§1232g; 34 CFR Part 99; Internal Revenue Service Publication 1075
(https://www.irs.gov/pub/irs-pdf/pl075.pdf); Substance Abuse and Mental Health Services
Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records,
42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20.
d. "Cloud" means data storage on servers hosted by an entity other than the Contractor
and on a network outside the control of the Contractor. Physical storage of data in the
cloud typically spans multiple servers and often multiple locations. Cloud storage can be
divided between consumer grade storage for personal files and enterprise grade for
companies and governmental entities. Examples of consumer grade storage would include
iTunes, Dropbox, Box,com, and many other entities. Enterprise cloud vendors include
Microsoft Azure, Amazon Web Services, and Rackspace.
e. "CLC" means Community Living Connections, Washington State's name for its No -
Wrong -Door access network of Area Agencies on Aging and their state, regional and local
partners.
f. "CLC-GetCare" means a version of RTZ's GetCare product modified to support
Washington State's Community Living Connections. It is used for managing programs
funded by the Older Americans Act, CMS, state general fund, local resources, and federal
grants, including Medicaid Alternative Care (MAC) and Tailored Supports for Older Adults
(TSOA).
It supports reporting for the National Aging Program Information System and Medicare
ALTCCOG 2021-27
Improvements for Providers Act. It also supports the CLC public website with a consumer
portal and a resource directory.
g. "Encrypt" means to encode Confidential Information into a format that can only be
read by those possessing a "key"; a password, digital certificate or other mechanism
available only to authorized users. Encryption must use a key length of at least 256 bits for
symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the
Advanced Encryption Standard (AES) must be used if available.
h. "FedRAMP" means the Federal Risk and Authorization Management Program (see
www.fedramp.gov), which is an assessment and authorization process that federal
government agencies have been directed to use to ensure security is in place when
accessing Cloud computing products and services.
i. "GetCare" is a secure cloud -based platform for client and program management. It is
a product of RTZ Systems.
j. "Hardened Password" means a string of at least eight characters containing at least
three of the following four character classes: Uppercase alphabetic, lowercase alphabetic,
numeral, and special characters such as an asterisk, ampersand, or exclamation point.
k. "Mobile Device" means a computing device, typically smaller than a notebook, which
runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices
include smart phones, most tablets, and other form factors.
I. "Multi -factor Authentication" means controlling access to computers and other IT
resources by requiring two or more pieces of evidence that the user is who they claim to
be. These pieces of evidence consist of something the user knows, such as a password or
PIN; something the user has such as a key card, smart card, or physical token; and
something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan.
"PIN" means a personal identification number, a series of numbers which act as a password
for a device. Since PINs are typically only four to six characters, PINS are usually used in
conjunction with another factor of authentication, such as a fingerprint.
m. "Portable Device" means any computing device with a small form factor, designed to
be transported from place to place. Portable devices are primarily battery powered devices
with base computing resources in the form of a processor, memory, storage, and network
access. Examples include, but are not limited to, mobile phones, tablets, and laptops.
Mobile Device is a subset of Portable Device.
n. "Portable Media" means any machine readable media that may routinely be stored or
moved independently of computing devices. Examples include magnetic tapes, optical
discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal
hard drives that have been removed from a computing device.
o. "Secure Area" means an area to which only authorized representatives of the entity
possessing the Confidential Information have access, and access is controlled through use
of a key, card key, combination lock, or comparable mechanism.
Secure Areas may include buildings, rooms or locked storage containers (such as a filing
cabinet or desk drawer) within a room, as long as access to the Confidential Information is
not available to unauthorized personnel.
p. In otherwise Secure Areas, such as an office with restricted access, the Data must be
secured in such a way as to prevent access by non -authorized staff such as janitorial or
facility security staff, when authorized Contractor staff are not present to ensure that non -
authorized staff cannot access it.
ALTCCOG 2021-27
q. "Trusted Network" means a network operated and maintained by the Contractor, which
includes security controls sufficient to protect DSHS Data on that network. Controls would
include a firewall between any other networks, access control lists on networking devices
such as routers and switches, and other such mechanisms which protect the confidentiality,
integrity, and availability of the Data.
r. "Unique User ID" means a string of characters that identifies a specific user and which,
in conjunction with a password, passphrase or other mechanism, authenticates a user to
an information system.
2. Systems Access -And Method of Access. The Contractor may request permission to access the
following:
a. Provider One payment system, or successor payment system, for payment data; and
b. The Community Living Connections (CLC)/GetCare System in order to manage, record, and
report service provision and utilization, demographic, resource directory, and consumer
website information.
3. Agpmand Disdasure InfQLmAfion. The Contractor shall not disclose the contents of any client
records, files, papers and communications except as necessary for the administration of programs
to provide services to clients as required by law.
a. The Contractor shall limit access to client data to staff whose duties specifically require access
to such data in the performance of their assigned duties. Contractor staff shall not access any
individual client data for personal purposes. Clients shall only be permitted to access their own
data
b. The Contractor shall ensure each employee with access to data systems signs the Contractor
Agreement on Nondisclosure of Confidential Information form, provided by SE WA ALTC COG,
to acknowledge the data access requirements prior to SE WA ALTC COG granting access.
Access will be given only to data necessary to the performance of this Agreement. The
Contractor shall retain the original Nondisclosure form on file. The Contractor shall have the
form available for SE WA ALTC COG review upon request.
The Contactor must provide an annual written reminder of the Nondisclosure requirements to
all employees with access to data to remind them of the limitations, use or publishing of data.
The Contractor shall retain documentation of such reminder on file for monitoring purposes.
c. The Contractor shall not use or disclose any information concerning any client for any purpose
not directly connected with the administration of the Contractor's responsibilities under this
Agreement except by prior written consent of the client, his/her attorney, parent or guardian.
d. SE WA ALTC COG and the Contractor may disclose information to each other or to DSHS for
purposes directly connected with the administration of DSHS/SE WA ALTC COG programs. This
includes, but is not limited to, determining eligibility, providing services, and participation in an
audit.
e. The Contractor shall disclose information for research, statistical, monitoring and evaluation
purposes conducted by appropriate federal agencies, DSHS and SE WA ALTC COG. SE WA ALTC
COG must authorize in writing the disclosure of this information to any other party not
identified in this section.
f. The Contractor shall not link the data with personal data or individually identifiable data from
any other source nor re -disclose the data unless specifically authorized in this Agreement or by
the prior written consent of SE WA ALTC COG.
ALTCCOG 2021-27
g. The Contractor shall notify SE WA ALTC COG within five business days when a User leaves
employment or otherwise no longer requires system access. Upon notification, the system
Administrator will deactivate the User ID and terminate access to the applicable application(s).
The Contractor shall ensure that only registered system Users access and use the systems in
this Agreement, use only their own User ID and password to access the systems and do not
allow employees who are not registered to borrow a User ID or password to access any systems.
i. Access to systems may be continuously tracked and monitored. SE WA ALTC COG and DSHS
reserve the right at any time to conduct audits of systems access and use, and to investigate
possible violations of this Agreement and/or violations of federal and state laws and regulations
governing access to protected health information.
4. dissemination to Staff. Prior to making information available to new staff and annually thereafter,
the Contractor shall ensure that staff accessing the Personal Information or PHI under this
Agreement are trained in HIPAA use and disclosure of PHI requirements and understand:
a. Confidentiality of Client Data
(1) Client data is confidential and is protected by various state and federal laws. The basis
for this protection is the individual's right to privacy as outlined in the HIPAA Privacy
Rule- 45 CFR 160 to 45 CFR 164.
(2) Personal Information means demographic and financial information about a particular
individual that is obtained through one or more sources (such as name, address, SSN,
and phone numbers). RCW 42.56.210 lists the information that is exempted from public
inspection and copying.
b. Use of Client Data
(1) Client data may be used only for purposes of these contracted services, directly related
to providing services to the client or for the operation of aging and long-term care
programs.
(2) Any personal use of client information is strictly prohibited.
(3) Access to data must be limited to those staff whose duties specifically require access to
such data in the performance of their assigned duties.
c. Disclosure of Information
(1) Client information may be provided to the client, client's authorized guardian, or a client -
authorized 3rd party per WAC 388-01.
(2) Client information may be disclosed to other individuals or agencies only for purposes of
administering DSHS/SE WA ALTC COG programs.
(3) Questions related to disclosure are to be directed to the SE WA ALTC COG Contracts
Manager.
(4) Any disclosure of information contrary to this section is unauthorized and is subject to
penalties identified in law
S. Securi ly of Data.
The Contractor shall take reasonable precautions to secure against unauthorized physical and
electronic access to data, which shall be protected in a manner that prevents unauthorized
persons, including the general public, from retrieving data by means of computer, remote
terminal, or other means.
ALTCCOG 2021-27
The Contractor shall take due care to ensure the Contractor and its subcontractors protect said
data from unauthorized physical and electronic access. The Contractor is authorized to store
data on portable devices and media. The data will be stored on computers with security systems
that require individual user IDs and hardened passwords. Only persons who have signed the
Contractor Agreement on Nondisclosure ofConfidential Information form will be able to access
the data that Washington State shares with SE WA ALTC COG and the Contractor under this
Agreement.
b. The Contractor shall ensure disks and/or documents generated in printed form from the
electronic file are properly returned, destroyed or shredded when no longer needed so
unauthorized individuals cannot access client information. Data destroyed shall include all
copies of any data sets in possession after the data has been used for the purpose specified
herein or within 30 days of the date of termination, and certify such destruction to SE WA ALTC
COG. SE WA ALTC COG shall be responsible for destroying the returned documents to ensure
confidentiality is maintained. The Data provided by DSHS/SE WA ALTC COG will remain the
property of DSHS/SE WA ALTC COG and will be promptly destroyed when the Contractor and
its subcontractors have completed the work for which the information was required, as fully
described herein.
c. The Contractor shall protect information according to state and federal laws including the
following incorporated by reference:
(1) Privacy Act 1974 5 USC subsection 552a;
(2) Chapter 40.14 RCW Preservation and Destruction of Public Records;
(3) Chapter 74.04 RCW General Provisions —Administration;
(4) Chapter 42.56.210 RCW Certain Personal & Other Records Exempt;
(5) 45 CFR 205.50 provides for safeguarding information for the financial assistance
programs and identifies limitations to disclosure of said information; and
(6) Public Law 99-508 (18 USC section 2510et. Seq. Electronic Communications Privacy Act
of 1986) Part A of Title IV of the Social Security Act authorizes disclosure of client
information and provides for safeguards, which restrict the use or disclosure of
information concerning applicants or recipients to purposes directly connected with
administration of the program.
6. Administrative Controls. The Contractor must have the following controls in place:
a. A documented security policy governing the secure use of its computer network and
systems, and which defines sanctions that may be applied to Contractor staff for violating
that policy.
b. If the Data shared under this agreement is classified as Category 4, the Contractor must be
aware of and compliant with the applicable legal or regulatory requirements for that
Category 4 Data.
c. If Confidential Information shared under this agreement is classified as Category 4, the
Contractor must have a documented risk assessment for the systern(s) housing the
Category 4 Data.
7. Authorization, Authentication. -and Access_,. In order to ensure that access to the Data is limited
to authorized staff, the Contractor must:
a. Have documented policies and procedures governing access to systems with the shared
Data.
ALTCCOG 2021-27
b. Restrict access through administrative, physical, and technical controls to authorized staff.
c. Ensure that user accounts are unique and that any given user account logon ID and
password combination is known only to the one employee to whom that account is
assigned.
d. For purposes of non -repudiation, it must always be possible to determine which employee
performed a given action on a system housing the Data based solely on the logon ID used
to perform the action.
e. Ensure that only authorized users are capable of accessing the Data.
f. Ensure that an employee's access to the Data is removed immediately:
(1) Upon suspected compromise of the user credentials.
(2) When their employment, or the contract under which the Data is made available to
them, is terminated.
(3) When they no longer need access to the Data to fulfill the requirements of the
contract.
g. Have a process to periodically review and verify that only authorized users have access to
systems containing DSHS/SE WA ALTC COG Confidential Information.
h. When accessing the Data from within the Contractor's network (the Data stays within the
Contractor's network at all times), enforce password and logon requirements for users
within the Contractor's network, including:
(1) A minimum length of 8 characters, and containing at least three of the following
character classes: uppercase letters, lowercase letters, numerals, and special
characters such as an asterisk, ampersand, or exclamation point.
(2) That a password does not contain a user's name, logon ID, or any form of their full
name.
(3) That a password does not consist of a single dictionary word. A password may be
formed as a passphrase which consists of multiple dictionary words.
(4) That passwords are significantly different from the previous four passwords.
Passwords that increment by simply adding a number are not considered
significantly different.
i. When accessing Confidential Information from an external location (the Data will traverse
the Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce
password and logon requirements for users by employing measures including:
(1) Ensuring mitigations applied to the system don't allow end -user modification.
(2) Not allowing the use of dial -up connections.
(3) Using industry standard protocols and solutions for remote access. Examples would
include RADIUS and Citrix.
(4) Encrypting all remote access traffic from the external workstation to Trusted Network
or to a component within the Trusted Network. The traffic must be encrypted at all
times while traversing any network, including the Internet, which is not a Trusted
Network.
(5) Ensuring that the remote access system prompts for re -authentication or performs
automated session termination after no more than 30 minutes of inactivity.
ALTCCOG 2021-27
(6) Ensuring use of Multi -factor Authentication to connect from the external end point
to the internal end point.
Passwords or PIN codes may meet a lesser standard if used in conjunction with another
authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or
token (software, hardware, smart card, etc.) in that case:
(1) The PIN or password must be at least 5 letters or numbers when used in conjunction
with at least one other authentication factor
(2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would
not be acceptable)
(3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would
not be acceptable)
k. If the contract specifically allows for the storage of Confidential Information on a Mobile
Device, passcodes used on the device must:
(1) Be a minimum of six alphanumeric characters.
(2) Contain at least three unique character classes (upper case, lower case, letter,
number).
(3) Not contain more than a three consecutive character run. Passcodes consisting of
12345, or abcd12 would not be acceptable.
I. Render the device unusable after a maximum of 10 failed logon attempts.
8. Protection_ of Data. The Contractor agrees to store Data on one or more of the following
media and protect the Data as described:
a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will
be restricted to Authorized User(s) by requiring logon to the local workstation using a
Unique User ID and Hardened Password or other authentication mechanisms which
provide equal or greater security, such as biometrics or smart cards.
b. Network server disks. For Data stored on hard disks mounted on network servers and
made available through shared folders, access to the Data will be restricted to Authorized
Users through the use of access control lists which will grant access only after the
Authorized User has authenticated to the network using a Unique User ID and Hardened
Password or other authentication mechanisms which provide equal or greater security,
such as biometrics or smart cards. Data on disks mounted to such servers must be located
in an area which is accessible only to authorized personnel, with access controlled through
use of a key, card key, combination lock, or comparable mechanism.
For DSHS/SE WA ALTC COG Confidential Information stored on these disks, deleting
unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise
meet the requirements listed in the above paragraph. Destruction of the Data, as outlined
below in Section 7 Data Disposition, may be deferred until the disks are retired, replaced,
or otherwise taken out of the Secure Area.
c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by SE
WAALTCCOG on optical discs which will be used in local workstation optical disc drives and
which will not be transported out of a Secure Area. When not in use for the contracted
purpose, such discs must be Stored in a Secure Area. Workstations which access DSHS/SE
WA ALTC COG Data on optical discs must be located in an area which is accessible only to
authorized personnel, with access controlled through use of a key, card key, combination
ALTCCOG 2021-27
lock, or comparable mechanism.
Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided
by SE WA ALTC COG on optical discs which will be attached to network servers and which
will not be transported out of a Secure Area. Access to Data on these discs will be restricted
to Authorized Users through the use of access control lists which will grant access only
after the Authorized User has authenticated to the network using a Unique User ID and
Hardened Password or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards.
Data on discs attached to such servers must be located in an area which is accessible only
to authorized personnel, with access controlled through use of a key, card key, combination
lock, or comparable mechanism.
e. Paper documents. Any paper records must be protected by storing the records in a Secure
Area which is only accessible to authorized personnel. When not in use, such records must
be stored in a Secure Area.
f. Remote Access. Access to and use of the Data over the State Governmental Network (SGN)
or Secure Access Washington (SAW) will be controlled by DSHS staff who will issue
authentication credentials (e.g. a Unique User ID and Hardened Password) to Authorized
Users on Contractor's staff.
Contractor will notify the SE WA ALTC COG Contracts Manager immediately whenever an
Authorized User in possession of such credentials is terminated or otherwise leaves the
employ of the Contractor, and whenever an Authorized User's duties change such that the
Authorized User no longer requires access to perform work for this Contract.
Data storage on portable devices or media.
(1) Except where otherwise specified herein, DSHS/SE WA ALTC COG Data shall not be
stored by the Contractor on portable devices or media unless specifically authorized
within the terms and conditions of the Contract. If so authorized, the Data shall be
given the following protections:
(a) Encrypt the Data.
(b) Control access to devices with a Unique User ID and Hardened Password or
stronger authentication method such as a physical token orbiometrics.
(c) Manually lock devices whenever they are left unattended and set devices to
lock automatically after a period of inactivity, if this feature is available.
Maximum period of inactivity is 20 minutes.
(d) Apply administrative and physical security controls to Portable Devices and.
Portable Media by:
i. Keeping them in a Secure Area when not in use,
ii. Using check-in/check-out procedures when they are shared, and
iii. Taking frequent inventories.
(2) When being transported outside of a Secure Area, Portable Devices and Portable
Media with DSHS Confidential Information must be under the physical control of
Contractor staff with authorization to access the Data, even if the Data is encrypted.
g. Data stored for backup purposes.
(1) DSHS/SE WA ALTC COG Confidential Information may be stored on Portable Media
as part of a Contractor's existing, documented backup process for business continuity
ALTC'COG 2021-27
or disaster recovery purposes. Such storage is authorized until such time as that
media would be reused during the course of normal backup operations. If backup
media is retired while DSHS/SE WA ALTC COG Confidential Information still exists
upon it, such media will be destroyed at that time in accordance with the disposition
requirements below in Section 7 Data Disposition.
(2) Data may be stored on non -portable media (e.g. Storage Area Network drives, virtual
media, etc.) as part of a Contractor's existing, documented backup process for
business continuity or disaster recovery purposes. If so, such media will be protected
as otherwise described in this exhibit.
If this media is retired while DSHS/SE WA ALTC COG Confidential Information still
exists upon it, the data will be destroyed at that time in accordance with the
disposition requirements below in Section 7 Data Disposition.
Cloud storage. DSHS/SE WA ALTC COG Confidential Information requires protections
equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data
is problematic as neither SE WA ALTC COG nor the Contractor has control of the
environment in which the Data is stored. For this reason:
(1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the
following conditions are met:
(a) Contractor has written procedures in place governing use of the Cloud storage
and Contractor attests in writing that all such procedures will be uniformly
followed.
(b) The Data will be Encrypted while within the Contractor network.
(c) The Data will remain Encrypted during transmission to the Cloud,
(d) The Data will remain Encrypted at all times while residing within the Cloud
storage solution.
(e) The Contractor will possess a decryption key for the Data, and the decryption
key will be possessed only by the Contractor and/or DSHS/SE WA ALTC COG.
(f) The Data will not be downloaded to non -authorized systems, meaning systems
that are not on either the DSHS or Contractor networks.
(g) The Data will not be decrypted until downloaded onto a computer within the
control of an Authorized User and within either the DSHS or Contractor's
network.
(2) Data will not be stored on an Enterprise Cloud storage solution unless either.
(a) The Cloud storage provider is treated as any other Sub -Contractor, and agrees
in writing to all of the requirements within this exhibit; or,
(b) The Cloud storage solution used is Fed RAMP certified.
(3) If the Data includes Protected Health Information covered by the Health Insurance
Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business
Associate Agreement prior to Data being stored in their Cloud solution.
9. System Protection. To prevent compromise of systems which contain DSHS/SE WA ALTC COG
Data or through which that Data passes:
a. Systems containing DSHS Data must have all security patches or hotfixes applied within
three months of being made available.
b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have
ALfCCOG 2021-27
been applied within the required timeframes.
c. Systems containing DSHS/SE WA ALTC COG Data shall have an Anti-Malware application,
if available, installed,
d. Anti-Malware software shall be kept up to date. The product, its anti -virus engine, and any
malware database the system uses, will be no more than one update behind current,
10. Data Segregation.
a. DSHS/SE WA ALTC COG Data must be segregated or otherwise distinguishable from non-
DSHS/SE WA ALTC COG data.
This is to ensure that when no longer needed by the Contractor, all DSHS/SE WA ALTC COG
Data can be identified for return or destruction. It also aids in determining whether
DSHS/SE WA ALTC COG Data has or may have been compromised in the event of a security
breach, As such, one or more of the following methods will be used for data segregation.
(1) DSHS/SE WA ALTC COG Data will be kept on media (e.g. hard disk, optical disc, tape,
etc.) which will contain no non-DSHS/SE WA ALTC COG Data; and/or
(2) DSHS/SE WA ALTC COG Data will be stored in a logical container on electronic media,
such as a partition or folder dedicated to DSHS/SE WA ALTC COG Data; and/or
(3) DSHS/SE WA ALTC COG Data will be stored in a database which will contain no non-
DSHS/SE WA ALTC COG data; and/or
(4) DSHS/SE WA ALTC COG Data will be stored within a database and will be
distinguishable from non- DSHS/SE WA ALTC COG data by the value of a specific
field or fields within database records.
(5) When stored as physical paper documents, DSHS/SE WA ALTC COG Data will be
physically segregated from non-DSHS/SE WA ALTC COG data in a drawer, folder, or
other container.
b. When it is not feasible or practical to segregate DSHS/SE WA ALTC COG Data from non-
DSHS/SE WA ALTC - COG data, then both the DSHS/SE WA ALTC COG Data and the non-
DSHS/SE WA ALTC COG data with which it is commingled must be protected as described
in this Exhibit.
11. Data Disposition When the contracted work has been completed or when the Data is no
longer needed, except as noted above in Section 4.b, Data shall be returned to SE WA ALTC
COG or destroyed. Media on which Data may be stored and associated acceptable methods of
destruction are as follows;
Data Stored On:
Server or workstation hard disks, or
Removable media (e.g. floppies, USB flash
drives, portable hard disks) excluding optical
discs
Paper documents with sensitive
Confidential Information
Will Be Destroyed By:
Using a "wipe" utility which will overwrite the
Data at least three (3) times using either
random or single character data, or
Degaussing sufficiently to ensure that the
Data cannot be reconstructed, or
Physically destroying the disk.
or Recycling through a contracted firm,
provided the contract with the recycler
assures that the confidentiality of Data will be
ALTCCOG 2021-27
protected.
Paper documents containing Confidential
On -site shredding, pulping, or incineration
Information requiring special handling
(e.g protected health information)
Optical discs (e.g. CDs or DVDs)
Incineration, shredding, or completely
defacing the readable surface with a coarse
abrasive
Magnetic tape
Degaussing, incinerating or crosscut
shredding
12. Notification of Compromise tii I The compromise or potential
compromise of DSHS/SE WA ALTC COG shared Data must be reported to the SE WA ALTC COG
Contact Person designated in the Agreement within one (1) business day of discovery.
Contractor must also take actions to mitigate the risk of loss and comply with any notification
or other requirements imposed by law or DSHS/SE WA ALTC COG.
13. Data shared with Subcontractors, If DSHS/SE WA ALTC COG Data provided under this
Agreement is to be shared with a subcontractor, the Agreement with the subcontractor must
include all of the data security provisions within this Agreement and within any amendments,
attachments, or exhibits within this Agreement. If the Contractor cannot protect the Data as
articulated within this Agreement, then the contract with the Subcontractor must be submitted
to the SE WA ALTC COG Contact Person specified for this Agreement for review and approval.