Loading...
HomeMy WebLinkAboutAgreements/Contracts - RenewGRANT AND ADAMS COUNTY DEVELOPMENTAL DISABILITIES SUBCONTRACTOR AGREEMENT '12-030 INIZ.0 AGREEMENT PERIOD: 7/1/2021 — 06/30/2022 ORGANIZATION NAME: Entrust Community Services SUBCONTRACTOR CONTACT PERSON: Miranda Bridges EMAIL: bridgesm@entrustcs.org (509) 907-0276 SIGNATORY AUTHORITY: Tom Gaulke, CEO EMAIL: gaulket@entrustcs.org (509) 834-2961 ADDRESS: 213 S. 11th Avenue Yakima, WA 98909-0727 IRS TAX NUMBER: 91-0862938 QUALIFIED PROVIDER SERVICES: Individual Supported Employment, Community Inclusion Additional terms of this agreement are set out in and governed by following which are incorporated herein by reference: SPECIAL TERMS AND CONDITIONS — Exhibit A DATA SECURITY REQUIREMENTS — Exhibit B SPENDING PLAN AGREEMENT — Exhibit C BOARD OF COUNTY COMMISSIONERS GRANT & ADAMS COUNTY DEVELOPMENTAL DISABILITIES 2- 7T* �i,ILDanny E/Stone, Chair 6ate Nicole R. DavidsonDate Rob nes, V"ed-RKair Date Ix. L?zoo-.-- Cindy Carte Member Date Attest: Batar J. Vasquez, Date Cl - r f the Board Approved as to form: of Kev(n McCrae Date Deput-r Prosecuting Attorney Grant & Adams County Developmental Disabilities Subcontractor Agreement 7/1/2021— 6/30/2022 Developmental Disabilities County Coordinator 2, Dell-A'nderson, CL, LMHC Date Grant Integrated Services Executive Director %�yy� �� 2/1/22 Tom G461ke EnTrust Page 2 of 24 SPECIAL TERMS AND CONDITIONS EXHIBIT A 1) Definitions Specific to Program Agreement: The words and phrases listed below, as used in this Program Agreement, shall each have the following definitions: a) ""Acuity Level" means the level of an individual's abilities and needs as determined through the Developmental Disability Association (DDA) assessment. b) "AWA" means ALTSA Web Access. c) "Additional Consumer Services" refers to indirect Client service types as follows: 1) ""Community Information and Education": Activities to inform and/or educate the general public about developmental disabilities and related services. These may include information and referral services; activities aimed at promoting public awareness and involvement; and community consultation, capacity building and organization activities. 2) "Training": To increase the job-related skills and knowledge of staff, providers, volunteers, or interning students in the provision of services to people with developmental disabilities. Also, to enhance program related skills of board or advisory board members. 3) "Other Activities" reserved for special projects and demonstrations categorized into the following types: a) Infrastructure projects: Projects in support of Clients (services not easily tracked back to a specific working age Client) or that directly benefit a Client but the Client is not of working age. Examples include planning services like benefits planning and generic job development e.g. 'Project Search". b) Start-up projects: Projects that support an agency or directly benefit the agency. Examples include equipment purchases and agency administrative support. c) Partnership Project: Collaborative partnerships with school districts, employment providers, Division of Vocational Rehabilitation (DVR), families, employers and other community collaborators needed to provide the employment supports and services young adults with developmental disabilities require to become employed during the school year they turn twenty-one (21). d) ""BARS" means Budget and Accounting Reporting System. e) "Client" means a person with a developmental disability as defined in chapter 388-823 WAC who is currently eligible and active with the Developmental Disabilities Administration, or is an identified Pre - Admission Screening and Resident Review (PASRR) Client. f) 'Competitive Integrated Employment" means work performed by an individual on a part-time or full- time basis, within an integrated setting within the community that meets Home and Community Based Services (HCBS) settings requirements. The individual must be compensated at minimum wage or higher, using the higher ofthe Federal, State, or local rate, and at a rate comparable to the wage paid to non -disabled workers performing the same tasks, including receiving the same benefits and opportunities for advancement. g) "Consumer Support" refers to direct Client service types as follows: Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 3 of 24 7/1/2021— 6/30/2022 1) "Community Inclusion" or "CI": services are individualized services provided in typical integrated community settings. Services will promote individualized skill development, independent living, and community integration for persons to learn how to actively and independently engage in their local community. Activities will provide opportunities to develop relationships and to learn, practice and apply skills that result in greater independence and community inclusion. These services may be authorized for individuals aged sixty-two (62) and older. These services may be authorized instead of employment support (Individual Employment or Group Supported Employment) for working age individuals who have received nine (9) months of employment support. 2) "Individual Supported Employment" or "IE": services are a part of an individual's pathway to employment and are tailored to individual needs, interests, and abilities, and promote career development. These are individualized services necessary to help persons with developmental disabilities obtain and continue integrated employment at or above the state's minimum wage in the general workforce. These services may include intake, discovery, assessment, job preparation, job marketing, job supports, record keeping and support to maintain a job. 3) "Individualized Technical Assistance" or "ITA": services are a part of an individual's pathway to individual employment. This service provides assessment and consultation to the employment provider to identify and address existing barriers to employment. This is in addition to supports received through supported employment services for individuals who have not yet achieved their employment goal. h) "County" is the political subdivision of the state of Washington, and the county or counties entering into this Program Agreement. i) "CRM" means the DDA Case Resource Manager. j) "CSA" means County Service Authorization. k) "DD" means developmental disabilities. 1) "DDA" means the Developmental Disabilities Administration within DSHS. m) "DDA Region" means the DDA Regional office. n) "DVR" means the Division of Vocational Rehabilitation. o) "Employment Outcome Payment" means a payment to providers for transition students born between specific dates; have high acuity; are authorized for Individual employment; and student obtains a competitive integrated job within a specific timeframe. If the job is a minimum of ten (10) hours of work per week an additional amount will be include in the payment. p) "General Terms and Conditions" means the contractual provisions contained within that agreement, which govern the contractual relationship between DSHS and the county. q) "HCBS" means the Medicaid Home and Community Based Services. r) "Job Foundation Report" is a document derived from employment readiness activities performed by students who are between ages nineteen (19) through twenty (20) that identifies actionable next steps for employment. The employment service providers developing the Job Foundation report will be supporting students with employment activities on average of thirty-five (35) hours until student moves to Job Development phase of employment activities. s) "PASRR" means Preadmission Screening and Resident Review. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 4 of 24 7/1/2021— 6/30/2022 t) "PCSP," means Person Centered Service Plan, a document that authorizes and identifies the DDA paid services to meet a Client's assessed needs. Formerly referred to as the Individual Support Plan. u) "Quality Assurance" means an adherence to all Program Agreement requirements, including DDA Policy 6.13,, ETProgra►vider Oualifica County Guidelines and the Criteria for ploLmentlPaZ Evaluation, as well as a focus on reasonably expected levels of performance, quality, and practice. v) "Quality Improvement" means a focus on activities to improve performance above minimum standards and reasonably expected levels of performance, quality, and practice. w) "Subcontractor" is the service provider/vendor contracted by the County to provide services. 2) Purpose: This Program Agreement is entered into between Grant & Adams County Developmental Disabilities (County) and First Choice Employment Services (Subcontractor) in accordance with Chapter 71A.14 RCW. Its purpose is to advance the state legislative policy to provide a coordinated and comprehensive state and local program of services for persons with developmental disabilities. 3) Client Eligibility: Client eligibility and service referral are the responsibility of DDA under Chapter 388- 823 WAC (Eligibility) and Chapter 388-825 WAC (Service Rules). Only persons referred by DDA shall be eligible for direct Client services under this program agreement. It is DDA"s responsibility to determine and authorize the appropriate direct service(s) type. Direct Client services provided without authorization are not reimbursable under this program agreement. 4) Credentials and Minimum Requirements: a) Administration of the developmental disabilities County program cannot be subcontracted. b) Qualified DD Program Coordinator: A qualified DD program coordinator has a minimum of five (5) years training and experience in the administration and/or the delivery of developmental disabilitiesservices to a community. For a county where the coordinator administers more than one (1) program area (e.g., Substance Use Disorder, Mental Health, Developmental Disabilities), training and experience in administration and/or a related human or social service may be considered. c) Administration Responsibility: The County will administer the program agreement including contract oversight and monitoring, community outreach and education activities, and regular communication with the DDA region and subcontracted providers. d) Fiscal Responsibility: The Subcontractor must demonstrate the ability to safeguard public funds including maintaining books, records, documents, and other materials relevant to the provision of goods and services. e) Sufficient Policies and Procedures for establishment and maintenance of adequate internal controllsystems: The Subcontractor will maintain written policy procedural manuals for information systems, personnel, and accounting/finance in sufficient detail such that operations can continue should staffing change or absences occur. f) Background/Criminal History Check: A background/criminal history clearance is required every three (3) years for all employees (including DD program County staff), subcontractors,, and/or volunteers who may have unsupervised access to vulnerable DSHS Clients, in accordance with RCW 43.43.830-8451 RCW 74.15.030, and Chapter 388 WAC. If the entity reviewing the application elects Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 5 of 24 7/1/2021— 6/30/2022 to hire or retain an individual after receiving notice that the applicant has a conviction for an offense that would disqualify the applicant from having unsupervised access to vulnerable adults as defined in Chapter 74.34 RCW, then the County shall deny payment for any subsequent services rendered by the disqualified individual provider. The DSHS Background Check Central Unit (BCCU) must be utilized to obtain background clearance. g) Qualified Service Providers: All subcontractors must meet qualifications as outlined utlined in the DDA Policy 6.13, Proaram Provider Oualifications. h) Home and Community Based Waiver Services Assignment of Medicaid Billing Rights: The County assures that each subcontractor has agreed to assign to the County its Medicaid billing rights for services to DDA Clients eligible under Title XIX programs in this Program Agreement. Written documentation shall be available to DSHS on request. i) Reporting Abuse and Neglect: The County staff and its subcontractors who are mandated reporters under RCW 74.34.0 must comply with reporting requirements described in RCW 74.34.0351 and Chapter 26.44 RCW. If the County is notified by DSHS that a Subcontractor staff memberis cited or on the registry for a substantiated finding, then that associated staff will be prohibited from providing services under this program agreement. j) The County staff who perform evaluations of subcontractor work sites will promptly report to DSHS per DDA Policy 5.13, Protection from Abuse: Mandato ry gggplting, if: 1) They have reasonable cause to believe that abandonment, abuse, financial exploitation or neglect (as defined in RCW 74.34.020) of a person who has a developmental disability (as defined in RCW 71A.10.020) has occurred, and, 2) If they have reason to suspect that sexual or physical assault of such a person has occurred, they shall also immediately report to the appropriate law enforcement agency. k) Subcontractors are specifically authorized to have data storage on portable devices or media in accordance with the Data Security Requirements in Exhibit B. 1) Order of Precedence: In the event of any inconsistency in this Program Agreement and any attached exhibits, unless otherwise provided herein, the inconsistency shall be resolved by giving precedence, in the following order, to: 1) County Program Agreement; 2) Attached Exhibits. 5) Duty to Disclose: Under 42 CFR X455.104, the Subcontractor must obtain certain disclosures and complete required screenings to ensure the County does not pay federal funds to excluded persons. The Subcontractor is also required to provide disclosures from managing employees, specifically the persons in the positions of Director/Manager and Fiscal/Budget staff. 6) Statement of Work: Subcontractor shall provide the services and staff, and otherwise do all things necessary for, or incidental to the performance of work, as set forth below. Working collaboratively and sharing information as needed for service coordination, the Subcontractor shall administer DD services within the counties as set forth below: Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 6 of 24 7/1/2021— 6/30/2022 a) The Subcontractor shall: 1) Work with the County when individuals are referred for services, authorized services,and/or for support modifications; 2) Work with the County to document planned services in the Individual's Person -Centered Service Plan; 3) Assist with informing the County of any potential service level changes not documented in the individual"s DD Assessment prior to any changes; 4) Work with the County regarding service termination; b) Compliance with BARS Policies: Subcontractor shall take any necessary and reasonable steps to comply with BARS Policies. c) The Subcontractor shall comply with the following referenced documents found at DDA Internet site httr)s://www.dshs.wa.gov/ddalcountv-best-practices under "County Best Practices": 1) DDA Policy 4.11, County Services for Working Age Adults; 2) Chapter WAC 388-850, Chapter 388-828 WAC, WAC 388-845-0001f 0030, 0210, f 0220, 0600 — 0610, 1030-1040, 3) Criteria for Evaluation; 4) DDA Guiding Values; 5) County Guide to Achieve DDA's Guiding Values; 6) DDA Guidelines for Community Assessments within Employment and Vocational Programs: and 7) Disability Rights Washington (formerly Washington Protection and Advocagy Svstem) Access Agreement. d) The Subcontractor shall develop and submit a comprehensive quality plan that has a focus on activities to improve performance above minimum standards, and reasonably expected levels of performance, quality and practice as required by WAC 388-850-020. e) Qualified Providers: A qualified provider must be a county or an individual or agency contracted with a county or DDA. f) Technical Assistance: DDA contracts with technical assistance providers that may be utilized by Counties with prior written approval. Should Subcontractors require technical assistance, they can request this from the County. g) Subcontractors: The County will pass on all applicable information on contractual requirements that are between DDA and the County to the Subcontractor. The County shall immediately notify the DDA Region of the County's intent to terminate a subcontractor who is serving a DDA referral. Individuals or agencies contracted with a county or DDA may not subcontract for Employment or Community Inclusion services. h) The County shall provide or contract with subcontractors who are qualified Employment and Day Program Service Providers for consumer support services that include the following program outcomes: Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 7 of 24 7/1/2021— 6/30/2022 1) Monthly Community Inclusion (CI) service support hours will be based on the Client's CI service level per WAC 388-828-9310 for all Clients who began receiving CI services July 1, 2011 and forward. a) To ensure health and safety, promote positive image and relationships in the community, increase competence and individualized skill -building, and achieve other expected benefits of CI, services will occur individually or in a group of no more than two (2) or three (3) individuals with similar interests and needs. b) CI services will focus on activities that are typically experienced by the general public. Support to participate in segregated activities and/or specialized activities will not be reimbursed. c) A Client receiving CI services will not receive employment support simultaneously. d) A Client receiving CI services may, at any time, choose to leave Community Inclusion services to pursue work and receive employment support. 2) Clients in an employment program will be supported to work towards a living wage. A living wage is the amount needed to enable an individual to meet or exceed his/her living expenses. Clients should be supported to average twenty (20) hours of community work per week or eighty- six (86) hours per month; however, each person's preferred hours of employment should be taken into consideration. The amount of service a Client. receives will be based on his/her demonstrated need, acuity level and work history per WAC 388-828. 3) The Client's DDA PCSP is the driver for service. The AWA CSA and updated Planned Rates information will not exceed the Client's DDA PCSP. Service changes will not occur until the Client has received proper notification from DDA. 4) All Clients will have an Individualized Employment plan to identify Client's preferences. Minimum plan elements are outlined in the reference document "Criteria for an Evaluation." A copy of the Client's individualized plan will be provided to the Client, their CRM, guardian and others as appropriate. 5) Semi-annual progress reports that describe the outcomes of activities will be provided by the provider to the client, their CRM, guardian, County, and others as appropriate. The report will summarize the progress made towards the Client's individualized goals. 6) All Clients will be contacted by their service provider according to Client need, and at least once per month. 7) If Clients in Individual Employment have not obtained paid employment at minimum wage or better within six (6) months, the Subcontractor will assure the following steps are taken: a) Review the progress toward employment goals; b) Provide evidence of consultation with the Client/guardian; and c) Develop additional strategies with the Client/guardian, County staff, case manager, and others identified by the Client. Strategies may include requesting technical assistance, changing to a new provider, and/or providing additional resources as needed to support the individual's pursuit of employment. The additional strategies will be documented for each Client, and kept in the Client's file(s). Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 8 of 24 7/1/2021— 6/30/2022 8) If after twelve (12) months the Client remains unemployed, an additional review will be conducted. The Subcontractor will address steps outlined in the previous six (6) month progress report inthe next six (6) month progress report. The Client may request to participate in Community Inclusion activities, or the Client may choose to remain in an employment program. When requesting to participate in CI, the Client shall communicate directly with his or her DDA Case Manager. The DDA Case Manager is responsible for authorizing CI services. 9) For Individual Employment where the service provider is also the Client's employer, long term funding will remain available to the service provider employer for six (6) months after the employee DDA Client's date of hire. At the end of the six (6) month period, if the DDA Client continues to need support on the job, another service provider who is not the employer of record must provide the support unless the County or DDA issues prior written approval for the service provider to continue to provide long-term supports if needed. If the County approves the continuation of long-term supports where the service provider is also the Client's employer, the County will regularly monitor these positions to assure fading efforts occur when appropriate, and any potential conflict of interest is addressed. 10) Individual Employment staff hours must be attributed to the "Individual Employment and Billable Activity Phases)". 11) Employment and day services must adhere to the Home and Community Based settings(HCBS) requirements of 42CFR 441 530(a)(1), including that: a) The setting is integrated in the greater community, and supports individuals to have full access to the greater community; b) Ensures the individual receives services in the community to the same degree of access as individuals not receiving Medicaid HOBS; c) The setting provides opportunities to seek employment, and work in competitive integrated settings; and d) The setting facilitates individual choice regarding services and supports, and who provides them. i) Quality Assurance and Service Evaluation: The County shall develop and have available an evaluation system to review services that are provided by subcontractors. The evaluation system will have both a Quality Assurance and a Quality Improvement component, and both must include objective measures. The objective measures at a minimum, will include performance indicators, by acuity, that include the number of new jobs; job loss. and reasons for job loss; the percentage employed earning minimum wage or better; and the average number of hours worked. This employment outcome information will be requested biannually of all subcontractors. The County's service evaluation system shall serve as the method by which current subcontractors demonstrate that they continue to be qualified providers. A copy of description of such evaluation system shall be provided upon request to DDA for review. j) Evaluation: The County shall evaluate and review services delivered to reasonably assure compliance and quality. The County shall conduct at least one (1) visit to each subcontractor during the biennium. The County shall maintain written documentation of all evaluations, recommendations, and corrective action plans for each subcontractor. Copies of such documentation will be provided to the DDA upon request. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 9 of 24 7/1/2021— 6/30/2022 k) The County shall work with local developmental disability advisory groups to plan for, and coordinate services. 1) The County shall participate in regularly scheduled meetings between County DD staff and DDA staff to remain updated and current including ACHS and Regional Meetings. Information from these scheduled meetings will be relayed to Subcontractors. m) AWA Data System: In compliance with the AWA Training Manual, the County shall use the AWA data system for all: 1) Billing requests; 2) Service provider address and phone number maintenance; 3) Evaluation dates; 4) Employment outcome information; and 5) Monthly provide all data described in the Billing Instructions and in the Employment Outcomes Instructions, which is hereby incorporated by reference. n) Assure the integrity of data submitted to the State. When data is submitted and rejected due to errors, or an error is later identified, the County will work with the Subcontractor so the County can correct and resubmit the data within thirty (30)days. o) The County will work with the Subcontractor to review and respond to the AWA "Work List" items within five (5) working days including referral(s) and pending authorization(s). p) The County will review the AWA `Ticklers" Planned Rate tab and update, the planned rate within five (5) working days after the planned rate start date. The County will relay any changes in planned rates to subcontractors. 7) Consideration a) Fees: 1) Approval of fees is the responsibility of the DDA. The DDA Region reserves the right to approve fees/rates for the services being provided. The County will submit a fee/rate schedule with the initial Program Agreement. The County will submit updated fee/rate schedules to the DDA Regional Employment Specialist for approval as changes occur. The rate schedule will include the following information: a) County(s) name; b) Time period for which the schedule is applicable; and c) Each contracted direct service (IE, GSE, CI, ITA, CDS) and its associated rate. 2) Fee Limitations: The DDA Billing Instructions found on the County Best Practices site provides limitations on the Hourly Rate for each direct service. Hourly rates must be divisible by four (4). b) Spending Plan,, attached as Exhibit C: 1) Budget amount listed in Exhibit C: The Subcontractor may not exceed the hourly rate indicated on the spending plan agreement included in Exhibit C. The spending plan may only be Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 10 of 24 7/1/2021— 6/30/2022 modified by mutual agreement of the parties in writing, and shall not require a program agreement. a) Spending Plan: DDA will provide the initial Spending Plan. Funding shall be distributed under planned expenditures as well as allocated under State and Medicaid, and shall function as a line item budget for expenditures under this agreement. The planned expenditures for consumer support are based on Client numbers as well as planned additional consumer services expenditures. b) Program Agreement Amendments: A County can request an amendment at any time. An amendment for additional client(s) may be supported when clients exceed the number used to develop the contract. An amendment for additional service hours authorized may be supported when the County provides evidence. An amendment request for expenditures exceeding contract total due to hourly rates paid to service provider may not be supported as the County is responsible to manage contract and rates paid to their providers. c) Exemptions: The DDA Assistant Secretary may approve in writing an exemption to a specific program agreement requirement. 8) Billing and Payment: a) Program Agreement Budget: DSHS shall pay the County all allowable costs, which are defined by DDA as cost incurred by the program for: 1) Administration: Costs of the County Human Services Department or similar county office, responsible for administration of the Developmental Disabilities Program. Allowable costs include personnel and overhead costs directly related to the administration and coordination of the program, including such activities as program planning, budgeting, contracting, monitoring, and evaluation. Also included are departmental and county indirect and/or direct administrative costs, to the extent that such costs are appropriately allocated to the program using an established methodology consistent with grants management guidelines. For a County whose designated coordinator manages multiple programs, the County must be able to provide evidence of the time the coordinator spent working on the Developmental Disabilities program. 2) Additional Consumer Services: a) Training: i) Staff Training: Costs incurred by the program for planned, structured activities for the purpose of providing, or improving, or enhancing job-related knowledge and skills of staff, providers, volunteers, or interning students in the provision of developmental disabilities services. ii) Board Training: Costs incurred by the program for planned, structured activities designed to provide, improve, or enhance program -related skills of board and advisory committee members. b) Community Information and Education: to inform and/or educate the general public about developmental disabilities and related services. These may include information and referral services; activities aimed at promoting public awareness and involvement; and community consultation, capacity building and organization activities. c) Other Activities: Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 11 of 24 7/1/2021— 6/30/2022 i) Infrastructure projects: Projects in support of Clients (services not easily tracked back toa specific working age Client) or that directly benefit a Client(s), but the Client is not of working age. Examples include planning services like benefits planning and generic job development e.g. "Project Search." ii) Start-up projects: Projects that support an agency or directly benefit the agency. Examples include equipment purchases, and agency administrative support. iii) Partnership project: Collaborative partnerships with school districts, employment providers, DVR, families, employers and other community collaborators needed to provide the employment supports and services young adults with developmental disabilities require to become employed during the school year when they turn twenty-one (21). Supports provided should compliment and not replace what the student(s) receive through the Individualized Education Program (IEP). 3) Consumer Support: a) Community Inclusion services are individualized services provided in atypical integrated community settings for individuals in retirement. Services will promote individualized skill development, independent living and .community integration for persons to learn how to actively and independently engage in their local community. Activities will provide opportunities to develop relationships and to learn, practice and apply skills that result in greater independence and community inclusion (per the Community Inclusion Billable Activities). b) Individual Supported Employment services are a part of an individual's pathway to employment, and are tailored to individual needs, interests, and abilities to promote career development. These are individualized services necessary to help persons with developmental disabilities obtain and continue integrated employment at or above the state's minimum wage in the general workforce. These services may include intake, discovery, assessment, job preparation, job marketing, job supports, record keeping and support to maintain a job (per the Individual Employment Phases & Billable Activities). c) Individualized Technical Assistance services are a part of an individual's pathway to employment. This service provides assessment and consultation to the employment provider to identify and address existing barriers to employment. This is in addition to supports received through supported employment services for individuals who have not yet achieved their employment goal. b) Reimbursement for the state fiscal year shall not exceed the total hourly amount listed in Exhibit C to this program agreement. However, with a program agreement amendment, the parties may increase or decrease the hourly program agreement amount. Counties will work with DDA HQ on amendments to the program agreement. c) Monthly Invoice with signed documentation: All requests for reimbursement amounts must be entered and posted into the AWA system. The County may post a combined claim of all programs/services covered by this program agreement. DSHS shall make all payments due to the County for all invoices submitted pursuant to this section within sixty (60) days following posting of required information. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 12 of 24 7/1/2021— 6/30/2022 d) Clients will be assisted in accessing DVR services per the DDA/DVR MOU. Client services shall not be reimbursed under this Program Agreement when the same services are paid for under the Rehabilitation Act of 1973 by DVR, Public Law 94-142, or any other source of public or private funding. e) Reimbursement of Client services: A claim for each individual is made on the AWA system by indicating the number of service units delivered to each individual listed and the fee per unit. Units are defined as: 1) An 'Hour" is at least fifty (50) minutes of direct service. Partial hour to the quarter may be recorded. f) Program Administration: The County will provide program administration and coordination includingsuch activities as planning, budgeting, contracting, monitoring, evaluation and may bill for administrative costs. Administrative costs reimbursement will not exceed 7% of the total combined allocation for consumer support and other consumer support services unless the Assistant Secretary of DDA approves a request for an exception under Chapter 388-850 WAC. Monthly claims for administrative costs will be 1/12 of the maximum administration amount. g) The Individual Employment Phases & Billable Activities document defines the individual Client services that DDA reimburses. That document is located on the DSHS DDA County Best Practices Web site at https://www.dshs.wa.gov/ddaIcountv-best-1)ractices. h) The Community Inclusion Billable activities document defines the individual Client services DDA reimburses. That document is located on the DSHS DDA County Best Practices Web site. i) Timeliness of, and Modification to Billings: All initial invoices with signed documentation must be received by the County within sixty (60) calendar days following the last day of the month in which the service is provided. Corrected invoices and documentation including re -posted billing information, will be accepted throughout the fiscal year if they are. received within sixty (60) calendar days of the associated fiscal year unless an extension is approved by the DDA Regional Administrator, or designee. Payment will not be made on any invoice submitted past sixty (60) calendar days after the program agreement fiscal year. j) Recovery of Fees: If the County bills and is paid fees for services that DSHS later finds were (a) notdelivered or (b) not delivered in accordance with program agreement standards, DSHS shall recover the fees for those services, and the Subcontractor shall fully cooperate during the recovery. 9) Intermediate Care Facilities for Intellectual Disabilities (ICF/ID) Agreement. If applicable per 42 CFR 483.410, the County shall assure that all county -operated or subcontracted programs serving persons living in ICF/ID facilities develop a plan and coordinate their services with the facility on behalf of the ICF/ID resident. DDA will supply to the County a list of ICF/ID residents who attend a day program. 10) Single State Medicaid Agency—Health Care Authority (HCA): HCA, as the single state Medicaid Agency, has administrative authority for Title XIX coverage per 42 CFR 431.10. DSHS is the operating agency for the Home and Community Based Waivers for services for people with developmental disabilities. The County only has responsibility for services covered in this agreement. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 13 of 24 7/1/2021— 6/30/2022 11) DSHS/DRW Access Agreement: The DRW February 27, 2001 Access Agreement with DDA is incorporated by reference. The County assures that it and its subcontractors have reviewed the access agreement. The agreement covers DRW's access to individuals with developmental disabilities, clients, programs and records, outreach activities, authority to investigate allegations of abuse and neglect, and other miscellaneous matters, and is binding for all providers of DDA contracted services. 12) Confidential Information. All subcontractors must: a) Ensure the security of confidential information, and b) When transporting client records containing confidential information outside a secure area, one or more of the following as appropriate: 1) Using a trusted network; or 2) Encrypting the confidential information, including: a) Email and/or email attachments; b) Confidential Information when it is stored on portable devices or media including but not limited to laptop computers and flash memory devices. 13) Data Security Requirements. Exhibit A shall only apply to the County if the County possesses one hundred fifty (150) ormore DSHS records across all programs or services throughout their organization, or transmits more than five (5) records at one time. 14) Supersession of Prior Data Security Agreement. If the parties hereto have previously entered into a standalone data security requirements agreement, both parties hereby agree that upon mutual execution said agreement shall take precedence as the sole data security agreement between the parties. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 14 of 24 7/1/2021— 6/30/2022 EXHIBIT B DATA SECURITY REQUIRMENTS 1) Definitions. The words and phrases listed below, as used in this exhibit, shall each have the following definitions: a) "AES" means. the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology (https://nvlpubs.nist.gov/nistpubs/FIPS/­ N IST.FIPS.197.pdf). b) "Authorized Users(s)" means individual(s) with a business need to access DSHS Confidential Information, and who has or have been authorized to do so. c) "Category 4 Data" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. For purposes of this contract, data classified as Category 4 refers to data protected- by: the Health Insurance Portability and Accountability Act (HIPAA). d) "Cloud" means data storage on servers hosted by an entity other than the Subcontractor and on a network outside the control of the County. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iCloud, Dropbox, Box.com, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, 0365, and Rackspace. e) "Encrypt" means to encode confidential information into a format that can only be read by those possessing a "key"; a password, digital certificate, or other mechanism available only to authorized users. Encryption must use a key length of at least one hundred twenty-eight 128 bits (256 preferred) for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard(AES) must be used if available. f) "Hardened Password" means a string of at least eight characters containing at least three (3) of the following four (4) character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. g) "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. h) "Multi -factor Authentication" means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PIN" means a personal identification number, a series of numbers which act as a password for a device. Since PINs are typically only four to six characters, PINs are usually used in conjunction with another factor of authentication, such as a fingerprint. i) "Portable Device" means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 15 of 24 7/1/2021— 6/30/2022 but are not limited to, mobile phones, tablets, and laptops. Mobile device is a subset of portable device. j) "Portable Media" means any machine-readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device. k) "Secure Area" means an area to which only authorized representatives of the entity possessing the confidential information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure areas may include buildings, rooms, or locked storage containers (such as a filing cabinet or desk drawer) within a room, if access to the confidential information is not available to unauthorized personnel. In otherwise secure areas, such as an office with restricted access, the data must be secured in such a way as to prevent access by non -authorized staff such as janitorial or facility security staff, when authorized Subcontractor staff are not present to ensure that non -authorized staff cannot access it. 1) "Trusted Network" means a network operated and maintained by the Subcontractor, which includes security controls sufficient to protect DSHS data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the data. m) "Unique User ID" means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. 2) Authority. The security requirements described in this document reflect the applicable requirements of Standard 141.10 (httr)s://ocio.wa-gov/policies) of the Office of the Chief Information Officer for the State of Washington, and of the DSHS Information Security Policy and Standards Manual. Reference material related to these requirements can be found here: https://www.dshs.wa.eov/ffa/keeping-dshs- client - information -private -and -secure, which is a site developed by the DSHS Information Security Office and hosted by DSHS Central Contracts and legal services. 3) Administrative Controls. The Subcontractor must have the following controls in place: a) A documented security policy governing the secure use of its computer network and systems, and which defines sanctions that may be applied to Subcontractor staff for violating that policy. b) If the data shared under this agreement is classified as Category 4 data, the Subcontractor must be aware of, and compliant with the applicable legal or regulatory requirements for that Category 4 Data. c) If confidential information shared under this agreement is classified as Category 4 data, the Subcontractor must have a documented risk assessment for the system(s) housing the Category 4 data. 4) Authorization, Authentication, and Access. To ensure that access to the data is limited to authorized staff, the subcontractor must: a) Have documented policies and procedures governing access to systems with the shared data. b) Restrict access through administrative, physical, and technical controls to authorized staff. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 16 of 24 7/1/2021— 6/30/2022 c) Ensure that user accounts are unique, and that any given user account logon ID and password combination is known only to the one (1) employee to whom that account is assigned. For purposes of non -repudiation, it must always be possible to determine which employee performed a given action on a system housing the data based solely on the logon ID used to perform the action. d) Ensure that only authorized users can access the data. e) Ensure that an employee's access to the data is removed immediately: 1) Upon suspected compromise of the user credentials; 2) When their employment, or the contract under which the data is made available to them, is terminated; 3) When they no longer need access to the data to fulfill the requirements of the contract. f) Have a process to periodically review and verify that only authorized users have access to systems containing DSHS confidential information. g) When accessing the data from within the Subcontractor's network (the data stays within the Subcontractor's network at all times), enforce password and logon requirements for users within the Subcontractor's network, including: 1) A minimum length of eight (8) characters and containing at least three (3) of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. 2) That a password does not contain a user's name, logon ID, or any form of their full name. 3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words. 4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. h) When accessing confidential information from an external location (the data will traverse the internet or otherwise travel outside the Subcontractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: 1) Ensuring mitigations applied to the system don't allow end-user modification; 2) Not allowing the use of dial-up connections; 3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix; 4) Encrypting all remote access traffic from the external workstation to a trusted network or to a component within the trusted network. The traffic must be always encrypted while traversing any network, including the internet, which is not a trusted network; 5) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than thirty (30) minutes of inactivity. 6) Ensuring use of multi -factor authentication to connect from the external end point to the internal end point. i) Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 17 of 24 7/1/2021— 6/30/2022 1) The PIN or password must be at least five (5) letters or numbers when used in conjunction with at least one (1) other authentication factor; 2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable); 3) Must not contain a "run" of three (3) or more consecutive numbers (12398, 98743 would not be acceptable). j) If the contract specifically allows for the storage of confidential information on a mobile device, passcodes used on the device must: 1) Be a minimum of six (6) alphanumeric characters; 2) Contain at least three (3) unique character classes (upper case, lower case, letter, number); 3) Not contain more than a three (3) consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. k) Render the device unusable after a maximum of ten (10) failed logon attempts. 5) Protection of Data. The subcontractor agrees to store data on one or more of the following media and protect the data as described: a) Hard disk drives. For data stored on local workstation hard disks, access to the data will be restricted to Authorized User(s) by requiring logon to the local workstation using a unique user ID and hardened password or other authentication mechanisms, which provide equal or greater security, such as biometrics or smart cards. b) Network server disks. For data stored on hard disks mounted on network servers and made available through shared folders, access to the data will be restricted to authorized users using access control lists which will grant access only after the authorized user has authenticated to the network using a unique user ID and hardened password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area, which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. c) For DSHS confidential information stored on these disks, deleting unneeded data is sufficient if the disks remain in a secure area and otherwise meet the requirements listed in the above paragraph. Destruction of the data, as outlined below under the heading: Data Disposition, may be deferred until the disks are retired, replaced, or otherwise taken out of the secure area. d) Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on optical discs which will be used in local workstation optical disc drives, and which will not be transported out of a secure area. When not in use for the contracted purpose, such discs must be stored in a secure area. Workstations which access DSHS data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e) Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by DSHS on optical discs which will be attached to network servers, and which will not be transported out of a secure area. Access to data on these discs will be restricted to authorized users using access control lists which will grant access only after the authorized user has authenticated to the network using a unique user ID and hardened password or other authentication mechanisms which provide Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 18 of 24 7/1/2021— 6/30/2022 equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area, which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. f) Paper documents. Any paper records must be protected by storing the records in a secure area, which is only accessible to authorized personnel. When not in use, such records must be stored in a secure area. g) Remote Access. Access to and use of the data over the State Governmental Network (SGN) or Secure Access Washington (SAW) will be controlled by DSHS staff who will issue authentication credentials (e.g. a unique user ID and hardened password) to authorized users on the County staff. The County will notify DSHS staff immediately whenever an authorized user in possession of such credentials is terminated or otherwise leaves the employment of the County, and whenever an authorized user's duties change such that the authorized user no longer requires access to perform work for this contract. h) Data storage on portable devices or media. 1) Except where otherwise specified herein, DSHS data shall not be stored by the Subcontractor on portable devices or media unless specifically authorized within the terms and conditions of the contract. If so authorized, the data shall be given the following protections: a) Encrypt the data; b) Control access to devices with a unique user ID and hardened password or stronger authentication method such as a physical token or biometrics; c) Manually lock devices whenever they are left unattended and set devices to lock automatically after a period of inactivity if this feature is available. Maximum period of inactivity is twenty (20) minutes; d) Apply administrative and physical security controls to portable devices and portable media by: i) Keeping them in a secure area when not in use, ii) Using check-in/check-out procedures when they are shared, and iii) Taking frequent inventories. 2) When being transported outside of a secure area, portable devices and portable media with DSHS confidential information must be under the physical control of Subcontractor staff with authorization to access the data, even if the data is encrypted. i) Data stored for backup purposes. 1) DSHS confidential information may be stored on portable media as part of a Subcontractor's existing documented backup process for business continuity or disaster recovery purposes. Such storage is authorized until such time as that media would be reused during the course of normal backup operations.- If. backup media is retired while DSHS confidential information still exists upon it, such media will be destroyed at that time in accordance with the disposition requirements below in the section labeled Data Disposition. 2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of a Subcontractor's existing documented backup process for business continuity or disaster recovery purposes. If so, such media will be protected as otherwise described in this exhibit. If this media is retired while DSHS confidential information still exists upon it, the data Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 19 of 24 7/1/2021— 6/30/2022 will be destroyed at that time in accordance with the disposition requirements listed below in the section called Data Disposition. j) Cloud Storage. DSHS confidential information requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of data is problematic as neither the County, DSHS nor the Subcontractor has control of the environment in which the data is stored. For this reason: 1) DSHS data will not be stored in any consumer grade cloud solution, unless all of the following conditions are met: a) Subcontractor has written procedures in place governing use of the cloud storage and the Subcontractor can attest to the contact listed in the contract and keep a copy of that attestation 'for your records in writing that all such procedures will be uniformly followed. b) The data will be encrypted while within the contractor network. c) The data will remain encrypted during transmission to the cloud. d) The data will remain encrypted at all times while residing within the cloud storage solution. e) The Subcontractor will possess a decryption key for the data, and the decryption key will be possessed only by the Subcontractor. f) The data will not be downloaded to non -authorized systems, meaning systems that are not on the Subcontractor network. g) The data will not be decrypted until downloaded onto a computer within the control of an authorized user, and within either the DSHS or Subcontractor's network. 2) Data will not be stored on an enterprise cloud storage solution unless either: a) The cloud storage provider is treated as any other Subcontractor, and agrees in writing to all of the requirements within this exhibit; or, b) The cloud storage solution used is HIPAA compliant. 3) If the data includes protected health information covered by the Health Insurance Portability and Accountability Act (HIPAA), the cloud provider must sign a Business Associate Agreement prior to data being stored in their cloud solution. 6) System Protection. To prevent compromise of systems which contain DSHS data or through which that data passes: a) Systems containing DSHS data must have all security patches or hotfixes applied within three (3) monthsof being made available. b) The Subcontractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes. c) Systems containing DSHS data shall have an anti-malware application, if available, installed. d) Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware database the system uses, will be no more than one update behind current. 7) Data Segregation. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 20 of 24 7/1/2021— 6/30/2022 a) DSHS category 4 data must be segregated or otherwise distinguishable from non-DSHS data. This is to ensure that when no longer needed by the Subcontractor, all DSHS data can be identified for return or destruction. It also aids in determining whether DSHS data has or may have been compromised in the event of a security breach. As such, one or more of the following methods will be used for data segregation: 1) DSHS data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non-DSHS data. 2) DSHS data will be stored in a logical container on electronic media, such as a partition or folder dedicated to DSHS data. 3) DSHS data will be stored in a database which will contain no non-DSHS data. 4) DSHS data will be stored within a database, and will be distinguishable from non-DSHS data by the value of a specific field or fields within database records. 5) When stored as physical paper documents, DSHS data will be physically segregated from non- DSHS data in a drawer, folder, or other container. b) When it is not feasible or practical to segregate DSHS data from non-DSHS data, then both the DSHS data and the non-DSHS data with which it is commingled, must be protected as described in this exhibit. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 21 of 24 7/1/2021— 6/30/2022 8) Data Disposition. When the contracted work has been completed, or when the data is no longer needed, except as noted above in Section 5.b, data shall be returned to DSHS or destroyed. Media on which data may be stored and associated acceptable methods of destruction are as follows: Data Stored on: Will be destroyed by: Server or workstation hard discs, or removable media (eg: floppies, USB flash drives, portable hard discs) excluding optical discs. Using a "wipe" utility which will overwrite the data at least three (3) times using either random or single character data, or Degaussing sufficiently to ensure that the data cannot be reconstructed, or physically destroying the disc. Paper documents with sensitive or confidential information. Recycling through a contracted firm, provided the contract with the recycler assures that the confidentiality of data will be protected. Paper documents containing confidential information requiring special handling (eg: protected health information) On-site shredding, pulping or incineration. Optical discs (eg: CDs or DVDs) Incineration, shredding, or completely defacing the readable surface with. a coarse abrasive. Magnetic tape Degaussing, incinerating or crosscut shredding. 9) Notification of Compromise or Potential Compromise. The compromise or potential compromise of DSHS shared data must be reported to the County contact designated in the contract within one (1) business day of discovery, and to the DSHS Privacy Officer at dshsprivacvofficerOdshs.w X Subcontractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DSHS. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 22 of 24 7/1/2021— 6/30/2022 10) Data shared with Subcontractors. If DSHS data provided under this contract is to be shared with a subcontractor, the contract with the subcontractor must include all of the data security provisions within this contract, and within any amendments, attachments, or exhibits within this contract. If the Subcontractor cannot protect the data as articulated within this contract, then the contract with the subcontractor must be submitted to the DSHS contact specified for this contract for review and approval. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 23 of 24 7/1/2021— 6/30/2022 SPENDING PLAN AGREEMENT EXHIBIT C The Subcontractor agrees to the following in satisfactorily performing the terms and conditions of this contract: a) Payment for Employment Services will be paid at an hourly rate of $ 84.00; b) Payment for Community Inclusion Services will be paid at an hourly rate of $39.00. c) Payment for services will be made on a fee-for-service basis unless otherwise specified in this agreement; d) No payment shall be made for any services rendered by the Subcontractor except for services within the scope of this agreement, and all funds received must be used for services as identified in this agreement; e) Except as provided in the section titled Reduction in Funding, all budget revisions shall be treated as agreement modifications. Grant & Adams County Developmental Disabilities Subcontractor Agreement Page 24 of 24 7/1/2021— 6/30/2022