HomeMy WebLinkAboutAgreements/Contracts - GRISK19-018 44
Washington State �
PROFESSIONAL SERVICES
HCA Contract Number: K3376
Health Care thonty
CONTRACT for
Resulting from Solicitation Number (If
applicable: NA
840 E. Plum Street
Fidelity Review Services
CONTRACTOR CONTACT
CONTRACTOR TELEPHONE CONTRACTOR E-MAIL ADDRESS
Gail Goodwin
ContractorNendor Contract Number:
THIS CONTRACT is made by and between Washington State Health Care Authority, (HCA) and Grant
County, (Contractor).
CONTRACTOR NAME
CONTRACTOR DOING BUSINESS AS (DBA)
Grant County
Grant Integrated Health
CONTRACTOR ADDRESS 1 Street
City State Zip Code
840 E. Plum Street
Moses Lake WA 98837
CONTRACTOR CONTACT
CONTRACTOR TELEPHONE CONTRACTOR E-MAIL ADDRESS
Gail Goodwin
509-765-9239 ggoddw(in@grantcountywa.gov
Is Contractor a Subrecipient under this Contract?
HCA CONTACT E-MAIL ADDRESS
CFDA NUMBER(S):
FFATA Form Recuired
❑YES ONO
7
93.958
❑YES ONO
Number: 102020562
HCA PROGRAM
SE/SH
HCA DIVISION/SECTION
DBHR/Supported Housing and Employment
HCA CONTACT NAME AND TITLE
HCA CONTACT ADDRESS
Health Care Authority
Lisa Bennett -Perry, Medical Program Assistance Specialist 3
626 8th Avenue SE
PO Box 45330
Olympia, WA 98504-5330
HCA CONTACT TELEPHONE
HCA CONTACT E-MAIL ADDRESS
(360) 725-1961
1 lisa.bennett-perry@hca.wa.gov
CONTRACT START DATE CONTRACT END DATE TOTAL MAXIMUM CONTRACT AMOUNT
02/01/2019 12/31/2019 $10,000
PURPOSE OF CONTRACT:
In implementing the Washington Medicaid Transformation Project, DBHR seeks to incentivize agencies to adhere to
the Evidence -Based Practices related to Permanent Supportive Housing (PSH) Services or Individual placement and
Supports (IPS) for Supported Employment (SE) Services. To this end, DBHR is promoting the performance of Fidelity
Reviews within Agencies and providing opportunities for the employees of Agencies to receive training through
observation and assistance at Fidelity Reviews being conducted at other FCS contracted agencies. The goal is to
expand and sustain the quality and availability of PSH and SE Services for those who are most vulnerable and to
increase the likelihood of creating outcomes that will support a continuation of these Services beyond the Transformation
Demonstration Project. This Contract provides funding to Agencies to incentivize participation in SH or SE Fidelity
Review activities as stated below in the Performance Work Statement.
The parties signing below warrant that they have read and understand this Contract, and have authority to
execute this Contract. This Contract will be binding on HCA only upon signature by HCA.
CTOR SIGNATURE PRINTED NAME AND TITLE DATE 51GNE
Tf Tom Taylor BOCC Chair Z�t ltd
NAT E PRINTED NAME AND TITLE DA E SGNE
Jim Gayton, HCA Contracts Administrator Z ��
Rev 4/20/2017
TABLE OF CONTENTS
1. STATEMENT OF WORK (SOW).................................................................................................. 3
2. DEFINITIONS............................................................................................................................... 3
3. SPECIAL TERMS AND CONDITIONS......................................................................................... 6
Attachments
Attachment 1: Confidential Information Security Requirements
Attachment 2: Federal Compliance, Certifications and Assurances
Attachment 3: Business Associates Agreement
Schedules
Schedule A: Statement of Work (SOW) Fidelity Review Services
Washington State 2 Description of Services
Health Care Authority
Contract #K3376 for Fidelity Review Services
IN CONSIDERATION of the mutual promises as set forth in this Contract, the parties agree as
follows:
STATEMENT OF WORK (SOW)
The Contractor will provide the services and staff as described in Schedule A: Statement of
Work.
2. DEFINITIONS
"Agency" means a behavioral health agency within the state of Washington that enters into
this contract to participate in a Fidelity Review of its existing PSH or SE services, or to assign
one of its Providers to participate in a Fidelity Review being conducted within another
behavioral health agency for purposes of learning the principles of EBP associated with PSH or
SE Services that are provided.
"Authorized Representative" means a person to whom signature authority has been
delegated in writing acting within the limits of his/her authority.
"Breach" means the unauthorized acquisition, access, use, or disclosure of Confidential
Information that compromises the security, confidentiality, or integrity of the Confidential
Information.
"Business Associate" means a Business Associate as defined in 45 CFR 160.103, who
performs or assists in the performance of an activity for or on behalf of HCA, a Covered Entity,
that involves the use or disclosure of protected health information (PHI). Any reference to
Business Associate in this DSA includes Business Associate's employees, agents, officers,
Subcontractors, third party contractors, volunteers, or directors.
"CFR" means the Code of Federal Regulations. All references in this Contract to CFR
chapters or sections include any successor, amended, or replacement regulation. The CFR
may be accessed at http://www.ecfr.gov/cgi-bin/EGFR?oa.ie=browse.
"Confidential Information" means information that may be exempt from disclosure to the
public or other unauthorized persons under chapter 42.56 RCW or chapter 70.02 RCW or other
state or federal statutes or regulations. Confidential Information includes, but is not limited to,
any information identifiable to an individual that relates to a natural person's health, (see also
Protected Health Information); finances, education, business, use or receipt of governmental
services, names, addresses, telephone numbers, social security numbers, driver license
numbers, financial profiles, credit card numbers, financial identifiers and any other identifying
numbers, law enforcement records, HCA source code or object code, or HCA or State security
information.
Washington State 3 Description of Services
Health Care Authority
"Consumer" means, per WAC 388.865.0150 a person who has applied for, is eligible for, or
who has received mental health services in the state of Washington.
"Contract" means this Contract document and all schedules, exhibits, attachments,
incorporated documents and amendments.
"Contractor" means the Contractor listed on page one (1) of this agreement, its employees
and agents. Contractor includes any firm, provider, organization, individual or other entity
performing services under this Contract. It also includes any Subcontractor retained by
Contractor as permitted under the terms of this Contract.
"Covered entity" means a health plan, a health care clearinghouse or a health care provider
who transmits any health information in electronic form to carry out financial or administrative
activities related to health care, as defined in 45 CFR 160.103.
"Data" means information produced, furnished, acquired, or used by Contractor in meeting
requirements under this Contract.
"Division of Behavioral Health and Recovery" or "DBHR" means the division within the
Health Care Authority that administers the state and Medicaid funded mental health programs
authorized by chapters 71.05, 71.24, 72.06.060 and 74.50 RCW.
"Effective Date" means the first date this Contract is in full force and effect. It may be a
specific date agreed to by the parties; or, if not so specified, the date of the last signature of a
party to this Contract.
"EBP" or "Evidence -Based Practice" refers to the SAMHSA Evidence -Based Practices that
have been rigorously tested, have yielded consistent, replicable results, and have proven safe,
beneficial, and effective for most people diagnosed with mental illness and substance use
disorders. As used in this Contract, EBPs relate to the CSS for PSH and to the IPS for SE.
"Fidelity Review" refers to a process for self-assessment of Agency's model of delivering
PSH or SE Services and a review of Agency's adherence to Evidence -Based Practices.
"Foundational Community Supports CS" program provides targeted Medicaid benefits to
assist eligible individuals with complex health needs obtain and maintain stable housing and
employment
"HCA Contract Manager" means the individual identified on the cover page of this Contract
who will provide oversight of the Contractor's activities conducted under this Contract.
"Health Care Authority" or "HCA" means the Washington State Health Care Authority, any
division, section, office, unit or other entity of HCA, or any of the officers or other officials
lawfully representing HCA.
"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at
45 CFR Parts 160 and Part 164.
Washington State 4 Description of Services
Health Care Authority
"Individual Placements and Supports" or "IPS" means an enhanced version of SAMHSA'S
Supported Employment Evidence-Based Practices Kit.
"Overpayment" means any payment or benefit to the Contractor in excess of that to which the
Contractor is entitled by law, rule, or this Contract, including amounts in dispute.
"PSH" or "Permanent Supportive Housing" means a SAMHSA Evidence-Based Practice
model for individuals experiencing homelessness who are also experiencing mental illness,
addiction, and other health conditions. Research and practice show that supportive housing
increases housing stability and reduces costs. The model consists of fidelity to six (6)
components/principles.
"Proprietary Information" means information owned by Contractor to which Contractor claims
a protectable interest under law. Proprietary Information includes, but is not limited to,
information protected by copyright, patent, trademark, or trade secret laws.
"Protected Health Information" or "PHI" means individually identifiable information that
relates to the provision of health care to an individual; the past, present, or future physical or
mental health or condition of an individual; or past, present, or future payment for provision of
health care to an individual, as defined in 45 CFR 160.103. Individually identifiable information
is information that identifies the individual or about which there is a reasonable basis to believe
it can be used to identify the individual, and includes demographic information. PHI is
information transmitted, maintained, or stored in any form or medium. 45 CFR 164.501. PHI
does not include education records covered by the Family Educational Rights and Privacy Act,
as amended, 20 USC 1232g(a)(4)(b)(iv).
"Provider" means an individual meeting the education and experience criteria for the provision
of Foundational Community Supports (FCS) Permanent Supportive Housing or Supported
Employment Services organization that employs such individual.
"RCW" means the Revised Code of Washington. All references in this Contract to RCW
chapters or sections include any successor, amended, or replacement statute. Pertinent RCW
chapters can be accessed at: http://apps.leg.wa..ov/rcw/.
"Statement of Work" or "SOW" means a detailed description of the work activities the
Contractor is required to perform under the terms and conditions of this Contract, including the
deliverables and timeline, and is Schedule A hereto.
"Subcontractor" means a person or entity that is not in the employment of the Contractor,
who is performing all or part of the business activities under this Contract under a separate
contract with Contractor. The term "Subcontractor' means subcontractor(s) of any tier.
"Subrecipient" means a contractor operating a federal or state assistance program receiving
federal funds and having the authority to determine both the services rendered and disposition
of program. See OMB Super Circular 2 CFR 200.501 and 45 CFR 75.501, "Uniform
Washington State 5 Description of Services
Health Care Authority
Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for
additional detail.
"SE" or "Supported Employment" means a SAMHSA Evidence -Based Practice built on
fidelity that includes eight (8) components/principles that are based in research. SE is also
known as the Individual Placement and Support model (IPS) and is effective in assisting
consumer obtain and maintain employment.
"USC" means the United States Code. All references in this Contract to USC chapters or
sections shall include any successor, amended, or replacement statute. The USC may be
accessed at http://uscode.house.gov/
"WAC" means the Washington Administrative Code. All references to WAC chapters or
sections will include any successor, amended, or replacement regulation. Pertinent WACs may
be accessed at: http://ai)p.leg.wa.gov/wac/.
3. SPECIAL TERMS AND CONDITIONS
3.1 PERFORMANCE EXPECTATIONS
Expected performance under this Contract includes, but is not limited to, the following:
3.1.1 Knowledge of applicable state and federal laws and regulations pertaining to subject
of contract;
3.1.2 Use of professional judgment;
3.1.3 Collaboration with HCA staff in Contractor's conduct of the services;
3.1.4 Conformance with HCA directions regarding the delivery of the services;
3.1.5 Timely, accurate and informed communications;
3.1.6 Regular completion and updating of project plans, reports, documentation and
communications;
3.1.7 Regular, punctual attendance at all meetings; and
3.1.8 Provision of high quality services.
Prior to payment of invoices, HCA will review and evaluate the performance of Contractor
in accordance with Contract and these performance expectations and may withhold
payment if expectations are not met or Contractor's performance is unsatisfactory.
Washington State 6 Description of Services
Health Care Authority
3.2 TERM
3.2.1 The initial term of the Contract will commence on 02/01/2019, or date of last
signature, whichever is later, and continue through 12/31/19, unless terminated
sooner as provided herein.
3.2.2 This Contract may be extended in whatever time increments HCA deems
appropriate. No change in terms and conditions will be permitted during these
extensions unless specifically agreed to in writing.
3.2.3 Work performed without a contract or amendment signed by the authorized
representatives of both parties will be at the sole risk of the Contractor. HCA will not
pay any costs incurred before a contract or any subsequent amendment(s) is fully
executed.
3.3 COMPENSATION
The Maximum Compensation payable to Contractor for the performance of all things
necessary for or incidental to the performance of work as set forth in Section 1:
Performance Work Statement is $10,000, and includes any allowable expenses and
based on the following:
3.3.1 Contractor's compensation for services rendered will be based on the following
rates or in accordance with the following terms.
3.3.2 Federal funds disbursed through this Contract were received by HCA through OMB
Catalogue of Federal Domestic Assistance (CFDA) Number: 93.958, SAMHSA,
SM010056, MHBG. Contractor agrees to comply with applicable rules and
regulations associated with these federal funds and has signed Attachment 2:
Federal Compliance, Certification and Assurances, attached.
3.4 INVOICE AND PAYMENT
3.4.1 Contractor must submit accurate invoices to the following address for all amounts to
be paid by HCA via e-mail to: AcctspayCa_hca.wa.cwv. Include the HCA Contract
number in the subject line of the email.
3.4.2 Invoices must describe and document to HCA's satisfaction a description of the
work performed, the progress of the project, and fees. If expenses are invoiced,
invoices must provide a detailed breakdown of each type. Any single expense in the
amount of $50.00 or more must be accompanied by a receipt in order to receive
reimbursement. All invoices will be reviewed and must be approved by the Contract
Manager or his/her designee prior to payment.
3.4.3 Contractor must submit properly itemized invoices to include the following
information, as applicable:
Washington State 7 Description of Services
Health Care Authority
3.4.3.1 HCA Contract number K3376;
3.4.3.2 Contractor name, address, phone number;
3.4.3.3 Description of Services;
3.4.3.4 Date(s) of delivery;
3.4.3.5 Net invoice price for each item;
3.4.3.6 Applicable taxes;
3.4.3.7 Total invoice price; and
3.4.3.8 Payment terms and any available prompt payment discount.
3.4.4 HCA will return incorrect or incomplete invoices to the Contractor for correction and
reissue. The Contract Number must appear on all invoices, bills of lading,
packages, and correspondence relating to this Contract.
3.4.5 In order to receive payment for services or products provided to a state agency,
Contractor must register with the Statewide Payee Desk at
http://des wa gov/services/ContractingPurchasing/Business/VendorPav/Pages/defa
ult.asox. Payment will be considered timely if made by HCA within thirty (30)
calendar days of receipt of properly completed invoices. Payment will be directly
deposited in the bank account or sent to the address Contractor designated in its
registration.
3.4.6 Upon expiration of the Contract, any claims for payment for costs due and payable
under this Contract that are incurred prior to the expiration date must be submitted
by the Contractor to HCA within sixty (60) calendar days after the Contract
expiration date. HCA is under no obligation to pay any claims that are submitted
sixty-one (61) or more calendar days after the Contract expiration date ("Belated
Claims"). HCA will pay Belated Claims at its sole discretion, and any such potential
payment is contingent upon the availability of funds.
3.5 CONTRACTOR AND HCA CONTRACT MANAGERS
3.5.1 Contractor's Contract Manager will have prime responsibility and final authority for
the services provided under this Contract and be the principal point of contact for
the HCA Contract Manager for all business matters, performance matters, and
administrative activities.
3.5.2 HCA's Contract Manager is responsible for monitoring the Contractor's performance
and will be the contact person for all communications regarding contract
performance and deliverables. The HCA Contract Manager has the authority to
accept or reject the services provided and must approve Contractor's invoices prior
to payment.
Washington State 8 Description of Services
Health Care Authority
3.5.3 The contact information provided below may be changed by written notice of the
change (email acceptable) to the other party.
CONTRACTOR
Health Care Authority
Contract Manager Information
Contract Manager Information
Name:
Gail Goodwin
Name:
Lisa Bennett -Perry
Medical Assistance Program
Title:
Title:
Specialist 3
840 E.Plum Street; Moses
Post Office Box 45330
Address:
Lake, WA 98837
Address:
Olympia, WA 98504-5330
Phone:
509-765-9239
Phone:
360-725-1961
Email:
ggoodwin@grantcountywa.gov
11
Email:
lisa.bennett-perry@hca.wa.gov
3.6 LEGAL NOTICES
Any notice or demand or other communication required or permitted to be given under this
Contract or applicable law is effective only if it is in writing and signed by the applicable
party, properly addressed, and delivered in person,via email, or by a recognized courier
service, or deposited with the United States Postal Service as first-class mail, postage
prepaid certified mail, return receipt requested, to the parties at the addresses provided in
this section.
3.6.1 In the case of notice to the Contractor:
Gail Goodwin
Grant County
840 E. Plum Street
Moses Lake, WA 98837
3.6.2 In the case of notice to HCA:
Attention: Contracts Administrator
Health Care Authority
Division of Legal Services
Post Office Box 42702
Olympia, WA 98504-2702
3.6.3 Notices are effective upon receipt or four (4) Business Days after mailing, whichever
is earlier.
3.6.4 The notice address and information provided above may be changed by written
notice of the change given as provided above.
Washington State 9 Description of Services
Health Care Authority
3.7 INCORPORATION OF DOCUMENTS AND ORDER OF PRECEDENCE
Each of the documents listed below is by this reference incorporated into this Contract. In
the event of an inconsistency, the inconsistency will be resolved in the following order of
precedence:
3.7.1 Applicable Federal and State of Washington statutes and regulations;
3.7.2 Recitals
3.7.3 Special Terms and Conditions;
3.7.4 General Terms and Conditions — DSHS Contract #1783-86421;
3.7.5 Attachment 1: Confidential Information Security Requirements;
3.7.6 Attachment 2: Federal Compliance, Certifications and Assurances;
3.7.7 Attachment 3: Business Associates Agreement;
3.7.8 Schedule A(s): Statement(s) of Work; and
3.7.9 Any other provision, term or material incorporated herein by reference or otherwise
incorporated.
Approved as to Form:
This contract format was approved by
the Office of the Attorney General.
Approval on file.
Washington State 10 Description of Services
Health Care Authority
Attachment 1
Confidential Information Security Requirements
1. Definitions
In addition to the definitions set out in Section 2 of this Contract K3376 for Fidelity Review
Services, the definitions below apply to this Attachment.
a. "Hardened Password" means a string of characters containing at least three of the
following character classes: upper case letters; lower case letters; numerals; and
special characters, such as an asterisk, ampersand or exclamation point.
Passwords for external authentication must be a minimum of 10 characters
long.
Passwords for internal authentication must be a minimum of 8 characters
long.
iii. Passwords used for system service or service accounts must be a minimum
of 20 characters long.
"Portable/Removable Media" means any Data storage device that can be detached or
removed from a computer and transported, including but not limited to: optical media
(e.g. CDs, DVDs); USB drives; or flash media (e.g. CompactFlash, SD, MMC).
c. "Portable/Removable Devices" means any small computing device that can be
transported, including but not limited to: handhelds/PDAs/Smartphones; Ultramobile
PC's, flash memory devices (e.g. USB flash drives, personal media players); and
laptops/notebook/tablet computers. If used to store Confidential Information, devices
should be Federal Information Processing Standards (FIPS) Level 2 compliant.
d. "Secured Area" means an area to which only Authorized Users have access. Secured
Areas may include buildings, rooms, or locked storage containers (such as a filing
cabinet) within a room, as long as access to the Confidential Information is not
available to unauthorized personnel.
e. "Transmitting" means the transferring of data electronically, such as via email, SFTP,
webservices, AWS Snowball, etc.
f. "Trusted System(s)" means the following methods of physical delivery: (1) hand -
delivery by a person authorized to have access to the Confidential Information with
written acknowledgement of receipt; (2) United States Postal Service ("USPS") first
class mail, or USPS delivery services that include Tracking, such as Certified Mail,
Express Mail or Registered Mail; (3) commercial delivery services (e.g. FedEx, UPS,
DHL) which offer tracking and receipt confirmation; and (4) the Washington State
Campus mail system. For electronic transmission, the Washington State
Washington State Page 11 of 36 Health Care Authority
Governmental Network (SGN) is a Trusted System for communications within that
Network.
g. "Unique User ID" means a string of characters that identifies a specific user and which,
in conjunction with a password, passphrase, or other mechanism, authenticates a user
to an information system.
2. Confidential Information Transmitting
a. When transmitting HCA's Confidential Information electronically, including via email,
the Data must be encrypted using NIST 800 -series approved algorithms
(http://csrc.nist.gov/publications/PubsSPs.html). This includes transmission over the
public internet.
b. When transmitting HCA's Confidential Information via paper documents, the Receiving
Party must use a Trusted System.
3. Protection of Confidential Information
The Contractor agrees to store Confidential Information as described:
a. Data at Rest:
Data will be encrypted with NIST 800 -series approved algorithms. Encryption
keys will be stored and protected independently of the data. Access to the Data
will be restricted to Authorized Users through the use of access control lists, a
Unique User ID, and a Hardened Password, or other authentication mechanisms
which provide equal or greater security, such as biometrics or smart cards.
Systems which contain or provide access to Confidential Information must be
located in an area that is accessible only to authorized personnel, with access
controlled through use of a key, card key, combination lock, or comparable
mechanism.
Data stored on Portable/Removable Media or Devices:
• Confidential Information provided by HCA on Removable Media will be
encrypted with NIST 800 -series approved algorithms. Encryption keys will
be stored and protected independently of the Data.
HCA's data must not be stored by the Receiving Party on Portable Devices
or Media unless specifically authorized within the Data Share Agreement. If
so authorized, the Receiving Party must protect the Data by:
1. Encrypting with NIST 800 -series approved algorithms. Encryption
keys will be stored and protected independently of the data;
Washington State Page 12 of 36 Health Care Authority
2. Control access to the devices with a Unique User ID and Hardened
Password or stronger authentication method such as a physical token
or biometrics;
3. Keeping devices in locked storage when not in use;
4. Using check-in/check-out procedures when devices are shared;
5. Maintain an inventory of devices; and
6. Ensure that when being transported outside of a Secured Area, all
devices with Data are under the physical control of an Authorized
User.
b. Paper documents. Any paper records containing Confidential Information must be
protected by storing the records in a Secured Area that is accessible only to authorized
personnel. When not in use, such records must be stored in a locked container, such
as a file cabinet, locking drawer, or safe, to which only authorized persons have
access.
4. Confidential Information Segregation
HCA Confidential Information received under this Contract must be segregated or
otherwise distinguishable from non -HCA data. This is to ensure that when no longer
needed by the Contractor, all HCA Confidential Information can be identified for return or
destruction. It also aids in determining whether HCA Confidential Information has or may
have been compromised in the event of a security Breach.
a. The HCA Confidential Information must be kept in one of the following ways:
on media (e.g. hard disk, optical disc, tape, etc.) which will contain only HCA
Data; or
ii. in a logical container on electronic media, such as a partition or folder
dedicated to HCA's Data; or
iii. in a database that will contain only HCA Data; or
iv. within a database and will be distinguishable from non -HCA Data by the
value of a specific field or fields within database records; or
when stored as physical paper documents, physically segregated from non -
HCA Data in a drawer, folder, or other container.
b. When it is not feasible or practical to segregate HCA Confidential Information from
non -HCA data, then both the HCA Confidential Information and the non -HCA data
with which it is commingled must be protected as described in this Attachment.
Washington State Page 13 of 36 Health Care Authority
5. Confidential Information Shared with Subcontractors
If HCA Confidential Information provided under this Contract is to be shared with a
Subcontractor, the contract with the Subcontractor must include all of the Confidential
Information Security Requirements.
6. Confidential Information Disposition
When the Confidential Information is no longer needed, except as noted below, the
Confidential Information must be returned to HCA or destroyed. Media are to be destroyed
using a method documented within NIST 800-88
(http://csrc.nist.gov/publications/PubsSPs.htmi).
a. For HCA's Confidential Information stored on network disks, deleting unneeded
Confidential Information is sufficient as long as the disks remain in a Secured Area
and otherwise meet the requirements listed in Section 3, above. Destruction of the
Confidential Information as outlined in this section of this Attachment may be
deferred until the disks are retired, replaced, or otherwise taken out of the Secured
Area.
Washington State Page 14 of 36 Health Care Authority
ATTACHMENT 2
FEDERAL COMPLIANCE, CERTIFICATIONS, AND ASSURANCES
In the event federal funds are included in this agreement, the following sections apply: I. Federal Compliance
and 11. Standard Federal Assurances and Certifications. In the instance of inclusion of federal funds, the
Contractor may be designated as a sub -recipient and the effective date of the amendment shall also be the
date at which these requirements go into effect.
FEDERAL COMPLIANCE - The use of federal funds requires additional compliance and control
mechanisms to be in place. The following represents the majority of compliance elements that may apply
to any federal funds provided under this contract. For clarification regarding any of these elements or
details specific to the federal funds in this contract, contact: Lisa Bennett -Perry
a. Source of Funds: This agreement is being funded partially or in full through Cooperative Agreement
number SM010056, the full and complete terms and provisions of which are hereby incorporated into
this agreement can be found by reference in Exhibit C. Federal funds to support this agreement are
identified by the Catalog of Federal Domestic Assistance (CFDA) number 93.958 and amount to
$10,000. The sub-awardee is responsible for tracking and reporting the cumulative amount expended
under HCA Contract No. K3376.
b. Period of Availability of Funds: Pursuant to 45 CFR 92.23, Sub-awardee may charge to the award
only costs resulting from obligations of the funding period specified in SMO 10056, unless carryover of
unobligated balances is permitted, in which case the carryover balances may be charged for costs
resulting from obligations of the subsequent funding period. All obligations incurred under the award
must be liquidated no later than 90 days after the end of the funding period.
c. Single Audit Act: A sub-awardee (including private, for-profit hospitals and non-profit institutions)
shall adhere to the federal Office of Management and Budget (OMB) Super Circular 2 CFR 200.501
and 45 CFR 75.501. A sub-awardee who expends $750,000 or more in federal awards during a
given fiscal year shall have a single or program -specific audit for that year in accordance with the
provisions of OMB Super Circular 2 CFR 200.501 and 45 CFR 75.501.
d. Modifications: This agreement may not be modified or amended, nor may any term or provision be
waived or discharged, including this particular Paragraph, except in writing, signed upon by both
parties.
1. Examples of items requiring Health Care Authority prior written approval include, but are not
limited to, the following:
i. Deviations from the budget and Project plan.
ii. Change in scope or objective of the agreement.
iii. Change in a key person specified in the agreement.
iv. The absence for more than three months or a 25% reduction in time by the Project
Manager/Director.
v. Need for additional funding.
vi. Inclusion of costs that require prior approvals as outlined in the appropriate cost principles.
vii. Any changes in budget line item(s) of greater than twenty percent (20%) of the total budget
in this agreement.
2. No changes are to be implemented by the Sub-awardee until a written notice of approval is
received from the Health Care Authority.
e. Sub -Contracting: The sub-awardee shall not enter into a sub -contract for any of the work performed
under this agreement without obtaining the prior written approval of the Health Care Authority. If sub-
contractors are approved by the Health Care Authority, the subcontract, shall contain, at a minimum,
Washington State Page 15 of 36 Health Care Authority
sections of the agreement pertaining to Debarred and Suspended Vendors, Lobbying certification,
Audit requirements, and/or any other project Federal, state, and local requirements.
f. Condition for Receipt of Health Care Authority Funds: Funds provided by Health Care Authority to the
sub-awardee under this agreement may not be used by the sub-awardee as a match or cost-sharing
provision to secure other federal monies without prior written approval by the Health Care Authority.
g. Unallowable Costs: The sub-awardees' expenditures shall be subject to reduction for amounts
included in any invoice or prior payment made which determined by HCA not to constitute allowable
costs on the basis of audits, reviews, or monitoring of this agreement.
h. Citizenship/Alien Verification/Determination: The Personal Responsibility and Work Opportunity
Reconciliation Act (PRWORA) of 1996 (PL 104-193) states that federal public benefits should be
made available only to U.S. citizens and qualified aliens. Entities that offer a service defined as a
"federal public benefit" must make a citizenship/qualified alien determination/ verification of applicants
at the time of application as part of the eligibility criteria. Non -US citizens and unqualified aliens are
not eligible to receive the services. PL 104-193 also includes specific reporting requirements.
i. Federal Compliance: The sub-awardee shall comply with all applicable State and Federal statutes,
laws, rules, and regulations in the performance of this agreement, whether included specifically in this
agreement or not.
Civil Rights and Non -Discrimination Obligations During the performance of this agreement, the
Contractor shall comply with all current and future federal statutes relating to nondiscrimination.
These include but are not limited to: Title VI of the Civil Rights Act of 1964 (PL 88-352), Title IX of the
Education Amendments of 1972 (20 U.S.C. §§ 1681-1683 and 1685-1686), section 504 of the
Rehabilitation Act of 1973 (29 U.S.C. § 794), the Age Discrimination Act of 1975 (42 U.S.C. §§ 6101-
6107), the Drug Abuse Office and Treatment Act of 1972 (PL 92-255), the Comprehensive Alcohol
Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970 (PL 91-616), §§523 and
527 of the Public Health Service Act of 1912 (42 U.S.C. §§290dd-3 and 290ee-3), Title VIII of the Civil
Rights Act of 1968 (42 U.S.C. §§3601 et seq.), and the Americans with Disability Act (42 U.S.C.,
Section 12101 et seq.) http://www.hhs.gov/ocr/civilrights
HCA Federal Compliance Contact Information
Federal Grants and Budget Specialist
Health Care Policy
Washington State Health Care Authority
Post Office Box 42710
Olympia, Washington 98504-2710
II. CIRCULARS `COMPLIANCE MATRIX' - The following compliance matrix identifies the OMB Circulars
that contain the requirements which govern expenditure of federal funds. These requirements apply to
the Washington State Health Care Authority (HCA), as the primary recipient of federal funds and then
follow the funds to the sub-awardee, listed on page one (1) of this contract. The federal Circulars which
provide the applicable administrative requirements, cost principles and audit requirements are identified
by sub-awardee organization type.
Washington State Page 16 of 36 Health Care Authority
OMB CIRCULAR
ENTITY TYPE
ADMINISTRATIVE
I COST
AUDIT REQUIREMENTS
REQUIREMENTS
PRINCIPLES
State. Local and Indian Tribal
OMB Super Circular 2 CFR 200.501 and 45 CFR 75.501
Governments and
Governmental Hospitals
Non -Profit Organizations and
Non -Profit Hospitals
Washington State Page 16 of 36 Health Care Authority
Colleges or Universities and
Affiliated Hospitals
For -Profit Organizations
Definitions:
"Sub -recipient"; means the legal entity to which a sub -award is made and which is accountable to the State for the
use of the funds provided in carrying out a portion of the State's programmatic effort under a sponsored project. The
term may include institutions of higher education, for-profit corporations or non -U.S. Based entities.
"Sub -award and Sub -grant' are used interchangeably and mean a lower tier award of financial support from a
prime awardee (e.g., Washington State Health Care Authority) to a Sub -recipient for the performance of a substantive
portion of the program. These requirements do not apply to the procurement of goods and services for the benefit of
the Washington State Health Care Authority.
IV. STANDARD FEDERAL CERTIFICATIONS AND ASSURANCES - Following are the Assurances,
Certifications, and Special Conditions that apply to all federally funded (in whole or in part) agreements
administered by the Washington State Health Care Authority.
CERTIFICATIONS
1. CERTIFICATION REGARDING
DEBARMENT AND SUSPENSION
The undersigned (authorized official signing for
the contracting organization) certifies to the best
of his or her knowledge and belief, that the
contractor, defined as the primary participant in
accordance with 45 CFR Part 76, and its
principals:
a) are not presently debarred, suspended,
proposed for debarment, declared ineligible,
or voluntarily excluded from covered
transactions by any Federal Department or
agency;
b) have not within a 3 -year period preceding this
contract been convicted of or had a civil
judgment rendered against them for
commission of fraud or a criminal offense in
connection with obtaining, attempting to
obtain, or performing a public (Federal, State,
or local) transaction or contract under a
public transaction; violation of Federal or
State antitrust statutes or commission of
embezzlement, theft, forgery, bribery,
falsification or destruction of records, making
false statements, or receiving stolen
property;
d) have not within a 3 -year period preceding this
contract had one or more public transactions
(Federal, State, or local) terminated for cause
or default.
Should the contractor not be able to provide this
certification, an explanation as to why should be
placed after the assurances page in the contract.
The contractor agrees by signing this contract
that it will include, without modification, the clause
titled "Certification Regarding Debarment,
Suspension, In eligibility, and Voluntary
Exclusion --Lower Tier Covered Transactions" in
all lower tier covered transactions (i.e.,
transactions with sub -grantees and/or
contractors) and in all solicitations for lower tier
covered transactions in accordance with 45 CFR
Part 76.
2. CERTIFICATION REGARDING DRUG-
FREE WORKPLACE REQUIREMENTS
The undersigned (authorized official signing for
the contracting organization) certifies that the
contractor will, or will continue to, provide a drug-
free workplace in accordance with 45 CFR Part
76 by:
c) are not presently indicted or otherwise
criminally or civilly charged by a a) Publishing a statement notifying employees
governmental entity (Federal, State, or local) that the unlawful manufacture, distribution,
with commission of any of the offenses dispensing, possession or use of a controlled
enumerated in paragraph (b) of this substance is prohibited in the grantee's
certification; and workplace and specifying the actions that will
Washington State Page 17 of 36 Health Care Authority
be taken against employees for violation of
such prohibition;
b) Establishing an ongoing drug-free awareness
program to inform employees about
(1) The dangers of drug abuse in the
workplace;
(2) The contractor's policy of maintaining a
drug-free workplace;
(3) Any available drug counseling,
rehabilitation, and employee assistance
programs; and
(4) The penalties that may be imposed upon
employees for drug abuse violations
occurring in the workplace;
c) Making it a requirement that each employee
to be engaged in the performance of the
contract be given a copy of the statement
required by paragraph (a) above;
d) Notifying the employee in the statement
required by paragraph (a), above, that, as a
condition of employment under the contract,
the employee will—
(1) Abide by the terms of the statement; and
(2) Notify the employer in writing of his or her
conviction for a violation of a criminal drug
statute occurring in the workplace no later
than five calendar days after such conviction;
e) Notifying the agency in writing within ten
calendar days after receiving notice under
paragraph (d)(2) from an employee or
otherwise receiving actual notice of such
conviction. Employers of convicted
employees must provide notice, including
position title, to every contract officer or other
designee on whose contract activity the
convicted employee was working, unless the
Federal agency has designated a central
point for the receipt of such notices. Notice
shall include the identification number(s) of
each affected grant;
f) Taking one of the following actions, within 30
calendar days of receiving notice under
paragraph (d) (2), with respect to any
employee who is so convicted—
(1) Taking appropriate personnel action
against such an employee, up to
and including termination,
consistent with the requirements of
the Rehabilitation Act of 1973, as
amended; or
(2) Requiring such employee to
participate satisfactorily in a drug
abuse assistance or rehabilitation
program approved for such
purposes by a Federal, State, or
local health, law enforcement, or
other appropriate agency;
g) Making a good faith effort to continue to
maintain a drug-free workplace through
implementation of paragraphs (a), (b), (c),
(d), (e), and (f).
For purposes of paragraph (e) regarding agency
notification of criminal drug convictions, Authority
has designated the following central point for
receipt of such notices:
Legal Services Manager
WA State Health Care Authority
PO Box 42700
Olympia, WA 98504-2700
3. CERTIFICATION REGARDING LOBBYING
Title 31, United States Code, Section 1352,
entitled "Limitation on use of appropriated funds
to influence certain Federal contracting and
financial transactions," generally prohibits
recipients of Federal grants and cooperative
agreements from using Federal (appropriated)
funds for lobbying the Executive or Legislative
Branches of the Federal Government in
connection with a SPECIFIC grant or cooperative
agreement. Section 1352 also requires that each
person who requests or receives a Federal grant
or cooperative agreement must disclose lobbying
undertaken with non -Federal (nonappropriated)
funds. These requirements apply to grants and
cooperative agreements EXCEEDING $100,000
in total costs (45 CFR Part 93).
The undersigned (authorized official signing for
the contracting organization) certifies, to the best
of his or her knowledge and belief, that:
(1) No Federal appropriated funds have been
paid or will be paid, by or on behalf of the
undersigned, to any person for influencing or
attempting to influence an officer or
employee of any agency, a Member of
Congress, an officer or employee of
Congress, or an employee of a Member of
Congress in connection with the awarding of
any Federal contract, the making of any
Washington State Page 18 of 36 Health Care Authority
Federal grant, the making of any Federal
loan, the entering into of any cooperative
agreement, and the extension, continuation,
renewal, amendment, or modification of any
Federal contract, grant, loan, or cooperative
agreement.
(2) If any funds other than Federally
appropriated funds have been paid or will be
paid to any person for influencing or
attempting to influence an officer or
employee of any agency, a Member of
Congress, an officer or employee of
Congress, or an employee of a Member of
Congress in connection with this Federal
contract, grant, loan, or cooperative
agreement, the undersigned shall complete
and submit Standard Form -LLL, "Disclosure
of Lobbying Activities," in accordance with
its instructions. (If needed, Standard Form -
LLL, "Disclosure of Lobbying Activities," its
instructions, and continuation sheet are
included at the end of this application form.)
(3) The undersigned shall require that the
language of this certification be included in
the award documents for all subcontracts at
all tiers (including subcontracts,
subcontracts, and contracts under grants,
loans and cooperative agreements) and that
all sub -recipients shall certify and disclose
accordingly.
This certification is a material representation of fact
upon which reliance was placed when this
transaction was made or entered into. Submission
of this certification is a prerequisite for making or
entering into this transaction imposed by Section
1352, U.S. Code. Any person who fails to file the
required certification shall be subject to a civil
penalty of not less than $10,000 and not more than
$100,000 for each such failure.
4. CERTIFICATION REGARDING PROGRAM
FRAUD CIVIL REMEDIES ACT (PFCRA)
The undersigned (authorized official signing for
the contracting organization) certifies that the
statements herein are true, complete, and
accurate to the best of his or her knowledge, and
that he or she is aware that any false, fictitious, or
fraudulent statements or claims may subject him
or her to criminal, civil, or administrative
penalties. The undersigned agrees that the
contracting organization will comply with the
Public Health Service terms and conditions of
award if a contract is awarded.
5. CERTIFICATION REGARDING
ENVIRONMENTAL TOBACCO SMOKE
Public Law 103-227, also known as the Pro -
Children Act of 1994 (Act), requires that smoking
not be permitted in any portion of any indoor
facility owned or leased or contracted for by an
entity and used routinely or regularly for the
provision of health, day care, early childhood
development services, education or library
services to children under the age of 18, if the
services are funded by Federal programs either
directly or through State or local governments, by
Federal grant, contract, loan, or loan guarantee.
The law also applies to children's services that
are provided in indoor facilities that are
constructed, operated, or maintained with such
Federal funds. The law does not apply to
children's services provided in private residence,
portions of facilities used for inpatient drug or
alcohol treatment, service providers whose sole
source of applicable Federal funds is Medicare or
Medicaid, or facilities where WIC coupons are
redeemed.
Failure to comply with the provisions of the law
may result in the imposition of a civil monetary
penalty of up to $1,000 for each violation and/or
the imposition of an administrative compliance
order on the responsible entity.
By signing the certification, the undersigned
certifies that the contracting organization will
comply with the requirements of the Act and will
not allow smoking within any portion of any indoor
facility used for the provision of services for
children as defined by the Act.
The contracting organization agrees that it will
require that the language of this certification be
included in any subcontracts which contain
provisions for children's services and that all sub -
recipients shall certify accordingly.
The Public Health Services strongly
encourages all recipients to provide a
smoke-free workplace and promote the non-
use of tobacco products. This is consistent
with the PHS mission to protect and advance
the physical and mental health of the
American people.
6. CERTIFICATION REGARDING
DEBARMENT, SUSPENSION, AND
Washington State Page 19 of 36 Health Care Authority
1)
2)
3)
4)
5)
6)
OTHER RESPONSIBILITY MATTERS
INSTRUCTIONS FOR CERTIFICATION
By signing and submitting this proposal, the
prospective contractor is providing the
certification set out below.
The inability of a person to provide the
certification required below will not
necessarily result in denial of participation in
this covered transaction. The prospective
contractor shall submit an explanation of why
it cannot provide the certification set out
below. The certification or explanation will be
considered in connection with the department
or agency's determination whether to enter
into this transaction. However, failure of the
prospective contractor to furnish a
certification or an explanation shall disqualify
such person from participation in this
transaction.
The certification in this clause is a material
representation of fact upon which reliance
was placed when the department or agency
determined to enter into this transaction. If it
is later determined that the prospective
contractor knowingly rendered an erroneous
certification, in addition to other remedies
available to the Federal Government, the
department or agency may terminate this
transaction for cause of default.
The prospective contractor shall provide
immediate written notice to the department or
agency to whom this contract is submitted if
at any time the prospective contractor learns
that its certification was erroneous when
submitted or has become erroneous by
reason of changed circumstances.
The terms covered transaction, debarred,
suspended, ineligible, lower tier covered
transaction, participant, person, primary
covered transaction, principal, proposal, and
voluntarily excluded, as used in this clause,
have the meanings set out in the Definitions
and Coverage sections of the rules
implementing Executive Order 12549. You
may contact the person to whom this contract
is submitted for assistance in obtaining a
copy of those regulations.
The prospective contractor agrees by
submitting this contract that, should the
proposed covered transaction be entered
into, it shall not knowingly enter into any lower
tier covered transaction with a person who is
debarred, suspended, declared ineligible, or
voluntarily excluded from participation in this
covered transaction, unless authorized by
Authority.
7) The prospective contractor further agrees by
submitting this contract that it will include the
clause titled "Certification Regarding
Debarment, Suspension, Ineligibility and
Voluntary Exclusion -- Lower Tier Covered
Transaction," provided by HHS, without
modification, in all lower tier covered
transactions and in all solicitations for lower
tier covered transactions.
8) A participant in a covered transaction may
rely upon a certification of a prospective
participant in a lower tier covered transaction
that it is not debarred, suspended, ineligible,
or voluntarily excluded from the covered
transaction, unless it knows that the
certification is erroneous. A participant may
decide the method and frequency by which it
determines the eligibility of its principals.
Each participant may, but is not required to,
check the Non -procurement List (of excluded
parties).
9) Nothing contained in the foregoing shall be
construed to require establishment of a
system of records in order to render in good
faith the certification required by this clause.
The knowledge and information of a
participant is not required to exceed that
which is normally possessed by a prudent
person in the ordinary course of business
dealings.
10) Except for transactions authorized under
paragraph 6 of these instructions, if a
participant in a covered transaction
knowingly enters into a lower tier covered
transaction with a person who is suspended,
debarred, ineligible, or voluntarily excluded
from participation in this transaction, in
addition to other remedies available to the
Federal Government, Authority may
terminate this transaction for cause or
default.
7. CERTIFICATION REGARDING
DEBARMENT, SUSPENSION, AND
OTHER RESPONSIBILITY MATTERS --
PRIMARY COVERED TRANSACTIONS
1) The prospective contractor certifies to the
best of its knowledge and belief, that it and its
principals:
a) Are not presently debarred, suspended,
proposed for debarment, declared
ineligible, or voluntarily excluded from
covered transactions by any Federal
department or agency;
Washington State Page 20 of 36 Health Care Authority
b) Have not within a three-year period
preceding this contract been convicted of or
had a civil judgment rendered against them
for commission of fraud or a criminal offense
in connection with obtaining, attempting to
obtain, or performing a public (Federal, State
or local) transaction or contract under a
public transaction; violation of Federal or
State antitrust statutes or commission of
embezzlement, theft, forgery, bribery,
falsification or destruction of records, making
false statements, or receiving stolen
property;
c) Are not presently indicted for or
otherwise criminally or civilly charged by
a governmental entity (Federal, State or
local) with commission of any of the
offenses enumerated in paragraph (1)(b)
of this certification; and
d) Have not within a three-year period
preceding this contract had one or more
public transactions (Federal, State or
local) terminated for cause or default.
2) Where the prospective contractor is unable to
certify to any of the statements in this
certification, such prospective contractor
shall attach an explanation to this proposal.
Washington State Page 21 of 36 Health Care Authority
CONTRACTOR SIGNATURE REQUIRED
SIGNATURE OF AUTHORIZED CERTIFYING
OFFICIAL
TITLE
Please also print or type name:
ORGANIZATION NAME: (if applicable)
DATE
Washington State Page 22 of 36 Health Care Authority
Attachment 3
Business Associates Agreement
This BUSINESS ASSOCIATE AGREEMENT is made between the Contractor listed on page one
(Business Associate) and the Washington State Health Care Authority (HCA). This agreement does
not expire or automatically terminate except as stated in Section 5.
Business Associate is or may be a "Business Associate" of HCA as defined in the HIPAA Rules. If
there is a conflict between the provisions of this Agreement and provisions of other contracts, this
Agreement controls; otherwise, the provisions in this Agreement do not replace any provisions of any
other contracts. If the other Contract is terminated, this Agreement nonetheless continues in effect.
This Business Associate Agreement supersedes any existing Business Associate Agreement the
Business Associate may have with HCA. It also supersedes any "business associate" section in an
underlying Contract.
Definitions
1.1 ACCESS ATTEMPTS
Information systems are the frequent target of probes, scans, "pings," and other activities that
may or may not indicate threats, whose sources may be difficult or impossible to identify, and
whose motives are unknown, and which do not result in access or risk to any information
system or PHI. Those activities are "access attempts."
1.2 DAY
"Day" means business days observed by Washington State government.
1.3 CATCH-ALL DEFINITIONS
The following terms used in this Agreement have the same meaning as those terms in the
HIPAA Rules: Breach, Business Associate, Data Aggregation, Designated Record Set,
Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy
Practices, Secretary, Security Incident, Unsecured Protected Health Information (PHI), and Use.
1.4 CLIENTS OR INDIVIDUALS
"Clients" or "individuals" are people who have health or other coverage or benefits from or
through HCA. They include Medicaid clients, Public Employees Benefits Board subscribers and
enrollees, and others.
1.5 CONTRACT OR UNDERLYING CONTRACT
"Contract" or "underlying contract" means all agreements between Business Associate and HCA
under which Business Associate is a "business associate" as defined in the Security or Privacy
Rules. The terms apply whether there is one such agreement or more than one, and if there is
Washington State Page 23 of 36 Health Care Authority
more than one the terms include them all even though a singular form is used except as
otherwise specified. The terms include agreements now in effect and agreements that become
effective after the effective date of this Agreement.
1.6 EFFECTIVE DATE
"Effective Date" means the date of the signature with the latest date affixed to the Agreement.
1.7 HIPAA RULES; SECURITY, BREACH NOTIFICATION, AND PRIVACY RULES
"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45
CFR Part 160 and Part 164, as now in effect and as modified from time to time. In part 164 of
title 45 CFR, the "Security Rule" is subpart C (beginning with §164.302), the "Breach Notification
Rule" is subpart D (beginning with § 164.400), and the "Privacy Rule" is subpart E (beginning
with § 164.500).
1.8 PROTECTED HEALTH INFORMATION OR PHI
"Protected Health Information" has the same meaning as in the HIPAA Rules except that in this
Agreement the term includes only information created by Business Associate or any of its
contractors, or received from or on behalf of HCA, and relating to Clients. "PHI" means
Protected Health Information.
2 Obligations and Activities of Business Associate
2.1 LIMITS
Business Associate will not use or disclose PHI other than as permitted or required by the
Contract or this Agreement or as required by law. Except as otherwise limited in this Agreement,
Business Associate may use or disclose PHI on behalf of, or as necessary for purposes of the
underlying contract, if such use or disclosure of PHI would not violate the Privacy Rule if done
by a Covered Entity and is the minimum necessary.
2.2 SAFEGUARDS
Business Associate will use appropriate safeguards, and will comply with the Security Rule with
respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the
Contract or this Agreement. Business Associate will store and transfer PHI in encrypted form.
2.3 REPORTING SECURITY INCIDENTS
2.3.1 Business Associate will report security incidents that materially interfere with an
information system used in connection with PHI. Business Associate will report those
security incidents to HCA within five days of their discovery by Business Associate. If
such an incident is also a Breach or may be a Breach, subsection 2.4 applies instead
of this provision.
2.3.2 Access Attempts shall be recorded in Business Associate's system logs. Access
Washington State Page 24 of 36 Health Care Authority
Attempts are not categorically considered unauthorized Use or Disclosure, but Access
Attempts do fall under the definition of Security Incident and Business Associate is
required to report them to HCA.
Since Business Associate's reporting and HCA's review of all records of Access
Attempts would be materially burdensome to both parties without necessarily reducing
risks to information systems or PHI, the parties agree that Business Associate will
review logs and other records of Access Attempts, will investigate events where it is
not clear whether or not an apparent Access Attempt was successful, and determine
whether an Access Attempt:
a. Was in fact a "successful" unauthorized Access to, or unauthorized Use,
Disclosure, modification, or destruction of PHI subject to this Agreement, or
b. Resulted in material interference with Business Associate's information system
used with respect to PHI subject to this Agreement, or
c. Caused an unauthorized Use or Disclosure.
2.3.3 Subject to Business Associate's performance as described in 2.3.2., this provision shall
serve as Business Associate's notice to HCA that Access Attempts will occur and are
anticipated to continue occurring with respect to Business Associate's information
systems. HCA acknowledges this notification, and Business Associate is not required
to provide further notification of Access Attempts unless they are successful as
described in Section 2.3.2. above, in which case Business Associate will report them in
accordance with Section 2.3.1 or Section 2.4.
2.4 BREACH NOTIFICATION
2.4.1 "Breach" is defined in the Breach Notification Rule. The time when a Breach is
considered to have been discovered is explained in that Rule. HCA, or its designee, is
responsible for determining whether an unauthorized Use or Disclosure constitutes a
Breach under the Breach Notification Rule, RCW 42.56.590 or RCW 19.255.010, or
other law or rule, and for any notification under the Breach Notification Rule, RCW
42.56.590 or RCW 19.255.010, or other law or rule.
2.4.2 Business Associate will notify HCA of any unauthorized use or disclosure and any
other possible Breach within five days of discovery. If Business Associate does not
have full details at that time, it will report what information it has, and provide full details
within 15 days after discovery. The initial report may be oral. Business Associate will
give a written report to HCA, however, as soon as possible. To the extent possible,
these reports must include the following:
a. The identification of each individual whose PHI has been or may have been
accessed, acquired, or disclosed;
b. The nature of the unauthorized Use or Disclosure, including a brief description of
what happened, the date of the event(s), and the date of discovery;
c. A description of the types of PHI involved;
Washington State Page 25 of 36 Health Care Authority
d. The investigative and remedial actions the Business Associate or its subcontractor
took or will take to prevent and mitigate harmful effects, and protect against
recurrence;
e. Any details necessary for a determination of the potential harm to Individuals
whose PHI is believed to have been Used or Disclosed and the steps such
Individuals should take to protect themselves; and
f. Such other information as HCA may reasonably request.
2.4.3 If Business Associate determines that it has or may have an independent notification
obligation under any state breach notification laws, Business Associate will promptly
notify HCA. In any event, Business Associate will notify HCA of its intent to give any
notification under a state breach notification law no fewer than ten business days
before giving such notification.
2.4.4 If Business Associate or any subcontractor or agent of Business Associate actually
makes or causes, or fails to prevent, a use or disclosure constituting a Breach within
the meaning of the Breach Notification Rule, and if notification of that use or disclosure
must (in the judgment of HCA) be made under the Breach Notification Rule, or RCW
42.56.590 or RCW 19.255.010, or other law or rule, then:
a. HCA may choose to make any notifications to the individuals, to the Secretary, and
to the media, or direct Business Associate to make them or any of them.
b. In any case, Business Associate will pay the reasonable costs of notification to
individuals, media, and governmental agencies and of other actions HCA
reasonably considers appropriate to protect clients (such as paying for regular
credit watches in some cases), and
c. Business Associate will compensate HCA clients for harms caused to them by the
Breach or possible Breach described above.
2.4.5 Business Associate's obligations regarding breach notification survive the termination
of this Agreement and continue for as long as Business Associate maintains the PHI
and for any breach or possible breach at any time.
2.5 SUBCONTRACTORS
Business Associate will ensure that any subcontractors or agents that create, receive, maintain,
or transmit PHI on behalf of the Business Associate agree to protective restrictions, conditions,
and requirements at least as strict as those that apply to the Business Associate with respect to
that information. Upon request by HCA, Business Associate will identify to HCA all its
subcontractors and provide copies of its agreements (including business associate agreements
or contracts) with them. The fact that Business Associate subcontracted or otherwise delegated
any responsibility to a subcontractor or anyone else does not relieve Business Associate of its
responsibilities.
Washington State Page 26 of 36 Health Care Authority
2.6 ACCESS
Business Associate will make available PHI in a designated record set to the HCA as necessary
to satisfy HCA's obligations under 45 CFR § 164.524. Business Associate will give the
information to HCA within five days of the request from the individual or HCA, whichever is
earlier. If HCA requests, Business Associate will make that information available directly to the
individual. If Business Associate receives a request for access directly from the individual,
Business Associate will inform HCA of the request within three days, and if requested by HCA it
will provide the access in accordance with the HIPAA Rules.
2.7 AMENDING PHI
Business Associate will make any amendments to PHI in a designated record set as directed or
agreed to by the HCA pursuant to 45 CFR § 164.526, or take other measures requested by
HCA to satisfy HCA's obligations under that provision. If Business Associate receives a request
for amendment directly from an individual, Business Associate will both acknowledge it and
inform HCA within three days, and if HCA so requests act on it within ten days and inform HCA
of its actions.
2.8 ACCOUNTING
Business Associate will maintain and make available to HCA the information required to provide
an accounting of disclosures as necessary to satisfy HCA's obligations under 45 CFR §
164.528. If Business Associate receives an individual's request for an accounting, it will either
provide the accounting as required by the Privacy Rule or, at its option, pass the request on to
HCA within ten days after receiving it.
2.9 OBLIGATIONS
To the extent the Business Associate is to carry out one or more of HCA's obligations under the
Privacy Rule, it will comply with the requirements of that rule that apply to HCA in the
performance of such obligations.
2.10 BOOKS, ETC.
Business Associate will make its internal practices, books, and records available to the
Secretary for purposes of determining compliance with the HIPAA Rules.
2.11 MITIGATION
Business Associate will mitigate, to the extent practicable, any harmful effect of a use or
disclosure of PHI by Business Associate or any of its agents or subcontractors in violation of the
requirements of any of the HIPAA Rules, this Agreement, or the Contract.
2.12 INDEMNIFICATION
To the fullest extent permitted by law, Business Associate will indemnify, defend, and hold
harmless the State of Washington, HCA, and all officials, agents and employees of the State
Washington State Page 27 of 36 Health Care Authority
from and against all claims of any kind arising out of or resulting from the performance of this
Agreement, including Breach or violation of HIPAA Rules.
3 Permitted Uses and Disclosures by Business Associate
3.1 LIMITED USE AND DISCLOSURE
Except as provided in this Section 3, Business Associate may use or disclose PHI only as
necessary to perform the services set forth in the Contract.
3.2 GENERAL LIMITATION
Business Associate will not use or disclose PHI in a manner that would violate the Privacy Rule
if done by HCA.
3.3 REQUIRED BY LAW
Business Associate may use or disclose PHI as required by law.
3.4 DE -IDENTIFYING
Business Associate may de -identified PHI in accordance with 45 CFR § 164.514(a) -(c).
3.5 MINIMUM NECESSARY
Business Associate will make uses and disclosures of only the minimum necessary PHI, and
will request only the minimum necessary PHI.
3.6 DISCLOSURE FOR MANAGEMENT AND ADMINISTRATION OF BUSINESS ASSOCIATE
3.6.1 Subject to subsection 3.6.2, Business Associate may disclose PHI for the proper
management and administration of Business Associate or to carry out the legal
responsibilities of the Business Associate.
3.6.2 The disclosures mentioned in subsection 3.6.1 above are permitted only if either:
a. The disclosures are required by law, or
b. Business Associate obtains reasonable assurances from the person to whom the
information is disclosed that the information will remain confidential and used or
further disclosed only as required by law or for the purposes for which it was
disclosed to the person, and that the person will notify Business Associate of any
instances of which it is aware in which the confidentiality of the information has
been breached.
3.7 AGGREGATION
Business Associate may use PHI to provide data aggregation services relating to the health
care operations of the HCA, if those services are part of the Contract.
Washington State Page 28 of 36 Health Care Authority
4 Activities of HCA
4.1 NOTICE OF PRIVACY PRACTICES
HCA will provide a copy of its current notice of privacy practices under the Privacy Rule to
Business Associate on request. HCA will also provide any revised versions of that notice by
posting on its website, and will send it on request.
4.2 CHANGES IN PERMISSIONS
HCA will notify Business Associate of any changes in, or revocation of, the permission by an
individual to use or disclose his or her PHI, to the extent that such changes may affect Business
Associate's use or disclosure of PHI.
4.3 RESTRICTIONS
HCA will notify Business Associate of any restriction on the use or disclosure of PHI that HCA
has agreed to or is required to abide by under 45 CFR § 164.522, to the extent that such
restriction may affect Business Associate's use or disclosure of PHI. Business Associate will
comply with any such restriction.
5 Term and Termination
5.1 TERM
5.1.1 This Agreement is effective as of the earliest of:
a. The first date on which Business Associate receives or creates PHI subject to this
Agreement, or
b. The effective date of the Contract, or if there is more than one Contract then the
effective date of the first one to be signed by both parties.
5.1.2 This Agreement continues in effect until the earlier of:
a. Termination of the provision of Services under the Contract or, if there is more than
one Contract, under the last of the Contracts under which services are terminated,
b. The termination of this Agreement as provided below, or
c. The written agreement of the parties.
5.2 TERMINATION FOR CAUSE
HCA may terminate this Agreement and the Contract (or either of them), if HCA determines
Business Associate has violated a material term of the Agreement. The termination will be
effective as of the date stated in the notice of termination.
Washington State Page 29 of 36 Health Care Authority
5.3 OBLIGATIONS OF BUSINESS ASSOCIATE UPON TERMINATION
The obligations of the Business Associate under this subsection 5.3 survive the termination of
the Agreement. Upon termination of this Agreement for any reason, Business Associate will:
5.3.1 Retain only that PHI that is necessary for Business Associate to continue its proper
management and administration or to carry out its legal responsibilities;
5.3.2 Return to HCA or, if agreed to by HCA, destroy the PHI that the Business Associate
and any subcontractor of Business Associate still has in any form (for purposes of this
subsection 5.3, to destroy PHI is to render it unusable, unreadable, or indecipherable
to the extent necessary to establish it is not Unsecured PHI, and Business Associate
will provide HCA with appropriate evidence of destruction within ten days of the
destruction);
5.3.3 Continue to use appropriate safeguards and comply with the Security Rule with respect
to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in
this Agreement, for as long as Business Associate retains any of the PHI (for purposes
of this subsection 5.3, If the PHI is destroyed it shall be rendered unusable, unreadable
or indecipherable to the extent necessary to establish it is not Unsecured PHI.
Business Associate will provide HCA with appropriate evidence of destruction);
5.3.4 Not use or disclose any PHI retained by Business Associate other than for the
purposes for which the PHI was retained and subject to the same conditions that
applied before termination;
5.3.5 Return to HCA, or, if agreed to by HCA, destroy, the PHI retained by Business
Associate when it is no longer needed by Business Associate for its proper
management and administration or to carry out its legal responsibilities; and
5.3.6 Business Associate's obligations relating to providing information to the Secretary and
other government survive the termination of this Agreement for any reason.
5.4 SUCCESSOR
Nothing in this Agreement limits the obligations of Business Associate under the Contract
regarding giving data to HCA or to a successor Business Associate after termination of the
Contract.
6 Miscellaneous
6.1 AMENDMENT
The Parties agree to take such action as is necessary to amend this Agreement from time to
time as is necessary for compliance with the requirements of the HIPAA Rules and any other
applicable law.
6.2 INTERPRETATION
Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA
Rules.
Washington State Page 30 of 36 Health Care Authority
6.3 HCA CONTACT FOR REPORTING AND NOTIFICATION REQUIREMENTS
Business Associate will address all reporting and notification communications required in this
Agreement to:
HCA Privacy Officer
Washington State Health Care Authority
626 8th Avenue SE
PO Box 42700
Olympia, WA 98504-2700
Telephone: 360-725-1116
E-mail: PrivacyOfficer@hca.wa.gov
Washington State Page 31 of 36 Health Care Authority
Schedule A
Statement of Work
Performance Work Statement.
Agency Baseline Fidelity Review. The Contractor shall provide the services and staff, and
otherwise do all things necessary for or incidental to the performance of work, as set forth below
in option #1 or option #2:
® Option # 1
Participate in a fidelity review of existing FCS PSH or SE services; by assigning two (2) of its
individuals to participate in two (2) fidelity reviews being conducted for purposes of learning the
principles of EBP associated with PSH or SE services that are provided. $5,000 per individual
staff, for a total of $10,000.
❑ Option # 2
Participate in an internal fidelity review; by agreeing to host a two (2) day review lead by state
fidelity reviewer and team of individuals from other regions across Washington. In addition,
assign a minimum of one (1) individual staff to participate in at least one (1) fidelity review for
purposes of learning the principles of EBP associated with PSH or SE services that are provided.
$10,000 per individual staff, for a total of $10,000.
2. Consideration.
Total consideration payable to Contractor for satisfactory performance of the work under this
contract is a maximum of $10,000, including any and all expenses, and shall be based on upon
receipt and acceptance of reports and documents established in the Deliverables and Payment
Chart, below.
Agencies can only participate in either option # 1 or # 2 (as identified above) and either supported
employment or supportive housing fidelity deliverable activity not both.
Deliverable
Due Date
Maximum
Payment
Option #1:
12/31/2019
Two (2) at $5,000
Participate in a fidelity review of existing FCS
each for a total of
PSH or SE services:
$10,000
• Participate in pre -planning call(s) for
the fidelity review
• Travel to other agencies (Travel
coordination will occur within your own
organization and is part of the
Washington State Page 32 of 36 Health Care Authority
reimbursement costs associated with
this project)
• Developing recommendations for the
improvement of SE/SH services
• Provide consensus input on scoring
• Assisting in report writing.
Option #2
12/31/2019
One (1) at
Participate in an internal fidelity review:
$10,000 for a
total of $10,000
• Participate in a pre -planning call(s) for
the fidelity review
• Schedule interviews with personnel,
consumers and key stakeholders
pertinent to the fidelity review
• Provide a schedule with interview
names to state trainer at least two
weeks prior to the review
• Provide agency materials that support
the components of the fidelity review
at least two weeks prior to the fidelity
review.
• In addition, assige one (1) individual
staff to participate in one (1) fidelity
review for purposes of learning the
principles of EBP associated with
PSH or SE services that are provided.
TOTAL for Option #1 or Option #2
$10,000
3. SAMHSA Award Terms.
3.1 This grant is subject to the terms and conditions, included directly, or incorporated by reference
on the Notice of Award (NoA).
3.2 Grant funds cannot be used to supplant current funding of existing activities.
3.3 By law, none of the funds awarded can be used to pay the salary of an individual at a rate in
excess of the Executive Level 1, which is $199,700 annually.
3.4 Awardees and sub -recipients must maintain records which adequately identify the source and
application of funds provided for financially assisted activities. These records must contain
information pertaining to grant or sub -grant awards and authorizations, obligations, unobligated
balances, assets, liabilities, outlays or expenditures, and income. SAMHSA or its designee may
Washington State Page 33 of 36 Health Care Authority
conduct a financial compliance audit and on-site program review of grants with significant
amounts of Federal funding.
3.5 Per 45 CFR 74.36 and 45 CFR 92.34 and the HHS Grants Policy Statement, any copyrighted or
copyrightable works developed under this cooperative agreement/grant shall be subject to
royalty-free, nonexclusive and irrevocable license to the government to reproduce, publish, or
otherwise use them and to authorize others to do so for General Government purposes.
Income earned from any copyrightable work developed under this grant must be used as
program income.
3.6 Program income accrued under this award must be used in accordance with the additional costs
alternative described in 45 CFR 74.24(b)(1) or 45 CFR 92.25(g)(2) as applicable. Program
income must be used to further the grant objectives and shall only be used for allowable costs
as set forth in the applicable OMB circulars A-102 and A-110.
3.7 No part of any appropriation contained in this Act shall be used, other than for normal and
recognized executive-legislative relationships, for publicity or propaganda purposes, for the
preparation, distribution, or use of any kit, pamphlet, booklet, publication, radio, television, or
video presentation designed to support or defeat legislation pending before the Congress,
except in presentation to the Congress itself or any State legislature.
3.8 No part of any appropriation contained in this Act shall be used to pay the salary or expenses of
any grant or contract recipient, or agency acting for such recipient, related to any activity
designed to influence legislation or appropriations pending before the Congress or any State
legislature.
3.9 Where a conference is funded by a grant or cooperative agreement the recipient must include
the following statement on all conference materials (including promotional materials, agenda,
and internet sites): "Funding for this conference was made possible (in part) by Grant
H79SM061705 from SAMHSA. The views expressed in written conference materials or
publications and by speakers and moderators do not necessarily reflect the official policies of
the Department of Health and Human Services; nor does mention of trade names, commercial
practices, or organizations imply endorsement by the U.S. Government."
3.10 If federal funds are used by the Contractor to attend a meeting, conference, etc. and meal(s) are
provided as part of the program, then the per diem applied to the Federal travel costs (M&IE
allowance) must be reduced by the allotted meal cost(s).
4. MHBG Funding Requirements and Limitations.
4.1 The Contractor shall comply with the utilization Funding Agreement guidelines within the State's
most recent MHBG plan, as referenced herein, and which was provided to Contractor prior to
Washington State Page 34 of 36 Health Care Authority
commencement of services under this Agreement. Contractor agrees to comply with Title V,
Section 1913 of the Public Health Service Act [42 U.S.C. 300x-1 et seq.].
4.2 The Contractor shall not use MHBG Funds for the following:
4.2.1 Services and programs that are covered under the capitation rate for Medicaid -covered
services to Medicaid enrollees.
4.2.2 The Contractor's administrative costs associated with salaries and benefits at the
Contractor's organizational level.
4.2.3 Inpatient mental health services.
4.2.4 Construction and/or renovation.
4.2.5 Capital assets or the accumulation of operating reserve accounts.
4.2.6 Equipment costs over $5,000.
4.2.7 Cash payments to Consumers.
4.2.8 State match for other federal funds.
5. Subcontracts and Subcontract Monitoring.
5.1 All activities and services performed pursuant to this Agreement, which are not performed
directly by the Contractor, must be subcontracted in accordance with the terms set forth under
this Agreement.
5.2 MHBG funds may not be used to pay for services provided prior to the execution of
subcontracts, or to pay in advance of service delivery. All subcontracts and amendments must
be in writing and executed by both parties prior to any services being provided.
5.3 MHBG fee-for-service, set rate, performance-based, cost reimbursement, and lump sum
subcontracts shall be based on reasonable costs.
5.4 The Contractor shall retain, on site, all subcontracts. Upon request by the Department,
Contractor will immediately make available any and all copies, versions, including all
amendments of subcontracts.
5.5 The Contractor must obtain prior approval before entering into any subcontracting arrangement.
In addition, the Contractor shall submit to the HCA Program Manager identified on Page 1 of the
contract at least one of the following for review and approval purposes:
5.5.1 Copy of the proposed subcontract to ensure it meets all HCA requirements; or
5.5.2 Copy of the contractor's standard contract template to ensure it meets all requirements
and approve only subcontracts entered into using that template; or
Washington State Page 35 of 36 Health Care Authority
5.5.3 Certify in writing that the subcontractor meets all requirements under the contract and that
the subcontract contains all required language under the contract, including any data
security, confidentiality and/or Business Associate language, as appropriate.
5.6 The Contractor shall ensure that its subcontractors receive an independent audit if the
subcontractor expends a total of $750,000 or more in federal awards from any and/or all
sources in any fiscal year. Contractor shall require all subcontractors to submit to Contractor
the data collection form and reporting package specified in 2 CFR Part 200, Subpart F, reports
required by the program -specific audit guide (if applicable), and a copy of any management
letters issued by the auditor within 10 days of audit reports being completed and received by
subcontractors. Contractor shall follow up any corrective actions for all subcontractor audit
findings in accordance with 2 CFR Part 200, Subpart F. Contractor shall retain documentation
of all subcontractor monitoring activities; and, upon request by the Department, shall
immediately make all audits and/or monitoring documentation available to the Department.
5.7 The Contractor shall conduct and/or make arrangements for an annual fiscal review of each
subcontractor receiving MHBG funds through fee-for-service, set rate, performance-based or
cost reimbursement subcontracts; and, shall provide the department documentation of these
annual fiscal reviews upon request. The annual fiscal review shall ensure:
5.7.1 Expenditures are accounted for by revenue source.
5.7.2 No expenditures were made for items identified in Section 4 of this Agreement.
5.7.3 Expenditures are made only for the purposes stated in this Agreement, and that services
were actually provided.
Washington State Page 36 of 36 Health Care Authority