HomeMy WebLinkAboutAgreements/Contracts - Renew (003)DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-05B78Dl3C49ED
GRANT AND ADAMS COUNTY DEVELOPMENTAL DISABILITIES
SUBCONTRACTOR AGREEMENT
AGREEMENT PERIOD: 7/1/2023 — 06/30/2024
ORGANIZATION NAME: Goodwill Industries of the Inland Northwest
SUBCONTRACTOR CONTACT PERSON: Jaime McDowall
EMAIL: imcdowall@_iign.org
TELEPHONE: (509) 855-1647
SIGNATORY AUTHORITY: Clark Brekke, President & CEO
EMAIL: goodwi I lad mi nistration.org,
TELEPHONE: (509) 838-4246
ADDRESS: E. 130 Third
Spokane, WA 99202
IRS TAX NUMBER: 91-0597006
QUALIFIED PROVIDER SERVICES: Group Supported Employment, Community Inclusion, Individual
Supported Employment
Additional terms of this agreement are set out in and governed by following which are incorporated
herein by reference:
Exhibit A — Special Terms and Conditions
Exhibit B — Data Security Requirements
Exhibit C — Spending Plan Agreement
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 1 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
Exhibit A - Special Terms and Conditions
1) Definitions Specific to Program Agreement: The words and phrases listed below, as used in this
Program Agreement, shall each have the following definitions:
a) "Acuity Level": means the level of a Client's abilities and needs as determined through the Developmental
Disability Association (DDA) assessment.
b) "ALTSA Web Access (AWA)": means a web -based portal to the Developmental Disabilities
Administration CARE system designed to support county services for DDA clients.
c) "Additional Consumer Services": refers to indirect Client service types as follows:
1) "Community Information and Education": Activities to inform and/or educate the general public
about developmental disabilities and related services. These may include information and referral
services; activities aimed at promoting public awareness and involvement; and community
consultation, capacity building and organization activities.
2) "Training": To increase the job-related skills and knowledge of staff, providers, volunteers, or
interning students in the provision of services to people with developmental disabilities. Also, to
enhance program related skills of board or advisory board members.
3) "Other Activities": reserved for special projects and demonstrations categorized into the following
types:
(a) Infrastructure projects: Projects in support of Clients (services not easily tracked back to a
specific working age Client) or that directly benefit a Client(s) but the Client is not of working
age. Examples include planning services like benefits planning and generic job development
e.g. "Project Search".
(b) Start-up projects: Projects that support an agency or directly benefit the agency. Examples
include equipment purchases and agency administrative support.
(c) Partnership Project: Collaborative partnerships with school districts, employment providers,
Division of Vocational Rehabilitation (DVR), families, employers and other community collaborators
needed to provide the employment supports and services young adults with developmental
disabilities require to become employed during the school year they turn twenty-one (21).
d) "Budget and Accounting Reporting System (BARS)": means a master classification of balance sheet,
revenue and expenditure/expense accounts.
e) "Client": means a person with a developmental disability as defined in Chapter 388-823 WAC who is
currently eligible and active with the Developmental Disabilities Administration or is an identified Pre -
Admission Screening and Resident Review (PASRR) Client.
f) "Competitive Integrated Employment": means work performed by a Client on a part-time or full-time
basis, within an integrated setting within the community that meets the Home and Community Based
Services (HCBS) settings requirements. The Client must be compensated at minimum wage or higher,
using the higher of the Federal, State, or local rate, and at a rate comparable to the wage paid to non -
disabled workers performing the same tasks, including receiving the same benefits and opportunities for
advancement.
g) "Consumer Support": refers to direct Client service types as follows:
1) "Community Inclusion" or "CI": means individualized services provided in integrated community
settings with other individuals without disabilities. The activities are based on Client interests and
provide opportunities typically experienced by the general public of similar age in their local
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 2 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
community, accessible by public transit or a reasonable commute from their home. The goal of the
service to support clients to participate, contribute, and develop relationships with community
members who are not paid staff. These services may be authorized for individuals aged sixty-two
(62) and older. These services may be authorized in addition to or instead of employment support
(Individual Employment or Group Supported Employment) for working age individuals who have
received nine (9) months of employment support.
2) "Individual Supported Employment (IE)": services are a part of a Client's pathway to employment
and are tailored to individual needs, interests, and abilities, and promote career development.
These are individualized services necessary to help persons with developmental disabilities obtain
and continue integrated employment at or above the state's minimum wage inthe general
workforce. These services may include intake, discovery, assessment, job preparation, job
marketing, job supports, record keeping, and support to maintain a job.
3) "Individualized Technical Assistance (ITA)":. services are a part of an Client's pathway to individual
employment. This service provides assessment and consultation to the employment provider to
identify and address existing barriers to employment. This is in addition to supports received
through supported employment services for clients who have not yet achieved their employment
goal.
4) "Group Supported Employment (GSE)"": services are a part of a Client's pathway to integrated jobs
in typical community employment. These services are intended to be short termand offer ongoing
supervised employment for groups of no more than eight (8) workers with disabilities in the same
setting. The service outcome is sustained paid employment leading to further career development
in integrated employment at or above minimum wage. Examples include enclaves, mobile crews,
and other business models employing small groups of workers with disabilities in integrated
employment in community settings.
h) "County": is the political subdivision of the state of Washington and the county or counties entering into
this Program Agreement.
'i) "DDA Case Resource Manager (CRM)": means a case manager for DDA Clients.
j) "County Service Authorization (CSA)": means an authorization for county services.
k) "Developmental Disabilities (DD)": means a disability attributable to intellectual disability, cerebral
palsy, epilepsy, autism, or another neurological or other condition of an individual found by the
secretary to be closely related to an intellectual disability, or to require treatment similar to that
required for individuals with intellectual disabilities, which disability originates before the individual
attains age eighteen (18), which has continued or can be expected to continue indefinitely, and which
constitutes a substantial limitation to the individual.
1) "Developmental Disabilities Administration (DDA)": means a division within the Department of Social
and Health Services.
m) "DDA Regional office (DDA Region)": means the regional DDA office that supports DDA clients.
n) "Division of Vocational Rehabilitation (DVR)": means a division within the Department of Social and
Health Services.
o) "Employment Outcome Payment": means a payment to providers for transition students born between
specific dates; have high acuity; are authorized for Individual employment; and studentobtains a
competitive integrated job within specific timeframes. If the job is a minimum of ten (10) hours of work
per week an additional amount will be include in the payment.
p) "General Terms and Conditions": means the contractual provisions contained within that agreement,
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 3 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
which govern the contractual relationship between the County and the Subcontractor.
q) "Medicaid Home and Community Based Services HCBS": means services that occur in a Client's home
or community rather than institutions or other isolated settings. These programs serve a variety of
targeted populations groups, such as people with intellectual or developmental disabilities, physical
disabilities, and/or mental illnesses.
r) ""Job Foundation Report": is a document derived from employment readiness activities performed by
students who are between ages nineteen (19) through twenty (20) that identifies actionable next steps
for employment. The employment service providers developing the Job Foundation report will be
supporting students with employment activities an average of thirty-five (35) hours.
s) ""Preadmission Screening and Resident Review (PASRR)": means individuals with intellectual disabilities
or related conditions (ID/RC) who have been referred for nursing facility (NF) care.
t) "Person Centered Service Plan (PCSP)": means a document that authorizes and identifies the DDApaid
services to meet a Client's assessed needs. Formerly referred to as the Individual Support Plan.
u) ""Quality Assurance": means an adherence to all Program Agreement requirements, including DDAPo_ I
6.13, EmploymentlDay Program Provider Qualifications, County Guidelines and the Criteria for
Evaluation, as well as a focus on reasonably expected levels of performance, quality, and practice.
v) ""Quality Improvement": means a focus on activities to improve performance above minimum standards
and reasonably expected levels of performance, quality and practice.
w) ""Service Provider": is a qualified Client service vendor who is contracted to provide Employment andDay
Program services.
x) "Subcontractor": is the service provider contracted by the County to provide services.
2) Purpose: This Program Agreement is entered into between Grant & Adams County Developmental
Disabilities (County) and Goodwill Industries of the Inland Northwest (Subcontractor) in accordance with
Chapter 71A.14 RCW. Its purpose is to advance the state legislative policy to provide a coordinated and
comprehensive state and local program of services for persons with developmental disabilities.
3) Client Eligibility: Client eligibility and service referral are the responsibility of DDA under Chapter 388-
823 WAC (Eligibility) and Chapter 388-825 WAC (Service Rules). only persons referred by DDA shall be
eligible for direct Client services under this Program Agreement. It is DDA's responsibility to determine and
authorize the appropriate direct service(s) type. Direct Client services provided without authorization are
not reimbursable under this Program Agreement.
4) Credentials and Minimum Requirements:
a) Administration of the developmental disabilities County program cannot be subcontracted.
b) Qualified DD Program Coordinator: A qualified DD program coordinator has a minimum of five years
training and experience in the administration and/or the delivery of developmental disabiIitiesservices
to a community. For a county where the coordinator administers more than one program area (e.g.
Substance Use Disorder, Mental Health, Developmental Disabilities), training and experience in
administration and/or a related Human or Social service may be considered.
c) Administration Responsibility: The County will administer the program agreement including contract
oversight and monitoring, community outreach and education activities, and regular communication
with the DDA region and subcontracted providers.
d) Fiscal Responsibility: The Subcontractor must demonstrate the ability to safeguard public funds
including maintaining books, records, documents, and other materials relevant to the provision of goods
and services.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 4 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
e) Sufficient Policies and Procedures for establishment and maintenance of adequate internal control
systems: The Subcontractor will maintain written policy procedural manuals for information systems,
personnel, and accounting/finance in sufficient detail such that operations can continue should staffing
change or absences occur. Policies shall be dated and include dates when revised.
f) Background/Criminal History Check: A background/criminal history clearance is required every three (3)
years for all employees (including DD program County staff), Subcontractors, and/or volunteers who
may have unsupervised access to vulnerable DSHS Clients, in accordance with RCW 43.43.830-845,
RCW 74.15.030, and Chapter 388 WAC. If the entity reviewing the application elects to hire or retain
an individual after receiving notice that the applicant has a conviction for an offense that would
disqualify the applicant from having unsupervised access to vulnerable adults asdefined in RCW '74.341
then the County shall deny payment for any subsequent services rendered by the disqualified individual
provider. The DSHS Background Check Central Unit (BCCU)must be utilized to obtain background
clearance.
g) Qualified Service Providers: The Subcontractor assures that it meet qualifications asoutlined in the DDA
Policy 6.13, Provider Qualifications for Employment and Day Program Services.
h) Home and Community Based Waiver Services Assignment of Medicaid Billing Rights: The Subcontractor
has agreed to assign to the County its Medicaid billing rights for services to DDA Clients eligible under
Title XIX programs in this Program Agreement. Written documentation shall be available to the County
and DSHS on request.
i) Reporting Abuse and Neglect: Subcontractor staff are mandated reporters under RCW 74.34.020(13) and
must comply with reporting requirements described in RCW 74.34.035, 040 and Chapter 26.44 RCW. If the
County is notified by DSHS that a Subcontractor staff member is cited or on the registry for a
substantiated finding, then that associated staff will be prohibited from providing services under this
Program Agreement.
j) The County staff who perform evaluations of subcontractor work sites will promptly report to DSHSper
DDA Policy 6.08, Incident Management and Reporting Requirements for County and County
Contracted -Providers, if:
1) They have reasonable cause to believe that abandonment, abuse, financial exploitation orneglect
(as defined in RCW 74.34.020) of a person who has a developmental disability (asdefined in RCW
71A.10.020) has occurred, and,
2) If they have reason to suspect that sexual or physical assault of such a person has occurred, they
shall also immediately report to the appropriate law enforcement agency.
k) Subcontractors are specifically authorized to have data storage on portable devices or media in
accordance with the Data Security Requirements.
1) Order of Precedence: In the event of any inconsistency in this Program Agreement and any attached
exhibits, unless otherwise provided herein, the inconsistency shall be resolved by giving precedence, in
the following order, to:
1) Contract;
2) Attached Exhibits.
5) Duty to Disclose: Under 42 CFR §455.104, the Subcontractor must obtain certain disclosures and
complete required screenings to ensure the County does not pay federal funds to excluded persons or
entities. The Subcontractor is required to provide disclosures from managing employees, specifically the
persons in the positions of Director/ Manager and Fiscal/Budget staff, i.e. the person who authorizes
expenditures.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 5 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78Dl3C49ED
6) Statement of Work: Subcontractor shall provide the services and staff, and otherwise do all things
necessary for, or incidental to the performance of work, as set forth below. Working collaboratively and
sharing information as needed for service coordination, the parties shall administer DD services withinthe
counties of Grant and Adams as set forth below:
a) The County shall:
1) Review subcontractors and shall immediately notify DDA of any concerns with thesubcontractors
identified by the County;
2) Inform and include the Subcontractor in the discharge planning of Clients leaving institutions and returning
to the community who will need program funding;
3) Inform the Subcontractor of Clients who have had their waiver status changed;
4) Work with the Subcontractor when referring Clients for services and will withdraw referrals when
authorization is not issued;
5) Authorize new service within five (5) working days and will emend existing service authorization
before expiration date;
6) Inform Clients of service changes through Planned Action Notice(s);
7) Work with the Subcontractor to document planned services in the Client's Person Centered Service
Plan including notification of assessment dates;
8) Work with the Subcontractor when terminating services;
9) Work with DDA Head Quarters and the County on Spending Plan adjustments; and
10) Work with the Subcontractor in participating of evaluation of direct service providers.
b) The Subcontractor shall:
1) Work with the County when individuals are referred for services, authorized services and/or for
support modifications;
2) Work with the County to document planned services in the Client's Person -Centered Service Plan;
3) Assist with informing the County of any potential service level changes not documented i n the
Client's DD Assessment prior to any changes;
4) Work with the County regarding service termination;
c) Compliance with Budget and Accounting Reporting System Policies (BARS) Policies: Subcontractor shall
take any necessary and reasonable steps to comply with BARS Policies.
d) The Subcontractor shall comply with the following referenced documents found at DDA Internet site
https://www.dshs.wa.gov/dda/county-best-practices under "County Best Practices":
1) DDA Policy 4.11, County Services for Working Age Adults;
2) Chapter WAC 388-850, Chapter 388-828 WAC, WAC 388-845-00011 0030, 0210, 0215, 0220, 0600-
06101 1030-1040, 21001 2110;
3) Criteria for Evaluation;
4) DDA Guiding ValuesL
5) County Guide to Achieve DDA's Guiding Values;
6) DDA Guidelines for Community Assessments within Employment and Vocational Programs; and
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 6 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
7) Disability Rights Washington (formerly Washington Protection and Advocacy System) Access
Agreement.
e) The Subcontractor shall develop and submit a comprehensive plan for the County DD Services as
required by WAC 388-850-020.
f) Qualified Providers: A qualified provider must be a county or an individual or agency contracted with a
county or DDA.
g) Technical Assistance: DDA contracts with Technical Assistance providers that may be utilized by
Counties with prior written approval.
h) Subcontractors: The County will pass on all applicable contractual requirements that are betweenDDA
and the County to the subcontractor. The County shall immediately notify the DDA Region ofthe
County's intent to terminate a subcontractor who is serving a DDA referral. Individuals or agencies
contracted with a county or DDA may not subcontract for Employment or Community Inclusion
services.
i) The County shall provide or contract with qualified Employment and Day Program Service Providers for
consumer support services that include the following program outcomes:
1) Monthly Community Inclusion (CI) service support hours will be based on the Client's CI service
level per WAC 388-828-9310 for all Clients who began receiving CI services July 1, 2011 and
forward.
(a) To ensure health and safety, promote positive image and relationships in the community,
increase competence and individualized skill -building, and achieve other expected benefitsof CI,
services will occur individually or in a group of no more than two (2) or three (3) individuals
with similar interests and needs.
(b) CI services will focus on activities that are typically experienced by the general public. Support
to participate in segregated activities and/or specialized activities will not be reimbursed.
2) Clients in an employment program will be supported to work towards a living wage. A living wage is
the amount needed to enable a Client to meet or exceed his/her living expenses. Clients should be
supported to average twenty (20) hours of community work per week or eighty-six (86) hours per
month; however, each person's preferred hours of employment should be taken into consideration.
The amount of service a Client receives will be based on his/her demonstrated need, acuity level
and work history per WAC 388-828.
3) The Client's DDA PCSP is the driver for service. The AWA County Service Authorization (CSA) and
updated Planned Ratesinformation will not exceed the Client's DDA PCSP. Service changes will not
occur until the Client has received proper notification from DDA.
4) All Clients will have an Individualized Employment or Community Inclusion plan to identify Client's
preferences. Minimum plan elements are outlined in the reference document"'Criteria for
Evaluation." A copy of the Client's individualized plan will be provided to the Client, theirCRM,
guardian, and others as appropriate.
5) Six-month progress reports that describe the progress made towards achieving Client's goal will be
provided by the service provider to the CRM, Client, and/or guardian, if any, within thirty (30) days
following the six-month period. The report will summarize activities and outcomes made towards
the Client's individualized goal(s).
6) All Clients will be contacted by their service provider according to Client need and at least onceper
month.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 7 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78Dl3C49ED
7) If Clients in Individual Employment or Group Supported Employment, have not obtained paid
employment at minimum wage or better within six (6) months, the Subcontractor will assure the
following steps are taken:
(a) Review the progress toward employment goals;
(b) Provide evidence of consultation with the Client/guardian; and
(c) Develop additional strategies with the Client/guardian, county staff, employment support staff,
case manager, and others identified by the Client. Strategies may include providing technical
assistance, changing to a new provider, and/or providing additional resources asneeded to
support the Client's pursuit of employment. The additional strategies will bedocumented for
each Client and kept in the Client's file(s).
8) If after twelve (12) months the Client remains unemployed, an additional review will be conducted.
The Subcontractor will address steps outlined in the previous six-month progress report, inthe next
six-month progress report. When requesting to participate in CI, the Client shall communicate
directly with his or her DDA Case Manager. The DDA Case Manager is responsible for authorizing CI
services.
9) For Individual Employment where the Subcontractor is also the Client's employer, long term funding
will remain available to the Subcontractor employer for six (6) months after the employee's/Client's
date of hire. At the end of the six-month period, if the DDA Client continues to need support on the
job, another Subcontractor who is not the employer of record must provide the support unless the
County or DDA issues prior written approval for the Subcontractor to continue to provide long-term
supports if needed. If the County or DDA approves the continuation of long-term supports where
the service provider is also the Client's employer, the County or DDA will regularly monitor these
positions to assure fading efforts occur when appropriate and any potential conflict of interest is
addressed.
10) Individual Employment staff hours must be attributed to the "Individual Employment and Billable
Activity Phases)".
11) For Group Supported Employment (GSE),, Clients must have paid work. The total number of direct
service staff hours provided to the group should be equal to or greater than the group's collective
amount of individual support monthly base hours. If the direct service staff hours are less than the
collective amount, then the provider will be reimbursed only for the number of hours staff actually
provided.
(a) The collective group's individual hours should be the minimum staff hours delivered to support
the group.
(b) A GSE client must be on-site/at work at least their base individual hours as a minimum per
month. If a client is not on-site/at work for all their base hours, the County should verify that
the provider delivered the collective group's individual hours to the group (what was thenumber
of staff hours provided to the group during the month? If it was less than the collective group s
total the provider can only bill for the staff hours that were pro video) .
(c) A GSE agency may not bill for a GSE Client who does not receive services during an entire
service month.
(d) A GSE agency must have a record of which staff is supporting which Clients on any givenday.
(e) A GSE agency must have supportive documentation that provides clear evidence of support
helping with specific activities as identified in the Client plan to move a Client on their pathway
towards their employment goal(s).
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 8 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
(f) Running a GSE service is a part of the business operation and not billable to Clients (contract
procurement, contract maintenance, or administration functions associated withGSE).
(g) Individual time in the community working towards the individual employment goal, separate
from the group time, must include phase information (refer to Employment Phases and Billable
Activities -see Phases 1— 4 for element /activity description).
12) Employment and day services must adhere to the Home and Community Based settings(HCBS)
requirements of 42CFR 441 530(a)(1), including that:
(a) The setting is integrated in the greater community and supports clients to have fullaccess to the
greater community;
(b) Ensures the individual receives services in the community to the same degree of access as
individuals not receiving Medicaid HCBS;
(c) The setting provides opportunities to seek employment and work in competitive integrated
settings; and
(d) The setting facilitates individual choice regarding services and supports, and who providesthem.
j) Quality Assurance and Service Evaluation: The County shall develop and have available an evaluation
system to review services. The evaluation system must have both a Quality Assuranceand a Quality
Improvement component, and both must include objective measures. The objective measures at a
minimum will include performance indicators, by acuity, that include the number of new jobs; job loss
and reasons for job loss; the percentage employed earning minimum wage or better; and the average
number of hours worked. The County's service evaluation system shall serve as the method by which
current providers demonstrate that they continue to be qualified providers. A copy of description of
such evaluation system shall be provided upon request to DDA for review.
k) Evaluation: The County shall evaluate and review services delivered to reasonably assure compliance
and quality. The County shall conduct at least one (1) visit to each subcontractor every two (2) years.
The County shall maintain written documentation of all evaluations, recommendations, and corrective
action plans for each subcontractor. Copies of such documentation will be provided to the DDA upon
request.
I) The County shall work with local developmental disability advisory groups to plan for and coordinate
services.
m) The County shall participate in regularly scheduled meetings between County DD staff and DDAstaff to
remain updated and current including ACHS and Regional Meetings.
n) AWA Data System: In compliance with the AWA Training Manual, the County shall use the AWAdata
system for all:
1) Billing requests;
2) Service provider address and phone number maintenance;
3) Evaluation dates;
4) Employment outcome information; and
5) Monthly provide all data described in the Billing Instructions and in the Employment Outcomes
Instructions, which is hereby incorporated by reference.
o) Assure the integrity of data submitted to the State. When data is submitted and rejected due to errors
or an error is later identified, the County will work with the Subcontractor so the County can correct and
resubmit the data within thirty (30)days.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 9 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
p) Review and respond the AWA "Work List" items within five (5) working days including Referrals and
pending Authorization.
q) Review the AWA "Ticklers" Planned Rate tab and update the planned rate within five (5) working days
after the Planned Rate start date.
7) Consideration
a) Fees:
1) Approval of fees is the responsibility of the DDA. The DDA HQ Employment and Day Unit Manager
reserves the right to approve fees/ rates for the services being provided. The County will submit a
fee/rate schedule with the initial Program Agreement. The County will submit updated fee/rate
schedules to the HQ Employment and Day Unit Manager for approval as changes occur. The rate
schedule will include the following information:
(a) County(s) name;
(b) Time period for which the schedule is applicable; and
(c) Each contracted direct service (IE, GSE, CI, ITA, CDS) and its associated rate.
2) Fee Limitations: The DDA Billing Instructions found on the County Best Practices site provides
limitations on the Hourly Rate for each direct service. Hourly rates must be divisible by four (4).
b) Budget and Spending Plan, attached as Exhibit C:
1) Budget amount listed in Exhibit C: The County may not exceed the state only revenue dollar
amount or the total revenue dollar amount indicated on the Program Budget Agreement included in
Exhibit C. The waiver revenue dollar amount may be exceeded to accommodateClients moving
from state -only employment and day services to waiver employment and dayservices.
2) Spending Plan: The County will provide the initial spending plan/Program Agreement Budget/Exhibit
C. The planned expenditures for Consumer Support are based on authorized Clients, their acuity
level and work history for a given point in time. To determine the Additional Consumer Support
amount, the Consumer Support amount is multiplied by a percentage. The spending plan may only
be modified by mutual agreement of the parties in writing and shall not require a program
agreement.
(a) Funds Designated for Additional Consumer Services: If a Subcontractor provides Community
Information and Education services under additional consumer services, then activities must
include outreach efforts to federally recognized local tribes.
(b) Program Agreement Amendments: A County can request an amendment at any time. An
amendment for additional client(s) may be supported when clients exceed the number used to
develop the contract. An amendment for additional service hours authorized may be supported
when county provides evidence. An amendment request for expenditures exceeding contract
totaldue to hourly rates paid to service provider may not be supported as the County is
responsible to manage contract and rates paid to their providers.
(c) Exemptions: The DDA Assistant Secretary may approve in writing an exemption to a specific
program agreement requirement.
8) Billing and Payment:
a) Program Agreement Budget: The County shall pay the Subcontractor all allowable costs, which are
defined as costs incurred by the program for:
1) Additional Consumer Services:
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 10 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
(a) Training:
(i) Staff Training: Costs incurred by the program for planned, structured activities for the
purpose of providing, or improving, or enhancing job-related knowledge and skills of staff,
providers, volunteers, or interning students in the provision of developmental disabilities
services.
(ii) Community Information and Education: to inform and/or educate the general public about
developmental disabilities and related services. These may include information and referral
services; activities aimed at promoting public awareness and involvement; and community
consultation, capacity building and organization activities.
(b) Other activities.
(i) Infrastructure projects: Projects in support of Clients (services not easily tracked back to a
specific working age Client) or that directly benefit a Client(s) but the Client is not of
working age. Examples include planning services like benefits planning and generic job
development e.g. "Project Search."
(ii) Start-up projects: Projects that support an agency or directly benefit the agency. Examples
include equipment purchases and agency administrative support.
(iii) Partnership project: Collaborative partnerships with school districts, employment providers,
DVR, Families, employers and other community collaborators needed to provide the
employment supports and services young adults with developmental disabilities require to
become employed during the school year they turn twenty-one (21). Supports provided
should complement and not replace what the student(s) receive through the Individualized
Education Program (IEP).
2) Consumer Support.
(a) Community Inclusion services are individualized services provided in integrated community
settings with other individuals without disabilities. The activities are based on Client interests
and provide opportunities typically experienced by the general public of similar age in their local
community, accessible by public transit or a reasonable commute from their home. The goal of
the service is to support Clients to participate,, contribute, and develop relationships with
community members who are not paid staff. These services may be authorized for individual's
age sixty-two (62) and older. These services may be authorized in addition to or instead of
employment support (Individual Employment or Group Supported Employment) for working age
individuals who have received nine (9) months of employment support.
(b) Child Development Services are designed to meet the developmental needs of each eligiblechild
and the needs of the family related to enhancing the child's development. Services may include
specialized instruction, speech-language pathology, occupational therapy, physical therapy,
assistive technology, and vision services. Services are provided in naturalenvironments to the
maximum extent appropriate.
(c) Individual Supported Employment services are a part of a Client's pathway to employment and
are tailored to individual needs, interests, and abilities to promote careerdevelopment. These
are individualized services necessary to help persons with developmental disabilities obtain and
continue integrated employment at or above the state's minimum wage in the general
workforce. These services may include intake, discovery, assessment, job preparation, job
marketing, job supports, record keeping and support to maintain a job (per the Individual
Employment Phases 8L Billable Activities).
(d) Individualized Technical Assistance services are a part of a Client's pathway toemployment or
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 11 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
community inclusion. This service provides assessment and consultation to the provider to
identify and address existing barriers to employment or community inclusion. This is in
addition to supports received through supported employment or community inclusion services
for individuals who have not yet achieved their goal.
(e) Group Supported Employment services are a part of an Client's pathway to integrated jobs in
typical community employment. These services are intended to be short term and offer ongoing
supervised employment for groups of no more than eight (8) workers with disabilities in the
same setting. The service outcome is sustained paid employment leading to further career
development in integrated employment at or above minimum wage. Examples include enclaves,
mobile crews, and other business models employing small groups of workers with disabilities in
integrated employment community settings.
b) Reimbursement for the state Fiscal Year shall not exceed the total amount listed in Exhibit C to this
Program Agreement. However, with a Program Agreement amendment, the parties may increase or
decrease the Program Agreement amount. Counties will work with DDA HQ on amendments to the
Program Agreement.
c) Monthly Invoice with Signed Documentation: All requests for reimbursement amounts must be entered
and posted into the AWA system. The Contractor may post a combined claim of all programs/services
covered by this Program Agreement. DSHS shall make all payments due to theContractor for all
invoices submitted pursuant to this section within forty-five (45) days following posting of required
information.
d) Clients will be assisted in accessing DVR services per the DDA/DVR MOU. Client services shall notbe
reimbursed under this Program Agreement when the same services are paid for under the
Rehabilitation Act of 1973 by DVR, Public Law 94-142 or any other source of public or private funding.
e) Reimbursement of Client Services: A claim for each Client is made on the AWA system by indicating the
number of service units delivered to each Client listed and the fee per unit. Unitsare defined as:
1) An 'Hour" is at least fifty (50) minutes of direct service. Partial, hour to the quarter may berecorded.
2) A "Day" is at least four (4) hours of direct service and will only be used in connection with AdultDay
Care reimbursement.
3) A "Month" represents a minimum of at least fifty (50) minutes of direct service for CDS
reimbursement.
f) Program Administration: The County will provide program administration and coordination including
such activities as planning, budgeting, contracting, monitoring, and evaluation. Monthly claims for
administration can be 1/12 of the maximum amount identified in Exhibit C under Administration or for
the actual costs incurred in the given month but the total Administration bill will be the lesser of the
two. Administration cost reimbursement and may bill for administrative costs as identified in Exhibit
C. Administrative costs reimbursement will not exceed 7% of the total combined allocation for
Consumer Support and Other Consumer Support services unless the Assistant Secretary of DDA
approves a request for an exception under chapter 388-850WAC. Monthly claims for administrative
costs will be 1/12 of the maximum Administration amount identified in Exhibit C, or the lessor of the
two.
g) The Individual Employment Phases & Billable Activities document defines the individual Client services
that DDA reimburses. That document is located on the DSHS DDA County Best PracticesWeb site at
https: //www.dshs.wa.gov/dda/county-best-practices.
h) The Community Inclusion Billable Activities document defines the individual Client services DDA
reimburses. That document is located on the DSHS DDA County Best Practices Web site at
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 12 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
https: //www.dshs.wa.Qov/dda/county-best-practices.
i) Timeliness of and Modification to Billings: All initial invoices with signed documentation must be
received by the DDA Region within forty-five (45) calendar days following the last day of the month in
which the service is provided. Corrected invoices and documentation including re -posted billing
information will be accepted throughout the fiscal year as long as they are received within sixty (60)
calendar days of the associated fiscal year unless an extension is approved by the DDA Regional
Administrator or designee. Payment will not be made on any invoice submitted past sixty (60) calendar
days after the Program Agreement fiscal year.
j) Recovery of Fees: If the County bills and is paid fees for services that DSHS later finds were (a) not
delivered or (b) not delivered in accordance with Program Agreement standards, DSHS shall recover
the fees for those services and the County shall fully cooperate during the recovery.
k) Preadmission Screening and Resident Review (PASRR) Administration: The County may bill for
administration costs as identified in Exhibit C. Monthly claims for administration cost will be based on
the actual PASRR expenditures multipliedby 7%.
1) Reimbursement for Partnership project: A claim of $2,400 per student for each completed Job
Foundation document that is at a satisfactory or above rating will be requested through the AWA
system as other monthly cost.
m) Job Foundation report line item 95 and 96 as identified in the ADSA Web Access (AWA) billing system.
King, Snohomish and Pierce Counties will use line item 95, all other participating Countieswill use line
item 96 (OSPI). A copy of the completed Job Foundation document will be sent electronically to the
shared mailbox located at: DDAJobFoundationReports dshs.wa.gov
n) Job placement verification for transition students: The AWA Employment Output for Individual
Employment will be completed and submitted with payment request to verify employer, job startdate,
job type, etc.
o) Job Foundation Administration: The County may bill for administration costs as identified in Exhibit C.
Monthly claims for administration cost will be based on the actual expenditures multiplied by 7%. King,
Snohomish and Pierce Counties will use line item 13, all other participating Counties will use line item
14 (OSPI).
9) Intermediate Care Facilities for Intellectual Disabilities (ICF/ID) Agreement. If applicable per 42
CFR 483.410, the County shall assure that all county -operated or subcontracted programs serving persons
living in ICF/ID facilities develop a plan and coordinate their services with the facility on behalfof the ICF/ID
resident. DDA will supply to the County a list of ICF/ID residents who attend a day program.
10) Single State Medicaid Agency—Health Care Authority (HCA): HCA, as the single state Medicaid
Agency, has administrative authority for Title XIX coverage per 42 CFR 431.10. DSHS is the operating
agency for the Home and Community Based Waivers for services for people with developmental
disabilities. The County only has responsibility for services covered in this agreement.
11) DSHS/ DRW Access Agreement: The DRW February 27, 2001 Access Agreement with DDA is
incorporated by reference. The County assures that it and its subcontractors have reviewed theAccess
Agreement. The agreement covers DRW's access to individuals with developmental disabilities, Clients,
programs and records, outreach activities, authority to investigate allegations of abuse and neglect, and
other miscellaneous matters and is binding for all providers of DDA contracted services.
12) Confidential Information. All Counties and their subcontractors must:
a) Ensure the security of Confidential Information, and
b) When transporting client records containing Confidential Information outside a Secure Area, one or
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 13 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-05B78DBC49ED
more of the following as appropriate:
1) Using a Trusted Network; or
2) Encrypting the Confidential Information, including:
(a) Email and/or email attachments
(b) Confidential Information when it is stored on portable devices or media including, but notlimited
to laptop computers and flash memory devices.
13) Data Security Requirements. Exhibit B shall only apply to the Subcontractor if the Subcontractor
possesses one hundred fifty (150) ormore DSHS records across all programs or services throughout their
organization, or transmits more than five (5) records at one time.
14) Supersession of Prior Data Security Agreement. If the Parties hereto have previously entered into a
Standalone Data Security Requirements Agreement., both Parties hereby agree that upon mutual execution
said Agreement shall take precedence as the sole Data security Agreement between the Parties.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 14 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
Exhibit B -Data Security Requirements
1) Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following
definitions:
a) "AES": means the Advanced Encryption Standard, a specification of Federal Information Processing
Standards Publications for the encryption of electronic data issued by the National Institute of
Standards and Technology (https: I/nvl pubs. n ist.gov/nistpubs/fips/nist.fi ps. 197.pdf).
b) "Authorized Users(s)": means an individual or individuals with a business need to access DSHS
Confidential Information, and who has or have been authorized to do so.
c) "Category 4 Data": is data that is confidential and requires special handling due to statutes or
regulations that require especially strict protection of the data and from which especially serious
consequences may arise in the event of any compromise of such data. For purposes of this contract,
data classified as Category 4 refers to data protected by: the Health Insurance Portabilityand
Accountability Act (HIPAA).
d) "Cloud": means data storage on servers hosted by an entity other than the Subcontractor and on a
network outside the control of the Subcontractor. Physical storage of data in the cloud typically spans
multiple servers and often multiple locations. Cloud storage can be divided between consumer grade
storage for personal files and enterprise grade for companies and governmental entities. Examples of
consumer grade storage would include iCloud, Dropbox, Box.com, and many other entities. Enterprise
cloud vendors include Microsoft Azure, Amazon Web Services, 0365, and Rackspace.
e) "Encrypt": means to encode Confidential Information into a format that can only be read by those
possessing a "key"; a password, digital certificate, or other mechanism available only to authorized
users. Encryption must use a key length of at least 128 bits (256 preferred) for symmetric keys, or2048
bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard(AES) must
be used if available.
f) "Hardened Password": means a string of at least eight (8) characters containing at least three (3) of
the following four -character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special
characters such as an asterisk, ampersand, or exclamation point.
g) "Mobile Device": means a computing device, typically smaller than a notebook, which runs a mobile
operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones most
tablets, and other form factors.
h) "Multi -factor Authentication": means controlling access to computers and other IT resources by
requiring two (2) or more pieces of evidence that the user is who they claim to be. These pieces of
evidence consist of something the user knows, such as a password or PIN; something the user hassuch
as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a
fingerprint, facial scan, or retinal scan. "PIN" means a personal identification number, a series of
numbers which act as a password for a device. Since PINs are typically only four (4) to six (6)
characters, PINs are usually used in conjunction with another factor of authentication, such as a
fingerprint.
i) "Portable Device": means any computing device with a small form factor, designed to be transported
from place to place. Portable devices are primarily battery powered devices with base computing
resources in the form of a processor, memory, storage, and network access. Examples include, but are
not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of PortableDevice.
j) "Portable Media": means any machine readable media that may routinely be stored or moved
independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs),
flash memory (thumb drives) devices, external drives, and internal hard drives that have been removed
from a computing device.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 15 of 23
DocuSign Envelope ID: 47FD631 E-35OD-444D-85EF-C5B78DBC49ED
k) "Secure Area": means an area to which only authorized representatives of the entity possessing the
Confidential Information have access, and access is controlled through use of a key, card key,
combination lock, or comparable mechanism. Secure Areas may include buildings, rooms, or locked
storage containers (such as a filing cabinet or desk drawer) within a room, as long as accessto the
Confidential Information is not available to unauthorized personnel. In otherwise Secure Areas, such as
an office with restricted access, the Data must be secured in such a way as to prevent access by non -
authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not
present to ensure that non -authorized staff cannot access it.
1) "Trusted Network": means a network operated and maintained by the Contractor, which includes
security controls sufficient to protect DSHS Data on that network. Controls would include a firewall
between any other networks, access control lists on networking devices such as routers and' switches,
and other such mechanisms which protect the confidentiality, integrity, and availability ofthe Data.
m) "Unique User ID": means a string of characters that identifies a specific user and which, inconjunction
with a password, passphrase or other mechanism, authenticates a user to aninformation system.
2) Authority. The security requirements described in this document reflect the applicable requirements of
Standard 141.10 (https://ocio.wa.gov/policies) of the Office of the Chief Information Officer for the stateof
Washington, and' of the DSHS Information Security Policy and Standards Manual. Reference material
related to these requirements can be found here: https://www.dshs.wa.gov/ffa/keer)inq-dshs- client -
information -private -and -secure, which is a site developed by the DSHS Information Security Office and
hosted by DSHS Central Contracts and Legal Services.
3) Administrative Controls. The Subcontractor must have the following controls in place:
a) A documented security policy governing the secure use of its computer network and systems, and
which defines sanctions that may be applied to Contractor staff for violating that policy.
b) If the Data shared under this agreement is classified as Category 4 data, the Contractor must beaware
of and compliant with the applicable legal or regulatory requirements for that Category 4 Data.
C) If Confidential Information shared under this agreement is classified as Category 4 data, the Contractor
must have a documented risk assessment for the system(s) housing the Category 4Data.
4) Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to
authorized staff, the Subcontractor must:
a) Have documented policies and procedures governing access to systems with the shared Data.
b) Restrict access through administrative, physical, and technical controls to authorized staff.
c) Ensure that user accounts are unique and that any given user account logon ID and password
combination is known only to the one (1) employee to whom that account is assigned. For purposes of
non -repudiation, it must always be possible to determine which employee performed a given actionon
a system housing the Data based solely on the logon ID used to perform the action.
d) Ensure that only authorized users are capable of accessing the Data.
e) Ensure that an employee's access to the Data is removed immediately:
1) Upon suspected compromise of the user credentials.
2) When their employment, or the contract under which the Data is made available to them, is
terminated.
3) When they no longer need access to the Data to fulfill the requirements of the contract.
f) Have a process to periodically review and verify that only authorized users have access to systems
containing DSHS Confidential Information
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 16 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
g) When accessing the Data from within the Subcontractor's network (the Data stays within the
Subcontractor's network at all times), enforce password and logon requirements for users within the
Contractor's network, including:
1) A minimum length of eight (8) characters and containing at least three (3) of the following
character classes: uppercase letters, lowercase letters, numerals, and special characters such as
asterisk, ampersand, or exclamation point.
2) That a password does not contain a user's name, logon ID, or any form of their full name.
3) That a password does not consist of a single dictionary word. A password may be formed as a
passphrase which consists of multiple dictionary words.
4) That passwords are significantly different from the previous four (4) passwords. Passwords that
increment by simply adding a number are not considered significantly different.
h) When accessing Confidential Information from an external location (the Data will traverse the Internet
or otherwise travel outside the Contractor's network), mitigate risk and enforce passwordand logon
requirements for users by employing measures including:
1) Ensuring mitigations applied to the system don't allow end-user modification.
2) Not allowing the use of dial-up connections.
3) Using industry standard protocols and solutions for remote access. Examples would includeRADIUS
and Citrix.
4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a
component within the Trusted Network. The traffic must be encrypted at all times while traversing
any network, including the Internet, which is not a Trusted Network.
5) Ensuring that the remote access system prompts for re -authentication or performs automated
session termination after no more than thirty (30) minutes of inactivity.
6) Ensuring use of Multi -factor Authentication to connect from the external end point to the internal
end point.
i) Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication
mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token(software, hardware,
smart card, etc.) in that case:
1) The PIN or password must be at least five (5) letters or numbers when used in conjunction with at
least one other authentication factor.
2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be
acceptable).
3) Must not contain a "run" of three (3) or more consecutive numbers (12398, 98743 would not be
acceptable)
j) If the contract specifically allows for the storage of Confidential Information on a Mobile Device,
passcodes used on the device must:
1) Be a minimum of six (6) alphanumeric characters.
2) Contain at least three (3) unique character classes (upper case, lowercase, letter, number).
3) Not contain more than a three (3) consecutive character run. Passcodes consisting of 12345, or
abcd12 would not be acceptable.
k) Render the device unusable after a maximum of ten (10) failed logon attempts.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 17 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
5) Protection of Data. The Subcontractor agrees to store Data on one (1) or more of the following media
andprotect the Data as described:
a) Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be
restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User IDand
Hardened Password or other authentication mechanisms, which provide equal or greater security, such
as biometrics or smart cards.
b) Network server disks. For Data stored on hard disks mounted on network servers and made
available through shared folders, access to the Data will be restricted to Authorized Users through the
use of access control lists which will grant access only after the Authorized User has authenticated to
the network using a Unique User ID and Hardened Password or other authentication mechanisms
which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to
such servers must be located in an area, which is accessible on lyto authorized personnel, with access
controlled through use of a key, card key, combination lock, orcomparable mechanism.
1) For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as
long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above
paragraph. Destruction of the Data, as outlined below in Section 8 Data Disposition, may be
deferred until the disks are retired, replaced, or otherwise taken out of the Secure Area.
c) Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on
optical discs which will be used in local workstation optical disc drives, and which will not be
transported out of a Secure Area. When not in use for the contracted purpose, such discs must be
Stored in a Secure Area. Workstations which access DSHS Data on optical discs must be located in an
area which is accessible only to authorized personnel, with access controlled through use of akey, card
key, combination lock, or comparable mechanism.
d) Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by
DSHS on optical discs which will be attached to network servers, and which will not be transported out
of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use
of access control lists which will grant access only after the Authorized User has authenticated to the
network using a Unique User ID and Hardened Password or other authentication mechanisms which
provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such
servers must be located in an area which is accessible onlyto authorized personnel, with access
controlled through use of a key, card key, combination lock, orcomparable mechanism.
e) Paper documents. Any paper records must be protected by storing the records in a Secure Area,
which is only accessible to authorized personnel. When not in use, such records must be stored ina
Secure Area.
f) Data storage on portable devices or media.
1) Except where otherwise specified herein, DSHS Data shall not be stored by the Subcontractor on
portable devices or media unless specifically authorized within the terms and conditions of the
Contract. If so authorized, the Data shall be given the following protections:
a) Encrypt the Data.
b) Control access to devices with a Unique User ID and Hardened Password or stronger
authentication method such as a physical token or biometrics.
c) Manually lock devices whenever they are left unattended and set devices to lock automatically
after a period of inactivity, if this feature is available. Maximum period ofinactivity is twenty
(20) minutes.
d) Apply administrative and physical security controls to Portable Devices and Portable Media by:
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 18 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
i) Keeping them in a Secure Area when not in use,
ii) Using check-in/check-out procedures when they are shared, and
iii) Taking frequent inventories
2) When being transported outside of a Secure Area, Portable Devices and Portable Media with DSHS
Confidential Information must be under the physical control of Subcontractor staff with
authorization to access the Data, even if the Data is encrypted.
g) Data stored for backup purposes.
1) DSHS Confidential information may be stored on Portable Media as part of a Contractor's existing,
documented backup process for business continuity or disaster recovery purposes. Such storage is
authorized until such time as that media would be reused during the course of normal backup
operations. If backup media is retired while DSHS Confidential Information still exists upon it, such
media will be destroyed at that time in accordance with the disposition requirements below in
Section 8 Data Disposition.
2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media, etc.)
as part of a Contractor's existing, documented backup process for business continuity or disaster
recovery purposes. If so, such media will be protected as otherwise described in this exhibit. If this
media is retired while DSHS Confidential Information still exists upon it, the data will be destroyed
at that time in accordance with the disposition requirements below in Section 8 Data Disposition
h) Cloud storage. DSHS Confidential Information requires protections equal to or greater than those specified
elsewhere within this exhibit. Cloud storage of Data is problematic as neither the County nor the
Subcontractor has control of the environment in which the Data is stored. For this reason:
1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions
are met:
a) Subcontractor has written procedures in place governing use of the Cloud storage and Subcontractor
attest to the contact listed in the contract and keep a copy of that attestation for your records in
writing that all such procedures will be uniformly followed.
b) The Data will be Encrypted while within the Subcontractor network.
c) The Data will remain Encrypted during transmission to the Cloud.
d) The Data will remain Encrypted at all times while residing within the Cloud storage solution.
e) The Subcontractor will possess a decryption key for the Data, and the decryption key will be
possessed only by the Subcontractor.
f) The Data will not be downloaded to non -authorized systems, meaning systems that are not on
the Subcontractor network.
g) The Data will not be decrypted until downloaded onto a computer within the control of an
Authorized User and within either the DSHS or Subcontractor's network.
2) Data will not be stored on an Enterprise Cloud storage solution unless either:
a) The Cloud storage provider is treated as any other Sub -Contractor, and agrees in writing to all
the requirements within this exhibit; or,
b) The Cloud storage solution used is HIPAA compliant.
c) If the Data includes protected health information covered by the Health Insurance Portability
and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement
prior to Data being stored in their Cloud solution.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 19 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
6) System Protection. To prevent compromise of systems which contain DSHS Data or through which that
Data passes:
a) Systems containing DSHS Data must have all security patches or hotfixes applied within three (3)
months of being made available.
b) The Subcontractor will have a method of ensuring that the requisite patches and hotfixes have been
applied within the required timeframes.
c) Systems containing DSHS Data shall have an Anti-Malware application, if available, installed.
d) Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware
database the system uses, will be no more than one update behind current.
7) Data Segregation.
a) DSHS category 4 data must be segregated or otherwise distinguishable from non-DSHS data. Thisis to
ensure that when no longer needed by the Subcontractor, all DSHS Data can be identified for return or
destruction. It also aids in determining whether DSHS Data has or may have been compromised in the
event of a security breach. As such, one or more of the following methods will be used for data
segregation:
1) DSHS Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain nonon-
DSHS Data.
2) DSHS Data will be stored in a logical container on electronic media, such as a partition or folder
dedicated to DSHS Data.
3) DSHS Data will be stored in a database which will contain no non-DSHS data. And/or,
4) DSHS Data will be stored within a database and will be distinguishable from non-DSHS data bythe
value of a specific field or fields within database records.
5) When stored as physical paper documents, DSHS Data will be physically segregated from non-
DSHS data in a drawer, folder, or other container stored as physical paper documents, DSHS Data
will be physically segregated from non-DSHS data in a drawer, folder, or other container.
8) Data Disposition. When the contracted work has been completed or when the Data is no longer needed,
except as noted above in Section 5.b, Data shall be returned to DSHS or destroyed. Media onwhich Data
may be stored and associated acceptable methods of destruction are as follows:
Data store on:
Will be destroyed by:
Server or workstation hard disks, or
Using a ""wipe" utility which will overwrite the
Data at least three (3) times using either random
or single character data, or
Removable media (e.g. floppies, USB
Degaussing sufficiently to ensure that the Data
flash drives, portable hard disks)
cannot be reconstructed, or
excluding optical disk.
Physically destroying the disk
Paper documents with sensitive or
Recycling through a contracted firm, provided
Confidential Information.
the contract with the recycler assures that the
confidentiality of Data will be protected.
Paper documents containing
On-site shredding, pulping or incineration.
Confidential Information requiring
special handling (e.g. protected
health information).
Optical disks (e.g. CDS or DVDs
Incineration, shredding, or completely defacing
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 20 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
the readable surface with a coarse abrasive.
Magnetic tae Degaussing, incinerating or crosscut shredding.
9) Notification of Compromise or Potential Compromise. The compromise or potential compromise of
DSHS shared Data must be reported to the County within one (1) business day of discovery. The County
will notify the DSHS Privacy Officer at dshsprivacvofficer@dshs.wa.gov. Subcontractor must also take
actions to mitigate the risk of loss and comply with any notification or other requirements imposed by-law
or DSHS.
10) Data shared with Subcontractors. If DSHS Data provided under this Contract is to be shared with a
Subcontractor, the Contract with the Subcontractor must include all of the data security provisions within
this Contract and within any amendments, attachments, or exhibits within this Contract. If the
Subcontractor cannot protect the Data as articulated within this Contract, then the contract with the
Subcontractor must be submitted to the DSHS Contact specified for this contract for review and approval.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 21 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-C5B78DBC49ED
Exhibit C - Spending Plan Agreement
The Subcontractor agrees to the following in satisfactorily performing the terms and conditions of this
contract:
a) Payment for Group Supported Employment will be paid at an hourly rate of $91.04.
b) Payment for Individual Employment Services will be paid at an hourly rate of $105.60.
c) Payment for Community Inclusion Services will be paid at an hourly rate of $61.36.
d) Payment for services will be made on afee-for-service basis unless otherwise specified in this agreement;
e) No payment shall be made for any services rendered by the Subcontractor except for services within the
scope of this agreement, and all funds received must be used for services as identified in this agreement;
f) Except as provided in the section titled Reduction in Funding, all budget revisions shall be treated as
agreement modifications.
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 — 6/30/2024 Page 22 of 23
DocuSign Envelope ID: 47FD631 E-350D-444D-85EF-05l378DBC49ED
BOARD OF COUNTY COMMISSIONERS
Rob Joni Date
�cz��3
Cindy CartA, Vice -Chair Date
Danny Stone, Member Date
t:
� �,Z9,Z3
Barb alkaVasquez, Date
Clerk bf he Board
Approved as to form:
Rebekah Kay jw"" Date
Chief Deputy Prosecuting Attorney
GRANT & ADAMS COUNTY
DEVELOPMENTAL DISABILITIES
e--Docuftned by:
Motto, pawlb6vu 8/18/2023
F489AS V Aq 6...
Nicole R. Davidson Date
Developmental Disabilities County Coordinator
e--Docuftned by:
Vell 4mle*�Pao 8/17/2023
AFQ1 qQ.56Q7P34Q1
Dell Anderson, M.Ed., LMHC Date
Renew Executive Director
ee—Docuftned by:
O br(k(G 8/17/2023
!h,.raa33QQ44@71W4r=c__.
Clark Brekke, President and CEO Date
Goodwill Industries of the Inland Northwest
Grant & Adams County Developmental Disabilities - Subcontractor Agreement 7/1/2023 – 6/30/2024 Page 23 of 23