Okaloosa County BOCC — August 18, 2015 — Maruti-Executed Contract — reading text

order for both parties to close their books and records , the CONTRACTOR shall clearly state "final invoice" on the CONTRACTOR's final/last billing to the COUNTY. This shall constitute CONTRACTOR's certification that all services have been properly performed and all charges and costs have been invoiced to the COUNTY. Any further charges, if not properly included on this final invoice, are waived by the CONTRACTOR. ARTICLE 5 -BUSINESS ASSOCIATE AGREEMENT To the extent applicable, CONTRACTOR, including its agents , servants, subcontractors and employees shall appropriately safeguard protected health information ("PHI") that may be created , received, maintained, or transmitted on behalf of the COUNTY, in compliance with the applicable provisions of Public Law 104-191 of August 21, 1996, known as the Health Insurance Portability and Accountability Act of 1996, Subtitle F - Administrative Simplification , Sections 261 , et seq. , as amended and any related regulations ("H IPAA") , and with Public Law 111-5 of February 17, 2009, known as the American Recovery and Reinvestment Act of 2009 , Title XII , Subtitle D - Privacy, Sections 13400, et seq. , the Health Information Technology and Clinical Health Act, as amended and any related regulations (the "HITECH Act"), to the extent the acts and implementing regulations are applicable to the services provided by CONTRACTOR. Notwithstanding that HIPAA and its implementing may not prevent the disclosure of PHI , or other health or personal information acquired by CONTRACTOR in its performance of this Contract, CONTRACTOR shall not volunteer or disclose health or personal information to third parties , unless such disclosure is required by Florida's Public Records or other law applicable to the records created , possessed or maintained by CONTRACTOR. A. General Provisions 1. Meaning of Terms. The terms used in this Contract shall have the same meaning as those terms defined in HIPAA. 2. Regulatory References. Any reference in this Contract to a regulatory section means the section currently in effect or as amended. 3. Interpretation. Any ambiguity in this Contract shall be interpreted to permit compliance with HIPAA. Page 5 of 45 B. Obligations of CONTRACTOR To the extent required by law, CONTRACTOR agrees that it will : 1. Not use or further disclose PHI other than as permitted or required by this Contract or as required by law; 2. Use appropriate safeguards and comply, where applicable, with the HIPAA Security Rule with respect to electronic protected health information ("e-PHI") and implement appropriate physical, technical and administrative safeguards to prevent use or disclosure of PHI other than as provided for by this Contract; 3. Report in writing to the COUNTY any use or disclosure of PHI not provided for by this Contract of which CONTRACTOR becomes aware , including any security incident (as defined in the HIPAA Security Rule) and any breach of unsecured PHI (as defined in the HIPAA Breach Notification Rule) within three (3) business days of CONTRACTOR's discovery of the security incident or breach. CONTRACTOR will comply with all applicable provisions of the HIPAA Breach Notification Regulations found at 45 CFR §164.400 et seq. when making breach notification to the COUNTY. The COUNTY shall have sole control over the timing and method of breach notification to affected individual(s), the Department of Health and Human Services, and, if applicable, the media. CONTRACTOR agrees that, if requested by the COUNTY to do so, it will provide breach notification to affected individuals of any breach of unsecured PHI discovered by Business Associate. If requested by the COUNTY to make breach notification to affected individuals , CONTRACTOR shall comply with all applicable provisions of the HIPAA Breach Notification Regulations found at 45 CFR §164.400 et seq., and any direction from the COUNTY; 4. In accordance with 45 CFR §164.502(e)(1 )(ii) and §164.308(b)(2), ensure that any subcontractors that create, receive, maintain , or transmit PHI on behalf of CONTRACTOR agree to the same restrictions, conditions, and requirements that apply to CONTRACTOR with respect to such information by requiring such subcontractors to sign an agreement with CONTRACTOR that contains , at a minimum, the same provisions as this Contract; 5. Make PHI in a designated record set available to the COUNTY and to an individual who has a right of access in a manner that satisfies the COUNTY's obligations to provide access to PHI in accordance with 45 CFR §164.524 within 30 days of a request ; 6. Make any amendment(s) to PHI in a designated record set as directed by the COUNTY, or take other measures necessary to satisfy the COUNTY's obligations under 45 CFR §164.526; Page 6 of 45 7. Maintain and make available information required to provide an accounting of disclosures to the COUNTY or an individual who has a right to an accounting within 60 days and as necessary to satisfy the COUNTY's obligations under 45 CFR §164.528; 8. To the extent that CONTRACTOR is to carry out any of the COUNTY's obligations under the HIPAA Privacy Rule, CONTRACTOR shall comply with the requirements of the Privacy Rule that apply to the COUNTY when it carries out that obligation ; 9. Make its intemal practices, books, and records relating to the use and disclosure of PHI received from , or created or received by CONTRACTOR on behalf of the COUNTY, available to the Secretary of the Department of Health and Human Services for purposes of determining Business Associate's and the COUNTY's compliance with HIPAA and the HITECH Act; 10. Restrict the use or disclosure of PHI if the COUNTY notifies CONTRACTOR of any restriction on the use or disclosure of PHI that the COUNTY has agreed to or is required to abide by under 45 CFR §164.522; and 11. Assist the COUNTY in complying with its Red Flags Rule obligations , if the COUNTY is subject to the Red Flags Rule (found at 16 CFR §681 .1 et seq.), by: (a) implementing policies and procedures to detect relevant Red Flags (as defined under 16 C.F.R. §681.2); (b) taking all steps necessary to comply with the policies and procedures of the COUNTY's Identity Theft Prevention Program (if the COUNTY is required to have a Program) ; (c) ensuring that any agent or third party who performs services on its behalf in connection with covered accounts of the COUNTY agrees to implement reasonable poliCies and procedures designed to detect, prevent, and mitigate the risk of identity theft; and (d) alerting the COUNTY of any Red Flag incident (as defined by the Red Flag Rules) of which it becomes aware, the steps it has taken to mitigate any potential harm that may have occurred, and provide a report to the COUNTY of any threat of identity theft as a result of the incident. Protect, defend, reimburse, indemnify and hold the COUNTY. and their respective agents, employees and elected officers harmless from and against all claims, liability, expense, loss , cost, damages or causes of action of every kind or character, including attorney's fees and costs, whether at trial or appellate levels or otherwise, arising as a result of a breach of unsecured PHI caused by any act or omission of CONTRACTOR or arising from any other violation of HIPAA or the HITECH Act caused by any act or omission of CONTRACTOR. Page 7 of 45 ARTICLE 6 - PERFORMANCE BOND The CONTRACTOR shall furnish , to the COUNTY, a Performance Bond or Clean Irrevocable Letter of Credit in the amount equal to 1 month's value of the total contract. The Performance Bond or Clean Letter of Credit shall take effect on the commencement date of this Contract, and CONTRACTOR shall keep the same in full force and effect during the entire term of this Contract. The CONTRACTOR shall furnish a Performance Bond in a form and format and with terms and conditions satisfactory to the COUNTY, that conforms with the requirements of the COUNTY, unless expressly provided herein to the contrary, as security for the faithful performance of this Contract and for all costs incurred by the COUNTY to obtain full performance of the Contract, including but not limited to a replacement contract, in the event the CONTRACTOR fails to perform as required under the Contract. The term "COST" as used herein shall include all fees , costs, and expenses arising out of the CONTRACTOR's failure to perform the Contract whether direct, indirect, actual, consequential, or incidental , and shall include attomey's fees and costs, expert witness fees and expenses, the costs of all appellate proceedings and all time incurred by the COUNTY. The Performance Bond is to ensure the faithful performance of all the requirements of this Contract, and to save, defend, indemnify, and hold harmless the COUNTY from any and all damages , costs, fees , and expenses either directly or indirectly arising out of any failure to perform the Contract, whether in whole or in part. The Bond shall be issued by a company authorized to do business in the State of Florida and having a currently valid certificate of authority and bonding capacity, as issued by the United States Department of Treasury under 31.U .S.C., sections 9304 through 9308. The CONTRACTOR shall verify with the COUNTY, prior to execution of the Contract, the acceptability of the surety provided thereunder. A cash deposit, certified check, or Clean Irrevocable Letter of Credit, from a financial institution with a rating deemed acceptable by the COUNTY, may be provided in lieu of the Performance Bond provided that the form , format, and terms of coverage are acceptable to the COUNTY. The terms of coverage of an Irrevocable Letter of Credit shall be substantially the same as that required of the Performance and Payment Bond , and the Letter of Credit shall be issued by an institution that offers security similar to that of a bonding company. In lieu of a Performance Bond or Clean Irrevocable Letter of Credit whose term is for the duration of the Contract, the CONTRACTOR may provide an initial Performance Bond or Clean Irrevocable Letter of Credit whose term is for one (1) year and which is renewable on an annual basis. CONTRACTOR shall renew the Performance Bond or Clean Irrevocable Letter of Credit so that it remains in full force and effect during each year of the Contract. The renewed instrument must be received by COUNTY at least sixty (60) days prior to the expiration of the then current term of the Performance Bond or Clean Irrevocable Letter of Credit provided to COUNTY. Each renewed instrument shall fully comply with the provisions of this Contract. CONTRACTOR's failure to renew Page 8 of 45 or the COUNTY to receive a renewed Performance Bond or Clean Irrevocable Letter of Credit in accordance with the requirements of this Contract, fo r any year of the Contract may result in the termination of the Contract. ARTICLE 7 - TRUTH-IN-NEGOTIATION