Okaloosa County BOCC — 2013 meeting #1139 (date undetermined) — MEDICAID ORIGINAL 2009 — reading text

systems, networks, or data being Viewed, manipulated, damaged, destroyed or made inaccessible by an unauthorized activity. See National Institute of Standards and Technology (NIST) Special Publication 800-61, "Computer Security Incident Handling Guide," for more information. 2. Use and Disclosure of Protected Health Information. The Recipient shall not use or disclose protected health information other than aspermitled by this Agreement or by federal and state law. The Recipient will use appropriate safeguards to prevent the use or disclosure of protected health information for any purpose not in conformity with this Agreement and federal and state law. The Recipient will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic protected health information the Recipient creates, receives, maintains, or transmits on behalf of the Agency. 3. Use and Disclosure of Information for Management. Administration. and Legal Responsibilities. The Recipient is permitted to use and disclose protected health information received from the Agency for the proper management and administration of the Recipient or to carry out the legal responsibilities of the ReCipient, in accordance with 45 CF.R. 164.504(e)(4). Such disclosure is only permissible where required by law, or where the Recipient obtains reasonable assurances from the person to whom the protected health information is disclosed that: (1) the protected health information will be held confidentially, (2) the protected health information will be used or further disclosed only as required by law or for the purposes for which it was disclosed to the 2008/2009 Medicaid Non~Emergency Transportation Subcontracted Transportation Provider Contract Page 89 of 117  person, and (3) the person notifies the Recipient of any instance of which it is aware in which the confidentiality of the protected health information has been breached. 4. Disclosure to Third Parties. The Recipient will not divulge, disclose, or communicate protected health information to any third party for any purpose not in conformity with this Agreement without prior written approval from the Agency. The Recipient shall ensure that any agent, including a subcontractor, to whom it provides protected health information received from, or created or received by the Recipient on behalf of, the Agency agrees to the same terms, conditions, and restrictions that apply to the Recipient with respect to protected health information. 5. Access to Information. The Recipient shall make protected health information available in accordance with federal and state law, including providing a right of access to persons who are the subjects of the protected health information in accordance with 45 C.F.R. 164.524. 6. Amendment and Incorporation of Amendments. The Recipient shall make protected health information available for amendment and to incorporate any amendments to the protected health information in accordance with 45 C.F.R. § 164.526. 7. Accounting for Disclosures. The Recipient shall make protected health information available as required to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528. The Recipient shall document all disclosures of protected health information as needed for the Agency to respond to a request for an accounting of disclosures in accordance with 45 C.F.R. § 164.528. 8. Access to Books and Records. The Recipient shall make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the Recipient on behalf of the Agency, available to the Secretary of the Department of Health and Human .Services or the Secretary's designee . for purposes· of determining compliance with the Department of Health and Human Services Privacy Regulations. 9. Reporting. The Recipient shall make a good faith effort to identify any use or disclosure of protected health information not provided for in this Agreement. The Recipient will report to the Agency, within ten (10) business days of discovery, any use or disclosure of protected health information not provided for in this Agreement of which the Recipient is aware. The Recipient will report to the Agency, within twenty-four (24) hours of discovery, any security incident of which the Recipient is aware. A violation of this paragraph shall be a material violation of this Agreement. 10. Termination. Upon the Agency's discovery of a material breach of this Attachment, the Agency shall have the right to terminate this Agreement. 10.a. Effect of Termination. At the termination of this Agreement, the Recipient shall return all protected health information that the Recipient still maintains in any form, including any copies or hybrid or merged databases made by the Recipient; or with prior written approval of the Agency, the protected health 2008/2009 Medicaid Non·Emergency Transportation Subcontracted Transportation Provider Contract Page 90 of 117  information may be destroyed by the Recipient after its use. If the protected health information is destroyed pursuant to the Agency's prior written approval, the Recipient must provide a written confirmation of such destruction to the Agency. If return or destruction of the protected health information is determined not feaSible by the Agency, the Recipient agrees to protect the protected health information and treat it as strictly confidential. The Recipient has caused this Attachment to be signed and delivered by its duly authorized representative, as of the date set forth below. Recipient Name: William J, Roberts TTT. Chairman Name and Title of Authorized Signer 2008/2009 Medicaid Non-Emergency Transportation Subcontracted Transportation Provider Contract Page 91 of 117  ATTACHMENT 2 SPECIAL AUDIT REQUIREMENTS The administration of resources awarded by the Commission for the Transportation Disadvantaged (which may be referred to as the "Agency" or "Grantor'') to the recipient (which may be referred to as the "Vendor", "Facility" or "Recipient'') may be subject to audits and/or monitoring by the Commission, as described in this Attachment. MONITORING In addition to reviews of audits conducted in accordance with OMS Circular A-133 and Section 215.97, F.S., as revised (see "AUDITS" below), monitoring procedures may include, but not be limited to, on-site visits by Commission staff, limited scope audits as defined by OMB Circular A- 133, as revised, and/or other procedures. By entering into this Agreement, the Recipient agrees to comply and cooperate with any monitoring procedures/processes deemed appropriate by the Commission. In the event the Commission determines that a limited scope audit of the Recipient is appropriate, the Recipient agrees to comply with any additional instructions provided by the Commission staff to the Recipient regarding such audit. The Recipient further agrees to comply and cooperate with any inspections, reviews, investigations, or audits deemed necessary by the Chief Financial Officer (CFO) or Auditor General. AUDITS PART I: FEDERALLY FUNDED Recipients of federal funds (i.e. state, local government, or non-profit organizations as defined in OMB Circular A-1233, as revised) are to have audits done annually using the following criteria:·· . .. 1. In the event that the recipient expends $500,000 or more in Federal awards in its fiscal year, the Recipient must have a single or program-specific audit conducted in accordance with the provisions of OMB Circular A-133, as revised. EXHIBIT 1 to this agreement indicates Federal resources awarded through the Agency for Health Care Administration by this Agreement. In determining the Federal awards expended in its fiscal year, the Recipient shall consider all sources of Federal awards, including Federal resources received from the Commission. The determination of amounts of Federal awards expended should be in accordance with the guidelines established by OMB Circular A-133, as revised. An audit of the Recipient conducted by the Auditor General in accordance with the provisions OMB Circular A-133, as revised, will meet the reqUirements of this part. 2. In connection with the audit requirements addressed in Part I, paragraph 1, the Recipient shall fulfill the requirements relative to auditee responsibilities as provided in Subpart C of OMB Circular A-133, as revised. 2008/2009 Medicaid Non-Emergency Transportation Subcontracted Transportation Provider Contract Page 92 of 117  3. If the Recipient expends less than $500,000 in Federal awards in its fiscal year, an audit conducted in accordance with the provisions of OMS Circular A-133, as revised, is not required. However, if the recipient elects to have an audit conducted in accordance with the provisions of OMS Circular A-133, as revised, the cost of the audit must be paid from non-Federal resources (i.e., the cost of such an audit must be paid from Recipient resources obtained from other than Federal entities). 4. Federal awards are to be identified using the Catalog of Federal Domestic Assistance (CFDA) title and number, award number and year, and name of the awarding federal agency. The Recipient may access information regarding the Catalog of Federal Domestic Assistance (CFDA) via the internet at jlttp:!l12.46.245.173fcfdafcfda.html. PART II: STATE FUNDED Recipients of state funds (i.e. a nonstate entity as defined by Section 215.97(2)(1), Florida Statutes) are to have audits done annually using the following criteria 1. In the event that the Recipient expends a total amount of state financial assistance equal to or in excess of $500,000 in any fiscal year of such Recipient, the Recipient must have a State single or project-specific audit for such fiscal year in accordance with Section 215.97, Florida Statutes; applicable rules of the Department of Financial Services; and Chapters 10.550 (local governmental entities) or 10.650 (nonprofit and for-profit organizations), Rules of the Auditor General. EXHIBIT 1 to this agreement indicates state financial assistance awarded through the Commission by this Agreement. In determining the state financial assistance expended in its fiscal year, the Recipient shall consider all sources of state financial assistance, including state financial assistance received from the Commission, other state agencies, and other nonstate entities. State financial assistance does not include Federal direct or pass-through awards and resources received by a nonstate entity for Federal program matching requirements. 2. In connection with the audit requirements addressed in Part II, paragraph 1, the