Common use of Paragraph XXII Clause in Contracts

Paragraph XXII. Records Management and Maintenance of the Contract is deleted in its entirety and replaced with the following: A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”

Paragraph XXII. Records Management and Maintenance of the Contract is deleted in its entirety and replaced with the following: A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as County of Orange, Health Care Agency File Folder: M042DR049 Page 3 of 49 Contract MA-042-18011730 required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”

Paragraph XXII. Records Management and Maintenance of the Contract is deleted in its entirety and replaced with the following: A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”

Paragraph XXII. Records Management and Maintenance of the Contract is deleted in its entirety and replaced with the following: A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. . County of Orange, Health Care Agency File Folder: M042NW043 Page 3 of 47 Contract MA-042-18010268 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”

Paragraph XXII. Records Management and Maintenance of the Contract is deleted in its entirety and replaced with the following: A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications.. County of Orange, Health Care Agency File Folder: M042NW044 Page 3 of 47 Contract MA-042-18010274 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”