Loading...
HomeMy WebLinkAbout2016-405-E Health - Piedmont Health Services, Inc. for support for medical and dental care DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B 2016-17 OUTSIDE AGENCY PERFORMANCE AGREEMENT This Agreement, made and entered into the first day of July 2016, by and between the County of Orange, a political subdivision of the State of North Carolina, 200 South Cameron Street, Hillsborough, North Carolina, 27278, ("County") and Piedmont Health Services, Inc., a not-for-profit corporation, located at 299 Lloyd St., Carrboro, NC 27510 ("Provider"). WITNESSETH: WHEREAS, it is in the interests of the County that said program be assisted by the County and thereby enhance its availability to residents of the County, and said program addresses an important community human services need, as identified by the Board of Commissioners; WHEREAS, for the purpose and subject to the terms and conditions hereinafter set forth, the County hereby contracts for the services of the Provider, and the Provider agrees to provide the services to the County in accordance with the terms of this Agreement. NOW, THEREFORE, in consideration of the above and the mutual covenants and conditions hereafter set forth, the County and Provider agree as follows: 1. Term of the Agreement. The term of this Agreement shall be a program year beginning July 1, 2016 to June 30, 2017. 2. Scope of Services. a. Provider will provide services, as outlined in the attached Scope of Services and any amendments or revision thereto which is attached as Exhibit "A" and incorporated by reference, to the residents of Orange County. The Scope of Services may be different from the original application based on County appropriation; however, any revisions or amendments to this Agreement must be approved in writing by the County and attached to this Agreement. b. The Provider shall be solely responsible for the means, methods, techniques, sequence, safety program and procedures necessary to properly and fully complete the work set forth in the Scope of Services. 3. Funding. a. The County agrees to appropriate for the provision of services described in Exhibit A, Scope of Services and more particularly described in the Program Budget, the maximum sum of Eleven Thousand dollars ($11,000.00). b. All funds appropriated shall be used for purposes described in Exhibit A. Any funds not used for the purposes stated shall be returned to the County. Any substantive changes in the use of funds must be authorized in writing by the County prior to any expenditure of the funds by the Provider. If the funds are expended not in accordance with the Scope of DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B Services, at the discretion of the County the Provider may be required to repay the funds to the County. c. The County's obligation to make each payment is contingent upon receipt of Quarterly Progress Reports and satisfactory progress toward completion of performance measures and accounting of expenditures as detailed in the attached Scope of Services. d. The Provider shall be paid in four equal installments in the amount of$2,750.00, contingent upon receipt of the quarterly request for reimbursement and related supporting documentation. The first installment shall be paid no later than August 31 of the Program year and after execution of this Outside Agency Performance Agreement by both the County and the Provider; the remaining installments shall be disbursed on October 15, January 15 and April 15 of the program year and upon satisfactory completion of(c) and the information included in this paragraph. e. Once Provider has satisfied its obligations as provided in (c) and (d) above, payment will be made 30 days after receipt of the Quarterly Progress Report and Request for Reimbursement or 30 days after due date of Quarterly Progress Report whichever is later. f. The County is not obligated to provide any other support to Provider in this or in succeeding fiscal years. 4. Agency Reporting. a. Provider will provide the Orange County a quarterly report that includes a fiscal report, updates on 2016-2017 performance measures and objectives as provided in Scope of Services. Quarterly Progress Report dates are: July 1 — September 15, September 16 — December 15; December 16— March 15 and March 16 -June 30. Quarterly reports are due on October 1, December 31,April 1 and July 31 of the program year. b. Reports shall be forwarded to the Orange County Health Director. c. Provider agrees to allow the County to inspect its financial books and records, which document costs of those services, upon reasonable notice during normal working hours. 5. Termination. a. In the event of any of the circumstances set forth below (hereinafter referred to as "default"), the County may immediately terminate this Agreement, in whole or in part, and from time to time. Notice of termination must be in writing, state the reason or reasons for the termination, and specify the effective date of the termination: i. In the event that Provider shall cease to exist as an organization or shall enter bankruptcy proceedings, be declared insolvent, or liquidate all or substantially all of its assets, or significantly reduce its services or accessibility to Orange County residents during the term of this Agreement; or Piedmont Health Services,Inc. Orange County Performance Agreement Page 2 Rev. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B ii. In the event that Provider shall fail to render a satisfactory accounting as provided section 4 above, the County may terminate this Agreement and Provider shall return all payments already made to it by the County for services which have not been provided or for which no satisfactory accounting has been rendered; or iii. In the event of any fraudulent representation by the Provider in an invoice or other verification required to obtain payment under this Agreement or other dishonesty on a material matter relating to the performance of services under this Agreement. iv. Nonperformance,incomplete service or performance, or failure to satisfactorily perform any part of the work identified in the Scope of Services or to comply with any provision of this Agreement, as determined by the County in its sole discretion. v. Failure to adhere to the terms of applicable county, state or federal laws, regulations, or stated public policy. b. In the event of default by the Provider, the county may elect to terminate this Agreement,in whole or in part and/or require the Provider to repay the funds within seven (7) from written notice of default. The County may (but shall not be required to) grant the Provider an opportunity to cure the default without termination of this Agreement. This clause shall not be interpreted to limit the County's remedies in law or in equity. c. Notwithstanding the foregoing, either party may terminate the agreement at any time without penalty; provided that written notice of such termination is furnished to the other party at least 30 days prior to termination. In the event of such termination, any payment due shall be prorated to the date of termination and any unused funds shall be returned to the County within 10 days of termination. d. Any termination of this Agreement for default under this section that is later deemed to be unjustified shall be deemed a termination for convenience. 6. Insurance. a. General Requirements. the Provider shall purchase and maintain, during the period of performance of this Agreement,insurance: i. Worker's Compensation. For protection from claims under workers' or workmen's compensation acts; ii. Comprehensive General Liability Insurance covering claims arising out of or relating to bodily injury,including bodily injury, sickness, disease or death of any of the Consultant's employees or any other person and to real and personal property including loss of use resulting thereof; iii. Comprehensive Automobile Liability Insurance, including hired and non-owned vehicles, if any, covering personal injury or death, and property damage; and Piedmont Health Services,Inc. Orange County Performance Agreement Page 3 Rep. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B iv. Professional Liability Insurance, covering personal injury, bodily injury and property damage and claims arising out of or related to the performance under this Agreement by the Consultant or his agents, consultants and employees. b. Limits of Coverage: Minimum limits of insurance coverage shall be as follows: INSURANCE DESCRIPTION MINIMUM REQUIRED COVERAGE • Worker's Compensation Limits for Coverage A - Statutory State NC & Coverage B - Employers Liability $500,000 each accident, disease policy limit and disease each employee • Commercial General $1,000,000 Each Occurrence Liability $2,000,000 Aggregate • Automobile Liability $500,000 Combined Single Limit • Professional Liability $1,000,000 Each Occurrence $2,000,000 Aggregate c. All insurance policies (with the exception of Worker's Compensation and Professional Liability) required under this Agreement shall name the County as an additional insured party and as a certificate holder. Evidence of such insurance and all correspondence shall be sent to: Orange County Risk Manager Post Office Box 8181 Hillsborough, NC 27278 d. Nothing in this section is intended to affect or abrogate the County's sovereign immunity defenses. 7. Relationship of the Parties. Provider is an independent contractor of the County. Provider represents that they has or will secure, at his own expense, all personnel required in performing the services under this Agreement. Such personnel shall not be employees or have any contractual relationship with the County. All personnel engaged in work under this Agreement shall be fully qualified and shall be authorized and permitted under federal, state and local law to perform such services. 8. Compliance with all Laws. The Provider, at its sole expense, shall comply with all laws, ordinances, orders and regulations of the federal, state or local governments, as well as their respective departments, commissions, boards, and officers, which are in effect at the time of execution of this Agreement or are adopted at any time following execution of this agreement. Piedmont Health Services,Inc. Orange County Performance Agreement Page 4 Rep. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B 9. Subcontract. The County and Provider deem the services provided under this Agreement to be personal in nature and Provider may not subcontract any rights or duties under this Agreement to any other party without prior written consent from the County. 10. Assignment. The Provider shall not assign this Agreement, including the rights to payment, to any other party without the prior written consent of the County. 11. Indemnification. Provider agrees to defend, indemnify, and hold harmless the County, for all loss, liability, claims or expense (including reasonable attorney's fees) arising from bodily injury, including death or property damage, to any person or persons caused in whole or in part by the negligence or willful misconduct of the Provider, except to the extent same are caused by the negligence or willful misconduct of the County. It is the intent of this section to require Provider to indemnify the County to the extent permitted under North Carolina law. Nothing in this section is intended to affect or abrogate the County's sovereign immunity defenses. 12. Non-Appropriation. This Agreement is subject to the availability of funds to purchase the specified services and may be terminated at any time if such funds become unavailable. 13. Non-Discrimination. Provider agrees as part of consideration of the granting of funds by Orange County the parties hereto for themselves, their agents, officials, employees and servants agree not to discriminate in any manner of these basis of race, color, gender, national origin, age, handicap, religion, sexual orientation, familial status or veterans status with reference to any activities carried out by the grantee, no matter how remote. The parties hereto further agree in all respects to conform to the provision and intent of Orange County Civil Rights Ordinance, as amended. Any violation of this requirement is a breach of this Agreement and County may immediately terminate this Agreement without further obligation on the part of the County. This paragraph is not intended to limit and does not limit the definition of breach to discrimination. This provision may be enforced by action for specific performance, injunctive relief, or other remedy as by law provided; this provision shall be binding on the grantees, the successors and assigns of the parties hereto with reference to the above subject manner. 14. Living Wage. Orange County is committed to providing its employees with a living wage and encourages agencies if funds to pursue the same goal. The County's living wage is $13.15 per hour. To the extent possible, Orange County recommends that Piedmont Health Services, Inc. provide a living wage to its employees. 15. Notice. The Parties hereto agree and understand that written notice, mailed or delivered, to the last known address shall constitute sufficient notice to the County and the Provider. All notices required and/or made pursuant to this Agreement to be given to the County and the Provides shall be in writing and mailed to the party addressed as follows: County: Provider: Orange County Health Dept. Piedmont Health Services, Inc. ATTN: Accounts Payable 299 Lloyd St. 300 West Tryon Street Carrboro, NC 27510 Hillsborough, NC 27278 Piedmont Health Services,Inc. Orange County Performance Agreement Page Rep. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B 16. Entire Agreement. This Agreement, including any referenced attachments, constitutes the entire Agreement between the parties and shall supersede, replace or nullify any and all prior Agreements of understandings; written or oral, relating to the matters set forth herein, and any such prior Agreements or understandings shall have no force or affect whatsoever on this Agreement. The Counts'and Provider have read this Agreement and agree to be bound by all of its terms, and further agree that this Agreement constitutes the complete and exclusive statement of the Agreement between the County and Provider. 17. Severability. All clauses found herein shall act independently of each other. If a clause is found to be illegal or unenforceable, it shall have no effect on the other provisions of this Agreement. It is understood by the parties hereto that if any part, term or provision of this Agreement is by the Courts held to be illegal or in conflict with any laws of the State of North Carolina or the United States, the validity of the remaining portions or provisions shall not be affected, and the rights and obligations of the parties shall be construed and enforced as if the Agreement did not contain the particular part, term or provision held to be invalid. 18. Governing Law. This Agreement and the duties, responsibilities, obligations and rights of respective parties hereunder shall be governed by the laws of the State of North Carolina. By executing this Agreement Provider affirms that Provider and any subcontractors of Provider are and shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor, on the list created by the State Treasurer pursuant to G.S. 147-86.58. 19. Signatures. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the intent of the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66. IN WITNESS WHEREOF, the Orange County and the Provider have signed this Agreement, effective on the last date this Agreement is signed by both parties as indicated by the dates set forth under signatures below. ,�¢¢ at etw behalf of the Provider 1/VIA.�I. ?bwtu1 7/22/2016 -F8Be& FCOO254OO... Brian Toomey, CEO Date 5 IJ ew,:behalf of Orange County Government bbtUut, ti-cum te,V'Stt,(1 7/27/2016 fR77gg4R755F477 Bonnie Hammersley, County Manager Date Piedmont Health Services,Inc. Orange County Performance Agreement Page 6 Rep. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B ATTACHMENT "A" Orange County Certifications Outside Agency Performance Agreement Chief Contact,Administrators, Chief Executive Officer and Chief Financial Officer I certify that I have provided a list of the chief contact, administrators, chief executive officer and chief financial officer for my agency with this Agreement and that I will keep it current to the County of Orange. The list should be in writing with the name, title, residential address; phone and email address and if possible, fax number. Officers and Board of Directors I certify that I have provided a current list of the Officers and Board of Directors with this Agreement and that we will continue to update the list as changes occur. The list should be in writing,with the name, physical address, mailing address and if possible, phone, fax and email address. Budget Submission I certify that I have provided a budget for the period to be covered by funding Orange County, and that any substantive changes made to this budget have been in advance authorized in writing by Orange County. Annual Financial Review I certify that I have provided a copy of the latest annual Financial Review for our agency and the budget adopted by the agency for the fiscal years encompassing this Agreement. If not, please explain on a separate sheet of paper. Alignment with Organization's Mission I certify that the programs and services for which this funding is requested align with the mission of the organization. Intended Purpose I certify that the funds provided to the agency under the terms of this Agreement will be used for a public purpose and shall only be used for the purposes intended and any money not used for those purposes will be promptly returned to Orange County. Transparency I certify that board meetings are open to the public with the exception of closed session meetings. Additionally, all financial records are available for public inspection by request upon reasonable notice. crloocouGSDigrned by: �o�ui 7/22/2016 Certified by: Title: Date: Piedmont Health Services,Inc. Orange County Performance Agreement Page 8 Rev. 7/2016 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B EXHIBIT "A" Scope of Services-FY 2016-17 Outside Agency Performance Agreement Agency Name: Piedmont Health Services,Inc. Program Name: Carrboro Community Health Center Patient-Centered Primary Care Home Funding Award: $11,000 Outline how the agency will spend Orange County's funding award. Expense Description Amount Provider salary support for uncompensated medical and dental care at the Carrboro $11,000 Community Health Center. Program Services For assistance with this or the following section, please reference the Exhibit A instructions and example, located within the contract and reporting memorandum. Outline the major activities the agency will employ to attain the Anticipated Outcomes below,by June 30,2017. • The HRSA Bureau of Primary Health Care defines a health center patient as an individual who receives a visit from a licensed independent provider. In the case of PHS, this includes individuals making a medical and/or dental primary care visit at one of our health center sites. Our other services (e.g. case management,pharmacy, nutrition) are provided as an enhancement to the provider visit. Thus, the primary care visit (medical or dental) is the appropriate unit of service for Carrboro Community Health Center. • • Anticipated Outcomes The Anticipated Results column must include quantifiable results in the form of number of persons/units served within Orange County, only (all Towns and municipalities), if you use percentages, you must also provide the total number of participants within that measure's description or for an earlier performance measure. Performance Measures Anticipated Results Residents of Chapel Hill/Carrboro/Orange County will receive primary care services 3,400 (medical and dental)at the Carrboro Community Health Center unduplicated patients DocuSigned by: riricuA, �btMt 1 7/22/2016 Certified by: FARR6RFCRO754oR Title: Date: DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ("Agreement") is made effective the first day of July 1, 2016, by and between Orange County Government through its Orange County Health Department ("Covered Entity"), and Functional Fitness, LLC, ("Business Associate"). Covered Entity and Business Associate may be referred herein individually as a "Party" or collectively as the "Parties". This Agreement supersedes any previously executed Business Associate Agreement between the Parties. WITNESSETH: WHEREAS, Sections 261 through 264 of the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Public Law 104-191, as modified by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), Public Law 111-5, known as "the Administrative Simplification provisions," direct the Department of Health and Human Services to develop standards to protect the security, confidentiality and integrity of health information; and WHEREAS, pursuant to the Administrative Simplification provisions, the Secretary of Health and Human Services ("Secretary") has issued regulations modifying the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as the same may be amended from time to time (the"HIPAA Security and Privacy Rule"); and WHEREAS, the Parties wish to enter into or have entered into an arrangement whereby Business Associate will provide certain services to Covered Entity, and, pursuant to such arrangements, Business Associate may be considered a"Business Associate" of Covered Entity as defined in the HIPAA Security and Privacy Rule (the agreement evidencing such arrangement is detailed below and hereinafter referred to as the"Service Agreement(s)"); and WHEREAS, Business Associate may have access to Protected Health Information (as defined below) in fulfilling its responsibilities under such arrangement; THEREFORE, in consideration of the Parties' continuing obligations under the Service Agreement, compliance with the HIPAA Security and Privacy Rule, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the provisions of this Agreement in order to address the requirements of the HIPAA Security and Privacy Rule and to protect the interests of both Parties. I. DEFINITIONS (a) Service Agreement. Agreement(s) for services affected by this HIPAA Business Associate Agreement, which this Business Associate Agreement shall be attached to, and is (are) hereby incorporated by reference, and which shall be taken and considered as a part of this document the same as if fully set out herein: 2016-17 Outside Agency Performance Agreement (b) Catch-all Provision. Except as otherwise defined herein, any and all capitalized terms in this Agreement shall have the definitions set forth in the HIPAA Security and Privacy Rule, 45 CFR Parts 160 and 164, subparts A and E. In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of the HIPAA Security and Privacy Rule, as amended, the HIPAA Security and Privacy Rule shall control. Where provisions of this Agreement are different than those mandated in the HIPAA Security and Privacy Rule, but are nonetheless permitted by the HIPAA Security and Privacy Rule,the provisions of this Agreement shall control. (c) Electronic Protected Health Information. Protected Health Information that is transmitted by or maintained in Electronic Media(as defined in the HIPAA Security and Privacy Rule). 1 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B (d) Protected Health Information. "Protected Health Information" shall have the same meaning as the term in 45 CFR § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity and includes without limitation "Electronic Protected Health Information." Business Associate acknowledges and agrees that all Protected Health Information that is created or received by Covered Entity and disclosed or made available in any form,including paper record, oral communication, audio recording, and electronic display by Covered Entity or its operating units to Business Associate or is created or received by Business Associate on Covered Entity's behalf shall be subject to this Agreement. (e) Required by Law. "Required by Law" shall have the same meaning as the term in 45 CFR § 164.103. IL OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE (a) Use and Disclosure. Business Associate agrees to fully comply with the requirements under the HIPPA Security and Privacy Rule applicable to Business Associates and not to use or disclose Protected Health Information other than as permitted or required by this Agreement, the Service Agreement or as Required by Law. To the extent Business Associate carries out obligations of Covered Entity under the HIPAA Security and Privacy Rule, Business Associate shall comply with the applicable provisions of the HIPAA Security and Privacy Rule as if such use or disclosure were made by Covered Entity. Business Associate agrees to comply with Covered Entity's policies regarding the minimum necessary use or disclosure of Protected Health Information. (b) Appropriate Safeguards. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of Protected Health Information other than as provided for by this Service Agreement(s), this Agreement or as Required by Law. This includes the implementation physical, technical and administrative safeguards to prevent use or disclosure of Protected Health Information other than as permitted in this Agreement or Required by Law and reasonably and appropriately protect the confidentiality, integrity, and availability of any Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security and Privacy Rule. The Business Associate shall maintain appropriate documentation of its compliance with the HIPPA Security and Privacy Rule, including, but not limited to, its policies, procedures, records of training and sanctions of members in its workforce. (c) Assurances. Business Associate agrees to provide Covered Entity with written assurances that any Protected Health Information placed on any type of mobile media, including, but by no means limited to, lap top computers, Ipads and mobile phones, is encrypted in accordance with guidance issued by the Secretary. (d) Agents and Subcontractors. Business Associate shall require any agents, including any subcontractors, to whom it provides Protected Health Information from Covered Entity that is created, received, maintained or transmitted on behalf of Business Associate to agree by written contract with Business Associate to the same (or greater) restrictions, conditions and requirements that apply to Business Associate with respect to such information, and to agree to implement reasonable and appropriate safeguards to protect any of such information that is Electronic Protected Health Information. In addition, Business Associate agrees to take reasonable steps to ensure that its employees' actions or omissions do not cause Business Associate to breach the terms of this Agreement. (e) Mitigation of Breach. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement, as well as to provide complete cooperation to Covered Entity should Covered Entity elect to review or investigate such 2 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B noncompliance or Security Incident. Business Associate shall cooperate in Covered Entity's breach analysis and/or risk assessment, if requested. Furthermore, Business Associate shall cooperate with Covered Entity in the event that Covered Entity determines that any third parties must be notified of a Breach,provided that Business Associate shall not provide any such notification except at the direction of Covered Entity. (f) Breach Reporting. Business Associate shall report in writing to Covered Entity's Privacy Officer (see Exhibit A), any use or disclosure of Protected Health Information that is not in compliance with the terms of this Agreement, as well as any Security Incident and any actual or suspected Breach, of which it becomes aware, without unreasonable delay, and in no event later than forty-eight (48) hours of such discovery. For purposes of this Agreement, "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. Such notification shall contain the elements required by 45 C.F.R. § 164.410. (g) Compliance. To the extent applicable, Business Associate will comply with (i) Covered Entity's Notice of Privacy Practices; (ii) any limitations to which Covered Entity has agreed in regard to an Individual's permission to use or disclose his or her Protected Health Information; and (iii) any restrictions to the use or disclosure of Protected Health Information to which Covered Entity has agreed or is required to agree. (h) Government Access. Business Associate will make its internal practices, books and records available to the Secretary of the Department of Health and Human Services for purposes of determining compliance with the terms of the HIPAA Security and Privacy Rule, and, at the request of the Secretary, will comply with any investigations and compliance reviews, permit access to information, and cooperate with any complaints, as Required by Law. Without unreasonable delay and, in any event, no more than 48 hours of receipt of the request or notification, Business Associate will notify Covered Entity in writing of any request by any governmental entity, or its designee, to review Business assessment of any kind. (i) Electronic Transactions. If Business Associate conducts any Standard Transactions for or on behalf of Covered Entity, Business Associate shall comply with the requirements under the Electronic Transaction Rule. (j) Audit. Business Associate shall permit Covered Entity, in its discretion, to conduct an audit of Business Associate's compliance with this Agreement, HIPAA, and HITECH. Such audit may consist of an onsite visit, a series of inquiries that require written responses, or both. Business Associate shall promptly and completely respond to Covered Entity's requests for infolination in support of the audit, which shall not be conducted more than once annually except in cases of an actual or reasonably suspected Security Incident or reasonably suspected noncompliance with this Agreement, HIPAA or HITECH. Each Party shall bear its own costs associated with the audit. (k) Identity Theft. Business Associate shall implement Identity Theft Monitoring Policies and Procedures to protect any patient information that may be breached by the Business Associate to the extent applicable under the Federal Trade Commission's Red Flag Rules. (1) HITECH Compliance. Business Associate shall: A. Not receive, directly or indirectly, any impermissible remuneration in exchange for Protected Health Information or Electronic Protected Health Information, except as permitted by HITECH § 13405(d) or the HIPPA Regulations; B. Comply with the marketing and other restrictions applicable to Business Associates contained in HITECH § 13406 and the HIPPA Regulations; 3 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B C. To the extent required under HITECH § 13404, fully comply with the applicable requirements of 45 CFR 164.502(e)(2) for each use and disclosure of Protected Health Information; D. To the extent required under HITECH § 13401, fully comply with 45 CFR §§ 164.308, 164.310, 164.312, and 164.316; E. To the extent required under HITECH §§13401 and 13404, comply with the additional privacy and security requirements that apply to Covered Entities in the same manner and to the same extent as Covered Entity is required to do so; and F. To the extent required under the HIPPA Regulations, comply with the privacy and security requirements that apply to Business Associates. (m) State Privacy Laws. Business Associate shall understand and comply with state privacy laws to the extent that such privacy laws are not preempted by HIPPA or HITECH. III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE (a) Use of Protected Health Information on Behalf of Covered Entity. Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities or services for, or on behalf of, Covered Entity described in the Service Agreement,provided that such use or disclosure would not violate the HIPPA Security and Privacy Rule if it were made by Covered Entity or would not violate the Covered Entities minimum necessary policies. (b) Other Uses of Protected Health Information. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information within its workforce for the proper management and administration of Business Associate not to include Marketing or Commercial Use and to carry out the legal responsibilities of Business Associate; and (c) Third Party Confidentiality. Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that if Business Associate discloses any Protected Health Information to a third party for such purpose, the Business Associate shall enter into a written agreement with such third party requiring the following: A. Disclosure only as Required by Law; or B. Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality, integrity, and or availability of the Protected Health Information has been breached immediately upon becoming aware. (d) Business Associate may provide data aggregation services relating to the health care operations of Covered Entity pursuant to any agreements between the Parties evidencing their business relationship as permitted by 45 CFR§ 164.504(e)(2)(i)(B). (e) Other Uses Strictly Limited. Nothing in this Agreement shall permit the Business Associate to share Protected Health Information with Business Associate's affiliates or contractors except for the purposes of the Service Agreement(s) between the Covered Entity and Business Associate(s) identified in Section I(a) of this Agreement. 4 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B (f) Covered Entity Authorization for Additional Uses. Any use of Protected Health Information by Business Associate, its affiliate or Contractor, other than those purposes of this Agreement, shall require express written authorization by the Covered Entity, and a Business Associate Agreement or amendment as necessary. Activities which are prohibited include, but are not limited to, Marketing, as defined by 45 CFR § 164.503 or the sharing for Commercial Use or any purpose construed by Covered Entity as Marketing or Commercial Use, even if such sharing would be permitted by federal or state laws. (g) Business Associate may de-identify Protected Health Information only at the specific direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health Information except at the direction of Covered Entity and in compliance with the requirements of the HIPAA Security and Privacy Rule. IV. AVAILABILITY OF PHI (a) Access to Protected Health Information. Business Associate agrees, in the event the Business Associate maintains protected health information in a Designated Record Set, to make available, within ten (10) days of a request by Covered Entity in a time and manner designated by Covered Entity, Protected Health Information in a Designated Record Set, to Covered Entity or as directed by Covered Entity, to an individual in order to meet the requirements of 45 CFR § 164.524 of the HIPAA Security and Privacy Rule. (b) Amendments to Protected Health Information. In the event that the Business Associate maintains Protected Health Information in a Designated Record Set, Business Associate agrees to make any amendment(s) to Protected Health Information in a designated record set that the Covered Entity directs or agrees to pursuant to the HIPAA Security and Privacy Rule at the request of Covered Entity of an individual, within ten(10) days of receipt of a request from Covered Entity and in the time and manner designated by Covered Entity. (c) Accounting of Disclosures. Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures, as required by 45 CFR § 164.528 of the HIPAA Security and Privacy Rule. Business Associate will comply with Covered Entity's policy regarding accounting of disclosures. (d) Document Disclosures. In the event an Individual makes a request under this Section of the Agreement directly to Business Associate, Business Associate will notify Covered Entity of such request within three (3) business days and shall cooperate with, and act only at the direction of Covered Entity in responding to such request. V. OBLIGATIONS OF COVERED ENTITY (a) Notice of Privacy Practices. Covered Entity shall provide Business Associate with the notice of privacy practice that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to that notice. (b) Notice of Changes in Individual's Access or Protected Health Information. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, is such changes affect Business Associate's permitted or required uses. (c) Notice of Restriction in Individual's Access to Protected Health Information. Covered Entity shall notify Business Associate of any restrictions to the use or disclosure of Protected Health Information that Covered Entity has agreed in accordance with 45 CFR § 164.522 to the extent that such restriction may affect Business Associate's use of Protected Health Information. 5 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B VI. PERMISSABLE REQUESTS BY COVERED ENTITY Requests Permissible Under HIPAA. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy or Security Rule. VII. TERMINATION (a) Term. This Agreement shall be effective as of the date first set forth above and shall terminate upon the earlier of (i) the termination of all agreements between the parties, and (ii) the termination by Covered Entity for cause as provided herein. (b) Termination for Cause. Notwithstanding anything in this Agreement to the contrary, Covered Entity shall have the right to terminate this Agreement and the Service Agreement immediately if Covered Entity determines that Business Associate has or will violated any material term of this Agreement. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall provide an opportunity for Business Associate to cure the breach or end the violation. Covered Entity may terminate this Agreement if Business Associate does not cure the breach or end the violation within the time period specified by Covered Entity. If termination, cure or end of the violation is not feasible, Covered Entity may report the violation to the Secretary. (c) Obligation of Business Associate Upon Termination. At termination of this Agreement, the Service Agreement(or any similar documentation of the business relationship of the Parties), or upon request of Covered Entity,whichever occurs first, Business Associate, shall: A. if feasible, return(in a manner or process approved by the Covered Entity) or destroy all Protected Health Information, regardless of form, including but not limited to paper or electronic format, received from Covered Entity, or created, maintained or received by Business Associate on behalf of Covered Entity. Business Associate shall retain no copies of the Protected Health Information. This provision shall also apply to Protected Health Information and other confidential information in the possession of sub-contractors or agents of Business Associate. B. If such return or destruction is not feasible, Business Associate shall (i) retain only that Protected Health Information necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; (ii) return or destroy the remaining Protected Health Information that the Business Associate still maintains in any form; (iii) extend the protections of this Agreement to the retained Protected Health Information; (iv) limit further uses and disclosures to those purposes that make the return or destruction of the Protected Health Infoitnation not feasible; and (v) return or destroy the retained Protected Health Information when it is no longer needed by Business Associate. (d) Survival. This paragraph shall survive the termination of this Agreement and shall apply to Protected Health Information created, maintained, or received by Business Associate and any of its subcontractors. VIII. MISCELLANEOUS (a) Indemnification. Business Associate agrees to indemnify, defend, and hold harmless Covered Entity, its officers, agents, contractors and agents, against, and in respect of, any and all claims, losses, expenses, costs, damages, obligations, penalties, and liabilities which Covered Entity may incur by reason of Business Associate's breach of or failure to perform any its obligations pursuant to this 6 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B Agreement,including but not limited to any injury or damages arising from any noncompliance with this Agreement or any Security Incident attributable to the negligence of Business Associate, including failure to execute the terms of this Agreement. Further, Business Associate agrees to indemnify, defend, and hold harmless Covered Entity, its officers, employees, contractors and agents, against all costs and expenses, including but not limited to, reasonable legal expenses, which are incurred by or on behalf of Business Associate in connection with the defense of such claims. (b) Disclaimer. Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement, HIPAA, HITECH, or the HIPAA Regulations will be adequate or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of Protected Health Information. (c) Assistance in Litigation or Administrative Proceedings. Business Associate shall make itself, and any subcontractors, employees, affiliates or agents assisting Business Associate in the performance of its obligations under this Agreement, available to Covered Entity, at no cost to Covered Entity, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its directors, officers or employees based upon a claimed violation of HIPAA, HITECH, the HIPAA Regulations, or other laws relating to security and privacy, except where Business Associate or its subcontractor, employee or agent is named adverse party. (d) Survival. The obligations of Business Associate under this Agreement shall survive the expiration, termination, or cancellation of this Agreement, the Service Agreement and/or the business relationship of the parties, and shall continue to bind Business Associate, its agents, employees, contractors, successors, and assigns as set forth herein. (e) Ownership of Information. Covered Entity holds all right, title, and interest in and to the Protected Health Information and Business Associate does not hold and will not acquire by virtue of this Agreement or by virtue of providing goods or services to Covered Entity, any right, title, or interest in or to the PHI or any portion thereof. (f) Right to Injunctive Relief. Business Associate expressly acknowledges and agrees that the breach, or threatened breach,by it of any provision of this Agreement may cause Covered Entity to be irreparably harmed and that Covered Entity may not have an adequate remedy at law. Therefore, Business Associate agrees that upon such breach, or threatened breach, Covered Entity will be entitled to seek injunctive relief to prevent Business Associate from commencing or continuing any action constituting such breach without having to post a bond or other security and without having to prove the inadequacy of any other available remedies. Nothing in this paragraph will be deemed to limit or abridge any other remedy available to Covered Entity at law or in equity. Except as expressly stated herein or in the HIPAA Security and Privacy Rule, the parties to this Agreement do not intend to create any rights in any third parties. (g) Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the HIPSS Regulations. In addition, this Agreement may be amended or modified by the Parties only in writing. (h) Assignment. No Party may assign its respective rights and obligations under this Agreement without the prior written consent of the other Party. (i) Independent Contractor. None of the provisions of this Agreement are intended to create, nor will they be deemed to create any relationship between the Parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of this Agreement and any other agreements between the Parties evidencing their business relationship. This Agreement will be governed by the laws of the State of North Carolina. No change, waiver or discharge of any 7 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion. (j) Regulatory References. A reference in this Agreement to a section in HIPAA, HITECH or the HIPAA Regulations means the section as it currently is in effect or as amended. (k) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Regulations. The parties agree that, in the event that any documentation of the arrangement pursuant to which Business Associate provides services to Covered Entity contains provisions relating to the use or disclosure of Protected Health Information that are more restrictive than the provisions of this Agreement, the more restrictive provisions will control. The provisions of this Agreement are intended to establish the minimum requirements regarding Business Associate's use and disclosure of Protected Health Information. (1) Severability. In the event any part or parts of this Agreement are held to be unenforceable, the remainder of this Agreement will continue in effect. In addition, in the event a party believes in good faith that any provision of this Agreement fails to comply with the then-current requirements of the HIPAA Security and Privacy Rule, such party shall notify the other party in writing. For a period of up to (30) thirty days, the parties shall address in good faith such concern and amend the teens of this Agreement, if necessary to bring it into compliance. If, after such thirty-day period, a party believes in good faith that the Agreement fails to comply with the HIPAA Security and Privacy Rule, then either party has the right to terminate upon written notice to the other party. (m) Notices and Communications. All instructions, notices, consents, demands, or other communications required or contemplated by this Agreement shall be in writing and shall be delivered to the Party at the address below: For Covered Entity: For Business Associate Orange County Health Department Piedmont Health Services, Inc. 300 W. Tryon Street 299 Lloyd Street Hillsborough,NC 27278 Carrboro,NC 27510 (n) Strict compliance. No failure by any Party to insist upon strict compliance with any terms or provisions of this Agreement, to exercise any option, to enforce any right, or to seek any remedy upon any default of any other Party shall affect, or constitute a waiver of, any Party's right to insist upon such strict compliance, exercise that option, enforce that right, or seek that remedy with respect to that default or any prior, or contemporaneous, or subsequent default. No custom or practice of the Parties at variance with any provisions of this Agreement shall affect, or constitute a waiver of, any Party's right to demand strict compliance with all provisions of this Agreement. (o) Governing Law. This Agreement shall be governed and construed in accordance with the laws of the State of North Carolina except to the extent that North Carolina laws have been pre-empted by HIPAA and without giving effect to principals of conflicts of law. Jurisdiction shall be Orange County, North Carolina, for purposes of litigation resulting from disagreements of the Parties for purposes of this Agreement and the Service Agreement(s). (p) E-Verify. Employers and their subcontractors with 25 or more employees as defined in Article 2 of Chapter 64 of the NC General Statutes must comply with E-Verify requirements to contract with governmental units. E-Verify is a Federal program operated by the United States Department of Homeland Security and other federal agencies, or any successor or equivalent program used to verify the work authorization of newly hired employees pursuant to federal law. Where applicable, failure to maintain compliance with the requirements of Article 2 of Chapter 64 of the North Carolina General Statutes shall constitute breach of this Agreement. If applicable, by executing this Agreement, Business 8 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B Associate affirms that they are in compliance with Article 3 of Chapter 64 if the North Carolina General Statutes. IN WITNESS WHEREOF, the Parties have executed this Agreement as of the day and year written above. CO € I6FITY: BUS Sisitn&SQCIATE: - -'� f ricuA, �btMt 11 By: -- C9ED9D0FC6B545E BY• _F $F B025408... Orange County Health Director Title: Title: 9 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B EXHIBIT A COVERED ENTITY PRIVACY OFFICER CONTACT INFORMATION To report to Covered Entity any use or disclosure of Protected Health Information not in compliance with the terms of this Agreement that might be considered a privacy breach, Business Associate should contact the Privacy Officer at the applicable entity. To report to Covered Entity any Security Incident(as defined in the Agreement), Business Associate should contact Carla Julian(919) 245-2434, or the Security Officer at The Orange County Health Department. 10 October 2013 DocuSign Envelope ID:58ED7F55-231C-4FAC-AD50-6415BD24288B Piedmont Health Services, Inc. 299 Lloyd Street Carrboro, NC 27510_ INSURANCE CERTIFICATION This is to certify that as of February 1, 2016, Piedmont Health Services, Inc. has the following insurance overages: Type of Insurance Company and Amount of Coverage Expiration Coverage Address Date of Policy 1 Commerical Package: Hanover American 2-1-17 General Liability Insurance Co. 3M/ 1M /3M Property Damage 440 Lincoln Street Replacement Abuse& Molestation Worcester, MA 01605 1M/5K/ 1 M Crime 3M/ 1M /3M Policy#:ZZ6A53449100 1M 1 1M 1 Commercial Package: Allmerica Financial Benefit 2-1-17 Automobile Policy Ins 1M/5K/1M CSL Liability 440 Lincoln Street Med Pay Worcester, MA 01605 UM/UIM Policy#AW6A534528 1 Commercial Package: Hanover Insurance Group 5M/5mil aggregate 2-1-17 Umbrella Liability Policy 440 Lincoln Street Policy#:UH6A53449500 Worcester, MA 01605 Limit 1 Workmen's Allmerica Financial Benefit 500K/500K/500K 2-1-17 Compensation Ins Policy#: W26A52452500 440 Lincoln Street Employers Liability Limits Worcester, MA 01605 1 Other: RSUI Indemnity Company 3M per claim/aggregate 2-1-17 Directors and Officers 945 E Paces Ferry Rd, Ste 3M per claim/aggregate Employment Practices 1800 1M per claim/aggregate Liability Limit Atlanta, GA 30326 Fiduciary Liability Limit Policy#: NHP655838 INSURANCE AGENTS: 1 Senn Dunn Insurance Co. 1400 Eastchester Drive High Point, NC 27265 (336) 878 -7800 e A—ed this 11th day of March 2016 .. A. •' % r/ LydiF. Mason, CFO Pied ont Health Services, Inc. 299 Lloyd Street Carrboro, NC 27510 PIEDMI7 OP ID: KB C". CERTIFICATE OF LIABILITY INSURANCE DATE(MM/DD/YYYY) `••-- 07/06/2016 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER. IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy,certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). CONT PRODUCER NAMEACT Kendra A. Biddle, CPCU, CIC Senn Dunn-Charlotte 440 South Church St.,Ste 500 PHONE,Ext):336-899-2410 FAX No): 336-841-5319 Charlotte,NC 28202 E-MAIL kbiddle @senndunn.com M.Bryan Beasley,CIC ADDRESS: INSURER(S)AFFORDING COVERAGE NAIC# INSURER A:Massachusetts Bay Insurance Co INSURED Piedmont Health Services Inc. INSURER B:AIX Specialty Insurance Co. Lydia Mason 299 Lloyd St. INSURER C:Allmerica Financial Benefit Carrboro, NC 27510 INSURER D: INSURER E: INSURER F: COVERAGES CERTIFICATE NUMBER: REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES.LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. IN SR TYPE OF INSURANCE I POLICY EFF POLICY EXP INSD WVD POLICY NUMBER /Y LIMITS (MM/DD YYY) (MM/DD/YYYY) B X COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE $ 1,000,000 CLAIMS-MADE X OCCUR L16-A734411-00 10/11/2015 10/11/2016 DAMAGE TO RENTED 1,000,000 PREMISES(Ea occurrence) $ MED EXP(Any one person) $ 5,000 PERSONAL&ADV INJURY $ 1,000,000 GE 'L AGGREGATE LIMIT APPLIES PER: GENERAL AGGREGATE $ 3,000,000 POLICY PRO- JECT LOC PRODUCTS-COMP/OP AGG $ 3,000 000 JECT � OTHER: $ AUTOMOBILE LIABILITY COMBINED SINGLE LIMIT $ 1 000 000 (Ea accident) , , C X ANY AUTO AW6A534528-01 10/11/2015 10/11/2016 BODILY INJURY(Per person) $ ALL OWNED SCHEDULED BODILY INJURY(Per accident) $ AUTOS AUTOS NON-OWNED PROPERTY DAMAGE HIRED AUTOS AUTOS (Per accident) X UMBRELLA LIAB X OCCUR EACH OCCURRENCE $ 5,000,000 B EXCESS LIAB CLAIMS-MADE L16A734412-00 10/11/2015 10/11/2016 AGGREGATE $ 5,000,000 DED RETENTION$ $ WORKERS COMPENSATION X PER OTH- AND EMPLOYERS'LIABILITY STATUTE ER Y/N A ANY PROPRIETOR/PARTNER/EXECUTIVE W26A52452501 02/01/2016 02/01/2017 E.L.EACH ACCIDENT $ 500,000 OFFICER/MEMBER EXCLUDED? N/A (Mandatory in NH) E.L.DISEASE-EA EMPLOYEE $ 500,000 If yes,describe under DESCRIPTION OF OPERATIONS below E.L.DISEASE-POLICY LIMIT $ 500,000 B Professional L16-A734411-00 10/11/2015 10/11/2016 Incident 1,000,000 Liability CLAIMS MADE Aggregate 3,000,000 DESCRIPTION OF OPERATIONS/LOCATIONS/VEHICLES (ACORD 101,Additional Remarks Schedule,may be attached if more space is required) CERTIFICATE HOLDER CANCELLATION ORANGHE SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN Orange County Health Dept ACCORDANCE WITH THE POLICY PROVISIONS. 300 W Tryon Street Hillsborough, NC 27278 AUTHORIZED REPRESENTATIVE ©1988-2014 ACORD CORPORATION. All rights reserved. ACORD 25(2014/01) The ACORD name and logo are registered marks of ACORD