HomeMy WebLinkAbout2016-406-E Health - Starpoint Global Services for scanning of medical records DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
ORANGE COUNTY
AMENDMENT TO SERVICES AGREEMENT
NORTH CAROLINA
THIS AMENDMENT, made and entered into this the 1st day of July, 2016,by and between the County of Orange,
a body politic and corporate of the State of North Carolina, ("County"), and StarPoint Global Services ("Provider");
WITNESSETH:
WHEREAS, the County and Provider entered into a Services Agreement dated, February 1, 2015, to provide
services to be rendered by Provider to County's Health Department("Original Agreement"); and
WHEREAS, the County and Provider desire to amend the Original Agreement, while keeping in effect all terms
and conditions of the Original Agreement not inconsistent with the terms and conditions set forth below.
NOW THEREFORE, for and in consideration for the mutual covenants and agreements made herein, the parties
agree to amend the Original Agreement as follows:
To amend Section 5.a. as follows: The maximum amount payable for Basic Services shall not exceded Fifty
Thousand Dollars ($50,000).
Except for the changes made in Section 5.a. herein, the Original Agreement shall remain in full force and effect to
the extent it is not inconsistent with this Amendment. In the event that there is a conflict between the Original
Agreement and this Amendment,this Amendment shall control.
IN WITNESS WHEREOF, Orange County and the Consultant have signed this Amendment, effective this
the 1St day of July,2016.
FO r at IEdi :COUNTY jeith41/1 DQ$�,J1JOVIDER:
ljbin,in,lt, NUAAIMt,V'S�,t,i r,.By 0637994B755E477.. By 003C045BA18 dB9...
Bonnie Hammersley, County Manager Richard H. Ray,Jr. Director of Bus. Dev.
Starpoint Global Services
Revised July 2015
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DBI}158A0-1139-48CD-8576-549C07AE1795
[Departmental Use Only]
TITLE Starpoint Global Svcs
FY FY 2015-16
NORTH CAROLINA
SERVICES AGREEMENT UNDER$90,000.00
NO RFP/RFQ
ORANGE COUNTY
This Services Agreement (hereinafter "Agreement"), made and entered into this 1st day of
February, 2016, ("Effective Date") by and between Orange County, North Carolina a political
subdivision of the State of North Carolina (hereinafter, the "County") and StarPoint Global
Services, (hereinafter,the "Provider").
WITNESSETH:
That the County and Provider, for the consideration herein named, do hereby agree as
follows:
1. Services
a. Scope of Work.
i) This Agreement is for services to be rendered by Provider to County with respect to
(insert type of project): Imaging Patient Records and Other Services as provided in
Estimated Cost and Service Proposal Provided by StarPoint Global Services for the
Orange County Health Department, dated January 19, 2016 ("Proposal"), attached
as Exhibit A, Additional Terms and Conditions, Exhibit B; Business Associate
Agreement, Exhibit C; Storage Agreement, Exhibit D; Container Transmittal,
Exhibit E; and Authority for Access, Exhibit F; all of which are hereby incorporated
into this Agreement and shall be taken and considered as a part of this Agreement
the same as if fully set out herein. In the event of any conflict or inconsistency
between this Agreement and the Exhibits, this Agreement shall control except where
there is a conflict or inconsistency between this Agreement and the Business
Associate Agreement, then the provisions of the Business Associate Agreement
shall control.
ii) By executing this Agreement, the Provider represents and agrees that Provider is
qualified to perform and fully capable of performing and providing the services
required or necessary under this Agreement in a fully competent, professional and
timely manner.
iii) Time is of the essence with respect to this Agreement.
iv) The services to be performed under this Agreement consist of Basic Services, as
described and designated in Section 3 hereof. Compensation to the Provider for
Basic Services under this Agreement shall be as set forth herein.
2. Responsibilities of the Provider
Revised 1/16
1
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
a. Services to be provided. The Provider shall provide the County with all services
required in Section 3 to satisfactorily complete the Project within the time limitations set
forth herein and in accordance with the highest professional standards.
b. Standard of Care.
i) The Provider shall exercise reasonable care and diligence in performing services
under this Agreement in accordance with the highest generally accepted standards
of this type of Provider practice throughout the United States and in accordance
with applicable federal, state and local laws and regulations applicable to the
performance of these services. Provider is solely responsible for the professional
quality, accuracy and timely completion and/or submission of all work related to
the Basic Services.
ii) Provider shall be responsible for all errors or omissions of its agents, contractors,
employees, or assigns in the performance of the Agreement. Provider shall
correct any and all errors, omissions, discrepancies, ambiguities, mistakes or
conflicts at no additional cost to the County.
iii) The Provider shall not, except as otherwise provided for in this Agreement,
subcontract the performance of any work under this Agreement without prior
written permission of the County. No permission for subcontracting shall create,
between the County and the subcontractor, any contract or any other relationship.
iv) Provider is an independent contractor of County. Any and all employees of the
Provider engaged by the Provider in the performance of any work or services
required of the Provider under this Agreement, shall be considered employees or
agents of the Provider only and not of the County, and any and all claims that may
or might arise under any workers compensation or other law or contract on behalf
of said employees while so engaged shall be the sole obligation and responsibility
of the Provider.
v) Provider agrees that Provider, its employees, agents and its subcontractors, if any,
shall be required to comply with all federal, state and local antidiscrimination
laws, regulations and policies that relate to the performance of Provider's services
under this Agreement.
vi) If activities related to the performance of this Agreement require specific licenses,
certifications, or related credentials Provider represents that it and/or its
employees, agents and subcontractors engaged in such activities possess such
licenses, certifications, or credentials and that such licenses certifications, or
credentials are current, active, and not in a state of suspension or revocation.
vii) In determining the basic services to be provided, should any documents be
referenced in this Agreement, the terms of this Agreement shall have priority in
any conflict between the terms of referenced documents and the terms of this
Agreement. Should a request for proposals and a proposal be referenced the
terms of the request for proposals shall have priority over the terms of any
proposal.
Revised 1/16
2
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
3. Basic Services
a. Basic Services. The Services to be rendered pursuant to this Agreement are as follows
(fully describe services to be provided): See Exhibit A, Proposal and specifically Scope
of Work.
4. Duration of Services
a. Term. The term of this Agreement shall be from February 1, 2016 to January 31,
2017.
b. Scheduling of Services.
i) The Provider shall schedule and perform its activities in a timely manner.
ii) Should the County determine that the Provider is behind schedule, it may require
the Provider to expedite and accelerate its efforts, including providing additional
resources and working overtime, as necessary, to perform its services in
accordance with the approved project schedule at no additional cost to the
County.
iii) The Commencement Date for the Provider's Basic Services shall be February 1,
2016.
5. Compensation
a. Compensation for Basic Services. Compensation for Basic Services shall include all
compensation due the Provider from the County for all services under this Agreement
except for any authorized Reimbursable Expenses which are defined herein. The
maximum amount payable for Basic Services shall not exceed Thirty-five Thousand
Dollars ($35,000). Payment for Basic Services shall become due and payable within
thirty (30) days of Provider properly invoicing County. Payment shall be subject to
provisions of Section 5(b).
b. Disputes. In the event the amount stated on an invoice is disputed by the County, the
County may withhold payment of all or a portion of the amount stated on an invoice
until the parties resolve the dispute. Should Provider fail to perform its duties under the
terms of this Agreement, County may, without fault or penalty, withhold any payment
associated with the work to be performed until such time as said work is completed.
c. Additional Services. County shall not be responsible for costs related to any services in
addition to the Basic Services performed by Provider unless County requests such
additional services in writing and such additional services are evidenced by a written
amendment to this Agreement.
6. Responsibilities of the County
a. Cooperation and Coordination. The County has designated (Colleen Bridger or
designee) to act as the County's representative with respect to the Project and shall have
the authority to render decisions within guidelines established by the County Manager
Revised 1/16
3
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0156A0-1139-48CD-8576-549C07AE1795
and/or the County Board of Commissioners and shall be available during working hours
as often as may be reasonably required to render decisions and to furnish information.
7. Insurance
a. General Requirements. Provider shall obtain, at its sole expense, Commercial General
Liability Insurance,Automobile Insurance, Workers' Compensation Insurance, and any
additional insurance as may be required by County's Risk Manager as such insurance
requirements are described in the Orange County Risk Transfer Policy and Orange
County Minimum Insurance Coverage Requirements (each document is incorporated
herein by reference and may be viewed at
http://www.orangecountync.gov/depa rtments/purchasing division/contracts.php). If
County's Risk Manager determines additional insurance coverage is required such
additional insurance shall consist of N/A (if no additional insurance required mark N/A
as being not applicable). Provider shall not commence work until such insurance is in
effect and certification thereof has been received by the County's Risk Manager.
S. Indemnity
a. Indemnity. The Provider agrees to defend, indemnify and hold harmless the County from
all loss, liability, claims or expense, including attorney's fees, arising out of or related to
the Project and arising from bodily injury including death or property damage to any
person or persons caused in whole or in part by the negligence or misconduct of the
Provider except to the extent same are caused by the negligence or willful misconduct of
the County. It is the intent of this provision to require the Provider to indemnify the
County to the fullest extent permitted under North Carolina law.
9. Amendments to the Agreement
a. Changes in Basic Services. Changes in the Basic Services and entitlement to additional
compensation or a change in duration of this Agreement shall be made by a written
Amendment to this Agreement executed by the County and the Provider. The Provider
shall proceed to perform the Services required by the Amendment only after receiving a
fully executed Amendment from the County.
10. Termination
a. Termination for Convenience of the County. This Agreement may be terminated without
cause by the County and for its convenience upon seven (7) days' prior written notice to
the Provider.
b. Other Termination. The Provider may terminate this Agreement based upon the County's
material breach of this Agreement; provided, the County has not taken all reasonable
actions to remedy the breach. The Provider shall give the County seven (7) days' prior
written notice of its intent to terminate this Agreement for cause.
c. Compensation After Termination.
Revised 1/16
4
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
i) In the event of termination, the Provider shall be paid that portion of the fees and
expenses that it has earned to the date of termination, less any costs or expenses
incurred or anticipated to be incurred by the County due to errors or omissions of
the Provider.
ii) Should this Agreement be terminated, the Provider shall deliver to the County
within seven (7) days, at no additional cost, all deliverables including any
electronic data or files relating to the Project.
d. Waiver. The payment of any sums by the County under this Agreement or the failure of
the County to require compliance by the Provider with any provisions of this Agreement
or the waiver by the County of any breach of this Agreement shall not constitute a
waiver of any claim for damages by the County for any breach of this Agreement or a
waiver of any other required compliance with this Agreement.
e. Suspension. County may suspend the Basic Services and this Agreement at any time for
County's convenience and without penalty to County upon three (3) days' notice to
Provider. Upon any suspension by County, Provider shall discontinue work on the Basic
Services and shall not resume the Basic Services until notified to proceed by County.
11. Additional Provisions
a. Limitation and Assignment. The County and the Provider each bind themselves, their
successors, assigns and legal representatives to the terms of this Agreement. Neither the
County nor the Provider shall assign or transfer its interest in this Agreement without the
written consent of the other.
b. Governing Law. This Agreement and the duties, responsibilities, obligations and rights
of respective parties hereunder shall be governed by the laws of the State of North
Carolina.
c. Compliance with Laws. Provider shall at all times remain in compliance with all
applicable local, state, and federal laws, rules, and regulations including but not limited
to all anti-discrimination laws. By executing this Agreement Provider affirms that
Provider and any subcontractors of Provider are and shall remain in compliance with
Article 2 of Chapter 64 of the North Carolina General Statutes.
d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek damages
with respect to any provision of, or the performance or non-performance of, this
Agreement shall be brought in the General Court of Justice of North Carolina sitting in
Orange County, North Carolina. It is agreed by the parties that no other court shall have
jurisdiction or venue with respect to such suits or actions. Binding arbitration may not
be initiated by either Party, however, the Parties may agree to nonbinding mediation of
any dispute prior to the bringing of such suit or action.
e. Entire Agreement. This Agreement represents the entire and integrated agreement
between the County and the Provider and supersedes all prior negotiations,
representations or agreements, either written or oral. This Agreement may be amended
Revised 1116
5
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
only by written instrument signed by both parties. Modifications may be evidenced by
facsimile signatures.
f. Severability. If any provision of this Agreement is held as a matter of law to be
unenforceable, the remainder of this Agreement shall be valid and binding upon the
Parties.
g. Ownership of Work Product. Should Provider's performance of this Agreement generate
documents, items or things that are specific to this Project such documents, items or
things shall become the property of the County and may be used on any other project
without additional compensation to the Provider. The use of the documents, items or
things by the County or by any person or entity for any purpose other than the Project as
set forth in this Agreement shall be at the full risk of the County.
h. Non-Appropriation. Provider acknowledges that County is a governmental entity, and
the validity of this Agreement is based upon the availability of public funding under the
authority of its statutory mandate.
In the event that public funds are unavailable and not appropriated for the performance of
County's obligations under this Agreement, then this Agreement shall automatically
expire without penalty to County immediately upon written notice to Provider of the
unavailability and non-appropriation of public funds. It is expressly agreed that County
shall not activate this non-appropriation provision for its convenience or to circumvent
the requirements of this Agreement, but only as an emergency fiscal measure during a
substantial fiscal crisis.
In the event of a change in the County's statutory authority, mandate and/or mandated
functions, by state and/or federal legislative or regulatory action, which adversely affects
County's authority to continue its obligations under this Agreement, then this Agreement
shall automatically terminate without penalty to County upon written notice to Provider
of such limitation or change in County's legal authority.
i. Signatures. This Agreement together with any amendments or modifications may be
executed electronically. All electronic signatures affixed hereto evidence the intent of
the Parties to comply with Article 11A and Article 40 of North Carolina General Statute
Chapter 66.
j. Notices. Any notice required by this Agreement shall be in writing and delivered by
certified or registered mail, return receipt requested to the following:
Orange County Provider's Name
Attention: Kimberlee Quatrone Starpoint Global Services
P.O. Box 8181 1 Ashley Wade Lane
Hillsborough,NC 27278 Chapel Hill,NC 27516
[SIGNATURE PAGE TO FOLLOW]
Revised 1/16
6
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have
hereunder set their hands and seal, all as of the day and year first above written.
ORANGE COUNTY: PROVIDER:
/•--DocuSigned by: DocuSigned by:
BJ• gg4la. �GFd]] By 095Caonnlo5aua...
County Manager
Richard H. Ray, Jr.,
Director of Business Development
Printed Name and Title
Revised 1116
7
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit B
ADDITIONAL TERMS AND CONDITIONS
The following additional terms and conditions shall apply to this agreement.
1, STORED MATERIAL - Provider shall store the Stored Material identified by County on the Container
Transmittal Form("Exhibit E"). County and Provider may change,delete or add to the Stored Material by
written agreement only. Additional materials shall, unless otherwise indicated in writing, be deemed to be
held under these same terms and conditions and shall be considered part of the Stored Material.
2. ACCEPTANCE -In the absence of an executed contract, County's act of tendering material for storage to
Provider constitutes acceptance by County of the terms, conditions and rated contained within this
agreement.
3. COUNTY AUTHORIZED REPRESENTATIVES - County must designate all individuals that are
authorized to have access to the Stored Material by identifying said individuals on Provider's Access
Authorization form ("Exhibit F"). Only the Authorized Representative and Secondary Authorized
Representative may authorize destruction of the Stored Material.
4. ACCESS TO STORED MATERIALS - Provider shall conduct services pertaining to the Stored Material
only pursuant to direction of County's agent(s) identified by County on Provider's Access Authorization
form. County represents that the Authorized Representative and the Secondary Authorized Representative
have full authority to order all services that pertain to the Stored Material including, but not limited to,
removal and destruction of Stored Material.
The Provider reserves the right to deny access to or delivery of the Stored Material until such time as
County has cured any default under this agreement.
5. DESTRUCTION OF RECORDS - Upon written instruction from County's Authorized Representative or
County's Secondary Authorized Representative, Provider may destroy the Stored Material. The County
releases the Provider from all liability by reason of the destruction of Stored Material pursuant to such
authority.
6. RULES - County shall not, at any time, store with Provider any narcotics, Hazardous Materials as
hereinafter defined, or materials otherwise considered to be highly flammable,explosive,toxic,radioactive
or which may attract vermin or insects, or any other materials which are otherwise illegal, dangerous and
unsafe to store or handle. Provider reserves the right to open and inspect the Stored Materials tendered for
storage restrictions and guidelines. For purposes of this agreement, the term "Hazardous Materials" shall
mean and refer to any wastes, materials, or other substances of any kind or character that are or become
regulated as hazardous or toxic waste or substances, or which require special handling or treatment,under
any local,state or federal law,rule,regulation or order.
7. Medicare Access to Records.Each party shall keep,and allow the other party reasonable access to, full and
accurate books and records of all services rendered hereunder. Further, to the extent required by Section
1395x(v)(I)(I)of Title 42 of the United States Code,until the expiration of four years after the termination
of this Agreement, Contractor shall, upon written request, make available to the Secretary of the United
States Department of Health and Human Services, or to the Comptroller General of the United States
General Accounting Office,or to any of their duly authorized representatives,a copy of this Agreement and
such books, documents, and records as are necessary to certify the nature and extent of the costs of the
services Contractor provided under this Agreement.
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit D
STARFOINT •
GLOBAL SERVICES
800-STAR-344
STORAGE / SERVICE AGREEMENT
ACCOUNT: (Orange County Health Department)
Client: Orange County Health Department Billing Address (If Different)
Street Address: 300 West Tryon St. Street or Box No:
•
City, State, Zip: Hillsborough,NC 27278 City, State, Zip:
Primary Contacts: Pam McCall Billing Contact:
Telephone: 919-245-2402 Telephone:
Fax: Fax:
Email: pmccall@orangecountyno.gov Email:
Starpoint Global Services ("Company") hereby agrees to accept for storage under its
management system at its facilities,such record material (the "Stored Material") as Orange
County Health Department(the "Client") requests, subject to all terms and conditions
herein. Client agrees to pay Company according to the Company's current rate schedule,
as amended from time to time. Company's current rate schedule is attached hereto as
Exhibit G and incorporated herein by reference.
CLIENT STARPOINT GLOBAL SERVICES
Name: Pam McCall, MPH, RN Name: Richard H. Ray, Jr.
Signature: Signature:
Title: Personal Health Services Director Title: Director of Business Development
Date: Date:
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit E
STAF2ROlN '" Container Transmittal
/INGLOBAL SERVICES
ACCOUNT NAME DEPT
Set Code a Carslomur'u iK Destruction Dale
IDENTIFICATION: L I II LL-1 I .LULL.. LL L.L J l I 1 t r i i 1 1
F�In nil N 5 1 4 s MM/M YY Yy
Media Type Claus Flange
CONTENTS: l 1 I 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 / 1 1 1 1
From To
Sequence Range
1 1 1 1 1 7 1 1 L.1 JJ..JIJ..,..J LL!_L.L1 ,LLLL.LL LI .1 1
From To
TEXT DESCRIPTION (Please Print) , _ . . . . . _ w_ µ _ _ _ _ _ _ _ _ _ _ _ . _ _ .. , , . . . _
2
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit F
Authority For Access
This shall be considered authorization for the following named individuals to have access to the contents held in the account of:
Client Name: Client Account No.
Department Sub Department
Client Address: City: State: Zip Code:
at Starpoint Global Services.These same individuals shall be considered having authority to order any and all disposition of the contents of this
account by personal access,telephone,facsimile,email or written request until further written notice.
ADD THE FOLLOWING:
Pam McCall
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
Judy Butler
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
Madelyn Davis
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
Rebekah Hermann
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
Cathy York
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
Robin Gasparini
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
April Walker
(Printed First Name) (Printed Last Name) (Optional Password,8 characters) (Signature)
VOID THE FOLLOWING:
•
(Printed First and Last Name) (Printed Firer'and Last Name)
(Printed First and Last Name) (Printed First and Last Name
(Printed First and Last Name) (Printed First and Last Name
(Printed First and Last Name) (Printed First and Last Name
THIS AUTHORIZATION MUST 13E SIGNED BY AN OFFICER'OR AUTHORIZED MANAGER OF THE COMPANY
Colleen Bridger, Ph.D, MPH Director of Health
(Print Name) (Signature) (Title) (Hate)
This document is confidential and contains the names of those individuals who are authorized to access any and at records stored at Starpoint Global Services.This information is Intended
only for the usa of those individuals.Do not copy or distribute,To maintain security of your records please notify us Immediately of any and all changes using this farm.Changes become
effective 24 hours after receipt of Original Copy.Fax and photocopies cannot be accepted,
3
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit A
ESTIMATED COST AND SERVICE PROPOSAL PROVIDED BY
1 .. , GLOBAL . C .,
I
Orange County Health Department
FOR
Imaging Patient Records and Related Services
Jan. 19 2016
1
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Our pricing and marketing information provided to you is CONFIDENTIAL and proprietary
information. You agree that it shall not be disclosed to any third party and shall, at all times,
remain confidential.
2
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:❑80158A0-1139-48CD-8576-549C07AE1795
xSTARPOINT
GLOBAL SERVtC S
Jan. 19,2016
Proposal For:
Orange County Health Department
Attn: Pam McCall and Beth Ann Arbogast
300 West Tryon St.
Hillsborough,NC 27278
Dear Pam and Beth Ann:
Starpoint Global Services ("Starpoint") hereby submits this revised proposal for the digitization
of paper-based medical records belonging to Orange County Health Department("OCHD", "the
Health Department"). Thank you for giving Starpoint the opportunity to provide you with this
information.
Executive Summary
The Orange County Health Department operates two clinics in Orange County, one in Chapel
Hill and one in Hillsborough. Medical records for both sites remain a combination of paper-
based charts and digital information maintained with the Patagonia electronic health record.
Starpoint proposes to enable the EHR by systematically digitizing the Health Department's
hardcopy records for embedding into the Patagonia interface. These legacy records will be
hosted by Patagonia's secure cloud platform. Using this strategy, all patients seen by the clinic
after the go live date for the electronic record will have a comprehensive file stored directly in
the EHR, along with every other patient seen by the clinic since 2010.All retention requirements
for the hardcopy records will be satisfied, and accessibility to medical histories will be
instantaneous.
To accomplish this goal, Starpoint will pack all remaining hardcopy files for relocation to
Starpoint's Chapel Hill facility. Starpoint will progress through these files alphabetically, and
data will be loaded in batches directly into Patagonia. The Depaitment will provide lists of
specific patients needed on a priority basis in coordination with upcoming appointment
schedules. As Starpoint continues to progress through the alphabet, fewer and fewer of these
individual requests will be necessary, and the entire effort should be completed within 3 or 4
weeks from the start of the scanning project,
The Department will keep records of patients with no activity since before 2010, but may opt to
pack containers with files from this population as needed for Starpoint to pick up and scan. Files
scanned individually or in small batches by Starpoint should appear in Patagonia within a few
3
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
seconds of a transmission from Starpoint.
Starpoint will image all records using Digitech Systems, Inc. (DSI) PaperFlow software. Images
will be captured using Bowe Bell+Howell Spectrum &Plus Scanners at 200 dpi, utilizing the
latest technology available, including ultrasonic multi-feed detection to eliminate missed pages
and any possible user error.
Following a rigorous quality control process, images will be indexed according to client
requirements with the following indices:Patient Name,Date of Birth,MR number and chart
section. The chart section index for this project will be a static field indicating that the files
produced are archived charts. Starpoint will manually key the MR numbers from patient jackets
and will populate the additional demographic information via a department-provided patient
index with information tied to a unique identifier. This strategy will decrease reliance on manual
indexing, which will increase efficiency and accuracy for export to Patagonia. Finally, images
will be transmitted on an encrypted drive directly to Patagonia for loading into the Patagonia
cloud for Orange County. Therefore, no technical support on the part of the County will be
required to hand off data or to load the data to the electronic health record. Indexing information
will match scanned files to existing demographic information in order to deposit files in the
correct patient folders automatically.Any files which do not successfully match the
demographics of an existing patient will appear in a folder for manual investigation/disposal by
clinic staff.
As an additional quality control measure, Starpoint will store a backup copy of all images in our
vault for a full year after the project is completed at no cost. Starpoint will utilize a NAS Drive
devoted exclusively to this project with internal redundancy in the hardware as back-up.
Completed datagroups will be exported directly to the encrypted DataLocker for delivery to
Patagonia. If the County would like to purchase its own DataLocker or similar encrypted device,
it may provide one to Starpoint to be used for the duration of the project and returned to the
County upon completion. If the County opts to use a Starpoint-provided device for data
transport, Starpoint will utilize the DataLocker's built-in data scrubbing purge function to delete
data once transferred. This function not only designates data for deletion (to be over-written
during future usages), it actually overwrites all of the ones and zeroes that construct the data on
command.
Once the project is completed, Starpoint can continue to store the NAS Server for the County for
up to one year as a back-up to Patagonia. Starpoint is also willing to turn over the NAS Server to
the County at its request.
For clients that do not require such a hardware hand-off, Starpoint's protocol for purging
electronic data goes beyond simply erasing it,which can obviously leave some or all of the data
residing on the devices, even after it appears to have been "erased". Even if you bypass or empty
the recycle bin, the data is not physically deleted: The space on the disk where the data is stored
is marked as available for reuse, but the old data will remain there until the space is reclaimed to
store new information.
4
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID: DB0158A0-1139-48CD-8576-549C07AE1795
Starpoint uses a utility to overwrite all of the binary code that is connected to this original data
with zeros in a scrubbing process.
Starpoint will also store the original hardcopy records for one year at no cost. Additionally,
Starpoint offers the added flexibility of our data migration capabilities, meaning that imaged
records can be exported to any document management system or electronic health record should
the Health Department choose to change ERR vendors for any reason in the future or to add a
third-party document management solution such as PaperVision,Laserfiche or Newgen
OmniDocs.
Starpoint has hundreds of export functions already in place and can use its software partner,
Digitech Systems,to design customized export functions whenever needed for data integration.
For the purposes of the Health Department's specific needs,however, Starpoint is actively
working with Patagonia as a value-add scanning partner in Orange County, as well as in several
other counties statewide.
Starpoint proposes to provide for the safety, security and accessibility of all records by protecting
access and privacy where required. We will accomplish this by:
• Securely relocating records to Starpoint's information management center
• Providing inventory and activity reports to Orange County Health Department
• Giving access to records only to authorized personnel
• Retrieving and delivering records when needed by the Health Department
• Making any additions to inventory as needed by the Health Department
• Confidentially and securely purging and destroying charts as needed by the
Health Department
Starpoint proposes to provide all hardware, labor and expertise to complete the relocation of
existing records, document preparation, scanning, indexing, page by page quality control
comparisons (QC), data export, data delivery and document destruction (if desired). Starpoint
will also provide one year of free storage in a secure, HIPAA-compliant environment at our
Chapel Hill facility. Starpoint will maintain continuity of access throughout the scanning process
with digital transmission of requested files available at no additional charge to the Health
Department.
5
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Overview
Headquartered in Chapel Hill, Starpoint is a national leader in the records management field and
a longtime provider of storage, scanning, document destruction and all associated services for
hospitals, universities, municipalities, and large corporations throughout the United States.
Since 1989, Starpoint has provided the best in records and information management services to
discerning companies who demand more from their providers than simple storage. Our
commitments to accuracy of operations and to guaranteed delivery of both paper and digital files
make us unique within our industry. Strict policies and procedures, extensive safety and security
practices, and a flawless 100%find ratio combine to provide Starpoint customers with the most
worry-free, cost-effective solution in records management.
Starpoint has already completed several large scanning projects for Orange County, beginning in
2012 with the successful digitization of all hardcopy case files from the Child Support
Enforcement office and establishing a paperless environment there.
Since that time, Starpoint has completed scanning projects for other Orange County Departments
including EMS, HR, Tax and Environmental Health.
Recently, Starpoint became one of only three approved vendors in North Carolina to meet
requirements for enrollment in the state's new scanning services and data migration program
available to all facets of state government by way of the State of North Carolina's Office of
Information Technology Services.
Starpoint has completed expansive imaging projects for a vast array of clients, including Nortel,
Crittenden Memorial Hospital, Carolina Center for Behavioral Health, McKinney Pediatrics,
UNC-Chapel Hill,Lewisville Pulmonary Associates,BD Worldwide Medical,Metglas, Inc., NC
State University,the North Carolina Department of Health and Human Resources,NC
Department of Environment and Natural Resources, Central Dermatology Center, UNC Child
Medical Evaluation Program, West Virginia University, Chatham Hospital and the NC
Department of Public Safety.
Our specialty has always been the management and imaging of patient medical records. We
recently finished digitizing every patient record for Rex Hospital(UNC Health) in Raleigh,
involving tens of millions of images scanned during several phases of an eight-year project. Most
recently, Starpoint began providing imaging services to Mission Health, starting with Blue Ridge
Regional Hospital in Spruce Pine.
Our expertise, decades of experience and local corporate headquarters make Starpoint a perfect
fit for the records management needs of the Orange County Health Department.
Based on a long history of working with the State on a variety of large scanning projects,
Starpoint has developed a simple, all-inclusive, per-image pricing model for document imaging
projects. This price includes all labor related to document preparation, actual scanning, indexing,
6
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-6576-549C07AE1795
quality control, data processing, data delivery and even one year of free storage for original
hardcopies.
Starpoint also offers the security of trained and experienced fulltime employees, many of whom
have worked for Starpoint for more than a decade. Starpoint is a one-stop shop, offering all
associated services directly, free from reliance on any third party subcontractors or temporary
staffing. We are fully HIPAA-compliant,maintain all applicable certifications and guarantee 100
percent find ratios for any requested files.
We utilize a proven system of barcodes and transmittals upon intake, allowing us to track all
activity associated with the files and containers we pick up throughout their lifecycle. This
system will provide the ultimate level of accountability for the Health Department. From the
moment your boxes are loaded onto a Starpoint truck,their precise individual locations will
always be known. Ha specific file is needed during the scanning process, it can be located
instantly, and then physically or digitally transmitted to either clinic location (or directly into the
Patagonia cloud).All retention schedules (and destruction schedules) are also documented within
this system. Requests for charts (or boxes) can be made by authorized depat(Anent employees by
phone, fax, or email.
100% Delivery Guarantee
At Starpoint, we will deliver any request for a barcode-labeled item the same day. Efficiency will
increase;risk and worry will decrease. Starpoint will provide a complete inventory of each item
that belongs to your facility at any time either electronically in Microsoft Excel format or as a
hardcopy report.
The same standards of guaranteed quality apply to our digital management services. At no time
during an imaging project will accessibility of records be disrupted. To ensure a complete
conversion with the highest quality, we have processes in place for identification, transportation,
preparation, digitization, quality control and confidential destruction of records and files, During
the scanning process, we guarantee 100%delivery satisfaction of requested files.A history of
activity is maintained documenting who requests information,when it was requested, and when
it is returned to a facility. Trained Starpoint employees will undertake all aspects of the project
with no investment of additional labor support required from Orange County.
Once scanned, all data is guaranteed to be exported in a useful manner, as directed by the Health
Department. Images will be individually compared to originals in a rigorous QC process and
indexed according to direction from the department.
The combination of professional, accurate document imaging and 26 years of experience in file
management is a distinct advantage that Starpoint can offer the Orange County Health
Department.
7
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Scope of Work
All-Inclusive Intake and Inventory
•Starpoint personnel will pack and relocate containers of hardcopy records from the clinics
in Hillsborough and Chapel Hill and transport them to Chapel Hill scanning facility.
Starpoint can accommodate weekly pick-ups based on scheduled appointments or larger
pick-ups based on alphabetic/chronologic segments of archived charts (recommended).
There is no additional cost for labor, intake or transport of these records. For Orange
County, the cost of empty containers needed for transport will also be waived, representing
hundreds of dollars in savings for the County.
•Starpoint's barcode and transmittal process will ensure that all containers are tracked both
physically and by reported activity from the moment they are picked up from the clinics,
throughout their lifecycle.
•Starpoint will physically or digitally deliver any chart needed by the Health Department
during normal business hours for the duration of the scanning process.
•Starpoint will establish authorized access by Health Department users,
Digital Conversion
•Starpoint will purge and digitally convert any records that Orange County Health
Department wishes to digitize at the all-inclusive rate of 4.2 cents per image.
•Charts will be prepped for feeding into the scanners by removing any paper clips, staples
and post-it notes, and copying and repairing damaged pages whenever required.
•Starpoint will image all pages at full duplex mode with our Ultrasonic Multi-Feed Detection
equipped Bowe Bell+Howell scanners to ensure a 100% capture rate.
•Images will be scanned at 200 dpi in TIFF Group IV format files for interoperability.
Following scanning, a set of image and manipulation processes will be run to remove blank
pages, correct skewed images, and remove black borders.
•All images will be manually Quality Controlled to ensure total data capture and legibility.
Documents will be cross compared between physical and digital,with any inadequacies
immediately rectified through re-scanning.
•Starpoint will index all images using MR numbers, patient names, dates of birth and static
fields to designate chart sections and County.
•Starpoint will process all files using Adobe OCR to enable full-text searchability at no
added cost.
•Images will be exported to a medium and format of Orange County Health Department's
choosing.
•Following digitization, Starpoint will store all boxes for a period of one year for quality
assurance testing and backup at no charge. After that year, Starpoint will contact the Health
Department to gain authorization for destruction and destroy said records and issue a
Certificate of Confidential Destruction.
8
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0156A0-1139-48CD-8576-549C07AE1795
Chain of Custody
Starpoint will pack all files targeted for scanning and will transport these files directly to our
secure scanning facility using only Starpoint-owned vehicles and fulltime employees. Scanning .
will be completed on a closed network with absolutely no internet connectivity.All data will be
stored on a server devoted exclusively to this project, and this server will become the property of
the County at the conclusion of the project. Starpoint will provide this server at no additional
cost. Starpoint can store this server for the County or can deliver it to the County at the
conclusion of the scanning effort.
Starpoint will provide on-demand access to all files throughout the scanning project. Requested
files can be delivered physically or by digital means. The County may elect to have Starpoint
send encrypted PDF versions of requested files to authorized County employees by email or to
have Starpoint load individually requested files directly into Patagonia using a Patagonia-hosted
FTP connection.This connection with Patagonia had already been tested successfully during
Starpoint's efforts for other counties.
Completed datagroups will be delivered in person to Patagonia using secure DataLockers.
DataLockers utilize 256-bit encryption and are used by the US Military as well as many hospitals
and State Departments in North Carolina. The devices include a digital keypad and require a 16-
digit passcode to access information.
9
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Cost of Service:
All-Inclusive Scanning: $0.042 per image.
This rate is available regardless of actual quantities designated for scanning.
For medical records, Starpoint generally equates 13.5 linear inches of records to 1 container(1.2
cubic foot), and generally sees an image yield of approximately 2,500 images per container.
Actual image yields can fluctuate by plus or minus 1,000 images per container depending on
percentage of duplex pages and size and density of charts. A sample container of Orange County
Health Department records has been scanned and yielded 2,553 images.
Each of the two clinics has its own fileroom with charts from 2010 to the present organized
alphabetically and mixed by dates of service.
As of Sept. 2015,the Hillsborough location held approximately 197 linear feet of records, and
the Chapel Hill location held approximately 151 linear feet. These numbers will equate to
approximately 175 containers of records from Hillsborough and another 134 containers from
Chapel Hill.
Projected Total Chart Volumes
Linear Total Approx Image Total Cost
Feet of Containers Yield (based on (all-
Records worth (1.2 2,550 images per inclusive,
cu ft) container) per-image
rate of
_ $0.042)
Hillsborough 197 feet 175 446,250 $18,742.50
site
Chapel Hill 151 feet 134 341,700 $14,351.40
site
Cumulative 348 309 787,950 $33,093.90
Total
The above figures show expected costs for digital conversion of the existing filerooms in their
entirety. Actual costs will be based on actual image yields.
to
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DBO158A0-1139-48CD-8576-549C07AE1795
The$0.042 per image rate represents a 47.5 percent discount from Starpoint's list price for
these services. This rate is available to the Department regardless of actual quantities designated
for scanning. The above project cost totals are estimates only, and actual costs may vary.
We are able to offer this generous rate due to the proximity of the OCHD clinics and to the
relative simplicity of indexing, as well as to Starpoint's desire to assist with the missions of local
nonprofits such as the Health Department.
It is a comprehensive rate which includes all services related to pick-up, transport, scanning,
indexing, QC, data export, data delivery and one year secure storage, as well as all empty
containers and labor for packing files from the shelves.
Confidential Destruction
Additional services, including confidential destruction, are available at pricing listed in attached
Schedule A. The all-inclusive price for confidential shredding is 16 cents per pound. The average
banker's box full of records weighs approximately 30 pounds and costs about$4.80 to destroy.
Destruction includes pick up, transport, shredding and creation of a certificate of destruction.
At any time prior to the end of the free year of storage we have offered for all scanned records,
the County may opt to reclaim original files,to initiate monthly storage or to authorize
confidential destruction via shredding. To shred all 309 containers of medical records we
anticipate to relocate from the two clinics would cost approximately$1,483.20.
11
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-4SCD-8576-549C07AE1795
Competitive Edge:
This proposal represents a guaranteed quality and level of service unmatched in our industry.
Starpoint promises to put in all efforts, and we will do whatever it takes to complete this project
for the Orange County Health Department in a timely manner. I personally will be available to
you 24/7/365.
Thank you again for this opportunity to be of service.
Best regards,
Richard H. Ray, Jr.
Richard H. Ray, Jr. Tel: 919-933-9529
Director of Business Development Fax: 919-942-1400
Starpoint Global Services Cell: 919-923-1217
PO Box 707 E-Mail: richard@starpointusa.com
Carrboro,NC 27510
This proposal is presented by Richard H. Ray, Jr., Director of Business Development for
Starpoint Global Services, on behalf of Clay Brinkley, VP and Chief Information Officer, and
Christoffel Verwoerdt, CEO.
Starpoint Global Services is headquartered in Chapel Hill,NC. The mailing address is PO Box
707, Carrboro,NC 27510. The phone number is 919-942-6666, and the fax is 919-942-1400.
Correspondences relating to this proposal and its evaluation can be directed to Richard H. Ray,
Jr. at richard @starpointusa.com or directly by phone at 919-933-9529 (office) or 919-923-1217
(cell).
This proposal has been thoroughly reviewed and evaluated by Starpoint management. It is based
on careful consideration by Starpoint to guarantee Orange County Health Department the very
highest level of customer service at our best possible price.
12
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:090159A0-1139-48CD-8576-549C07AE1795
TERMS AND CONDITIONS
The following terms and conditions shall apply to this agreement.
1, STORED MATERIAL-Company shall store the Stored Material identified by Client on the Records
Transmittal Form (a sample of which is attached hereto as Exhibit E), Client and Company may change,
delete or add to the Stored Material by written agreement only. Additional materials shall,unless otherwise
indicated in writing, be deemed to be held under these same terms and conditions and shall be considered
part of the Stored Material.
2. ACCEPTANCE-In the absence of an executed contract, Client's act of tendering material for storage to
Company constitutes acceptance by Client of the terms, conditions and rated contained within this
agreement.
3. RATES-Client agrees to pay Company according to Company's then current rate schedule, A copy of the
Company's current rate schedule is attached hereto as Schedule A. Payment in full is due in advance on
the first day of the month. Rates may be changed upon thirty (30) days notice to Client. For Stored
Material received during a month, or stored for a portion of a month, charges will be assessed according to
the Schedule A rates then in effect, Additional charges, if any, shall be paid simultaneously with the
regular monthly rates.
4. CLIENT AUTHORIZED REPRESENTATIVES-Client must designate all individuals that are authorized
to have access to the Stored Material by identifying said individuals on Company's Access Authorization
form (a sample of which is attached hereto as Exhibit F). Only the Authorized Representative and
Secondary Authorized Representative may authorize destruction of the Stored Material.
5. ACCESS TO STORED MATERIALS
5.1 Company shall conduct services pertaining to the Stored Material only pursuant to direction of
Client's agent(s) identified by Client on Company's Access Authorization form. Client represents
that the Authorized Representative and the Secondary Authorized Representative have full authority
to order all services that pertain to the Stored Material including, but not limited to, removal and
destruction of Stored Material.
5.2 The Company reserves the right to deny access to or delivery of the Stored Material until such time as
Client has cured any default under this agreement.
6. ACT OF GOD OR FORCE MAJEURE-An"act of God"or"force maj cure"is defined for purposes of this
agreement as strikes, lockouts, sit-downs, material or labor restrictions by any governmental authority,
unusual transportation delays, riots, floods, washouts, explosions, earthquakes, fire storms, weather
(including wet grounds or inclement weather), acts of a public enemy, terrorist act, wars, insurrections,
national emergency, shortage of labor or materials,and/or any other cause not reasonably within the control
of the Company or which by the exercise of due diligence Company is unable, wholly or in part, to
overcome.
7. LIMITATION OF LIABILITY
7.1 Company's liability, if any, for loss, damage,or destruction to the Stored Material shall be limited to
the assumed value of the Stored Material,which is agreed to as follows:
(a) for Stored Material that is stored according to Company's hardcopy rates: $2.25 per cubic foot
for Stored Material stored at the"per box"rate or$2.25 per linear foot for Stored Material stored
at the"open shelf file storage"rate; and,
(b) for Stored Material that is stored according to Company's Media Vault rates: $50.00 per
magnetic tape,$7.00 per microfilm roll,$50.00 per data cartridge,or$1.50 per computer diskette.
13
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0156A0-1139-48CD-8576-549C07AE1795
In no event shall the Company be liable for loss of the information contained in the Stored Material or any
related consequential or incidental damages. Such limitation of liability shall apply irrespective of the
cause of loss,damage,or destruction of the Stored Material.
7.2 The Stored Material is not insured by Company against loss or injury, irrespective of the cause of the
loss or injury.
7.3 Client understands and acknowledges that normal deterioration and aging of record media occurs with
time and Company assumes no liability for such deterioration.
7.4 Claims by Client for loss, damage or destruction must be presented in writing to Company within
sixty (60) days of the date on which Client is notified or learns of the loss, damage or destruction to
part or all of the Stored Material has occurred.
7.5 No action, suit or proceeding may be brought or maintained by Client or any other third party against
Company for loss, damage or destruction of the Stored Material, unless a timely written claim has
been given as provided in Section 7.4 of this agreement.
7.6 When services pertaining to the Stored Material are requested by Client, a reasonable time shall be
given to Company to complete said services and, if Company is unable to perform the requested
service(or to provide any other service herein contemplated)because of force majeure,acts of God or
because of loss or destruction which the Company is not liable, or because of any other excuse
provided by law,the company shall not be liable for failure to carry out such instructions or services.
8. TERM-The term of this agreement shall commence on the date of Client's signature and will continue for
one year, with automatic renewals for successive one-year terms, unless written notice of non-renewal is
delivered by either party to the other at least thirty days before the expiration date of the then current term,
9. DEFAULT
9.1 The occurrence of any one of more of the following events shall constitute a default of this agreement
("Events of Default"):
a. failure to pay any sum due hereunder;or
b, breach of any provision of this agreement; or
c. client becomes insolvent or files, or has filed against it, any proceeding in federal or state court
seeking debtor relief.
9.2 Upon the occurrence of any Event of Default,Company,and its sole option,may exercise any or all of
the following remedies without terminating Client's obligations under this agreement:
a.demand in writing that Client pick up the Stored Material;
b.deliver the Stored Material to the Client.
c. upon thirty (30) days advance written notice to Client, destroy the Stored Material, the cost of
which shall be billed to Client. Client acknowledges that since the Stored Material has little or no
market value, sale of the Stored Material would be impossible, and destruction is the only way for
the Company to mitigate its damages.
d.terminate this agreement,whereupon Company,shall recover all damages suffered by reason of
such termination.
9.3 After any Event of Default,Client shall continue to pay all sums due hereunder up to and including,
if applicable,the date of delivery of the Stored Material as provided in 9.2(b)above.
In the event Company takes any action pursuant to this section, it shall have no liability to Client or
anyone claiming through Client. The exercise by Company of any one or more of the remedies
provided in this agreement shall not prevent the exercise by Company of any of the other remedies
14
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549007AE1795
herein provided. All remedies provided for in this agreement are cumulative and may,at the election
of Company, be exercised alternatively, successively or in any other manner and are in addition to
any of the rights provided by law. Company shall be entitled to include all reasonable attorneys' fees
and costs incurred in connection with the enforcement of this agreement.
10. DESTRUCTION OF RECORDS-Upon written instruction from Client's Authorized Representative or
Client's Secondary Authorized Representative, Company may destroy the Stored Material. The Client
releases the Company from all liability by reason of the destruction of Stored Material pursuant to such
authority. The Company may also destroy the Stored Materials in accordance with Section 9.2 (c) of this
agreement.
11. TITLE WARRANTY-Client warrants that it is the owner or legal custodian of the Stored Material and has
full authority to store the Stored Materials in accordance with the terms of this agreement.
12. INDEMNIFICATION-Company shall not be liable to Client or to Client's customers, employees, agents,
guests or invitees, or to any other person whomever, for any injury to persons or damage to property,
including, but not limited to consequential dames, (1) caused by any act or omission of Client, its
customers, employees, agents, guests or invitees, licensees and concessionaires, or of any other person
claiming through Client, or (2) arising out of any breach or default by Client in the performance of its
obligations hereunder, or (3) arising out of the failure or cessation of any service provided by Company
(including security service and devices). Client hereby agrees to indemnify Company and hold Company
harmless from any liability,loss,expense or claim(including,but not limited to reasonable attorney's fees)
arising out of such damage or injury. Nor shall Company be liable to Client for any loss or damage that
may be occasioned by or through the acts of omissions of others persons whomsoever,excepting only duly
authorized employees and agents of Company acting within the scope of their authority, Unless caused by
the negligence of Company, Client agrees to fully indemnify and hold harmless Company, its officers,
employees and agents for any liability,cost or expense,including reasonable attorneys' fees,that Company
may suffer or incur as a result of claims, demands, costs or judgments against it arising out of its
relationship with Client or third parties.
13. RULES
13,1 Client shall not, at any time, store with Company any narcotics,Hazardous Materials as hereinafter
defined, or materials otherwise considered to be highly flammable, explosive, toxic, radioactive or
which may attract vermin or insects,or any other materials which are otherwise illegal,dangerous and
unsafe to store or handle. Company reserves the right to open and inspect the Stored Materials
tendered for storage restrictions and guidelines. For purposes of this agreement,the term "Hazardous
Materials"shall mean and refer to any wastes,materials, or other substances of any kind or character
that are or become regulated as hazardous or toxic waste or substances, or which require special
handling or treatment,under any local,state or federal law,rule,regulation or order,
14. CONFIDENTIALITY-Company acknowledges that the Stored Materials may contain confidential
information. Company specifically agrees that it will release the Stored Material only to Client, except as
provided below.
In the event that Company receives a request to disclose all or any part of the Stored Materials under the
terms of a subpoena or order issued by a court or by a governmental body,Company agrees:
a. to notify Client immediately of the existence, terms, and circumstances surrounding such
request;and
b. to furnish only such portion of the Stored Material as it is legally compelled to disclose.
15. NOTICES-All notices under this agreement shall be in writing. Unless delivered personally, all notices
shall be addressed to the appropriate addresses noted herein,or as otherwise designated in writing. Notices
shall be deemed to have been delivered when deposited in the United States mail,postage prepaid,certified
mail,return receipt requested, addressed to the parties at the respective addresses set forth on page one, or
to such other addresses as the parties may have designated by written notice to each other.
15
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139.48CD-8576-549C07AE1795
16. MISCELLANEOUS-All schedules, if any, attached hereto are hereby incorporated by reference and made
a part hereof. The term "agreement" as used herein shall be deemed to include all such schedules. All
words and phrases in this agreement shall be construed to include the singular or plural number, and the
masculine,feminine or neuter gender, as the context requires. This agreement(together with any schedules
attached and documents incorporated herein) constitutes the entire agreement between the parties, oral or
written between the parties. This agreement may not be assigned by Client without the consent of
Company. No modification of this agreement,except changes to Company's rate schedule,as provided for
herein,shall be binding unless in writing,attached hereto,and signed by the party against which it is sought
to be enforced. No waiver of any right or remedy shall be effective unless in writing and nevertheless,shall
not operate as a waiver of any other right or remedy on a future occasion. Every provision of this
agreement is intended to be severable. If any term or provision is illegal, invalid or unenforceable, there
shall be added automatically as part of this agreement,a provision as similar in terms as necessary to render
such provision legal, valid and enforceable. This agreement shall be governed by and construed in
accordance with the laws of the State of North Carolina. Client agrees that any action or proceeding arising
out of or related in any way to this agreement shall be brought solely in a Court of competent jurisdiction
sitting in Hillsborough, Orange County, North Carolina. Client hereby irrevocably and unconditionally
consents to the jurisdiction of such court and hereby irrevocably and unconditionally waives any defense of
an inconvenient forum to the maintenance of any action or proceeding in such court,any objection to venue
with respect to any such action or proceeding and any right of jurisdiction on account of the place of
residence or domicile of any party thereto. Nothing in this agreement shall be deemed or construed to
constitute or create a partnership, association, joint venture, or agency between the parties hereto. Each
party to this contract has the right to terminate contract upon 30 days notice.
17. HIPAA. The Parties hereby agree to the terms and conditions of the Business Associate agreement,
attached as Exhibit C and fully incorporated herein.
Medicare Access to Records.Each party shall keep,and allow the other party reasonable access to,full
and accurate books and records of all services rendered hereunder. Further, to the extent required by
Section 1395x(v)(1)(I)of Title 42 of the United States Code,until the expiration of four years after the
termination of this Agreement, Contractor shall, upon written request,make available to the Secretary
of the United States Department of Health and Human Services, or to the Comptroller General of the
United States General Accounting Office, or to any of their duly authorized representatives, a copy of
this Agreement and such books, documents, and records as are necessary to certify the nature and
extent of the costs of the services Contractor provided under this Agreement.
CLIENT STARPOINT GLOBAL SERVICES
Name: Ccl?mil, Name: Ri . E�kf�is�"•:' ;Jr.
l41w,t, rot Jr,
Signatureti coCOODOFC68 s�.,. Signature. EsKar.13C4D0...
Title: Orange County Health Director Title: Director of Business Development
Date: 1/28/2016 Date: 1/28/2016
16
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Schedule A
Starpoint Global Services
Price list as of January 1,2015
Records Management
SPECIAL PRICING FOR ORANGE COUNTY HEALTH DEPT. $0.042 per image for Scanning
(Scanning Projects are all-inclusive,and not subject to any charges for intake or monthly storage)
Monthly Storage Charges (Minimum Storage Billing:$40.00)
Secured Box Storage per cu.ft. $0.275/cubic foot
Secured Box Storage(1.2 cu.ft.) $0.33 each unit
Secured Box Storage(2 cu.ft.) $0.60 each unit
Secured Bankers(check)Box $0.28 each unit
Secured File/X-ray Storage $0.05 each unit
Generation of Inventory
New Box Input $ 1.50 each unit
New File Input $0.75 each unit
Retrieval
Box $ 1.50 each unit
File/Interfile $ 1.50 each unit
Refile
Box $ 1.50 each unit
File/Interfile $ 1.50 each unit
Permanent Removal
Box/File(retrieval,data entry, docking) $3,60 each unit
•
Delivery&Pick Up
Boxes/Files $ 1.00 each unit
Pick Up/Delivery(within 30 miles—includes first unit) $ 12.50 per trip
Rush Trip Charge $37.50 per trip
(Also applies to after-hours,weekends,and holidays)
X-ray Digitization $3.00 per film
Secured and Certified Destruction
Box/File $0.16 per lbs
X-ray $0.00 per lbs
Certificate of Destruction No Charge
Other Services
Priority Search,Box/File $ 15.00 per search
Priority Dock Access(access within 2 hours,or same day after 11:00 AM) $6.00 per event
Photo Copies $0.40 per page
Facsimile $0.40 per page
Mail/Fed Ex(Actual plus mark-up) Actual plus 20%
Labor per Man-hour for Inventory&Repacking $23.00 per hour
Reports FREE
Starpoint Record Storage Carton&Barcode $2.50 each unit
17
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0.1139-48CD-8576-549C07AE1795
Media and Vital Records Management
Monthly Storage Charges(in vault)
Tape Reel(In Racks) $0.42 each unit
Tape Cartridge $0.29 each unit
CD-ROM $0.29 each unit
0,75 cu. ft.turtle") $3.10 each unit
Container:(1.2 cu.ft.) $4.15 each unit
(Minimum Storage Billing:$40.00)
Generation of Inventory
New Tape/CD Input $ 1.50 each unit
Retrieval
Reel/Cartridge/CD-ROM $ 1.50 each unit
Container $ 1.50 each unit
Refile
Reel/Cartridge/CD-ROM $ 1.50 each unit
Container $ 1.50 each unit
Delivery&Pick up
Reel/Cartridge/CD-ROM/Container $ 1.15 each unit
Pick Up/Delivery(within 30 miles--includes first unit) $ 12.50 per trip
Rush Trip Charge $37.50 per trip
(Also applies to after-hours,weekends,and holidays)
Permanent Removal
Reel/Cartridge/CD-ROM/Container $3.60 each unit
(retrieval,data entry,docking)
Other Services
Mail/FedEx Actual plus 20%
Labor per Man-hour for inventory&repacking $23.00 per hour
Reports FREE
18
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Imaging
Proposed pricing only. MI imaging projects must be sampled.
Imaging
Project Admin,Preparation&Set-up fee $200.00
Project Admin,Preparation&Set-up fee w/PaperVision $250.00
Project Admin,Preparation&Set-up fee w/ImageSilo $250.00
Document Scanning**
8.5 x 11 $0,08 per page
8.5 x 14 $0,11 per page
11 x 17 $0.25 per page
17x22 $0.88 per page
22 x 34 $ 1.25 per page
28 x 40 $ 1.38 per page
34 x 44 $ 1,50 per page
X-ray Scanning $3.00 per film
**Prep&indexing $23.00 per hour
PaperVision Enterprise Software
1-9 seats $ 1500 per seat
10-99 seats $1200 per seat
99+ $ 1000 per seat
Annual maintenance $200 per seat
PaperVision Xpress Software $800 per seat
Annual maintenance $ 100 per seat
ImageSilo Web Retrieval
Monthly storage Charge $50.00 per 1 GB
Technical Support Hourly $50.00 per hour
Site visit $250 minimum
Support call $ 15.00
Destruction Services
Confidential Pickup and Destruction $40.00/bin/visit*
*Once a month service minimum/console supplied during term of service
Confidential Console Purchase $ 150.00 each
Box/File/Paper $0.16 per lbs
Other Storage
Other Storage/Floor Space $ 1.00 per sq.ft.
Please note that these prices are subject to change depending on volume of storage
19
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("Agreement") is made effective the first day of October,
2015,by and between Orange County Government by and through the Orange County Health Department
("Covered Entity"), and Starpoint Global Services, ("Business Associate"). Covered Entity and Business
Associate may be referred herein individually as a "Party" or collectively as the "Parties". This
Agreement supersedes any previously executed Business Associate Agreement between the Parties.
WITNESSETH:
WHEREAS, Sections 261 through 264 of the federal Health Insurance Portability and
Accountability Act of 1996 ("HIPAA"), Public Law 104-191, as modified by the Health Information
Technology for Economic and Clinical Health Act ("HITECH"), Public Law 111-5, known as "the
Administrative Simplification provisions," direct the Department of Health and Human Services to
develop standards to protect the security,confidentiality and integrity of health information; and
WHEREAS, pursuant to the Administrative Simplification provisions, the Secretary of Health
and Human Services ("Secretary") has issued regulations modifying the Privacy, Security, Breach
Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as the same may be amended from
time to time(the"HIPAA Security and Privacy Rule"); and
WHEREAS, the Parties wish to enter into or have entered into an arrangement whereby Business
Associate will provide certain services to Covered Entity, and, pursuant to such arrangements, Business
Associate may be considered a"Business Associate"of Covered Entity as defined in the HIPAA Security
and Privacy Rule (the agreement evidencing such arrangement is detailed below and hereinafter referred
to as the"Service Agreement(s)");and
WHEREAS, Business Associate may have access to Protected Health Information as defined
below)in fulfilling its responsibilities under such arrangement;
THEREFORE, in consideration of the Parties' continuing obligations under the Service
Agreement, compliance with the HIPAA Security and Privacy Rule, and other good and valuable
consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the
provisions of this Agreement in order to address the requirements of the HIPAA Security and Privacy
Rule and to protect the interests of both Parties.
1. DEFINITIONS
(a) Service Agreement. Agreement(s) for services affected by this HIPAA Business
Associate Agreement, which this Business Associate Agreement shall be attached to, and is (are) hereby
incorporated by reference, and which shall be taken and considered as a part of this document the same as
if fully set out herein:
Starpoint Global Services Medical Scanning
(b) Catch-all Provision. Except as otherwise defined herein, any and all capitalized terms in
this Agreement shall have the definitions set forth in the HIPAA Security and Privacy Rule,45 CFR Parts
160 and 164,subparts A and E. In the event of an inconsistency between the provisions of this Agreement
and mandatory provisions of the HIPAA Security and Privacy Rule, as amended,the HIPAA Security and
Privacy Rule shall control. Where provisions of this Agreement are different than those mandated in the
HIPAA Security and Privacy Rule, but are nonetheless permitted by the HIPAA Security and Privacy
Rule,the provisions of this Agreement shall control.
1
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AEI795
Exhibit C
(c) Electronic Protected Health Information. Protected Health Information that is transmitted
by or maintained in Electronic Media(as defined in the HIPAA Security and Privacy Rule).
(d) Protected Health Information. "Protected Health Information" shall have the same
meaning as the term in 45 CFR § 160.103, limited to the information created or received by Business
Associate from or on behalf of Covered Entity and includes without limitation "Electronic Protected
Health Information." Business Associate acknowledges and agrees that all Protected Health Information
that is created or received by Covered Entity and disclosed or made available in any form, including paper
record, oral communication, audio recording, and electronic display by Covered Entity or its operating
units to Business Associate or is created or received by Business Associate on Covered Entity's behalf
shall be subject to this Agreement.
(e) Required by Law. "Required by Law" shall have the same meaning as the term in 45
CFR§ 164.103.
II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
(a) Use and Disclosure. Business Associate agrees to fully comply with the requirements
under the HIPPA Security and Privacy Rule applicable to Business Associates and not to use or disclose
Protected Health Information other than as permitted or required by this Agreement, the Service
Agreement or as Required by Law. To the extent Business Associate carries out obligations of Covered
Entity under the HIPAA Security and Privacy Rule, Business Associate shall comply with the applicable
provisions of the HIPAA Security and Privacy Rule as if such use or disclosure were made by Covered
Entity. Business Associate agrees to comply with Covered Entity's policies regarding the minimum
necessary use or disclosure of Protected Health Information.
(b) Appropriate Safeguards. Business Associate agrees to use appropriate safeguards to
prevent use or disclosure of Protected Health Information other than as provided for by this Service
Agreement(s), this Agreement or as Required by Law. This includes the implementation physical,
technical and administrative safeguards to prevent use or disclosure of Protected Health Information other
than as permitted in this Agreement or Required by Law and reasonably and appropriately protect the
confidentiality, integrity, and availability of any Electronic Protected Health Information that it creates,
receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security and
Privacy Rule. The Business Associate shall maintain appropriate documentation of its compliance with
the HIPPA Security and Privacy Rule, including, but not limited to, its policies, procedures, records of
training and sanctions of members in its workforce.
(c) Assurances. Business Associate agrees to provide Covered Entity with written
assurances that any Protected Health Information placed on any type of mobile media, including, but by
no means limited to, lap top computers, Ipads and mobile phones, is encrypted in accordance with
guidance issued by the Secretary.
(d) Agents and Subcontractors. Business Associate shall require any agents, including any
subcontractors, to whom it provides Protected Health Information from Covered Entity that is created,
received, maintained or transmitted on behalf of Business Associate to agree by written contract with
Business Associate to the same (or greater) restrictions, conditions and requirements that apply to
Business Associate with respect to such information, and to agree to implement reasonable and
appropriate safeguards to protect any of such information that is Electronic Protected Health Information.
In addition, Business Associate agrees to take reasonable steps to ensure that its employees' actions or
omissions do not cause Business Associate to breach the terms of this Agreement.
2
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
(e) Mitigation of Breach, Business Associate agrees to mitigate, to the extent practicable,
any harmful effect that is known to Business Associate of a use or disclosure of Protected Health
Information by Business Associate in violation of the requirements of this Agreement, as well as to
provide complete cooperation to Covered Entity should Covered Entity elect to review or investigate such
noncompliance or Security Incident. Business Associate shall cooperate in Covered Entity's breach
analysis and/or risk assessment, if requested. Furthermore, Business Associate shall cooperate with
Covered Entity in the event that Covered Entity determines that any third parties must be notified of a
Breach, provided that Business Associate shall not provide any such notification except at the direction of
Covered Entity.
(f) Breach Reporting. Business Associate shall report in writing to Covered Entity's Privacy
Officer (see Attachment A), any use or disclosure of Protected Health Information that is not in
compliance with the terms of this Agreement,as well as any Security Incident and any actual or suspected
Breach, of which it becomes aware, without unreasonable delay, and in no event later than forty-eight
(48) hours of such discovery. For purposes of this Agreement, "Security Incident" means the attempted
or successful unauthorized access, use, disclosure, modification, or destruction of information or
interference with system operations in an information system. Such notification shall contain the
elements required by 45 C.F.R. § 164.410.
(g) Compliance. To the extent applicable, Business Associate will comply with(i) Covered
Entity's Notice of Privacy Practices; (ii) any limitations to which Covered Entity has agreed in regard to
an Individual's permission to use or disclose his or her Protected Health Information; and (iii) any
restrictions to the use or disclosure of Protected Health Information to which Covered Entity has agreed
or is required to agree.
(h) Government Access. Business Associate will make its internal practices, books and
records available to the Secretary of the Department of Health and Human Services for purposes of
determining compliance with the terms of the HIPAA Security and Privacy Rule, and, at the request of
the Secretary, will comply with any investigations and compliance reviews, permit access to information,
and cooperate with any complaints, as Required by Law. Without unreasonable delay and, in any event,
no more than 48 hours of receipt of the request or notification, Business Associate will notify Covered
Entity in writing of any request by any governmental entity, or its designee, to review Business
assessment of any kind.
(i) Electronic Transactions. If Business Associate conducts any Standard Transactions for or
on behalf of Covered Entity, Business Associate shall comply with the requirements under the Electronic
Transaction Rule.
(j) Audit. Business Associate shall permit Covered Entity, in its discretion, to conduct an
audit of Business Associate's compliance with this Agreement, HIPAA, and HITECH. Such audit may
consist of an onsite visit, a series of inquiries that require written responses, or both. Business Associate
shall promptly and completely respond to Covered Entity's requests for information in support of the
audit, which shall not be conducted more than once annually except in cases of an actual or reasonably
suspected Security Incident or reasonably suspected noncompliance with this Agreement, HIPAA or
HITECH. Each Party shall bear its own costs associated with the audit.
(k) Identity Theft. Business Associate shall implement Identity Theft Monitoring Policies
and Procedures to protect any patient information that may be breached by the Business Associate to the
extent applicable under the Federal Trade Commission's Red Flag Rules.
(1) HITECH Compliance. Business Associate shall:
3
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
A. Not receive, directly or indirectly, any impermissible remuneration in exchange
for Protected Health Information or Electronic Protected Health Information,
except as permitted by HITECH § 13405(d) or the HIPPA Regulations;
B. Comply with the. marketing and other restrictions applicable to Business
Associates contained in HITECH § 13406 and the HIPPA Regulations;
C. To the extent required under HITECH§ 13404, fully comply with the applicable
requirements of 45 CFR 164.502(e)(2) for each use and disclosure of Protected
Health Information;
D. To the extent required under HITECH § 13401, fully comply with 45 CFR §§
164.308, 164.310, 164.312, and 164.316;
E. To the extent required under HITECH §§13401 and 13404, comply with the
additional privacy and security requirements that apply to Covered Entities in the
same manner and to the same extent as Covered Entity is required to do so;and
F. To the extent required under the HIPPA Regulations, comply with the privacy
and security requirements that apply to Business Associates.
(m) State Privacy Laws. Business Associate shall understand and comply with state privacy
laws to the extent that such privacy laws are not preempted by HIPPA or HITECH.
III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
(a) Use of Protected Health Information on Behalf of Covered Entity. Except as otherwise
limited in this Agreement, Business Associate may use or disclose Protected Health Information to
perform functions, activities or services for, or on behalf of, Covered Entity described in the Service
Agreement, provided that such use or disclosure would not violate the HIPPA Security and Privacy Rule
if it were made by Covered Entity or would not violate the Covered Entities minimum necessary policies.
(b) Other Uses of Protected Health Information. Except as otherwise limited in this
Agreement, Business Associate may use Protected Health Information within its workforce for the proper
management and administration of Business Associate not to include Marketing or Commercial Use and
to carry out the legal responsibilities of Business Associate; and
(c) Third Party Confidentiality. Except as otherwise limited in this Agreement, Business
Associate may disclose Protected Health Information for the proper management and administration of
Business Associate or to carry out the legal responsibilities of Business Associate, provided that if
Business Associate discloses any Protected Health Information to a third party for such purpose, the
Business Associate shall enter into a written agreement with such third party requiring the following:
A. Disclosure only as Required by Law; or
B. Business Associate obtains reasonable assurances from the person to whom the
information is disclosed that the information will remain confidential and will be used or
further disclosed only as Required by Law or for the purpose for which it was disclosed
to the person, and the person notifies Business Associate of any instances of which it is
aware in which the confidentiality, integrity, and or availability of the Protected Health
Information has been breached immediately upon becoming aware.
4
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DBO156A0-1139-48CD-8576-549C07AE1795
Exhibit C
(d) Business Associate may provide data aggregation services relating to the health care
operations of Covered Entity pursuant to any agreements between the Parties evidencing their business
relationship as permitted by 45 CFR§ 164.504(e)(2)(i)(B).
(e) Other Uses Strictly Limited. Nothing in this Agreement shall permit the Business
Associate to share Protected Health Information with Business Associate's affiliates or contractors except
for the purposes of the Service Agreement(s) between the Covered Entity and Business Associate(s)
identified in Section I(a)of this Agreement.
(f) Covered Entity Authorization for Additional Uses. Any use of Protected Health
Information by Business Associate, its affiliate or Contractor, other than those purposes of this
Agreement, shall require express written authorization by the Covered Entity, and a Business Associate
Agreement or amendment as necessary. Activities which are prohibited include, but are not limited to,
Marketing, as defined by 45 CFR § 164.503 or the sharing for Commercial Use or any purpose construed
by Covered Entity as Marketing or Commercial Use, even if such sharing would be permitted by federal
or state laws.
(g) Business Associate may de-identify Protected Health Information only at the specific
direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health
Information except at the direction of Covered Entity and in compliance with the requirements of the
HIPAA Security and Privacy Rule.
IV. AVAILABILITY OF PHI
(a) Access to Protected Health Information. Business Associate agrees, in the event the
Business Associate maintains protected health information in a Designated Record Set, to make available,
within ten (10) days of a request by Covered Entity in a time and manner designated by Covered Entity,
Protected Health Information in a Designated Record Set, to Covered Entity or as directed by Covered
Entity, to an individual in order to meet the requirements of 45 CFR § 164.524 of the HIPAA Security
and Privacy Rule.
(b) Amendments to Protected Health Information. In the event that the Business Associate
maintains Protected Health Information in a Designated Record Set, Business Associate agrees to make
any amendment(s) to Protected Health Information in a designated record set that the Covered Entity
directs or agrees to pursuant to the HIPAA Security and Privacy Rule at the request of Covered Entity of
an individual,within ten(10)days of receipt of a request from Covered Entity and in the time and manner
designated by Covered Entity.
(c) Accounting of Disclosures. Business Associate agrees to maintain and make available
the information required to provide an accounting of disclosures, as required by 45 CFR§ 164.528 of the
HIPAA Security and Privacy Rule. Business Associate will comply with Covered Entity's policy
regarding accounting of disclosures.
(d) Document Disclosures. In the event an Individual makes a request under this Section of
the Agreement directly to Business Associate, Business Associate will notify Covered Entity of such
request within three (3) business days and shall cooperate with, and act only at the direction of Covered
Entity in responding to such request.
V. OBLIGATIONS OF COVERED ENTITY
(a) Notice of Privacy Practices. Covered Entity shall provide Business Associate with the
notice of privacy practice that Covered Entity produces in accordance with 45 CFR § 164.520, as well as
any changes to that notice.
5
October2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
(b) Notice of Changes in Individual's Access or Protected Health Information. Covered
Entity shall provide Business Associate with any changes in, or revocation of, permission by an
Individual to use or disclose Protected Health Information, is such changes affect Business Associate's
permitted or required uses.
(c) Notice of Restriction in Individual's Access to Protected Health Information. Covered
Entity shall notify Business Associate of any restrictions to the use or disclosure of Protected Health
Information that Covered Entity has agreed in accordance with 45 CFR§ 164.522 to the extent that such
restriction may affect Business Associate's use of Protected Health Information.
VI. PERMISSABLE REQUESTS BY COVERED ENTITY
Requests Permissible Under HIPAA. Covered Entity shall not request Business Associate to use
or disclose Protected Health Information in any manner that would not be permissible under the Privacy
or Security Rule.
VII. TERMINATION
(a) Term. This Agreement shall be effective as of the date first set forth above and shall
terminate upon the earlier of (i) the termination of all agreements between the parties, and (ii) the
termination by Covered Entity for cause as provided herein.
(b) Termination for Cause. Notwithstanding anything in this Agreement to the contrary,
Covered Entity shall have the right to terminate this Agreement and the Service Agreement immediately
if Covered Entity determines that Business Associate has or will violated any material term of this
Agreement. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered
Entity shall provide an opportunity for Business Associate to cure the breach or end the violation.
Covered Entity may terminate this Agreement if Business Associate does not cure the breach or end the
violation within the time period specified by Covered Entity. If termination, cure or end of the violation
is not feasible,Covered Entity may report the violation to the Secretary.
(c) Obligation of Business Associate Upon Termination. At termination of this Agreement,
the Service Agreement(or any similar documentation of the business relationship of the Parties), or upon
request of Covered Entity,whichever occurs first, Business Associate,shall:
A. if feasible, return(in a manner or process approved by the Covered Entity) or destroy
all Protected Health Information, regardless of form, including but not limited to
paper or electronic format, received from Covered Entity, or created, maintained or
received by Business Associate on behalf of Covered Entity. Business Associate
shall retain no copies of the Protected Health Information. This provision shall also
apply to Protected Health Infonnation and other confidential information in the
possession of sub-contractors or agents of Business Associate.
B. If such return or destruction is not feasible, Business Associate shall (i) retain only
that Protected Health Information necessary for Business Associate to continue its
proper management and administration or to carry out its legal responsibilities; (ii)
return or destroy the remaining Protected Health Information that the Business
Associate still maintains in any form; (iii)extend the protections of this Agreement to
the retained Protected Health Information; (iv) limit further uses and disclosures to
those purposes that make the return or destruction of the Protected Health
Information not feasible; and (v) return or destroy the retained Protected Health
Information when it is no longer needed by Business Associate.
6
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
(d) Survival. This paragraph shall survive the termination of this Agreement and shall apply
to Protected Health Information created, maintained, or received by Business Associate and any of its
subcontractors.
VIII. MISCELLANEOUS
(a) Indemnification. Business Associate agrees to indemnify, defend, and hold harmless
Covered Entity, its officers, agents, contractors and agents, against, and in respect of, any and all claims,
losses, expenses, costs, damages, obligations, penalties, and liabilities which Covered Entity may incur
by reason of Business Associate's breach of or failure to perform any its obligations pursuant to this
Agreement, including but not limited to any injury or damages arising from any noncompliance with this
Agreement or any Security Incident attributable to the negligence of Business Associate, including
failure to execute the terms of this Agreement. Further, Business Associate agrees to indemnify, defend,
and hold harmless Covered Entity, its officers, employees, contractors and agents, against all costs and
expenses, including but not limited to, reasonable legal expenses, which are incurred by or on behalf of
Business Associate in connection with the defense of such claims.
(b) Disclaimer. Covered Entity makes no warranty or representation that compliance by
Business Associate with this Agreement, HIPAA, HITECH, or the HIPAA Regulations will be adequate
or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all
decisions made by Business Associate regarding the safeguarding of Protected Health Information.
(c) Assistance in Litigation or Administrative Proceedings. Business Associate shall make
itself, and any subcontractors, employees, affiliates or agents assisting Business Associate in the
performance of its obligations under this Agreement, available to Covered Entity, at no cost to Covered
Entity, to testify as witnesses, or otherwise,in the event of litigation or administrative proceedings being
commenced against Covered Entity, its directors, officers or employees based upon a claimed violation
of HIPAA, HITECH, the HIPAA Regulations, or other laws relating to security and privacy, except
where Business Associate or its subcontractor, employee or agent is named adverse party.
(d) Survival. The obligations of Business Associate under this Agreement shall survive the
expiration, termination, or cancellation of this Agreement, the Service Agreement and/or the business
relationship of the parties, and shall continue to bind Business Associate, its agents, employees,
contractors,successors, and assigns as set forth herein.
(e) Ownership of Information. Covered Entity holds all right, title, and interest in and to the
Protected Health Information and Business Associate does not hold and will not acquire by virtue of this
Agreement or by virtue of providing goods or services to Covered Entity, any right,title, or interest in or
to the PHI or any portion thereof.
(f) Right to Injunctive Relief. Business Associate expressly acknowledges and agrees that
the breach, or threatened breach,by it of any provision of this Agreement may cause Covered Entity to be
irreparably harmed and that Covered Entity may not have an adequate remedy at law.Therefore,Business
Associate agrees that upon such breach, or threatened breach, Covered Entity will be entitled to seek
injunctive relief to prevent Business Associate from commencing or continuing any action constituting
such breach without having to post a bond or other security and without having to prove the inadequacy
of any other available remedies. Nothing in this paragraph will be deemed to limit or abridge any other
remedy available to Covered Entity at law or in equity. Except as expressly stated herein or in the HIPAA
Security and Privacy Rule, the parties to this Agreement do not intend to create any rights in any third
parties.
7
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
(g) Amendment. The Parties agree to take such action as is necessary to amend this
Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the
HIPSS Regulations. In addition, this Agreement may be amended or modified by the Parties only in
writing.
(h) Assignment. No Party may assign its respective rights and obligations under this
Agreement without the prior written consent of the other Party.
(i) Independent Contractor. None of the provisions of this Agreement are intended to create,
nor will they be deemed to create any relationship between the Parties other than that of independent
parties contracting with each other solely for the purposes of effecting the provisions of this Agreement
and any other agreements between the Parties evidencing their business relationship. This Agreement
will be governed by the laws of the State of North Carolina. No change, waiver or discharge of any
liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance
of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other
occasion.
(j) Regulatory References. A reference in this Agreement to a section in HIPAA, HITECH
or the HIPAA Regulations means the section as it currently is in effect or as amended.
(k) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning
that permits Covered Entity to comply with the HIPAA Regulations. The parties agree that, in the event
that any documentation of the arrangement pursuant to which Business Associate provides services to
Covered Entity contains provisions relating to the use or disclosure of Protected Health Information that
are more restrictive than the provisions of this Agreement, the more restrictive provisions will control.
The provisions of this Agreement are intended to establish the minimum requirements regarding Business
Associate's use and disclosure of Protected Health Information.
(1) Severability. In the event any part or parts of this Agreement are held to be
unenforceable, the remainder of this Agreement will continue in effect. In addition, in the event a party
believes in good faith that any provision of this Agreement fails to comply with the then-current
requirements of the HIPAA Security and Privacy Rule, such party shall notify the other party in writing.
For a period of up to (30)thirty days,the parties shall address in good faith such concern and amend the
terms of this Agreement, if necessary to bring it into compliance. If, after such thirty-day period, a party
believes in good faith that the Agreement fails to comply with the HIPAA Security and Privacy Rule,
then either party has the right to terminate upon written notice to the other party.
(m) Notices and Communications. All instructions, notices, consents, demands, or other
communications required or contemplated by this Agreement shall be in writing and shall be delivered to
the Party at the address below:
For Covered Entity: For Business Associate"
Orange County Health Department Starpoint Global Services
300 West Tryon Street 1 Ashley Wade Lane
Hillsborough NC, 27278 Chapel Hill,NC 27516
(919)245-2411 (919)942-2737
(n) Strict compliance. No failure by any Party to insist upon strict compliance with any
terms or provisions of this Agreement,to exercise any option,to enforce any right, or to seek any remedy
upon any default of any other Party shall affect, or constitute a waiver of, any Party's right to insist upon
such strict compliance, exercise that option, enforce that right, or seek that remedy with respect to that
default or any prior, or contemporaneous, or subsequent default. No custom or practice of the Parties at
variance with any provisions of this Agreement shall affect, or constitute a waiver of, any Party's right to
demand strict compliance with all provisions of this Agreement.
8
October2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139-48CD-8576-549C07AE1795
Exhibit C
(o) Governing Law. This Agreement shall be governed and construed in accordance with the
laws of the State of North Carolina except to the extent that North Carolina laws have been pre-empted by
HIPAA and without giving effect to principals of conflicts of law. Jurisdiction shall be Orange County,
North Carolina, for purposes of litigation resulting from disagreements of the Parties for purposes of this
Agreement and the Service Agreement(s).
(p) E-Verify. Employers and their subcontractors with 25 or more employees as defined in
Article 2 of Chapter 64 of the NC General Statutes must comply with E-Verify requirements to contract
with governmental units. E-Verify is a Federal program operated by the United States Department of
Homeland Security and other federal agencies, or any successor or equivalent program used to verify the
work authorization of newly hired employees pursuant to federal law. Where applicable, failure to
maintain compliance with the requirements of Article 2 of Chapter 64 of the North Carolina General
Statutes shall constitute breach of this Agreement. If applicable, by executing this Agreement, Business
Associate affirms that they are in compliance with Article 3 of Chapter 64 if the North Carolina General
Statutes.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the day and year written
above.
CO 9Fs 'I:ITY: BUSINES-Si 6S/OCIA I'L:
By C9ED9DOFC6E545E... By ti..,...0v3F9556A1R541-19
Title: Orange County Health Director Title: Director of Business Development
9
October 2013
DocuSign Envelope ID:3B343F2B-F3EC-4D90-A7F9-1C4402CBA567
DocuSign Envelope ID:DB0158A0-1139.48CD-8576-549C07AE1795
Exhibit C
ATTACHMENT A
COVERED ENTITY PRIVACY OFFICER CONTACT INFORMATION
To report to Covered Entity any use or disclosure of Protected Health Information not in compliance with
.the terms of this Agreement that might be considered a privacy breach, Business Associate should contact
the Privacy Officer at the applicable entity. To report to Covered Entity any Security Incident(as defined
in the Agreement), Business Associate should contact Carla Julian(919)245-2434,or the Security
Officer at The Orange County Health Department.
•
10
October2013