HomeMy WebLinkAbout2019-150 Health - UNC NCCCN participation agreement NORTH CAROLINA COMMUNITY CARE NETWORKS, INC. PARTICIPATION AGREEMENT
THIS PARTICIPATION AGREEMENT (the "Agreement") will be effective when signed by the named
Participant below(the"Effective Date")and is made and entered into by and between NORTH CAROLINA
COMMUNITY CARE NETWORKS, INC., a North Carolina nonprofit corporation ("N3CN") and the
Participant named herein below("Participant"),on behalf of itself and any Participating Entities for whom
Participant has the authority to bind to this Agreement. N3CN and Participant are individually a"Party",
and collectively,the"Parties".
Orange County
Legal Name of Participant
Orange County Health Department, 300 West T on Street, Hillsborough, NC 27278
Address of Participant
RECITALS
A. N3CN provides a Data Platform to facilitate the access, use, maintenance, storage, and transfer of
Protected Health Information ("PHI") and other Data relating to Participant's involvement in Care
Management and Provider Services administered by N3CN.
B. The Data originates from multiple sources such as the State, Participant, N3CN,and third parties.
C. The form of this Agreement has been presented to and accepted by the State and is intended to be
executed without material changes to its terms.
D. The Parties wish to enter into this Agreement to set forth the permissions and obligations of the
Parties related to access,use,maintenance,storage,and transfer of Data through the Data Platform.
NOW,THEREFORE,for good and valuable consideration,the receipt and sufficiency of which is admitted
and acknowledged by the Parties,and wishing to be legally bound,the Parties agree as follows:
1. Supersedure. This Agreement shall be deemed to and hereby does supersede and replace any prior
or contemporaneous oral or written agreements and understandings between the Parties related to
access, use, maintenance, storage, or transfer of Data between the Parties. Without limiting the
foregoing,this Agreement specifically supersedes:
a. The North Carolina Community Care Networks, Inc. Participation Agreement
b. The Community Care of North Carolina,Inc. Participation Agreement
c. The Contract to Participate in the Statewide Enhanced Primary Care Case Management Program;
d. The Technology Enabled Care Coordination Agreement
e. Any other prior agreements between the Parties controlling access to and protection of State-
owned data.
Page 1 of 21
2. Incorporation of Recitals. The Recitals to this Agreement are hereby incorporated into and made part
of this Agreement.
3. Rules of Construction.
a. The words "include" and "including," and all variations, will be deemed to be followed by the
words"without limitation"and not deemed terms of limitation.
b. The word"and"includes the meaning of an alternative as well as the meaning of addition.
c. The word"or" includes the meaning of addition as well as the meaning of an alternative.
d. The word"any" includes the meaning of a singular item and the meaning of all items.
e. Sections and headings are for convenience of reference only and will not affect the construction
or interpretation of this Agreement.
f. The Parties waive any common law or statutory rule of construction which favors the non-writing
Party, and the Parties agree that this Agreement, including all terms,conditions, and provisions,
must be construed without regard to which Party wrote that term,condition,or provision.
g. References to Participant will be deemed to include reference to Participant's Authorized Users
unless the context requires otherwise.
4. Definitions. All capitalized terms will have the meaning defined herein below; any capitalized term
not defined herein or elsewhere in this Agreement shall have the meaning defined in the HIPAA
Regulations or, if not defined in the HIPAA Regulations, the term shall have the meaning ascribed to
it by other Applicable Law.
a. Affiliate. "Affiliate"means any entity that owns,is owned by,or shares common ownership with,
a Party.
b. Applicable Law. "Applicable Law" means all state and federal statutes and regulations governing
the activities of N3CN and Participant in connection with their participation in programs
administered by N3CN and governing the access, use,transmission,storage,and maintenance of
PHI and other Personally Identifiable Information.
c. Authorized User. "Authorized User" means Participant's employees, workforce members, and
contractors who have been authorized by N3CN, or by Participant's Site Administrator under
N3CN's then-current data use policy,to use the Data Platform for a Permitted Purpose and who
have been assigned a user name and password to access the Data Platform. Authorized Users
may only be Natural Persons.
d. Business Associate. "Business Associate" has the meaning ascribed to this term in 45 CFR
§160.103.
e. Business Associate Agreement("BAA"). "BAA" means the Business associate contract or other
arrangement between the Covered Entity and the Business Associate that establishes the
Permitted Purposes for PHI and requires the Business Associate to comply with the privacy and
security provisions of HIPAA related to PHI.
Page 2 of 21
f. Care Management. "Care Management" refers to a broad array of healthcare-related activities
including care coordination, care planning, case management, quality improvement, quality
assessment,and population-based activities performed by a care manager or related position on
behalf of Participants and Enrollees to promote better health outcomes at a reduced cost.
g. Confidential Information. "Confidential Information"means any and all information of strategic
or commercial value relating to a Party's or any Affiliate's business or operations that a Party
discloses to the other Party and that is either (i) designated in writing as confidential or
proprietary at the time of disclosure or in a reasonable period after disclosure, or (ii) should
reasonably be regarded as confidential or proprietary given the nature and circumstances of its
disclosure. All proprietary information is Confidential Information. All business information that
derives value in not being generally known to the public, or which has the potential to cause
reputational damage to a Party, is Confidential Information. This Agreement is Confidential
Information.
h. Confidentiality Agreement. "Confidentiality Agreement" means an agreement between
Participant and its Authorized Users that establishes Permitted Uses and all restrictions and
obligations related to the access, use, maintenance, storage, and transfer of the Data and the
Confidential Information made available pursuant to this Agreement.
L Covered Entity. "Covered Entity"has the meaning ascribed to this term in 45 CFR§160.103.
j. Data. The "Data" means all PHI, IIHI,and P I I accessed, used, maintained,stored, or transferred
through the Data Platform or otherwise pursuant to this Agreement and the 2019 Primary Care
Case Management Agreement Between The North Carolina Department of Health and Human
Services Department of Health Benefits and North Carolina Community Care Networks, Inc. and
any successor agreement between the State and N3CN authorizing use of State-owned data.
k. Data Breach. "Data Breach" means an impermissible access, use, or disclosure of the Data that
does or is likely to compromise the security or privacy of the Data. To be deemed likely to
comprise the privacy or security of the Data,the unauthorized access,use,or disclosure must be
determined to meet the following criteria: (i) The Data is clearly or likely to be identifiable to
specific individuals; (ii) The person accessing, using, or disclosing the Data is acting In an
unauthorized manneror outside the control of either Partyand is likely to use the Data otherthan
for a Permitted Purpose; (iii) The Data was actually acquired or viewed; and (iv) the risk of an
unpermitted use or disclosure causing harm to either Party or to the specific individual identified
has not been or cannot be mitigated.
1. Data Platform. "Data Platform"means collectively the software,hardware,applications,systems,
and other code and devices controlled, leased,or used by N3CN or any Affiliate to facilitate the
acquisition, use, maintenance, storage, and transfer of Data between the Parties. The Data
Platform also includes any backup systems and Data created and maintained to enable N3CN and
Participant to recoverfrom any event resulting in a loss of access tothe Data Platform orthe Data.
m. Enrollee. "Enrollee" means a person identified by the State as eligible for Medicaid or Health
Choice services.
n. Health Plan. "Health Plan"has the meaning ascribed to this term in 45 C.F.R.§160.103.
Page 3 of 21
o. HIPAA Regulations. "HIPAA Regulations" mean the standards for privacy of Individually
Identifiable Health Information and the security standards for the protection of Electronic
Protected Health Information as promulgated under 45 C.F.R. Parts 160 and 164 by the U.S.
Department of Health and Human Services under the Health Insurance Portability and
Accountability Act ("HIPAA") of 1996 and the Health Information Technology for Economic and
Clinical Health Act(the"HITECH Act")of the American Recovery and Reinvestment Act of 2009,in
effect on the Effective Date of this Agreement and as may be amended,modified,or renumbered
hereafter.
p. individual. "Individual"has the meaning ascribed to this term in 45 C.F.R.§160.103 and includes
a personal representative in accordance with 45 C.F.R.§164.502(g).
q. Individually Identifiable Health Information["IIHI")."II1-11"means information that is a subset of
health information, including demographic information collected from an individual, and,
employer,or health care clearinghouse;and(2)Relates to the past,present,or future physical or
mental health or condition of an individual;the provision of health care to an individual;or the
past, present, or future payment for the provision of health care to an individual; and (1) That
identifies the individual; or ill With respect to which there is a reasonable basis to believe the
information can be used to identify the individual.
r. Minimum Necessary Standard. "Minimum Necessary Standard"has the meaning ascribed to that
term in 45 C.F.R. § 164.502, and this standard must be used in all situations described in that
section as situations to which the standard applies.
s. Natural Person. "Natural Person" means only living people.
t. Participating Entity. "Participating Entity"means any person or entity owned or controlled by or
under the supervision of Participant that will by means of the signature authority of Participant
access or use Data covered under this Agreement.
u. PCCM Network. "PCCM Network"refers to any of the entities defined as a PCCM Network under
the State Plan of North Carolina or approved as a PCCM Network by the State.
v. Permitted Purpose. "Permitted Purpose" includes the following activities, provided those
activities are performed in compliance with all Applicable Laws:
L Treatment.Treatment means the provision,coordination, or management of health care and
related services by one or more healthcare providers.
ii. Hearth Core Operations.Health Care Operations includes quality assessment and improvement
activities, Including outcomes evaluation and development of clinical guidelines; population-
based activities relatingto improving health,reducing health care costs,protocol development,
case management and care coordination.
iii. Payment.Payment means activities undertaken by:(1)a Health Plan to obtain premiums or to
determine or fulfill its responsibility for coverage and provision of benefits under the health
plan; or (2) a health care provider or Health Plan to obtain or provide reimbursement for
providing health care, Payment activities include (1) determinations of eligibility or coverage
(including coordination of benefits or the determination of cost sharing amounts), and
adjudication or subrogation of health benefit claims; (2) risk adjusting amounts due based on
Enrollee health status and demographic characteristics; (3) billing, claims management,
Page 4 of 21
collection activities, obtaining payment under a contract for reinsurance (including stop-loss
insurance and excess of loss insurance),and related health care data processing; (4) review of
health care services with respect to medical necessity, coverage under a health plan,
appropriateness of care, or justification of charges; (5) utilization review activities, including
precertification and preauthor€nation of services, concurrent and retrospective review of
services;and(6)disclosure to consumer reporting agencies of information relating to collection
of premiums or reimbursement.
iv. Public Health. Public Health means the activities described in 45 C.F.R.§164.512(b).
v. Research. Research means a systematic investigation, including development, testing, and
evaluation, designed to contribute to generalizable knowledge.
vi. Administration. Administration means carrying out N3CN's proper management and oversight
of its Data Platform and its responsibilities under the 2019 PRIMARY CARE CASE MANAGEMENT
SERVICES CONTRACT#37751 BETWEEN THE NORTH CAROLINA DEPARTMENT OF HEALTH AND
HUMAN SERVICES DIVISION OF HEALTH BENEFITS AND NORTH CAROLINA COMMUNITY CARE
NETWORKS, INC. or any successor agreement for accessing and using State-owned data, this
Agreement, and Applicable Law, Applicable Law, this Agreement, and any other agreement
between N3CN and any third party for accessing and using Data through the Data Platform.
Without limiting the generality of the foregoing,Administration also includes performing record
maintenance, conducting or assisting in audits permitted or required,evaluating performance
of the Data Platform,conducting technical system support on the Data Platform and the Data,
carrying out N3CN's and Participant's functions and obligations under this Agreement(including
any necessary data extractions from Participant's systems and applications),and all applicable
BAAs, other agreements, and policy and procedure documents, and all other activities
authorized by the N3CN Board of Directors consistent with Applicable Law.
w. Person. "Person" means both a Natural Person and any entity managed by Natural Persons,
except where Person is part of the term"Natural Person".
x. Personally Identifiable Information ("PIl"). "PII" means a Natural Person's first name or initial
followed by their last name in combination with identifying information as defined in North
Carolina General Statute§14-113.20(b),other than email addresses and related internet account
information.
V. Protected Health information ("PHI"). "PHI" means individually identifiable heath information
that is:(i)Transmitted by electronic media;(€€)Maintained in electronic media;or(iii)Transmitted
or maintained in any other form or medium.
z. Provider Services. "Provider Services" refer to activities that support healthcare providers
participating in the PCCM Program,including Practice Support,Behavioral Health Integration,and
Pharmacy Support.
aa. Representative. "Representative" includes any employee, contractor, agent, officer, or
consultant of a Party,including any Affiliate.
bb. Required by Law. "Required by Law"has the meaning ascribed to this term in 45 C.F.R.§164.103,
cc. State. "State" refers to the State of North Carolina, including all administrative agencies involved
in the management of Medicaid and Health Choice data,populations,and programs.
Page 5 of 21
cid. State-owned data. ".State-owned data" means Medicaid and Health Choice Claims Data and
Medicaid and Health Choice enrollment data,provided by the State to either Party,and for which
the State of North Carolina is the Covered Entity for HIPAA purposes.
ee. Subcontractor. "Subcontractor", when capitalized, means those entities including PCCM
Networks to which N3CN contractually delegates any of its care management or provider support
responsibilities which are contractual responsibilities of N3CN under contracts with the State or
any other payor of healthcare or care management services.
5. Intent of the Parties. It is the express intent of the Parties that this Agreement be executed to ensure
that Data accessed, used, stored, maintained, or transferred through the Data Platform as part of
participation in Care Management and Provider Services are protected from unauthorized use or
disclosure and are used and disclosed consistent with Permitted Purposes, N3CN and State policies
and procedures,and Applicable Law.
6. License to the Data. During the Term of this Agreement,and subject to the terms and obligations of
this Agreement and all applicable policies and procedures,for each type of Data owned or controlled
by a Party,that Party grants to the other Party and its Authorized Users a limited,non-exclusive, non-
transferable, non-commercial license to access, use, maintain,store, and transfer Data through the
Data Platform for the Permitted Purposes subject to all obligations and restrictions contained in this
Agreement. Each Party's license granted hereunder ends immediately upon the termination or
expiration of this Agreement. The ending of a Party's license hereunder does not terminate a Party's
obligations to keep and to make available any Data required to be kept or made available to meet any
obligation Required by Law or required by the 2019 PRIMARY CARE CASE MANAGEMENT SERVICES
CONTRACT # 37761 BETWEEN THE NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN
SERVICES DIVISION OF HEALTH BENEFITS AND NORTH CAROLINA COMMUNITY CARE NETWORKS,INC.
or any successor agreement between N3CN and the State related to the access and use of State-
owned data.
7. License to the Data Platform. During the Term of this Agreement, and subject to the terms and
obligations of this Agreement and all applicable policies and procedures, N3CN grants to Participant
and to Participant's Authorized Users a limited, non-exclusive, non-transferable, non-commercial
license to access and use the Data Platform solely to enable Participant to fulfill its obligations under
this Agreement and the 2019 PRIMARY CARE CASE MANAGEMENT SERVICES CONTRACT# 37761
BETWEEN THE NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES DIVISION OF
HEALTH BENEFITS AND NORTH CAROLINA COMMUNITY CARE NETWORKS, INC. or any successor
agreement between N3CN and the State related to the access and use of State-owned data.
Participant and Participant's Authorized Users must at all times comply with all applicable N3CN and
State policies regarding access to and use of State-owned data and any component of the Data
Platform. When Participant's license to the Data Platform ends for any reason,Participant and all its
Authorized Users must immediately cease all access to and use of the Data Platform and any Data.
8. Participants. This Agreement will be used by all entities participating in Care Management and
Provider Services administered by N3CN. Types of Participants include:
a. Behavioral Health Providers(non-LMEJMCO)
b. County or other Government Agency
Page 6 of 21
c. Division of State-owned Hospital Facilities("DSOHF")
d. HIV Case Management Providers
e. Hospital and Hospital Systems
f. Local Management Entity/Managed Care Organization ("LME/MCO")
g. Primary Care Provider("PCP"), Group Practices
h. Subcontractor
If Participant does not clearly fit into one of the categories a-g, Participant will be deemed to be in
category h regardless of any similarities or dissimilarities Participant has to other categorizations.
9. General Obligations Applicable to Participant. Participant is responsible for its Participating Entities
and Authorized Users, including any breach of this Agreement by its Participating Entities or
Authorized Users or by anyone using participant's facilities or any equipment or software owned,
leased,or controlled by Participant to access or use the Data Platform or the Data, including for any
purpose other than a Permitted Purpose. In recognition of these obligations,Participant agrees to:
a. Follow all Applicable Law.
b. Work with designated care managers and other N3CN and Subcontractor staff under the PCCM
Program to enhance continuity of care for Enrollees and to help promote self-management of
physical and behavioral health conditions for Enrollees.
c. Ensure its Authorized Users have all necessary equipment, software, and other resources to
access and use the Data Platform and the Data in accordance with the technical and operational
specifications provided by N3CN.
d. Ensure Participant's Representatives, Participating Entities, and Authorized Users access and use
the Data Platform and access,use,store,maintain,and transfer Data only for Permitted Purposes
and consistent with all Applicable Law.
e. Maintain and provide to N3CN as requested an ongoing list of all Participating Entities and
Authorized Users of Participant.
f. Monitor all access and use of the Data Platform and all access, use, storage, maintenance, and
transfer of Data occurring at any location owned, leased, or controlled by Participant or any
Authorized User of Participant,or occurring through equipment under the ownership or control
of Participant or any Authorized User of Participant.
g. Implement and maintain reasonable administrative,technical,and physical safeguards to protect
the confidentiality,integrity,and availability of the Data Platform and the Data.
i. Administrative safeguards must include written policies and procedures for managing access,
use, storage, maintenance, transfer, and disclosure of Data and access and use of the Data
Platform and must include sanctions for any violations of those policies and procedures.
ii. `technical safeguards must include appropriate security lockouts,password management, data
encryption, and related mechanisms to ensure the privacy and security of the Data Platform
and the Data.
iii. Physical safeguards must include restricted access to places where the Data Platform may be
accessed or used, and where the Data may be accessed, used, stored, maintained, or
transferred.
Page 7 of 21
h. Ensure Authorized Users have appropriate role-based access to the Data Platform and the Data
that complies with the Minimum Necessary Standard under HIPAA.
i. Implement and maintain written policies and procedures that address: (1) identification and
authorization of Authorized Users;(2)audit controls and periodic reviews to ensure all access and
use occurs by Authorized Users for Permitted Purposes only;(3) notification to Authorized Users
of any changes in the Data Platform,the Data, or the policies and processes through which they
are accessed or used; (4) notification to N3CN of any violation of this Agreement, including any
unauthorized access to or use of the Data Platform or any unauthorized access, use, storage,
maintenance,ortransfer of the Data;and(5) protection against malware and other mechanisms,
both tangible and intangible,designed to disrupt,destroy,damage,or delay the operation of the
Data Platform or the Data.
j. Follow all N3CN and State-issued policies and procedures related to accessing, using, storing,
maintaining, transferring, monitoring, and auditing State-owned data and Data within the Data
Platform. This obligation includes communicating to N3CN and working with N3CN to resolve any
suspected violations of those policies and procedures including any suspected breaches of PHI,
IIHI,or P1I.
k. Report to N3CN monthly or as requested the results of all periodic audits and reviews to ensure
all access to and use of the Data Platform and the Data are by Authorized Users for Permitted
Purposes according to Applicable taw. Participant must perform audits and reviews at least
monthly.
I. Cooperate fully with N3CN, the State, and any regulatory or credentialing authority in any
investigation or audit by making available all personnel, and all books, records, and related
information created or maintained in connection with Participant's access and use of the Data
Platform or access,use,storage,maintenance,or transfer of Data.
m. Notify N3CN as soon as practical after first becoming aware of a Data Breach. In the case of a
breach involving social security numbers, Participant must notify N3CN within sixty minutes of
becoming aware of the breach. This timeline is a State requirement for all entities accessing and
using State-owned data. For confirmed breaches of PHI, notification must be made to N3CN
within twenty-four hours. This timeline also is a State requirement for entities accessing and using
State-owned data. The notification will include,to the extent available:
i. A brief description of what happened, including the date of the Data Breach and the date
of discovery of the Data Breach;
ii. The identification of each Individual whose Data has been,or is reasonably believed to have
been,accessed,acquired,used,or Disclosed;
ill. A description of the roles of the people involved in the Data Breach (e.g., employees,
Authorized Users,service providers,unauthorized persons,etc.);
iv. A description of the types of Data involved in the Data Breach (whether full name, Social
Security number, date of birth, home address,account number, diagnosis, disability code,
or other types of Identifiable information);
v. The number of Individuals or records impacted/estimated to be impacted by the Data
Breach;
Page 8 of 21
vi. A description of actions taken to investigate the Data Breach, to mitigate harm to
Individuals,and to protect against any further Data Breaches;
vii. The current status of the Data Breach (under investigation or resolved);
viii. Contact procedures for Individuals to ask questions or learn additional information,which
shall include a toll-free telephone number,an e-mail address,Web site,or postal address;
and
ix. Corrective actions taken and planned to prevent a similar Data Breach.
n. Ensure that any subcontractors, agents, or other third parties used by Participant or by any
Authorized User execute all necessary documents binding those subcontractors,agents,or other
third parties to protect the privacy and security of the Data Platform and the Data consistent with
the obligations of this Agreement and all Applicable Law.
10. N3CN Data Obligations. N3CN agrees to:
a. Follow all Applicable Law.
b. Ensure N3CN's workforce members, including any contractors,access and use the Data Platform
and access, use, store, maintain, and transfer Participant Data only for Permitted Purposes and
consistent with all Applicable Law.
c. Monitor all access and use of the Data Platform and all access, use, storage, maintenance, and
transfer of the Data occurring at a location owned, leased, or controlled by N3CN, or occurring
through equipment under the ownership or control of N3CN,to ensure all access and use is only
for Permitted Purposes and consistent with all Applicable Law.
d. Implement and maintain reasonable administrative,technical,and physical safeguards to protect
the confidentiality, integrity,and availability of the Data Platform and the Data.
L Administrative safeguards must include written policies and procedures for managing access,
use, storage, maintenance, transfer, and disclosure of Data and access and use of the Data
Platform and must include sanctions for any violations of those policies and procedures.
ii. Technical safeguards must include appropriate security lockouts,password management, data
encryption, and related mechanisms to ensure the privacy and security of the Data Platform
and the Data.
iii. Physical safeguards must include restricted access to places where the Data Platform and the
Data may be accessed,used,or disclosed.
e. Ensure N3CN workforce members have appropriate role-based access to the Data Platform and
the Data that complies with the Minimum Necessary Standard under HIPAA.
f. Implement and maintain written policies and procedures that address: (1) proper access to and
use of the Data Platform and the Data;(2)audit controls and periodic reviews to ensure access to
and use of the Data Platform and the Data is for Permitted Purposes only; (3) notification to
Participant of any changes in the Data Platform,the Data, or the policies and processes through
which they are accessed or used; (4) notification to Participant of any unauthorized access to or
use of Participant Data by N3CN's Authorized Users of which N3CN becomes aware(unless N3CN
is required not to make such notification as part on an ongoing criminal investigation);and (5)
protection against malware and other mechanisms, both tangible and intangible, designed to
disrupt,destroy,damage,or delay the operation of the Data Platform or the Data.
Page 9 of 21
g. Notify Participant as soon as practical after first becoming aware of a Data Breach affecting Data
provided by Participant. For disclosures of social security numbers or confirmed breaches of
Participant data,this notice will occur promptly after reporting the Data Breach to the State unless
the State or an investigatory agency requests notification be delayed so as not to hinder any law
enforcement activities or investigations. The notification will include,to the extent available:
i. A brief description of what happened, including the date of the Data Breach and the date
of discovery of the Data Breach;
ii. The identification of each Individual whose Data has been,or is reasonably believed to have
been,accessed,acquired,used,or Disclosed;
iii. A description of the roles of the people involved in the Data Breach (e.g., employees,
Authorized Users,service providers,unauthorized persons,etc.);
iv. A description of the types of Data involved in the Data Breach (whether full name,Social
Security number,date of birth, home address,account number,diagnosis,disability code,
or other types of identifiable information);
v. The number of Individuals or records impacted estimated to be impacted by the Data
Breach;
vi. A description of actions takers to investigate the Data Breach, to mitigate harm to
Individuals,and to protect against any further Data Breaches;
vii. The current status of the Data Breach(under investigation or resolved);
viii, Contact procedures for Individuals to ask questions or learn additional information,which
shall include a toll-free telephone number,an e-mail address,Web site,or postal address;
and
ix. Corrective actions taken and planned to prevent a similar Data Breach.
h. Ensure that any subcontractors,agents,or other third parties used by N3CN execute all necessary
documents binding those subcontractors,agents,or other third parties to protect the privacy and
security of the Data Platform and the Data consistent with the obligations of this Agreement and
all Applicable Law.
11. Obligations Based on Category of Participant. This Agreement must include the applicable exhibit(s),
as listed below and incorporated herein by reference, to describe additional obligations specific to
Participant's type of entity, If Participant is a type that does not have additional obligations based on
its type,Participant will not have an attached exhibit. If Participant may perform obligations as more
than one type of entity,more than one exhibit will be attached,and all those obligations will apply to
Participant.
a. Division of State owned Hospitals and Facilities. Additional DSDHF obligations will be those
described in Exhibit:DSQHF.
b. County or other Government Agency. Additional County obligations will be those described in
Exhibit:Governmental Entity.
c. Subcontractor. Additional Subcontractor obligations will be those described in Exhibit:
Subcontractor.
Page 10 of 21
d. Hospital,Hospital Groups,Primary Care Practices,Primary Care Practice Groups.These additional
obligations will be described in Exhibit: Hospital / Hospital Groups 1 Primary Care Practices
Primary Care Practice Groups.
12. Mutual Business Associate Obligations. Each Party individually stands as a Business Associate to the
other Party regarding PHI provided by that other Party,whether the providing Party is itself a Covered
Entity or a Business Associate for that PHI. Therefore,each Party individually agrees to the following
Business Associate Agreement provisions for any PHI it accesses or uses for which it is not the owner
or the primary custodian. Each Party,in its role as a Business Associate,agrees to:
a. Use PHI in its possession only as permitted or required by this Agreement or as otherwise
Required by Law.
b. Disclose PHI in its possession to third parties only if(1)the disclosures are Required By Law,or(ii)
the Business Associate has received from the third party written assurances regarding its
confidential handling of such PHI as required under 45 CFR §164.504(e)(4), and the third party
agrees in writing to notify Business Associate of any instances of which it becomes aware that the
confidentiality of the information has been breached.
c. Comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health information
(ePHI),to prevent use or disclosure of PHI other than as provided for by this Agreement.
d. Acknowledge its continuing obligations under HIPAA and agree to comply with any subsequent
regulations promulgated under HIPAA and any guidance thereto.
e. Acknowledge that (1) the foregoing requirements shall apply to Business Associate in the same
manner that such requirements apply to a Covered Entity, and (ii) Business Associate shall be
subject to the civil and criminal enforcement provisions set forth at 42 USC 1320d-5 and 1320d-
6, as amended from time to time,for failure to comply with the requirements and any applicable
guidance subsequently issued by the Secretary of the Department of Health and Human Services
("Secretary")with respect to such requirements.
f. Disclose to its subcontractors, agents,or other third parties only the minimum PHI necessary to
perform or fulfill the Permitted Uses.
g. Transmit any ePHI it creates, receives, or maintains in a manner that the ePHI is rendered
unusable,unreadable,or indecipherable to unauthorized persons through the use of technology
or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of
Public Law 111-5.
h. Establish procedures for mitigating any deleterious effects from any improper use or disclosure
of PHI from Business Associate or any subcontractor or agent thereof,
I. Make available all records, books, agreements, policies, and procedures relating to the use or
disclosure of PHI to the Secretary for purposes of investigating or determining compliance with
HIPAA.
j. Upon prior written request, make available to the other Party during normal business hours at
Business Associate's offices all records, books, agreements, policies, and procedures relating to
Page 11 of 21
the use and disclosure of PHI to determine Business Associate's compliance with the terms of this
Agreement.
k. Document all disclosures of PHI that require an accounting of disclosures as required under 45
CFR §164.528. Business Associate further agrees,within thirty (30) days of receiving a written
request from the other Party, to provide to that Party such information as is requested and
reasonably available to permit that Party to respond to a request by an individual for an
accounting of the disclosures of the individual's PHI in accordance with 45 CFR§164.528.
I. Notify the other Party within ten (10)business days of Business Associate's discovery of:
i. any use or disclosure of PHI not provided for by this Agreement;
ii. any breach of unsecured PHI as defined at 4S CFR§164.402;and
iii. any Security Incident of which it becomes aware. Pings and related broadcast actions not
resulting in any known or suspected security interference shall not be reported except as
aggregate statistics of such events as requested by the other Party.
Notification under this section shall include, as reasonably available, the identification of each
individual whose PHI has been, or is suspected to have been, accessed, acquired, or disclosed.
Business Associate further agrees to make available in a reasonable time and manner any other
available information needed by the other Party to respond to individual and governmental inquiries
regarding any of the notifications received from Business Associate. The Party responsible for any
Data Breach,through its actions or omissions or through those of its agents,shall be responsible for
notifying the persons affected and any administrative bodies in accordance with Applicable Law. The
Parties agree to coordinate any public announcement required under Applicable Law.
m. Comply with all the restrictions on access,use,disclosure,storage,and transmission of PHI found
in the 2019 PRIMARY CARE CASE MANAGEMENT SERVICES CONTRACT#37761 BETWEEN THE
NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES DIVISION OF HEALTH
BENEFITS AND NORTH CAROLINA COMMUNITY CARE NETWORKS, INC. and any successor
agreement between N3CN and the State for accessing and using State-owned data.
13. Mutual Covered Entity Obligations. To the extent either Party is a Covered Entity regarding any Data
it provides,accesses,or uses through the Data Platform,that Party agrees to:
a. inform the Business Associate of any changes in the notice of privacy practices that the Covered
Entity provides to individuals pursuant to 45 CFR§164.520 that affect Business Associate's use or
disclosure of PHI, and provide to the Business Associate, upon request, a copy of the notice of
privacy practices currently in use.
b. inform the Business Associate of any changes in, or revocation of, the authorization provided
pursuant to 45 CFR§164.508,to the extent relevant to any obligations underthis Agreement.
c. inform the Business Associate, in writing and in a timely manner, of any arrangements required
of Covered Entity under 45 CFR §part 160 and 164 that may affect the use or disclosure of PHI
required by the Business Associate under this Agreement,including restrictions regarding the use
or disclosure of PHI as provided for in 45 CFR§164.522.
d. make any amendments to PHI that Covered Entity agrees to pursuant to 45 CFR§164.526.
Page 12 of 21
e. document disclosures of PHI and information related to such disclosures as would be required for
Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in
accordance with 45 CFR§164.528,
14. Participant Obligations when neither a Covered Entity nor a Business Associate. Any Participant
who does not fit the description of a Covered Entity or a Business Associate, by executing this
Agreement agrees to be bound to all the obligations for safeguarding the privacy and security of the
Data Platform and the Data as if Participant were a Business Associate,for al!Data accessed or used
by Participant.
15. Ownership of Data. Access to or use of Data under this Agreement does not change the ownership
of Data accessed or used. Notwithstanding the foregoing, Data provided through the Data Platform
may become integrated into patient records and may no longer be separable from the Data of the
receiving entity. The Parties acknowledge it is impractical to require deletion of Data that has been
integrated into other systems and applications, but that Data shall remain under all the privacy and
security and Permitted Use restrictions set forth in this Agreement.
16. Confidential Information. Confidential Information disclosed to a Party must be kept confidential
until it has been disclosed publicly by someone authorized by the owner of the Confidential
Information. Confidential Information must only be retained while needed to perform under this
Agreement.When the need to perform ends for any reason,that Confidential Information disclosed,
including all copies, must be returned to the disclosing Parry or destroyed with a certificate of
destruction attested by the person responsible for its destruction. Records that cannot be destroyed
or returned must be kept confidential until those records have lost their confidential nature through
no fault of the Party receiving the Confidential Information. A record of this Agreement may be
retained securely as a record of the Party's obligations. Confidential Information must only be used
for the specific purpose for which it was disclosed, A Party receiving Confidential Information must
take all reasonable measures to prevent unauthorized disclosure.At a minimum, a Party must treat
Confidential Information with as much security as it treats its own confidential information,and never
with less than reasonable care.
17. Term and Termination.
a. Term. This Agreement commences on its Effective[late and continues through the thirty-first day
of December of the year in which it was signed by Participant(the"Initial Term"). Thereafter,this
Agreement renews automatically for consecutive one(1)year Terms(the"Renewal Terms")until
terminated by one of the Parties as provided herein below. The Initial Term and all Renewal Terms
are collectively the"Term"of this Agreement.
b. Automatic Termination. if Participant is participating only in the State program covered by the
2019 PRIMARY CARE CASE MANA GEMENT SERVICES CONTRACT#37761 BETWEEN THE NORTH
CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES DIVISION OF HEALTH BENEFITS AND
NORTH CAROLINA COMMUNITY CARE NETWORKS, INC., then this Agreement will terminate
immediately upon the termination of that contract, except that this Agreement will continue in
force under any successor agreement between N3CN or its Affiliate and the State for accessing
and using State-owned data. Additionally, if any Applicable Law is changed making Participant's
Page 13 of 21
access or use of the Data Platform orthe Data unlawfvi,or Participant becomes ineligible to access
or use the Data Platform orthe Data,then this Agreement will end immediately capon that change.
c. Termination by Participant. Participant may terminate this Agreement for any or no reason sixty
(60) days after providing written notice to N3CN of Participant's intent to terminate, provided
Participant also terminates participation in and ceases all activities related to any programs
covered by this Agreement. Termination of this Agreement will cause N3CN to de-authorize
Participant and all Participant's Authorized Users from accessing the Data Platform and the Data.
d. Termination by N3CN. N3CN may terminate this Agreement for any or no reason thirty(30)days
after providing written notice to Participant of N3CN's intent to terminate. Termination of this
Agreement will cause N3CN to de-authorize Participant and all Participant's Authorized Users
from accessing the Data Platform and the Data. N3CN may terminate this Agreement immediately
if it determines Participant has caused or allowed a Data Breach which would require notification
to affected Individuals and the State.
e. Survival of Data Obligations. In addition to any other survival terms in this Agreement,the Parties
expressly acknowledge that termination of this Agreement will not and shall not be deemed to
relieve any Party or its Authorized Users from maintaining the privacy and security of any Data
accessed or used by or incorporated into that Party's systems and applications,and State-owned
data may not be used for any purpose other than performing under this Agreement and may not
be disclosed to any third party for any reason without the prior written permission of N3CN and
the State.
18. Disclaimers.
a. Clinical Decision Support and Information. The Data Platform and the Data may contain
information, protocols, and input relating to clinical decision-making. The Parties mutually
understand and agree that any such information,protocols,and input available through the Data
Platform do not, and shall not be construed to act as, a substitute for a healthcare provider's
professional judgment. THE PARTIES EXPRESSLY DISCLAIM ANY WARRANTY OF ACCURACY OR
COMPLETENESS OF ANY DATA OR INFORMATION INPUT INTO THE DATA PLATFORM BY ANY
PARTY,AUTHORIZED USER, OR ANY THIRD PARTY. PARTICIPANT AND EACH AUTHORIZED USER
ASSUME ALL RISK AND RESPONSIBILITY FOR ITS USE OF SUCH DATA,INFORMATION, PROTOCOLS,
AND INPUT OBTAINED FROM OR THROUGH THE DATA PLATFORM. N3CN DOES NOT
RECOMMEND OR ENDORSE ANY PROVIDER OF HEALTHCARE OR HEALTHCARE RELATED
PRODUCTS, ITEMS,OR SERVICES, AND NOTHING IN THIS AGREEMENT SHALL BE CONSTRUED TO
IMPLYANYSUCH ENDORSEMENT.
b. External Networks, Devices, Carrier Lines, and Exchanges. Connections to external data
repositories and information technology systems("Networks")may be made available through or
in conjunction with the Data Platform to facilitate the storage and transmission of Data. External
monitoring and alert devices("Peripherals")may also be made available through or in conjunction
with the Data Platform to facilitate telehealth services. Participant hereby agrees and
acknowledges that N3CN may access such Networks and Peripherals to facilitate various features
in the Data Platform and that PHI may be stored and transmitted using such Networks and
Peripherals. N3CN MAKES NO REPRESENTATION OR WARRANTY REGARDING THE AVAILABILITY
Page 14 of 21
OF ANY PARTICULAR NETWORKS OR CARRIER LINES OR PERIPHERALS OR ANY PARTICULAR DATA
SOURCE OR NETWORK PARTICIPANT OR DEVICE MANUFACTURER.PARTICIPANT ACKNOWLEDGES
THAT ACCESS TO THE SYSTEM WILL BE PROVIDED OVER VARIOUS FACILITIES AND
COMMUNICATION LINES, AND INFORMATION WILL BE STORED ON REMOTE SERVERS,
REPOSITORIES,AND STORAGE MEDIA AND TRANSMITTED OVER LOCAL EXCHANGE AND INTERNET
BACKBONE CARRIER LINES AND MOBILE NETWORKS AND THROUGH ROUTERS, SWITCHES,AND
OTHER DEVICES OWNED, MAINTAINED, AND SERVICED BY THIRD-PARTY CARRIERS, UTILITIES,
AND SERVICE PROVIDERS,ALL OF WHICH ARE BEYOND N3CN'S CONTROL.ATANYTIME,SERVERS,
REPOSITORIES, PERIPHERALS, DATA SOURCES, AND OTHER NETWORK PARTICIPANTS MAY BE
ADDED OR DELETED WITHOUT PRIOR NOTICE. PARTICIPANT ACKNOWLEDGES AND AGREES THAT
AT ANY TIME AND WITHOUT PRIOR NOTICE, A DATA SOURCE MAY ELECT NOT TO SEND OR
RECEIVE DATA OR MESSAGES AND A PERIPHERAL MAY NO LONGER BE AVAILABLE IN
CONJUNCTION WITH THE DATA PLATFORM. IN ADDITION, N3CN HEREBY DISCLAIMS ANY
LIABILITY FOR OR RELATING TO:(I)THE INTEGRITY,PRIVACY,SECURITY,CONFIDENTIALITY,OR USE
OF ANY INFORMATION OR DATA WHILE IT ISTRANSMrrrED VIA CARRIER LINES;OR(II)ANY DELAY,
FAILURE, INTERRUPTION, INTERCEPTION, LOSS,TRANSMISSION,OR CORRUPTION OF ANY DATA
OR INFORMATION ATTRIBUTABLE TO TRANSMISSION ON THE CARRIER LINES, USE OF THE
CARRIER LINES IS SOLELY AT THE RISK OF PARTICIPANT AND ITS AUTHORIZED USERS, AND IS
SUBJECT TO ALL APPLICABLE LOCAL,STATE,AND NATIONAL LAWS.
c. Data Platform Services and Software. THE DATA PLATFORM IS PROVIDED ON AN "AS IS" BASIS
ONLY. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, N3CN DOES NOT REPRESENT
OR WARRANT THAT THE DATA PLATFORM WILL MEET THE REQUIREMENTS OF ANY PERSON OR
ENTITY OR WILL OPERATE ERROR-FREE OR CONTINUOUSLY, AND N3CN MAKES NO OTHER
REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.THE PARTIES AGREE
THAT NO AGREEMENTS, REPRESENTATIONS, OR WARRANTIES OTHER THAN THOSE EXPRESSLY
SET FORTH IN THIS AGREEMENT HAVE BEEN MADE, AND THAT NO FUTURE AGREEMENT,
REPRESENTATION, OR WARRANTY UNDER THIS AGREEMENT SHALL BE EFFECTIVE UNLESS
EXPRESSLY STATED IN AN AMENDMENT TO THIS AGREEMENT.
d. Patient Information. PATIENT INFORMATION THAT MAY BE PROVIDED TO PARTICIPANT AND
THEIR AUTHORIZED USERS THROUGH THE DATA PLATFORM ARE BEING PROVIDED "AS IS"AND
"AS AVAILABLE" WITHOUT ANY WARRANTY OF ANY KIND, EXPRESSED OR IMPLIED, WHETHER
STATUTORY OR COMMON LAW, ARISING FROM COURSE OF DEALING, OR OTHERWISE,
INCLUDING WITHOUT LIMITATION ALL WARRANTIES OF MERCHANTABILITY, NON-
INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. NO PARTY WARRANTS THAT THE
PERFORMANCE OF ITS SYSTEM OR THE DATA PLATFORM OR THE DELIVERY OF PATIENT
INFORMATION WILL BE TIMELY, UNINTERRUPTED,OR ERROR FREE.
19. Limitations of Party Liability. This provision is not meant to and shall not be deemed to limit the
applicabilityof the North Carolina Tort Claim5 Act and any immunities available togovernment entities
thereunder,including any sovereign immunity claim. Subject to the limitations described below,each
Party agrees to be liable for all actions and failures to act of its Representatives,Participating Entities,
and Authorized Users,including with respect to Participant any unauthorized access or use of Data or
the Data Platform by anyone using facilities, equipment, or software owned, leased, controlled, or
Page 15 of 21
used by Participant, its Participating Entities, or its Authorized Users. Without limiting the
classification of other types of damages, damages arising from breaches of indemnification,
confidentiality, insurance, or data privacy and security obligations are expressly agreed to be direct
damages.
a. Damages Subject to Complete Limitation of Liability. NEITHER PARTY SHALL HAVE ANY LIABILITY
TO THE OTHER PARTY, OR TO ANY THIRD PARTY, FOR ANY INDIRECT, SPECIAL, EXEMPLARY,
CONSEQUENTIAL, INCIDENTAL,OR PUNITIVE DAMAGES WHETHER ARISING IN CONTRACT,TORT,
OR UNDER ANY OTHER THEORY, REGARDLESS OF WHETHER A PARTY HAS BEEN NOTIFIED OF THE
POSSIBILITY FOR SUCH DAMAGES. N3CN SHALL HAVE NO LIABILITY TO PARTICIPANT OR TO ANY
THIRD PARTY FOR ANY CLAIMS OR DAMAGES ARISING OUT OF OR RELATED TO PARTICIPANT'S
FAILURE TO PROVIDE THE DATA REQUIRED IN THE FORMAT REQUIRED BYTHIS AGREEMENT.
b. Damages Not Subject to Limitation of Liability. NEITHER PARTY SHALL CLAIM ANY EXCLUSION
OR LIMITATION OF LIABILITY RELATED TO ITS INDEMNIFICATION AND CONFIDENTIALITY
OBLIGATIONS,OR TO DAMAGES RESULTING FROM THAT PARTY'S,ITS REPRESENTATIVES',OR ITS
AUTHORIZED USERS'ACTS OR OMISSIONS THAT RESULT IN OR ALLOW A DATA BREACH.
c. Damages Subject to a Cap. THE PARTIES AGREE TO LIMIT THEIR LIABILITY TOWARD THE OTHER
FOR OTHER DIRECT DAMAGES TO THE AMOUNT OF INSURANCE COVERAGE MAINTAINED BY THE
INSURED PARTY,OR THE AMOUNT OF INSURANCE REQUIRED BY STATUTE OR THIS AGREEMENT,
WHICHEVER IS GREATER, FOR THE TYPE OF DAMAGE SUSTAINED. NOTWITHSTANDING THE
FOREGOING, IN THE EVENT A PARTY DROPS OR LOWERS OR FAILS TO OBTAIN INSURANCE
COVERAGE OTHER THAN AS AGREED TO IN WRITING BETWEEN THE PARTIES, THOSE DIRECT
DAMAGES WILL NOT BE SUBJECT TO ANY CAP.
d. Acts of Other Participants. Neither Party to this Agreement shall be responsible to the other for
any claims, demands, expenses, costs, damages, liabilities, or losses, including reasonable
attorney fees (collectively "Claims"), which may arlse from any acts or failures to act by other
participants or any persons acting for or on behalf of another participant. Participant shall hold
N3CN harmless against all Claims arising from or relating to the acts or omissions of its Authorized
Users and any person who uses the security credentials of one of those Authorized Users,whether
lawfully or unlawfully. N3CN shall hold Participant harmless against all Claims arising from or
relating to the acts or omissions of its Authorized Users and any person who uses the security
credentials of one of those Authorized Users,whether lawfully or unlawfUlly.
e. Patient Care. Participant and Participant's Authorized Users are solely responsible for all
decisions and actions taken or not taken involving patient care, utilization management, and
quality management of Individuals resulting from or in any way related to the use of the Data
Platform or the Data. Neither Participant nor any of their Authorized Users shall have any
recourse against N3CN for any Claim made by or on behalf of any Enrollee or other patient,and
Participant, on behalf of itself, its Representatives, and its Authorized Users hereby irrevocably
waives any and all Claims against N3CN, whether now existing or hereafter accruing, relating to
or resulting from Participant's or its Authorized Users'use or misuse of the Data Platform or the
Data.
Page 16 of 21
20. Notices.
a. Business operations/issues Notices. The primary means of communication between the Parties
for Notice purposes regarding business operations and other non-legal Issues related to
performance under this Agreement shall be email. Either Party may change its email address of
its contacts by giving written notice to the other Party of such change.
i. N3CN Business email:ialexander communitycarenc.arg
ii. Participant Business email: kquatrone@orangecountync.gov
Business operations and other non-legal issues allowing or requiring notice may also be sent by US
Mail and delivered to the addresses provided herein below.
b. Legal Notices. All Notices allowed or required under this Agreement relating to legal matters,
including contract amendments, contract termination, breaches of the Agreement or any
obligation contained therein, audits, and all related legal matters must be sent by US Mail,
certified with return receipt requested, or by a nationally recognized courier(e.g. FedEx, UPS),
and must be addressed usingthe address information provided below,as amended by the Parties
from time to time.
i. For N3CN: 2300 Rexwoods, Drive,Raleigh, NC 27607 ATTENTION:General Counsel
ii. For Participant: 300 W.Tryon Street Hillsborough, NC 27278 ATTENTION:Carla Julian
21. Remedies. The rights and remedies of the Parties under this Agreement are cumulative and will not
be construed as available only in the alternative. The Parties agree a material breach of its
Confidentiality,Indemnification,or Insurance obligations would cause injury and damage which could
not adequately be compensated for in an action at law.Therefore,a Party will be entitled to injunctive
and other equitable relief In the event of a material breach,orto prevent the imminent breach of any
such obligation by the other Party or its Representatives or Authorized Users,without the need for
prior proof or any posting of bond. Resort to equitable relief will not be construed to be a waiver of
any other rights or remedies of the Parties.
22. Amendments. The form of this Agreement has been accepted by the North Carolina Department of
Health and Human Services, Department for Health Benefits ("DHB"),for use under the contract the
2019 PRIMARY CARE CASE MANAGEMENT SERVICES CONTRACT #f 37761 BETWEEN THE NORTH
CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES DIVISION OF !-HEALTH BENEFITS AND
NORTH CAROLINA COMMUNITYCARE NETWORKS,INC. and any successor agreement between N3CN
and the State for accessing and using State-owned data. N3CN will not entertain substantive changes
to the terms of this Agreement when used for protecting State-owned data. If Participant is not
participating in any State-funded programs or using any State-owned data, this Agreement may be
amended only in a writing signed by both Parties. The Parties agree that if Participant signs but does
not date the Agreement,N3CN may fill in the date of Participant's signature without need fora formal
amendment and will notify Participant of this act if it occurs.
23. Assignment. N3CN may assign or transfer this Agreement to an Affiliate,a successor-in-interest, or
to an acquirer of all or substantially all of the assets of N3CN. Participant may not assign or transfer
this Agreement, or any part thereof, without the prior written consent of N3CN. In the event
Participant purchases or is purchased by another entity, no new Authorized Users are permitted until
Page 17 of 21
the Parties amend this Agreement to reflect the change in ownership and the acceptance by the new
participant of all the obligations of Participant under this Agreement.This Agreement shall inure to
the benefit of N3CN,Participant,their successors and permitted assigns.
24. Waiver. If either Party waives the enforcement of any obligation or right created under this
Agreement,that waiver shall not operate as or be construed as an amendment or modification of this
Agreement.Further,such waiver will not bar any subsequent enforcement of the same or any other
obligation or right under this Agreement.
25. Integration. This Agreement contains the entire understanding of the Parties as to its contents and
supersedes all other prior and contemporaneous contracts, documents, and agreements in relation
to the subject matter of this Agreement.
26. 5everability. 1f any of the provisions this Agreement are adjudicated by a court of competent
jurisdiction to be invalid,void,or unenforceable,the remainder of this Agreement will remain in full
force and effect and the invalid,void,or unenforceable provision will not be part of the Agreement.
27. Independent Contractors. The Parties to this Agreement are contracting as independent contractors
one toward the other, and nothing herein shall be construed to create a joint venture, agency,
partnership,or employer-employee relationship.Neither Party will have the power to bind the other
Party.Neither Party wilt have any claim against the other Party for employee benefits of any kind.
28. No Third-Party Beneficiaries. This Agreement does not and will not create in any natural person,
corporation,partnership or other organization or entity otherthan N3CN and Participant any benefits
or rights,and this Agreement will be effective only as to N3CN and Participant and their successors
and permitted assigns. Any third party who benefits from any provision of this Agreement shall be
deemed an incidental beneficiary only.
29. Duplicate& Electronic Originals. This Agreement may be executed simultaneously in one or more
counterparts, each of which is deemed an original but all of which together constitute a single
instrument. Any conflict among duplicate originals shall be resolved to give full effect to the
agreement under common sense rules of construction.A conflict will not renderthe agreement void,
invalid, or unenforceable. Copies transmitted electronically are the equivalent to originals, as are
signatures applied to such documents and transmitted electronically. The Parties agree that signed
electronic copies will be binding upon them the same as though they were hardcopies with original
signatu res.
30. Insurance. Each Party agrees to self-insure,orto obtain and maintain reasonable policies of insurance
of types and in amounts sufficient to protect itself,its employees,and its agents against foreseeable
liabilities arising from work contemplated under this Agreement. To the extent a Party does not
maintain a sufficient self-insurance fund or insurance,the cap on liability for direct damages will not
apply to that under-insured Party.
31. Survival. Any provisions of this Agreement,including pass-through State requirements,that by their
nature extend beyond the Term or expiration of the Agreement, will survive the termination or
expiration of the Agreement. Without limiting the generality of the foregoing, the Confidentiality,
Page 18 of 21
Indemnification, Insurance, and Remedies provisions will survive termination or expiry of this
Agreement. In addition, any entity in possession of or having access to State-owned data must
continue to protect the privacy and security of that data after termination of this Agreement so long
as that entity retains possession of or access to that data and may not use or allow access to that data
for any purpose without the prior written consent of N3CN or the State.
32. Authority to Sign. N3CN and Participant warrant they have the capacity to enter into and perform the
obligations under this Agreement and all activities contemplated herein, and that all corporate and
other actions required to authorize them to enter into and perform this Agreement were properly
taken.
33. Governing Law. This Agreement will be governed by and construed under, and the rights and
liabilities of the Parties determined by,the laws and regulations of the State of North Carolina.
34. Captions and Headings. The headings and captions in this Agreement are for convenience only and
will not affect the interpretation of the Agreement.
IN WITNESS WHEREOF, the Parties, through their authorized representatives,execute this Participation
Agreement as of the dates provided herein below:
North Carolina Community Care Networks,Inc. Orange County
[Legal Name of Participant]
l
By: By:
Name: L �+1�`i ��� ont)CW L') Name: 3GIL1lrr �t1.dLrl�f
Title: f F F� Title: s •?A t r
Date: Zd ! Date: !3 2C%1
Page 19 of 21
Exhibit
Governmental Entity
For all Counties, health districts, and other governmental agencies or entities that participate in
Care Management and Provider Services, these Participants will have the following additional
specific obligations:
1. Work with N3CN and any designated Subcontractors to review periodic performance
measures and other metrics from both standard and ad hoc reports and compare
performance with quality, access, cost,and utilization benchmarks.
7. Participate in Provider Satisfaction Surveys administered by N3CN.
3. Provide the Care Management and Provider Services for the programs listed in the Payments
section below.
4. Follow all published DHB, Department, and N3CN policies regarding travel expenses,
international contractors, use of State funds, and other matters applicable to performance
under this Agreement.
5. Comply within a reasonable timeframe with all N3CN requests for information related to
financial and clinical activities of Participant performed pursuant to contract#37761 and any
successor contract.
Payments.
For any governmental entity participating in the following programs, payment for participation
as of the date of execution of the Agreement, subject to change by action of the State, will be
per member per month ("PMPM") payments as follows:
Program for Eligibility Category as aR roprlate] PMPM PayMent
Care Coordination for Children("CC4C') $4.56
Obstetric Care Management("OBCM") $4.96
These payments will be made monthly, in arrears, on a net thirty (30) basis from the date N3CN
receives the data an which the payment will be based, If payment amounts due to Participant
for a given program decrease by more than fifty percent, N3CN may at its discretion change the
frequency of payment for that program up to an annual payment. Payments will be distributed
to Participant from the appropriate PCCM Network until such time as the program oversight and
payment obligations are transferred to N3CN. Once N3CN assumes these responsibilities, all
payments will be made via electronic funds transfer("EFT").
Page 20 of 21
Payments may be discontinued at any time if: 1) N3CN no longer receives sufficient funds from
the State to continue these services;2) Participant fails to meet any of the performance measures
required of N3CN under its obligations to the State for any services being subcontracted to
Participant; or 3) N3CN terminates its contract(s)funding any of the listed programs or services.
Payments listed in this exhibit are subject to change by the State at any time. In the event the
State changes its PMPM payments or eliminates any of these programs, those changes will
automatically apply to this exhibit without need to amend this exhibit or the Agreement.
Page 21 of 21
ADDENDUM
The following letters regarding statutory certifications are an Addendum to this Participation
Agreement by and between North Carolina Community Care Networks,Inc.and Orange County,North
Carolina,a local political subdivision of the State of North Carolina:
[X]Letter dated February 19,2019 re:Certification of use of E-Verify
[X]Letter dated February 19,2019 re:Certification related to Iran Divestment Act
Community Care
OF NORTH CAROLINA
February xg, 2019
To:All North Carolina units of local government
Re, Certification of use of E-Verify
Pursuant to North Carolina Genmj 6 -26,Community Care of North Carolina,
Inc., ("CCNC") an behalf of itself and its subsidiary North Carolina Community Care
Networks,Inc.("NCCCN"),certifies that:(i)after hiring each employee to work in the U.S.
for a term of at least nine (g) months, it verifies that employee's work authorization
through the federal E-Verify program operated by the United States Department of
Homeland Security,and(ii)it retains the record of the verification while the employee is
hired and for one(i)year thereafter.
Consistent with the language of North-Carolina Qpneral Statute x -x , which
allows a unit of local government to be deemed in compliance by adding E-Verify language
to its contracts but does not require such language to be added to contracts, this
certification represents our compliance with the statutory requirement to use E-Verify and
is presented in connection with the execution of all contracts with units of local
government for the State of North Carolina.
Sincerely,
Torlen Wade
Executive Vice President,Community care of North Carolina,Inc.
COMMUNITY CARE OF NORTH CAROLINA Committed to improving the heallla of our communities
rra..
2300 Roxwoeds Drive,Suite 100•R31e141e,NC 27607 e)wwwcommunitycarenc-org "'• "°
Community Care
OF NORTH CAROLINA
February 19,2019
To:All North Carolina units of local gover went
Re: Certification related to the Iran Divestment Act
Pursuant to&rth_Carolina Sessio-m-Law_2ois-ii$,and North Carolina Ggneral 5taljea
147.86:%s et sea., Community Care of North Carolina,Inc.,("CCNC")on behalf of itself
and its subsidiary North Carolina Community Care Networks, Inc. ("NCCCN"), certifies
that it has reviewed the Final Divestment .fist — Iran posted on the website for the
Department of State Treasurer, Investment Manager Division, found at
www.nctreasurer.comJIM% and has determined that neither CCNC nor NCCCN are on
that list as published as of the date of this letter.
Further, CCNC, on behalf of itself and NCCCN, certifies that it has reviewed the Parent
and Subsidiary List of companies on the Final Divestment List and has determined that
neither company has any subcontracts with any entity on that list as published as of the
date of this letter.
Sincerely,
Torlen Wade
Executive[dice President,Community care of North Carolina,Inc.
COMMUNITY CARE OF NORTH CAROLINA Comrnated to improving the health of our communities
v2300 Re%Woods Wive.Suite 100•Raleigh,NC 27607 S www.communitycarenc.org