HomeMy WebLinkAbout20141891.tiff RESOLUTION
RE: APPROVE SEVEN PURCHASE OF SERVICES AGREEMENTS WITH VARIOUS
PROVIDERS AND AUTHORIZE CHAIR TO SIGN
WHEREAS, the Board of County Commissioners of Weld County, Colorado, pursuant to
Colorado statute and the Weld County Home Rule Charter, is vested with the authority of
administering the affairs of Weld County, Colorado, and
WHEREAS, the Board has been presented with seven Purchase of Services Agreements
between the County of Weld, State of Colorado, by and through the Board of County
Commissioners of Weld County, on behalf of the Department of Human Services, Area Agency on
Agency, and the various providers, as follows, commencing July 1, 2014,and ending June 30, 2015,
with further terms and conditions being as stated in said agreements, and
Catholic Charities and Community Services of the Archdiocese of Denver
Charles J. Connell, Attorney at Law
Eldergarden
Meals on Wheels
North Range Behavioral Health
Rehabilitation and Visiting Nurse Association
Senior Resource Services
WHEREAS,after review, the Board deems it advisable to approve said agreements, copies
of which are attached hereto and incorporated herein by reference.
NOW, THEREFORE, BE IT RESOLVED by the Board of County Commissioners of Weld
County, Colorado, that the seven Purchase of Services Agreements between the County of Weld,
State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of
the Department of Human Services, Area Agency on Agency, and the various providers as listed
above be, and hereby are, approved.
BE IT FURTHER RESOLVED by the Board that the Chair be, and hereby is, authorized to
sign said agreements.
•
orrat CC , Nsp (sr)
.t au a.8gn,c�a 8/`l
4/zs
2014-1891
HR0085
RE: SEVEN PURCHASE OF SERVICES AGREEMENTS WITH VARIOUS PROVIDERS
PAGE 2
The above and foregoing Resolution was, on motion duly made and seconded, adopted by
the following vote on the 23rd day of June, A.D., 2014.
BOARD OF COUNTY COMMISSIONERS
WELD COUNTY, COLORADO (� -
ATTEST: ditto) .cpi‘,k, k
Douglaseademacher Chair
Weld County Clerk to the Board
uz�tQ�
//1� arbara Kirkmeyer, ro-Tem
BY: (Llfia�llL(... L1JtEfAL fm
Dept Clerk to the Board •
Sean P. Conway e'
A O D M: b A
Mike Freeman
y Attorne EXCUSED
William F. Garcia
(��
Date of signature: x'2 i4 • }; `
� .
Vas,
2014-1891
HR0085
MEMORANDUM
1861 DATE: June 19, 2014
fi 1 TO: Douglas Rademacher, Chair, Board of County Co i Toners
FROM: Judy A. Grie o, Director, Human Se p m n COUNTY
g
RE: Purchase of Services Agreements be the Weld County
Department of Human Services' Area Agency on Aging and
Various Providers
Enclosed for Board approval are Purchase of Services Agreements between the Department and Various
Providers. These Agreements are funded through the Older Americans Act fund and/or the Older
Coloradoan funds. The Area Agency on Aging Budget was presented under the Board's Work Session
dated June 2,2014,with the requirement of completing annual Purchase of Services Agreements. These
Agreements were reviewed under the Board's Pass-Around Memorandum dated June 11, 2014, and
approved for placement on the Board's Agenda.
Below are the major provisions of the attached Agreements:
Units of Service/
No. Provider/Term Program Area Contract Amount
1 Catholic Charities and Community Outreach Services for 175 1800 Units
Services of the Archdiocese of Hispanic older adults
Denver
Educational outreach 12 Units
July 1,2014—June 30, 2015 services for 300 Hispanic
older adults Max. $60,000.00
2 Charles J. Connell, Legal Services Max. $7,500.00
Attorney at Law
July 1, 2014—June 30, 2015
3 Eldergarden Adult Day Services for 10 3,187 Units
Frail Seniors
July 1, 2014—June 30, 2015 Max. $50,000.00
4 Meals on Wheels Home Delivered Meals for Max. $130,000.00
120 Homebound Seniors
July 1, 2014—June 30, 2015
5 North Range Behavioral Health Peer Counseling Services to 3,749 Contact Units
120 Older Adults
July 1, 2014—June 30, 2015 Max. $80,000.00
6 Rehabilitation and Visiting Nurse Homemaker and personal Max. $115,000.00
Association care services
July 1, 2014—June 30, 2015
7 Senior Resource Services Transportation Services to 4,173 Units
300 Seniors Unit Rate of$11.98
July 1,2014—June 30, 2015 per One Way Ride
Max. $50,000.00
If you have any questions, give me a call at extension 6510. 2014-1891
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT,made and entered into this ls'day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County,on behalf of the Weld County
Department of Human Services'Area Agency on Aging,hereinafter referred to as"AAA" and Catholic Charities
and Community Services of the Archdiocese Denver Weld Regional Office,hereinafter referred to as"CCD-W".
WITNESSETH:
WHEREAS,"AAA" develops and administers the Area Plan for a comprehensive and coordinated system of
services, and
WHEREAS,"AAA" serves as the advocate and focal point for older persons with the greatest economic and social
need, and
WHEREAS,"Catholic Charities and Community Services of the Archdiocese Denver Weld Regional Office is a
private,non-profit organization existing for the purpose of providing outreach services to low-income and minority
residents of Weld County,and
WHEREAS,"AAA"desires to purchase outreach services for low-income minority seniors from"CCD-W,"
NOW THEREFORE, it is mutually agreed:
1. "CCD-W"agrees to provide 1800 units of direct one on outreach services to 175 Hispanic seniors with a
goal of reaching 175 rural seniors, 100 low income elders and 32 disabled seniors. The primary target for
outreach services will be Hispanic seniors who are isolated, rural, low income and disabled. A minimum of
75%of the unduplicated seniors projected to be served must newly identified clients who have not been
served by this contract in the past.
"CCD-W"agrees to providel2 units of group educational programs to 300 Hispanic seniors. The primary
target for these outreach services will be Hispanic seniors who are isolated,rural, low income and/or
disabled.
2. The"AAA"hereby agrees to award grant monies in the sum of$60,000($22,500 Older Americans Act and
$37,500 Older Coloradoan Funds)to"CCD-W."
3. "CCD-W" agrees to commence services with thirty(30)days after the signing of the Agreement and assure
completion of all services required hereunder by June 30,2015.
4. "CCD-W" agrees to document and report any project income received as a result of services provided
under the Agreement.
5. "CCD-W"agrees to include the following statement in any written materials(pamphlets,brochures,
announcements, etc.) or in any verbal presentations: "CCD-W" is supported,in part by funds provided by
the Weld County Area agency on aging through the Older Americans Act."
6. "CCD-W" understands that"AAA" is required to conduct periodic evaluations of the activities conducted
under this Agreement and to monitor on an ongoing basis the performance of"Catholic Charities and
Community Services of the Archdiocese Denver Weld Regional Office"to insure that the funds made
available by the Agreement are expended in keeping with the purposes for which they were awarded; and
"Catholic Charities and Community Services of the Archdiocese Denver Weld Regional Office"
accordingly agrees to cooperate fully with the"AAA" in the conduct of such evaluation and monitoring,
including the keeping and supplying of such information, and providing access to documents and records to
1
the"AAA" for the purpose of audit; and further agrees to do all things necessary to enable"AAA"to fulfill
its obligation to the State of Colorado and the United States Government.
7. Any changes,including any increase or decrease in the amount of"CCD-W's"compensation,and
including changes in budget allocations which are mutually agreed upon by and between the"AAA"and
"CCD-W", shall be incorporated in written amendments to this Agreement and in appropriate revisions to
the grant proposal.
8. "CCD-W"understands and agrees that the following provisions are part of the official application and as
such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies,procedures,and practices of the County,the Older
Americans Act,the policies and procedures established by the State Unit on Aging, and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is FederaUState program income unearned at the time the project is
terminated,this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging,specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
v. Maintain internet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy, which will address any alleged infractions of any federal
state or local laws by `CCD-W" against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
2
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies,volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
I. Agrees to perform background checks of all employees, volunteers or subcontractors pursuant to
C.R.S.27-1-110 and in accordance with the policy of"AAA"and the State Unit on Aging.
9. Additional Work. In the event the County shall require changes in the scope,character, or complexity of
the work to be performed, and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance, an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
10. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are,or shall be deemed to be, agents or employees of the
County for any purpose. Contractor shall have no authorization, express or implied,to bind the County to
any agreement, liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
11. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
12. Reports County Property. All reports,test results and all other tangible materials produced in
connection with the performance of this Agreement, whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
13. Acceptance of Product not a Waiver. Upon completion of the work, Contractor shall submit to County
originals of all test results,reports,etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
14. Insurance and Indemnification. Contractor shall defend and indemnify County,its officers and agents,
from and against loss or liability arising from Contractor's acts,errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
15. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination,Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
16. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under,without the prior written approval of County.
3
17. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
18. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
19. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement,where such failure is due to any
cause beyond its reasonable control, including but not limited to Acts of God, fires,strikes, war, flood,
earthquakes or Governmental actions.
20. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
21. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies,procedures,and practices of County.
22. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
23. Certification. Contractor certifies that Contractor is not an illegal immigrant, and further,Contractor
represents,warrants, and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant,employs illegal aliens or subcontracts with illegal
aliens, County can terminate this Agreement and Contractor may be held liable for damages.
24. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation, and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
25. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
26. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends,supervises Contractor's operations,or authorizes funding to Contractor.
27. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal,or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
28. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
29. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement,and all rights of action relating to such enforcement,shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
30. PUBLIC CONTRACTS FOR SERVICES. CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer, issuance,or sale of securities, investment advisory services or fund management services,
4
sponsored projects, intergovernmental agreements,or information technology services or products and
services] Contractor certifies,warrants, and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c),Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract. Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed,(b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice, and(d)shall comply with reasonable requests made in the course
of an investigation,undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment.If Contractor participates in the Department program, Contractor shall deliver to the
contracting State agency,Institution of Higher Education or political subdivision a written notarized
affirmation,affirming that Contractor has examined the legal work status of such employee, and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency,institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
31. The term of this Agreement shall be from July 1,2014 through June 30,2015.
32. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1
2014 between the Department of Human Services Weld County Area Agency on Aging and
Catholic Charities and Community Services of the Archdiocese Denver Weld Regional Office .
For purposes of this Addendum,the Weld County Department of Human Services Area Agency
on Aging is referred to as "Covered Entity" or "CE" and Catholic Charities and Community
Services of the Archdiocese Denver Weld Regional Office is referred to as "Associate". Unless
the context clearly requires a distinction between the Contract document and this Addendum, all
references herein to "the Contract" or"this Contract" include this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information ("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
5
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d— 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or"PHI" means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii)that identifies the
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
6
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or (iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v) to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2)business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
7
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
£ Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten (10) business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten(10) business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten (10) business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five (5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
8
complying with the HIPAA Rules, and permit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i) prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books, records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
9
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
10
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either (i) terminate the Contract, if feasible or (ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or (ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
11
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
12
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event (i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or (ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
13
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: Laurence Smith
Title: President/CEO
Department and Division: Catholic Charities and Community Services of the
Archdiocese Denver Weld Regional Office
Address: 1442 North 11`h Ave
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014, between the Weld County
Department of Human Services Area Agency on Aging and Catholic Charities and
Community Services of the Archdiocese Denver Weld Regional Office
("Contract") and is effective as of July 1, 2014(the "Attachment Effective Date"). This
Attachment may be amended from time to time as provided in Section 10(b) of the
Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS CATHOLIC CHARITIES AND COMMUNITY
WELD COUNTY COLORADO SERVICES OF THE ARC ES DENVER
(�pt t�j 9 A9--114 � WELD REGIO L OF CE
IS ouglanademacher, Chair JUN 2 3 2014
By:
4 Mat) Laurence Smith J�` /f�President/CEO
AT�ouT: W • a;ti " itle: 72c�s.CY/» C?5
t O Weld County
tyy Clerk to t'- Boar /
'
BY: 7 i I_:�«� % gç/Date:i .it.. .. m ai
Deputy Clerk&t e Board
WELD COUNTY DEPARTMENT OF HUMAN
SERV CES
J dy A. G 'ego, Dire r
WyEELL COUNT A A AGENCY ON AGING
lsva21n
Eva M. Jew , ivision Head 16
&ON- /g2/
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT,made and entered into this 1 s'day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County,on behalf of the Weld County
Department of Human Services'Area Agency on Aging,hereinafter referred to as"AAA"and Charles J.Connell,
Attorney at,hereinafter referred to as"Connell".
WITNESSETH:
WHEREAS,"AAA"develops and administers the Area Plan for a comprehensive and coordinated system of
services,and
WHEREAS,"AAA"serves as the advocate and focal point for older persons with the greatest economic and social
need,and
WHEREAS,"AAA""provides legal assistance to older persons through the Senior Citizens Law Project and
employs a legal assistant to coordinate the Project,and
WHEREAS,by the laws of the State of Colorado,the"AAA"must employ licensed attorney authorized to practice
law in the state of Colorado so that the"AAA" Legal Assistant shall act under the supervision of such attorney.
NOW THEREFORE, it is mutually agreed:
1. The"AAA"desires to purchase services from"CONNELL",through his expertise as an attorney licensed
to practice law in the state of Colorado, for supervision of the legal assistant at the"AAA"Senior Citizen's
Law Project.
2. "CONNELL"desires to provide his expertise as a licensed attorney in the state of Colorado for direction
and supervision of the legal assistant at the"AAA" Senior Citizen's Law Project.
3. The"AAA" legal assistant and"CONNELL"will review applications to the Program. "CONNELL"will
be available for weekly review of applications, for telephone contact by the"AAA" legal assistant,and for
appearance in proceedings in court when necessary.
4. After consultation with"CONNELL",the"AAA" legal assistant shall follow up on case handling and
negotiation,pursuant to the supervision and direction of"CONNELL".
5. The"AAA" Legal assistant shall be responsible for community outreach,publicity of the program,and
community education.
6. The"AAA" legal assistant shall be allowed to represent persons before an agency or in an agency
proceeding,or administrative tribunal,and complete necessary forms not requiring knowledge and skill
beyond that possessed by the ordinary experienced and intelligent layman,as provided by Colorado law.
7. The"AAA"Senior Citizens Law Project agrees not to dispense legal advice and counsel except when
under the direction and supervision of"CONNELL".
8. "CONNELL"will provide a ten-percent match for the Senior Citizen's Law Program in the form travel
time and mileage to court proceedings and client conferences,access to a law library use of office phone,
along with providing limited word processing,usual copying fees and ordinary postage expenses,all with a
value of a least ten-percent(10%)of the total received from this agreement during 2012-2013. It is agreed
that"CONNELL"shall continue to provide his own Professional Liability Insurance. The"AAA" legal
1
assistant shall be insured for liability against errors and omissions resulting from any actions within the
scope of his/her employment,the same as other employees of Weld County.
9. The"AAA"shall reimburse"CONNELL"at the rate of$32.50 per hour for consultation time and$42.50
per hour for court appearance time, up to but not exceeding the sum of$7,500(Older Americans Act
funds). The"AAA"and"CONNELL"shall keep a time log record to monitor the hours worked by
"CONNELL". "CONNELL"shall be paid monthly for actual services rendered in the previous month.
10. "CONNELL"agrees to commence services with thirty(30)days after the signing of the Agreement and
assure completion of all services required hereunder by June 30,2015.
11. "CONNELL"agrees to document and report any project income received as a result of services provided
under the Agreement.
12. "CONNELL"understands that"AAA"is required to conduct periodic evaluations of the activities
conducted under this Agreement and to monitor on an ongoing basis the performance of"CONNELL
"to insure that the funds made available by the Agreement are expended in keeping with the purposes for
which they were awarded;and"CONNELL"accordingly agrees to cooperate fully with the"AAA" in the
conduct of such evaluation and monitoring, including the keeping and supplying of such information,and
providing access to documents and records to the"AAA" for the purpose of audit;and further agrees to do
all things necessary to enable"AAA"to fulfill its obligation to the State of Colorado and the United States
Govemment.
13. Any changes, including any increase or decrease in the amount of"CONNELL's"compensation,and
including changes in budget allocations which are mutually agreed upon by and between the"AAA"and
"CONNELL",shall be incorporated in written amendments to this Agreement and in appropriate revisions
to the grant proposal.
14. "CONNELL" understands and agrees that the following provisions are part of the official application and
as such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies,procedures,and practices of the County,the Older
Americans Act,the policies and procedures established by the State Unit on Aging,and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is Federal/State program income unearned at the time the project is
terminated,this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging,specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
2
v. Maintain intemet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy,which will address any alleged infractions of any federal
state or local laws by'CONNELL"against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies,volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions,including cash and in-
kind shall be verifiable from agency records.
15. Additional Work. In the event the County shall require changes in the scope,character,or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance,an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
16. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are,or shall be deemed to be,agents or employees of the
County for any purpose. Contractor shall have no authorization,express or implied,to bind the County to
any agreement,liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
17. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
18. Reports County Property. All reports,test results and all other tangible materials, except client files
produced in connection with the performance of this Agreement,whether or not such materials are in
completed form,shall at all times be considered the property of the County. Contractor shall not make use
of such material for purposes other than in connection with this Agreement without prior written approval
of County.
19. Acceptance of Product not a Waiver. Upon completion of the work,Contractor shall submit to County
originals of all test results,reports,etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
3
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
20. Insurance and Indemnification. Contractor shall defend and indemnify County, its officers and agents,
from and against loss or liability arising from Contractor's acts,errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
21. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination, Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
22. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under,without the prior written approval of County.
23. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
24. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
25. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement,where such failure is due to any
cause beyond its reasonable control,including but not limited to Acts of God,fires,strikes,war,flood,
earthquakes or Governmental actions.
26. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
27. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies,procedures,and practices of County.
28. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
29. Certification. Contractor certifies that Contractor is not an illegal immigrant,and further,Contractor
represents,warrants,and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant,employs illegal aliens or subcontracts with illegal
aliens, County can terminate this Agreement and Contractor may be held liable for damages.
30. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
31. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
32. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
4
recommends, supervises Contractor's operations,or authorizes funding to Contractor.
33. Severability. If any term or condition of this Agreement shall be held to be invalid,illegal,or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
34. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
35. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement,and all rights of action relating to such enforcement, shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
36. PUBLIC CONTRACTS FOR SERVICES. CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer,issuance,or sale of securities,investment advisory services or fund management services,
sponsored projects,intergovernmental agreements,or information technology services or products and
services]Contractor certifies,warrants,and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS§8-
17.5-102(5)(c), Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract.Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed,(b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice,and(d)shall comply with reasonable requests made in the course
of an investigation, undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program,Contractor shall deliver to the
contracting State agency,Institution of Higher Education or political subdivision a written notarized
affirmation,affirming that Contractor has examined the legal work status of such employee,and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency,institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
37. The term of this Agreement shall be from July 1,2014 through June 30,2015.
38. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
5
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1,
2014 between the Department of Human Services Weld County Area Agency on Aging and
Charles J. Connell. For purposes of this Addendum, the Weld County Department of Human
Services Area Agency on Aging is referred to as "Covered Entity" or"CE" and Charles J.
Connell is referred to as "Associate". Unless the context clearly requires a distinction between
the Contract document and this Addendum, all references herein to"the Contract"or"this
Contract" include this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d- 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act(P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules,the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164,as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or"PHI" means any information, whether oral or
recorded in any form or medium: (i)that relates to the past,present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii)that identifies the
6
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment,payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or(iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v)to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain,prior to making any such disclosure: (i)reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2) business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
7
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
f. Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten(10)business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten(10)business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
8
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten(10)business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five(5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complying with the HIPAA Rules, and permit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information,that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
I. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract(e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
9
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the IIIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i)prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems,books, records, agreements,policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
3. Obligations of CE.
10
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
11
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either(i)terminate the Contract, if feasible or(ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i)the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or(ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
12
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event (i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii)Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
13
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract,the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11th Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: Charles J. Connell
Title: Attorney at Law
Department and Division: N/A
Address: 2308 West 29th Street Suite 200
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014, between Weld County Department
of Human Services Area Agency on Aging and Charles J. Connell ("Contract") and is effective
as of July 1, 2014 (the "Attachment Effective Date"). This Attachment may be amended from
time to time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and,pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS Charles J. Connell, Attorney
WELD COUNTY COLLCORADO ((��
Ck' Q�YLYvk -
Douglasi Rademacher,Chair JUN By: /
2 32014
arles J.Connell,Attorney at Law
ATT ST: 4 s liea tl : cAnAulei'
N
Weld County Clerk to th oard tb6t U SC
29/- 5Z
BY:
eputy Clerk t e Board 1111411
WELD COUNTY DEPARTMENT OF HUMAN
SERVI ES
Jy A.Gr ego, Dir
WELD UNTY AGENCY ON AGING
7
Eva M.Je I on Head
16
0?oiy-/29/
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT, made and entered into this 1"day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County,on behalf of the Weld County
Department of Human Services'Area Agency on Aging,hereinafter referred to as "AAA"and Eldergarden,
hereinafter referred to as"Eldergarden".
WITNESSETH:
WHEREAS,"AAA" develops and administers the Area Plan for a comprehensive and coordinated system of
services, and
WHEREAS,"AAA" serves as the advocate and focal point for older persons with the greatest economic and social
need, and
WHEREAS,"Eldergarden"is a private,non-profit organization existing for the purpose of adult day care services to
residents of Weld County,and
WHEREAS,"AAA"desires to purchase adult day services for low-income elders from"Eldergarden"
NOW THEREFORE, it is mutually agreed:
monies in the sum of$50 000 $25 000 Older Americans Act and
1. The"AAA"hereby agrees to award grant ( ,
$25,000 State Funds for Senior Services)to"Eldergarden."
2. "Eldergarden"agrees to provide 3187 units of adult day care to 10 seniors with a goal of reaching 3 rural
seniors, 3 minority seniors and 10 disabled/frail seniors.
3. The"AAA"agrees to reimburse"Eldergarden"for all eligible project costs up to but not exceeding the sum
of$50.000 at an hourly rate of$15.69
4. "Eldergarden"agrees to commence services with thirty(30)days after the signing of the Agreement and
assure completion of all services required hereunder by June 30,2015.
5. "Eldergarden"agrees to document and report any project income received as a result of services provided
under the Agreement.
6. "Eldergarden"agrees to include the following statement in any written materials(pamphlets,brochures,
announcements,etc.)or in any verbal presentations: "Eldergarden"is supported, in part by funds provided
by the Weld County Area agency on aging through the Older Americans Act."
7. "Eldergarden"understands that"AAA" is required to conduct periodic evaluations of the activities
conducted under this Agreement and to monitor on an ongoing basis the performance of"Eldergarden"to
insure that the funds made available by the Agreement are expended in keeping with the purposes for
which they were awarded; and"Eldergarden"accordingly agrees to cooperate fully with the"AAA" in the
conduct of such evaluation and monitoring, including the keeping and supplying of such information,and
providing access to documents and records to the"AAA"for the purpose of audit; and further agrees to do
all things necessary to enable"AAA"to fulfill its obligation to the State of Colorado and the United States
Government.
8. Any changes, including any increase or decrease in the amount of"Eldergarden's" compensation,and
including changes in budget allocations which are mutually agreed upon by and between the"AAA"and
"Eldergarden", shall be incorporated in written amendments to this Agreement and in appropriate revisions
to the grant proposal.
1
9. "Eldergarden" understands and agrees that the following provisions are part of the official application and
as such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies,procedures, and practices of the County,the Older
Americans Act,the policies and procedures established by the State Unit on Aging,and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is Federal/State program income unearned at the time the project is
terminated,this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging, specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
v. Maintain intemet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy,which will address any alleged infractions of any federal
state or local laws by `Eldergarden"against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies, volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
I. Agrees to perform background checks of all employees, volunteers or subcontractors pursuant to
2
C.R.S.27-1-110 and in accordance with the policy of AAA and the State Unit on Aging.
10. Additional Work. In the event the County shall require changes in the scope,character,or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance,an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
11. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are,or shall be deemed to be,agents or employees of the
County for any purpose. Contractor shall have no authorization, express or implied,to bind the County to
any agreement,liability, or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
12. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
13. Reports County Property. All reports,test results and all other tangible materials produced in
connection with the performance of this Agreement,whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
14. Acceptance of Product not a Waiver. Upon completion of the work,Contractor shall submit to County
originals of all test results,reports,etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
15. Insurance and Indemnification. Contractor shall defend and indemnify County, its officers and agents,
from and against loss or liability arising from Contractor's acts,errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
16. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination, Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
17. Non-Assignment. Contractor may not assign or transfer this Agreement, any interest therein or claim there
under,without the prior written approval of County.
18. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
19. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
3
20. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement,where such failure is due to any
cause beyond its reasonable control, including but not limited to Acts of God, fires, strikes,war, flood,
earthquakes or Governmental actions.
21. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
22. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies,procedures, and practices of County.
23. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
24. Certification. Contractor certifies that Contractor is not an illegal immigrant, and further,Contractor
represents,warrants,and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant, employs illegal aliens or subcontracts with illegal
aliens,County can terminate this Agreement and Contractor may be held liable for damages.
25. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
26. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
27. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends, supervises Contractor's operations, or authorizes funding to Contractor.
28. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal,or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
29. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
30. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement, and all rights of action relating to such enforcement,shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
31. PUBLIC CONTRACTS FOR SERVICES. CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer, issuance,or sale of securities, investment advisory services or fund management services,
sponsored projects, intergovernmental agreements,or information technology services or products and
services] Contractor certifies,warrants, and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c), Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
4
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract. Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed,(b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract, (c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice,and(d)shall comply with reasonable requests made in the course
of an investigation,undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program, Contractor shall deliver to the
contracting State agency, Institution of Higher Education or political subdivision a written,notarized
affirmation, affirming that Contractor has examined the legal work status of such employee,and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency, institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
32. The term of this Agreement shall be from July 1,2014 through June 30,2015.
33. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
5
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1,
2014 between the Department of Human Services Weld County Area Agency on Aging and
Eldergarden. For purposes of this Addendum, the Weld County Department of Human Services
Area Agency on Aging is referred to as "Covered Entity" or "CE" and Eldergarden is referred to
as "Associate". Unless the context clearly requires a distinction between the Contract document
and this Addendum, all references herein to "the Contract" or"this Contract" include this
Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d- 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or"PHI" means any information, whether oral or
recorded in any form or medium: (i)that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii) that identifies the
6
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or (iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v)to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2) business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
7
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
f. Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten (10) business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten (10) business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
8
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten (10) business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five (5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complying with the HIPAA Rules, and permit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
9
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i) prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books, records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
10
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
11
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either (i) terminate the Contract, if feasible or (ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or (ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a),2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
12
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply withlaw. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event (i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceeding . Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
13
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: Judy VanEgdom
Title: Director
Department and Division: Eldergarden
Address: 910 27th Avenue
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014 between Weld County Department
of Human Services Area Agency on Aging and Eldergarden, ("Contract") and is effective as of
July 1, 2014 (the "Attachment Effective Date"). This Attachment may be amended from time to
time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
16
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms.]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS ELDERGARDEN
WELD COUNTY,COLORADO to
910 27 Avenue
4 GE ir Greeley, CO 80634
Dougl s Rademac er,Chair
JUN 2 3 2014 By:
Judy nEgdom, xecutive Director
ATTE T: itle:Weld County Clerk to the B' ' L:
LBY: Eet ate: //b- p j eputy Clerk e BoardU
WELD COUNTY DEPARTMENT OF HUMAN
SERVICES 1
ud .Griego, irector
WELD COUNTY AR AGENCY ON AGING
tea zn .
Eva M.Jewell, Di isi Head
17
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT,made and entered into this I"day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County, on behalf of the Weld County
Department of Human Services'Area Agency on Aging, hereinafter referred to as "AAA" and Meals on Wheels
hereinafter referred to as"MOW".
WITNESSETH:
WHEREAS,"AAA"develops and administers the Area Plan for a comprehensive and coordinated system of
services,and
WHEREAS, "AAA"serves as the advocate and focal point for older persons with the greatest economic and social
need, and
WHEREAS,"MOW" is a private, non-profit organization existing for the purpose of providing home delivered
meals to homebound residents of Weld County.and
WHEREAS,"AAA"desires to purchase home delivered meals for low-income elders from"MOW"
NOW THEREFORE, it is mutually agreed:
I. The"AAA" hereby agrees to award grant monies(under the Older Americans Act and Older Coloradoan
State Funding for Senior Services) in the sum of$130,000($125,531 Older Americans Act and$4,469
Older Coloradoan State Funding)to"MOW."
2. The"AAA" hereby agrees to award"MOW" a percentage of the Nutrition Services Incentive Program
(NSIP) reimbursement. The reimbursement will be based on a per meal rate for every meal served to an
eligible Title Ill recipient for the purpose of serving the number of meals in paragraph 3.
3. "MOW" agrees to provide meals to approximately 120 seniors with a goal of reaching 30 rural seniors, 30
Hispanic seniors and 120 homebound seniors. Homebound status must be formally re-evaluated every 6
months and entered into SAMS. Unit cost reimbursement for each meal that meets the 33 1/3 RDI
requirements is $5.73.
4. "MOW"agrees to commence services with thirty(30)days after the signing of the Agreement and assure
completion of all services required hereunder by June 30, 2015.
5. "MOW" agrees to document and report any project income received as a result of services provided under
the Agreement.
6. "MOW"agrees to include the following statement in any written materials(pamphlets, brochures,
announcements, etc.)or in any verbal presentations: "MOW" is supported, in part by funds provided by the
Weld County Area agency on aging through the Older Americans Act."
7. "MOW" understands that"AAA" is required to conduct periodic evaluations of the activities conducted
under this Agreement and to monitor on an ongoing basis the performance of"MOW"to insure that the
funds made available by the Agreement are expended in keeping with the purposes for which they were
awarded; and"MOW" accordingly agrees to cooperate fully with the"AAA" in the conduct of such
evaluation and monitoring, including the keeping and supplying of such information,and providing access
to documents and records to the"AAA" for the purpose of audit; and further agrees to do all things
necessary to enable"AAA" to fulfill its obligation to the State of Colorado and the United States
Government.
&C/Y— 1/4529/
8. Any changes, including any increase or decrease in the amount of"MOW's"compensation, and including
changes in budget allocations which are mutually agreed upon by and between the"AAA" and"MOW",
shall be incorporated in written amendments to this Agreement and in appropriate revisions to the grant
proposal.
9. "MOW"understands and agrees that the following provisions are part of the official application and as
such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies, procedures,and practices of the County, the Older
Americans Act,the policies and procedures established by the State Unit on Aging, and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is Federal/State program income unearned at the time the project is
terminated, this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA" and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging, specifically,
i. To submit monthly financial and programmatic reports to the"AAA" by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software:
v. Maintain internet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking, timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy, which will address any alleged infractions of any federal
state or local laws by 'MOW- against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
2
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies, volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
I. Agrees to perform background checks of all employees, volunteers or subcontractors pursuant to
C.R.S. 27-1-110 and in accordance with the policy of"AAA"and the State Unit on Aging.
10. Additional Work. In the event the County shall require changes in the scope,character, or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance,an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
I I. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are, or shall be deemed to be,agents or employees of the
County for any purpose. Contractor shall have no authorization,express or implied,to bind the County to
any agreement, liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
12. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
13. Reports County Property. All reports, test results and all other tangible materials produced in
connection with the performance of this Agreement, whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
14. Acceptance of Product not a Waiver. Upon completion of the work, Contractor shall submit to County
originals of all test results, reports, etc., generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
15. Insurance and Indemnification. Contractor shall defend and indemnify County, its officers and agents,
from and against loss or liability arising from Contractor's acts, errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
16. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination, Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
17. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under, without the prior written approval of County.
3
18. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
19. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
20. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement, where such failure is due to any
cause beyond its reasonable control, including but not limited to Acts of God, fires, strikes, war, flood,
earthquakes or Governmental actions.
21. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
22. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies, procedures, and practices of County.
23. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
24. Certification. Contractor certifies that Contractor is not an illegal immigrant, and further,Contractor
represents, warrants, and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant, employs illegal aliens or subcontracts with illegal
aliens,County can terminate this Agreement and Contractor may be held liable for damages.
25. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
26. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
27. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends, supervises Contractor's operations, or authorizes funding to Contractor.
28. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal,or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
29. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
30. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement,and all rights of action relating to such enforcement, shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
4
31. PUBLIC CONTRACTS FOR SERVICES. CRS §8-I 7.5-101. [Not Applicable to agreements relating to
the offer, issuance, or sale of securities, investment advisory services or fund management services,
sponsored projects, intergovernmental agreements, or information technology services or products and
services] Contractor certifies,warrants, and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c), Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract. Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed,(b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice,and(d)shall comply with reasonable requests made in the course
of an investigation, undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program,Contractor shall deliver to the
contracting State agency, Institution of Higher Education or political subdivision a written,notarized
affirmation, affirming that Contractor has examined the legal work status of such employee, and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency, institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
32. The term of this Agreement shall be from July 1,2014 through June 30,2015.
33. This Agreement may be terminated up thirty (30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1,
2014 between the Department of Human Services Weld County Area Agency on Aging and
Eldergarden. For purposes of this Addendum, the Weld County Department of Human Services
Area Agency on Aging is referred to as "Covered Entity" or "CE" and Meals on Wheels is
referred to as "Associate". Unless the context clearly requires a distinction between the Contract
document and this Addendum, all references herein to "the Contract" or"this Contract" include
this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information ("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d— 1320d-8 ("HIPAA") as
5
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set
forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or "PHI" means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii) that identifies the
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
6
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or (iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or (v) to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.5020)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2) business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five(5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
7
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
f. Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten (10) business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten (10) business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten (10) business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five (5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complying with the HIPAA Rules, and permit access by the Secretary during normal business
8
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i) prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books, records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
9
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or (ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
10
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either (i) terminate the Contract, if feasible or(ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or(ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
11
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
g g
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
12
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event (i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
pP
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
13
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: MaryMargaret Cox
Title: Director
Department and Division: Meals on Wheels
Address: 2131 9th Street
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014, between Weld County Department
of Human Services Area Agency on Aging and Meals on Wheels, ("Contract") and is effective
as of July 1, 2014 (the "Attachment Effective Date"). This Attachment may be amended from
time to time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms.]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS Meals on Wheels
WELD COUNTY, COLORADO 2131 9 Street
Greeley, CO 80631
Dougl s Rademacher, Chair JUN 2 3 2014
By. �
�� Gs���fary argavvrd�t Cox
ATCT t ` (� 'r�, /- LL it e: �Q�
/.Q`�WJ G• �C.��l.Girr
Weld County Clerk to the oard 01 � C�
ate: �� �e/ eo/
BY: �.
Deputy Clerk to the and
- ,�i...-rte•
WELD COUNTY DEPARTMENT OF HUMAN
SERVIC S
u y A. Gil o, Direc r
W COUNT AGENCY ON AGING
odkv?
Eva M. Jewell, iv. ion Head
16
ao/41-/89/
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT,made and entered into this 1s'day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County,on behalf of the Weld County
Department of Human Services'Area Agency on Aging,hereinafter referred to as "AAA"and North Range
Behavioral Health,hereinafter referred to as"NRBH".
WITNESSETH:
WHEREAS,"AAA"develops and administers the Area Plan for a comprehensive and coordinated system of
services,and
WHEREAS,"AAA" serves as the advocate and focal point for older persons with the greatest economic and social
need,and
WHEREAS,"NRBH" is a private,non-profit organization existing for the purpose providing mental health services
to residents of Weld County,and
WHEREAS,"AAA"desires to purchase peer counseling services for low-income elders from"NRBH"
NOW THEREFORE, it is mutually agreed:
1. The"AAA"hereby agrees to award grant monies(under the Older Americans Act and Older Coloradoan
State Funding for Senior Services)in the sum of$80,000($33,000 Older Americans Act and$47,000 Older
Coloradoan) to"NRBH."
2. "NRBH"agrees to provide 3,749 units of Peer Counseling to 120 older adults with the goal of serving 30
rural elders and 15 Hispanic elders and 20 disabled/frail older adults.
3. The"AAA"agrees to reimburse"NRBH"for all eligible project costs up to by not exceeding the sum of
$80,000 at an hourly rate of$21.34 per hour.
4. "NRBH"agrees to commence services with thirty(30)days after the signing of the Agreement and assure
completion of all services required hereunder by June 30,2015.
5. "NRBH"agrees to document and report any project income received as a result of services provided under
the Agreement.
6. "NRBH"agrees to include the following statement in any written materials(pamphlets,brochures,
announcements,etc.)or in any verbal presentations: "NRBH"is supported, in part by funds provided by the
Weld County Area agency on aging through the Older Americans Act."
7. "NRBH"understands that"AAA" is required to conduct periodic evaluations of the activities conducted
under this Agreement and to monitor on an ongoing basis the performance of"NRBH"to insure that the
funds made available by the Agreement are expended in keeping with the purposes for which they were
awarded; and"NRBH"accordingly agrees to cooperate fully with the"AAA"in the conduct of such
evaluation and monitoring,including the keeping and supplying of such information, and providing access
to documents and records to the"AAA" for the purpose of audit;and further agrees to do all things
necessary to enable"AAA"to fulfill its obligation to the State of Colorado and the United States
Government.
8. Any changes, including any increase or decrease in the amount of"NRBH's"compensation,and including
changes in budget allocations which are mutually agreed upon by and between the"AAA" and"NRBH",
shall be incorporated in written amendments to this Agreement and in appropriate revisions to the grant
1
07oiy-/ /
proposal.
9. "NRBH"understands and agrees that the following provisions are part of the official application and as
such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies,procedures,and practices of the County,the Older
Americans Act,the policies and procedures established by the State Unit on Aging,and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is Federal/State program income unearned at the time the project is
terminated,this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging,specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
v. Maintain Internet access in order to transfer all required data to the"AAA".
f Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy, which will address any alleged infractions of any federal
state or local laws by `NRBH" against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies,volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
2
I. Agrees to perform background checks of all employees,volunteers or subcontractors pursuant to
C.R.S.27-1-110 and in accordance with the policy of"AAA"and the State Unit on Aging.
10. Additional Work. In the event the County shall require changes in the scope,character, or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance, an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
11. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are,or shall be deemed to be,agents or employees of the
County for any purpose. Contractor shall have no authorization,express or implied,to bind the County to
any agreement, liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
12. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
13. Reports County Property. All reports,test results and all other tangible materials produced in
connection with the performance of this Agreement, whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
14. Acceptance of Product not a Waiver. Upon completion of the work, Contractor shall submit to County
originals of all test results,reports, etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
15. Insurance and Indemnification. Contractor shall defend and indemnify County,its officers and agents,
from and against loss or liability arising from Contractor's acts,errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
16. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination, Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
17. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under,without the prior written approval of County.
18. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
19. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
3
20. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement,where such failure is due to any
cause beyond its reasonable control, including but not limited to Acts of God, fires, strikes,war, flood,
earthquakes or Governmental actions.
21. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
22. Compliance. This Agreementand the provision of services hereunder shall be subject to the laws of
P �eemen
Colorado and be in accordance with the policies,procedures, and practices of County.
23. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
24. Certification. Contractor certifies that Contractor is not an illegal immigrant,and further.Contractor
represents,warrants,and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant,employs illegal aliens or subcontracts with illegal
aliens,County can terminate this Agreement and Contractor may be held liable for damages.
25. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
26. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
27. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends,supervises Contractor's operations, or authorizes funding to Contractor.
28. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal, or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
29. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
30. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement,and all rights of action relating to such enforcement, shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
31. PUBLIC CONTRACTS FOR SERVICES.CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer, issuance,or sale of securities, investment advisory services or fund management services,
sponsored projects, intergovernmental agreements,or information technology services or products and
P g g
services] Contractor certifies, warrants,and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c),Contractor shall not knowingly employ or contract with an illegal alien to perform work
4
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract.Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed,(b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice,and(d)shall comply with reasonable requests made in the course
of an investigation, undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program,Contractor shall deliver to the
contracting State agency, Institution of Higher Education or political subdivision a written, notarized
affirmation,affirming that Contractor has examined the legal work status of such employee,and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency, institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
32. The term of this Agreement shall be from July 1,2014 through June 30,2015.
33. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1,
2014 between the Department of Human Services Weld County Area Agency on Aging and
North Range Behavioral Health. For purposes of this Addendum, the Weld County Department
of Human Services Area Agency on Aging is referred to as "Covered Entity" or"CE" and North
Range Behavioral Health is referred to as "Associate". Unless the context clearly requires a
distinction between the Contract document and this Addendum, all references herein to "the
Contract" or"this Contract" include this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information ("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d- 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
5
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or "PHI" means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii) that identifies the
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i)for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or(iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
6
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v) to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2) business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
7
f. Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten(10) business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten(10) business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5)business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten(10)business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including,but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five(5)business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complying with the HIPAA Rules, and permit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
8
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract(e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i)prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books, records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
9
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
10
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason,that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either(i) terminate the Contract, if feasible or(ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or(ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
11
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a),2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
12
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event (i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
13
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: Larry Pottorff
Title: Executive Director
Department and Division: North Range Behavioral Health
Address: 1300 North 17th Ave
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014, between Weld County Department
of Human Services Area Agency on Aging and North Range Behavioral Health ("Contract")
and is effective as of July 1, 2014 (the "Attachment Effective Date"). This Attachment may be
amended from time to time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms.]
IN WITNESS WHEREOF, the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS North Range Behavioral Health
ELD COUNTY, COLORADO
C �s ma �1ay.r >` BY r
ougla ade er, Chair 2 3 20 arry Pottorff
s La Title: Executive Director
ATCTES�T: C� � ,,,,,//
i, / G. uld0:� 4C' 1aie:62
6/S / 4
Weld County Clerk tot Boar ,w s -
Imo.
BY: ��_!�!%-..(�. 1U i
deputy Cler ,tft a Board
WELD COUNTY DEPARTMENT OF HUMAN
SERVICES
dy A. Gri go, Direct
WEL COUNTY AREA AGENCY ON AGING
( a v¢ �Gd. L�i��
Eva M. Jewel ision Head
16
02O/4- /89/
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT, made and entered into this 1"day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County,on behalf of the Weld County
Department of Human Services'Area Agency on Aging, hereinafter referred to as"AAA" and Rehabilitation and
Visiting Nurse Association hereinafter referred to as"RVNA".
WITNESSETH:
WHEREAS,"AAA"develops and administers the Area Plan for a comprehensive and coordinated system of
services,and
WHEREAS,"AAA"serves as the advocate and focal point for older persons with the greatest economic and social
need,and
WHEREAS,"RVNA"is a private,non-profit organization existing for the purpose of providing home health care
services to residents of Weld County, and
WHEREAS,"AAA"desires to purchase home health care for low-income elders from"RVNA"
NOW THEREFORE,it is mutually agreed:
1. The"AAA"hereby agrees to award grant monies the sum of$115,000($21.175 Older American Act
Funds and$93,825 Older Coloradoan Funds) to"RVNA."
2. The"AAA"agrees to reimburse"RVNA"for all eligible project costs up to by not exceeding the sum of
$111,000 at an hourly rate of$24.72 for homemaker and personal care.The"AAA"also agrees to
reimburse"RVNA"for all eligible nursing services at an hourly rate of$108.00 and certified nursing
assistant services at an hourly rate of$31.42 not to exceed a total of$4,000. Funds that are not used for
nursing services and certified nursing assistant services may be used for homemaker and personal care
services.
3. "RVNA"agrees to commence services with thirty(30)days after the signing of the Agreement and assure
completion of all services required hereunder by June 30,2015.
4. "RVNA"agrees to document and report any project income received as a result of services provided under
the Agreement.
5. "RVNA"agrees to include the following statement in any written materials(pamphlets,brochures,
announcements,etc.)or in any verbal presentations: "RVNA"is supported, in part by funds provided by
the Weld County Area agency on aging through the Older Americans Act."
6. "RVNA"understands that"AAA"is required to conduct periodic evaluations of the activities conducted
under this Agreement and to monitor on an ongoing basis the performance of"RVNA"to insure that the
funds made available by the Agreement are expended in keeping with the purposes for which they were
awarded;and"RVNA"accordingly agrees to cooperate fully with the"AAA"in the conduct of such
evaluation and monitoring, including the keeping and supplying of such information, and providing access
to documents and records to the"AAA"for the purpose of audit;and further agrees to do all things
necessary to enable"AAA"to fulfill its obligation to the State of Colorado and the United States
Govemment.
7. Any changes, including any increase or decrease in the amount of"RVNA's"compensation,and including
changes in budget allocations which are mutually agreed upon by and between the"AAA"and"RVNA",
shall be incorporated in written amendments to this Agreement and in appropriate revisions to the grant
proposal.
1
d o/9—/ )5;/
8. "RVNA"understands and agrees that the following provisions are part of the official application and as
such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies, procedures. and practices of the County,the Older
Americans Act. the policies and procedures established by the State Unit on Aging.and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is FederafState program income unearned at the time the project is
terminated,this amount must be returned to the"AAA"unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging,specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
v. Maintain intemet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy,which will address any alleged infractions of any federal
state or local laws by`ANNA"against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA„
j. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
k. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies, volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
I. Agrees to perform background checks of all employees,volunteers or subcontractors pursuant to
C.R.S. 27-1-110 and in accordance with the policy of"AAA"and the State Unit on Aging.
2
9. Additional Work. In the event the County shall require changes in the scope, character,or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance,an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
10. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are,or shall be deemed to be, agents or employees of the
County for any purpose. Contractor shall have no authorization,express or implied,to bind the County to
any agreement, liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
11. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
12. Reports County Property. All reports,test results and all other tangible materials produced in
connection with the performance of this Agreement,whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
13. Acceptance of Product not a Waiver. Upon completion of the work,Contractor shall submit to County
originals of all test results,reports,etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for,any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally. '
14. Insurance and Indemnification. Contractor shall defend and indemnify County, its officers and agents,
from and against loss or liability arising from Contractor's acts, errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
15. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement maybe terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination,Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
16. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under,without the prior written approval of County.
17. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
18. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
19. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
3
to deliver or otherwise to perfomi any obligation under this Agreement. where such failure is due to any
cause beyond its reasonable control. including but not limited to Acts of God. fires,strikes.war, flood.
earthquakes or Governmental actions.
20. Notices. Any notice required to be given under this Agreement shall he in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
21. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies,procedures, and practices of County.
22. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
23. Certification. Contractor certifies that Contractor is not an illegal immigrant,and further,Contractor
represents, warrants,and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant,employs illegal aliens or subcontracts with illegal
aliens, County can terminate this Agreement and Contractor may be held liable for damages.
24. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
25. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
26. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends, supervises Contractor's operations,or authorizes funding to Contractor.
27. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal,or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
28. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
29. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement,and all rights of action relating to such enforcement, shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
30. PUBLIC CONTRACTS FOR SERVICES. CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer, issuance,or sale of securities,investment advisory services or fund management services,
sponsored projects, intergovernmental agreements, or information technology services or products and
services] Contractor certifies,warrants,and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c),Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
4
contract. Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed, (b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice,and(d) shall comply with reasonable requests made in the course
of an investigation,undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program,Contractor shall deliver to the
contracting State agency, Institution of Higher Education or political subdivision a written,notarized
affirmation,affirming that Contractor has examined the legal work status of such employee,and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency, institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
31. The term of this Agreement shall be from July 1, 2014 through June 30,2015.
32. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
5
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated Jul r 1
2014 between the Department of Human Services Weld County Area Agency on Aging and
RVNA. For purposes of this Addendum, the Weld County Department of Human Services Area
Agency on Aging is referred to as "Covered Entity" or"CE" and RVNA is referred to as
"Associate". Unless the context clearly requires a distinction between the Contract document
and this Addendum, all references herein to "the Contract" or"this Contract" include this
Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information ("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d— 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate pr
ior to the disclosure of PHI, as set forth in,but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or"PHI" means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii) that identifies the
6
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or(iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v) to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2)business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
7
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative.
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
agreement. Agreement the event of any violation of such Subcontractor or agent The between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
£ Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten (10)business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten (10)business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
8
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten (10) business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five (5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complying with the HIPAA Rules, and permit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate(and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
9
-
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices. available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and;or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
during the breach. Associate shall take (i) prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books,records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
10
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
11
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either(i) terminate the Contract, if feasible or(ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or (ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
•
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
12
of Liability. Any limitation of Associate's liability in the Contract shall be
7. Limitation
Y
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
P g g � g
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty(30)
days written notice in the event(i)Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
13
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor. employee or agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Eitherparty may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: Crystal Day
Title: President/CEO
Department and Division: RVNA
Address: 910 27th Avenue
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July I, 2014, between Weld County Department
of Human Services Area Agency on Aging and RVNA ("Contract") and is effective as of July 1,
2014 (the "Attachment Effective Date"). This Attachment may be amended from time to time as
provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Tenns. /This section may include specifications for disclosure format,
method o/transmission, use of an intermediary, use of digital signatures or PH, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms.]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS Rehabilitation and Visiting Nurses Association
2105 Clubhouse Drive
(WELD COUNTY,COLORADO p ,,_ Greele O 80634 *LW
gl ade e ,ChaiiQ�/h ti�Y`�` (
• ougla�Rademache ,Chair By.
JUN 2 Crystal Day
s La Title: zami/
ATTEST:
1/42
/a7/-1
�• �+'C�•
ate:
Weld County Clerk to the Board
BY:
eputy Clerk t e oard
WELD COUNTY DEPARTMENT OF HUMAN
SERV CES
J dy A. nego, r for
WELD COUNTY AREA AGENCY ON AGING
Eva M. Jewel ,Dp cad
16
a(2/y-/89?
PURCHASE OF SERVICE AGREEMENT
THIS AGREEMENT,made and entered into this Is'day of July 2014 by and between the County of Weld, State of
Colorado,by and through the Board of County Commissioners of Weld County, on behalf of the Weld County
Department of Human Services'Area Agency on Aging, hereinafter referred to as "AAA"and Senior Resource
Services, hereinafter referred to as"Senior Resource Services".
WITNESSETH:
WHEREAS,"AAA"develops and administers the Area Plan for a comprehensive and coordinated system of
services,and
WHEREAS,"AAA"serves as the advocate and focal point for older persons with the greatest economic and social
need,and
WHEREAS,"Senior Resource Services" is a private,non-profit organization existing to provide services to the
seniors and their families of Weld County, and
WHEREAS,"AAA"desires to purchase transportation services for low-income elders from"Senior Resource
Services"
NOW THEREFORE, it is mutually agreed:
1. The"AAA"hereby agrees to award grant monies(under the Older Americans Act and Older Coloradoan
State Funding for Senior Services)in the sum of$50,000($10,000 Older Americans Act and$40,000 Older
Coloradoan)to"Senior Resource Services."
2. "Senior Resource Services"agrees to provide 4 173 units of transportation services to 300 seniors, age 60
and older with a goal of reaching 50 rural seniors 25 minority seniors and 300 disabled/frail seniors.
3. "Senior Resource Services"agrees to provide transportation services to seniors residing throughout Weld
County. Priority will be given to seniors who are in need of rides to medical appointments and other critical
appointments such as shopping. Senior Resource Services also agrees to cross over county lines if that is
the closest point of access to medical and other appropriate services.
4. The"AAA"agrees to reimburse"Senior Resource Services" for all eligible project costs up to but not
exceeding the sum of$50,000 at a unit rate of$11.98. One unit of service equals 1 one-way ride.
5. "Senior Resource Services"agrees to commence services with thirty(30)days after the signing of the
Agreement and assure completion of all services required hereunder by June 30,2015.
6. "Senior Resource Services"agrees to document and report any project income received as a result of
services provided under the Agreement.
7. "Senior Resource Services"agrees to include the following statement in any written materials(pamphlets,
brochures, announcements,etc.)or in any verbal presentations: "Senior Resource Services" is supported, in
part by funds provided by the Weld County Area agency on aging through the Older Americans Act."
8. "Senior Resource Services" understands that"AAA" is required to conduct periodic evaluations of the
activities conducted under this Agreement and to monitor on an ongoing basis the performance of"Senior
Resource Services"to insure that the funds made available by the Agreement are expended in keeping with
the purposes for which they were awarded;and"Senior Resource Services"accordingly agrees to
cooperate fully with the"AAA" in the conduct of such evaluation and monitoring, including the keeping
and supplying of such information,and providing access to documents and records to the"AAA"for the
1
purpose of audit; and further agrees to do all things necessary to enable"AAA"to fulfill its obligation to
the State of Colorado and the United States Government.
9. Any changes, including any increase or decrease in the amount of"Senior Resource Services"'
compensation, and including changes in budget allocations which are mutually agreed upon by and
between the"AAA"and"Senior Resource Services", shall be incorporated in written amendments to this
Agreement and in appropriate revisions to the grant proposal.
10. "Senior Resource Services" understands and agrees that the following provisions are part of the official
application and as such become binding upon commencement of the project:
a. This Agreement and the provisions of services hereunder shall be subject to the laws of Colorado
and be in accordance with the policies,procedures,and practices of the County,the Older
Americans Act,the policies and procedures established by the State Unit on Aging,and the terms
and conditions of the project application approved by"AAA".
b. Understands that if there is Federal/State program income unearned at the time the project is
terminated,this amount must be returned to the"AAA" unless the"AAA"otherwise stipulates.
c. Understands that the project's fiscal affairs are subject to audit. If costs are disallowed,the
proportion of Federal/State funds disallowed must be returned to the"AAA".
d. Understands that this award is made for the period amounts stated in this Agreement. This
Agreement in no way implies further funding which is contingent upon the availability of funds
and approval of future project applications.
e. Agrees to keep records and make reports on the forms required by the"AAA"and in accordance
with guidelines issued by the State of Colorado and the Administration on Aging,specifically,
i. To submit monthly financial and programmatic reports to the"AAA"by the 10th of the
following month;
ii. To submit a final financial report within 45 days after the end of the project year;
iii. To submit other reports to the"AAA"as requested;
iv. Maintain a computer system that will be able to manage all required"AAA"reporting
software;
v. Maintain Internet access in order to transfer all required data to the"AAA".
f. Agrees to advise the"AAA"of needed program and financial changes and await approval from
the"AAA"prior to change implementation.
g. Agrees to have policies and procedures for complaint/appeal tracking,timely disposition of
complaints/appeals and documentation of such processes.
h. Agrees to have a client grievance policy, which will address any alleged infractions of any federal
state or local laws by 'Senior Resource Services"against recipients of or applicants for services.
i. Agrees to have a policy and procedure for wait lists that meets the requirements set forth by the
"AAA".
j. Agrees to have policy and procedures for all fiscal activities.
k. Agrees to provide recipients receiving services the opportunity to contribute to all or part of the
cost of the services received. Each recipient shall be given the opportunity to determine if they are
able to contribute to all or part of the cost of services. No recipient shall be denied a service
because of a failure to contribute to all or part of the cost of the service. All contributions shall be
2
considered program income. All contributions shall be used to expand the services for which the
contributions were given.
I. Agrees that local cash or in-kind contributions have not been used to satisfy or match another
federal grant or funds. Supplies, volunteer services,and other in-kind contributions shall be
valued as described under 45 C.F.R. 874.5. All matching contributions, including cash and in-
kind shall be verifiable from agency records.
m. Agrees to perform background checks of all employees, volunteers or subcontractors pursuant to
C.R.S. 27-1-110 and in accordance with the policy of AAA and the State Unit on Aging.
I I. Additional Work. In the event the County shall require changes in the scope,character,or complexity of
the work to be performed,and said changes cause an increase or decrease in the time required or the costs
to the Contractor for performance,an equitable adjustment in fees and completion time shall be negotiated
between the parties and this Agreement shall be modified accordingly by a supplemental Agreement. Any
claims by the Contractor for adjustment hereunder must be made in writing prior to performance of any
work covered in the anticipated supplemental Agreement. Any change in work made without such prior
supplemental Agreement shall be deemed covered in the compensation and time provisions of this
Agreement.
12. Independent Contractor. Contractor agrees that Contractor is an independent contractor and that neither
Contractor nor Contractor's agents or employees are, or shall be deemed to be,agents or employees of the
County for any purpose. Contractor shall have no authorization, express or implied,to bind the County to
any agreement, liability,or understanding. The parties agree that Contractor will not become an employee
of County,nor is Contractor entitled to any employee benefits from County as a result of the execution of
this Agreement.
13. Warranty. Contractor warrants that services performed under this Agreement will be performed in a
manner consistent with the professional standards governing such services and the provisions of this
Agreement.
14. Reports County Property. All reports,test results and all other tangible materials produced in
connection with the performance of this Agreement,whether or not such materials are in completed form,
shall at all times be considered the property of the County. Contractor shall not make use of such material
for purposes other than in connection with this Agreement without prior written approval of County.
15. Acceptance of Product not a Waiver. Upon completion of the work,Contractor shall submit to County
originals of all test results,reports, etc.,generated during completion of this work. Acceptance by County
of reports and incidental material furnished under this Agreement shall not in any way relieve Contractor of
responsibility for the quality and accuracy of the work. Acceptance by the County of,or payment for, any
services performed under this Agreement shall not be construed as a waiver of any of the County's rights
under this Agreement or under the law generally.
16. Insurance and Indemnification. Contractor shall defend and indemnify County, its officers and agents,
from and against loss or liability arising from Contractor's acts,errors or omissions in seeking to perform
its obligations under this Agreement. Contractor shall provide necessary workers' compensation insurance
at Contractor's own cost and expense.
17. Termination. Either party may terminate this Agreement at any time by providing the other party with a
30 day written notice thereof. Furthermore,this Agreement may be terminated at any time without notice
upon a material breach of the terms of the Agreement. In the event of an early termination,Contractor shall
be paid for work performed up to the time of notice and County shall be entitled the use of all material
generated pursuant to this Agreement.
3
18. Non-Assignment. Contractor may not assign or transfer this Agreement,any interest therein or claim there
under, without the prior written approval of County.
19. Access to Records. County shall have access to Contractor's financial records as they relate to this
Agreement for purposes of audit. Such records shall be complete and available for audit 90 days after final
payment hereunder and shall be retained and available for audit purposes for at least five years after final
payment hereunder.
20. Time of Essence. Time is of the essence in each and all of the provisions of this Agreement.
21. Interruptions.Neither party to this Agreement shall be liable to the other for delays in delivery or failure
to deliver or otherwise to perform any obligation under this Agreement, where such failure is due to any
cause beyond its reasonable control, including but not limited to Acts of God, fires, strikes, war,flood,
earthquakes or Governmental actions.
22. Notices. Any notice required to be given under this Agreement shall be in writing and shall be mailed or
delivered to the other party at that party's address as stated above.
23. Compliance. This Agreement and the provision of services hereunder shall be subject to the laws of
Colorado and be in accordance with the policies, procedures, and practices of County.
24. Non-Exclusive Agreement. This Agreement is nonexclusive and County may engage or use other
contractors or persons to perform services of the same or similar nature.
25. Certification. Contractor certifies that Contractor is not an illegal immigrant,and further.Contractor
represents,warrants,and agrees that it has verified that Contractor does not employ any illegal aliens. If it
is discovered that Contractor is an illegal immigrant,employs illegal aliens or subcontracts with illegal
aliens,County can terminate this Agreement and Contractor may be held liable for damages.
26. Entire Agreement/Modifications. This Agreement contains the entire agreement between the parties with
respect to the subject matter contained in this Agreement. This instrument supersedes all prior negotiation,
representation,and understanding or agreements with respect to the subject matter contained in this
Agreement. This Agreement may be changed or supplemented only by a written instrument signed by both
parties.
27. Funding Contingency. No portion of this Agreement shall be deemed to create an obligation on the part
of County to expend funds not otherwise appropriated or budgeted for.
28. No Conflict. No employee of Contractor nor any member of Contractor's family shall serve on a County
Board,committee or hold any such position which either by rule,practice or action nominates,
recommends, supervises Contractor's operations,or authorizes funding to Contractor.
29. Severability. If any term or condition of this Agreement shall be held to be invalid, illegal, or
unenforceable,this Agreement shall be construed and enforced without such provision,to the extent that
this Agreement is then capable of execution within the original intent of the parties.
30. Governmental Immunity. No portion of this Agreement shall be deemed to constitute a waiver of any
immunity the parties or their officers or employees may possess.
31. No Third Party Beneficiary. It is expressly understood and agreed that the enforcement of the terms and
conditions of this Agreement, and all rights of action relating to such enforcement, shall be strictly reserved
to the undersigned parties and nothing in this Agreement shall give or allow any claim or right of action
whatsoever by any other person not included in this Agreement. It is the express intention of the
undersigned parties that any entity other than the undersigned parties receiving services or benefits under
this Agreement shall be an incidental beneficiary only.
4
32. PUBLIC CONTRACTS FOR SERVICES.CRS §8-17.5-101. [Not Applicable to agreements relating to
the offer, issuance,or sale of securities, investment advisory services or fund management services,
sponsored projects, intergovernmental agreements,or information technology services or products and
services] Contractor certifies,warrants,and agrees that it does not knowingly employ or contract with an
illegal alien who will perform work under this contract and will confirm the employment eligibility of all
employees who are newly hired for employment in the United States to perform work under this contract,
through participation in the E-Verify Program or the Department program established pursuant to CRS §8-
17.5-102(5)(c),Contractor shall not knowingly employ or contract with an illegal alien to perform work
under this contract or enter into a contract with a subcontractor that fails to certify to Contractor that the
subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this
contract. Contractor(a)shall not use E-Verify Program or Department program procedures to undertake
pre-employment screening of job applicants while this contract is being performed, (b)shall notify the
subcontractor and the contracting State agency within three days if Contractor has actual knowledge that a
subcontractor is employing or contracting with an illegal alien for work under this contract,(c)shall
terminate the subcontract if a subcontractor does not stop employing or contracting with the illegal alien
within three days of receiving the notice, and(d)shall comply with reasonable requests made in the course
of an investigation, undertaken pursuant to CRS §8-17.5-102(5),by the Colorado Department of Labor and
Employment. If Contractor participates in the Department program, Contractor shall deliver to the
contracting State agency, Institution of Higher Education or political subdivision a written notarized
affirmation,affirming that Contractor has examined the legal work status of such employee,and shall
comply with all of the other requirements of the Department program. If Contractor fails to comply with
any requirement of this provision or CRS §8-17.5-101 et seq.,the contracting State agency, institution of
higher education or political subdivision may terminate this contract for breach and, if so terminated,
Contractor shall be liable for damages.
33. The term of this Agreement shall be from July 1,2014 through June 30,2015.
34. This Agreement may be terminated up thirty(30)days written notice by either party. This Agreement shall
be terminated immediately in the event of loss of funding to the AAA.
5
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated July 1
2014 between the Department of Human Services Weld County Area Agency on Aging and
Senior Resource Services. For purposes of this Addendum, the Weld County Department of
Human Services Area Agency on Aging is referred to as "Covered Entity" or"CE" and Senior
Resource Services is referred to as "Associate". Unless the context clearly requires a distinction
between the Contract document and this Addendum, all references herein to "the Contract" or
"this Contract" include this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information("PHI") (defined
below).
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, 42 U.S.C. § 1320d— 1320d-8 ("HIPAA") as
amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH
Act (P.L. 111-005), and its implementing regulations promulgated by the U.S.
Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the
"HIPAA Rules") and other applicable laws, as amended.
C. As part of the HIPAA Rules, the CE is required to enter into a written contract containing
specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not
limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal
Regulations ("C.F.R.") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Rules at 45 C.F.R. Parts 160, 162 and 164, as amended.
In the event of any conflict between the mandatory provisions of the HIPAA Rules and the
provisions of this Contract, the HIPAA Rules shall control. Where the provisions of this
Contract differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the
HIPAA Rules, the provisions of this Contract shall control.
b. "Protected Health Information" or"PHI" means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past, present or
future payment for the provision of health care to an individual; and (ii) that identifies the
6
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.501.
c. "Protected Information" shall mean PHI provided by CE to Associate or created
received, maintained or transmitted by Associate on CE's behalf. To the extent Associate is a
covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and
health care operations, Protected Information under this Contract does not include any PHI
created or obtained by Associate as a covered entity and Associate shall follow its own policies
and procedures for accounting, access and amendment of Associate's PHI.
d. "Subcontractor" shall mean a third party to whom Associate delegates a function,
activity, or service that involves CE's Protected Information, in order to carry out the
responsibilities of this Agreement.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the HIPAA Rules if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii)to
carry out the legal responsibilities of Associate; or(iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum. Associate accepts full
responsibility for any penalties incurred as a result of Associate's breach of the HIPAA Rules.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the HIPAA Rules if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v)to report
violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section
164.502(j)(1). To the extent that Associate discloses Protected Information to a third party
Subcontractor, Associate must obtain, prior to making any such disclosure: (i) reasonable
assurances through execution of a written agreement with such third party that such Protected
Information will be held confidential as provided pursuant to this Addendum and only disclosed
as required by law or for the purposes for which it was disclosed to such third party; and that
such third party will notify Associate within two (2) business days of any breaches of
confidentiality of the Protected Information, to the extent it has obtained knowledge of such
breach. Additional provisions, if any, governing permitted disclosures of Protected Information
are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
7
this Contract. Associate shall comply with the requirements of the HIPAA Security Rule at 45
C.F.R. Sections 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a
comprehensive written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of the Associate's
operations and the nature and scope of its activities. Associate shall review, modify, and update
documentation of, its safeguards as needed to ensure continued provision of reasonable and
appropriate protection of Protected Information.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) business days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more Subcontractors or agents to
provide services under the Contract, and such Subcontractors or agents receive or have access to
Protected Information, each Subcontractor or agent shall sign an agreement with Associate
containing the same provisions as this Addendum and further identifying CE as a third party
beneficiary with rights of enforcement and indemnification from such Subcontractors or agents
in the event of any violation of such Subcontractor or agent agreement. The Agreement between
the Associate and Subcontractor or agent shall ensure that the Subcontractor or agent agrees to at
least the same restrictions and conditions that apply to Associate with respect to such Protected
Information. Associate shall implement and maintain sanctions against agents and
Subcontractors that violate such restrictions and conditions and shall mitigate the effects of any
such violation.
f. Access to Protected Information. If Associate maintains Protected Information
contained within CE's Designated Record Set, Associate shall make Protected Information
maintained by Associate or its agents or Subcontractors in such Designated Record Sets
available to CE for inspection and copying within ten (10) business days of a request by CE to
enable CE to fulfill its obligations to permit individual access to PHI under the HIPAA Rules,
including, but not limited to, 45 C.F.R. Section 164.524. If such Protected Information is
maintained by Associate in an electronic form or format, Associate must make such Protected
Information available to CE in a mutually agreed upon electronic form or format.
g. Amendment of PHI. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate or its agents or Subcontractors shall make such
Protected Information available to CE for amendment within ten (10) business days of receipt of
a request from CE for an amendment of Protected Information or a record about an individual
contained in a Designated Record Set, and shall incorporate any such amendment to enable CE
to fulfill its obligations with respect to requests by individuals to amend their PHI under the
HIPAA Rules, including, but not limited to, 45 C.F.R. Section 164.526. If any individual
requests an amendment of Protected Information directly from Associate or its agents or
Subcontractors, Associate must notify CE in writing within five (5) business days of receipt of
the request. Any denial of amendment of Protected Information maintained by Associate or its
agents or Subcontractors shall be the responsibility of CE.
8
h. Accounting Rights. If Associate maintains Protected Information contained
within CE's Designated Record Set, Associate and its agents or Subcontractors shall make
available to CE within ten (10) business days of notice by CE, the information required to
provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA
Rules, including, but not limited to, 45 C.F.R. Section 164.528. In the event that the request for
an accounting is delivered directly to Associate or its agents or Subcontractors, Associate shall
within five (5) business days of the receipt of the request forward it to CE in writing. It shall be
CE's responsibility to prepare and deliver any such accounting requested. Associate shall not
disclose any Protected Information except as set forth in Section 2(b) of this Addendum.
i. Governmental Access to Records. Associate shall keep records and make its
internal practices, books and records relating to the use and disclosure of Protected Information
available to the Secretary of the U.S. Department of Health and Human Services (the
"Secretary"), in a time and manner designated by the Secretary, for purposes of determining
CE's or Associate's compliance with the HIPAA Rules. Associate shall provide to CE a copy of
any Protected Information that Associate provides to the Secretary concurrently with providing
such Protected Information to the Secretary when the Secretary is investigating CE. Associate
shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance
review of Associate's policies, procedures or practices to determine whether Associate is
complyingwith the HIPAA Rules, andpermit access by the Secretary during normal business
hours to its facilities, books, records, accounts, and other sources of information, including
Protected Information, that are pertinent to ascertaining compliance.
j. Minimum Necessary. Associate (and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the HIPAA Rules including, but not limited to 45 C.F.R. Sections 164.502(b)
and 164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Except upon termination of the Contract as
provided in Section 4(d) of this Addendum, Associate and its Subcontractors or agents shall
retain all Protected Information throughout the term of this Contract and shall continue to
maintain the information required under Section 2(h) of this Addendum for a period of six (6)
years.
m. Associate's Insurance. Associate shall maintain insurance to cover loss of PHI
data and claims based upon alleged violations of privacy rights through improper use or
disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements
of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar
limits, additional insured status and notice of cancellation).
9
n. Notice of Privacy Practices. Associate shall be responsible for reviewing CE's
Notice of Privacy Practices, available on CE's external website, to determine any requirements
applicable to Associate per this Contract.
o. Notification of Breach. During the term of this Contract, Associate shall notify
CE within two (2) business days of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall not initiate
notification to affected individuals per the HIPAA Rules without prior notification and approval
of CE. Information provided to CE shall include the identification of each individual whose
PHI has been, or is reasonably believed to have been accessed, acquired or disclosed
unsecuredq
during the breach. Associate shall take (i)prompt corrective action to cure any such deficiencies
and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and
state laws and regulations.
p. Audits, Inspection and Enforcement. Within ten (10) business days of a written
request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable
inspection of the facilities, systems, books, records, agreements, policies and procedures relating
to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of
determining whether Associate has complied with this Addendum; provided, however, that: (i)
Associate and CE shall mutually agree in advance upon the scope, timing and location of such an
inspection; and (ii) CE shall protect the confidentiality of all confidential and proprietary
information of Associate to which CE has access during the course of such inspection. The fact
that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems,
books, records, agreements, policies and procedures does not relieve Associate of its
responsibility to comply with this Addendum, nor does CE's (i) failure to detect or(ii) detection,
but failure to notify Associate or require Associate's remediation of any unsatisfactory practices,
constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract.
q. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards, including encryption of PHI, to maintain and ensure the confidentiality,
integrity and security of Protected Information transmitted pursuant to the Contract, in
accordance with the standards and requirements of the HIPAA Rules.
r. Restrictions and Confidential Communications. Within ten (10) business days of
notice by CE of a restriction upon uses or disclosures or request for confidential communications
pursuant to 45 C.F.R. Section 164.522, Associate will restrict the use or disclosure of an
individual's Protected Information. Associate will not respond directly to an individual's
requests to restrict the use or disclosure of Protected Information or to send all communication of
Protect Information to an alternate address. Associate will refer such requests to the CE so that
the CE can coordinate and prepare a timely response to the requesting individual and provide
direction to Associate.
3. Obligations of CE.
10
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards, including encryption of PHI, to maintain and ensure the confidentiality, integrity and
security of Protected Information transmitted pursuant to the Contract, in accordance with the
standards and requirements of the HIPAA Rules.
b. Notice of Changes. CE maintains a copy of its Notice of Privacy Practices on its
website. CE shall provide Associate with any changes in, or revocation of, permission to use or
disclose Protected Information, to the extent that it may affect Associate's permitted or required
uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of
PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected
Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE
may withhold amounts due Associate as CE deems necessary to protect CE against loss from
third party claims of improper use or disclosure and to reimburse CE for the excess costs
incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
11
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation.. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall
either(i) terminate the Contract, if feasible or(ii) if termination of this Contract is not feasible,
CE shall report Associate's breach or violation to the Secretary of the Department of Health and
Human Services. If Associate knows of a pattern of activity or practice of a Subcontractor or
agent that constitutes a material breach or violation of the Subcontractor's or agent's obligations
under the written agreement between Associate and the Subcontractor or agent, Associate shall
take reasonable steps to cure such breach or end such violation, if feasible.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of the HIPAA Rules or other security or privacy laws or(ii) a finding
or stipulation that the other party has violated any standard or requirement of the HIPAA Rules
or other security or privacy laws is made in any administrative or civil proceeding in which the
party has been joined.
d. Effect of Termination.
(I) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or Subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Associate shall continue to extend the protections of Sections
2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such Protected Information, and shall limit
further use of such PHI to those purposes that make the return or destruction of such PHI
infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its Subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
12
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contractor the HIPAA Rules will be adequate or satisfactory for Associate's own purposes.
Associate is solely responsible for all decisions made by Associate regarding the safeguarding of
PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to the HIPAA Rules relating to certification of its
security practices, CE or its authorized agents or contractors, may, at CE's expense, examine
Associate's facilities, systems, procedures and records as may be necessary for such agents or
contractors to certify to CE the extent to which Associate's security safeguards comply with the
HIPAA Rules or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of the HIPAA Rules and other applicable laws relating to the
confidentiality, integrity, availability and security of PHI. The parties understand and agree that
CE must receive satisfactory written assurance from Associate that Associate will adequately
safeguard all Protected Information and that it is Associate's responsibility to receive satisfactory
written assurances from Associate's Subcontractors and agents. Upon the request of either party,
the other party agrees to promptly enter into negotiations concerning the terms of an amendment
to this Addendum embodying written assurances consistent with the standards and requirements
of the HIPAA Rules or other applicable laws. CE may terminate this Contract upon thirty (30)
days written notice in the event(i) Associate does not promptly enter into negotiations to amend
this Contract when requested by CE pursuant to this Section, or(ii) Associate does not enter into
an amendment to this Contract providing assurances regarding the safeguarding of PHI that CE,
in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA
Rules.
b. Amendment of Attachment A. Attachment A may be modified or amended b
by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any Subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as
witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against CE, its directors, officers or employees based upon a claimed violation of
the HIPAA Rules or other laws relating to security and privacy or PHI, except where Associate
or its Subcontractor, employee or agent is a named adverse party.
13
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer, upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with the HIPAA Rules. The parties agree that any
ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent
with the HIPAA Rules. This Contract supercedes and replaces any previous separately executed
HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
by CE as
Party Beneficiaries") shall survive termination of this Contract and shall enforceablebe
provided herein in the event of such failure to perform or comply by the Associate. This
Addendum shall remain in effect during the term of the Contract including any extensions.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract, the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Eva Jewell
Title: Division Head
Department and Division: Weld County Department of Human Services Area Agency on
Aging
Address: 315 North 11`h Ave PO Box 1805
Greeley, Colorado 80631
Contractor/Business Associate Representative:
Name: DeeArm Groves
Title: Executive Director
Department and Division: Senior Resource Services
Address: 800 8`h Ave Suite #145
Greeley, Colorado 80631
14
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated July 1, 2014 between Weld County Department
of Human Services Area Agency on Aging and Senior Resource Services ("Contract") and is
effective as of July 1, 2014 (the "Attachment Effective Date"). This Attachment may be
amended from time to time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows:
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt:
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information:
15
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications. de-identification or re-identification of data and
other additional terms.]
IN WITNESS WHEREOF,the parties hereto have executed this Agreement on the day first written above.
BOARD OF COUNTY COMMISSIONERS SENIOR RESOURCE SERVICES
WELD COUNTY, COLORADO 800 8th Ave Suite 145
Ttzqq\e^9 dcc1.t tM_Q�� Street Greeley, CO 80634
DouglaiRadem her, Chair JUN 2 3 201 -
DeeAnn Groves
AT EST: it d '_
agailieti S / L Iso '.�.r.,2� e: 1' U MIRY Q7--0441
s "'ll
Weld County Clerk tote :oardtdbils
BY: 1!,i/�i s. _ ! r � ����JU !" ate: 1\(\ 0- 1 7.0 `�
Deputy Clerk t.E'e Board
WELD COUNTY DEPARTMENT OF HUMAN
SERVIC S
A. Grie o, Dire
W OU EA AGENCY ON AGING
Elva M. ivision Head
16
Hello