Common use of Audits and Record Retention Clause in Contracts

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including ▇▇▇▇▇▇▇▇, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - E), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMC-ODS IA, Exhibit F; SABG Contract] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall be subject to examination and audit of the Department of Auditor General for a period of three (3) years after final payment under contract (Government Code § 8546. 3.3 For SABG funded services, Contractor agrees to maintain and preserve, until three years after termination of the SABG State-County Contract and final payment from DHCS to the Contractor, to permit DHCS or any duly authorized representative, to have access to, examine or audit any pertinent books, documents, papers and records related to this contract and to allow interviews of any employees who might reasonably have information related to such records. 3.4 Contractor shall allow the County, CMS, the Office of the Inspector General, the Comptroller General of the United States, and other authorized federal and state agencies, or their duly authorized designees, to evaluate Contractor’s, and subcontractors’, performance under this contract, including the quality, appropriateness, and timeliness of services provided, and to inspect, evaluate, and audit any and all records, documents, and the premises, equipment and facilities maintained by the Contractor and its subcontractors pertaining to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is later. [42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.5 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.6 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 42 CFR 433.32. 3.7 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than 10 years. [DMC-ODS IA, Exhibit A] 3.8 Contractor is responsible for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMC-ODS IA, Exhibit B; SABG Contract, Enclosures 3, 5] 3.9 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth in the State Department of Health Care Services’ Cost Reporting/Data Collection Systems. 3.10 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMC-ODS IA and SABG Contract. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMC-ODS IA, Exhibit F, SABG Contract and BHRS Policy and Procedure BHRS-SUS-06. 3.11 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.12 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the SABG Contract, Enclosure 2.

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including ▇▇▇▇▇▇▇▇, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - Edated January 3, 2018), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMCState-ODS IACounty Contract, Exhibit F; SABG Contract, Attachment I] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall be subject to examination and audit of the Department of Auditor General for a period of three (3) years after final payment under contract (Government Code § 8546. 3.3 For SABG Substance Abuse Prevention and Treatment Block Grant (SABG) funded services, Contractor agrees to maintain and preserve, until three years after termination of the SABG State-County Contract and final payment from DHCS to the Contractor, to permit DHCS or any duly authorized representative, to have access to, examine or audit any pertinent books, documents, papers and records related to this contract and to allow interviews of any employees who might reasonably have information related to such records. 3.4 Contractor shall allow the County, CMS, the Office of the Inspector General, the Comptroller General of the United States, and other authorized federal and state agencies, or their duly authorized designees, to evaluate Contractor’s, and subcontractors’, performance under this contract, including the quality, appropriateness, and timeliness of services provided, and to inspect, evaluate, and audit any and all records, documents, and the premises, equipment and facilities maintained by the Contractor and its subcontractors pertaining to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is later. [42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.5 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.6 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 42 CFR 433.32. 3.7 3.6 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than 10 years. [DMCState-ODS IACounty Intergovernmental Agreement, Exhibit A, Attachment I] 3.8 3.7 Contractor is responsible for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. . When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMCState-ODS IACounty Intergovernmental Agreement, Exhibit B; SABG Contract, Enclosures 3, 5] 3.9 3.8 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth in the State Department of Health Care Services’ Cost Reporting/Data Collection Systems. 3.10 3.9 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMCState-ODS IA and SABG Contract. County Contract Exhibit F. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMCState-ODS IACounty Contract, Exhibit F, SABG Contract F and BHRS Policy and Procedure BHRS-SUS-06. 3.11 3.10 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.12 3.11 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the State-County SABG Contract. Exhibit A, Enclosure 2.Attachment I.

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including ▇▇▇▇▇▇▇▇, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - Edated January 3, 2018), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMCState-ODS IACounty Contract, Exhibit F; SABG Contract, Attachment I] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall be subject to examination and audit of the Department of Auditor General for a period of three (3) years after final payment under contract (Government Code § 8546. 3.3 For SABG Substance Abuse Prevention and Treatment Block Grant (SABG) funded services, Contractor agrees to maintain and preserve, until three years after termination of the SABG State-County Contract and final payment from DHCS to the Contractor, to permit DHCS or any duly authorized representative, to have access to, examine or audit any pertinent books, documents, papers and records related to this contract and to allow interviews of any employees who might reasonably have information related to such records. 3.4 Contractor shall allow the County, CMS, the Office of the Inspector General, the Comptroller General of the United States, and other authorized federal and state agencies, or their duly authorized designees, to evaluate Contractor’s, and subcontractors’, performance under this contract, including the quality, appropriateness, and timeliness of services provided, and to inspect, evaluate, and audit any and all records, documents, and the premises, equipment and facilities maintained by the Contractor and its subcontractors pertaining to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is later. [42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.5 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.6 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 42 CFR 433.32. 3.7 3.6 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than 10 years. [DMCState-ODS IACounty Intergovernmental Agreement, Exhibit A, Attachment I] 3.8 3.7 Contractor is responsible for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMCState-ODS IACounty Intergovernmental Agreement, Exhibit B; SABG Contract, Enclosures 3, 5] 3.9 3.8 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth in the State Department of Health Care Services’ Cost Reporting/Data Collection Systems. 3.10 3.9 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMCState-ODS IA and SABG Contract. County Contract Exhibit F. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMCState-ODS IACounty Contract, Exhibit F, SABG Contract F and BHRS Policy and Procedure BHRS-SUS-06. 3.11 3.10 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.12 3.11 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the State-County SABG Contract. Exhibit A, Enclosure 2.Attachment I.