Common use of RECORDS MANAGEMENT AND MAINTENANCE Clause in Contracts

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 17 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 18 this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 19 accordance with this Agreement Contract and all applicable requirements. 5 20 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 21 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 22 shall include, but not be limited to, individual patient charts and utilization review records. 8 23 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 24 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 25 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 26 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 27 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 28 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 29 principles of reimbursement and GAAP. 15 30 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 31 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 32 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 33 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 34 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 35 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI made in 36 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 37 1 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //state

RECORDS MANAGEMENT AND MAINTENANCE. 2 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 22 accordance with this Agreement Contract and all applicable requirements. 5 23 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 24 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 8 26 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 27 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 28 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 29 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 30 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 31 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 32 principles of reimbursement and GAAP. 15 33 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 34 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 35 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 37 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //state

RECORDS MANAGEMENT AND MAINTENANCE. 2 4 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 5 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 6 accordance with this Agreement Contract and all applicable requirements. 5 7 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 8 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 9 records shall include, but not be limited to, individual patient charts and utilization review records. 8 10 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 11 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 12 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 13 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 14 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 15 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 16 principles of reimbursement and GAAP. 15 17 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 18 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 19 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 20 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 21 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 22 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 23 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 24 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 25 or state regulations and/or COUNTY policies. 24 26 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 27 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 28 and implement written record management procedures. 27 29 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 30 termination of the contract, Contract unless a longer period is required due to legal proceedings such as litigations 29 31 and/or settlement of claims. 30 32 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 33 following discharge of the participant, client and/or patient. 32 34 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 36 CONTRACTOR is unable to meet the record location criteria above, upon CONTRACTOR’s request 37 ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single 1 location, identified by 36 CONTRACTOR. 37 //. 1 2 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 3 of, this AgreementContract, within forty-eight (48) hourshours of CONTRACTOR’s receipt of the PRA request. 4 CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request.PRA 4 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 9 maintained by or for a covered entity that is: 8 10 1. The medical records and billing records about individuals maintained by or for a covered 10 12 2. The enrollment, payment, claims adjudication, and case or medical management record 11 13 systems maintained by or for a health plan; or 12 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 16 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 19 or site visit. 18 20 2. Provide auditor or other authorized individuals access to documents via a computer 19 21 terminal. 20 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 23 requested. 22 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 26 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 27 or regulation, and copy ADMINISTRATOR on such notifications. 26 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy 29 and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR 30 shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //31

RECORDS MANAGEMENT AND MAINTENANCE. 2 9 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 10 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 11 accordance with this Agreement and all applicable requirements. 5 12 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 13 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 14 records shall include, but not be limited to, individual patient charts and utilization review records. 8 15 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 16 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 17 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 18 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 19 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 20 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 21 principles of reimbursement and GAAP. 15 22 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 23 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 24 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 25 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 26 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 27 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 28 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 29 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 30 regulations and/or COUNTY policies. 24 31 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 32 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 33 implement written record management procedures. 27 34 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 35 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 36 and/or settlement of claims. 30 37 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 1 discharge of the participant, client and/or patient. 32 2 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 3 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 4 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 5 written approval to CONTRACTOR to maintain records in a single location, identified by 36 6 CONTRACTOR. 37 //. 1 7 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 8 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 9 information that is requested by the PRA request. 4 10 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 11 participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request 12 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 13 for a covered entity that is: 8 14 1. The medical records and billing records about individuals maintained by or for a covered 10 16 2. The enrollment, payment, claims adjudication, and case or medical management record 11 17 systems maintained by or for a health plan; or 12 18 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 19 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 20 with the terms of this Agreement and common business practices. If documentation is retained 15 21 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 22 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 23 or site visit. 18 24 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 26 requested. 22 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 29 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 30 regulation, and copy ADMINISTRATOR on such notifications. 26 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //34

RECORDS MANAGEMENT AND MAINTENANCE. 2 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 6 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 7 accordance with this Agreement Contract and all applicable requirements. 5 8 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 9 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 10 shall include, but not be limited to, individual patient charts and utilization review records. 8 11 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 12 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 13 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 14 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 15 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 16 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 17 principles of reimbursement and GAAP. 15 18 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 19 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 20 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 21 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 22 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 23 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 24 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 25 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 26 or state regulations and/or COUNTY policies. 24 27 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 28 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 29 and implement written record management procedures. 27 30 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 31 termination of the contractContract, unless a longer period is required due to legal proceedings such as 32 litigations 29 and/or settlement of claims. 30 33 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 34 following discharge of the participant, client and/or patient. 32 35 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 36 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 37 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 1 CONTRACTOR. 37 2 // 1 3 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 4 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 5 information that is requested by the PRA request. 4 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 9 maintained by or for a covered entity that is: 8 10 1. The medical records and billing records about individuals maintained by or for a covered 10 12 2. The enrollment, payment, claims adjudication, and case or medical management record 11 13 systems maintained by or for a health plan; or 12 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 16 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 19 or site visit. 18 20 2. Provide auditor or other authorized individuals access to documents via a computer 19 21 terminal. 20 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 23 requested. 22 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 26 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 27 regulation, and copy ADMINISTRATOR on such notifications. 26 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 29 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 30 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //31

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contractAgreement, unless a longer period is required due to legal proceedings such as 29 litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //29

RECORDS MANAGEMENT AND MAINTENANCE. 2 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 17 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 18 accordance with this Agreement and all applicable requirements. 5 19 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 20 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 21 records shall include, but not be limited to, individual patient charts and utilization review records. 8 22 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 23 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 24 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 25 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 26 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 27 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 28 principles of reimbursement and GAAP. 15 29 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 30 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 31 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 32 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 33 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 34 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 35 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 36 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 37 regulations and/or COUNTY policies. 24 1 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 2 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 3 implement written record management procedures. 27 4 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 5 termination of the contractAgreement, unless a longer period is required due to legal proceedings such as 6 litigations 29 and/or settlement of claims. 30 7 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 following 8 discharge of the participant, client and/or patient. 32 9 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 10 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 11 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 12 written approval to CONTRACTOR to maintain records in a single location, identified by 36 13 CONTRACTOR. 37 //. 1 14 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 15 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 16 information that is requested by the PRA request. 4 17 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 18 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 19 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained 20 by or for a covered entity that is: 8 21 1. The medical records and billing records about individuals maintained by or for a covered 10 23 2. The enrollment, payment, claims adjudication, and case or medical management record 11 24 systems maintained by or for a health plan; or 12 25 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 26 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 27 with the terms of this Agreement and common business practices. If documentation is retained 15 28 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 29 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 30 or site visit. 18 31 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 32 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 33 requested. 22 34 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 35 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 36 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 37 regulation, and copy ADMINISTRATOR on such notifications. 26 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 4 L. CONTRACTOR shall retain all client participant, client, and/or patient medical records for ten seven (107) 5 years 30 following discharge of the participant, client and/or patient, with the exception of non-emancipated 6 minors for 31 whom records must be kept until for at least one (1) year after such minors have reached the age of twenty-five 7 eighteen (2518) years, or for 32 minors that deliver babies while in custodyseven (7) years after the last date of service, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhichever is longer. 34 // 35 // 36 // 37 //8

RECORDS MANAGEMENT AND MAINTENANCE. 2 7 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 8 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 9 accordance with this Agreement and all applicable requirements. 5 10 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 11 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 12 records shall include, but not be limited to, individual patient charts and utilization review records. 8 13 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 14 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 15 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 16 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 17 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 18 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 19 principles of reimbursement and GAAP. 15 20 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 21 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 22 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 23 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 24 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 25 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 26 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 27 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 28 or state regulations and/or COUNTY policies. 24 29 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 30 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 31 and implement written record management procedures. 27 32 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 33 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 34 and/or settlement of claims. 30 35 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 36 following discharge of the participant, client and/or patient.. 37 // 32 1 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 2 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 3 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 4 written approval to CONTRACTOR to maintain records in a single location, identified by 36 5 CONTRACTOR. 37 //. 1 6 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 7 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 8 all information that is requested by the PRA request. 4 9 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 10 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 11 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 12 maintained by or for a covered entity that is: 8 13 1. The medical records and billing records about individuals maintained by or for a covered 10 15 2. The enrollment, payment, claims adjudication, and case or medical management record 11 16 systems maintained by or for a health plan; or 12 17 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 18 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 19 with the terms of this Agreement and common business practices. If documentation is retained 15 20 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 21 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 22 or site visit. 18 23 2. Provide auditor or other authorized individuals access to documents via a computer 19 24 terminal. 20 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 26 requested. 22 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 29 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 30 or regulation, and copy ADMINISTRATOR on such notifications. 26 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 34 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 35 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 19 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement Contract and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 34 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 36 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 37 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 1 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 2 or state regulations and/or COUNTY policies. 24 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 5 and implement written record management procedures. 27 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 8 and/or settlement of claims. 30 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 10 following discharge of the participant, client and/or patient. 32 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 12 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 14 written approval to CONTRACTOR to maintain records in a single location, identified by 36 15 CONTRACTOR. 37 //. 1 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 17 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 18 information that is requested by the PRA request. 4 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 22 maintained by or for a covered entity that is: 8 23 1. The medical records and billing records about individuals maintained by or for a covered 10 25 2. The enrollment, payment, claims adjudication, and case or medical management record 11 26 systems maintained by or for a health plan; or 12 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 29 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 32 or site visit. 18 33 2. Provide auditor or other authorized individuals access to documents via a computer 19 34 terminal. 20 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 36 requested.. 37 // 22 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 4 or regulation, and copy ADMINISTRATOR on such notifications. 26 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //8

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 28 years from the 28 termination of the contract, unless a longer period is required due to legal proceedings 29 such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (7)/ten (10) 31 years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //32

RECORDS MANAGEMENT AND MAINTENANCE. 2 31 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 32 this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 33 accordance with this Agreement Contract and all applicable requirements. 5 34 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 35 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 36 shall include, but not be limited to, individual patient charts and utilization review records.. 37 // 8 1 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 2 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 3 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 4 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 5 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 6 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 7 principles of reimbursement and GAAP. 15 8 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 9 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 10 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 11 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 12 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 13 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 14 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 15 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 16 regulations and/or COUNTY policies. 24 17 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 18 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 19 implement written record management procedures. 27 20 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 21 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 22 and/or settlement of claims. 30 23 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 24 discharge of the participant, client and/or patient. 32 25 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 27 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 28 written approval to CONTRACTOR to maintain records in a single location, identified by 36 29 CONTRACTOR. 37 //: 1 30 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 31 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 32 information that is requested by the PRA request. 4 33 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 34 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 35 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 36 maintained by or for a covered entity that is:: 37 // 8 1 1. The medical records and billing records about individuals maintained by or for a covered 10 3 2. The enrollment, payment, claims adjudication, and case or medical management record 11 4 systems maintained by or for a health plan; or 12 5 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 6 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 7 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 8 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 9 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 10 or site visit. 18 11 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 12 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 13 requested. 22 14 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 15 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 16 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 17 regulation, and copy ADMINISTRATOR on such notifications. 26 18 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 19 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 20 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //21

RECORDS MANAGEMENT AND MAINTENANCE. 2 12 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 13 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 14 accordance with this Agreement and all applicable requirements. 5 15 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 16 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 17 records shall include, but not be limited to, individual patient charts and utilization review records. 8 18 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 19 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 20 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 21 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 22 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 23 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 24 principles of reimbursement and GAAP. 15 25 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 26 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 27 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 28 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 30 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 31 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 33 or state regulations and/or COUNTY policies. 24 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 36 and implement written record management procedures.. 37 // 27 1 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 2 years from the 28 termination of the contract, unless a longer period is required due to legal proceedings 3 such as litigations 29 and/or settlement of claims. 30 4 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (7)/ten (10) years 31 5 following discharge of the participant, client and/or patient. 32 6 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 7 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 8 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 9 written approval to CONTRACTOR to maintain records in a single location, identified by 36 10 CONTRACTOR. 37 //. 1 11 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 12 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 13 all information that is requested by the PRA request. 4 14 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 15 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 17 maintained by or for a covered entity that is: 8 18 1. The medical records and billing records about individuals maintained by or for a covered 10 20 2. The enrollment, payment, claims adjudication, and case or medical management record 11 21 systems maintained by or for a health plan; or 12 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 23 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 24 with the terms of this Agreement and common business practices. If documentation is retained 15 25 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 26 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 27 or site visit. 18 28 2. Provide auditor or other authorized individuals access to documents via a computer 19 29 terminal. 20 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 31 requested. 22 32 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 33 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 34 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 35 regulation, and copy ADMINISTRATOR on such notifications.. 36 // 37 // 26 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //4

RECORDS MANAGEMENT AND MAINTENANCE. 2 34 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 35 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 36 accordance with this Agreement Contract and all applicable requirements. 5 1 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 2 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 3 records shall include, but not be limited to, individual patient charts and utilization review records. 8 4 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 5 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 6 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 7 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 8 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 9 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 10 principles of reimbursement and GAAP. 15 11 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 12 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 13 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 14 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 15 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 16 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 17 PHI made in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to 18 the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of 19 federal 23 or state regulations and/or COUNTY policies. 24 20 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 21 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 22 and implement written record management procedures. 27 23 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 24 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 25 and/or settlement of claims. 30 26 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 27 following discharge of the participant, client and/or patient. 32 28 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 29 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 30 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 31 written approval to CONTRACTOR to maintain records in a single location, identified by 36 32 CONTRACTOR. 37 //. 1 33 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 34 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 35 information that is requested by the PRA request. 4 36 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 37 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 2 maintained by or for a covered entity that is: 8 3 1. The medical records and billing records about individuals maintained by or for a covered 10 5 2. The enrollment, payment, claims adjudication, and case or medical management record 11 6 systems maintained by or for a health plan; or 12 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 8 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 9 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 11 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 12 or site visit. 18 13 2. Provide auditor or other authorized individuals access to documents via a computer 19 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 19 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 20 or regulation, and copy ADMINISTRATOR on such notifications. 26 21 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 22 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 23 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //24

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 12 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 15 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 16 records shall include, but not be limited to, individual patient charts and utilization review records. 8 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 22 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 23 principles of reimbursement and GAAP. 15 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 27 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 29 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 30 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 31 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 32 regulations and/or COUNTY policies. 24 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 35 implement written record management procedures. 27 36 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 37 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 1 and/or settlement of claims. 30 2 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 3 discharge of the participant, client and/or patient. 32 4 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 5 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 6 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 7 written approval to CONTRACTOR to maintain records in a single location, identified by 36 8 CONTRACTOR. 37 //. 1 9 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 10 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 11 information that is requested by the PRA request. 4 12 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 13 participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request 14 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 15 for a covered entity that is: 8 16 1. The medical records and billing records about individuals maintained by or for a covered 10 18 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; orrecord 12 20 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 21 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 22 with the terms of this Agreement and common business practices. If documentation is retained 15 23 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 24 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 25 or site visit. 18 26 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 27 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 28 requested. 22 29 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 30 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 31 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 32 regulation, and copy ADMINISTRATOR on such notifications. 26 33 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 34 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 35 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //29

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, 37 this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 1 information that is requested by the PRA request. 4 2 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 3 participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request 4 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 5 for a covered entity that is: 8 6 1. The medical records and billing records about individuals maintained by or for a covered 10 8 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; orrecord 12 10 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 11 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with 12 the terms of this Agreement Contract and common business practices. If documentation is retained 15 electronically, 13 CONTRACTOR shall, in the event of an audit or site visit: 16 14 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 15 or site visit. 18 16 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 17 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 18 requested. 22 19 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security 20 of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII 21 and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, 22 and copy ADMINISTRATOR on such notifications. 26 23 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 24 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 25 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //26

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 19 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 34 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 36 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 37 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 1 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 2 or state regulations and/or COUNTY policies. 24 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 5 and implement written record management procedures. 27 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 8 and/or settlement of claims. 30 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 10 following discharge of the participant, client and/or patient. 32 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 12 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 14 written approval to CONTRACTOR to maintain records in a single location, identified by 36 15 CONTRACTOR. 37 //. 1 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 18 all information that is requested by the PRA request. 4 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 22 maintained by or for a covered entity that is: 8 23 1. The medical records and billing records about individuals maintained by or for a covered 10 25 2. The enrollment, payment, claims adjudication, and case or medical management record 11 26 systems maintained by or for a health plan; or 12 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 29 with the terms of this Agreement and common business practices. If documentation is retained 15 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 32 or site visit. 18 33 2. Provide auditor or other authorized individuals access to documents via a computer 19 34 terminal. 20 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 36 requested.. 37 // 22 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 4 or regulation, and copy ADMINISTRATOR on such notifications. 26 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 8 L. CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing 9 contractual services. Provider’s site NPIs must be kept until such minors have reached submitted to the age ADMINISTRATOR prior to 10 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 11 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 12 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 13 on file with ADMINISTRATOR in advance of twenty-five (25) yearsproviding services to Clients. It is the responsibility of 14 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 15 NPPES. Each contract site, or as well as every staff member that provides billable services, is responsible 16 for 32 minors that deliver babies while in custodynotifying the NPPES within 30 calendar days of any updates to personal information, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhich may 17 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 34 // 35 // 36 // 37 //18

RECORDS MANAGEMENT AND MAINTENANCE. 2 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 17 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 18 accordance with this Agreement and all applicable requirements. 5 19 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 20 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 21 records shall include, but not be limited to, individual patient charts and utilization review records. 8 22 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 23 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 24 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 25 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 26 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 27 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 28 principles of reimbursement and GAAP. 15 29 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 30 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 31 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 32 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 33 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 34 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 35 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 36 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 37 or state regulations and/or COUNTY policies. 24 1 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 2 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 3 and implement written record management procedures. 27 4 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 5 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 6 and/or settlement of claims. 30 7 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 8 following discharge of the participant, client and/or patient. 32 9 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 10 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 11 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 12 written approval to CONTRACTOR to maintain records in a single location, identified by 36 13 CONTRACTOR. 37 //. 1 14 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 15 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 16 all information that is requested by the PRA request. 4 17 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 18 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 19 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 20 maintained by or for a covered entity that is: 8 21 1. The medical records and billing records about individuals maintained by or for a covered 10 23 2. The enrollment, payment, claims adjudication, and case or medical management record 11 24 systems maintained by or for a health plan; or 12 25 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 26 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 27 with the terms of this Agreement and common business practices. If documentation is retained 15 28 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 29 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 30 or site visit. 18 31 2. Provide auditor or other authorized individuals access to documents via a computer 19 32 terminal. 20 33 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 34 requested. 22 35 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 36 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 37 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 1 or regulation, and copy ADMINISTRATOR on such notifications. 26 2 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 3 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 4 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 5 L. CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing 6 contractual services. Provider’s site NPIs must be kept until such minors have reached submitted to the age ADMINISTRATOR prior to 7 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 8 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 9 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 10 on file with ADMINISTRATOR in advance of twenty-five (25) yearsproviding services to Clients. It is the responsibility of 11 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 12 NPPES. Each contract site, or as well as every staff member that provides billable services, is responsible 13 for 32 minors that deliver babies while in custodynotifying the NPPES within 30 calendar days of any updates to personal information, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhich may 14 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 34 // 35 // 36 // 37 //15

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 19 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require.. 27 // 11 28 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 29 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 30 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 31 principles of reimbursement and GAAP. 15 32 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 33 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 34 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 35 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 36 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 37 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 1 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 2 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 3 or state regulations and/or COUNTY policies. 24 4 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 5 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 6 and implement written record management procedures. 27 7 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 8 years from the 28 termination of the contract, unless a longer period is required due to legal proceedings 9 such as litigations 29 and/or settlement of claims. 30 10 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (7)/ten (10) 11 years 31 following discharge of the participant, client and/or patient. 32 12 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 13 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 14 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 15 written approval to CONTRACTOR to maintain records in a single location, identified by 36 16 CONTRACTOR. 37 //. 1 17 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 18 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 19 all information that is requested by the PRA request. 4 20 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 21 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 22 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 23 maintained by or for a covered entity that is: 8 24 1. The medical records and billing records about individuals maintained by or for a covered 10 26 2. The enrollment, payment, claims adjudication, and case or medical management record 11 27 systems maintained by or for a health plan; or 12 28 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 29 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 30 with the terms of this Agreement and common business practices. If documentation is retained 15 31 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 32 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 33 or site visit. 18 34 2. Provide auditor or other authorized individuals access to documents via a computer 19 35 terminal. 20 36 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 37 requested. 22 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 4 or regulation, and copy ADMINISTRATOR on such notifications. 26 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //8

RECORDS MANAGEMENT AND MAINTENANCE. 2 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 6 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 7 accordance with this Agreement and all applicable requirements. 5 8 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 9 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 10 records shall include, but not be limited to, individual patient charts and utilization review records. 8 11 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 12 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 13 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 14 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 15 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 16 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 17 principles of reimbursement and GAAP. 15 18 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 19 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 20 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 21 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 22 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 23 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 24 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 25 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 26 or state regulations and/or COUNTY policies. 24 27 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 28 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 29 and implement written record management procedures. 27 30 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 31 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 32 and/or settlement of claims. 30 33 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 following 34 discharge of the participant, client and/or patient. 32 35 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 36 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 37 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 1 written approval to CONTRACTOR to maintain records in a single location, identified by 36 2 CONTRACTOR. 37 //. 1 3 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 4 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 5 all information that is requested by the PRA request. 4 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 9 maintained by or for a covered entity that is: 8 10 1. The medical records and billing records about individuals maintained by or for a covered 10 12 2. The enrollment, payment, claims adjudication, and case or medical management record 11 13 systems maintained by or for a health plan; or 12 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 16 with the terms of this Agreement and common business practices. If documentation is retained 15 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 19 or site visit. 18 20 2. Provide auditor or other authorized individuals access to documents via a computer 19 21 terminal. 20 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 23 requested. 22 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 26 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 27 or regulation, and copy ADMINISTRATOR on such notifications. 26 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 29 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 30 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 31 L. CONTRACTOR shall retain all client participant, client, and/or patient medical records for ten seven (107) 32 years 30 following discharge of the participant, client and/or patient, with the exception of non-non- 33 emancipated minors for 31 whom records must be kept until for at least one (1) year after such minors have 34 reached the age of twenty-five eighteen (2518) years, or for 32 minors that deliver babies while in custodyseven (7) years after the last date of service, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhichever is 35 longer. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records 7 records shall include, but not be limited to, individual patient charts and utilization review records.. 8 8 9 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 10 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 11 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 12 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 13 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 14 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 15 principles of reimbursement and GAAP. 15 16 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 17 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 18 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 19 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 21 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 22 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 23 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 24 regulations and/or COUNTY policies. 24 25 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 26 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 27 implement written record management procedures. 27 28 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 29 termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations 29 30 and/or settlement of claims. 30 31 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 32 discharge of the participant, client and/or patient. 32 33 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 34 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 35 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 36 written approval to CONTRACTOR to maintain records in a single location, identified by 36 37 CONTRACTOR. 37 //. 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 5 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 7 for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 19 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 20 requested. 22 21 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security 22 of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII 23 and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, 24 and copy ADMINISTRATOR on such notifications. 26 25 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //28

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 19 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement Contract and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 23 shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 34 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 36 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 37 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 1 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 2 or state regulations and/or COUNTY policies. 24 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 5 and implement written record management procedures. 27 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 8 and/or settlement of claims. 30 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 10 following discharge of the participant, client and/or patient. 32 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 12 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 14 written approval to CONTRACTOR to maintain records in a single location, identified by 36 15 CONTRACTOR. 37 //. 1 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 17 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 18 information that is requested by the PRA request. 4 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 22 maintained by or for a covered entity that is: 8 23 1. The medical records and billing records about individuals maintained by or for a covered 10 25 2. The enrollment, payment, claims adjudication, and case or medical management record 11 26 systems maintained by or for a health plan; or 12 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 29 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 32 or site visit. 18 33 2. Provide auditor or other authorized individuals access to documents via a computer 19 34 terminal. 20 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 36 requested.. 37 // 22 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 3 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 4 regulation, and copy ADMINISTRATOR on such notifications. 26 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 8 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 9 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //10

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient Client records shall be maintained in a secure 25 manner. CONTRACTOR shall 25 maintain participant, client, and/or patient Client records and must establish 26 and implement written record management procedures. 27 26 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 27 termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations 29 28 and/or settlement of claims. 30 29 E. CONTRACTOR shall retain all client and/or patient Client medical records for ten (10) years 31 following discharge of 30 the participant, client and/or patientClient. 32 31 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 32 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of OrangeOrange County. If 34 CONTRACTOR 33 is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to 34 CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 //. 1 35 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 36 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 37 information that is requested by the PRA request. 4 1 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients Clients 2 be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. 3 Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 4 1. The medical records and billing records about individuals maintained by or for a covered 10 6 2. The enrollment, payment, claims adjudication, and case or medical management record 11 7 systems maintained by or for a health plan; or 12 8 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 9 I. CONTRACTOR may retain client, and/or patient Client documentation electronically in accordance 14 with the terms of 10 this Agreement Contract and common business practices. If documentation is retained 15 electronically, 11 CONTRACTOR shall, in the event of an audit or site visit: 16 12 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 13 or site visit. 18 14 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 19 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 20 regulation, and copy ADMINISTRATOR on such notifications. 26 21 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 22 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 23 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //24

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever 13 nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with 14 Medicare 14 principles of reimbursement and GAAP.. 15 // 15 16 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 17 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the 18 medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in 19 accordance 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 21 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure 22 of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 23 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of 24 federal 23 or state regulations and/or COUNTY policies. 24 25 C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure 25 26 manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish 26 27 and implement written record management procedures. 27 28 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 29 termination of the contractContract, unless a longer period is required due to legal proceedings such as 30 litigations 29 and/or settlement of claims. 30 31 E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years 31 32 following discharge of the participant, client Client and/or patient. 32 33 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, 34 charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 19 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 34 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 36 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 37 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 1 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 2 or state regulations and/or COUNTY policies. 24 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 5 and implement written record management procedures. 27 6 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 8 and/or settlement of claims. 30 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 10 following discharge of the participant, client and/or patient. 32 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇12 billings, and revenues available at one (1) location within the limits of the County of Orange. If 34 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 14 written approval to CONTRACTOR to maintain records in a single location, identified by 36 15 CONTRACTOR. 37 //. 1 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 18 all information that is requested by the PRA request. 4 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 22 maintained by or for a covered entity that is: 8 23 1. The medical records and billing records about individuals maintained by or for a covered 10 25 2. The enrollment, payment, claims adjudication, and case or medical management record 11 26 systems maintained by or for a health plan; or 12 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 29 with the terms of this Agreement and common business practices. If documentation is retained 15 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 32 or site visit. 18 33 2. Provide auditor or other authorized individuals access to documents via a computer 19 34 terminal. 20 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 36 requested.. 37 // 22 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 3 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 4 regulation, and copy ADMINISTRATOR on such notifications. 26 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 8 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 9 billings, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //10

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 15 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 16 records shall include, but not be limited to, individual patient charts and utilization review records. 8 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 22 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 23 principles of reimbursement and GAAP. 15 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 27 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 29 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 30 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 31 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 32 or state regulations and/or COUNTY policies. 24 33 C. CONTRACTOR’s participant, client, and/or patient Client records shall be maintained in a secure 25 manner. CONTRACTOR 34 shall maintain participant, client, and/or patient Client records and must establish 26 and implement written record management procedures. 27 35 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 36 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 37 and/or settlement of claims. 30 1 E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years 31 2 following discharge of the participant, client and/or patientClient. 32 3 F. CONTRACTOR shall make records pertaining to the costs of services, participant Client fees, charges, 33 4 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 5 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 6 written approval to CONTRACTOR to maintain records in a single location, identified by 36 7 CONTRACTOR. 37 //. 1 8 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 9 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 10 all information that is requested by the PRA request. 4 11 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients 12 Clients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their 13 records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered 14 entity that is: 8 15 1. The medical records and billing records about individuals maintained by or for a covered 10 17 2. The enrollment, payment, claims adjudication, and case or medical management record 11 18 systems maintained by or for a health plan; or 12 19 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 20 I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance 14 21 with the terms of this Agreement and common business practices. If documentation is retained 15 22 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 23 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 24 or site visit. 18 25 2. Provide auditor or other authorized individuals access to documents via a computer 19 26 terminal. 20 27 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 28 requested. 22 29 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 30 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 31 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 32 or regulation, and copy ADMINISTRATOR on such notifications. 26 33 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 34 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 35 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 36 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 37 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //Orange.

RECORDS MANAGEMENT AND MAINTENANCE. 2 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 6 accordance with this Agreement Contract and all applicable requirements. 5 7 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 8 shall include, but not be limited to, individual patient charts and utilization review records. 8 9 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 10 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 14 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 15 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 16 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 17 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 18 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 19 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 20 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 12 this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement Contract and all applicable requirements. 5 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 15 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 records 16 shall include, but not be limited to, individual patient charts and utilization review records. 8 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 22 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 23 principles of reimbursement and GAAP. 15 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 27 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 29 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 30 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 31 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 32 regulations and/or COUNTY policies. 24 33 C. CONTRACTOR’s participant, client, and/or patient Client records shall be maintained in a secure 25 manner. CONTRACTOR shall 34 maintain participant, client, and/or patient Client records and must establish 26 and implement written record management procedures. 27 35 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 36 termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations 29 37 and/or settlement of claims. 30 1 E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years 31 following 2 discharge of the participant, client and/or patientClient. 32 3 F. CONTRACTOR shall make records pertaining to the costs of services, participant Client fees, charges, 33 4 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 5 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 6 written approval to CONTRACTOR to maintain records in a single location, identified by 36 7 CONTRACTOR. 37 //. 1 8 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 9 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 10 information that is requested by the PRA request. 4 11 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients Clients 12 be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. 13 Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 14 1. The medical records and billing records about individuals maintained by or for a covered 10 16 2. The enrollment, payment, claims adjudication, and case or medical management record 11 17 systems maintained by or for a health plan; or 12 18 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 19 I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance 14 20 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 21 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 22 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 23 or site visit. 18 24 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 26 requested. 22 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 29 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 30 regulation, and copy ADMINISTRATOR on such notifications. 26 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 34 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 35 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 15 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 16 records shall include, but not be limited to, individual patient charts and utilization review records. 8 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 22 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 23 principles of reimbursement and GAAP. 15 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 27 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 29 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 30 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 31 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 32 or state regulations and/or COUNTY policies. 24 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 35 and implement written record management procedures. 27 36 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 37 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 1 and/or settlement of claims. 30 2 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 3 following discharge of the participant, client and/or patient. 32 4 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 5 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 6 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 7 written approval to CONTRACTOR to maintain records in a single location, identified by 36 8 CONTRACTOR. 37 //. 1 9 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 10 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 11 all information that is requested by the PRA request. 4 12 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 13 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 14 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 15 maintained by or for a covered entity that is: 8 16 1. The medical records and billing records about individuals maintained by or for a covered 10 18 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; orrecord 12 20 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 21 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 22 with the terms of this Agreement and common business practices. If documentation is retained 15 23 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 24 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 25 or site visit. 18 26 2. Provide auditor or other authorized individuals access to documents via a computer 19 27 terminal. 20 28 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 29 requested. 22 30 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 31 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 32 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 33 or regulation, and copy ADMINISTRATOR on such notifications. 26 34 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 35 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 36 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 37 L. CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing 1 contractual services. Provider’s site NPIs must be kept until such minors have reached submitted to the age ADMINISTRATOR prior to 2 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 3 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 4 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 5 on file with ADMINISTRATOR in advance of twenty-five (25) yearsproviding services to Clients. It is the responsibility of 6 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 7 NPPES. Each contract site, or as well as every staff member that provides billable services, is responsible 8 for 32 minors that deliver babies while in custodynotifying the NPPES within 30 calendar days of any updates to personal information, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhich may 9 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 34 // 35 // 36 // 37 //10

RECORDS MANAGEMENT AND MAINTENANCE. 2 24 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 25 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 26 accordance with this Agreement and all applicable requirements. 5 27 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 28 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 29 records shall include, but not be limited to, individual patient charts and utilization review records. 8 30 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 31 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 32 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 33 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 34 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 35 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 36 principles of reimbursement and GAAP. 15 37 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 1 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 2 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 3 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 4 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 5 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 6 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 7 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 8 or state regulations and/or COUNTY policies. 24 9 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 10 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 11 and implement written record management procedures. 27 12 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 13 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 14 and/or settlement of claims. 30 15 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 16 following discharge of the participant, client and/or patient. 32 17 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 18 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 19 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 20 written approval to CONTRACTOR to maintain records in a single location, identified by 36 21 CONTRACTOR. 37 //. 1 22 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 23 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 24 all information that is requested by the PRA request. 4 25 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 26 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 27 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 28 maintained by or for a covered entity that is: 8 29 1. The medical records and billing records about individuals maintained by or for a covered 10 31 2. The enrollment, payment, claims adjudication, and case or medical management record 11 32 systems maintained by or for a health plan; or 12 33 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 34 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 35 with the terms of this Agreement and common business practices. If documentation is retained 15 36 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 37 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 1 or site visit. 18 2 2. Provide auditor or other authorized individuals access to documents via a computer 19 3 terminal. 20 4 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 5 requested. 22 6 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 7 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 8 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 9 or regulation, and copy ADMINISTRATOR on such notifications. 26 10 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy 11 and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR 12 shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. . 13 CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing contractual 14 services. Provider’s site NPIs must be kept until such minors have reached submitted to the age ADMINISTRATOR prior to rendering services 15 to Clients. Contractors providing direct or indirect services for State reporting must also submit 16 rendering (individual) provider NPIs to ADMINISTRATOR for each staff member providing Medi–Cal 17 billable services. Contractor reimbursement will not be processed unless NPIs are on file with 18 ADMINISTRATOR in advance of twenty-five (25) yearsproviding services to Clients. It is the responsibility of each contract 19 provider site and individual staff member that bills Medi–Cal to obtain an NPI from the NPPES. Each 20 contract site, or as well as every staff member that provides billable services, is responsible for 32 minors that deliver babies while in custodynotifying 21 the NPPES within 30 calendar days of any updates to personal information, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhich may include, but is 22 not limited to, worksite address, name changes, taxonomy code changes, etc. 34 // 35 // 36 // 37 //23

RECORDS MANAGEMENT AND MAINTENANCE. 2 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 22 accordance with this Agreement and all applicable requirements. 5 23 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 24 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 25 records shall include, but not be limited to, individual patient charts and utilization review records. 8 26 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 27 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 28 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 29 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 30 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 31 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 32 principles of reimbursement and GAAP. 15 33 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 34 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 35 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended.. 37 // 19 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 2 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 3 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 4 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 5 regulations and/or COUNTY policies. 24 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 8 implement written record management procedures. 27 9 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 10 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 11 and/or settlement of claims. 30 12 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 13 discharge of the participant, client and/or patient. 32 14 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 15 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 16 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 17 written approval to CONTRACTOR to maintain records in a single location, identified by 36 18 CONTRACTOR. 37 //. 1 19 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 20 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 21 information that is requested by the PRA request. 4 22 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 23 participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request 24 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 25 for a covered entity that is: 8 26 1. The medical records and billing records about individuals maintained by or for a covered 10 28 2. The enrollment, payment, claims adjudication, and case or medical management record 11 29 systems maintained by or for a health plan; or 12 30 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 31 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 32 with the terms of this Agreement and common business practices. If documentation is retained 15 33 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 34 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 35 or site visit. 18 36 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal.. 37 // 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 5 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 6 regulation, and copy ADMINISTRATOR on such notifications. 26 7 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 8 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 9 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 10 L. CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing contractual 11 services. Provider’s site NPIs must be kept until such minors have reached submitted to the age of twenty-five ADMINISTRATOR prior to rendering services to 12 Clients. Contractors providing direct or indirect services for State reporting must also submit rendering 13 (25individual) years, or provider NPIs to ADMINISTRATOR for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //each staff member providing Medi–Cal billable

RECORDS MANAGEMENT AND MAINTENANCE. 2 21 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 22 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 23 accordance with this Agreement and all applicable requirements. 5 24 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 25 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 26 records shall include, but not be limited to, individual patient charts and utilization review records. 8 27 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 28 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 29 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 30 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 31 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 32 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 33 principles of reimbursement and GAAP. 15 34 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 35 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 36 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 37 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 2 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 3 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 4 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 5 or state regulations and/or COUNTY policies. 24 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 8 and implement written record management procedures. 27 9 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 10 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 11 and/or settlement of claims. 30 12 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 13 following discharge of the participant, client and/or patient. 32 14 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 15 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 16 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 17 written approval to CONTRACTOR to maintain records in a single location, identified by 36 18 CONTRACTOR. 37 //. 1 19 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 20 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 21 all information that is requested by the PRA request. 4 22 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 23 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 24 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 25 maintained by or for a covered entity that is: 8 26 1. The medical records and billing records about individuals maintained by or for a covered 10 28 2. The enrollment, payment, claims adjudication, and case or medical management record 11 29 systems maintained by or for a health plan; or 12 30 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 31 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 32 with the terms of this Agreement and common business practices. If documentation is retained 15 33 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 34 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 35 or site visit. 18 36 2. Provide auditor or other authorized individuals access to documents via a computer 19 37 terminal. 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 5 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 6 or regulation, and copy ADMINISTRATOR on such notifications. 26 7 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 8 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 9 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 10 L. CONTRACTOR shall retain all client and/or patient medical records obtain an NPI for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors each site identified as a location for 31 whom records providing 11 contractual services. Provider’s site NPIs must be kept until such minors have reached submitted to the age ADMINISTRATOR prior to 12 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 13 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 14 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 15 on file with ADMINISTRATOR in advance of twenty-five (25) yearsproviding services to Clients. It is the responsibility of 16 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 17 NPPES. Each contract site, or as well as every staff member that provides billable services, is responsible 18 for 32 minors that deliver babies while in custodynotifying the NPPES within 30 calendar days of any updates to personal information, records will be retained until the child reaches the age of 33 twenty-five (25) yearswhich may 19 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 34 // 35 // 36 // 37 //20

RECORDS MANAGEMENT AND MAINTENANCE. 2 12 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 13 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 14 accordance with this Agreement and all applicable requirements. 5 15 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 16 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 17 records shall include, but not be limited to, individual patient charts and utilization review records. 8 18 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 19 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 20 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 21 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 22 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 23 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 24 principles of reimbursement and GAAP. 15 25 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 26 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 27 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 28 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 30 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 31 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 33 or state regulations and/or COUNTY policies. 24 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 36 and implement written record management procedures.. 37 // DocuSign Envelope ID: 078BF8D6-5F2D-4A09-9496-B48306DEE156 27 1 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 2 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 3 and/or settlement of claims. 30 4 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 following 5 discharge of the participant, client and/or patient. 32 6 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 7 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 8 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 9 written approval to CONTRACTOR to maintain records in a single location, identified by 36 10 CONTRACTOR. 37 //. 1 11 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 12 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 13 all information that is requested by the PRA request. 4 14 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 15 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 17 maintained by or for a covered entity that is: 8 18 1. The medical records and billing records about individuals maintained by or for a covered 10 20 2. The enrollment, payment, claims adjudication, and case or medical management record 11 21 systems maintained by or for a health plan; or 12 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 23 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 24 with the terms of this Agreement and common business practices. If documentation is retained 15 25 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 26 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 27 or site visit. 18 28 2. Provide auditor or other authorized individuals access to documents via a computer 19 29 terminal. 20 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 31 requested. 22 32 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 33 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 34 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 35 or regulation, and copy ADMINISTRATOR on such notifications.. 36 // 37 // DocuSign Envelope ID: 078BF8D6-5F2D-4A09-9496-B48306DEE156 26 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 4 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 5 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //6

RECORDS MANAGEMENT AND MAINTENANCE. 2 29 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 30 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 31 accordance with this Agreement and all applicable requirements. 5 32 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 33 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 34 records shall include, but not be limited to, individual patient charts and utilization review records. 8 35 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 36 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 37 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 1 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 2 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 3 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 4 principles of reimbursement and GAAP. 15 5 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 6 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 7 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 8 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 9 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 10 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 11 PHI made in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to 12 the 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of 13 federal 23 or state regulations and/or COUNTY policies. 24 14 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 15 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 16 and implement written record management procedures. 27 17 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 18 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 19 and/or settlement of claims. 30 20 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 21 following discharge of the participant, client and/or patient. 32 22 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 23 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 24 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 25 written approval to CONTRACTOR to maintain records in a single location, identified by 36 26 CONTRACTOR. 37 //. 1 27 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 28 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 29 all information that is requested by the PRA request. 4 30 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 31 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 32 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 33 maintained by or for a covered entity that is: 8 34 1. The medical records and billing records about individuals maintained by or for a covered 10 36 2. The enrollment, payment, claims adjudication, and case or medical management record 11 37 systems maintained by or for a health plan; or 12 1 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 2 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 3 with the terms of this Agreement and common business practices. If documentation is retained 15 4 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 5 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 6 or site visit. 18 7 2. Provide auditor or other authorized individuals access to documents via a computer 19 8 terminal. 20 9 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 10 requested. 22 11 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 12 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 13 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 14 or regulation, and copy ADMINISTRATOR on such notifications. 26 15 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 16 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 17 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //18

RECORDS MANAGEMENT AND MAINTENANCE. 2 21 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 22 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 23 accordance with this Agreement Contract and all applicable requirements. 5 24 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 25 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such 7 26 records shall include, but not be limited to, individual patient charts and utilization review records. 8 27 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 28 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 29 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 30 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 31 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 32 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 33 principles of reimbursement and GAAP. 15 34 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 35 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 36 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 37 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 2 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 3 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 4 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 5 or state regulations and/or COUNTY policies. 24 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 8 and implement written record management procedures. 27 9 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 10 termination of the contractContract, unless a longer period is required due to legal proceedings such as 11 litigations 29 and/or settlement of claims. 30 12 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 13 following discharge of the participant, client and/or patient. 32 14 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 15 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of OrangeOrange County. If 34 16 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 17 written approval to CONTRACTOR to maintain records in a single location, identified by 36 18 CONTRACTOR. 37 //. 1 19 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 20 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all 21 information that is requested by the PRA request. 4 22 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 23 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 24 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 25 maintained by or for a covered entity that is: 8 26 1. The medical records and billing records about individuals maintained by or for a covered 10 28 2. The enrollment, payment, claims adjudication, and case or medical management record 11 29 systems maintained by or for a health plan; or 12 30 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 31 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 32 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 33 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 34 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 35 or site visit. 18 36 2. Provide auditor or other authorized individuals access to documents via a computer 19 37 terminal. 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 5 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 6 or regulation, and copy ADMINISTRATOR on such notifications. 26 7 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 8 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 9 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 10 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 11 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange County. 34 // 35 // 36 // 37 //12

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 15 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 16 records shall include, but not be limited to, individual patient charts and utilization review records. 8 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 22 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 23 principles of reimbursement and GAAP. 15 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 27 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 29 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 30 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 31 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 32 or state regulations and/or COUNTY policies. 24 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 35 and implement written record management procedures.. 36 // 37 // 27 1 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years years from 2 the 28 termination of the contract, unless a longer period is required due to legal proceedings such as 3 litigations 29 and/or settlement of claims. 30 4 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 5 following discharge of the participant, client and/or patient, or as otherwise required by applicable 6 federal or state law. 32 7 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 8 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 9 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 10 written approval to CONTRACTOR to maintain records in a single location, identified by 36 11 CONTRACTOR. 37 //. 1 12 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 13 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 14 all information that is requested by the PRA request. 4 15 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 16 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 17 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 18 maintained by or for a covered entity that is: 8 19 1. The medical records and billing records about individuals maintained by or for a covered 10 21 2. The enrollment, payment, claims adjudication, and case or medical management record 11 22 systems maintained by or for a health plan; or 12 23 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 24 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 25 with the terms of this Agreement and common business practices. If documentation is retained 15 26 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 27 1. Have documents readily available within twenty-four three (243) hour business days of receiving notice of a 28 scheduled audit 17 or site visit. 18 29 2. Provide auditor or other authorized individuals access to documents via a computer 19 30 terminal. 20 31 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 32 requested. 22 33 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 34 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 35 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 36 or regulation, and copy ADMINISTRATOR on such notifications.. 37 // 26 1 K. CONTRACTOR may be required to pay any shall bear the costs associated with a Breach of privacy and/or 27 security of PII 2 and/or PHIPHI that is caused by CONTRACTOR and that COUNTY incurs in addressing such Breach and 3 consequences thereof, including but not limited to the costs of investigation, notification, remediation, documentation or other 4 costs associated with addressing the Breach. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //5

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient Client records shall be maintained in a secure 25 manner. CONTRACTOR shall 25 maintain participant, client, and/or patient Client records and must establish 26 and implement written record management procedures. 27 26 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 27 termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations 29 28 and/or settlement of claims. 30 29 E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years 31 following 30 discharge of the participant, client and/or patientClient. 32 31 F. CONTRACTOR shall make records pertaining to the costs of services, participant Client fees, charges, 33 32 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 33 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 34 written approval to CONTRACTOR to maintain records in a single location, identified by 36 35 CONTRACTOR. 36 // 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that Clients 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. 6 Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 7 1. The medical records and billing records about individuals maintained by or for a covered 10 9 2. The enrollment, payment, claims adjudication, and case or medical management record 11 10 systems maintained by or for a health plan; or 12 11 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 12 I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance 14 13 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 14 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 15 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 16 or site visit. 18 17 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 18 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 19 requested. 22 20 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 21 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 22 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 23 regulation, and copy ADMINISTRATOR on such notifications. 26 24 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 25 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 26 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 27 L. CONTRACTOR shall retain all client and/or make records pertaining to the costs of services, patient medical records for ten fees, charges, 28 ▇▇▇▇▇▇▇▇, and revenues available at one (101) years 30 following discharge location within the limits of the client and/or patient, with the exception County of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) yearsOrange. 34 // 35 // 36 // 37 //29

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTORCONTRACTOR shall not utilize information and/or data received from COUNTY, its officersor arising 19 out of, agentsor developed, employees and subcontractors shall, throughout the term 3 as a result of this Agreement for any purpose other than performance of services 20 under this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 34 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 36 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 37 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 County of Orange Contract MA-042-21010167 1 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 2 or state regulations and/or COUNTY policies. 24 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 5 and implement written record management procedures. 27 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 8 and/or settlement of claims. 30 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following 10 discharge of the participant, client and/or patient. 32 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 12 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 14 written approval to CONTRACTOR to maintain records in a single location, identified by 36 15 CONTRACTOR. 37 //. 1 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 18 all information that is requested by the PRA request. 4 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 22 maintained by or for a covered entity that is: 8 23 1. The medical records and billing records about individuals maintained by or for a covered 10 25 2. The enrollment, payment, claims adjudication, and case or medical management record 11 26 systems maintained by or for a health plan; or 12 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 29 with the terms of this Agreement and common business practices. If documentation is retained 15 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 32 or site visit. 18 33 2. Provide auditor or other authorized individuals access to documents via a computer 19 34 terminal. 20 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 36 requested. 22 37 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 County of Orange Contract MA-042-21010167 1 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 2 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 3 regulation, and copy ADMINISTRATOR on such notifications. 26 4 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 19 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 20 accordance with this Agreement and all applicable requirements. 5 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 7 23 records shall include, but not be limited to, individual patient charts and utilization review records. 8 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 29 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 14 30 principles of reimbursement and GAAP. 15 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 34 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 36 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 37 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 1 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //state

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 3 of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement Contract and all applicable requirements. 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 6 which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records 7 records shall include, but not be limited to, individual patient charts and utilization review records. 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 13 claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare 14 principles of reimbursement and GAAP. 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 18 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 20 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 22 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or state 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 28 termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (107) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, 5 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or 7 for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 19 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 20 requested. 22 21 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 22 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security 23 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or 24 regulation, and copy ADMINISTRATOR on such notifications. 26 25 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //28