Common use of RECORDS MANAGEMENT AND MAINTENANCE Clause in Contracts

RECORDS MANAGEMENT AND MAINTENANCE. 26 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 accordance with this Agreement and all applicable requirements. 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 or state regulations and/or COUNTY policies. 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 36 implement written record management procedures. 37 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 litigations and/or settlement of claims. 3 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 clients, participants, clients and/or patients be provided the right to access or receive a copy of their DRS 7 and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 maintained by or for a covered entity that is: 9 1. The medical records and billing records about individuals maintained by or for a covered 11 2. The enrollment, payment, claims adjudication, and case or medical management record 12 systems maintained by or for a health plan; or 13 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance with the terms of this Agreement and common business practices. If documentation is retained 16 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit or 18 site visit. 19 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32

RECORDS MANAGEMENT AND MAINTENANCE. 26 35 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 36 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 37 accordance with this Agreement and all applicable requirements. 29 . 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 2 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 3 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 4 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 5 violation of federal 33 or state regulations and/or COUNTY policies. 34 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 8 and 36 implement written record management procedures. 37 9 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 10 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 11 litigations and/or settlement of claims. 3 12 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 13 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 14 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 15 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 17 maintained by or for a covered entity that is: 9 18 1. The medical records and billing records about individuals maintained by or for a covered 11 20 2. The enrollment, payment, claims adjudication, and case or medical management record 12 21 systems maintained by or for a health plan; or 13 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 23 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 24 with the terms of this Agreement and common business practices. If documentation is retained 16 25 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 26 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 27 or 18 site visit. 19 28 2. Provide auditor or other authorized individuals access to documents via a computer 29 terminal. 20 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 31 requested. 22 32 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 33 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 34 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 35 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 36 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 37 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 . 1 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 2 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 3 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 4 (18) years, or for seven (7) years after the last date of service, whichever is longer. 325

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 27 21 this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement Contract and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 30 24 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 31 25 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall mitigate to the 32 26 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 27 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish and 36 30 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 clients37 Clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 maintained 2 by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, clientClient, and/or patient documentation electronically in 15 accordance 9 with the terms of this Agreement Contract and common business practices. If documentation is retained 16 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit or 18 12 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 20 14 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 15 requested. 22 16 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 17 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 18 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 19 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 20 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 21 J. CONTRACTOR shall retain all participant, client Client and/or patient medical records for seven (7) 29 years 22 following discharge of the participant, client Client and/or patient, with the exception of non-emancipated 30 minors for whom 23 records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) 24 years, or for seven (7) years after the last date of service, whichever is longer. 3225

RECORDS MANAGEMENT AND MAINTENANCE. 26 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 6 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 7 accordance with this Agreement and all applicable requirements. 29 8 B. CONTRACTOR shall implement and maintain administrative, technical and physical 9 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 10 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 11 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 12 violation of federal 33 or state regulations and/or COUNTY policies. 34 13 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 14 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 15 and 36 implement written record management procedures. 37 16 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 17 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 18 litigations and/or settlement of claims. 3 19 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 20 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 21 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 22 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 23 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 24 maintained by or for a covered entity that is: 9 25 1. The medical records and billing records about individuals maintained by or for a covered 11 27 2. The enrollment, payment, claims adjudication, and case or medical management record 12 28 systems maintained by or for a health plan; or 13 29 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 30 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 31 with the terms of this Agreement and common business practices. If documentation is retained 16 32 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 33 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 34 or 18 site visit. 19 35 2. Provide auditor or other authorized individuals access to documents via a computer 36 terminal.. 37 // 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 5 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 6 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 7 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 8 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 9 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 10 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 11 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 12 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3213

RECORDS MANAGEMENT AND MAINTENANCE. 26 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 27 3 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 4 accordance with this Agreement and all applicable requirements. 29 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 30 6 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 31 7 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall mitigate to the 32 8 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 or 9 state regulations and/or COUNTY policies. 34 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 36 12 implement written record management procedures. 37 13 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 14 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 15 litigations and/or settlement of claims. 3 16 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 17 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 19 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 maintained 21 by or for a covered entity that is: 9 22 1. The medical records and billing records about individuals maintained by or for a covered 11 24 2. The enrollment, payment, claims adjudication, and case or medical management record 12 25 systems maintained by or for a health plan; or 13 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 16 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit or 18 31 site visit. 19 32 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 20 33 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 34 requested. 22 35 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security 36 of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 email or 37 fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 1 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay 3 any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 4 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years following 5 discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for whom records must 6 be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven 7 (7) years after the last date of service, whichever is longer. 328

RECORDS MANAGEMENT AND MAINTENANCE. 26 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 4 accordance with this Agreement and all applicable requirements. 29 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of federal 33 or state regulations and/or COUNTY policies... 34 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 36 implement written record management procedures. 37 13 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 14 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 15 litigations and/or settlement of claims. 3 16 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 17 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 19 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 21 maintained by or for a covered entity that is: 9 22 1. The medical records and billing records about individuals maintained by or for a covered 11 24 2. The enrollment, payment, claims adjudication, and case or medical management record 12 25 systems maintained by or for a health plan; or 13 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 16 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 18 site visit. 19 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 20 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 35 requested.. 36 // 37 // 22 1 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 3 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 4 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 7 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 8 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 9 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 10 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3211

RECORDS MANAGEMENT AND MAINTENANCE. 26 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 13 accordance with this Agreement and all applicable requirements. 29 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 15 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 16 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 17 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 18 violation of federal 33 or state regulations and/or COUNTY policies. 34 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 21 and 36 implement written record management procedures. 37 22 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 23 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 24 litigations and/or settlement of claims. 3 25 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 28 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 30 maintained by or for a covered entity that is: 9 31 1. The medical records and billing records about individuals maintained by or for a covered 11 33 2. The enrollment, payment, claims adjudication, and case or medical management record 12 34 systems maintained by or for a health plan; or 13 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 36 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 37 with the terms of this Agreement and common business practices. If documentation is retained 16 34 of 47 R:\BH K MGMT\BH VENDOR FOLDER(S)\CYS\WYS02 - CYBH BHOP\FY 2021-22\MA-042-19010161_WESTERN YOUTH SERVICES_BHOP_FY18-21 REDLINE AMEND 3.DOC WYS02BHKK21 1 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 2 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 3 or 18 site visit. 19 4 2. Provide auditor or other authorized individuals access to documents via a computer 5 terminal. 20 6 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 7 requested. 22 8 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 9 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 10 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 11 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 12 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 13 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 14 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 15 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 16 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 17 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3218

RECORDS MANAGEMENT AND MAINTENANCE. 26 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 13 accordance with this Agreement and all applicable requirements. 29 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 15 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 16 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 17 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 18 violation of federal 33 or state regulations and/or COUNTY policies. 34 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 21 and 36 implement written record management procedures. 37 22 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 23 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 24 litigations and/or settlement of claims. 3 25 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 28 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 30 maintained by or for a covered entity that is: 9 31 1. The medical records and billing records about individuals maintained by or for a covered 11 33 2. The enrollment, payment, claims adjudication, and case or medical management record 12 34 systems maintained by or for a health plan; or 13 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 36 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 37 with the terms of this Agreement and common business practices. If documentation is retained 16 33 of 42 1 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 2 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 3 or 18 site visit. 19 4 2. Provide auditor or other authorized individuals access to documents via a computer 5 terminal. 20 6 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 7 requested. 22 8 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 9 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 10 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 11 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 12 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 13 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 14 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 15 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 16 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 17 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3218

RECORDS MANAGEMENT AND MAINTENANCE. 26 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 27 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 accordance with this Agreement and all applicable requirements. 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical 30 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 31 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 32 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 33 violation of federal 33 or state regulations and/or COUNTY policies. 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 36 and 36 implement written record management procedures.. 37 // 37 1 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 2 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 3 litigations and/or settlement of claims. 3 4 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 5 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 6 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 7 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 9 maintained by or for a covered entity that is: 9 10 1. The medical records and billing records about individuals maintained by or for a covered 11 12 2. The enrollment, payment, claims adjudication, and case or medical management record 12 13 systems maintained by or for a health plan; or 13 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 15 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 16 with the terms of this Agreement and common business practices. If documentation is retained 16 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 18 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 19 or 18 site visit. 19 20 2. Provide auditor or other authorized individuals access to documents via a computer 21 terminal. 20 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 23 requested. 22 24 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 25 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 26 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 27 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 28 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 29 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 30 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 31 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 32 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 33 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3234 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 21 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 24 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 25 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 26 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 27 violation of federal 33 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 30 and 36 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 37 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 2 maintained by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 9 accordance with the terms of this Agreement and common business practices. If documentation is 10 retained 16 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 12 or 18 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 23 J. CONTRACTOR shall retain all participant, client client, and/or patient medical records for seven (7) 29 24 years following discharge of the participant, client and/or patient, with the exception of non-non- 25 emancipated 30 minors for whom records must be kept for at least one (1) year after such minors have 26 reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is 27 longer. 28 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 29 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 30 accordance with this Agreement and all applicable requirements. 31 1. 32CONTRACTOR shall maintain records that are adequate to substantiate the services for 32 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 33 records shall include, but not be limited to, individual patient charts and utilization review records. 34 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 35 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 36 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 37 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 1 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 2 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 3 principles of reimbursement and GAAP. 4 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 5 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 6 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 7 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 8 B. CONTRACTOR shall implement and maintain administrative, technical and physical 9 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 10 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 11 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 12 or state regulations and/or COUNTY policies. 13 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 14 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 15 and implement written record management procedures. 16 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 17 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 18 and/or settlement of claims. 19 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 20 following discharge of the participant, client and/or patient. 21 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 22 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. If 23 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 24 written approval to CONTRACTOR to maintain records in a single location, identified by 25 CONTRACTOR. 26 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 27 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 28 all information that is requested by the PRA request. 29 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 30 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 31 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 32 maintained by or for a covered entity that is: 33 1. The medical records and billing records about individuals maintained by or for a covered 35 2. The enrollment, payment, claims adjudication, and case or medical management record 36 systems maintained by or for a health plan; or 37 // 1 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 2 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 3 with the terms of this Agreement and common business practices. If documentation is retained 4 electronically, CONTRACTOR shall, in the event of an audit or site visit: 5 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 6 or site visit. 7 2. Provide auditor or other authorized individuals access to documents via a computer 8 terminal. 9 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 10 requested. 11 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 12 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 13 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 14 or regulation, and copy ADMINISTRATOR on such notifications. 15 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 16 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 17 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 18

RECORDS MANAGEMENT AND MAINTENANCE. 26 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 17 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 18 accordance with this Agreement and all applicable requirements. 29 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 22 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 23 violation of federal 33 or state regulations and/or COUNTY policies. 34 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 36 implement written record management procedures. 37 27 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 28 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 29 litigations and/or settlement of claims. 3 30 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 31 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 32 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 33 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 34 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 35 maintained by or for a covered entity that is: 9 36 1. The medical records and billing records about individuals maintained by or for a covered 11 1 2. The enrollment, payment, claims adjudication, and case or medical management record 12 2 systems maintained by or for a health plan; or 13 3 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 4 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 5 with the terms of this Agreement and common business practices. If documentation is retained 16 6 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 7 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 8 or 18 site visit. 19 9 2. Provide auditor or other authorized individuals access to documents via a computer 10 terminal. 20 11 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 12 requested. 22 13 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 14 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 15 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 16 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 17 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 18 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 19 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 20 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 21 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 22 (18) years, or for seven (7) years after the last date of service, whichever is longer. 23 K. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 24 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 25 CONTRACTOR. 26 L. CONTRACTOR may be required to retain all records involving litigation proceedings and 27 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 28 M. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 29 of, this Agreement, within forty-eight (48) hours. 32CONTRACTOR shall provide ADMINISTRATOR 30 all information that is requested by the PRA request. 31 “A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 32 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 33 accordance with this Agreement and all applicable requirements. 34 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 37 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 3 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 7 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 21 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 24 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 25 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 26 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 27 violation of federal 33 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 30 and 36 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, 35 charges, 4 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 37 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 2 maintained by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 9 with the terms of this Agreement and common business practices. If documentation is retained 16 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 12 or 18 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 23 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 24 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 25 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 26 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3227

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors subcontractor shall, throughout the term of 27 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 24 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 25 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 26 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 27 violation of federal 33 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 30 and 36 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 37 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 2 maintained by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 9 with the terms of this Agreement and common business practices. If documentation is retained 16 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 12 or 18 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 23 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 24 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 25 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 26 (18) years, or for seven (7) years after the last date of service, whichever is longer. 32A. CONTRACTOR, 27 its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare,

RECORDS MANAGEMENT AND MAINTENANCE. 26 3 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 4 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 5 accordance with this Agreement and all applicable requirements. 29 6 B. CONTRACTOR shall implement and maintain administrative, technical and physical 7 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 8 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 9 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 10 violation of federal 33 or state regulations and/or COUNTY policies. 34 11 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 12 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 13 and 36 implement written record management procedures. 37 14 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 15 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 16 litigations and/or settlement of claims. 3 17 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 18 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 19 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 20 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 22 maintained by or for a covered entity that is: 9 23 1. The medical records and billing records about individuals maintained by or for a covered 11 25 2. The enrollment, payment, claims adjudication, and case or medical management record 12 26 systems maintained by or for a health plan; or 13 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 28 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 29 accordance with the terms of this Agreement and common business practices. If documentation is 30 retained 16 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 31 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 32 or 18 site visit. 19 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 20 36 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 37 requested. 22 1 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 3 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 4 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 7 J. CONTRACTOR shall retain all participant, client client, and/or patient medical records for seven (7) 29 8 years following discharge of the participant, client and/or patient, with the exception of non-non- 9 emancipated 30 minors for whom records must be kept for at least one (1) year after such minors have 10 reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is 11 longer. 3212

RECORDS MANAGEMENT AND MAINTENANCE. 26 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 4 accordance with this Agreement and all applicable requirements. 29 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of federal 33 or state regulations and/or COUNTY policies. 34 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 36 implement written record management procedures. 37 13 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 14 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 15 litigations and/or settlement of claims. 3 16 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 17 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 19 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 21 maintained by or for a covered entity that is: 9 22 1. The medical records and billing records about individuals maintained by or for a covered 11 24 2. The enrollment, payment, claims adjudication, and case or medical management record 12 25 systems maintained by or for a health plan; or 13 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 16 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 18 site visit. 19 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 20 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 35 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 36 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 37 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 1 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 4 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 5 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 6 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 7 (18) years, or for seven (7) years after the last date of service, whichever is longer. 328

RECORDS MANAGEMENT AND MAINTENANCE. 26 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 13 accordance with this Agreement and all applicable requirements. 29 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 15 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 16 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 17 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 18 violation of federal 33 or state regulations and/or COUNTY policies. 34 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 21 and 36 implement written record management procedures. 37 22 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 23 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 24 litigations and/or settlement of claims. 3 25 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 28 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 30 maintained by or for a covered entity that is: 9 31 1. The medical records and billing records about individuals maintained by or for a covered 11 33 2. The enrollment, payment, claims adjudication, and case or medical management record 12 34 systems maintained by or for a health plan; or 13 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 36 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 37 with the terms of this Agreement and common business practices. If documentation is retained 16 1 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 2 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit or 18 3 site visit. 19 4 2. Provide auditor or other authorized individuals access to documents via a computer 5 terminal. 20 6 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 7 requested. 22 8 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 9 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 10 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 11 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 12 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 13 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 14 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 15 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 16 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 17 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3218

RECORDS MANAGEMENT AND MAINTENANCE. 26 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 4 accordance with this Agreement and all applicable requirements. 29 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of federal 33 or state regulations and/or COUNTY policies. 34 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 36 implement written record management procedures. 37 13 D. CONTRACTOR shall retain all financial records for a minimum of seven ten (710) years from the 1 14 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 15 litigations and/or settlement of claims. 3 16 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 17 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 19 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 21 maintained by or for a covered entity that is: 9 22 1. The medical records and billing records about individuals maintained by or for f or a covered 11 24 2. The enrollment, payment, claims adjudication, and case or medical management record 12 25 systems maintained by or for a health plan; or 13 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 16 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 18 site visit. 19 32 2. Provide auditor or other authorized individuals access to documents via a computer comp uter 33 terminal. 20 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 35 requested.. 36 // 37 // 22 1 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 3 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 4 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 7 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven ten (710) 29 years 8 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 9 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 10 (18) years, or for seven ten (710) years after the last date of service, whichever is longer. 3211

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term t erm 21 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 24 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 25 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 26 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 27 violation of federal 33 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 30 and 36 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven ten (710) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 37 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 2 maintained by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for f or a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 9 with the terms of this Agreement and common business practices. If documentation is retained 16 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 12 or 18 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 23 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven ten (710) 29 years 24 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 non -emancipated minors for 25 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 26 (18) years, or for seven ten (710) years after the last date of service, whichever is longer. 3227

RECORDS MANAGEMENT AND MAINTENANCE. 26 17 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 18 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 19 accordance with this Agreement and all applicable requirements. 29 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical 21 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 22 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 23 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 24 violation of federal 33 or state regulations and/or COUNTY policies. 34 25 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 26 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 27 and 36 implement written record management procedures. 37 28 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 29 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 30 litigations and/or settlement of claims. 3 31 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, 32 charges, 4 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 33 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 34 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 35 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 36 maintained by or for a covered entity that is:: 37 // 9 1 1. The medical records and billing records about individuals maintained by or for a covered 11 3 2. The enrollment, payment, claims adjudication, and case or medical management record 12 4 systems maintained by or for a health plan; or 13 5 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 6 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 7 with the terms of this Agreement and common business practices. If documentation is retained 16 8 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 9 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 10 or 18 site visit. 19 11 2. Provide auditor or other authorized individuals access to documents via a computer 12 terminal. 20 13 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 14 requested. 22 15 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 16 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 17 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 18 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 19 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 20 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 21 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 22 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 23 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 24 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3225

RECORDS MANAGEMENT AND MAINTENANCE. 26 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 21 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 22 accordance with this Agreement and all applicable requirements. 29 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 24 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 25 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 26 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 27 violation of federal 33 or state regulations and/or COUNTY policies. 34 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 30 and 36 implement written record management procedures. 37 31 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 32 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 33 litigations and/or settlement of claims. 3 34 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 35 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 37 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 2 maintained by or for a covered entity that is: 9 3 1. The medical records and billing records about individuals maintained by or for a covered 11 5 2. The enrollment, payment, claims adjudication, and case or medical management record 12 6 systems maintained by or for a health plan; or 13 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 9 accordance with the terms of this Agreement and common business practices. If documentation is 10 retained 16 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 12 or 18 site visit. 19 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 20 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 16 requested. 22 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 23 J. CONTRACTOR shall retain all participant, client client, and/or patient medical records for seven (7) 29 24 years following discharge of the participant, client and/or patient, with the exception of non-non- 25 emancipated 30 minors for whom records must be kept for at least one (1) year after such minors have 26 reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is 27 longer. 3228

RECORDS MANAGEMENT AND MAINTENANCE. 26 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 6 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 7 accordance with this Agreement and all applicable requirements. 29 8 B. CONTRACTOR shall implement and maintain administrative, technical and physical 9 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 10 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 11 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 12 violation of federal 33 or state regulations and/or COUNTY policies. 34 13 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 14 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 15 and 36 implement written record management procedures. 37 16 D. CONTRACTOR shall retain all financial records for a minimum of seven ten (710) years from the 1 17 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 18 litigations and/or settlement of claims. 3 19 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 20 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 21 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 22 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 23 request addendum to their records. Title 45 CFR §164.501164 .501, defines DRS as a group of records 8 24 maintained by or for a covered entity that is: 9 25 1. The medical records and billing records about individuals maintained by or for f or a covered 11 27 2. The enrollment, payment, claims adjudication, and case or medical management record 12 28 systems maintained by or for a health plan; or 13 29 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 30 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 31 with the terms of this Agreement and common business practices. If documentation is retained 16 32 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 33 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 34 or 18 site visit. 19 35 2. Provide auditor or other authorized individuals access to documents via a computer 36 terminal.. 37 // 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 5 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 6 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 7 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 8 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 9 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven ten (710) 29 years 10 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 non -emancipated minors for 11 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32eighteen

RECORDS MANAGEMENT AND MAINTENANCE. 26 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 6 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 7 accordance with this Agreement and all applicable requirements. 29 8 B. CONTRACTOR shall implement and maintain administrative, technical and physical 9 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 10 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 11 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 12 violation of federal 33 or state regulations and/or COUNTY policies. 34 13 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 14 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 15 and 36 implement written record management procedures. 37 16 D. CONTRACTOR shall retain all financial records for a minimum of seven ten (710) years from the 1 17 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 18 litigations and/or settlement of claims. 3 19 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 20 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 21 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 22 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 23 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 24 maintained by or for a covered entity that is: 9 25 1. The medical records and billing records about individuals maintained by or for f or a covered 11 27 2. The enrollment, payment, claims adjudication, and case or medical management record 12 28 systems maintained by or for a health plan; or 13 29 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 30 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 31 with the terms of this Agreement and common business practices. If documentation is retained 16 32 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 33 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 34 or 18 site visit. 19 35 2. Provide auditor or other authorized individuals access to documents via a computer 36 terminal.. 37 // 20 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 2 requested. 22 3 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 4 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 5 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 6 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 and/ or 7 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 8 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 9 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven ten (710) 29 years 10 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 non -emancipated minors for 11 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32eighteen

RECORDS MANAGEMENT AND MAINTENANCE. 26 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 13 accordance with this Agreement and all applicable requirements. 29 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 15 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 16 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 17 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 18 violation of federal 33 or state regulations and/or COUNTY policies. 34 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 21 and 36 implement written record management procedures. 37 22 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 23 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 24 litigations and/or settlement of claims. 3 25 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 28 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 30 maintained by or for a covered entity that is: 9 31 1. The medical records and billing records about individuals maintained by or for a covered 11 33 2. The enrollment, payment, claims adjudication, and case or medical management record 12 34 systems maintained by or for a health plan; or 13 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 14 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 2 with the terms of this Agreement and common business practices. If documentation is retained 16 3 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 5 or 18 site visit. 19 6 2. Provide auditor or other authorized individuals access to documents via a computer 7 terminal. 20 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 9 requested. 22 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 16 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 17 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 18 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 19 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3220

RECORDS MANAGEMENT AND MAINTENANCE. 26 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 13 accordance with this Agreement and all applicable requirements. 29 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 15 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 16 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 17 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 18 violation of federal 33 or state regulations and/or COUNTY policies. 34 19 C. CONTRACTOR’s participantClient, client, and/or patient records shall be maintained in a secure 35 manner. 20 CONTRACTOR shall maintain participantClient, client, and/or patient records and must establish and 36 implement 21 written record management procedures. 37 22 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 23 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 24 litigations and/or settlement of claims. 3 25 E. CONTRACTOR shall make records pertaining to the costs of services, participant Client fees, charges, 4 26 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 28 clients, participants, clients Clients and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 30 maintained by or for a covered entity that is: 9 31 1. The medical records and billing records about individuals maintained by or for a covered 11 33 2. The enrollment, payment, claims adjudication, and case or medical management record 12 34 systems maintained by or for a health plan; or 13 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 14 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 2 with the terms of this Agreement and common business practices. If documentation is retained 16 3 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 5 or 18 site visit. 19 6 2. Provide auditor or other authorized individuals access to documents via a computer 7 terminal. 20 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 9 requested. 22 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 16 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 17 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 18 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32eighteen

RECORDS MANAGEMENT AND MAINTENANCE. 26 7 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 8 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 9 accordance with this Agreement and all applicable requirements. 29 10 B. CONTRACTOR shall implement and maintain administrative, technical and physical 11 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 12 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 13 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 14 violation of federal 33 or state regulations and/or COUNTY policies. 34 15 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 16 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 17 and 36 implement written record management procedures. 37 18 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 19 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 20 litigations and/or settlement of claims. 3 21 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 22 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 23 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 24 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 25 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 26 maintained by or for a covered entity that is: 9 27 1. The medical records and billing records about individuals maintained by or for a covered 11 29 2. The enrollment, payment, claims adjudication, and case or medical management record 12 30 systems maintained by or for a health plan; or 13 31 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 32 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 33 with the terms of this Agreement and common business practices. If documentation is retained 16 34 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 35 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 36 or 18 site visit.. 37 // 19 1 2. Provide auditor or other authorized individuals access to documents via a computer 2 terminal. 20 3 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 4 requested. 22 5 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 6 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 7 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 8 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 9 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 10 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 11 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 12 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 13 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 14 (18) years, or for seven (7) years after the last date of service, whichever is longer. 3215

RECORDS MANAGEMENT AND MAINTENANCE. 26 13 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 27 14 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 15 accordance with this Agreement and all applicable requirements. 29 16 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 30 17 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 31 18 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall mitigate to the 32 19 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 20 or state regulations and/or COUNTY policies. 34 21 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 22 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 36 23 implement written record management procedures. 37 24 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 25 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 26 litigations and/or settlement of claims. 3 27 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 28 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 29 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 30 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 31 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 maintained 32 by or for a covered entity that is: 9 33 1. The medical records and billing records about individuals maintained by or for a coveredcovered 34 health care provider; 11 35 2. The enrollment, payment, claims adjudication, and case or medical management record 12 36 systems maintained by or for a health plan; or 13 37 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 . 28 of 34 X:\ASR\SUD\ASR 16-000543 HIV Transitional STC FY 16-17 JCG redline.docx ▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇▇▇▇ 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 2 with the terms of this Agreement and common business practices. If documentation is retained 16 3 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit or 18 5 site visit. 19 6 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 20 7 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32

RECORDS MANAGEMENT AND MAINTENANCE. 26 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 4 accordance with this Agreement and all applicable requirements. 29 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of federal 33 or state regulations and/or COUNTY policies. 34 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 36 implement written record management procedures. 37 13 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 14 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 15 litigations and/or settlement of claims. 3 16 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 17 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 19 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 21 maintained by or for a covered entity that is: 9 22 1. The medical records and billing records about individuals maintained by or for a covered 11 24 2. The enrollment, payment, claims adjudication, and case or medical management record 12 25 systems maintained by or for a health plan; or 13 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 16 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 18 site visit. 19 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 20 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 35 requested.. 36 // 37 // 22 1 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 2 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 3 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 4 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 7 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 8 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 9 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen 10 (18) years, or for seven (7) years after the last date of service, whichever is longer. 11 K. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 12 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 13 CONTRACTOR. 14 L. CONTRACTOR may be required to retain all records involving litigation proceedings and 15 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 16 M. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Agreement, within forty-eight (48) hours. 32CONTRACTOR shall provide ADMINISTRATOR 18 all information that is requested by the PRA request. 19 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 22 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 25 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 28 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 32 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 36 B. CONTRACTOR shall implement and maintain administrative, technical and physical 4 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 7 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 10 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 12 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 17 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 20 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 24 1. The medical records and billing records about individuals maintained by or for a covered 26 2. The enrollment, payment, claims adjudication, and case or medical management record 28 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 29 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 32 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 34 2. Provide auditor or other authorized individuals access to documents via a computer 36 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or

RECORDS MANAGEMENT AND MAINTENANCE. 26 27 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 28 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 29 accordance with this Agreement and all applicable requirements. 29 30 B. CONTRACTOR shall implement and maintain administrative, technical and physical 31 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 32 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 33 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 34 violation of federal 33 or state regulations and/or COUNTY policies. 34 35 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 36 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 37 and 36 implement written record management procedures.. 34 of 41 37 1 D. CONTRACTOR shall retain all financial records for a minimum of seven ten (710) years from the 1 2 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 3 litigations and/or settlement of claims. 3 4 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 5 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 6 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 7 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 9 maintained by or for a covered entity that is: 9 10 1. The medical records and billing records about individuals maintained by or for a covered 11 12 2. The enrollment, payment, claims adjudication, and case or medical management record 12 13 systems maintained by or for a health plan; or 13 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 15 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 16 with the terms of this Agreement and common business practices. If documentation is retained 16 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 18 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 19 or 18 site visit. 19 20 2. Provide auditor or other authorized individuals access to documents via a computer 21 terminal. 20 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 23 requested. 22 24 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 25 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 26 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 27 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 28 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 29 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 30 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven ten (710) 29 years 31 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 32 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32eighteen

RECORDS MANAGEMENT AND MAINTENANCE. 26 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 17 of 27 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 28 18 accordance with this Agreement and all applicable requirements. 29 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 30 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 31 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 22 mitigate to the 32 extent practicable, the known harmful effect of any use or disclosure of PHI made in 23 violation of federal 33 or state regulations and/or COUNTY policies. 34 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and 36 implement written record management procedures. 37 27 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 28 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 29 litigations and/or settlement of claims. 3 30 E. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 31 ▇▇▇▇▇▇▇▇, and revenues available at one (1) location within the limits of the County of Orange. 5 32 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 6 33 clients, participants, clients participants and/or patients be provided the right to access or receive a copy of their DRS 7 and/or 34 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 8 35 maintained by or for a covered entity that is: 9 36 1. The medical records and billing records about individuals maintained by or for a covered 11 1 2. The enrollment, payment, claims adjudication, and case or medical management record 12 2 systems maintained by or for a health plan; or 13 3 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 14 4 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 15 accordance 5 with the terms of this Agreement and common business practices. If documentation is retained 16 6 electronically, CONTRACTOR shall, in the event of an audit or site visit: 17 7 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 8 or 18 site visit. 19 9 2. Provide auditor or other authorized individuals access to documents via a computer 10 terminal. 20 11 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 12 requested. 22 13 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 14 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 24 15 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 25 16 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 17 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 18 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28 19 J. CONTRACTOR shall retain all participant, client and/or patient medical records for seven (7) 29 years 20 following discharge of the participant, client and/or patient, with the exception of non-emancipated 30 minors for 21 whom records must be kept for at least one (1) year after such minors have reached the age of 31 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 32eighteen