Loading...
HomeMy WebLinkAboutReso 181-2024 (24-1095)MEMORANDUM OF UNDERSTANDING BETWEEN THE CITIES OF REDWOOD CITY AND SOUTH SAN FRANCISCO AND THE COUNTY OF SAN MATEO FOR THE PROVISION OF COMMUNITY WELLNESS CRISIS RESPONSE TEAM (CWCRT) FY 2024-2025 The purpose of this Agreement is to set forth the agreement between the County of San Mateo (County), acting through the Behavioral Health and Recovery Services (BHRS) of San Mateo County Health; and the City of Redwood City and the City of South San Francisco (each, a City, and collectively referred to herein as the Cities); and each City’s respective police department to continue to provide the Community Wellness Crisis Response Team (CWCRT) program (Program) to improve City and County response to community members experiencing mental health crisis. This Agreement sets forth the terms of a working relationship between the County/BHRS and the Cities, collectively referred to as the Parties, for the provision of embedding licensed clinicians in law enforcement agencies in support of the CWCRT Program. The Cities and the County agree to the following: 1. Exhibits and Attachments Attachment 1 – HIPAA Requirements. 2. Background Information On January 12, 2020, the San Mateo County Board of Supervisors adopted Resolution No. R077937, which approved the Pilot CWCRT Program, a partnership among four city Police Departments (Daly City, South San Francisco, San Mateo, Redwood City, and BHRS, to embed in each city’s police department one mental health licensed clinician to provide a crisis co-response to crisis calls involving mental health issues. The County entered a contract with StarVista to provide the mental health clinicians for the Pilot CWCRT Program, as StarVista was already providing a mobile youth crisis response team. The Pilot CWCRT Program was subsequently approved by each city’s City Council. The Pilot CWCRT Program, launched on December 6, 2021, was designed as a law enforcement co-responder mobile crisis model, based on best practice models in other jurisdictions. The Pilot CWCRT Program enhances City and County response to incidents involving individuals experiencing mental health crises, by supplementing the crisis response with the engagement of a mental health clinician assigned to work with each partner police department. The Pilot CWCRT Program clinicians are StarVista staff contracted with BHRS and assist in the first response by providing early intervention, crisis de-escalation, 5150 evaluation, involuntary hold, and referrals to therapeutic hospitalizations, and guidance to support services for individuals in mental health crisis. BHRS provides ongoing clinical training opportunities, consultation, and oversight on the crisis response work, technical and infrastructure support, and contract monitoring responsibilities. The Pilot CWCRT Program has demonstrated reduction in psychiatric emergency services (PES) admission and improved linkage connection to needed on-going treatment services for the community members in crisis, as reported by John W. Gardner Center for Youth and Their Communities of the Stanford University Graduate School of Education (Gardner Center), based on their evaluation study examining the interventions and assessment methods utilized by the Pilot CWCRT Program participant cities in supporting the population served through the Pilot CWCRT Program during the pilot period. This Agreement will continue the CWCRT Program in the Cities by continuously providing one full-time mental health clinician in the City Police Departments offering first response mental health crisis services as described herein. The Agreement addresses the roles and responsibilities between the Cities and the County. 3. Purpose or Scope of Work The Cities enter into this cooperative and reciprocal Agreement with the County, acting through BHRS, for continuous provision of the CWCRT Program to enhance each City’s response to community members in mental health crisis. In the event of a suspected mental health crisis within a community, once informed, the mental health clinician will respond to the scene together with the City law enforcement officer, exercising their independent judgment and expertise and in collaboration with the City’s law enforcement staff. The goal of the immediate co-response will be to de-escalate the crisis and to support the safety of the individual in crisis, those around the individual, and all responding to the incident. The mental health clinician will then assess the person suspected to be in mental health crisis (the “client”) and determine the best course of action (e.g., temporary mandatory placement in a medical facility for psychiatric evaluation and treatment under Section 5150 of the Welfare and Institutions Code, referral for treatment, etc.). One of the goals of the CWCRT Program is that clients in mental health crisis who come into contact with law enforcement receive early intervention to guide them toward appropriate health services. The mental health clinicians will have been trained in the range of available mental health resources both within BHRS and in the community and, together, the law enforcement/mental health clinician response team will decide on the best course of action and/or resource or program for the client. The County of San Mateo derives direct benefit from the implementation of this Agreement, by way of, for example, increasing its ability to directly respond to community members in mental health crisis; providing Medi-Cal reimbursable services to County clients; enhancing response time for those in need of mental health services and resources; and creating a broader and more effective continuum of care that results in a decrease in justice system contacts. In an effort to achieve a healthy and integrated community, this Agreement represents a collaboration among the Parties to jointly exercise their common powers to enhance community linkages and help stabilize and improve the health and well-being of persons experiencing mental health crisis. Important outcomes include, but are not limited to: residential stability, improved mental health, reduced use of acute and emergency services, and reduced contact with the criminal justice system. 4. Relationship of Parties The Parties acknowledge and agree that the services performed under this Agreement by the StarVista mental health clinicians (also referred to as “StarVista clinicians”) are conducted by an independent contractor under a separate agreement between BHRS and StarVista. The StarVista clinicians are part of the StarVista workforce and remain employees of StarVista while providing services under specific terms of an agreement with BHRS, and at no time shall the StarVista clinicians be deemed employees of the Cities or BHRS. Neither the County of San Mateo nor the StarVista clinicians acquire any of the rights, privileges, powers, or advantages of the employees of the Cities. 5. Mutual Responsibilities of Parties 5.1 The Parties agree to adhere to, review, and modify as needed, policies and procedures for the CWCRT Program, regarding, but not limited to, scope of work, chain of communication, necessary training, grievance process, performance concerns, monitoring of the CWCRT Program, supervision of job performance of the StarVista clinicians, and handling and disposition of data generated by CWCRT Program participants. The policies and procedures will reflect the Parties’ mutual understanding that the StarVista clinicians are contracted StarVista employees and professionals who exercise independent clinical judgment and expertise in the performance of their scope of work complying to all the County’s requirements related to crisis mental health services, applicable laws and ethics, and the required documentation and reporting procedures under the BHRS Documentation Guidelines. 5.2 The Parties will develop relevant training plans for the StarVista clinicians and the law enforcement officers to participate in collaborative trainings when appropriate, develop program strategies, and implement protocol of response team in a manner that respects the dignity and diversity of community members. 6. Responsibility of Individual Parties 6.1 Each City, acting through its Police Department, shall be responsible for each of the following:  Provide the assigned StarVista mental health clinician with a workspace, City- specific computer/automation support, and office supplies necessary for all work required within the City’s police station.  Provide mobile police radio to the assigned StarVista mental health clinician for in- field work.  Orient and familiarize assigned StarVista mental health clinician with the Police Department work space, technology and operations, and specific community needs.  Support the assigned StarVista mental health clinician in clinical decisions and referrals.  Provide the assigned StarVista mental health clinician with access to the law enforcement data base system, to the extent necessary to carry out job responsibilities as a BHRS-contracted employee participating in the CWCRT Program.  Work collaboratively with the StarVista mental health clinician to provide necessary law enforcement-related information to assist them in achieving the agreed upon outcomes of the CWCRT Program. 6.2 BHRS shall be responsible for each of the following:  Maintain the StarVista agreement for provision of a trained full-time mental health clinician to be embedded in each of the City Police Departments for the mental health crisis response, as long as said agreement is appropriate and in the County’s best interests.  In the event the County determines in good faith that the StarVista agreement is no longer appropriate and in its best interests, provide sixty (60) days advance written notice of the termination of the StarVista agreement to the Cities, and ensure there shall be no gap in the provision of services of mental health clinicians to the Cities.  The Scope of Work provided by the mental health clinicians will be clearly defined in the BHRS agreement with StarVista, which includes crisis response, crisis de-escalation, crisis assessment, involuntary 5150 hold, short-term follow-up intervention support and case management linkage connection to needed treatment and services. Related training, documentation requirements and data collections will all be detailed in the County’s agreement with StarVista and monitored on an ongoing basis.  Ensure required onboarding documentation orientation, needed 5150 certification training, BHRS and community mental health/substance use services and resources training, and periodic training related to crisis response, crisis de-escalation, crisis assessment, 5150 involuntary hold, laws and ethics are arranged for or provided.  Provide StarVista clinicians with all County equipment and materials necessary to perform the function of a mental health crisis response clinician in the CWCRT Program (i.e. County laptop with needed applications, County car, auto insurance, auto maintenance, ongoing gasoline), and technical support to address related technical issues as they may arise in the use and maintenance of this equipment.  Provide Avatar electronic health record log-in for the purpose of client look-up and documentation of billable and nonbillable mental health services.  Hold meetings with StarVista for the purpose of contract monitoring, quality assurance, and clinical adherence.  Ensure continuous and appropriate supervision of the mental health clinicians by StarVista to provide quality care and clinically appropriate crisis services.  Ensure StarVista clinicians keep and maintain a valid license to engage in their specific mental health discipline in the State of California.  Exercise reasonable care to ensure compliance with all legal, ethical, and clinical requirements related to the contract with the County and the crisis work performed by the StarVista clinicians. 7. Goals and Objectives Goal 1: Law enforcement staff and the mental health clinicians will respond together to active crisis situations where mental health crisis is a factor. Goal 2: Improve outcomes for individuals experiencing a crisis due to mental illness or suspected mental illness. Goal 3: Increase access to appropriate behavioral health resources, services, and treatment. Goal 4: Provide clinical consultation, training, and support to law enforcement personnel in the field. Goal 5: Increase knowledge of mental health conditions and effective intervention strategies among law enforcement personnel. Goal 6: Law enforcement will strengthen relationships with service providers and community. The Parties agree to meet and confer periodically to continuously assess and revise program goals, and to add new program goals, as appropriate. 8. Special Terms and Conditions 8.1 Coordination and Oversight The assigned BHRS Clinical Services Manager will be responsible for the oversight of the StarVista contract and its progress status with StarVista, provide ongoing clinical consult, training, and quality assurance/quality improvement of the services provided by the StarVista clinicians. The Chiefs of the Police Departments and the BHRS Clinical Services Manager overseeing the StarVista agreement will participate in the quarterly oversight CWCRT Advisory meetings, as well as in the Working Group meetings as needed, to monitor the progress of the CWCRT Program towards its objectives, review any operational issues that have arisen, and identify items for ongoing work plan. 8.2 Conflict Resolution In the event of disagreements or conflicts between the Parties to this Agreement, the disagreement or conflict will be referred initially and in writing to the assigned Captains from the Cities and the Clinical Services Manager at BHRS. In the event consultation at that level does not resolve the disagreement or conflict, then the Chief of Police or their designee of the relevant Police Department(s), BHRS Clinical Services Manager, and BHRS’ Deputy Director of Adult and Older Adult Services shall meet and confer and attempt to resolve the matter. Finally, in the event the disagreement or conflict remains, the BHRS Director or their designee and the Chief(s) shall meet and confer. BHRS will obtain the participation of StarVista in the resolution process, as BHRS determines is appropriate. If the disagreement or conflict pertains to the performance of the assigned StarVista clinician, the disagreement or conflict will be referred initially and in writing to the assigned StarVista Program Manager/Chief Executive Officer and the BHRS Clinical Services Manager. In the event consultation at that level does not resolve the disagreement or conflict, above-noted meet-and- confer steps shall be followed. Finally, in the event the disagreement or conflict remains, StarVista shall remove the assigned mental health clinician and exercise reasonable diligence to identify and provide a qualified replacement. These conflict resolution steps will be clearly detailed in the BHRS-Star Vista agreement. 8.3 Staffing and Supervision The CWCRT Program under this agreement will consist of two full time mental health clinicians who must be licensed or license-eligible to provide mental health services by appropriate State of California licensing authorities. Under the BHRS agreement with StarVista, StarVista will be responsible for hiring the mental health clinicians if the current clinicians vacate their position and the hiring processes. The City will be entitled to assign one member to the StarVista hiring panel, if it so prefers. 8.4 Records and Confidentiality Records created by the StarVista clinicians shall be considered the County’s records, free from the control and direction of any other party to this Agreement. Such records will be subject to all federal, state, and local laws and regulations regarding the protection of client/patient privacy and confidentiality. The Parties agree that the StarVista clinicians must adhere to the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). BHRS will train the StarVista clinicians on federal, state, and local policies and procedures with respect to the confidentiality and use or disclosure of protected health information of clients as necessary and appropriate for the StarVista clinicians to carry out their functions. BHRS will provide the StarVista clinicians with the appropriate Health System policies and procedures, which are subject to change from time to time. The County reserves the right to take appropriate action for violation of its policies; such action may include the immediate termination of the contract work with StarVista or strong recommendation of the immediate termination of the specific StarVista clinician who violates Federal, State, or local law and policy. BHRS shall maintain beneficiary medical and/or clinical records for a period of ten (10) years, except that the records of the persons under age eighteen (18) at the time of treatment shall be maintained: a) until one (1) year beyond the person's eighteenth (18th) birthday or b) for a period of ten (10) years beyond the date of discharge, whichever is later. This rule does not supersede professional standards (BHRS is allowed to maintain records for a longer period of time if required by other regulations or licenses). 9. Hold Harmless and Indemnification 9.1. It is agreed that the County shall defend, hold harmless, and indemnify each of the Cities and their officers, employees, agents, and servants from any and all claims, suits, or actions of every name, kind, and description brought by a third party which arise out of the terms and conditions of this Agreement and which result from the acts or omissions of the County and/or its officers, employees, agents, and servants. 9.2. It is agreed that each of the Cities shall defend, save harmless, and indemnify the County and its officers, employees, agents, and servants from any and all claims, suits, or actions of every name, kind, and description brought by a third party which arise out of the terms and conditions of this Agreement and which result from the acts or omissions of a City or Cities and/or their respective officers, employees, agents and servants. 9.3. The duty of each party to defend, hold harmless, and indemnify the other as set forth herein shall include the duty to defend as set forth in Section 2778 of the California Civil Code. 9.4. In the event of concurrent negligence (or intentional/reckless acts) of a City or Cities and/or their respective officers and employees, on the one hand, and the County and/or its officers, employees, agents, and servants, on the other hand, then the liability for any and all claims for injuries or damage to persons and/or property which arise out of terms and conditions of this Agreement shall be apportioned according to the California theory of comparative fault. 10. Term and Termination 10.1. Term The Agreement shall be effective immediately upon signature of all the parties. Unless terminated earlier pursuant to Section 10.3, the term of the Agreement is from July 1,2024 through June 30,2025. 10.2. Amendment/Modification Process All subsequent modifications or amendments to this Agreement shall be in writing and signed by each of the Parties hereto before they will be effective. 10.3. Termination Any party upon tendering sixty (60) days written notice to the other parties may terminate this Agreement. County will be paid for work performed up to the termination date; however, the total will not exceed the amount payable per City under this Agreement. Each City will determine the final payment amount based upon the value of the work product delivered to that City and the percentage of the services performed. 10.4. Potential Termination of StarVista agreement In the event the County determines that the StarVista agreement is no longer appropriate and in its best interests as set forth in Section 6.2, the County must provide 60 days advance written notice of the termination of the StarVista agreement. If the event of termination of the StarVista agreement, each City has sole discretion to terminate this Agreement at that time or accept a comparable replacement mental health clinician provided by the County for the remainder of the Agreement term. 11. Funding/Financial Responsibilities Each City will pay the County a not-to-exceed amount of two hundred forty-nine thousand four hundred thirty-two Dollars ($249,432.00) for the completion of all the work and services described herein, which sum will include all costs or expenses incurred by County, payable as set forth below. Not To Exceed Amount per City Reimbursed salary and benefit costs NTE $176,737 Auto, Equipment and Supplies NTE $3,700 Operations and Administration NTE $68,995 Total NTE $249,432.00 11.1. Services for StarVista Clinician Personnel costs for the two full-time clinicians are 100% covered by the Cities with Redwood City covering for one full-time clinician and South San Francisco covering for one full-time clinician. The City shall reimburse the County for one hundred percent (100%) of these salary and benefit costs of the clinician for services rendered to date on a bi-annual basis, upon invoice by the County. The total reimbursement for one full time mental health clinician by StarVista for FY 24-25 shall not exceed the amount of $176,737.00. BHRS Fiscal will invoice the City Fiscal directly every six months; reimbursement from the City is expected within twenty (20) business days. The City shall provide the contact information of its Fiscal to BHRS at the time of signing this Agreement. The City will reimburse the County for any future Board Approved Cost of Living Adjustment (COLA) following a written amendment executed by all Parties. Personnel costs for the training, clinical consult, and technical support from the County are 100% covered by BHRS. 11.2. Auto, Equipment, and Supplies Costs The County laptop, with all required applications and software licenses needed for the clinical documentation by the StarVista clinicians, is 100% covered by BHRS. BHRS will provide each City with a County car. Each City will reimburse the County for the cost of maintenance expenses related to their assigned clinician’s use of the County car, including car insurance, maintenance, and gasoline. The total reimbursement per City shall not to exceed $3,700 per year per car . BHRS Fiscal shall invoice the City on a bi-annual basis; reimbursement from the City is expected within twenty (20) business days. 11.3. Operations, Administration and Supplies Costs Each City will reimburse their assigned clinician’s Operating Costs, Administrative Costs, and Supplies Costs incurred by StarVista for the clinicians for the term of this Agreement. The total reimbursement will not exceed $68,995 per City per year. Invoicing for these administrative costs will be identical to that described in Section 11.1. Operating and Supplies costs incurred by StarVista include, CWCRT program supplies, IT hardware – cellphones, telephone (subscription charges), recruiting (3rd Party Recruiter), StarVista office rent, training, filing fees/fingerprints, and employee health screening. Administration costs incurred by StarVista include 15% Indirect Cost. 12. Contact Information The following is contact information of the persons responsible from each party/entity for the completion and maintenance of this Agreement: 12.1. Party A (County of San Mateo) Information Name: Mike Callagy Address: 500 County Center Redwood City, CA 94063 Telephone: (650)-363-4129 Email: [email protected] 12.3 Party C (City of South San Francisco) Information Name: Scott Campbell Address: 1 Chestnut Avenue South San Francisco, CA 94080 Telephone: (650)-877-8900 Email: [email protected] 12.4 Party D (City of Redwood City) Information Name: Kristina Bell Address: 1301 Maple Street Redwood City, CA 94063 Telephone: (650)-780-7100 Email: [email protected] Effective Date and Signatures: This Agreement shall be effective upon the signature of all parties’ authorized officials. All Parties indicate agreement with this Agreement by their signatures. Signatures and dates: _______________________________________ Mike Callagy, Chief Executive Officer County of San Mateo Date Jei Africa, Director of BHRS County of San Mateo Date Kristina Bell, Police Chief City of Redwood City Date ______________________ Melissa Stevenson Diaz City Manager, Redwood City __________________________________________ Date 10/21/2024 Scott Campbell, Police Chief City of South San Francisco Date ___________________________ Sharon Ranals City Manager, South San Francisco ______________________ Date Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 1 Attachment 1 Health Insurance Portability and Accountability Act (HIPAA) Business Associate Requirements DEFINITIONS Terms used, but not otherwise defined, in this Schedule shall have the same meaning as those terms are defined in 45 Code of Federal Regulations (CFR) sections 160.103, 164.304, and 164.501. All regulatory references in this Schedule are to Title 45 of the Code of Federal Regulations unless otherwise specified. a.Business Associate. “Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the parties to this agreement shall mean Contractor. b.Covered Entity. "Covered entity" shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement shall mean County. c.HIPAA Rules. "HIPAA rules" shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR part 160 and part 164, as amended and supplemented by Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009. d.Designated Record Set. "Designated Record Set" shall have the same meaning as the term "designated record set" in Section 164.501. e.Electronic Protected Health Information. "Electronic Protected Health Information" (EPHI) means individually identifiable health information that is transmitted or maintained in electronic media; it is limited to the information created, received, maintained or transmitted by Business Associate from or on behalf of Covered Entity. f.Individual. "Individual" shall have the same meaning as the term "individual" in Section 164.501 and shall include a person who qualifies as a personal representative in accordance with Section 164.502(g). g.Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. h.Protected Health Information. "Protected Health Information" (PHI) shall have the same meaning as the term "protected health information" in Section 160.103 and is limited to the information created or received by Business Associate from or on behalf of County. i.Required By Law. "Required by law" shall have the same meaning as the term "required by law" in Section 164.103. j.Secretary. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his or her designee. k.Breach. The acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI and subject to the exclusions set forth in Section 164.402. Unless an exception applies, an impermissible use or disclosure of PHI is presumed to be a breach, unless it can be demonstrated there is a low Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 2 probability that the PHI has been compromised based upon, at minimum, a four-part risk assessment: 1. Nature and extent of PHI included, identifiers and likelihood of re-identification; 2. Identity of the unauthorized person or to whom impermissible disclosure was made; 3. Whether PHI was actually viewed or only the opportunity to do so existed; 4. The extent to which the risk has been mitigated. l. Security Rule. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C. m. Unsecured PHI. “Unsecured PHI” is protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in relevant HHS guidance. n. Security Incident. "Security Incident" shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems operations in an information system. “Security Incident” includes all incidents that constitute breaches of unsecured protected health information. OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE a. Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by the Agreement or as required by law. b. Business Associate agrees to use appropriate safeguards to comply with Subpart C of 45 CFR part 164 with respect to EPHI and PHI, and to prevent the use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to make uses and disclosures requests for Protected Health Information consistent with minimum necessary policy and procedures. d. Business Associate may not use or disclose protected health information in a manner that would violate subpart E of 45 CFR part 164.504 if used or disclosed by Covered Entity. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. f. Business Associate agrees to report to County any use or disclosure of Protected Health Information not authorized by this Agreement. g. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of County, agrees to adhere to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. h. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to provide access, at the request of County, and in the time and manner designated by County, to Protected Health Information in a Designated Record Set, to County or, as directed by County, to an Individual in order to meet the requirements under Section 164.524. Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 3 i. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the County directs or agrees to make pursuant to Section 164.526 at the request of County or an Individual, and in the time and manner designed by County. j. Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of County, available to the County at the request of County or the Secretary, in a time and manner designated by the County or the Secretary, for purposes of the Secretary determining County's compliance with the Privacy Rule. k. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528. l. Business Associate agrees to provide to County or an Individual in the time and manner designated by County, information collected in accordance with Section (k) of this Schedule, in order to permit County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528. m. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that Business Associate creates, receives, maintains, or transmits on behalf of County. n. Business Associate shall conform to generally accepted system security principles and the requirements of the final HIPAA rule pertaining to the security of health information. o. Business Associate shall ensure that any agent to whom it provides EPHI, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect such EPHI. p. Business Associate shall report to County any Security Incident within three (3) business days of becoming aware of such incident. Business Associate shall also facilitate breach notification(s) to the appropriate governing body (i.e. HHS, OCR, etc.) as required by law. As appropriate and after consulting with County, Business Associate shall also notify affected individuals and the media of a qualifying breach. q. Business Associate understands that it is directly liable under the HIPAA rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of Protected Health Information that are not authorized by this Attachment, the underlying contract as or required by law. PERMITTED USES AND DISCLOSURES BY CONTRACTOR AS BUSINESS ASSOCIATE Except as otherwise limited in this Schedule, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, County as specified in the Agreement; provided that such use or disclosure would not violate the Privacy Rule if done by County. Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 4 OBLIGATIONS OF COUNTY a. County shall provide Business Associate with the notice of privacy practices that County produces in accordance with Section 164.520, as well as any changes to such notice. b. County shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect Business Associate's permitted or required uses and disclosures. c. County shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that County has agreed to in accordance with Section 164.522. PERMISSIBLE REQUESTS BY COUNTY County shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if so requested by County, unless the Business Associate will use or disclose Protected Health Information for, and if the Agreement provides for, data aggregation or management and administrative activities of Business Associate. DUTIES UPON TERMINATION OF AGREEMENT a. Upon termination of the Agreement, for any reason, Business Associate shall return or destroy all Protected Health Information received from County, or created, maintained, or received by Business Associate on behalf of County, that Business Associate still maintains in any form. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. b. In the event that Business Associate determines that returning or destroying Protected Health Information is infeasible, Business Associate shall provide to County notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of the Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protection Health Information. MISCELLANEOUS a. Regulatory References. A reference in this Schedule to a section in the HIPAA Privacy Rule means the section as in effect or as amended, and for which compliance is required. b. Amendment. The Parties agree to take such action as is necessary to amend this Schedule from time to time as is necessary for County to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act, Public Law 104-191. Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 5 c. Survival. The respective rights and obligations of Business Associate under this Schedule shall survive the termination of the Agreement. d. Interpretation. Any ambiguity in this Schedule shall be resolved in favor of a meaning that permits County to comply with the Privacy Rule. e. Reservation of Right to Monitor Activities. County reserves the right to monitor the security policies and procedures of Business Associate.