Common use of Audits and Record Retention Clause in Contracts

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including xxxxxxxx, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - E), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMC-ODS IA, Exhibit F; SABG Contract] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall preserve and make available records, and shall be subject to examination and audit of the Department of Auditor General, for a period of ten (10) years from the date of final payment under this agreement, and for such longer period, if any, as required by applicable statute, by any other provision of this agreement, or by subparagraphs 3.2.1 or 3.2.2, below. 3.2.1. If this Agreement is completely or partially terminated, the records relating to the work terminated shall be preserved and made available for a period of three years from the date of any resulting final settlement. 3.2.2. If any litigation, claim, negotiation, audit, or other action involving the records has been started before the expiration of the ten-year period, the records shall be retained until completion of the action and resolution of all issues which arise from it, or until the end of the regular ten-year period, whichever is later. [County of Marin Performance Contract 21-10091, Exhibit A] 3.3 Contractor shall allow the County, CMS, the Office of the Inspector General, the Comptroller General of the United States, and other authorized federal and state agencies, or their duly authorized designees, to evaluate Contractor’s, and subcontractors’, performance under this contract, including the quality, appropriateness, and timeliness of services provided, and to inspect, evaluate, and audit any and all records, documents, and the premises, equipment and facilities maintained by the Contractor and its subcontractors pertaining to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is later. [42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.4 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.5 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 42 CFR 433.32 for a period of time no less than ten (10) years. 3.6 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than ten (10) years. [DMC-ODS IA, Exhibit A] 3.7 Contractor is responsible for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMC-ODS IA, Exhibit B; SABG Contract, Enclosures 3, 5] 3.8 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth in the State Department of Health Care Services’ Cost Reporting/Data Collection Systems. 3.9 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMC-ODS IA and SABG Contract. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMC-ODS IA, Exhibit F, SABG Contract and BHRS Policy and Procedure BHRS-SUS-06. 3.10 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.11 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the SABG Contract, Enclosure 2.

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including xxxxxxxx, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - E), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMC-ODS IA, Exhibit F; SABG SUBG Contract] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall preserve and make available records, and shall be subject to examination and audit of the Department of Auditor General, for a period of ten (10) years from the date of final payment under this agreement, and for such longer period, if any, as required by applicable statute, by any other provision of this agreement, or by subparagraphs 3.2.1 or 3.2.2, below. 3.2.1. If this Agreement is completely or partially terminated, the records relating to the work terminated shall be preserved and made available for a period of three years from the date of any resulting final settlement. 3.2.2. If any litigation, claim, negotiation, audit, or other action involving the records has been started before the expiration of the ten-year period, the records shall be retained until completion of the action and resolution of all issues which arise from it, or until the end of the regular ten-year period, whichever is later. [County of Marin Performance Contract 21-10091, Exhibit A] 3.3 Contractor shall allow the Countyagrees: 1) The Department, CMS, the Office of the Health and Human Services (HHS) Inspector General, the Comptroller General of the United States, and other authorized federal and state agenciesGeneral, or their duly authorized designees, and the County or any subdivision or appointee thereof have the right to evaluate Contractor’saudit, evaluate, and subcontractorsinspect any books, records, contracts, computer or other electronic systems of the Contractor, or of the Contractor’s subcontractor, that pertain to any aspect of services and activities performed, or determination of amounts payable under this Agreement at any time; 2) The Contractor will make available, for purposes of an audit, evaluation, or inspection, its premises, physical facilities, equipment, books, records, contracts, computer or other electronic systems relating to its Medicaid beneficiaries; 3) The Department, CMS, the HHS Inspector General, the Comptroller General, or their designees’, performance under this contractand the County or any subdivision or appointee thereof right to audit the Contractor will exist through ten years from the final date of the contract period or from the date of completion of any audit, including whichever is later; 4) If the qualityDepartment, appropriatenessCMS, and timeliness or the HHS Inspector General determines that there is a reasonable possibility of services providedfraud or similar risk, and to the Department, CMS, or the HHS Inspector General may inspect, evaluate, and audit the Contractor at any and all records, documents, and the premises, equipment and facilities maintained time. Full cooperation shall be given by the Contractor and its subcontractors pertaining in any auditing or monitoring conducted, according to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is laterAgreement. [DMC-ODS IA; 42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.4 Contractor shall cooperate with the County in the implementation, monitoring and evaluation of this Agreement and comply with any and all reporting requirements established by the County. Should the County identify an issue or receive notification of a complaint or potential/actual/suspected violation of requirements, the County may audit, monitor, and/or request information from the Contractor to ensure compliance with laws, regulations, and requirements, as applicable. 3.5 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.5 3.6 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 14214.1, 42 CFR 433.32 433.32, 438.3(h) and 438.3(u) for a period of time no less than ten (10) years. 3.6 3.7 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than ten (10) years. [DMC-ODS IA, Exhibit A] 3.7 3.8 Reasons for Recoupment: County will conduct periodic audits of Contractor is responsible files to ensure appropriate clinical documentation, high quality service provision and compliance with applicable federal, state and county regulations. Such audits may result in requirements for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related Contractor to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the reimburse County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMC-ODS IA, Exhibit B; SABG Contract, Enclosures 3, 5] 3.8 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth services previously paid in the State Department of Health Care Services’ Cost Reporting/Data Collection Systemscircumstances listed below (3.8.1 – 3. 3.9 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMC-ODS IA and SABG Contract. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMC-ODS IA, Exhibit F, SABG Contract and BHRS Policy and Procedure BHRS-SUS-06. 3.10 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.11 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the SABG Contract, Enclosure 2.

Audits and Record Retention. 3.1 Contractor and the County mutually agree to maintain the confidentiality of Contractor’s participant records, including xxxxxxxx, pursuant to Sections 11812(c) and 11879, Health & Safety Code and Federal Regulations for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2, Subparts A - E), the federal Health Insurance Portability and Accountability Act (HIPAA) and all other applicable State and Federal laws and any amendments. Contractor shall inform all its officers, employees, and agents of the confidentiality provisions of said regulations, and provide all necessary policies and procedures and training to ensure compliance. Contractor shall ensure staff participate in information privacy and security training at least annually, and prior to accessing protected health information (hereinafter PHI) or personal information (hereinafter PI), sign a confidentiality statement that includes, at a minimum, General use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be renewed annually and shall be retained for a period of six (6) years following termination of this contract. [DMC-ODS IA, Exhibit F; SABG Contract] 3.2 Where contracts exceed $10,000 of state funding – the Contractor shall preserve and make available records, and shall be subject to examination and audit of the Department of Auditor General, for a period of ten (10) years from the date of final payment under this agreement, and for such longer period, if any, as required by applicable statute, by any other provision of this agreement, or by subparagraphs 3.2.1 or 3.2.2, below. 3.2.1. If this Agreement is completely or partially terminated, the records relating to the work terminated shall be preserved and made available for a period of three years from the date of any resulting final settlement. 3.2.2. If any litigation, claim, negotiation, audit, or other action involving the records has been started before the expiration of the ten-year period, the records shall be retained until completion of the action and resolution of all issues which arise from it, or until the end of the regular ten-year period, whichever is later. [County of Marin Performance Contract 21-10091, Exhibit A] 3.3 Contractor shall allow the Countyagrees: 1) The Department, CMS, the Office of the Health and Human Services (HHS) Inspector General, the Comptroller General of the United States, and other authorized federal and state agenciesGeneral, or their duly authorized designees, and the County or any subdivision or appointee thereof have the right to evaluate Contractor’saudit, evaluate, and subcontractorsinspect any books, records, contracts, computer or other electronic systems of the Contractor, or of the Contractor’s subcontractor, that pertain to any aspect of services and activities performed, or determination of amounts payable under this Agreement at any time; 2) The Contractor will make available, for purposes of an audit, evaluation, or inspection, its premises, physical facilities, equipment, books, records, contracts, computer or other electronic systems relating to its Medicaid beneficiaries; 3) The Department, CMS, the HHS Inspector General, the Comptroller General, or their designees’, performance under this contractand the County or any subdivision or appointee thereof right to audit the Contractor will exist through ten years from the final date of the contract period or from the date of completion of any audit, including whichever is later; 4) If the qualityDepartment, appropriatenessCMS, and timeliness or the HHS Inspector General determines that there is a reasonable possibility of services providedfraud or similar risk, and to the Department, CMS, or the HHS Inspector General may inspect, evaluate, and audit the Contractor at any and all records, documents, and the premises, equipment and facilities maintained time. Full cooperation shall be given by the Contractor and its subcontractors pertaining in any auditing or monitoring conducted, according to such services at any time, and to allow interviews of any employee who might reasonably have information related to such records. Contractor shall allow such Inspection, evaluation and audit of Contractor’s documents and facilities, and those of its subcontractors, for 10 years from the term end date of this Contract or in the event the Contractor has been notified that an audit of investigation of this Contract has been commenced, until such time as the matter under audit or investigation has been resolved, including exhaustion of all legal remedies, whichever is laterAgreement. [DMC-ODS IA; 42 C.F.R. §§ 438.3(h), 438.230(c)(3)(i-iii)] 3.4 Contractor shall cooperate with the County in the implementation, monitoring and evaluation of this Agreement and comply with any and all reporting requirements established by the County. Should the County identify an issue or receive notification of a complaint or potential/actual/suspected violation of requirements, the County may audit, monitor, and/or request information from the Contractor to ensure compliance with laws, regulations, and requirements, as applicable. 3.5 Contractor acknowledges that if a DMC provider is under investigation by DHCS or any other state, local or federal law enforcement agency for fraud or abuse, DHCS may temporarily suspend the provider from the DMC program, pursuant to WIC 14043.36(a). Information about a provider’s administrative sanction status is confidential until such time as the action is either completed or resolved. DHCS may also issue a Payment Suspension to a provider pursuant to WIC 14107.11 and Code of Federal Regulations, Title 42, section 455.23. The County is to withhold payments from a DMC provider during the time a Payment Suspension is in effect. The County shall execute the Confidentiality Agreement. The Confidentiality Agreement permits DHCS to communicate with County concerning subcontracted providers that are subject to administrative sanctions. 3.5 3.6 Contractor, if applicable, shall maintain medical records and other records showing a Medi-Cal beneficiary’s eligibility for services, the service(s) rendered, the Medi-Cal beneficiary to whom the service was rendered, the date of the services, the medical necessity of the service and the quality of care provided. Records shall be maintained in accordance with Title 22 California Code of Regulations, W & I Code, Section 14214.1 and 14214.1, 42 CFR 433.32 433.32, 438.3(h) and 438.3(u) for a period of time no less than ten (10) years. 3.6 3.7 Contractor shall retain, as applicable, the following information: beneficiary grievance and appeal records in 42 CFR 438.416 and the data, information and documentation specified in 42 CFR 438.604, 438606, 438.608 and 438.610 for a period of no less than ten (10) years. [DMC-ODS IA, Exhibit A] 3.7 3.8 Reasons for Recoupment: County will conduct periodic audits of Contractor is responsible files to ensure appropriate clinical documentation, high quality service provision and compliance with applicable federal, state and county regulations. Such audits may result in requirements for the repayment of all audit exceptions and disallowances taken by local, State and Federal agencies, related Contractor to activities conducted by Contractor under the Agreement. All overpayments shall be returned to the reimburse County within 60 calendar days after the date on which the overpayment was identified, or the date any corresponding cost report is due, if applicable. When a financial audit is conducted by the Federal Government, the State, or the California State Auditor directly with Contractor, and if the Contractor disagrees with audit disallowances related to its programs, claims or services, County shall, at the Contractor’s request, request an appeal to the State via the County. [DMC-ODS IA, Exhibit B; SABG Contract, Enclosures 3, 5] 3.8 Financial records shall be kept so that they clearly reflect the source of funding for each type of service for which reimbursement is claimed. These documents include, but are not limited to, all ledgers, books, vouchers, time sheets, payrolls, appointment schedules, client data cards, and schedules for allocating costs. Fiscal records shall contain sufficient data to enable auditors to perform a complete audit and shall be maintained in conformance with the procedures and accounting principles set forth services previously paid in the State Department of Health Care Services’ Cost Reporting/Data Collection Systemscircumstances listed below (3.8.1 – 3. 3.9 If Contractor uses electronic medical records, the Contractor agrees to use a system that is consistent with privacy and information security requirements pertaining to technical security controls, audit controls and business continuity/disaster recovery controls outlined in the DMC-ODS IA and SABG Contract. If Contractor does not use electronic medical records, the Contractor agrees to adhere to paper document controls outlined in the DMC-ODS IA, Exhibit F, SABG Contract and BHRS Policy and Procedure BHRS-SUS-06. 3.10 If Contractor uses electronic medical records, the Contractor agrees to submit staff updates, including changes in roles or new or separated staff, to the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. The notification shall include submission of the Marin WITS Electronic Signature Agreement and Marin WITS User Request/Change Form, as applicable. If a user suspects that their electronic signature may be comprised, Contractor shall notify the Marin WITS Administrator within the timeframes outlined in the BHRS Policy and Procedure BHRS-SUS-08. 3.11 Contractors funded with SABG dollars for primary prevention services are required to adhere to the Primary Prevention Substance Use Disorder Data Service quality standards as outlined in the SABG Contract, Enclosure 2.