Common use of RECORDS MANAGEMENT AND MAINTENANCE Clause in Contracts

RECORDS MANAGEMENT AND MAINTENANCE. 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 accordance with this Contract and all applicable requirements. 23 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 principles of reimbursement and GAAP. 33 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state

RECORDS MANAGEMENT AND MAINTENANCE. 20 17 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 18 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 19 accordance with this Contract and all applicable requirements. 23 20 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 21 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 22 shall include, but not be limited to, individual patient charts and utilization review records. 26 23 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 24 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 25 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 26 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 27 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 28 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 29 principles of reimbursement and GAAP. 33 30 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 31 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 32 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 33 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 34 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 35 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI made in 2 36 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 37 1 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract Agreement and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or statestate regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years, or for 32 minors that deliver babies while in custody, records will be retained until the child reaches the age of 33 twenty-five (25) years. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract Agreement and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or statestate regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the Agreement, unless a longer period is required due to legal proceedings such as 29 litigations and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29

RECORDS MANAGEMENT AND MAINTENANCE. 20 31 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 32 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 33 accordance with this Contract and all applicable requirements. 23 34 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 35 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 36 shall include, but not be limited to, individual patient charts and utilization review records.. 37 // 26 1 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 2 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 3 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 4 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 5 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 6 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 7 principles of reimbursement and GAAP. 33 8 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 9 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 10 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 11 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 12 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 13 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 14 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 15 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 16 regulations and/or COUNTY policies. 17 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 18 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 19 implement written record management procedures. 20 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 21 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 22 and/or settlement of claims. 23 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 24 discharge of the participant, client and/or patient. 25 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 26 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 27 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 28 written approval to CONTRACTOR to maintain records in a single location, identified by 29 CONTRACTOR: 30 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 31 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 32 information that is requested by the PRA request. 33 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 34 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 35 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 36 maintained by or for a covered entity that is: 37 // 1 1. The medical records and billing records about individuals maintained by or for a covered 3 2. The enrollment, payment, claims adjudication, and case or medical management record 4 systems maintained by or for a health plan; or 5 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 6 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 7 with the terms of this Contract and common business practices. If documentation is retained 8 electronically, CONTRACTOR shall, in the event of an audit or site visit: 9 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 10 or site visit. 11 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 12 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 13 requested. 14 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 15 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 16 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 17 regulation, and copy ADMINISTRATOR on such notifications. 18 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 19 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 20 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 21

RECORDS MANAGEMENT AND MAINTENANCE. 20 6 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 7 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 8 accordance with this Contract and all applicable requirements. 23 9 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 10 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 11 shall include, but not be limited to, individual patient charts and utilization review records. 26 12 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 13 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 14 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 15 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 16 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 17 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 18 principles of reimbursement and GAAP. 33 19 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 20 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 21 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 22 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 24 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 25 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 26 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 27 regulations and/or COUNTY policies. 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 30 implement written record management procedures. 31 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 32 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 33 and/or settlement of claims. 34 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 35 discharge of the participant, client and/or patient. 36 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 37 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 1 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 2 written approval to CONTRACTOR to maintain records in a single location, identified by 3 CONTRACTOR. 4 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 5 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 6 information that is requested by the PRA request. 7 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 8 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 9 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 10 for a covered entity that is: 11 1. The medical records and billing records about individuals maintained by or for a covered 13 2. The enrollment, payment, claims adjudication, and case or medical management record 14 systems maintained by or for a health plan; or 15 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 16 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 17 with the terms of this Contract and common business practices. If documentation is retained 18 electronically, CONTRACTOR shall, in the event of an audit or site visit: 19 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 20 or site visit. 21 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 23 requested. 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 26 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 27 regulation, and copy ADMINISTRATOR on such notifications. 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 29 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 30 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 31

RECORDS MANAGEMENT AND MAINTENANCE. 20 12 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 13 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 14 accordance with this Contract Agreement and all applicable requirements. 23 15 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 16 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 17 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 18 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 19 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 20 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 21 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 22 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 23 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 24 principles of reimbursement and GAAP. 33 25 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 26 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 27 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 28 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical 30 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 31 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 32 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 or statestate regulations and/or COUNTY policies. 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 36 and implement written record management procedures. 37 // 1 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 2 years from the termination of the contract, unless a longer period is required due to legal proceedings 3 such as litigations and/or settlement of claims. 4 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7)/ten (10) years 5 following discharge of the participant, client and/or patient. 6 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 7 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 8 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 9 written approval to CONTRACTOR to maintain records in a single location, identified by 10 CONTRACTOR. 11 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 12 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 13 all information that is requested by the PRA request. 14 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 15 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 17 maintained by or for a covered entity that is: 18 1. The medical records and billing records about individuals maintained by or for a covered 20 2. The enrollment, payment, claims adjudication, and case or medical management record 21 systems maintained by or for a health plan; or 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 23 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 24 with the terms of this Agreement and common business practices. If documentation is retained 25 electronically, CONTRACTOR shall, in the event of an audit or site visit: 26 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 27 or site visit. 28 2. Provide auditor or other authorized individuals access to documents via a computer 29 terminal. 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 31 requested. 32 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 33 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 34 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 35 regulation, and copy ADMINISTRATOR on such notifications. 36 // 37 // 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 4

RECORDS MANAGEMENT AND MAINTENANCE. 20 9 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 10 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 11 accordance with this Contract Agreement and all applicable requirements. 23 12 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 13 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 14 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 15 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 16 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 17 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 18 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 19 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 20 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 21 principles of reimbursement and GAAP. 33 22 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 23 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 24 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 25 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 26 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 27 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 28 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 29 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 30 regulations and/or COUNTY policies. 31 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 32 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 33 implement written record management procedures. 34 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 35 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 36 and/or settlement of claims. 37 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 1 discharge of the participant, client and/or patient. 2 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 3 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 4 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 5 written approval to CONTRACTOR to maintain records in a single location, identified by 6 CONTRACTOR. 7 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 8 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 9 information that is requested by the PRA request. 10 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 11 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 12 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 13 for a covered entity that is: 14 1. The medical records and billing records about individuals maintained by or for a covered 16 2. The enrollment, payment, claims adjudication, and case or medical management record 17 systems maintained by or for a health plan; or 18 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 19 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 20 with the terms of this Agreement and common business practices. If documentation is retained 21 electronically, CONTRACTOR shall, in the event of an audit or site visit: 22 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 23 or site visit. 24 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 26 requested. 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 29 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 30 regulation, and copy ADMINISTRATOR on such notifications. 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 34

RECORDS MANAGEMENT AND MAINTENANCE. 20 7 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 8 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 9 accordance with this Contract Agreement and all applicable requirements. 23 10 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 11 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 12 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 13 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 14 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 15 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 16 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 17 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 18 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 19 principles of reimbursement and GAAP. 33 20 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 21 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 22 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 23 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 24 B. CONTRACTOR shall implement and maintain administrative, technical and physical 25 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 26 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 27 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 28 or statestate regulations and/or COUNTY policies. 29 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 30 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 31 and implement written record management procedures. 32 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 33 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 34 and/or settlement of claims. 35 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 36 following discharge of the participant, client and/or patient. 37 // 1 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 2 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 3 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 4 written approval to CONTRACTOR to maintain records in a single location, identified by 5 CONTRACTOR. 6 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 7 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 8 all information that is requested by the PRA request. 9 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 10 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 11 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 12 maintained by or for a covered entity that is: 13 1. The medical records and billing records about individuals maintained by or for a covered 15 2. The enrollment, payment, claims adjudication, and case or medical management record 16 systems maintained by or for a health plan; or 17 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 18 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 19 with the terms of this Agreement and common business practices. If documentation is retained 20 electronically, CONTRACTOR shall, in the event of an audit or site visit: 21 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 22 or site visit. 23 2. Provide auditor or other authorized individuals access to documents via a computer 24 terminal. 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 26 requested. 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 29 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 30 or regulation, and copy ADMINISTRATOR on such notifications. 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 34 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 35 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 20 4 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 5 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 6 accordance with this Contract and all applicable requirements. 23 7 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 8 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 9 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 10 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 11 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 12 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 13 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 14 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 15 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 16 principles of reimbursement and GAAP. 33 17 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 18 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 19 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 20 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 21 B. CONTRACTOR shall implement and maintain administrative, technical and physical 22 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 23 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 24 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 25 or statestate regulations and/or COUNTY policies. 26 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 27 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 28 and implement written record management procedures. 29 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 30 termination of the Contract unless a longer period is required due to legal proceedings such as litigations 31 and/or settlement of claims. 32 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 33 following discharge of the participant, client and/or patient. 34 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 35 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 36 CONTRACTOR is unable to meet the record location criteria above, upon CONTRACTOR’s request 37 ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single 1 location, identified by CONTRACTOR. 2 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 3 of, this Contract, within forty-eight (48) hours of CONTRACTOR’s receipt of the PRA request. 4 CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 9 maintained by or for a covered entity that is: 10 1. The medical records and billing records about individuals maintained by or for a covered 12 2. The enrollment, payment, claims adjudication, and case or medical management record 13 systems maintained by or for a health plan; or 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 16 with the terms of this Contract and common business practices. If documentation is retained 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 19 or site visit. 20 2. Provide auditor or other authorized individuals access to documents via a computer 21 terminal. 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 23 requested. 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 26 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 27 or regulation, and copy ADMINISTRATOR on such notifications. 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy 29 and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR 30 shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 31

RECORDS MANAGEMENT AND MAINTENANCE. 20 34 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 35 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 36 accordance with this Contract and all applicable requirements. 23 1 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 2 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 3 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 4 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 5 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 6 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 7 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 8 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 9 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 10 principles of reimbursement and GAAP. 33 11 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 12 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 13 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 14 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 15 B. CONTRACTOR shall implement and maintain administrative, technical and physical 16 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 17 PHI made in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to 18 the extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of 19 federal or statestate regulations and/or COUNTY policies. 20 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 21 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 22 and implement written record management procedures. 23 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 24 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 25 and/or settlement of claims. 26 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 27 following discharge of the participant, client and/or patient. 28 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 29 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 30 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 31 written approval to CONTRACTOR to maintain records in a single location, identified by 32 CONTRACTOR. 33 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 34 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 35 information that is requested by the PRA request. 36 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 37 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 2 maintained by or for a covered entity that is: 3 1. The medical records and billing records about individuals maintained by or for a covered 5 2. The enrollment, payment, claims adjudication, and case or medical management record 6 systems maintained by or for a health plan; or 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 8 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 9 with the terms of this Contract and common business practices. If documentation is retained 10 electronically, CONTRACTOR shall, in the event of an audit or site visit: 11 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 12 or site visit. 13 2. Provide auditor or other authorized individuals access to documents via a computer 14 terminal. 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 16 requested. 17 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 18 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 19 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 20 or regulation, and copy ADMINISTRATOR on such notifications. 21 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 22 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 23 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 24

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 34 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 36 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 37 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 1 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 2 or statestate regulations and/or COUNTY policies. 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 5 and implement written record management procedures. 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 8 and/or settlement of claims. 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 10 following discharge of the participant, client and/or patient. 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 12 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 14 written approval to CONTRACTOR to maintain records in a single location, identified by 15 CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 18 information that is requested by the PRA request. 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 22 maintained by or for a covered entity that is: 23 1. The medical records and billing records about individuals maintained by or for a covered 25 2. The enrollment, payment, claims adjudication, and case or medical management record 26 systems maintained by or for a health plan; or 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 29 with the terms of this Contract and common business practices. If documentation is retained 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 32 or site visit. 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 36 requested. 37 // 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 4 or regulation, and copy ADMINISTRATOR on such notifications. 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 8

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract Agreement and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or statestate regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 28 years from the termination of the contract, unless a longer period is required due to legal proceedings 29 such as litigations and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7)/ten (10) 31 years following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 3 all information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Agreement and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29 L. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 30 following discharge of the client and/or patient, with the exception of non-emancipated minors for 31 whom records must be kept until such minors have reached the age of twenty-five (25) years. 32

RECORDS MANAGEMENT AND MAINTENANCE. 20 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 6 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 7 accordance with this Contract and all applicable requirements. 23 8 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 9 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 10 shall include, but not be limited to, individual patient charts and utilization review records. 26 11 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 12 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 13 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 14 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 15 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 16 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 17 principles of reimbursement and GAAP. 33 18 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 19 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 20 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 21 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 22 B. CONTRACTOR shall implement and maintain administrative, technical and physical 23 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 24 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 25 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 26 or statestate regulations and/or COUNTY policies. 27 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 28 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 29 and implement written record management procedures. 30 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 31 termination of the Contract, unless a longer period is required due to legal proceedings such as 32 litigations and/or settlement of claims. 33 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 34 following discharge of the participant, client and/or patient. 35 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 36 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 37 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by 1 CONTRACTOR. 2 // 3 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 4 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 5 information that is requested by the PRA request. 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 9 maintained by or for a covered entity that is: 10 1. The medical records and billing records about individuals maintained by or for a covered 12 2. The enrollment, payment, claims adjudication, and case or medical management record 13 systems maintained by or for a health plan; or 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 16 with the terms of this Contract and common business practices. If documentation is retained 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 19 or site visit. 20 2. Provide auditor or other authorized individuals access to documents via a computer 21 terminal. 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 23 requested. 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 26 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 27 regulation, and copy ADMINISTRATOR on such notifications. 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 29 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 30 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 31

RECORDS MANAGEMENT AND MAINTENANCE. 20 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 17 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 18 accordance with this Contract Agreement and all applicable requirements. 23 19 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 20 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 21 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 22 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 23 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 24 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 25 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 26 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 27 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 28 principles of reimbursement and GAAP. 33 29 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 30 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 31 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 32 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 33 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 34 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 35 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 36 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 37 regulations and/or COUNTY policies. 1 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 2 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 3 implement written record management procedures. 4 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 5 termination of the Agreement, unless a longer period is required due to legal proceedings such as 6 litigations and/or settlement of claims. 7 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) following 8 discharge of the participant, client and/or patient. 9 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 10 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 11 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 12 written approval to CONTRACTOR to maintain records in a single location, identified by 13 CONTRACTOR. 14 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 15 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 16 information that is requested by the PRA request. 17 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 18 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 19 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained 20 by or for a covered entity that is: 21 1. The medical records and billing records about individuals maintained by or for a covered 23 2. The enrollment, payment, claims adjudication, and case or medical management record 24 systems maintained by or for a health plan; or 25 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 26 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 27 with the terms of this Agreement and common business practices. If documentation is retained 28 electronically, CONTRACTOR shall, in the event of an audit or site visit: 29 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 30 or site visit. 31 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 32 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 33 requested. 34 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 35 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 36 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 37 regulation, and copy ADMINISTRATOR on such notifications. 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 4 L. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 5 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 6 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 7 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 8

RECORDS MANAGEMENT AND MAINTENANCE. 18 A. CONTRACTOR shall not utilize information and/or data received from COUNTY, or arising 19 out of, or developed, as a result of this Agreement for any purpose other than performance of services 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 under this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 accordance with this Contract and all applicable requirementsAgreement. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 34 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 36 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 37 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the County of Orange Contract MA-042-21010167 1 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 2 or statestate regulations and/or COUNTY policies. 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 5 and implement written record management procedures. 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 8 and/or settlement of claims. 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 10 discharge of the participant, client and/or patient. 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 12 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 14 written approval to CONTRACTOR to maintain records in a single location, identified by 15 CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 18 all information that is requested by the PRA request. 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 22 maintained by or for a covered entity that is: 23 1. The medical records and billing records about individuals maintained by or for a covered 25 2. The enrollment, payment, claims adjudication, and case or medical management record 26 systems maintained by or for a health plan; or 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 29 with the terms of this Agreement and common business practices. If documentation is retained 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 32 or site visit. 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 36 requested. 37 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and County of Orange Contract MA-042-21010167 1 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 2 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 3 regulation, and copy ADMINISTRATOR on such notifications. 4 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 23 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 34 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 36 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 37 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 1 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 2 or statestate regulations and/or COUNTY policies. 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 5 and implement written record management procedures. 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 8 and/or settlement of claims. 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 10 following discharge of the participant, client and/or patient. 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 12 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 14 written approval to CONTRACTOR to maintain records in a single location, identified by 15 CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 18 information that is requested by the PRA request. 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 22 maintained by or for a covered entity that is: 23 1. The medical records and billing records about individuals maintained by or for a covered 25 2. The enrollment, payment, claims adjudication, and case or medical management record 26 systems maintained by or for a health plan; or 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 29 with the terms of this Contract and common business practices. If documentation is retained 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 32 or site visit. 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 36 requested. 37 // 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 3 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 4 regulation, and copy ADMINISTRATOR on such notifications. 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 8 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 9 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 10

RECORDS MANAGEMENT AND MAINTENANCE. 20 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 12 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 13 accordance with this Contract and all applicable requirements. 23 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 15 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 16 shall include, but not be limited to, individual patient charts and utilization review records. 26 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 22 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 23 principles of reimbursement and GAAP. 33 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 27 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 29 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 30 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 31 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 32 regulations and/or COUNTY policies. 33 C. CONTRACTOR’s Client records shall be maintained in a secure manner. CONTRACTOR shall 34 maintain Client records and must establish and implement written record management procedures. 35 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 36 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 37 and/or settlement of claims. 1 E. CONTRACTOR shall retain all Client and/or patient medical records for ten (10) years following 2 discharge of the Client. 3 F. CONTRACTOR shall make records pertaining to the costs of services, Client fees, charges, 4 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 5 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 6 written approval to CONTRACTOR to maintain records in a single location, identified by 7 CONTRACTOR. 8 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 9 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 10 information that is requested by the PRA request. 11 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that Clients 12 be provided the right to access or receive a copy of their DRS and/or request addendum to their records. 13 Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 14 1. The medical records and billing records about individuals maintained by or for a covered 16 2. The enrollment, payment, claims adjudication, and case or medical management record 17 systems maintained by or for a health plan; or 18 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 19 I. CONTRACTOR may retain Client, and/or patient documentation electronically in accordance 20 with the terms of this Contract and common business practices. If documentation is retained 21 electronically, CONTRACTOR shall, in the event of an audit or site visit: 22 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 23 or site visit. 24 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 25 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 26 requested. 27 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 28 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 29 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 30 regulation, and copy ADMINISTRATOR on such notifications. 31 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 34 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 35 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract Agreement and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 34 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 36 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 37 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 1 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 2 or statestate regulations and/or COUNTY policies. 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 5 and implement written record management procedures. 6 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 8 and/or settlement of claims. 9 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 10 following discharge of the participant, client and/or patient. 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 12 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 14 written approval to CONTRACTOR to maintain records in a single location, identified by 15 CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 18 all information that is requested by the PRA request. 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 22 maintained by or for a covered entity that is: 23 1. The medical records and billing records about individuals maintained by or for a covered 25 2. The enrollment, payment, claims adjudication, and case or medical management record 26 systems maintained by or for a health plan; or 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 29 with the terms of this Agreement and common business practices. If documentation is retained 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 32 or site visit. 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 36 requested. 37 // 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 4 or regulation, and copy ADMINISTRATOR on such notifications. 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 8 L. CONTRACTOR shall obtain an NPI for each site identified as a location for providing 9 contractual services. Provider’s site NPIs must be submitted to the ADMINISTRATOR prior to 10 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 11 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 12 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 13 on file with ADMINISTRATOR in advance of providing services to Clients. It is the responsibility of 14 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 15 NPPES. Each contract site, as well as every staff member that provides billable services, is responsible 16 for notifying the NPPES within 30 calendar days of any updates to personal information, which may 17 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 18

RECORDS MANAGEMENT AND MAINTENANCE. 20 12 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 13 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 14 accordance with this Contract Agreement and all applicable requirements. 23 15 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 16 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 17 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 18 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 19 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 20 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 21 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 22 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 23 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 24 principles of reimbursement and GAAP. 33 25 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 26 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 27 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 28 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 29 B. CONTRACTOR shall implement and maintain administrative, technical and physical 30 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 31 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 32 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 33 or statestate regulations and/or COUNTY policies. 34 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 35 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 36 and implement written record management procedures. 37 // DocuSign Envelope ID: 078BF8D6-5F2D-4A09-9496-B48306DEE156 1 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 2 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 3 and/or settlement of claims. 4 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) following 5 discharge of the participant, client and/or patient. 6 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 7 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 8 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 9 written approval to CONTRACTOR to maintain records in a single location, identified by 10 CONTRACTOR. 11 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 12 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 13 all information that is requested by the PRA request. 14 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 15 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 17 maintained by or for a covered entity that is: 18 1. The medical records and billing records about individuals maintained by or for a covered 20 2. The enrollment, payment, claims adjudication, and case or medical management record 21 systems maintained by or for a health plan; or 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 23 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 24 with the terms of this Agreement and common business practices. If documentation is retained 25 electronically, CONTRACTOR shall, in the event of an audit or site visit: 26 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 27 or site visit. 28 2. Provide auditor or other authorized individuals access to documents via a computer 29 terminal. 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 31 requested. 32 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 33 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 34 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 35 or regulation, and copy ADMINISTRATOR on such notifications. 36 // 37 // DocuSign Envelope ID: 078BF8D6-5F2D-4A09-9496-B48306DEE156 1 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 2 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 3 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 4 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 5 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 6

RECORDS MANAGEMENT AND MAINTENANCE. 20 21 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 22 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 23 accordance with this Contract Agreement and all applicable requirements. 23 24 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 25 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 26 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 27 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 28 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 29 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 30 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 31 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 32 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 33 principles of reimbursement and GAAP. 33 34 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 35 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 36 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 37 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 2 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 3 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 4 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 5 or statestate regulations and/or COUNTY policies. 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 8 and implement written record management procedures. 9 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 10 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 11 and/or settlement of claims. 12 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 13 following discharge of the participant, client and/or patient. 14 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 15 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 16 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 17 written approval to CONTRACTOR to maintain records in a single location, identified by 18 CONTRACTOR. 19 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 20 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 21 all information that is requested by the PRA request. 22 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 23 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 24 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 25 maintained by or for a covered entity that is: 26 1. The medical records and billing records about individuals maintained by or for a covered 28 2. The enrollment, payment, claims adjudication, and case or medical management record 29 systems maintained by or for a health plan; or 30 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 31 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 32 with the terms of this Agreement and common business practices. If documentation is retained 33 electronically, CONTRACTOR shall, in the event of an audit or site visit: 34 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 35 or site visit. 36 2. Provide auditor or other authorized individuals access to documents via a computer 37 terminal. 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 2 requested. 3 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 4 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 5 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 6 or regulation, and copy ADMINISTRATOR on such notifications. 7 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 8 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 9 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 10 L. CONTRACTOR shall obtain an NPI for each site identified as a location for providing 11 contractual services. Provider’s site NPIs must be submitted to the ADMINISTRATOR prior to 12 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 13 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 14 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 15 on file with ADMINISTRATOR in advance of providing services to Clients. It is the responsibility of 16 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 17 NPPES. Each contract site, as well as every staff member that provides billable services, is responsible 18 for notifying the NPPES within 30 calendar days of any updates to personal information, which may 19 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 20

RECORDS MANAGEMENT AND MAINTENANCE. 20 24 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 25 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 26 accordance with this Contract Agreement and all applicable requirements. 23 27 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 28 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 29 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 30 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 31 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 32 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 33 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 34 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 35 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 36 principles of reimbursement and GAAP. 33 37 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 1 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 2 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 3 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 4 B. CONTRACTOR shall implement and maintain administrative, technical and physical 5 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 6 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 7 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 8 or statestate regulations and/or COUNTY policies. 9 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 10 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 11 and implement written record management procedures. 12 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 13 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 14 and/or settlement of claims. 15 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 16 following discharge of the participant, client and/or patient. 17 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 18 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 19 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 20 written approval to CONTRACTOR to maintain records in a single location, identified by 21 CONTRACTOR. 22 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 23 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 24 all information that is requested by the PRA request. 25 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 26 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 27 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 28 maintained by or for a covered entity that is: 29 1. The medical records and billing records about individuals maintained by or for a covered 31 2. The enrollment, payment, claims adjudication, and case or medical management record 32 systems maintained by or for a health plan; or 33 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 34 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 35 with the terms of this Agreement and common business practices. If documentation is retained 36 electronically, CONTRACTOR shall, in the event of an audit or site visit: 37 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 1 or site visit. 2 2. Provide auditor or other authorized individuals access to documents via a computer 3 terminal. 4 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 5 requested. 6 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 7 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 8 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 9 or regulation, and copy ADMINISTRATOR on such notifications. 10 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy 11 and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR 12 shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 13 CONTRACTOR shall obtain an NPI for each site identified as a location for providing contractual 14 services. Provider’s site NPIs must be submitted to the ADMINISTRATOR prior to rendering services 15 to Clients. Contractors providing direct or indirect services for State reporting must also submit 16 rendering (individual) provider NPIs to ADMINISTRATOR for each staff member providing Medi–Cal 17 billable services. Contractor reimbursement will not be processed unless NPIs are on file with 18 ADMINISTRATOR in advance of providing services to Clients. It is the responsibility of each contract 19 provider site and individual staff member that bills Medi–Cal to obtain an NPI from the NPPES. Each 20 contract site, as well as every staff member that provides billable services, is responsible for notifying 21 the NPPES within 30 calendar days of any updates to personal information, which may include, but is 22 not limited to, worksite address, name changes, taxonomy code changes, etc. 23

RECORDS MANAGEMENT AND MAINTENANCE. 20 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 13 accordance with this Contract Agreement and all applicable requirements. 23 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 15 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 16 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 22 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 23 principles of reimbursement and GAAP. 33 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 27 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 29 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 30 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 31 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 32 or statestate regulations and/or COUNTY policies. 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 35 and implement written record management procedures. 36 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 37 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 1 and/or settlement of claims. 2 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 3 following discharge of the participant, client and/or patient. 4 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 5 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 6 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 7 written approval to CONTRACTOR to maintain records in a single location, identified by 8 CONTRACTOR. 9 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 10 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 11 all information that is requested by the PRA request. 12 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 13 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 14 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 15 maintained by or for a covered entity that is: 16 1. The medical records and billing records about individuals maintained by or for a covered 18 2. The enrollment, payment, claims adjudication, and case or medical management record 20 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 21 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 22 with the terms of this Agreement and common business practices. If documentation is retained 23 electronically, CONTRACTOR shall, in the event of an audit or site visit: 24 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 25 or site visit. 26 2. Provide auditor or other authorized individuals access to documents via a computer 27 terminal. 28 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 29 requested. 30 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 31 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 32 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 33 or regulation, and copy ADMINISTRATOR on such notifications. 34 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 35 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 36 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 37 L. CONTRACTOR shall obtain an NPI for each site identified as a location for providing 1 contractual services. Provider’s site NPIs must be submitted to the ADMINISTRATOR prior to 2 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 3 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 4 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 5 on file with ADMINISTRATOR in advance of providing services to Clients. It is the responsibility of 6 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 7 NPPES. Each contract site, as well as every staff member that provides billable services, is responsible 8 for notifying the NPPES within 30 calendar days of any updates to personal information, which may 9 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 10

RECORDS MANAGEMENT AND MAINTENANCE. 20 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 6 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 7 accordance with this Contract Agreement and all applicable requirements. 23 8 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 9 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 10 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 11 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 12 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 13 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 14 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 15 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 16 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 17 principles of reimbursement and GAAP. 33 18 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 19 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 20 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 21 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 22 B. CONTRACTOR shall implement and maintain administrative, technical and physical 23 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 24 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 25 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 26 or statestate regulations and/or COUNTY policies. 27 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 28 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 29 and implement written record management procedures. 30 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 31 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 32 and/or settlement of claims. 33 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) following 34 discharge of the participant, client and/or patient. 35 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 36 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 37 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 1 written approval to CONTRACTOR to maintain records in a single location, identified by 2 CONTRACTOR. 3 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 4 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 5 all information that is requested by the PRA request. 6 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 9 maintained by or for a covered entity that is: 10 1. The medical records and billing records about individuals maintained by or for a covered 12 2. The enrollment, payment, claims adjudication, and case or medical management record 13 systems maintained by or for a health plan; or 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 15 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 16 with the terms of this Agreement and common business practices. If documentation is retained 17 electronically, CONTRACTOR shall, in the event of an audit or site visit: 18 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 19 or site visit. 20 2. Provide auditor or other authorized individuals access to documents via a computer 21 terminal. 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 23 requested. 24 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 25 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 26 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 27 or regulation, and copy ADMINISTRATOR on such notifications. 28 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 29 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 30 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 31 L. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 32 years following discharge of the participant, client and/or patient, with the exception of non- 33 emancipated minors for whom records must be kept for at least one (1) year after such minors have 34 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 35 longer. 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 20 5 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 6 accordance with this Contract and all applicable requirements. 23 7 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 8 shall include, but not be limited to, individual patient charts and utilization review records. 26 9 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 10 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 principles of reimbursement and GAAP. 33 14 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 15 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 16 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 17 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 18 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 19 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 20 regulations and/or COUNTY policies.

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract Agreement and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require.. 27 // 29 28 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 29 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 30 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 31 principles of reimbursement and GAAP. 33 32 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 33 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 34 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 35 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 36 B. CONTRACTOR shall implement and maintain administrative, technical and physical 37 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 1 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 2 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 3 or statestate regulations and/or COUNTY policies. 4 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 5 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 6 and implement written record management procedures. 7 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) 8 years from the termination of the contract, unless a longer period is required due to legal proceedings 9 such as litigations and/or settlement of claims. 10 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7)/ten (10) 11 years following discharge of the participant, client and/or patient. 12 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 13 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 14 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 15 written approval to CONTRACTOR to maintain records in a single location, identified by 16 CONTRACTOR. 17 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 18 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 19 all information that is requested by the PRA request. 20 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 21 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 22 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 23 maintained by or for a covered entity that is: 24 1. The medical records and billing records about individuals maintained by or for a covered 26 2. The enrollment, payment, claims adjudication, and case or medical management record 27 systems maintained by or for a health plan; or 28 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 29 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 30 with the terms of this Agreement and common business practices. If documentation is retained 31 electronically, CONTRACTOR shall, in the event of an audit or site visit: 32 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 33 or site visit. 34 2. Provide auditor or other authorized individuals access to documents via a computer 35 terminal. 36 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 37 requested. 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 3 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 4 or regulation, and copy ADMINISTRATOR on such notifications. 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 8

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 19 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract Agreement and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 34 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 36 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 37 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 1 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state

RECORDS MANAGEMENT AND MAINTENANCE. 20 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 12 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 13 accordance with this Contract Agreement and all applicable requirements. 23 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 15 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 16 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 22 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 23 principles of reimbursement and GAAP. 33 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 27 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 29 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 30 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 31 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 32 regulations and/or COUNTY policies. 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 35 implement written record management procedures. 36 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 37 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 1 and/or settlement of claims. 2 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 3 discharge of the participant, client and/or patient. 4 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 5 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 6 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 7 written approval to CONTRACTOR to maintain records in a single location, identified by 8 CONTRACTOR. 9 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 10 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 11 information that is requested by the PRA request. 12 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 13 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 14 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 15 for a covered entity that is: 16 1. The medical records and billing records about individuals maintained by or for a covered 18 2. The enrollment, payment, claims adjudication, and case or medical management record 20 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 21 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 22 with the terms of this Agreement and common business practices. If documentation is retained 23 electronically, CONTRACTOR shall, in the event of an audit or site visit: 24 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 25 or site visit. 26 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 27 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 28 requested. 29 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 30 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 31 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 32 regulation, and copy ADMINISTRATOR on such notifications. 33 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 34 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 35 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 3 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 7 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 18 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 20 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 22 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 26 implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 28 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 5 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 6 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 7 for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 19 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 20 requested. 21 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 22 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 23 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 24 regulation, and copy ADMINISTRATOR on such notifications. 25 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28

RECORDS MANAGEMENT AND MAINTENANCE. 20 16 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 17 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 18 accordance with this Contract Agreement and all applicable requirements. 23 19 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 20 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 21 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 22 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 23 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 24 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 25 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 26 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 27 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 28 principles of reimbursement and GAAP. 33 29 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 30 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 31 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 32 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 33 B. CONTRACTOR shall implement and maintain administrative, technical and physical 34 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 35 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 36 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 37 or statestate regulations and/or COUNTY policies. 1 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 2 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 3 and implement written record management procedures. 4 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 5 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 6 and/or settlement of claims. 7 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 8 following discharge of the participant, client and/or patient. 9 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 10 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 11 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 12 written approval to CONTRACTOR to maintain records in a single location, identified by 13 CONTRACTOR. 14 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 15 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 16 all information that is requested by the PRA request. 17 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 18 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 19 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 20 maintained by or for a covered entity that is: 21 1. The medical records and billing records about individuals maintained by or for a covered 23 2. The enrollment, payment, claims adjudication, and case or medical management record 24 systems maintained by or for a health plan; or 25 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 26 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 27 with the terms of this Agreement and common business practices. If documentation is retained 28 electronically, CONTRACTOR shall, in the event of an audit or site visit: 29 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 30 or site visit. 31 2. Provide auditor or other authorized individuals access to documents via a computer 32 terminal. 33 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 34 requested. 35 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 36 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 37 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 1 or regulation, and copy ADMINISTRATOR on such notifications. 2 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 3 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 4 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 5 L. CONTRACTOR shall obtain an NPI for each site identified as a location for providing 6 contractual services. Provider’s site NPIs must be submitted to the ADMINISTRATOR prior to 7 rendering services to Clients. Contractors providing direct or indirect services for State reporting must 8 also submit rendering (individual) provider NPIs to ADMINISTRATOR for each staff member 9 providing Medi–Cal billable services. Contractor reimbursement will not be processed unless NPIs are 10 on file with ADMINISTRATOR in advance of providing services to Clients. It is the responsibility of 11 each contract provider site and individual staff member that bills Medi–Cal to obtain an NPI from the 12 NPPES. Each contract site, as well as every staff member that provides billable services, is responsible 13 for notifying the NPPES within 30 calendar days of any updates to personal information, which may 14 include, but is not limited to, worksite address, name changes, taxonomy code changes, etc. 15

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 7 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 20 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 22 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 26 implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 31 discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. 36 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, 37 this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 1 information that is requested by the PRA request. 2 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 3 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 4 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 5 for a covered entity that is: 6 1. The medical records and billing records about individuals maintained by or for a covered 8 2. The enrollment, payment, claims adjudication, and case or medical management record 10 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 11 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with 12 the terms of this Contract and common business practices. If documentation is retained electronically, 13 CONTRACTOR shall, in the event of an audit or site visit: 14 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 15 or site visit. 16 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 17 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 18 requested. 19 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security 20 of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII 21 and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, 22 and copy ADMINISTRATOR on such notifications. 23 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 24 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 25 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 26

RECORDS MANAGEMENT AND MAINTENANCE. 20 21 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 22 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 23 accordance with this Contract and all applicable requirements. 23 24 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 25 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 26 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 27 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 28 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 29 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 30 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 31 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 32 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 33 principles of reimbursement and GAAP. 33 34 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 35 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 36 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 37 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 2 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 3 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 4 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 5 or statestate regulations and/or COUNTY policies. 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 8 and implement written record management procedures. 9 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 10 termination of the Contract, unless a longer period is required due to legal proceedings such as 11 litigations and/or settlement of claims. 12 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 13 following discharge of the participant, client and/or patient. 14 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 15 xxxxxxxx, and revenues available at one (1) location within the limits of Orange County. If 16 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 17 written approval to CONTRACTOR to maintain records in a single location, identified by 18 CONTRACTOR. 19 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 20 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 21 information that is requested by the PRA request. 22 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 23 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 24 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 25 maintained by or for a covered entity that is: 26 1. The medical records and billing records about individuals maintained by or for a covered 28 2. The enrollment, payment, claims adjudication, and case or medical management record 29 systems maintained by or for a health plan; or 30 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 31 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 32 with the terms of this Contract and common business practices. If documentation is retained 33 electronically, CONTRACTOR shall, in the event of an audit or site visit: 34 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 35 or site visit. 36 2. Provide auditor or other authorized individuals access to documents via a computer 37 terminal. 1 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 2 requested. 3 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 4 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 5 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 6 or regulation, and copy ADMINISTRATOR on such notifications. 7 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 8 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 9 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 10 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 11 xxxxxxxx, and revenues available at one (1) location within the limits of Orange County. 12

RECORDS MANAGEMENT AND MAINTENANCE. 20 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 20 accordance with this Contract Agreement and all applicable requirements. 23 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 22 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 23 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 25 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 26 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 27 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 28 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 29 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 30 principles of reimbursement and GAAP. 33 31 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 32 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 33 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 34 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 35 B. CONTRACTOR shall implement and maintain administrative, technical and physical 36 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 37 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 1 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 2 or statestate regulations and/or COUNTY policies. 3 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 4 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 5 and implement written record management procedures. 6 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 7 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 8 and/or settlement of claims. 9 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 10 following discharge of the participant, client and/or patient. 11 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 12 billings, and revenues available at one (1) location within the limits of the County of Orange. If 13 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 14 written approval to CONTRACTOR to maintain records in a single location, identified by 15 CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 18 all information that is requested by the PRA request. 19 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 20 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 21 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 22 maintained by or for a covered entity that is: 23 1. The medical records and billing records about individuals maintained by or for a covered 25 2. The enrollment, payment, claims adjudication, and case or medical management record 26 systems maintained by or for a health plan; or 27 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 28 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 29 with the terms of this Agreement and common business practices. If documentation is retained 30 electronically, CONTRACTOR shall, in the event of an audit or site visit: 31 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 32 or site visit. 33 2. Provide auditor or other authorized individuals access to documents via a computer 34 terminal. 35 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 36 requested. 37 // 1 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 3 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 4 regulation, and copy ADMINISTRATOR on such notifications. 5 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 6 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 7 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 8 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 9 billings, and revenues available at one (1) location within the limits of the County of Orange. 10

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 3 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 7 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 18 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 20 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or statestate regulations and/or COUNTY policies. 24 C. CONTRACTOR’s Client records shall be maintained in a secure manner. CONTRACTOR shall 25 maintain Client records and must establish and implement written record management procedures. 26 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 27 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 28 and/or settlement of claims. 29 E. CONTRACTOR shall retain all Client medical records for ten (10) years following discharge of 30 the Client. 31 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 32 xxxxxxxx, and revenues available at one (1) location within the limits of Orange County. If CONTRACTOR 33 is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to 34 CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. 35 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 36 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 37 information that is requested by the PRA request. 1 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that Clients 2 be provided the right to access or receive a copy of their DRS and/or request addendum to their records. 3 Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 4 1. The medical records and billing records about individuals maintained by or for a covered 6 2. The enrollment, payment, claims adjudication, and case or medical management record 7 systems maintained by or for a health plan; or 8 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 9 I. CONTRACTOR may retain Client documentation electronically in accordance with the terms of 10 this Contract and common business practices. If documentation is retained electronically, 11 CONTRACTOR shall, in the event of an audit or site visit: 12 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 13 or site visit. 14 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 16 requested. 17 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 18 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 19 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 20 regulation, and copy ADMINISTRATOR on such notifications. 21 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 22 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 23 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 24

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 3 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 7 shall include, but not be limited to, individual patient charts and utilization review records.. 8 26 9 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 10 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 11 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 12 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 13 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 14 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 15 principles of reimbursement and GAAP. 33 16 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 17 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 18 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 19 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 21 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 22 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 23 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 24 regulations and/or COUNTY policies. 25 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 26 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 27 implement written record management procedures. 28 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 29 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 30 and/or settlement of claims. 31 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 32 discharge of the participant, client and/or patient. 33 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 34 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 35 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 36 written approval to CONTRACTOR to maintain records in a single location, identified by 37 CONTRACTOR. 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 5 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 6 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 7 for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 19 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 20 requested. 21 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security 22 of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII 23 and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, 24 and copy ADMINISTRATOR on such notifications. 25 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 26 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 27 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 28

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 18 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical 20 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 21 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 22 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 23 or statestate regulations and/or COUNTY policies. 24 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 25 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 26 and implement written record management procedures. 27 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 28 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 29 and/or settlement of claims. 30 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 31 following discharge of the participant, client and/or patient. 32 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 34 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 35 written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 7 maintained by or for a covered entity that is: 8 1. The medical records and billing records about individuals maintained by or for a covered 10 2. The enrollment, payment, claims adjudication, and case or medical management record 11 systems maintained by or for a health plan; or 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 13 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 14 with the terms of this Contract and common business practices. If documentation is retained 15 electronically, CONTRACTOR shall, in the event of an audit or site visit: 16 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 17 or site visit. 18 2. Provide auditor or other authorized individuals access to documents via a computer 19 terminal. 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 21 requested. 22 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 23 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 24 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 25 or regulation, and copy ADMINISTRATOR on such notifications. 26 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 27 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 28 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 29

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such 7 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever 13 nature 31 claimed to have been incurred in the performance of this Contract and in accordance with 14 Medicare 32 principles of reimbursement and GAAP.. 15 // 33 16 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 17 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the 18 medical 35 necessity of the service, and the quality of care provided. Records shall be maintained in 19 accordance with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical 21 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure 22 of PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 23 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of 24 federal or statestate regulations and/or COUNTY policies. 25 C. CONTRACTOR’s participant, Client, and/or patient records shall be maintained in a secure 26 manner. CONTRACTOR shall maintain participant, Client, and/or patient records and must establish 27 and implement written record management procedures. 28 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 29 termination of the Contract, unless a longer period is required due to legal proceedings such as 30 litigations and/or settlement of claims. 31 E. CONTRACTOR shall retain all Client and/or patient medical records for ten (10) years 32 following discharge of the participant, Client and/or patient. 33 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, 34 charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.

RECORDS MANAGEMENT AND MAINTENANCE. 20 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 3 this Contract, prepare, maintain and manage records appropriate to the services provided and in 22 4 accordance with this Contract and all applicable requirements. 23 5 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 6 which claims are submitted for reimbursement under this Contract and the charges thereto. Such records 25 7 shall include, but not be limited to, individual patient charts and utilization review records. 26 8 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 9 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 10 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 11 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 12 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 13 claimed to have been incurred in the performance of this Contract and in accordance with Medicare 32 14 principles of reimbursement and GAAP. 33 15 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 16 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 17 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 36 18 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 19 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 1 20 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 2 21 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 3 22 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or statestate 23 regulations and/or COUNTY policies. 24 C. CONTRACTOR’s Client records shall be maintained in a secure manner. CONTRACTOR shall 25 maintain Client records and must establish and implement written record management procedures. 26 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 27 termination of the Contract, unless a longer period is required due to legal proceedings such as litigations 28 and/or settlement of claims. 29 E. CONTRACTOR shall retain all Client and/or patient medical records for ten (10) years following 30 discharge of the Client. 31 F. CONTRACTOR shall make records pertaining to the costs of services, Client fees, charges, 32 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 33 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 34 written approval to CONTRACTOR to maintain records in a single location, identified by 35 CONTRACTOR. 36 // 37 // 1 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Contract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that Clients 5 be provided the right to access or receive a copy of their DRS and/or request addendum to their records. 6 Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 7 1. The medical records and billing records about individuals maintained by or for a covered 9 2. The enrollment, payment, claims adjudication, and case or medical management record 10 systems maintained by or for a health plan; or 11 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 12 I. CONTRACTOR may retain Client, and/or patient documentation electronically in accordance 13 with the terms of this Contract and common business practices. If documentation is retained 14 electronically, CONTRACTOR shall, in the event of an audit or site visit: 15 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 16 or site visit. 17 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 18 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 19 requested. 20 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 21 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 22 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 23 regulation, and copy ADMINISTRATOR on such notifications. 24 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 25 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 26 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 27 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 28 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 29

RECORDS MANAGEMENT AND MAINTENANCE. 20 29 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 30 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 31 accordance with this Contract Agreement and all applicable requirements. 23 32 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 33 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 34 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 35 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 36 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 37 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 1 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 2 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 3 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 4 principles of reimbursement and GAAP. 33 5 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 6 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 7 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 8 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 9 B. CONTRACTOR shall implement and maintain administrative, technical and physical 10 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 11 PHI made in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to 12 the extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of 13 federal or statestate regulations and/or COUNTY policies. 14 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 15 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 16 and implement written record management procedures. 17 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 18 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 19 and/or settlement of claims. 20 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 21 following discharge of the participant, client and/or patient. 22 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 23 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 24 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 25 written approval to CONTRACTOR to maintain records in a single location, identified by 26 CONTRACTOR. 27 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 28 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 29 all information that is requested by the PRA request. 30 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 31 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 32 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 33 maintained by or for a covered entity that is: 34 1. The medical records and billing records about individuals maintained by or for a covered 36 2. The enrollment, payment, claims adjudication, and case or medical management record 37 systems maintained by or for a health plan; or 1 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 2 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 3 with the terms of this Agreement and common business practices. If documentation is retained 4 electronically, CONTRACTOR shall, in the event of an audit or site visit: 5 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 6 or site visit. 7 2. Provide auditor or other authorized individuals access to documents via a computer 8 terminal. 9 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 10 requested. 11 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 12 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 13 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 14 or regulation, and copy ADMINISTRATOR on such notifications. 15 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 16 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 17 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 18

RECORDS MANAGEMENT AND MAINTENANCE. 20 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 13 accordance with this Contract Agreement and all applicable requirements. 23 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 15 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 16 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 22 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 23 principles of reimbursement and GAAP. 33 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 27 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 29 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 30 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 31 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 32 or statestate regulations and/or COUNTY policies. 33 C. CONTRACTOR’s Client records shall be maintained in a secure manner. CONTRACTOR 34 shall maintain Client records and must establish and implement written record management procedures. 35 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 36 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 37 and/or settlement of claims. 1 E. CONTRACTOR shall retain all Client and/or patient medical records for ten (10) years 2 following discharge of the Client. 3 F. CONTRACTOR shall make records pertaining to the costs of services, Client fees, charges, 4 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 5 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 6 written approval to CONTRACTOR to maintain records in a single location, identified by 7 CONTRACTOR. 8 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 9 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 10 all information that is requested by the PRA request. 11 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 12 Clients be provided the right to access or receive a copy of their DRS and/or request addendum to their 13 records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered 14 entity that is: 15 1. The medical records and billing records about individuals maintained by or for a covered 17 2. The enrollment, payment, claims adjudication, and case or medical management record 18 systems maintained by or for a health plan; or 19 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 20 I. CONTRACTOR may retain Client, and/or patient documentation electronically in accordance 21 with the terms of this Agreement and common business practices. If documentation is retained 22 electronically, CONTRACTOR shall, in the event of an audit or site visit: 23 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 24 or site visit. 25 2. Provide auditor or other authorized individuals access to documents via a computer 26 terminal. 27 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 28 requested. 29 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 30 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 31 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 32 or regulation, and copy ADMINISTRATOR on such notifications. 33 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 34 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 35 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 36 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 37 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.

RECORDS MANAGEMENT AND MAINTENANCE. 20 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 12 of 21 this ContractAgreement, prepare, maintain and manage records appropriate to the services provided and in 22 13 accordance with this Contract Agreement and all applicable requirements. 23 14 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 15 which claims are submitted for reimbursement under this Contract Agreement and the charges thereto. Such 16 records 25 shall include, but not be limited to, individual patient charts and utilization review records. 26 17 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN 27 18 Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 28 19 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 29 20 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 30 21 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 31 22 claimed to have been incurred in the performance of this Contract Agreement and in accordance with Medicare 32 23 principles of reimbursement and GAAP. 33 24 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 34 25 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 35 26 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 27 with 36 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 37 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 29 safeguards 1 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 30 PHI in 2 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 31 extent 3 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 32 or statestate regulations and/or COUNTY policies. 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 35 and implement written record management procedures. 36 // 37 // 1 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years years from 2 the termination of the contract, unless a longer period is required due to legal proceedings such as 3 litigations and/or settlement of claims. 4 E. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 5 following discharge of the participant, client and/or patient, or as otherwise required by applicable 6 federal or state law. 7 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 8 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 9 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 10 written approval to CONTRACTOR to maintain records in a single location, identified by 11 CONTRACTOR. 12 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 13 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 14 all information that is requested by the PRA request. 15 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 16 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 17 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 18 maintained by or for a covered entity that is: 19 1. The medical records and billing records about individuals maintained by or for a covered 21 2. The enrollment, payment, claims adjudication, and case or medical management record 22 systems maintained by or for a health plan; or 23 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 24 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 25 with the terms of this Agreement and common business practices. If documentation is retained 26 electronically, CONTRACTOR shall, in the event of an audit or site visit: 27 1. Have documents readily available within three (3) business days of receiving notice of a 28 scheduled audit or site visit. 29 2. Provide auditor or other authorized individuals access to documents via a computer 30 terminal. 31 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 32 requested. 33 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 34 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 35 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 36 or regulation, and copy ADMINISTRATOR on such notifications. 37 // 1 K. CONTRACTOR shall bear the costs associated with a Breach of privacy and/or security of PII 2 and/or PHI that is caused by CONTRACTOR and that COUNTY incurs in addressing such Breach and 3 consequences thereof, including costs of investigation, notification, remediation, documentation or other 4 costs associated with addressing the Breach. 5