Common use of RECORDS MANAGEMENT AND MAINTENANCE Clause in Contracts

RECORDS MANAGEMENT AND MAINTENANCE. 2 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 accordance with this Agreement and all applicable requirements. 5 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of federal or state regulations and/or COUNTY policies. 10 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and implement written record management procedures. 13 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 all times. 18 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 maintained by or for a covered entity that is: 22 1. The medical records and billing records about individuals maintained by or for a covered 24 2. The enrollment, payment, claims adjudication, and case or medical management record 25 systems maintained by or for a health plan; or 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance with the terms of this Agreement and common business practices. If documentation is 29 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or site visit. 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 requested.

RECORDS MANAGEMENT AND MAINTENANCE. 2 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 22 accordance with this Agreement and all applicable requirements. 5 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 24 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 25 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to 26 the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of 27 federal or state regulations and/or COUNTY policies. 10 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 30 implement written record management procedures. 13 31 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 expenditure, 32 revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 33 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 34 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 35 all times. 18 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 37 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 2 maintained by or for a covered entity that is: 22 3 1. The medical records and billing records about individuals maintained by or for a covered 24 5 2. The enrollment, payment, claims adjudication, and case or medical management record 25 6 systems maintained by or for a health plan; or 26 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 9 accordance with the terms of this Agreement and common business practices. If documentation is 29 10 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 12 site visit. 32 13 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 14 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 15 requested. 16 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 17 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 18 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 19 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 20 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 21 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 22 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 23 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 24 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 25 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 26 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 27 commencement of the contract, unless a longer period is required due to legal proceedings such as 28 litigations and/or settlement of claims. 29 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 30 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 31 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 32 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 33 CONTRACTOR. 34 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 35 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 36 // 37 // 1 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 2 with the terms of this Agreement and common business practices. If documentation is 29 retained 3 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 5 site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 17 following discharge of the client and/or patient, with the exception of non-emancipated minors for 18 whom records must be kept for at least one (1) year after such minors have reached the age of eighteen

RECORDS MANAGEMENT AND MAINTENANCE. 2 14 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 15 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 16 accordance with this Agreement and all applicable requirements. 5 17 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 18 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 19 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 20 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 21 violation of federal or state regulations and/or COUNTY policies. 10 22 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 23 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 24 and implement written record management procedures. 13 25 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 26 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 27 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 28 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 29 all times. 18 30 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 31 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 32 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 33 maintained by or for a covered entity that is: 22 34 1. The medical records and billing records about individuals maintained by or for a covered 24 36 2. The enrollment, payment, claims adjudication, and case or medical management record 25 37 systems maintained by or for a health plan; or 26 1 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 2 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 3 with the terms of this Agreement and common business practices. If documentation is 29 retained 4 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 5 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 6 site visit. 32 7 2. Provide auditor or other authorized individuals access to documents via a computer 33 8 terminal. 34 9 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 10 requested. 11 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 12 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 13 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 14 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 15 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 16 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 17 J. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 18 following discharge of the client and/or patient, with the exception of non-emancipated minors for 19 whom records must be kept for at least one (1) year after such minors have reached the age of eighteen 20 (18) years, or for seven (7) years after the last date of service, whichever is longer. 21 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 22 commencement of the contract, unless a longer period is required due to legal proceedings such as 23 litigations and/or settlement of claims. 24 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 25 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 26 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 27 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 28 CONTRACTOR. 29 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 30 settlement of claims for a longer term as directed by ADMINISTRATOR. 31 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 32 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 33 all information that is requested by the PRA request. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 7 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 8 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 9 accordance with this Agreement and all applicable requirements. 5 10 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 11 to ensure the privacy of PHI PHI/PII and prevent the intentional or unintentional use or disclosure of 7 PHI PHI/PII 12 in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to 13 the extent practicable, the known harmful effect of any use or disclosure of PHI PHI/PII made in 9 violation of 14 federal or state regulations and/or COUNTY policies. 10 15 C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure 11 16 manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish 12 17 and implement written record management procedures. 13 18 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 expenditure, 19 revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 20 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 21 preparation, and confidentiality of records related to participant, client Client and/or patient records are met at 17 22 all times. 18 23 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 clients24 Clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 25 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 26 maintained by or for a covered entity that is: 22 27 1. The medical records and billing records about individuals maintained by or for a covered 24 29 2. The enrollment, payment, claims adjudication, and case or medical management record 25 30 systems maintained by or for a health plan; or 26 31 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 32 G. CONTRACTOR may retain participant, clientClient, and/or patient documentation electronically in 28 33 accordance with the terms of this Agreement and common business practices. If documentation is 29 34 retained electronically, upon reasonable notice and during normal business hours, CONTRACTOR shall, 35 in the event of an audit or site visit: 30 36 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 37 site visit. 32 1 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 2 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 3 requested. 4 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 5 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 6 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 7 I. CONTRACTOR shall be required to pay actual costs associated with a Breach of privacy and/or 8 security of PII and/or PHI possessed or controlled by CONTRACTOR, including but not limited to the 9 costs of notification. 10 J. CONTRACTOR shall retain all participant, Client, and/or patient medical records for seven (7) 11 years following discharge of the participant, Client and/or patient, with the exception of non-emancipated 12 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 13 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 14 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 15 commencement of the contract, unless a longer period is required due to legal proceedings such as 16 litigations and/or settlement of claims. 17 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 18 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 19 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 20 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 21 CONTRACTOR. 22 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 23 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 24 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 25 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 26 information that is requested by the PRA request. 27

RECORDS MANAGEMENT AND MAINTENANCE. 2 7 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 8 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 9 accordance with this Agreement and all applicable requirements. 5 10 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 11 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 12 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 13 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 14 violation of federal or state regulations and/or COUNTY policies. 10 15 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 16 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 17 and implement written record management procedures. 13 18 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 19 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 20 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 21 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 22 all times. 18 23 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 24 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 25 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 26 maintained by or for a covered entity that is: 22 27 1. The medical records and billing records about individuals maintained by or for a covered 24 29 2. The enrollment, payment, claims adjudication, and case or medical management record 25 30 systems maintained by or for a health plan; or 26 31 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 32 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 33 accordance with the terms of this Agreement and common business practices. If documentation is 29 34 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 35 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 36 or site visit.. 37 // 32 1 2. Provide auditor or other authorized individuals access to documents via a computer 33 2 terminal. 34 3 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 4 requested. 5 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 6 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 7 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 8 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 9 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 10 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 11 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 12 years following discharge of the participant, client and/or patient, with the exception of non- 13 emancipated minors for whom records must be kept for at least one (1) year after such minors have 14 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 15 longer. 16 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 17 commencement of the contract, unless a longer period is required due to legal proceedings such as 18 litigations and/or settlement of claims. 19 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 20 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 21 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 22 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 23 CONTRACTOR. 24 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 25 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 26 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 27 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 28 all information that is requested by the PRA request. 29

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 . 27 D F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance with the terms of this Agreement and common business practices. If documentation is 29 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or site visit. 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 requested.

RECORDS MANAGEMENT AND MAINTENANCE. 2 27 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 28 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 29 accordance with this Agreement and all applicable requirements. 5 30 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 31 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 32 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 33 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 34 violation of federal or state regulations and/or COUNTY policies. 10 35 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 36 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 37 and implement written record management procedures. 13 . 1 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 2 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 3 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 4 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 5 all times. 18 6 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 9 maintained by or for a covered entity that is: 22 10 1. The medical records and billing records about individuals maintained by or for a covered 24 12 2. The enrollment, payment, claims adjudication, and case or medical management record 25 13 systems maintained by or for a health plan; or 26 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 15 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 16 accordance with the terms of this Agreement and common business practices. If documentation is 29 17 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 18 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 19 or site visit. 32 20 2. Provide auditor or other authorized individuals access to documents via a computer 33 21 terminal. 34 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 23 requested. 24 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 25 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 26 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 27 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 28 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 29 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 30 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 31 years following discharge of the participant, client and/or patient, with the exception of non- 32 emancipated minors for whom records must be kept for at least one (1) year after such minors have 33 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 34 longer. 35 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 36 commencement of the contract, unless a longer period is required due to legal proceedings such as 37 litigations and/or settlement of claims. 1 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 2 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 3 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 4 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 5 CONTRACTOR. 6 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 7 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 8 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 9 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 10 all information that is requested by the PRA request. 11

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 2 accordance with the terms of this Agreement and common business practices. If documentation is 29 3 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 5 or site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 17 years following discharge of the participant, client and/or patient, with the exception of non- 18 emancipated minors for whom records must be kept for at least one (1) year after such minors have 19 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 20 longer. 21 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 22 commencement of the contract, unless a longer period is required due to legal proceedings such as 23 litigations and/or settlement of claims. 24 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 25 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 26 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 27 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 28 CONTRACTOR. 29 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 30 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 31 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 32 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 33 all information that is requested by the PRA request. 34 // 35 // 36 // 37 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 15 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 16 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 17 accordance with this Agreement and all applicable requirements. 5 18 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 19 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 20 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 21 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 22 violation of federal or state regulations and/or COUNTY policies. 10 23 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 24 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 25 and implement written record management procedures. 13 26 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 27 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 28 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 29 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 30 all times. 18 31 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 32 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 33 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 34 maintained by or for a covered entity that is: 22 35 1. The medical records and billing records about individuals maintained by or for a covered 24 37 2. The enrollment, payment, claims adjudication, and case or medical management record 25 1 systems maintained by or for a health plan; or 26 2 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 . 3 // 4 // 5 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 6 with the terms of this Agreement and common business practices. If documentation is 29 retained 7 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 8 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 9 site visit. 32 10 2. Provide auditor or other authorized individuals access to documents via a computer 33 11 terminal. 34 12 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 13 requested.

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 . 27 D F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 36 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 37 with the terms of this Agreement and common business practices. If documentation is 29 retained 1 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 2 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 3 site visit. 32 4 2. Provide auditor or other authorized individuals access to documents via a computer 33 5 terminal. 34 6 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 7 requested. 8 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 9 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 10 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 11 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 12 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 13 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 14 J. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 15 following discharge of the client and/or patient, with the exception of non-emancipated minors for 16 whom records must be kept for at least one (1) year after such minors have reached the age of eighteen 17 (18) years, or for seven (7) years after the last date of service, whichever is longer. 18 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 19 commencement of the contract, unless a longer period is required due to legal proceedings such as 20 litigations and/or settlement of claims.

RECORDS MANAGEMENT AND MAINTENANCE. 2 13 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 14 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 15 accordance with this Agreement and all applicable requirements. 5 16 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 17 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 18 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 19 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 20 violation of federal or state regulations and/or COUNTY policies. 10 21 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 22 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 23 and implement written record management procedures. 13 24 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 25 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 26 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 27 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 28 all times. 18 29 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 30 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 31 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 32 maintained by or for a covered entity that is: 22 33 1. The medical records and billing records about individuals maintained by or for a covered 24 35 2. The enrollment, payment, claims adjudication, and case or medical management record 25 36 systems maintained by or for a health plan; or 26 37 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 27 of 35 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 2 accordance with the terms of this Agreement and common business practices. If documentation is 29 3 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 5 or site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 17 years following discharge of the participant, client and/or patient, with the exception of non- 18 emancipated minors for whom records must be kept for at least one (1) year after such 19 minors have reached the age of eighteen (18) years, or for seven (7) years after the last date of service, 20 whichever is longer. 21 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 22 commencement of the contract, unless a longer period is required due to legal proceedings such as 23 litigations and/or settlement of claims. 24 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 25 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 26 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 27 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 28 CONTRACTOR. 29 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 30 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 31 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 32 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 33 all information that is requested by the PRA request. 34

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // DocuSign Envelope ID: BFCD01B5-D006-4A32-9141-F0E14E16A639 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 2 accordance with the terms of this Agreement and common business practices. If documentation is 29 3 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 5 site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 17 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 18 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 19 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 20 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 21 commencement of the contract, unless a longer period is required due to legal proceedings such as 22 litigations and/or settlement of claims. 23 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 24 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 25 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 26 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 27 CONTRACTOR. 28 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 29 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 30 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 31 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 32 all information that is requested by the PRA request. 33

RECORDS MANAGEMENT AND MAINTENANCE. 2 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 22 accordance with this Agreement and all applicable requirements. 5 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 24 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 25 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to 26 the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of 27 federal or state regulations and/or COUNTY policies. 10 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 30 implement written record management procedures. 13 31 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 expenditure, 32 revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 33 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 34 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 35 all times. 18 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 37 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 2 maintained by or for a covered entity that is: 22 3 1. The medical records and billing records about individuals maintained by or for a covered 24 5 2. The enrollment, payment, claims adjudication, and case or medical management record 25 6 systems maintained by or for a health plan; or 26 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 9 accordance with the terms of this Agreement and common business practices. If documentation is 29 10 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 12 site visit. 32 13 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 14 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 15 requested. 16 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 17 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 18 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 19 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 20 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 21 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 22 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 23 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 24 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 25 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 26 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 27 commencement of the contract, unless a longer period is required due to legal proceedings such as 28 litigations and/or settlement of claims. 29 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 30 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 31 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 32 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 33 CONTRACTOR. 34 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 35 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 36 // 37 // 1 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request.

RECORDS MANAGEMENT AND MAINTENANCE. 2 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 of 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 22 accordance with this Agreement and all applicable requirements. 5 23 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 safeguards 24 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 PHI in 25 violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 mitigate to 26 the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 violation of 27 federal or state regulations and/or COUNTY policies. 10 28 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 29 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 30 implement written record management procedures. 13 31 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 expenditure, 32 revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 33 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 34 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 35 all times. 18 36 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 37 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 1 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 2 maintained by or for a covered entity that is: 22 3 1. The medical records and billing records about individuals maintained by or for a covered 24 5 2. The enrollment, payment, claims adjudication, and case or medical management record 25 6 systems maintained by or for a health plan; or 26 7 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 8 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 9 accordance with the terms of this Agreement and common business practices. If documentation is 29 10 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 11 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 12 site visit. 32 13 2. Provide auditor or other authorized individuals access to documents via a computer 33 14 terminal. 34 15 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 16 requested. 17 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 18 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 19 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 20 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 21 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 22 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 23 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 24 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 25 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 26 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 27 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 28 commencement of the contract, unless a longer period is required due to legal proceedings such as 29 litigations and/or settlement of claims. 30 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 31 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 32 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 33 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 34 CONTRACTOR. 35 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 36 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 37 // 1 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 2 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 3 information that is requested by the PRA request. 4

RECORDS MANAGEMENT AND MAINTENANCE. 2 25 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 26 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 27 accordance with this Agreement and all applicable requirements. 5 28 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 29 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 30 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 31 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 32 violation of federal or state regulations and/or COUNTY policies. 10 33 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 34 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 35 and implement written record management procedures. 13 36 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 37 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 1 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 2 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 3 all times. 18 4 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 5 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 6 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 7 maintained by or for a covered entity that is: 22 8 1. The medical records and billing records about individuals maintained by or for a covered 24 10 2. The enrollment, payment, claims adjudication, and case or medical management record 25 11 systems maintained by or for a health plan; or 26 12 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 13 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 14 accordance with the terms of this Agreement and common business practices. If documentation is 29 15 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 16 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 17 or site visit. 32 18 2. Provide auditor or other authorized individuals access to documents via a computer 33 19 terminal. 34 20 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 21 requested.

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 2 accordance with the terms of this Agreement and common business practices. If documentation is 29 3 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 5 site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 17 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 18 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 19 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 20 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 21 commencement of the contract, unless a longer period is required due to legal proceedings such as 22 litigations and/or settlement of claims. 23 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 24 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 25 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 26 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 27 CONTRACTOR. 28 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 29 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 30 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 31 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 32 all information that is requested by the PRA request. 33

RECORDS MANAGEMENT AND MAINTENANCE. 2 19 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 20 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 21 accordance with this Agreement and all applicable requirements. 5 22 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 23 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 24 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 25 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 26 violation of federal or state regulations and/or COUNTY policies. 10 27 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 28 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 29 and implement written record management procedures. 13 30 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 31 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 32 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 33 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 34 all times. 18 35 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 36 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 37 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 1 maintained by or for a covered entity that is: 22 2 1. The medical records and billing records about individuals maintained by or for a covered 24 4 2. The enrollment, payment, claims adjudication, and case or medical management record 25 5 systems maintained by or for a health plan; or 26 6 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 7 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 8 accordance with the terms of this Agreement and common business practices. If documentation is 29 9 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 10 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 11 or site visit. 32 12 2. Provide auditor or other authorized individuals access to documents via a computer 33 13 terminal. 34 14 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 15 requested. 16 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 17 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 18 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 19 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 20 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 21 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 22 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 23 years following discharge of the participant, client and/or patient, with the exception of non- 24 emancipated minors for whom records must be kept for at least one (1) year after such minors have 25 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 26 longer. 27 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 28 commencement of the contract, unless a longer period is required due to legal proceedings such as 29 litigations and/or settlement of claims. 30 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 31 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 32 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 33 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 34 CONTRACTOR. 35 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 36 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 37 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 1 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 2 all information that is requested by the PRA request. 3

RECORDS MANAGEMENT AND MAINTENANCE. 2 4 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 5 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 6 accordance with this Agreement and all applicable requirements. 5 7 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 8 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 9 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 10 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 11 violation of federal or state regulations and/or COUNTY policies. 10 12 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 13 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 14 and implement written record management procedures. 13 15 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 16 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 17 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 18 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 19 all times. 18 20 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 21 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 22 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 23 maintained by or for a covered entity that is: 22 24 1. The medical records and billing records about individuals maintained by or for a coveredcovered 25 health care provider; 24 26 2. The enrollment, payment, claims adjudication, and case or medical management record 25 27 systems maintained by or for a health plan; or 26 28 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 29 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 30 accordance with the terms of this Agreement and common business practices. If documentation is 29 31 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 32 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 33 or site visit. 32 34 2. Provide auditor or other authorized individuals access to documents via a computer 33 35 terminal. 34 36 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 37 requested. 1 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 2 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 3 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 4 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 5 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 6 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 7 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 8 years following discharge of the participant, client and/or patient, with the exception of non- 9 emancipated minors for whom records must be kept for at least one (1) year after such minors have 10 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 11 longer. 12 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 13 commencement of the contract, unless a longer period is required due to legal proceedings such as 14 litigations and/or settlement of claims. 15 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 16 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 17 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 18 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 19 CONTRACTOR. 20 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 21 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 22 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 23 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 24 all information that is requested by the PRA request. 25 // 26 //

RECORDS MANAGEMENT AND MAINTENANCE. 2 36 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 37 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 1 accordance with this Agreement and all applicable requirements. 5 2 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 3 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 4 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 5 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 6 violation of federal or state regulations and/or COUNTY policies. 10 7 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 8 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 9 and implement written record management procedures. 13 10 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 11 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 12 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 13 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 14 all times. 18 15 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 16 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 17 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 18 maintained by or for a covered entity that is: 22 19 1. The medical records and billing records about individuals maintained by or for a covered 24 21 2. The enrollment, payment, claims adjudication, and case or medical management record 25 22 systems maintained by or for a health plan; or 26 23 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 24 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 25 accordance with the terms of this Agreement and common business practices. If documentation is 29 26 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 27 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 28 or site visit. 32 29 2. Provide auditor or other authorized individuals access to documents via a computer 33 30 terminal. 34 31 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 32 requested. 33 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 34 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 35 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 36 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 37 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 1 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 2 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 3 years following discharge of the participant, client and/or patient, with the exception of non- 4 emancipated minors for whom records must be kept for at least one (1) year after such minors have 5 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 6 longer. 7 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 8 commencement of the contract, unless a longer period is required due to legal proceedings such as 9 litigations and/or settlement of claims. 10 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 11 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 12 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 13 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 14 CONTRACTOR. 15 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 16 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 17 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 18 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 19 all information that is requested by the PRA request. 20

RECORDS MANAGEMENT AND MAINTENANCE. 2 17 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 18 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 19 accordance with this Agreement and all applicable requirements. 5 20 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 21 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 22 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 23 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 24 violation of federal or state regulations and/or COUNTY policies. 10 25 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 26 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 27 and implement written record management procedures. 13 28 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 29 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 30 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 31 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 32 all times. 18 33 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 34 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 35 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 36 maintained by or for a covered entity that is: 22 37 1. The medical records and billing records about individuals maintained by or for a covered 24 2 2. The enrollment, payment, claims adjudication, and case or medical management record 25 3 systems maintained by or for a health plan; or 26 4 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 5 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 6 accordance with the terms of this Agreement and common business practices. If documentation is 29 7 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 8 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 9 or site visit. 32 10 2. Provide auditor or other authorized individuals access to documents via a computer 33 11 terminal. 34 12 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 13 requested. 14 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 15 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 16 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 17 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 18 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 19 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 20 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 21 years following discharge of the participant, client and/or patient, with the exception of non- 22 emancipated minors for whom records must be kept for at least one (1) year after such minors have 23 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 24 longer. 25 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 26 commencement of the contract, unless a longer period is required due to legal proceedings such as 27 litigations and/or settlement of claims. 28 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 29 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 30 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 31 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 32 CONTRACTOR. 33 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 34 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 35 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 36 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 37 all information that is requested by the PRA request.

RECORDS MANAGEMENT AND MAINTENANCE. 2 22 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 23 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 24 accordance with this Agreement and all applicable requirements. 5 25 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 26 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 27 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 28 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 29 violation of federal or state regulations and/or COUNTY policies. 10 30 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 31 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 32 and implement written record management procedures. 13 33 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 34 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 35 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 36 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 37 all times. 18 1 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 2 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 3 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 4 maintained by or for a covered entity that is: 22 5 1. The medical records and billing records about individuals maintained by or for a covered 24 7 2. The enrollment, payment, claims adjudication, and case or medical management record 25 8 systems maintained by or for a health plan; or 26 9 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 10 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 11 with the terms of this Agreement and common business practices. If documentation is 29 retained 12 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 13 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 14 or site visit. 32 15 2. Provide auditor or other authorized individuals access to documents via a computer 33 16 terminal. 34 17 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 18 requested. 19 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 20 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 21 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 22 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 23 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 24 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 25 J. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 26 following discharge of the client and/or patient, with the exception of non-emancipated minors for 27 whom records must be kept for at least one (1) year after such minors have reached the age of eighteen 28 (18) years, or for seven (7) years after the last date of service, whichever is longer. 29 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 30 commencement of the contract, unless a longer period is required due to legal proceedings such as 31 litigations and/or settlement of claims. 32 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 33 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.. 34 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 35 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 36 CONTRACTOR. 37 // 1 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 2 settlement of claims for a longer term as directed by ADMINISTRATOR. 3 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 4 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 5 all information that is requested by the PRA request. 6

RECORDS MANAGEMENT AND MAINTENANCE. 2 27 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 28 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 29 accordance with this Agreement and all applicable requirements. 5 30 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 31 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 32 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 33 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 34 violation of federal or state regulations and/or COUNTY policies. 10 35 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 36 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 37 and implement written record management procedures. 13 1 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 2 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 3 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 4 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 5 all times. 18 6 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 7 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 8 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 9 maintained by or for a covered entity that is: 22 10 1. The medical records and billing records about individuals maintained by or for a covered 24 12 2. The enrollment, payment, claims adjudication, and case or medical management record 25 13 systems maintained by or for a health plan; or 26 14 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 15 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 16 accordance with the terms of this Agreement and common business practices. If documentation is 29 17 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 18 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 19 or site visit. 32 20 2. Provide auditor or other authorized individuals access to documents via a computer 33 21 terminal. 34 22 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 23 requested. 24 // 25 // 26 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 27 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 28 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 29 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 30 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 31 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 32 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 33 years following discharge of the participant, client and/or patient, with the exception of non- 34 emancipated minors for whom records must be kept for at least one (1) year after such minors have 35 requestedreached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 36 longer. 37 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 1 commencement of the contract, unless a longer period is required due to legal proceedings such as 2 litigations and/or settlement of claims. 3 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 4 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 5 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 6 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 7 CONTRACTOR. 8 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 9 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 10 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 11 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 12 all information that is requested by the PRA request. 13

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 and 21 implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 36 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 37 accordance with the terms of this Agreement and common business practices. If documentation is 29 1 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 2 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 3 site visit. 32 4 2. Provide auditor or other authorized individuals access to documents via a computer 33 5 terminal. 34 6 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 7 requested. 8 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 9 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 10 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 11 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 12 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 13 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 14 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 15 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 16 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 17 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 18 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 19 commencement of the contract, unless a longer period is required due to legal proceedings such as 20 litigations and/or settlement of claims. 21 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 22 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 23 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 24 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 25 CONTRACTOR. 26 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 27 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 28 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 29 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 30 information that is requested by the PRA request. accordance with this Agreement and all applicable requirements. of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 31 “A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 32 34 B. CONTRACTOR shall implement and maintain administrative, technical and physical 35 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 36 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 37 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 1 violation of federal or state regulations and/or COUNTY policies.

RECORDS MANAGEMENT AND MAINTENANCE. 2 35 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 36 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 37 accordance with this Agreement and all applicable requirements. 5 1 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 2 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 3 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 4 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 5 violation of federal or state regulations and/or COUNTY policies. 10 6 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 7 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 8 and implement written record management procedures. 13 9 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 10 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 11 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 12 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 13 all times. 18 14 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 15 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 16 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 17 maintained by or for a covered entity that is: 22 18 1. The medical records and billing records about individuals maintained by or for a covered 24 20 2. The enrollment, payment, claims adjudication, and case or medical management record 25 21 systems maintained by or for a health plan; or 26 22 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 23 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 24 accordance with the terms of this Agreement and common business practices. If documentation is 29 25 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 26 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 27 site visit. 32 28 2. Provide auditor or other authorized individuals access to documents via a computer 33 29 terminal. 34 30 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 31 requested. 32 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 33 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 34 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 35 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 36 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 37 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 1 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 2 years following discharge of the participant, client and/or patient, with the exception of non-emancipated 3 minors for whom records must be kept for at least one (1) year after such minors have reached the age of 4 eighteen (18) years, or for seven (7) years after the last date of service, whichever is longer. 5 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 6 commencement of the contract, unless a longer period is required due to legal proceedings such as 7 litigations and/or settlement of claims. 8 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 9 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 10 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 11 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 12 CONTRACTOR. 13 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 14 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 15 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 16 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 17 all information that is requested by the PRA request. 18

RECORDS MANAGEMENT AND MAINTENANCE. 2 11 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 12 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 13 accordance with this Agreement and all applicable requirements. 5 14 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 15 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 16 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 17 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 18 violation of federal or state regulations and/or COUNTY policies. 10 19 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 20 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 21 and implement written record management procedures. 13 22 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 23 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 24 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 25 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 26 all times. 18 27 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 28 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 29 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 30 maintained by or for a covered entity that is: 22 31 1. The medical records and billing records about individuals maintained by or for a covered 24 33 2. The enrollment, payment, claims adjudication, and case or medical management record 25 34 systems maintained by or for a health plan; or 26 35 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.. 36 // 37 // 27 of 3334 X:\CONTRACTS - 2015 -\2015-2017\BH\MH MENTORING CHILD XXX-XXX XX 00-00 XX.XXX XXX00XXXX00 27 1 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 2 accordance with the terms of this Agreement and common business practices. If documentation is 29 3 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 4 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 5 or site visit. 32 6 2. Provide auditor or other authorized individuals access to documents via a computer 33 7 terminal. 34 8 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 9 requested. 10 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 11 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 12 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 13 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 14 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 15 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 16 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 17 years following discharge of the participant, client and/or patient, with the exception of non- 18 emancipated minors for whom records must be kept for at least one (1) year after such minors have 19 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is 20 longer. 21 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 22 commencement of the contract, unless a longer period is required due to legal proceedings such as 23 litigations and/or settlement of claims. 24 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 25 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 26 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 27 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 28 CONTRACTOR. 29 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 30 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 31 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 32 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 33 all information that is requested by the PRA request. 34 // 35 // 36 // 37 // 28 of 3334 X:\CONTRACTS - 2015 -\2015-2017\BH\MH MENTORING CHILD XXX-XXX XX 00-00 XX.XXX XXX00XXXX00

RECORDS MANAGEMENT AND MAINTENANCE. 2 14 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 3 15 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 4 16 accordance with this Agreement and all applicable requirements. 5 17 B. CONTRACTOR shall implement and maintain administrative, technical and physical 6 18 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 7 19 PHI in violation of the HIPAA, federal and state regulations and/or CHPP. CONTRACTOR shall 8 20 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 9 21 violation of federal or state regulations and/or COUNTY policies. 10 22 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 11 23 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 12 24 and implement written record management procedures. 13 25 D. CONTRACTOR shall ensure appropriate financial records related to cost reporting, 14 26 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 15 27 E. CONTRACTOR shall ensure all appropriate state and federal standards of documentation, 16 28 preparation, and confidentiality of records related to participant, client and/or patient records are met at 17 29 all times. 18 30 F. CONTRACTOR shall ensure all HIPAA (DRS) requirements are met. HIPAA requires that 19 31 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 32 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 33 maintained by or for a covered entity that is: 22 34 1. The medical records and billing records about individuals maintained by or for a covered 24 36 2. The enrollment, payment, claims adjudication, and case or medical management record 25 37 systems maintained by or for a health plan; or 26 1 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 2 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 28 accordance 3 with the terms of this Agreement and common business practices. If documentation is 29 retained 4 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 5 1. Have documents readily available within forty-eight (48) hour notice of a scheduled audit 31 or 6 site visit. 32 7 2. Provide auditor or other authorized individuals access to documents via a computer 33 8 terminal. 34 9 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 10 requested. 11 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 12 security of PII and/or PHI. CONTRACTOR shall notify COUNTY immediately by telephone call plus 13 email or fax upon the discovery of a Breach of unsecured PHI and/or PII. 14 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 15 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 16 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 17 J. CONTRACTOR shall retain all client and/or patient medical records for seven (7) years 18 following discharge of the client and/or patient, with the exception of non-emancipated minors for 19 whom records must be kept for at least one (1) year after such minors have reached the age of eighteen 20 (18) years, or for seven (7) years after the last date of service, whichever is longer. 21 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 22 commencement of the contract, unless a longer period is required due to legal proceedings such as 23 litigations and/or settlement of claims. 24 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 25 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.. 26 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 27 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 28 CONTRACTOR. 29 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 30 settlement of claims for a longer term as directed by ADMINISTRATOR. 31 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 32 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 33 all information that is requested by the PRA request. 34 // 35 // 36 // 37 //