Common use of RECORDS MANAGEMENT AND MAINTENANCE Clause in Contracts

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contractContract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records records, primarily in HMIS, appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts housing plans, case management plans and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patientparticipant, the identity of the MSN Patient participant to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require.. // 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles County policies of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain acceptable administrative, technical and physical safeguards to ensure the privacy and security of PHI and prevent the intentional or unintentional health related and/or personally identifying information CONTRACTOR collects from participants. If there is an unauthorized use or of disclosure of PHI participant’s health related and/or personally identifying information in violation possession of the HIPAACONTRACTOR, federal and state regulations. CONTRACTOR shall mitigate (i) immediately notify ADMINISTRATOR of such unauthorized use of disclosure and (ii) mitigate, to the extent practicable, the known harmful effect of any such unauthorized use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policiesdisclosure. C. CONTRACTORXXXXXXXXXX’s participant, client, and/or patient participant records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient participant records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. F. To the extent CONTRACTOR is subject to PRA, CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.eight

RECORDS MANAGEMENT AND MAINTENANCE. 18 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 19 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 20 accordance with this Agreement and all applicable requirements. 21 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 22 which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 23 records shall include, but not be limited to, individual patient charts and utilization review records. 24 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 25 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 26 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 27 principles of reimbursement and GAAP. 428 3. CONTRACTOR shall ensure the maintenance of medical records required by §70747 29 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 30 necessity of the service, and the quality of care provided. Records shall be maintained in accordance 31 with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 32 B. CONTRACTOR shall implement and maintain administrative, technical and physical 33 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 34 PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the 35 extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal 36 or state regulations and/or COUNTY policies.. 37 // 1 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 2 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 3 and implement written record management procedures. 4 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the 5 termination of the contractAgreement, unless a longer period is required due to legal proceedings such as 6 litigations and/or settlement of claims. 7 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years 8 following discharge of the participant, client and/or patient, or as otherwise required by applicable 9 federal or state law. 10 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 11 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 12 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 13 written approval to CONTRACTOR to maintain records in a single location, identified by 14 CONTRACTOR. 15 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 16 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 17 all information that is requested by the PRA request. 18 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that 19 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 20 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 21 maintained by or for a covered entity that is: 22 1. The medical records and billing records about individuals maintained by or for a covered health care provider;covered 24 2. The enrollment, payment, claims adjudication, and case or medical management record 25 systems maintained by or for a health plan; or 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 1. Have documents readily available within twenty-four three (243) hour business days of receiving notice of a 31 scheduled audit or site visit. 32 2. Provide auditor or other authorized individuals access to documents via a computer 33 terminal. 34 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 35 requested. 36 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 37 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or 1 security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law 2 or regulation, and copy ADMINISTRATOR on such notifications. 3 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 4 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 5 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 6 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, 7 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 8

RECORDS MANAGEMENT AND MAINTENANCE. 20 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 21 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 22 accordance with this Agreement and all applicable requirements. 23 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for 24 which claims invoices are submitted for reimbursement under this Agreement and the charges thereto. Such 25 records shall include, but not be limited to, individual patient charts and utilization review records. 26 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 27 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature 28 claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of 29 reimbursement and GAAP. 430 3. CONTRACTOR shall ensure the maintenance of medical records required by §70747 31 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 32 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with 33 §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 34 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 35 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 36 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent 37 practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state state 1 regulations and/or COUNTY policies. 2 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 3 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 4 implement written record management procedures. 5 D. CONTRACTOR shall retain all financial records for a minimum of ten seven (107) years from the 6 termination of the contract, unless a longer period is required due to legal proceedings such as litigations 7 and/or settlement of claims. 8 E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following 9 discharge of the participant, client and/or patient. 10 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 11 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 12 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 13 written approval to CONTRACTOR to maintain records in a single location, identified by 14 CONTRACTOR. 15 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 16 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 17 information that is requested by the PRA request. 18 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, 19 participants and/or patients be provided the right to access or receive a copy of their DRS and/or request 20 addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or 21 for a covered entity that is: 22 1. The medical records and billing records about individuals maintained by or for a covered health care provider;covered 24 2. The enrollment, payment, claims adjudication, and case or medical management record 25 systems maintained by or for a health plan; or 26 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. 27 I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance 28 with the terms of this Agreement and common business practices. If documentation is retained 29 electronically, CONTRACTOR shall, in the event of an audit or site visit: 30 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit 31 or site visit. 32 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 33 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 34 requested. 35 J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 36 security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security 37 of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or 1 regulation, and copy ADMINISTRATOR on such notifications. 2 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 3 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 4 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.. 5

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish and implement written record management procedures.. County of Orange, Health Care Agency File Folder: C019024M042DR059 AIHCS Page 27 of 64 Contract MA-042-1901001419010114 D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years following discharge of the participant, client Client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clientsClients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. County of Orange, Health Care Agency File Folder: C019024M042DR059 AIHCS Page 28 of 64 Contract MA-042-1901001419010114 L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Medical Services Initiative (MSI) Patient, as defined in Exhibit A to this Agreement, the identity of the MSN MSI Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS the California Department of Health Care Services may require. 3. CONTRACTOR shall maintain books, records, documents, and other evidence, accounting procedures and practicesprocedures, and other evidence practices sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCRCalifornia Code of Regulations, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCRCalifornia Code of Regulations, as it exists now or may hereafter be amended. and/or CHPP. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI protected health information (PHI) and prevent the intentional or unintentional use or disclosure of PHI in violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), any other related, federal and state regulations. . C. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI protected health informationPHI made in violation of federal or state regulations and/or COUNTY policies.. // C. D. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records records, primarily in HMIS, appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts housing plans, case management plans and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patientparticipant, the identity of the MSN Patient participant to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require.. // 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles County policies of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain acceptable administrative, technical and physical safeguards to ensure the privacy and security of PHI and prevent the intentional or unintentional health related and/or personally identifying information CONTRACTOR collects from participants. If there is an unauthorized use or of disclosure of PHI participant’s health related and/or personally identifying information in violation possession of the HIPAACONTRACTOR, federal and state regulations. CONTRACTOR shall mitigate (i) immediately notify ADMINISTRATOR of such unauthorized use of disclosure and (ii) mitigate, to the extent practicable, the known harmful effect of any such unauthorized use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policiesdisclosure. C. CONTRACTOR’s participant, client, and/or patient participant records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient participant records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. F. To the extent CONTRACTOR is subject to PRA, CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.eight

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years following discharge of the participant, client Client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clientsClients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. L. CONTRACTOR shall make records pertaining to the costs of services, patient fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange.

RECORDS MANAGEMENT AND MAINTENANCE. 29 A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term 30 of this Agreement, prepare, maintain and manage records appropriate to the services provided and in 31 accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 32 B. CONTRACTOR shall implement and maintain administrative, technical and physical 33 safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of 34 PHI in violation of the HIPAA, federal and state regulationsregulations and/or CHPP. CONTRACTOR shall 35 mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in 36 violation of federal or state regulations and/or COUNTY policies. 37 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure 30 of 36 S:\BH K MGMT\BH VENDOR FOLDER(S)\ADULT\RESIDENTIAL\RESIDENTIAL MH\FSI02 - HOMELESS BRIDGE HOUSING\FY 2022-23\FRIENDSHIP 1 manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish 2 and implement written record management procedures. 3 D. CONTRACTOR shall retain all ensure appropriate financial records for a minimum of ten (10) years from the termination of the contractrelated to cost reporting, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims4 expenditure, revenue, xxxxxxxx, etc., are prepared and maintained accurately and appropriately. 5 E. CONTRACTOR shall retain ensure all client and/or patient medical appropriate state and federal standards of documentation, 6 preparation, and confidentiality of records for ten (10) years following discharge of the related to participant, client and/or patientpatient records are met at 7 all times. 8 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS (DRS) requirements are met. HIPAA requires that 9 clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or 10 request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records 11 maintained by or for a covered entity that is: 12 1. The medical records and billing records about individuals maintained by or for a covered health care provider;covered 14 2. The enrollment, payment, claims adjudication, and case or medical management record 15 systems maintained by or for a health plan; or 16 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. 17 G. CONTRACTOR may retain participant, client, and/or patient documentation electronically in 18 accordance with the terms of this Agreement and common business practices. If documentation is 19 retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 20 1. Have documents readily available within twentyforty-four eight (2448) hour notice of a scheduled audit 21 or site visit. 22 2. Provide auditor or other authorized individuals access to documents via a computer 23 terminal. 24 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if 25 requested.. 26 // 27 // J. 28 H. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and 29 security of PII and/or PHI. CONTRACTOR shall, shall notify COUNTY immediately by telephone call plus 30 email or fax upon the discovery of a Breach of privacy unsecured PHI and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notificationsPII. K. 31 I. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or 32 security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall 33 pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI. 34 J. CONTRACTOR shall retain all participant, client, and/or patient medical records for seven (7) 35 years following discharge of the participant, client and/or patient, with the exception of non- 36 emancipated minors for whom records must be kept for at least one (1) year after such minors have 37 reached the age of eighteen (18) years, or for seven (7) years after the last date of service, whichever is S:\BH K MGMT\BH VENDOR FOLDER(S)\ADULT\RESIDENTIAL\RESIDENTIAL MH\FSI02 - HOMELESS BRIDGE HOUSING\FY 2022-23\FRIENDSHIP 1 longer. 2 K. CONTRACTOR shall retain all financial records for a minimum of seven (7) years from the 3 commencement of the contract, unless a longer period is required due to legal proceedings such as 4 litigations and/or settlement of claims. 5 L. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, 6 xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. 7 M. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR 8 may provide written approval to CONTRACTOR to maintain records in a single location, identified by 9 CONTRACTOR. 10 N. CONTRACTOR may be required to retain all records involving litigation proceedings and 11 settlement of claims for a longer term which will be directed by the ADMINISTRATOR. 12 O. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 13 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR 14 all information that is requested by the PRA request. 15

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI County of Orange, Health Care Agency Contract MA-042-19010140 made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, clientClient, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, clientClient, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contractAgreement, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client Client and/or patient medical records for ten (10) years following discharge of the participant, client Client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clientsClients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain clientClient, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications.. County of Orange, Health Care Agency Contract MA-042-19010140 K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of 16 this Agreement, prepare, maintain and manage records appropriate to the services provided and in 17 accordance with this Agreement and all applicable requirements. 18 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such 19 records shall include, but not be limited to, individual patient charts and utilization review records. 20 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was 21 rendered, and such additional information as ADMINISTRATOR or DHCS may require. 22 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and 23 practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare 24 principles of reimbursement and GAAP. 25 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 26 34 of 39 27 Z:\BH K MGMT\BH VENDOR FOLDER(S)\P&I\OCC03 - OUTREACH AND ENGAGEMENT\FY 2020- 1 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical 2 necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. 3 B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards 4 to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in 5 violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state 6 regulations and/or COUNTY policies. 7 C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and 8 implement written record management procedures. 9 D. CONTRACTOR shall retain all financial records for a minimum of seven (7) years/ten (10) years 10 from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. 11 E. CONTRACTOR shall retain all client and/or patient medical records for ten seven (7)/ten (10) years 12 following discharge of the participant, client and/or patient. 13 F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If 14 CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide 15 written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. 16 G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out 17 of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all 18 information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.” 6. Exhibit A, Paragraph II. Budget, Subparagraph A of the Contract is deleted in its entirety and replaced with the following: A. COUNTY shall pay CONTRACTOR in accordance with the Payments Paragraph in this Exhibit A to the Agreement and the following budgets, which are set forth for informational purposes only and may be adjusted by mutual agreement, in writing, by ADMINISTRATOR and CONTRACTOR. ADMINISTRATIVE COSTS PERIOD ONE PERIOD TWO PERIOD THREE PERIOD FOUR TOTAL Salaries $ 14,551 $ 16,640 $ 16,640 $16,640 $ 64,471 Benefits 2,239 4,186 4,186 2,995 13,606 Professional Services 1,800 2400 2,400 3,600 10,200 Indirect Costs 6,300 8,400 8,400 8,400 31,500 SUBTOTAL ADMINISTRATIVE $24,890 $31,626 $31,626 $31,635 $ 119,777 COSTS Salaries $131,899 $ 176,640 $ 176,640 $176,800 $ 661,979 Benefits 24,346 35,668 35,668 31,824 127,506 Services and Supplies 20,613 25,062 25,062 28,737 99,474 Subcontractors 8,250 11,000 11,000 11,000 41,250 One time start-up costs 12,690 0 0 0 12,690 SUBTOTAL PROGRAM COSTS $197,798 $ 248,370 $ 248,370 $248,361 $ 942,899 TOTAL GROSS COSTS $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 MHSA $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 TOTAL REVENUE $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 TOTAL MAXIMUM OBLIGATION $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676” 7. Exhibit A, Paragraph III. Payments, Subparagraph A, introductory paragraph of the Contract is deleted in its entirety and replaced with the following: A. COUNTY shall pay CONTRACTOR monthly, in arrears, the provisional amounts of $24,743 per month for Period One, the amount of $23,333 for Period Two, Period Three, and Period Four, as specified in the Referenced Contract Provisions of the Agreement.”

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contractAgreement, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request.. County of Orange, Health Care Agency File Folder: M042DR052 Page 5 of 42 Contract MA-042-18011847 H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.”

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.” 5. Exhibit A, Section II. Budget, Subsection A of the Contract is deleted in its entirety and replaced with the following: A. COUNTY shall pay CONTRACTOR in accordance with the Payments Paragraph in this Exhibit A to the Contract and the following budgets, which are set forth for informational purposes only and may be adjusted by mutual agreement, in writing, by ADMINISTRATOR and CONTRACTOR. ADMINISTRATIVE COSTS PERIOD ONE PERIOD TWO PERIOD THREE PERIOD FOUR TOTAL Salaries $ 23,030 $ 40,706 $ 40,706 $40,706 $ 145,148 Benefits 4,260 3,481 3,481 3,481 14,703 Indirect Costs 69,750 80,000 80,000 80,000 309,750 SUBTOTAL $ 97,040 ADMINISTRATIVE COSTS $ 124,187 $ 124,187 $124,187 $ 469,601 PROGRAM COSTS Salaries $ 471,510 $ 620,680 $ 640,680 $640,680 $2,373,550 Benefits 83,832 106,776 106,776 106,776 404,160 Services and Supplies 91,425 140,100 120,100 120,100 471,725 Subcontractors 54,770 73,027 73,027 73,027 273,851 One time start-up costs 39,226 0 0 0 39,226 BTOTAL PROGRAM $ 740,763 $ 940,583 $ 940,583 $940,583 $3,562,512 TS XX XXXXX COSTS $ 837,803 $1,064,770 $1,064,770 $1,064,770 $4,032,113 VENUE MHSA $ 837,803 $1,064,770 $1,064,770 $1,064,770 $4,032,113 AL REVENUE $ 837,803 $1,064,770 $1,064,770 $1,064,770 $4,032,113 AL $ 837,803 $1,064,770 $1,064,770 $1,064,770 $4,032,113” SU COS TOT RE TOT TOT

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this Agreement, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of County of Orange, Health Care Agency File Folder: X000XX000 Page 3 of 7 Contract MA-042-18010716 HCA ASR 19-001316 Page 3 of 7 Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this Agreement, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.” 6. Exhibit A, Paragraph II. Budget, Subparagraph A of the Contract is deleted in its entirety and replaced with the following: A. COUNTY shall pay CONTRACTOR in accordance with the Payments Paragraph in this Exhibit A to the Agreement and the following budgets, which are set forth for informational purposes only and may be adjusted by mutual agreement, in writing, by ADMINISTRATOR and CONTRACTOR. County of Orange, Health Care Agency File Folder: X000XX000 Page 4 of 7 Contract MA-042-18010716 HCA ASR 19-001316 Page 4 of 7 ADMINISTRATIVE COSTS PERIOD ONE PERIOD TWO PERIOD THREE PERIOD FOUR TOTAL Salaries $ 14,551 $ 16,640 $ 16,640 $16,640 $ 64,471 Benefits 2,239 4,186 4,186 2,995 13,606 Professional Services 1,800 2400 2,400 3,600 10,200 Indirect Costs 6,300 8,400 8,400 8,400 31,500 SUBTOTAL ADMINISTRATIVE $24,890 $31,626 $31,626 $31,635 $ 119,777 COSTS Salaries $131,899 $ 176,640 $ 176,640 $176,800 $ 661,979 Benefits 24,346 35,668 35,668 31,824 127,506 Services and Supplies 20,613 25,062 25,062 28,737 99,474 Subcontractors 8,250 11,000 11,000 11,000 41,250 One time start-up costs 12,690 0 0 0 12,690 SUBTOTAL PROGRAM COSTS $197,798 $ 248,370 $ 248,370 $248,361 $ 942,899 TOTAL GROSS COSTS $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 MHSA $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 TOTAL REVENUE $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676 TOTAL MAXIMUM OBLIGATION $222,688 $ 279,996 $ 279,996 $279,996 $ 1,062,676” 7. Exhibit A, Paragraph III. Payments, Subparagraph A, introductory paragraph of the Contract is deleted in its entirety and replaced with the following: A. COUNTY shall pay CONTRACTOR monthly, in arrears, the provisional amounts of $24,743 per month for Period One, the amount of $23,333 for Period Two, Period Three, and Period Four, as specified in the Referenced Contract Provisions of the Agreement.”

RECORDS MANAGEMENT AND MAINTENANCE. A. CONTRACTOR, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR or DHCS may require. 3. CONTRACTOR shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY policies. C. CONTRACTOR’s participant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR shall maintain participant, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR shall retain all client and/or patient medical records for ten (10) years following discharge of the participant, client and/or patient. F. CONTRACTOR shall make records pertaining to the costs of services, participant fees, charges, xxxxxxxxbillings, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR is unable to meet the record location criteria above, ADMINISTRATOR may provide written approval to CONTRACTOR to maintain records in a single location, identified by CONTRACTOR. G. CONTRACTOR shall notify ADMINISTRATOR of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR shall provide ADMINISTRATOR all information that is requested by the PRA request. H. CONTRACTOR shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTOR, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR on such notifications. K. CONTRACTOR may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.

RECORDS MANAGEMENT AND MAINTENANCE. DocuSign Envelope ID: 64CD433E-9957-4C47-AAC7-7C569AAA8714 A. CONTRACTORContractor, its officers, agents, employees and subcontractors shall, throughout the term of this AgreementContract, prepare, maintain and manage records appropriate to the services provided and in accordance with this Agreement Contract and all applicable requirements. 1. CONTRACTOR Contractor shall maintain records that are adequate to substantiate the services for which claims are submitted for reimbursement under this Agreement Contract and the charges thereto. Such records shall include, but not be limited to, individual patient charts and utilization review records. 2. CONTRACTOR Contractor shall keep and maintain records of each service rendered to each MSN Patient, the identity of the MSN Patient to whom the service was rendered, the date the service was rendered, and such additional information as ADMINISTRATOR Administrator or DHCS may require. 3. CONTRACTOR Contractor shall maintain books, records, documents, accounting procedures and practices, and other evidence sufficient to reflect properly all direct and indirect cost of whatever nature claimed to have been incurred in the performance of this Agreement Contract and in accordance with Medicare principles of reimbursement and GAAP. 4. CONTRACTOR Contractor shall ensure the maintenance of medical records required by §70747 through and including §70751 of the CCR, as they exist now or may hereafter be amended, the medical necessity of the service, and the quality of care provided. Records shall be maintained in accordance with §51476 of Title 22 of the CCR, as it exists now or may hereafter be amended. B. CONTRACTOR Contractor shall implement and maintain administrative, technical and physical safeguards to ensure the privacy of PHI and prevent the intentional or unintentional use or disclosure of PHI in violation of the HIPAA, federal and state regulations. CONTRACTOR Contractor shall mitigate to the extent practicable, the known harmful effect of any use or disclosure of PHI made in violation of federal or state regulations and/or COUNTY County policies. C. CONTRACTORContractor’s participantParticipant, client, and/or patient records shall be maintained in a secure manner. CONTRACTOR Contractor shall maintain participantParticipants, client, and/or patient records and must establish and implement written record management procedures. D. CONTRACTOR Contractor shall retain all financial records for a minimum of ten (10) years from the termination of the contract, unless a longer period is required due to legal proceedings such as litigations and/or settlement of claims. E. CONTRACTOR Contractor shall retain all client and/or patient medical records for ten (10) years following discharge of the participantParticipants, client and/or patient. F. CONTRACTOR Contractor shall make records pertaining to the costs of services, participant Participant fees, DocuSign Envelope ID: 64CD433E-9957-4C47-AAC7-7C569AAA8714 charges, xxxxxxxx, and revenues available at one (1) location within the limits of the County of Orange. If CONTRACTOR Contractor is unable to meet the record location criteria above, ADMINISTRATOR Administrator may provide written approval to CONTRACTOR Contractor to maintain records in a single location, identified by CONTRACTORContractor. G. CONTRACTOR Contractor shall notify ADMINISTRATOR Administrator of any PRA requests related to, or arising out of, this AgreementContract, within forty-eight (48) hours. CONTRACTOR Contractor shall provide ADMINISTRATOR Administrator all information that is requested by the PRA request. H. CONTRACTOR Contractor shall ensure all HIPAA DRS requirements are met. HIPAA requires that clients, participants Participants and/or patients be provided the right to access or receive a copy of their DRS and/or request addendum to their records. Title 45 CFR §164.501, defines DRS as a group of records maintained by or for a covered entity that is: 1. The medical records and billing records about individuals maintained by or for a covered health care provider; 2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or 3. Used, in whole or in part, by or for the covered entity to make decisions about individuals. I. CONTRACTOR Contractor may retain client, and/or patient documentation electronically in accordance with the terms of this Agreement Contract and common business practices. If documentation is retained electronically, CONTRACTOR Contractor shall, in the event of an audit or site visit: 1. Have documents readily available within twenty-four (24) hour notice of a scheduled audit or site visit. 2. Provide auditor or other authorized individuals access to documents via a computer terminal. 3. Provide auditor or other authorized individuals a hardcopy printout of documents, if requested. J. CONTRACTOR Contractor shall ensure compliance with requirements pertaining to the privacy and security of PII and/or PHI. CONTRACTOR Contractor shall, upon discovery of a Breach of privacy and/or security of PII and/or PHI by CONTRACTORContractor, notify federal and/or state authorities as required by law or regulation, and copy ADMINISTRATOR Administrator on such notifications. K. CONTRACTOR Contractor may be required to pay any costs associated with a Breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification. CONTRACTOR Contractor shall pay any and all such costs arising out of a Breach of privacy and/or security of PII and/or PHI.. DocuSign Envelope ID: 64CD433E-9957-4C47-AAC7-7C569AAA8714