HomeMy WebLinkAboutAgreement A-22-011 with CVHIE and Manifest MedEx.pdfCentral Valley Health Information Exchange
Physician Practice Participation Agreement
1
20190313.a.k.
CENTRAL VALLEY HEALTH INFORMATION EXCHANGE
AND
MANIFEST MEDEX
COUNTY OF FRESNO PARTICIPATION AGREEMENT
This Participation Agreement (the ) is entered into and effective as of this
_______________ day of 202 (the ), by and between Central Valley Health
Information Exchange HIO
California nonprofit public benefit corporation (), and County of Fresno, a political subdivision of
the State of California (). MX, HIO and Participant are referred to in this Agreement
individually as a or collectively as the .HI HIE
Provider
Recitals
A. MX is organized to facilitate health information aggregation and sharing in a manner
that complies with Law.
B. MX operates a health information exchange (the ) that will enable its participants
to electronically provide and receive health information regarding their patients.
C. Participant is a hybrid entity as identified under HIPAA and only its appropriate health
care component, certain permitted public health activities, and Emergency Medical Services will be
included for the purpose of determining data contributions and fees. Participant will both provide data
to and receive data from the HIE.
The Parties agree that:
1. Participation. Participant shall participate in the HIE as set forth in this Agreement. The
programs listed in Exhibit 1 shall comply with the terms of this Agreement. Participant
represents and warrants that it has the authority to bind the programs/entities listed on Exhibit
1 and shall remain fully liable for their actions and inactions.
2. Agreement. The Agreement includes this document and incorporates by reference the
following:
a. The Terms attached as Exhibit 2.a.
b. The Service Description attached as Exhibit 2.b., which includes: a description of: the
Tech Services that MX will provide to Participant; and the Data Submission Guidelines.
c. The Fee Schedule attached as Exhibit 2.c., which sets forth Subscription Fees and any
Implementation Fees that Participant will pay to MX and identifies any other fees that
might be paid by Participant pursuant to this Agreement, including the CVHIE
Supplemental Fee Structure in Exhibit 2.d.
Agreement No. 22-011
4th
Central Valley Health Information Exchange
Physician Practice Participation Agreement
2
20190313.a.k.
d. The Policies and Procedures Policies
(https://www.manifestmedex.org/wp-content/uploads/Policies_Manifest_MedEx.pdf),
and labeled Exhibit 2.e., as amended from time to time pursuant to this Agreement.
e. The BAA attached as Exhibit 2.f., as amended
from time to time pursuant to this Agreement. The BAA sets forth the obligations of
MX, in its capacity as the operator of the HIE and a business associate of Participant and
is separately executed by MX and Participant.
3. Term. The term of this Agreement shall commence on the Effective Date and continue until it is
terminated as described in the Terms.
4. General Provisions.
a.Conflicts. If the BAA conflicts with any other part of this Agreement (including the
Policies), the BAA shall prevail. If the Policies conflict with any other part of this
Agreement (except the BAA), the Policies shall prevail. If the terms of any other Exhibit
conflict with those of this Participation Agreement and/or Exhibit 2.a, this Participation
Agreement and Exhibit 2.a shall prevail.
b.Definitions. Capitalized terms that are not defined in the body of this Agreement shall
have the meanings described in the Terms (Exhibit 2.a.) and BAA (Exhibit 2.f.).
c.Notices. Notices and other communications between the Parties shall be in writing and
made: (a) by overnight delivery service; or (b) by e-mail or facsimile transmission. Notice
is deemed given on the date of the e-mail or facsimile, or one day after delivery to the
overnight service. If a sending Party receives notice that an e-mail message was not
delivered, that Party shall deliver the notice by overnight delivery service or by facsimile.
d.Electronic Signature. The parties agree that this Agreement may be executed by
symbol or process intended by an individual signing this Agreement to represent their
signature, including but not limited to (1) a digital signature; (2) a faxed version of an
original handwritten signature; or (3) an electronically scanned and transmitted (for
example by PDF document) of a handwritten signature. Each electronic signature affixed
or attached to this Agreement (1) is deemed equivalent to a valid original handwritten
signature of the person signing this Agreement for all purposes, including but not
limited to evidentiary proof in any administrative or judicial proceeding, and (2) has the
same force and effect as the valid original handwritten signature of that person. The
provisions of this section satisfy the requirements of Civil Code section 1633.5,
subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3, Part 2,
Title 2.5, beginning with section 1633.1). Each party using a digital signature represents
that it has undertaken and satisfied the requirements of Government Code section 16.5,
subdivision (a), paragraphs (1) through (5), and agrees that each other party may rely
upon that representation. This Agreement is not conditioned upon the parties
conducting the transactions under it by electronic means and either party may sign this
Agreement with an original handwritten signature.
DocuS ign Envelope ID : B0B431C1-1DC9-4B96-94B7-9F09F85B67A4
Central Valley Health Information Exchange
Physician Practice Participation Agreement
For Participant:
County of Fresno, a political subdivision of the State of California
Attn: David Luchini, Director
Department of Public Health
1221 Fulton Street
Fresno, CA 93721
Email : dluchini@fresnocountyca.gov
Attn: Susan Holt, Interim Director
Department of Behavioral Health
3133 N. Millbrook Ave .
Fresno, CA 93703
Email: sholt@fresnocountyca.gov
For MX: As set forth in the Terms .
For CVHIE/HIO: As set forth in the Terms .
The Parties hereby execute and enter into this Agreement .
Manifest MedEX
By:
Name:
Title:
r-;;DocuSigned by : L:=,:::~
Erica Galvez
Chief Operating Officer Manifest
MedEx
Participant
By:
Name:
Title:
Brian Pacheco
Chairman of the Board of
Supervisors of the County of Fresno
ATTEST:
HIO
CVHIE
By:
Name:
Title :
20190313 .a.k.
Executive Director
Central Valley Health Information Exchange (CVHIE)
3
Central Valley Health Information Exchange
Physician Practice Participation Agreement
4
20190313.a.k.
Exhibit 1
Participant Affiliates
County of Fresno HIPAA Hybrid Entity designated programs that have a treatment or public health
purpose to access protected health information:
Department of Public Health
Operations, divisions and programs of the Department of Public Health (DPH) excluding the
Environmental Health Division, Emergency Services Division, and the Vital Statistics Program.
Programs and DPH subcontractors permitted to access PHI are those that are consistent and
allowable pursuant to Exhibit 2.e.
Department of Behavioral Health
Department of Behavioral Health (DBH) programs and DBH subcontractors providing services that are
consistent and allowable pursuant to Exhibit 2.e
County of Fresno non-HIPAA designated programs:
Department of Public Health, Emergency Services Division, Emergency Medical Services Program
Emergency Medical Services Program excluding administrative support and training staff.
Permitted Use Case: The Emergency Medical Services Program shall have access to MX Data
solely for purposes of Treatment, Payment, or Health Care Operations, as defined by HIPAA.
All access to MX Data by Public Health Authorities for purposes other than Treatment shall be subject
to the minimum necessary standard.
Central Valley Health Information Exchange
Physician Practice Participation Agreement
5
20190313.a.k.
Exhibit 2.a.
Terms and Conditions
of the
Participation Agreement
(including Definitions)
Article 1
HIE Provider Functions and Duties
1.1 System, Services and Training. MX shall provide to Participant the System and Services set forth
in Exhibit 2.b.
1.2 . MX shall develop and maintain the Policies.
1.3 HITRUST. MX will use commercially reasonable efforts to obtain HITRUST CSF Certification as
soon as reasonably possible and thereafter shall maintain such Certification in accordance with HITRUST
standards.
Article 2
2.1 Contribution of Data. Participant shall contribute Patient Data to MX as required by the Service
Description (Exhibit 2.b.), the Policies (Exhibit 2.e.) and these Terms and Conditions (Exhibit 2.a.,
Terms
2.2 Restricted Use, Security and Access. Participant shall restrict access to and use of the System to
Participant and its Authorized Users. Participant shall implement security measures with respect to the
System and safeguard Patient Data as required by the Agreement. Participant shall not inhibit an NP
Participa access to the System or Patient Data.
Article 3
Mutual Duties; Relationship between the Parties
3.1 Compliance with Law and Safety. Each Party and its Personnel shall perform their duties and
exercise their rights under the Agreement in compliance with Law. Each Party and its Personnel shall
always consider Patient safety in taking any action under the Agreement.
3.2 Policies and DSG. HIE Provider and Participant and their Personnel shall each comply with the
Policies and the DSG, both of which are incorporated into and are part of the Agreement.
3.3 Committees. MX may establish committees from time to time (such as a Participants Advisory
Committee) and may request Participants to serve on any such committees.
3.4 Prevent Unauthorized Use. Participant shall: (i) only allow Authorized Users to access or use the
System and the passwords and/or the user names applicable to the System; and (ii) make reasonable
Central Valley Health Information Exchange
Physician Practice Participation Agreement
6
20190313.a.k.
efforts to prevent all Persons (other than Authorized Users) from accessing and/or using the System.
Participant shall notify MX promptly of any unauthorized access or use of the System of which
Participant becomes aware.
3.5 Training. Participant shall, to the reasonable satisfaction of MX, educate and train its Authorized
Users regarding the requirements of the Agreement, including the Policies and privacy and security
protocols.
Article 4
Fees
4.1 Fees. Initially, Participant shall not pay fees to MX. If in the future MX implements a fee
scheduled, then the provisions of this Article shall apply. Participant shall pay to HIO or its designee
amounts set forth or as subsidized in Exhibit 2.c. of this Agreement.
4.2 Change to Subscription Fees. HIE Provider
written notice of any increase in fees (the ); and (b) in the event of an increase in fees,
Participant may terminate the Agreement pursuant to Section 11.2.
4.3 Implementation Fees. In addition to Subscription Fees, Participant shall not pay fees to
implement Participant into the System (the ).
4.4 Payment Timing. Participant shall pay all Fees within forty-five (45) days following the date on
which MX or its agent sends an invoice to Participant for that Fee.
4.5 Late Charges. Fees not paid to HIE Provider in a timely manner as required by the Agreement
are subject to interest at the rate of one and one-half percent (1½%) per month or the highest amount
permitted by Law, whichever is lower. Interest shall be calculated from the date the invoice was sent.
4.6 Taxes. All Fees will be paid exclusive of all federal, state, municipal or other government excise,
sales, use, occupational or like taxes now in force or enacted in the future. Participant shall pay any tax
(excluding taxes on net income) that HIE Provider may be required to collect or pay due
to the sale or delivery of items and services provided to Participant pursuant to the Agreement. HIE
Provider will not deliver the System or Services to Participant in tangible form. Notwithstanding the
foregoing: (a) the Parties do not anticipate that any sales or use taxes will be payable with respect to the
Services or other deliverables provided hereunder (except for any taxes that become payable as the
result of any change in applicable Law); and (b) if possible, HIE Provider shall not deliver tangible copies
of any software or other deliverables in a manner that would cause taxes to become payable.
4.7 Invoice. Central
Participant, and Participant shall make payment to CVHIE.
4.8 Other Expenses. Participant is solely responsible for all charges and expenses Participant incurs
to access and use the System.
Article 5
Privacy and Security
5.1 Business Associate Agreement (BAA). By executing the Agreement, MX and Participant are
executing the BAA and agreeing to comply with the BAA.
Central Valley Health Information Exchange
Physician Practice Participation Agreement
7
20190313.a.k.
5.2 Notification of Breach of Privacy or Security. Each Party shall notify the other of any suspected
or actual Breach of Privacy or Security.
Article 6
Confidential Information
6.1 Nondisclosure. If a Party comes into possession of Confidential Information of or regarding the
other Party, MX Vendor, a Party shall: (a) keep and maintain in
strict confidence all such Confidential Information; (b) not use, reproduce, distribute or disclose that
Confidential Information except as permitted by the Agreement; and (c)
from making any use, reproduction, distribution, or disclosure of the Confidential Information that is not
allowed by the Agreement.
6.2 Equitable Remedies. All Confidential Information represents a unique intellectual property of
the Person who owns that Confidential Information (the ). The Disclosing Person
will be entitled to equitable relief and any other remedies available by Law.
6.3 Notice of Disclosure. A Party may disclose Confidential Information if that Party is legally
compelled to make that disclosure; provided that the Party promptly provides the other Party with
notice thereof by the earlier of: five (5) calendar days after receiving the request to disclose from a
Person, or three (3) business days before that disclosure will be made by the Party.
6.4 Media Releases. Notwithstanding any other provision of the Agreement, MX may publicly
identify Participant as a participant in MX and may include the name, address, logo, and a brief
description of Participant on its website or in any other materials developed by MX. Participant grants
Article 7
Representations and Warranties
7.1 Exclusion from Government Programs. Each Party represents and warrants that it and its
Personnel have not: (a) been listed by any federal or state agency as excluded, debarred, suspended or
otherwise ineligible to participate in federal and/or state programs; or (b) been convicted of any crime
relating to any federal and/or state reimbursement program.
7.2 Limited Warranties
regarding the System
or Services, expressed or implied, including the implied warranties of merchantability, fitness for a
particular purpose, and non-infringement, except those specifically stated in the Agreement.
7.3 Authorization and Compliance. Participant covenants, represents and warrants that Participant
has all necessary authority: to enter into this Agreement, to grant the rights granted herein, and to send
and receive the Patient Data exchanged under this Agreement.
7.4 Authorization to Contribute and receive Patient Data. Participant covenants, represents and
warrants that K.W.P.H. Enterprises doing business as American Ambulance is authorized to contribute
Patient Data related to emergency medical services on behalf of Participant provided under contract
with the Participant to MX.
Central Valley Health Information Exchange
Physician Practice Participation Agreement
8
20190313.a.k.
Article 8
Data: Ownership, Use, License and Quality
8.1 MX Use of Data. Subject to the limitations on use of Healthcare Data set forth in the Policies,
Participant grants to MX a fully-paid, non-exclusive, non-transferable, royalty-free right and license: (a)
to license and/or otherwise permit Persons to access through the System and/or to receive from the
System all Healthcare Data provided by Participant; (b) to use Healthcare Data provided by Participant
to perform any activities MX is allowed to perform under the Agreement (including the Policies); and (c)
system administration, testing and audits, provision of services, problem identification and resolution
8.2 Participant Access to System. MX grants to Participant, and Participant accepts, a non-exclusive,
personal, nontransferable, limited right to access and use the System under the terms and conditions
Agreement. Participant does not have any other right to access the System unless otherwise expressly
granted by the Agreement or a separate arrangement that complies with Section 8.3.1.
8.3 Participant Use of Data. When accessing or using Patient Data pursuant to the Agreement,
Participant and Authorized Users may access and/or use Patient Data to perform any activities
Participant is allowed to perform under the Agreement (including the Policies).
8.3.1 Participant and Authorized Users may also access Patient Data when Participant is
acting as a Business Associate of another Covered Entity, provided that: all documentation of that
arrangement complies with Law.
8.3.2 Notwithstanding any other provision of the Agreement, if Participant or an
Authorized User accesses any Patient Data that it is not permitted to access under the Agreement at the
time of that access, then Participant: (i) will be in breach of the Agreement, (ii) will not have or obtain
any right to that Patient Data, and (iii) must immediately return or destroy that Patient Data.
8.4 . As between HIE Provider and Participant, HIE Provider does not
8.5 Trademarks. Participant and its Personnel shall: (i) maintain
trademarks, service marks, and copyright legends; and (ii) not violate and/or MX
Participant will be liable for the acts of third party service providers engaged by Participant who violate
these proprietary rights or applicable Law.
8.6 Timely Provision of Data. Participant shall provide its Patient Data to MX regularly and promptly
the System and facilitate access to the Patient Data as required by the Policies and Services Description.
8.7 Data Quality. Participant shall use reasonable and appropriate efforts to ensure that all
Healthcare Data provided by Participant and/or Personnel to MX is accurate with respect to each
Patient. Each Party shall use reasonable and appropriate efforts to assure that its Personnel do not alter
Central Valley Health Information Exchange
Physician Practice Participation Agreement
9
20190313.a.k.
or corrupt the Patient Data received by or transmitted from that Party. Participant and its Authorized
Users shall use reasonable professional judgment in its use of the Healthcare Data and its application of
the Healthcare Data to make clinical decisions.
8.8 Notice of Data Inaccuracy. Each Party shall promptly notify the other Party of any known
inaccuracy in the Patient Data provided to the other Party through the System.
8.9 Access to Data. HIO shall not access or view any Patient Data via the System pursuant to this
Agreement, except that HIO may access or view Patient Data that it receives pursuant to a valid Business
Associate Agreement.
Article 9
Liability and Indemnity
9.1 Liability and Limitations of Liability. Each Party shall be liable to the other Party for Damages
breach of the Agreement, subject to the following
limitations:
9.1.1 Consequential Damages. Except as otherwise specified in this Section, in no event
shall either Party be liable to the other Party for any special, indirect, incidental, consequential,
punitive, or exemplary damages, including loss of profits or revenues, whether a Claim for that
liability or Damages is premised upon breach of contract, breach of warranty, negligence, strict
liability, or any other theories of liability, even if the Party was appraised of the possibility or
likelihood of those damages occurring.
9.1.2 Cap. The aggregate personal liability of each Party (including, in the aggregate, its
officers, directors and Personnel) to the other Party under this Agreement will be limited to the
greater of: (i) the aggregate insurance policy limits then available to the Party with respect to such
Claim, or (ii) five hundred thousand ($500,000) dollars.
9.1.3 Exclusions. Notwithstanding anything to the contrary in the Agreement, the
limitations of liability in Section 9.1.1 and 9.1.2 shall not apply to any Claims or Damages arising out
of or relating to: (a) ent; (b) either
; or (c)
9.2 MX Liability. Notwithstanding any other provision, HIE Provider has no responsibility for and will
not be liable to Participant for: (a) the accuracy, completeness, currency, content or delivery of
Healthcare Data; (b) any decision or action taken or not taken by Participant or any other Person
involving patient care, utilization management, or quality management that is in any way related to the
use of the System, Services, or Healthcare Data; (c) any impairment of the privacy, security,
confidentiality, integrity, availability of, and/or restructured use of any Healthcare Data resulting from
the acts or omissions of Participant, any Other HIO or NP Participant; (d) unauthorized access to the
procedures, or information through the System, whether by accident, fraudulent means or devices, or
any other method; and (e) any Damages occasioned by lost or corrupt data, incorrect reports, or
incorrect data files resulting from programming error, operator error, equipment or software
malfunctions, or the use of third-party software. Participant and its Personnel shall have no recourse
Central Valley Health Information Exchange
Physician Practice Participation Agreement
10
20190313.a.k.
against, and each does waive any claims against, MX for any loss, damage, claim, or cost relating to or
resulting from its own use of the System, Healthcare Data and/or the Services.
9.3 Participant Liability. The Participant is solely responsible for any and all acts or omissions taken
or made in reliance on the System, Healthcare Data and/or other information received from HIE
Provider, including inaccurate or incomplete information.
9.4 Indemnification. Indemnifying Party
Indemnified Party -
party Claims (and all Damages arising from or relating to those Claims) arising from: (a) the acts or
to comply with any obligation or satisfy any representation or warranty under the Agreement; and/or
9.5 Rules for Indemnification.
9.5.1 If a legal action is brought against the Indemnified Party, the Indemnifying Party shall,
at its sole cost and expense, defend the Indemnified Party after the Indemnified Party demands
indemnification by written notice given to the Indemnifying Party. Upon receipt of that notice, the
Indemnifying Party will have control of that litigation but may not settle that litigation without the
express consent of the Indemnified Party, which consent shall not be unreasonably withheld,
conditioned or delayed. An Indemnified Party may also engage counsel at its own cost in connection
with any Claim brought against it.
9.5.2 To the extent that the Indemnifying Party and Indemnified Party each have liability
for Damages claimed by an Indemnified Party under the Agreement, the Damages will be allocated
between them based on their proportionate share of fault for the Damages.
Article 10
Insurance
10.1 Insurance.
10.1.1 MX Insurance Requirements. During the Term, MX shall obtain and maintain the
following insurance coverage or self-insure in the following amounts:
(a)Commercial general liability insurance in the amount of at least five million
dollars ($5,000,000) per occurrence and at least ten million dollars ($10,000,000) in the
annual aggregate;
(b)Comprehensive professional liability (errors and omissions) insurance
covering the liability for financial loss due to error, omission or negligence of MX in the
amount of at least five million dollars ($5,000,000) per occurrence and at least ten million
dollars ($10,000,000) in the annual aggregate; and
(c)Network security liability insurance and privacy liability insurance in the
amount of at least ten million dollars ($10,000,000) per occurrence and at least ten million
dollars ($10,000,000) in the annual aggregate.
Central Valley Health Information Exchange
Physician Practice Participation Agreement
11
20190313.a.k.
10.1.2 Participant and Business Associate Insurance Requirements. During the Term,
Participant and any Business Associate of Participant that accesses the System shall each obtain and
maintain the following insurance coverage or self-insure in the following amounts:
(a)Commercial general liability insurance in the amount commonly carried by
a Person of the same commercial size and in the same line of business as Participant, but in
any event at least one million dollars ($1,000,000) per occurrence and two million dollars
($2,000,000) in the annual aggregate; and
(b)Comprehensive professional liability or errors and omissions (E&O)
insurance of the type and in the amount commonly carried by a Person of the same
commercial size and in the same line of business as Participant, but in any event at least
one million dollars ($1,000,000) per occurrence and three million dollars ($3,000,000) in
the annual aggregate.
10.1.3 General Requirements.
(a)
must be insurance
coverage commencing on the Effective Date and ending no earlier than three (3) years
after termination of the Agreement; and that insurance must satisfy the liability coverage
requirements set forth in this Article 10.
(b)Each Party shall
termination of the Agreement.
(c)All insurance coverage required by this Article shall be provided under valid
and enforceable policies issued by insurance companies legally authorized to do business in
California.
(d)Upon request of a Party, the other Party shall provide certificates of
insurance evidencing the coverage that the other Party is required to obtain and maintain.
Article 11
Term, Termination and Suspension
11.1 Term. The Agreement is effective on the Effective Date and shall remain in effect for five (5)
years, unless terminated as set forth below.
11.2 Termination by Participant. Participant may terminate the Agreement at any time, with or
11.3 Termination by MX. MX may exercise any of the following termination rights.
11.3.1 Privacy and Security. MX may in its sole discretion terminate the Agreement at any
in MX would, or is reasonably likely to, endanger the privacy or security of Patient Data or otherwise
result in a breach of the Agreement that is reasonably likely to harm MX or an NP Participant. MX
Central Valley Health Information Exchange
Physician Practice Participation Agreement
12
20190313.a.k.
shall deliver notice of this termination to Participant at least twenty-four (24) hours prior to
m, unless MX determines in its sole discretion that
Patient Data, in which case MX may terminate access immediately without notice.
11.3.2 Cessation. MX may te
written notice to Participant that MX will discontinue its operations and/or its provision of the
System and Services to participants.
11.3.3 Uncured Breach. MX may terminate the Agreement if Participant breaches the
Agreement and that breach continues uncured for a period of thirty (30) days after MX has delivered
breach.
11.3.4 Termination for Bankruptcy or Dissolution. MX may terminate the Agreement if MX
becomes bankrupt or insolvent, ceases to do business, or commences any dissolution, liquidation or
wind up.
11.4 HIO Termination. HIO may terminate the Agreement at any time, with or without cause, and
by HIO, the Agreement shall continue between Participant and MX unless otherwise validly terminated
by one of those two Parties.
11.5 Failure to Comply with Law. A
written notice to the other Parties or Party that: (a) identifies the Law that is (or will be) violated by the
Agreement; and (b) explains why the Agreement will not comply with Law. After a Party receives that
notice, the affected Party (or Parties) shall cooperate in good faith during the next thirty (30) days to
amend the Agreement so that it complies with the identified Law. If the Parties do not execute a
written amendment to the Agreement within the thirty (30) days, then either Party may terminate the
already in effect and violated by the Parties or the Agreement, then either Party may immediately
suspend all or part of its performance under the Agreement that is illegal while the Parties attempt in
good faith to modify the Agreement to cure that violation of Law.
11.6 Effect of Termination on Patient Data. Upon any termination of the Agreement, Participant shall
have no continued right to receive or duty to provide Patient Data, or to receive the Services. Upon any
termination, the Parties will comply with the provisions of the BAA as it pertains to PHI. If Participant
has provided Patient Data to MX, the Parties acknowledge and agree that such Patient Data has been
NP
return that Patient Data. MX shall protect such Patient Data as it protects all other Patient Data in its
possession. To the extent that either Party possesses Patient Data from the other Party, each Party shall
protect that Patient Data as it protects all other Patient Data in its possession, but is not required to
destroy, delete or return that Patient Data upon termination.
11.7 Suspended Access to Data
access to the System would, or is reasonably likely to, endanger the privacy or security of Patient Data,
ill provide read-only access if reasonably
Central Valley Health Information Exchange
Physician Practice Participation Agreement
13
20190313.a.k.
MX terminates the Agreement in accordance with this Article; or (b) the privacy or security problem has
bee
diligently to cure to the satisfaction of MX any problem(s) with its privacy or security.
11.8 Suspension Due to Fees. If Participant fails to pay undisputed amounts of Fees within sixty (60)
the System shall be restored upon payment of all delinquent undisputed Fees and any late charges
assessed pursuant to the Agreement.
Article 12
Miscellaneous Provisions
12.1 Applicable Law. The Agreement, and disputes regarding it, shall be governed by and interpreted
in accordance with the laws of the State of California (the ), but ignoring any choice or conflict of
law rules that would cause the laws of another jurisdiction to apply.
12.2 Amendment and Material Service Change.
12.2.1 Amendment. Any modification or amendment to the Agreement must be in writing
and signed by the Parties, except that the Policies, DSG, Terms, Fee Schedule and Material Service
Changes may be modified as set forth in the Agreement.
12.2.2 Material Service Change. MX may in its sole discretion implement a Material Service
Change after providing at least ninety (90) days prior written notice of the change to Participant.
Following a Material Service Change not acceptable to Participant, Participant may terminate the
Agreement pursuant to Section 11.2. If Participant has pre-paid to MX any Subscription Fees that
have not yet been earned by MX as of the date of termination, MX shall repay to Participant those
unearned Fees.
12.2.3 Policies and DSG Revision. MX may in its sole discretion modify or otherwise revise
the Policies and/or DSG after providing at least ninety (90) days prior written notice of any material
revision to Participant before the material revision is effective. If the Policy and/or DSG revision is
not acceptable to Participant, Participant may terminate the Agreement pursuant to Section 11.2.
12.2.4 Fee Revision. MX may in its sole discretion modify or otherwise revise the
Subscription Fee after providing at least ninety (90) days prior written notice of that revision to
Participant before the new fee is effective. If the Subscription Fee revision is not acceptable to
Participant, Participant may terminate the Agreement pursuant to Section 11.2.
12.2.5 Prepayment. If Participant has pre-paid to MX any Subscription Fees that have not
yet been earned by MX as of the date of termination, MX shall repay to Participant those unearned
Fees.
12.2.6 Required Revision. Notwithstanding any other provision in the Agreement, if a
revision to the Policies, Terms and/or DSG is required, in the reasonable judgment of MX, to be
made for the continued technological functioning of the HIE or for compliance with Law, MX may
unilaterally implement that revision and may shorten any requirement for prior notice set forth in
Central Valley Health Information Exchange
Physician Practice Participation Agreement
14
20190313.a.k.
the Agreement to that time period which MX reasonably determines appropriate under the
circumstances.
12.3 Assignment
duties or obligations under the Agreement, by operation of law or otherwise, without the prior written
consent of the other Party, which consent may be given, conditioned or
sole discretion, except that (a) either Party may assign the Agreement in whole or in part to an affiliate
or to a successor in interest, and (b) consent shall not be necessary in the context of an acquisition,
merger or change of control involving either Party. Any attempted assignment or transfer in violation of
the foregoing will be null and void.
12.4 Attorney Fees. Except as otherwise specified in the Agreement, the non-prevailing Party in any
arbitration, appeal or other legal proceeding pertaining to the Agreement shall pay to the prevailing
nd the costs of experts
and consultants. The substantially prevailing Party shall be the Party who prevails relative to the other
Party, as determined by the arbitrator or a court of competent jurisdiction, whether or not the
arbitration or proceeding proceeds to final judgment or award.
12.5 Availability of Records. For four (4) years after any termination of the Agreement, the Secretary
(), the Comptroller General of the United States () and/or their
designee will have access to all books and records of MX directly pertaining to the subject matter of the
Agreement, in accordance with the criteria developed by the U.S. Department of Health and Human
Services as provided in Section 952 of the Omnibus Reconciliation Act of 1980, 42 U.S.C. §1395x(v)(1)(A),
et seq. (). During that four years, upon request of the Secretary, the Comptroller General and/or
their designee, MX shall make available (at reasonable times) the Agreement and all books, documents
and records of MX that are necessary to verify the nature and extent of the costs of Services provided by
documents will be discontinued and become null and void upon a finding by a court or quasi-judicial
body of competent jurisdiction that the Agreement is outside the scope of the regulatory or statutory
definition of those agreements included within the purview of Section 952 of ORB or the rules and
regulations promulgated thereunder.
12.6 Federal Reporting Requirements. For four (4) years after any termination of the Agreement, MX
shall maintain its books, documents and records showing the nature and extent of the cost of Services
furnished under the Agreement in compliance with Section 1861(v)(1)(I) of the Social Security Act. If
requested, MX shall grant access thereto to the Secretary, the Comptroller General and/or their
designee.
12.7 Captions. Captions and headings shall have no effect in interpreting the Agreement.
12.8 Counterparts. The Agreement may be executed in one or more counterparts, each of which
shall be deemed to be an original.
12.9 Disputes. In the event of any Claim or disagreement related to the Agreement (a ),
the Parties shall:
12.9.1 Dispute Notice. A Party alleging a Dispute shall send written notice of the Dispute
) to the other Party and any
Central Valley Health Information Exchange
Physician Practice Participation Agreement
15
20190313.a.k.
other Person that the Party believes is involved in the Dispute. The Dispute Notice shall propose a
time and place for all involved Persons to meet and confer regarding the dispute.
12.9.2 Meet and Confer. Within twenty (20) days of a Party sending a Dispute Notice, the
Parties shall meet and confer in good faith regarding the Dispute. Other Persons interested in the
Dispute shall be invited to the conference, but the conference shall be held at the earliest date on
which the Parties can attend (regardless of the attendance of other interested Persons). The Meet
and Confer shall be considered a settlement negotiation for the purpose of all Laws, including
California Evidence Code § 1152.
12.9.3 Jurisdiction and Venue. All Disputes not resolved under this Section will be
adjudicated in the state and federal courts located in San Francisco, California and each Party hereby
consents to the personal jurisdiction of such courts.
12.9.4 Injunction. Notwithstanding anything to the contrary, any Party may immediately file
suit in any court as that Party deems necessary to protect or enforce its IP Rights, Proprietary and
Confidential Information or Patient Data.
12.10 Representation by Counsel; Interpretation. Each Party has been represented by counsel in
connection with this Agreement or has had an opportunity to be so represented. Both parties expressly
waive any claim that ambiguities in this Agreement should be interpreted against the other Party due to
the other Party drafting the language.
12.11 Entire Agreement. The Agreement is the entire understanding of the Parties regarding its
subject matter, and supersedes all prior written or oral understandings, promises, representations and
discussions between them with respect the subject matter of the Agreement.
12.12 Exhibits. All exhibits and attachments to the Agreement are incorporated into the Agreement
and are a part of the Agreement.
12.13 Force Majeure. Neither Party shall be liable for nonperformance or defective or late
performance of any of a duty under the Agreement to the extent and for such periods of time as that
control; provided that the Party uses good faith efforts to perform its duties.
12.14 Independent Contractors. The Parties are and shall at all times be an independent contractor of
the other, and not an employee, agent, partner of, or joint venture with the other. Except as specifically
allowed by the Agreement, neither Party has any right or authority to assume or create any obligation of
any kind, express or implied, on behalf of the other Party.
12.15 Severability. If any provision of the Agreement or the application of any provision, in whole or in
part, is determined to be invalid, void, illegal or unenforceable by an arbitrator or a court of competent
jurisdiction and such provision can be severed without substantially changing the bargain reached by the
Parties, such provision or part of such provision shall be severed from the Agreement, and such
severance shall have no effect upon the enforceability, performance or obligations of the remainder of
the Agreement.
12.16 Survival. Provisions of the Agreement shall survive any termination or expiration of the
Agreement when evident by the context of the provision and/or when specifically identified as surviving.
Central Valley Health Information Exchange
Physician Practice Participation Agreement
16
20190313.a.k.
12.17 Third-Party Beneficiary. No Person other than the Parties will have any right under or due to the
Agreement, and no Person will be a third-party beneficiary of the Agreement.
12.18 Waiver. No delay or omission by a Party to exercise a right or power it has under the Agreement
shall be construed as a waiver of that right or power. A waiver by any Party of any breach of the
Agreement shall not be construed to be consent to, waiver of, or excuse for any subsequent or different
breach. All waivers must be in writing and signed by the Parties.
12.19 Notice to MX:
Manifest MedEx
Attn: Chief Executive Officer
6001 Shellmound St., Ste. 500
Emeryville, CA 94608
Email: legal@manifestmedex.org
Notice to HIO:
Central Valley Health Information Exchange
Attn: Executive Director
5629 N. Figarden, Suite 101
Fresno, CA 93722
Email: JFranklin@communitymedical.org
17
20180904
Definitions Applicable to the Agreement
(Unless otherwise indicated, all Section references are to provisions in the Terms and Conditions.)
means one (1) or more individuals designated by Participant to: (a) designate
behalf of Participant.
is defined in Exhibit 2.b.
is defined in Exhibit 2.b.
means the Participation Agreement signed by Participant and MX, including all
documents incorporated into the Agreement by reference in the Agreement.
means application programming interface.
means an individual: (i) designated and authorized by an Administrator, in
accordance with the procedures set forth in the Agreement, to access and/or use the System
and Services on behalf of a Participant; and (ii) who is permitted under applicable Law to access
and/or use the System and Services.
means any access, use, receipt or disclosure of Patient Data
(including electronic PHI) that is not in compliance with Law.
has the meaning ascribed in 45 C.F.R. § 160.103.
executed by the Parties and attached to the Agreement.
Calendar Quarter the three months following the first day of January, April, July and
October.
means any claim, action, suit, or proceeding pertaining to the Agreement to recover
Damages, obtain specific performance and/or enjoin an action.
means the California Confidentiality of Medical Information Act, California Civil Code
Section 56 et seq.
is defined in Section 12.5 (Availability of Records).
means (a) all trade secrets, business plans, marketing plans, know-
how, data, contracts, documents, scientific and medical concepts, member and customer lists,
costs, financial information, profits and billings and referral sources, existing or future services,
products, operations, management, pricing, financial status, goals, strategies, objectives and
agreements, whether written or verbal, that are confidential in nature and pertains to or is
related to the Agreement, (b) all Security Information and (c) the Vendor Proprietary
Information; provided, however, that Confidential Information shall not include information
that:
18
20190313.a.k.
(a) is publicly known at the time of disclosure;
(b) is already known or obtained by any other Party other than in the course of the
breach of any confidentiality, nondisclosure or other agreement by that other Party or
in violation of applicable Law;
(c) is independently developed by any other Party;
(d) becomes known from an independent source having the right to disclose that
information and without similar restrictions as to disclosure and use and without breach
of these Agreement, or any other confidentiality or nondisclosure agreement by that
other Party; or
(e) is Patient Data.
has the meaning ascribed in 45 C.F.R. § 160.103.
means any and all liability, losses, judgments, damages and costs, including
rt costs and arbitration fees.
means a Person that: is not a Participant or NP Participant; and provides
Patient Data to MX.
means Participant or any NP Participant that provides Patient Data to MX.
means Participant or any NP Participant that accesses Patient Data from the
System.
means the guidelines for Participant to submit Patient Data to
MX, as provided by MX to Participant from time to time.
- means data that satisfies the requirements of 45 C.F.R. § 164.514(b).
is defined in Section 6.2 (Equitable Remedies).
is defined in Section 12.9 (Disputes).
is defined in Section 12.9.1 (Dispute Notice).
is the Data Submission Guidelines (defined above).
is defined in the Preamble.
means the Subscription Fees and the Implementation Fees.
is defined in Section 4.2 (Change to Subscription Fees).
19
20190313.a.k.
- means earlier of: the date on which MX first notifies Participant that one or
more of the Participant Affiliates has access to use the System, or one hundred eighty days (180)
from the Effective Date.
means Participant or an NP Participant that either: (a) meets the definition of
health plan in HIPAA; or (b) provides core health plan administrative services (at a minimum:
medical claims processing services and provider network management services) to a health plan
that meets the HIPAA definition.
means Patient Data and/or De-Identified Data that is collected, created,
maintained or disclosed by MX.
means Participant or an NP Participant that either: (a) meets the
definition of provider in HIPAA; or (b) is a medical group (e.g., independent practice association)
providing core administrative services to a provider that meets the HIPAA definition.
is defined in Recital B of the Agreement.
is defined in the Preamble of the Agreement.
means the Health Insurance Portability and Accountability Act of 1996, as amended by
HITECH, and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164.
means the Health Information Technology for Economic and Clinical Health Act, Title
XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of
2009 (commonly known as ), Pub. L. No. 111-5 (February 17, 2009).
is defined in Exhibit 2.c., and is first referenced in Section 4.3
(Implementation Fees).
is defined in Section 9.4 (Indemnification).
is defined in Section 9.4 (Indemnification).
means all present and future worldwide copyrights, trademarks, trade secrets,
patents, patent applications, moral rights, contract rights, concepts, inventions, processes,
techniques, algorithms, software (in source code and object code form) designs, schematics,
drawings, formulae, improvements to any of the foregoing, and other intellectual property and
proprietary rights, in whatever media or form.
means any federal or state law, statute, ordinance, rule, legally binding administrative
interpretation, regulation, order, judgment, or decree that is applicable to a Party or to another
Person identified in the Agreement.
means either: (a) a material cessation or reduction in the
functionality or interfaces of the System; or (b) a reduction in the level of Services provided by
MX.
20
20190313.a.k.
means a vendor with which MX has contracted with to provide technology in
connection with providing Services.
act as a Data Provider and/or a Data Recipient but is not a Party to the Agreement.
is defined in Section 12.5 (Availability of Records).
means a health information organization that contracts with MX to share health
data through their respective systems, or an organization that represents a community of payers
and/or providers for purposes of exchanging Patient Data between them.
is defined in the Preamble.
are defined in Exhibit 1.
means Participant or MX.
means an individual whose Patient Data is contributed to MX by a Data Provider or
Data Contributor.
means health information that: (a) is created or received by a Healthcare
Provider or Health Plan; (b) relates to: (i) past, present or future physical or mental health of a
Patient, or (ii) the provision of health care to a Patient; (c) identifies the Patient, or there is a
reasonable basis to believe the information can be used to identify the Patient (including
Protected Health Information, as that term is defined in HIPAA, and Medical Information, as that
term is defined in the CMIA); and (d) is made available to the System by a Data Provider or
is defined in Exhibit 2.b.
means an individual person, an entity or a governmental organization or agency,
including health information exchanges, researchers, Participants, NP Participants and/or an
employees, Authorized Users, accountants, attorneys,
that provide, access, receive or use any part of the System or the Services.
mean the privacy policies, security policies and/or procedural requirements adopted
by MX and made available to Participant at, as amended by MX from time to time. The current
version of the Policies can be found at https://www.manifestmedex.org/wp-
content/uploads/Policies_Manifest_MedEx.pdf.
or has the meaning ascribed in 45 C.F.R. § 164.103.
means the Secretary of the U.S. Department of Health and Human Services.
21
20190313.a.k.
means the electronic or physical security profile, security assessment
and security audit report of MX, Participant or an NP Participant.
means all services provided by MX pursuant to the Agreement.
is defined in Section 12.1 (Applicable Law).
is defined in Exhibit 2.c.
means the HIE and its related technology that MX provides to Participant and NP
Participants, as further described in the Policies.
means those services identified as tech services in Exhibit 2.b.
is defined in Section 11.1 (Term).
means the terms and conditions set forth in Exhibit 2.a.
is defined in Exhibit 2.b.
means all software, solutions, services and API keys of MX
Vendor to which Participant gains access by being a Party.
22
20190313.a.k.
Exhibit 2.b
SERVICE DESCRIPTION
MX will provide to Participant the Tech Services
Web-
health information. This includes eHealth Exchange services.
A notification service that alerts Participant when a Patient of Participant is: (i) seen in the
emergency department of Participant or an NP Participant; or (ii) admitted to or discharged
from the hospital of Participant or an NP Participant. Notifications will be based on the
subscription files submitted by Participant.
Reporting and analytic services that support Participant in analyzing the healthcare needs of
A. Training
Each Participant must designate a training coordinator before Participant begins to use
the System.
of the System, and on compliance with the Policies and Agreement. MX and its HIO affiliates will provide
web-based and/or in-person training to Training POCs and Administrator POCs and will provide training
resources and materials that Training POCs can use to train Authorized Users. Any training requested by
separate statement of work.
B. Support
) for Tech Services before
Participant begins to use the System. Administrator POCs will be responsible for: the management of
Authorized Users (e.g., setting up Authorized User accounts, assigning roles and providing security
credentials to Authorized Users); ensuring that Authorized Users have reviewed and agree to comply
with the Policies and the Agreement prior to obtaining access to the System; and providing Level 1 help-
desk support to Authorized Users, including re-setting passwords.
Administrator POCs, accessed through the web and/or email during Monday through Friday, 8:00 AM to
5:00 PM PST, excluding MX holidays posted on the MX website.
23
20190313.a.k.
C. Availability and Network Monitoring
Services will be monitored 24x7x365 by MX vendors. MX and its vendors will maintain hosted services
agreements that guarantee at least 99.8% uptime per calendar month, not including scheduled
downtime. In the event of unexpected downtime, MX will provide notifications to Participant via e-mail
or other electronic method such as the MX landing page.
D. Data Contributions
1. Participants, including each of the Participant Affiliates, will contribute Patient Data in
accordance with the schedules described below and over a secure connection configured by
MX and Participant (unless alternatives are otherwise mutually agreed upon). MX will set
Data Submission Guideline for Participants to use in submitting Patient
Data to MX. Participants will use reasonable efforts to provide Patient Data to MX
consistent with the Data Submission Guidelines.
The provisions in this Section D below not applicable to Participant are for informational
NP Participants. Those provisions not
applicable to Participant are not a guarantee or promise that MX will obtain such data from
all NP Participants.
2. Hospital Participants, including each of the Participant Affiliates, will provide the following
Patient Data to MX:
a.), within 6 months of the Effective
Date, and regularly thereafter.
b. Lab data (ORU messages), within 12 months of the Effective Date, and regularly
thereafter.
c. Pharmacy data (RDE messages), within 12 months of the Effective Date, and regularly
thereafter.
d. CCDAs (discharge summaries, transition of care documents) within 18 months of the
Effective Date, and regularly thereafter.
e. As other Patient Data become relevant to the HIE, the Parties shall work together to
develop a timeline for Participant to contribute such Patient Data to MX. If the Parties
do not agree on a timeline within three months after MX sends the notice to Participant,
24
20190313.a.k.
3. Physician and ambulatory practice Participants will provide the following Patient Data to
MX:
a.), or a patient roster if ADT data
cannot be provided, within 6 months of the Effective Date, and regularly thereafter.
b. Lab data from national reference labs and transcribed radiology reports by signing an
authorization form allowing labs and other entities ,
within 6 months of Effective Date, and regularly thereafter.
c. CCDAs (care summaries) within 18 months of the Effective Date, and regularly
thereafter.
d. As other Patient Data become relevant to the HIE, the Parties shall work together to
develop a timeline for Participant to contribute such Patient Data to MX. If the Parties
do not agree on a timeline within three months after MX sends the notice to Participant,
4. Health Plan Participants will provide the following Patient Data to MX:
a. Eligibility files for health plan enrollees (that define the identities of lives covered by the
health plan), and provider files for Health Plan providers, within six months of the
Effective Date, and regularly thereafter.
b. Medical and pharmacy claims data for health plan enrollees in mutually agreed format,
within 12 months of the Effective Date, and regularly thereafter.
5. IPA Participants will provide the following Patient Data to MX:
a. Eligibility files (or patient rosters) for Partic , within six months of the
Effective Date, and regularly thereafter.
b. Medical and pharmacy c mutually agreed format,
within 12 months of the Effective Date, and regularly thereafter.
c. Lab data from national reference labs and transcribed radiology reports by signing an
within 6 months of Effective Date, and regularly thereafter.
d. To the extent the IPA maintains clinical data for Participant members, the Participant
will provide CCDAs (care summaries) within 18 months of the Effective Date for those
Participant members, and regularly thereafter.
6. Skilled Nursing Facilities will provide the following Patient Data to MX:
a.), or a patient roster if ADT data
cannot be provided, within 6 months of the Effective Date, and regularly thereafter.
b. Lab data (ORU messages), within 12 months of the Effective Date, and regularly
thereafter.
c. Pharmacy data (RDE messages), within 12 months of the Effective Date, and regularly
thereafter.
d. CCDAs (care summaries) within 18 months of the Effective Date, and regularly
thereafter.
25
20190313.a.k.
e. As other Patient Data become relevant to the HIE, the Parties shall work together to
develop a timeline for Participant to contribute such Patient Data to MX. If the Parties
do not agree on a timeline within three months after MX sends the notice to Participant,
7. County public health, behavioral health, and/or emergency medical services patient data:
a. Provide one of the above three types of Patient level data, within 12 months of the
Effective Date, and regularly thereafter.
b. Emergency medical services data may be provided directly from American
Ambulance, subcontractor of the County to provide ambulance services.
8. Participant must refrain from sending sensitive health information (e.g., substance abuse
treatment information or self-pay information) that may be restricted from disclosure by
local, state, district, and federal law. Participants are responsible for complying with
applicable laws and for filtering any information that should not be provided or disclosed to
MX.
E. Participant Data Access Policies
As detailed in the Policies, the Participant shall develop, maintain and comply with written requirements
information. Those written requirements must be consistent with the Agreement and shall be provided
to MX upon request.
F. Implementation Services
Participant will pay Implementation Fees as set forth in Exhibit 2.c. to MX for implementation services.
These services include assisting with VPN and other connectivity services, channel/feed development
and configuration, mapping, patient or provider attribution, routing configuration, technical testing,
project management, business analysis and other act
to the MX System.
26
20190313.a.k.
Exhibit 2.c.
MX Fees
County of Fresno
1.Subscription Fees. Subscription Fees
to MX directly to use the System, except that Central Valley Health Information Exchange (CVHIE) will
exclusively determine any Supplemental Fees/Underwriting support charged by CVHIE or credited to
Participant by CVHIE as clearly identified in the invoice sent to the Participant as a CVHIE
charge/underwriting support (for Supplemental Services or otherwise). Central Valley Health
Information Exchange shall invoice Participant each Calendar Quarter in accordance with the above and
Participant shall remit all amounts due to Central Valley Health Information Exchange within thirty (30)
days of receipt of the invoice.
In the event Subscription Fees are implemented, Central Valley Health Information Exchange shall
invoice Participant each Calendar Quarter and Participant shall remit all amounts due to Central Valley
Health Information Exchange within thirty (30) days of receipt of the invoice.
In no event shall CVHIE Supplemental Fees/Underwriting support fees charged under this Agreement be
in excess of Fifty-Three Thousand One Hundred Thirty Dollars and No/100 ($53,130.00).
2.MX Implementation Fees Implementation Fees
MX Implementation fees shall be based on actual costs and preapproved by Participant. In no event
shall Implementation Fees charged by MX under this Agreement be in excess of Fifteen Thousand
Dollars and No/100 ($15,000.00).
3.MX Subscription Fees.
In no event shall MX Subscription Fees charged under this Agreement be in excess of Twenty Thousand
Dollars and No/100 ($20,000.00).
In no event shall total fees payable under this Agreement be in excess of Eighty-Eight Thousand One
Hundred Thirty Dollars and No/100 ($88,130.00).
Beginning on the second anniversary of the Effective Date, in the event that MX wishes to propose an
MX Subscription Fee pursuant to Section 4.2 of the Agreement that would result in the total MX
Subscription Fees for the remainder of the Term being greater than Twenty Thousand Dollars
($20,000.00 ten notice.
27
20190313.a.k.
Exhibit 2.d
CVHIE
and
Supplemental Fee Structure/Underwriting
NOTE:
CVHIE shall provide annual updates to the Supplemental Fee Structure/Underwriting by providing
written notice and invoices/subsidy information to Participants
CVHIE will provide to Participant the following services (
A. Training, Onboarding, and Support
Support Participant in the development of a user adoption plan that incorporates a phased roll-
out based on organizational priorities and capacities.
accordance with the train-the-trainer model.
Provide project management support to HIE Participants to facilitate their onboarding onto and
continued use of the System.
Policies relating to data access by Participant staff.
escalate issues if Participant does not receive a timely or adequate response.
B. Technology Services Implementation
Coordinate MX and Participant resources through initial technology implementation phases:
o Educate Participant on Data Submission Guidelines and coordinate discussion between
Participant and MX to resolve any issues with meeting the Guidelines;
o
System, providing project monitoring, coordination, and status reporting.
o Represent the interests of the Participant during the implementation process.
C. Local Data-Sharing Priorities
when
working with MX on system initiatives and design.
Gather and synthesize input from Participants on local priorities for data sharing, including
needs arising from local patient population characteristics, provider workflows, and specific
programs or initiatives.
Promote the development of services and the underlying technical functionality by MX to
address Participant priorities and support the roll-out of such services to Participants.
Provide subject matter expertise and identify relevant national and state best practices on an
ongoing basis.
28
20190313.a.k.
D. Governance
Facilitate a Board of Directors and Committees upon which HIE Participants are allotted seat(s)
and contribute to the overall direction of the HIO and the System.
HIO maintains its own Policies & Procedures governing internal operations.
Support Participants in meeting requirements for protecting the privacy and security of patient
information relating to HIE participation.
Coordinate communications between Participants and MX on governance-related issues.
E. Administrative Services
-profit status, such as financial
management.
Facilitate contracting for HIE services with MX and Participants.
29
20190313.a.k.
30
20190313.a.k.
Exhibit 2.e
Policies
The Policies are set https://www.manifestmedex.org/wp-
content/uploads/Policies_Manifest_MedEx.pdf), and are incorporated herein by reference as
Exhibit 2.e., as amended from time to time pursuant to this Agreement.
31
20190313.a.k.
Exhibit 2.f
MedEx, a California nonprofit public benefit corporation
Business Associate ), and County of Fresno, a political subdivision of the State of California Covered
Entity Both parties hereby agree to this Business Associate Agreement and are referred to in this BAA
Party Parties
Recitals
A. Covered Entity and Business Associate have entered into an agreement (the
Entity certain services that now or in the future shall include, but not be limited to, the
regulated by HIPAA.
B. Covered Entity is a hybrid entity under HIPAA. As such, the following components of
Covered Entity are subject to the terms of this BAA.
Department of Public Health Emergency Services Division, Emergency Medical
Services Program
Agreement
In consideration of the foregoing recitals and the promises set forth herein, the Parties agree as follows:
1. Definitions. All capitalized terms used in this BAA not specifically defined otherwise below or in
the Terms and Conditions of the Participation Agreement shall have the same definitions as given to
them under HIPAA.
(a)
at 45 C.F.R. § 164.103, except that as used herein, the term shall refer only to Protected Health
Information that Business Associate creates, receives, maintains or transmits on behalf of or from
Covered Entity.
2. Obligations of Business Associate.
(a) Compliance with Regulatory Obligations of Business Associate. Business Associate shall
perform and comply with all the applicable obligations and requirements imposed upon business
associates pursuant to HIPAA.
(b) Permitted Receipt, Use and Disclosure of PHI. Business Associate may receive, Use and
Disclose PHI to the minimum extent necessary to
activities and/or services under the Participation Agreement, and as otherwise permitted or required by
this BAA, the Participation Agreement, or Law. Business Associate shall not Use or Disclose PHI in any
manner that would violate the requirements of HIPAA if done by Covered Entity.
32
20190313.a.k.
(c) Specified Permitted Uses of PHI. Without limiting the generality of Section 2(b)
(Permitted Use and Disclosure of PHI), Business Associate may Use PHI as follows:
(i) For the proper management and administration of Business Associate.
(ii) To carry out the legal responsibilities of Business Associate.
(iii) To provide Data Aggregation services relating to the Health Care Operations of
Covered Entity or, if applicable, an organized health care arrangement of which the Covered Entity is a
member if and to the extent provided by the Participation Agreement or other agreement.
(iv) To perform services related to the creation of De-Identified Data.
(v) To perform quality improvement activities performed by EMS and to assist in
identifying appropriate additional care alternatives for patients who frequently use ambulance services
for non-emergency purposes.
(d) Specified Permitted Disclosures of PHI. Without limiting the generality of Section 2(b)
(Permitted Receipt, Use and Disclosure of PHI), Business Associate may Disclose PHI as follows:
(i) Pursuant to the direction of the Covered Entity;
(ii) For the proper management and administration of Business Associate or to
carry out the legal responsibilities of Business Associate if:
(A) If the disclosure is Required by Law; or
(B) If Business Associate obtains reasonable assurances from the person to
whom the information is Disclosed that it will be held confidentially and Used or further Disclosed only
as Required by Law or for the purposes for which it was Disclosed to the person, and if the person
promptly notifies Business Associate of any instances of which it is aware in which the confidentiality of
the information has been Breached.
(e) Specified Permitted Receipt of PHI. Without limiting the generality of Section 2(b)
(Permitted Receipt, Use and Disclosure of PHI), and in addition to Business Associate being permitted to
disclose PHI to its Subcontractors subject to section (h) below, Business Associate may receive PHI from
another business associate of Covered Entity pursuant to the direction of the Covered Entity.
(f) Safeguards. Business Associate shall Use appropriate safeguards and comply, where
applicable, with 45 C.F.R. §§ 164.302 through 164.316 with respect to electronic PHI, and will apply
appropriate safeguards to prevent the Use or Disclosure of the PHI in any form, including electronic
form other than as provided for by this BAA.
(g) Reporting Unauthorized Uses and Disclosures. Business Associate shall report to Covered
Entity, without unreasonable delay, and in accordance with the deadlines provided below, any Use or
Disclosure of PHI not permitted by this BAA of which Business Associate becomes aware, including any
Use or Disclosure involving PHI and any Breach of Privacy or Security as defined in the Terms and
Conditions of the Participation Agreement. Without limiting the generality of the foregoing:
33
20190313.a.k.
(i) Reporting of Breaches of Privacy or Security.
(A) Following the discovery of (I) any access to, Use or Disclosure of PHI
which is not permitted by the Participation Agreement (including any Breach of Privacy or Security) or
(I
designated privacy contact person without unreasonable delay, and in no case later than forty-eight (48)
hours after discovery of the Breach of Privacy or Security of the Security Incident; provided, however,
that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to
Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security
Incidents (as defined below) for which notice to Covered Entity by Business Associate shall be required
ll, port scans, unsuccessful log-on attempts,
denials of service and any combination of the above, so long as no such incident results in unauthorized
access, Use or Disclosure of PHI. Covered Entity will advise Business Associate of any subsequent
change
(B) In the event of a Breach of Privacy or Security, Business Associate shall
without unreasonable delay carry out an investigation and shall provide reasonably frequent updates to
Covered Entity as to the results of the investigation, including, as soon as reasonably possible, the
identification of each Patient whose PHI has been, or is reasonably believed to have been, accessed,
acquired, or Disclosed during any Breach of Privacy or Security.
(C) Business Associate shall cooperate with Covered Entity and shall provide
that assistance as Covered Entity may reasonably request so that Covered Entity may comply with any
obligations it may have to investigate, remediate, mitigate, report, and or otherwise notify third parties
of that Breach of Privacy or Security.
(h) Arrangements with Subcontractors. Business Associate shall enter into a BAA with any
Subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of
Business Associate, pursuant to which the Subcontractor shall agree to comply with the applicable
requirements of HIPAA and the same (or more stringent) restrictions and conditions that apply to
Business Associate with respect to that PHI pursuant to this BAA, and pursuant to which Business
Associate shall obtain satisfactory assurances that the Subcontractor shall appropriately safeguard that
PHI.
(i). Business Associate shall make available PHI in a designated
record set as necessary to satisfy the requirements of 45 C.F.R. § 164.524.
(j). Business Associate shall incorporate
amendments to PHI as and to the extent required for compliance with 45 C.F.R. § 164.526.
(k) Disclosures. Business Associate shall document
Disclosures of PHI and provide information sufficient to respond to a request by a Patient for an
Accounting of Disclosures in compliance with 45 C.F.R. § 164.528.
(l) Other Obligations. To the extent that Business Associate is, pursuant to the Participation
Agreement or this BAA, responsible to carry out an obligation of Covered Entity under HIPAA, Business
Associate shall comply with the requirements of HIPAA that apply to Covered Entity in the performance
of that obligation.
34
20190313.a.k.
(m) Books and Records. Business Associate shall make its internal practices, books, and
records relating to the Use and Disclosure of PHI received from or created or received by Business
Associate on behalf of Covered Entity, available to the Secretary for purposes of determining Covered
3.
(a) Notice of Change in Privacy Practices. Covered Entity shall notify Business Associate of
any limitation(s) in Covered
reasonably practicable, and in no case more than ten (10) business days after the change to the notice
of privacy practices containing such limitation.
(b) Notice of Change in Permissions. Covered Entity shall notify Business Associate of any
changes in, or revocation of, permission by an individual to Use or Disclose PHI, to the extent that that
in no case more than ten (10) business days after the date when Covered Entity learns of the change in
permissions. Business Associate shall abide by each change in, or revocation of, permission described
above in this clause (b).
(c) Notice of Change in Use. Covered Entity shall notify Business Associate of any restriction
to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. §164.522,
reasonably practicable, and in no case more than ten (10) business days after the date when Covered
Entity learns of the restriction. Business Associate shall abide by each restriction described above in this
clause (c).
(d) Appropriate Requests. Covered Entity shall not request that Business Associate Use or
Disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.
4. Term and Termination.
(a) Term. Subject to the other provisions of this Section 4 (Term and Termination), the term
of this BAA shall be coextensive with that of the Participation Agreement.
(b) Breach Pattern of Practice. If party knows of a pattern of activity or practice by the other
party that constitutes a material breach or violation of its obligations under HIPAA or this BAA, such
party shall notify the other party of that breach. If such other party is unsuccessful in curing that breach
within a reasonable time period specified by the notifying party, the notifying party may terminate this
BAA and the Participation Agreement, if feasible, upon written notice to the other party.
(c) Conduct Upon Termination. Upon termination or expiration of this BAA, Business
Associate and Covered Entity acknowledge that return or destruction of PHI is not feasible. Accordingly,
Business Associate shall extend the protections of this BAA, including Section 2(e) (Safeguards), to any
that PHI for so long as it is not destroyed, and limit further uses and Disclosures of that PHI to those
purposes that make the return or destruction not feasible, for as long as Business Associate or any
Subcontractor of Business Associate maintains that PHI. Upon the expiration of this period of
infeasibility, if any, Business Associate shall destroy all PHI that it has retained. If PHI is to be destroyed
35
20190313.a.k.
pursuant to this Section 4(c) (Conduct Upon Termination) or pursuant to the Participation Agreement,
Business Associate shall certify in writing to Covered Entity that that PHI has been destroyed.
5. Relationship to Participation Agreement. In the event that a provision of this BAA is contrary to
a provision of the Participation Agreement pertaining to Business Associat
obligations as a business associate, the provisions of this BAA shall control.
6. Cooperation in Investigations. The Parties acknowledge that certain breaches or violations of
this BAA may result in litigation or investigations pursued by federal or state governmental authorities of
the United States resulting in civil liability or criminal penalties. Each Party shall cooperate in good faith
in all respects with the other Party in connection with any request by a federal or state governmental
authority for additional information and documents or any governmental investigation, complaint,
action or other inquiry.
7. Amendment. The Parties agree to take that action from time to time as is necessary to amend
this BAA for Covered Entity and Business Associate to comply with HIPAA or other applicable law. The
Parties agree that this BAA may only be modified by mutual written amendment, signed by both Parties,
effective on the date set forth in the amendment.
8. Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA.
9. Electronic Signature. The parties agree that this Agreement may be executed by electronic
by an individual signing this Agreement to represent their signature, including but not limited to (1) a
digital signature; (2) a faxed version of an original handwritten signature; or (3) an electronically scanned
and transmitted (for example by PDF document) of a handwritten signature. Each electronic signature
affixed or attached to this Agreement (1) is deemed equivalent to a valid original handwritten signature
of the person signing this Agreement for all purposes, including but not limited to evidentiary proof in
any administrative or judicial proceeding, and (2) has the same force and effect as the valid original
handwritten signature of that person. The provisions of this section satisfy the requirements of Civil
Code section 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
Part 2, Title 2.5, beginning with section 1633.1). Each party using a digital signature represents that it
has undertaken and satisfied the requirements of Government Code section 16.5, subdivision (a),
paragraphs (1) through (5), and agrees that each other party may rely upon that representation. This
Agreement is not conditioned upon the parties conducting the transactions under it by electronic means
and either party may sign this Agreement with an original handwritten signature.
DocuS ign Envelope ID : B0B431 C1-1DC9-4B96-94B7-9F09F85B67 A4
In witness whereof, Covered Entity and Business Associate have entered into this BAA as of the Effective
Date of the Participation Agreement.
Covered Entity
By:
Name :
Title :
Brian Pacheco
Chairman of the Board of
Supervisors of the County
of Fresno
FOR ACCOUNTING USE ONLY :
Fund : 10000
20190313.a .k.
3 6
Business Associate
By:
Name :
Title :
ATTEST:
Erica Galvez
Chief Operating Officer Manifest
Medex
BERNICE E. SEIDEL
C lerk of the Board of Superv isors
Count f Fre ~no , tate of Californ ia
By.....,.,..-Q.~.....,.'--=.::.='1---~--
Deputy