HCA CONTRACT NO. FA971 AMENDMENT NO. 5

Attachment I, Scope of Services, Capitated Health Plans, Section D., Service(s) to be Provided, Item 3., Other Service Requirements, sub-item f. is hereby deleted in its entirety and replaced with the following:

The Health Plan has agreed to and is authorized by the Agency to provide services through telemedicine and as specified in Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-items 22., Telemedicine, and 23., Practitioner Services; Section VI, Behavioral Health Care, Item A., General Provisions; and Exhibit 5, Covered Services, only if denoted by an “X” in Table 9 below.

Attachment II, Core Contract Provisions, Table of Contents, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 6. Requirements, the header is hereby amended to now read as follows:

Enrollee Handbook Requirements

Attachment II, Core Contract Provisions, Section I, Definitions and Acronyms, Item A., Definitions is hereby amended to include the following definitions:

Is identified in the Florida Medicaid State Plan,

Is reasonably preventable through the application of procedures supported by evidence-based guidelines,

Has a negative consequence for the beneficiary,

Is auditable, and

Includes, at a minimum, the following:

Wrong surgical or other invasive procedure performed on a patient,

Surgical or other invasive procedure performed on the wrong body part, and

Surgical or other invasive procedure performed on the wrong patient.

Attachment II, Core Contract Provisions, Section I, Definitions and Acronyms, Item B., Acronyms is hereby amended to add the following acronyms:

Attachment II, Core Contract Provisions, Section II, General Overview, Item D., General Responsibilities of the Health Plan, sub-items 1. through 5. are hereby deleted in their entirety and replaced as follows:

The Health Plan shall comply with all provisions of this Contract, including all attachments, applicable exhibits, Health Plan Report Guide (Report Guide) requirements and any amendments and shall act in good faith in the performance of the Contract provisions.

The Health Plan shall develop and maintain written policies and procedures to implement and to comply with the provisions of this Contract.

The Health Plan shall submit policies and procedures related to this Contract to the Bureau of Managed Health Care (BMHC), upon request. If BMHC has requested policies and procedures, the Health Plan shall notify BMHC of any subsequent changes in such materials.

The Health Plan shall submit all other materials to include, but not be limited to, enrollee, provider and outreach/marketing materials related to this Contract, to BMHC for review and approval prior to implementation. Likewise, any material changes in such materials must be prior approved by BMHC before they take effect. The Health Plan shall submit the following materials requiring Agency review as follows unless specified elsewhere in the Contract:

Third party administrator subcontracts for FFS PSNs to BMHC at least ninety (90) calendar days before the effective date of the subcontract or change;

Managed Behavioral Health Organization subcontracts to BMHC at least forty-five (45) calendar days before the effective date of the subcontract or change; and

Other written materials to BMHC at least forty-five (45) calendar days before the effective date of the material or change.

Attachment II, Core Contract Provisions, Section III, Eligibility and Enrollment, Item A., Eligibility, sub-items 1.a.(5) and (6) are hereby amended and sub-item (7) is hereby included, respectively as follows:

Attachment II, Core Contract Provisions, Section III, Eligibility and Enrollment, Item A., Eligibility, sub-item 2.i. is hereby amended to now read as follows:

Individuals enrolled in the Channeling Waiver, Aged and Disabled Adult Waiver, Adult Cystic Fibrosis Waiver, Adult Day Health Care Waiver, Traumatic Brain and Spinal Cord Injury Waiver, Familial Dysautonomia Waiver, Family and Supported Living Waiver or Model Waiver.

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 1.f. is hereby included as follows:

The Health Plan shall provide written notice of changes affecting enrollees to those enrollees at least thirty (30) calendar days before the effective date of change.

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 2.d., the first sentence is hereby amended to now read as follows:

All enrollee communications including written materials, spoken scripts and web sites shall be at or near the fourth (4th) grade comprehension level.

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 6.a.(6) is hereby amended to now read as follows:

Procedures for obtaining required services, including second opinions at no expense to the enrollee (in accordance with 42 CFR 438.206(3) and s. 641.51, F.S.), and authorization requirements, including those services available without prior authorization;

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 6.a.(12) is hereby amended to change the DCF Medicaid Fair Hearing office title and address to now read as follows:

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-items 7.a. through 7.c. are hereby amended to now read as follows:

The Health Plan shall ensure its initial provider directory matches the provider network submission approved by the Agency for Contract execution and/or expansion. After the Agency’s initial provider directory approval, the Health Plan shall ensure its provider network matches the provider network file that the Health Plan submitted to the Agency or its designees in accordance with Section XII, Reporting Requirements, and the Health Plan Report Guide.

The provider directory shall include the names, locations, office hours, age groups, telephone numbers of, and non-English languages spoken by current Health Plan providers. The provider directory shall include, at a minimum, information relating to PCPs, specialists, pharmacies, hospitals, certified nurse midwives and licensed midwives, and ancillary providers. The provider directory also shall identify providers that are not accepting new patients. The provider directory shall also include information on how to determine a provider’s hospital affiliations. Such information must be available online and through customer service. The listing of behavioral health providers shall be grouped by categories (individual practitioners, groups, community mental health centers, and inpatient psychiatric).

The Health Plan shall maintain an online provider directory containing all the information described in subsections 7.a. and b., above. The Health Plan shall update the online provider directory to exclude providers who have left the network and include those who have been added since the previous update of the directory, at least monthly, or more often as required to comply with matching the most recent provider network file submitted to the Agency (see sub-item 7.a.(2), of this item). The Health Plan shall file an attestation to this effect with BMHC each month, even if no changes have occurred.

Attachment II, Core Contract Provisions, Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services, sub-item 13.b., the first sentence is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section V, Covered Services, Item C., Expanded Services, sub-item 1.f. is hereby amended and sub-items g. and h. are hereby included, respectively as follows:

Adult Hearing Services – hearing evaluations, hearing aid devices and hearing aid repairs;

Practitioner Services – one (1) general office visit per day; and

Home Health Services – not limited to three (3) home health visits per day.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 2.e. is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 10.a. is hereby amended to now include the following:

Pursuant to section 2702 of the Patient Protection and Affordable Care Act (ACA), the Florida Medicaid State Plan and 42 CFR section 434.6(12) and 447.26, and effective July 1, 2013, the Health Plan shall comply with the following requirements:

Require providers to identify Provider-Preventable Conditions (PPCs) in their claims;

Deny reimbursement for PPCs occurring after admission in any inpatient hospital or inpatient psychiatric hospital setting, including CSUs, as listed under Forms at http://ahca.myflorida.com/MCHQ/Managed_Health_Care/MHMO/med_prov_0912.shtml;

Ensure that non-payment for PPCs does not prevent enrollee access to services;

Ensure that documentation of PPC identification is kept and accessible for reporting to the Agency;

Capitated Health Plans and FFS Health Plans that are capitated or subcapitate for affected inpatient services must ensure their encounter data submissions include PPC information in order to meet the PPC identification requirements;

Beginning October 1, 2013, FFS Health Plans (PSNs and FFS specialty plans) shall ensure their providers submit claims with the following information as needed to process through FFS Medicaid:

Present on Admission (POA) indicator = “N ” or “Y” and applicable codes not POA;

The date of the occurrence;

The nature and a description of the specific event;

The applicable ICD code; and

For claims with admit dates prior to July 1, 2013, report value code “81” in Form Locator number 39, 40 or 41, as appropriate, on the UB-04, along with any non-covered days related to the PPC, and the amount field must be greater than “0”;

Effective January 1, 2014, the Health Plans must amend all hospital subcontracts to include PPC reporting requirements; and

Relative to all above requirements, the Health Plan may not:

Limit inpatient days for services that are unrelated to the PPC diagnosis present on admission (POA);

Reduce authorization to a provider when the PPC existed prior to admission;

Deny reimbursement to inpatient hospitals and inpatient psychiatric hospitals, including CSUs, for services occurring prior to the PPC event;

Deny reimbursement to surgeons, ancillary and other providers that bill separately through the CMS 1500;

Deny reimbursement for health care settings other than inpatient hospital and inpatient psychiatric hospital, including CSUs; and

Deny reimbursement for clinic services provided in clinics owned by hospitals.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 14.h. is hereby deleted in its entirety and replaced as follows:

(Capitated Health Plans only) Pay no more than the Medicaid program vaccine administration fee as follows:

For dates of service prior to January 1, 2013, ten dollars ($10.00) per administration, unless another rate is negotiated with the participating provider;

For dates of service on or after January 1, 2013, through December 31, 2014, in accordance with the Patient Protection and Affordable Care Act (ACA), no more than the Medicaid program vaccine product code and administration fee, per administration, as specified in the Florida Medicaid Physician Primary Care Rate Increase Fee Schedule at: http://portal.flmmis.com/FLPublic/Portals/0/StaticContent/Public/FEE%20SCHEDULES/2013_07_01_Phys_Primary_Care_Rates.pdf, and Section V, Covered Services, Item H., 23.a., Primary Care Services, of this Attachment, unless another rate is negotiated with the participating provider.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.a., lead paragraph, the fifth sentence is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.a.(4), lead paragraph is hereby amended to now read as follows:

If the Health Plan is capitated or uses its own pharmacy benefits administrator (PBA) as specified in Attachment I of this Contract, it shall submit a PDL that has been revised and approved by the Health Plan’s Pharmacy and Therapeutics (P&T) Committee to BMHC and the Bureau of Pharmacy Services by October 1 of each Contract year, and provide forty-five (45) calendar days’ written notice of any changes to both bureaus.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.b. is hereby amended to now read as follows:

If the Health Plan is capitated or uses its own PBA as specified in Attachment I of this Contract, it may delegate any or all functions to one (1) or more PBAs. Before entering into a subcontract, the Health Plan shall work with the Agency’s fiscal agent by emailing

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.f., the lead sentence is hereby amended to now read as follows:

If the Health Plan is capitated or uses its own PBA as specified in Attachment I of this Contract, it shall ensure that its enrollees are receiving the functional equivalent of those goods and services received by fee-for-service Medicaid recipients in accordance with the HSA.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.g., the lead sentence is hereby amended to now read as follows:

The Health Plan shall cover a brand-name drug if the prescriber:

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 16.n. is hereby amended to include the following:

Effective January 1, 2013, the Health Plan shall not cover barbiturates and benzodiazepines for dual eligibles.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 18.b. is hereby amended to now read as follows:

The Health Plan shall provide these required examinations or, if unable to do so within the required time frames, approve and process the out-of-network claim.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 22.a. is hereby amended to now read as follows:

The Health Plan may use telemedicine only as specified in this Contract and within any standards specified in the Agency’s Medicaid Services Coverage and Limitations Handbooks for the following services:

Behavioral Health Services (See Attachment I and Attachment II, Section VI);

Dental Services (See Attachment I and Attachment II, Exhibit 5); and.

Practitioner Services (See Attachment I and Attachment II, Section V, H.23.c.).

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, sub-item 23., Primary Care Services is hereby deleted in its entirety and replaced with sub-item 23., Practitioner Services, as follows:

Primary Care Services

The Health Plan shall process claims for and, if capitated or are approved by the Agency to subcapitate for certain covered services, pay certain

The capitated Health Plan shall ensure the physician payment specified in this section applies to such primary care services provided by physicians with a specialty designation of family medicine, general internal medicine, or pediatric medicine or related subspecialists. Physicians affected include the following:

A physician as defined in 42 CFR 440.50; or provider under the personal supervision of a physician who self-attests to a specialty designation of family medicine, general internal medicine or pediatric medicine; or a subspecialty recognized by the American Board of Medical Specialties (ABMS), the American Board of Physician Specialties (ABPS) or the American Osteopathic Association (AOA); and

A physician who self-attests that he/she is board certified with such a specialty or subspecialty and/or has furnished evaluation and management services and vaccine administration services under the codes listed below that equal at least sixty percent (60%) of the Medicaid codes he or she has billed during the most recently completed calendar year or, for newly eligible physicians, the prior month.

The Health Plan shall ensure that increased payments specified in this provision are not provided to physicians delivering primary care services at FQHCs, RHCs or CHDs.

The capitated Health Plan shall make increased physician payments according to this provision. The Health Plan shall ensure that the full benefit of the payment increase is paid to eligible providers, regardless of the payment amount received by the Health Plan from the Agency.

Enrolled Medicaid providers who provide services through FFS Health Plans (FFS PSNs) and the Specialty Plan for Children with Chronic Conditions shall use the Agency’s online attestation form and certification process for the Affordable Care Act Primary Care Increase, as specified at: http://portal.flmmis.com/FLpublic/default.aspx. This attestation will be required annually for the January 1, 2013 through December 31, 2014, time frame.

The capitated Health Plan shall document physician eligibility for any increased payments made under this subsection for each calendar year

Enrolled Medicaid providers may use the Agency’s online attestation form and certification process for the Affordable Care Act Primary Care Increase, as specified at http://portal.flmmis.com/FLpublic/default. The Health Plan may not require additional documentation to be submitted to the Health Plan for Medicaid-enrolled physicians who have already self-attested using the Agency’s Web-portal process for each calendar year.

For the January 1, 2013, through December 31, 2013, calendar year, capitated Health Plans shall ensure written notification of the Health Plan’s attestation/eligibility process is given to eligible providers by June 15, 2013, in order to allow physicians time to complete the process. The capitated Health Plan may direct its providers to print out and submit the Agency’s online attestation form, use its own attestation form or use its credentialing information to document Medicaid-registered providers’ eligibility for the increased physician payments.

If capitated Health Plans use the notification language supplied by the Agency verbatim (except for specified insertions), the Health Plan does not need Agency approval for this notice. If the Health Plan uses the supplied notice language verbatim, the Health Plan shall email the BMHC plan analyst of its intent to do so.

The capitated Health Plan shall complete its initial review of credentialing information from eligible physicians by August 15, 2013.

The capitated Health Plan shall ensure that physicians who complete the capitated Health Plan’s eligibility process or the Agency’s attestation process as specified above by August 15, 2013, will be eligible for the rate increase retroactively up to January 1, 2013. The capitated Health Plan shall ensure that physicians who complete the capitated Health Plan’s eligibility process or the Agency’s attestation process as specified above after August 15, 2013, are eligible for the fee increase on the first day of the month of documented eligibility.

The capitated Health Plan shall retain documentation of how its affected providers met the physician self-attestation and payment eligibility requirements, and make the documentation available to the Agency upon request.

The Agency will notify Medicaid-enrolled providers and Health Plans when the January 1, 2014, through December 31, 2014 physician self-attestation must be submitted. Upon such notification by the Agency, the capitated Health Plan shall ensure notification of the Health Plan’s and the Agency’s attestation/eligibility process is given to eligible providers by the Agency-required date.

The capitated Health Plan shall ensure that payments to eligible providers are limited to the following primary care services, in accordance with the Florida Medicaid Affordable Care Act Fee Schedule:

Evaluation and Management (E&M) codes 99201 through 99499; and

Current Procedural Terminology (CPT) vaccine administration codes 90460, 90461, 90471, 90472, 90473 and 90474, and their successor codes.

Notwithstanding the claims payment requirements in Section X, Administration and Management, Item C., Claims, the capitated Health Plan shall ensure physician payments related to this fee increase are made as follows:

For dates of service in the first three (3) quarters of calendar year 2013, the Health Plan shall ensure retroactive payments are paid within ninety (90) calendar days of receipt of the Agency’s supplemental payment to the Health Plan; and

For dates of service in the last quarter of calendar year 2013 and for calendar year 2014, the Health Plan shall ensure payments are paid within sixty (60) calendar days of receipt of the Agency’s supplemental payment to the Health Plan.

In order to provide accurate data reports of utilization and encounter data for physicians eligible for provider payments, including vaccination administration payments, made to the physician relative to this subsection, the capitated Health Plan shall report utilization of eligible services to the Agency’s Medicaid Program Analysis (MPA) secure file transfer protocol (SFTP) site as follows:

For the first and second quarter of calendar year 2013, covering eligible services provided between January 1, 2013 and June 30, 2013, with payment dates no later than June 30, 2013, the Health Plan shall submit an ad hoc summary report and supporting PCP fee increase encounter data, using the Agency-supplied template, that document the physician’s eligibility and provider payments made to the physician relative to this subsection. The Health Plan shall submit this ad hoc report by September 3, 2013;

For the remaining calendar quarters of 2013 and for calendar year 2014, the Health Plan shall submit to the Agency, by the end of the month following the end of each quarter, quarterly reports that document the physician’s eligibility and provider payments, including vaccination administration payments, made to the physician relative to this subsection, and as specified in Section XII, Reporting Requirements, and the Health Plan Report Guide. The Health Plan shall not include PCP fee increases (differential) in its regular, ongoing encounter data submissions to the Agency (see Attachment II, Section X., D., Encounter Data); and

The Agency will review and evaluate all submissions, and provide group feedback to the capitated Health Plans. Evaluation will consider: (1) adherence of submitted data to the format and content requirements provided in the attachments to this transmittal; (2) consistency between the summary report and the supporting encounter data; (3) the number of submissions required for acceptability of data; and (4) adherence to reporting deadlines. Capitated Health Plans with unacceptable data will be required to make corrections and resubmit, potentially resulting in payment delays for eligible physicians and resulting in sanctions and/or liquidated damages to the Health Plan.

The capitated Health Plan shall submit any documentation as required by the Agency, by the date specified by the Agency, in order to ensure that increased provider payments are made as required by 42 CFR 438.6(c)(5)(vi)(A), to adequately document expenditures eligible for 100% FFP and to support all audit or reconciliation processes.

The capitated Health Plan shall provide its physicians that have received an increased payment pursuant to this subsection with an explanation of benefits (EOB).

General Office Visit Limits

Unless approved as an expanded benefit in Attachment I, the Health Plan shall limit general office visits for non-pregnant adults (age 21 and over) to two (2) per month for services with procedure codes 99201 through 99215 provided by a physician, advanced registered nurse practitioner, or physician assistant with the specialty of family practice, general practice, preventive medicine, internal medicine, public health, adult primary care, college health nurse, or family nurse. Office visits to specialists are not subject to this limit.

Exemptions to the general office visit limit automatically apply to the following:

Recipients under the age of 21;

A pregnancy related diagnosis code associated with the visit;

Visits provided in CHDs, FQHCs or RHCs; and/or

The following diagnoses:

End-state cirrhosis and ascites (requiring adjustments to diuretic medications and check of potassium levels);

Diabetes with complications of peripheral neuropathy resulting in infected foot ulcer (requires frequent visits for antibiotics, debridement);

Pneumonia and comorbidities (to monitor treatment response); and

New onset of syncope (evaluation, review of studies and follow-up).

The Health Plan may authorize additional exemptions to the general office visit limits based on medical necessity on a case-by-case basis.

Telemedicine for Practitioner Services

Only physicians can provide and receive reimbursement for practitioner services provided through telemedicine.

Only the following medically necessary practitioner services may be provided through telemedicine by Florida-licensed physicians at the hub site: consultation procedure codes 99241 through 99255, with the addition of the modifier GT, provided in hospital settings (inpatient and outpatient) and physician offices.

Attachment II, Core Contract Provisions, Section V, Covered Services, Item H., Coverage Provisions, is hereby amended to include sub-item 24., Home Health Services as follows:

For non-pregnant adults (age 21 and over) the Health Plan shall limit home health visits to three (3) per day.

Exemptions to the home health visit limit automatically apply to the following:

Recipients under the age of 21; and

A pregnancy related diagnosis code associated with the with the visit;

The Health Plan may authorize additional exemptions to the home health visit limits based on medical necessity on a case-by-case basis.

Attachment II, Core Contract Provisions, Section VI, Behavioral Health Care, Item A., General Provisions, sub-item 8.d.(2) is hereby amended to now read as follows:

Outpatient hospital services for psychiatric conditions (ICD-9-CM codes 290 through 290.43, 290.8, 290.9, 293 through 298.9, 300 through 301.9, 302.7, 306.51 through 312.4 and 312.81 through 314.9, and 315.9);

Attachment II, Core Contract Provisions, Section VI, Behavioral Health Care, Item A., General Provisions, sub-item 8.d.(4) is hereby amended to now read as follows:

Community mental health services (ICD-9-CM codes 290 through 290.43, 290.8, 290.9, 293.0 through 298.9, 300 through 301.9, 302.7, 306.51 through 312.4 and 312.81 through 314.9, 315.3, 315.31, 315.5, 315.8, and 315.9); and for these procedure codes

Attachment II, Core Contract Provisions, Section VI, Behavioral Health Care, Item A., General Provisions, sub-item 8.d.(5) is hereby amended to now read as follows:

Community substance abuse services when the appropriate ICD-9 CM diagnosis code (290 through 290.43, 293.0 through 298.9, 302.7, 306.51 through 312.4 and 312.81 through 314.9, and 315.9) has been documented: H0001; H0001HN; H0001HO; H0001TS; H0047; H2010HF; H2012HF; T1007; T1007TS; T1015HF or T1023HF;

Attachment II, Core Contract Provisions, Section VII, Provider Network, Item B., Network Standards, is hereby amended to include sub-item 5., Primary Dental Providers as follows:

Attachment II, Core Contract Provisions, Section VII, Provider Network, Item H., Credentialing and Recredentialing, sub-item 2.a. is hereby amended to now read as follows:

A copy of each provider's current medical license pursuant to s. 641.495, F.S. However, if the provider is located in Georgia or Alabama, the provider’s medical license and permit must be current and applicable to the respective state in which the provider is located.

Attachment II, Core Contract Provisions, Section VII, Provider Network, Item H., Credentialing and Recredentialing, sub-item 2.c. is hereby deleted it its entirety and replaced as follows:

A satisfactory Level II background check pursuant to s. 409.907, F.S., for all treating providers not currently enrolled in Medicaid’s fee-for-service program;

Upon Agency notice of implementation of a managed care electronic background screening verification process:

The Health Plan shall verify the provider’s Medicaid eligibility through the Agency’s electronic background screening system. If the provider’s fingerprints are not retained in the Care Provider Background Screening Clearinghouse (Clearinghouse, see s. 435.12, F.S.) and/or eligibility results are not found, the Health Plan shall submit complete sets of the provider’s fingerprints electronically for Medicaid Level II screening following the appropriate process described on the Agency’s background screening website;

The Health Plan shall not contract with any provider who has a record of illegal conduct; i.e., found guilty of, regardless of adjudication, or who entered a plea of nolo contendere or guilty to any of the offenses listed in s. 435.04, F.S.;

Individuals listed in s. 409.907(8), F.S., for whom criminal history background screening cannot be documented must provide fingerprint cards or, upon Agency notice of implementation of a managed care electronic background

Attachment II, Core Contract Provisions, Section VII, Provider Network, Item I., Provider Services, sub-item 2.a.(19)(b), the first sentence is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section VIII, Quality Management, Item A., Quality Improvement is hereby amended to include sub-item 7., Critical Incidents as follows:

The Health Plan, capitated and FFS, shall develop and implement a critical and adverse incident reporting and management system for critical events that negatively impact the health, safety, or welfare of enrollees. Adverse incidents may include events involving abuse, neglect, exploitation, major illness or injury, involvement with law enforcement, elopement/missing, or major medication incidents. Such systems shall be for critical and adverse incidents that occur in all service delivery settings applicable to enrollees.

The Health Plan shall require participating providers to report adverse incidents to the Health Plan within twenty-four (24) hours after the incident. The Health Plan shall ensure that all participating providers are required to report adverse incidents to the Agency immediately but not more than twenty-four (24) hours after the incident. Reporting will include information including the enrollee’s identity, description of the incident and outcomes including current status of the enrollee.

The Health Plan shall report suspected abuse, neglect and exploitation of enrollees immediately, in accordance with s. 39.201, and Chapter 415, F.S. The Health Plan shall report suspected cases of abuse, neglect and/or exploitation to the appropriate protective services unit/hotline. The Department of Children and Families has the responsibility for investigating allegations of abuse, neglect and exploitation of children. The Florida Adult Protective Services has the responsibility for investigating allegations of abuse, neglect and exploitation of elders and individuals with disabilities.

Documentation related to the suspected abuse, neglect or exploitation, including the reporting of such, must be kept in a file, separate from the enrollee’s case file, that is designated as confidential. Such file shall be made available to the Agency upon request.

The Health Plan shall implement and maintain a risk-management program.

The Health Plan shall provide appropriate training and take corrective action as needed to ensure its staff, participating providers and direct service providers comply with critical incident requirements.

Enrollee quality of care issues must be reported to and a resolution coordinated with the Health Plan’s Quality Management Department.

The Health Plan shall report monthly to BMHC, by the fifteenth (15^th) calendar day of the month following the report month, a summary of critical incidents as specified in Section XII, Reporting Requirements, and the Health Plan Report Guide, in the manner and format specified by the Agency.

The Health Plan, shall report to BMHC all serious enrollee injuries occurring through health services within fifteen (15) calendar days after the Health Plan received information about the injury. The Health Plan will use the Agency’s Division of Health Quality Assurance’s (HQA’s) online Code 15 Report to document and report the incident. The Health Plan can find the Code 15 Report at: http://ahca.myflorida.com/SCHS/RiskMgtPubSaftey/on_line.shtml.

Attachment II, Core Contract Provisions, Section VIII, Quality Management, Item B., Utilization Management (UM), sub-item 1.a.(3) is hereby amended to now read as follows:

A procedure for enrollees to obtain a second medical opinion at no expense to the enrollee and for the Health Plan to authorize claims for such services in accordance with 42 CFR 438.206(3) and s. 641.51, F.S.

Attachment II, Core Contract Provisions, Section IX, Grievance System, Item G., Medicaid Fair Hearings, sub-item 5. is hereby amended to now read as follows:

The address at DCF for the Medicaid Fair Hearing office is:

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item D., Encounter Data, is hereby deleted in its entirety and replaced as follows:

Encounter data collection and submission is required from all Health Plans for all health care services, including expanded benefits, rendered to their enrollees (excluding services paid directly by the Agency on a fee-for-service basis). The Health Plan shall submit encounter data that meets established Agency data quality standards as defined herein. These standards are defined by the Agency to ensure receipt of complete and accurate data for program administration and are closely monitored and enforced. The Agency will revise and amend these standards with ninety (90) calendar days’ advance notice to the Health Plan to ensure continuous quality improvement. The Health Plan shall make changes or corrections to any systems, processes or data transmission formats as

The Health Plan must certify all data to the extent required in 42 CFR 438.606. Such certification must be submitted to the Agency with the certified data and must be based on the knowledge, information and belief of the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Medical Officer (MCO) or an individual who has written delegated authority to sign for, and directly reports to the CEO or CFO that all data submitted in conjunction with the encounter data and all documents requested by the Agency are accurate, truthful, and complete. The Health Plan agrees to provide the certification at the same time it submits the certified data in the format and within the timeframe required by the Agency.

The Health Plan shall be capable of sending and receiving any claims information directly to the Agency in standards and timeframes specified by the Agency within sixty (60) calendar days’ notice.

Upon implementation by the Agency, the Health Plan shall submit a “Check Run Summary File” reporting how total provider payment amounts reconcile with the encounter data submission for each provider payment adjudication cycle. The Check Run Summary File must be submitted along with the encounter data submissions. The Check Run Summary File must be submitted in a format and in timeframes specified by the Agency.

For encounter data acceptance purposes, the Health Plan must ensure the provider information it submits to the Agency is sufficient to ensure that providers are recognized in FMMIS as either actively enrolled Medicaid providers or as Health Plan registered providers. The Health Plan must ensure that provider information it sends to the Agency is sufficient to ensure accurate identification of participating network and non-participating providers who render services to Plan enrollees.

The Health Plan shall collect, and submit encounter data to the Agency’s fiscal agent. The Health Plan shall be held responsible for errors or noncompliance resulting from its own actions or the actions of an agent authorized to act on the Health Plan’s behalf.

The Health Plan shall implement and maintain review procedures to validate encounter data submitted by providers.

The Health Plan shall implement and maintain review procedures to validate the successful loading of encounter files by the Agency’s fiscal agent’s electronic data interface (EDI) clearinghouse. The Health Plan shall use the EDI response (acknowledgement) files to determine files were successfully loaded. Within seven (7) calendar days of the original submission attempt, the Health Plan shall correct and resubmit files that fail to load.

The Health Plan shall convert all information that enters its claims system via hard copy paper claims or other proprietary formats to encounter data to be submitted in the appropriate HIPAA-compliant formats.

All Health Plan encounters shall be submitted to the Agency in the standard HIPAA transaction formats, namely the ANSI X12N 837 transaction formats (P - Professional; I - Institutional; D - Dental) and, for pharmacy services, the National Council for Prescription Drug Programs (NCPDP) format. The Health Plan’s encounters shall also follow the standards in the Agency’s 5010 Companion Guides, the Florida D.0 Payer Specification - Encounters and in this section. The Agency will post encounter data reporting requirements on the following website:

The Health Plan shall retain submitted historical encounter data for a period not less than six (6) years as specified in the Standard Contract, Section I., Item D., Retention of Records.

The Health Plan shall submit complete, accurate and timely encounters to the Agency as defined below.

Pharmacy Encounters (NCPDP):

Complete: A Health Plan shall submit encounters for one-hundred percent (100%) of the covered services provided by Health Plan providers and non-participating providers, as defined in D.1. of this subsection.

Accurate: Ninety-five percent (95%) of the Health Plan’s encounter lines submissions shall pass NCPDP edits and the pharmacy benefits system edits as specified by the Agency. The NCPDP edits are described in the National Council for Prescription Drug Programs Telecommunications Standard Guides. Pharmacy benefits system edits are defined on the following website:

Timely: For no less than ninety-five percent (95%) of all pharmacy typical and atypical services with Health Plan paid dates on or after December 1, 2011, the Health Plan shall submit encounters on an ongoing basis by the fifteenth (15^th) day of the month after the date-of-service month.

Non-Pharmacy Encounters (X12):

Complete: A Health Plan shall submit encounters for one-hundred percent (100%) of the covered services provided by Health Plan providers and non-participating providers, as defined in D.1. of this subsection.

Accurate: Ninety-five percent (95%) of a Health Plan's encounter lines submissions shall pass FMMIS system edits as specified by the Agency.

Timely: For no less than ninety-five percent (95%) of all non-pharmacy typical and atypical services, the Health Plan shall submit encounters within sixty (60) calendar days following the end of the month in which the Health Plan paid the claims for services.

Encounter Resubmission - Adjustments, Reversals or Corrections:

Within thirty (30) calendar days after encounters fail NCPDP edits, X12 (EDI) edits or FMMIS system edits, the Health Plan shall correct and resubmit all encounters for which errors can be remedied.

The Health Plan shall correct and resubmit previously submitted X12 and NCPDP encounter data transactions to reflect the most current and accurate payment adjustments or reversals that resulted in a recoupment or additional payment within thirty (30) calendar days of the respective action.

The Health Plan shall have the capacity to identify encounter data anomalies and provide a description of that process to BMHC and MPI for review and approval.

Where the Health Plan has entered into capitation reimbursement arrangements with providers, the Health Plan shall comply with sub-item 4. of this section, above.

The Health Plan shall require timely submissions from its providers as a condition of the capitation payment.

The Health Plan shall participate in Agency-sponsored workgroups directed at continuous improvements in encounter data quality and operations.

If the Agency determines that the Health Plan fails to comply with encounter data reporting requirements of this Contract, the Agency shall require the Health Plan to submit a corrective action plan (CAP). In addition to a CAP, the Agency shall apply sanctions in accordance with Attachment II, Section XIV, Sanctions, of this Contract.

Encounter data submission time frames specified in this section do not affect time frames specified in Attachment II, Section XII, Reporting Requirements, for either pharmacy data encounter reporting, for risk adjustment, or behavioral health encounters (including pharmacy reporting).

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item E., Fraud and Abuse Prevention, sub-item 5., the lead-in paragraph is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item E., Fraud and Abuse Prevention, sub-item 5.b.(6) is hereby amended to now read as follows:

A summary of the results of the investigations of fraud, abuse, or overpayment that were conducted during the previous fiscal year by the Health Plan’s fraud investigative unit.

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item E., Fraud and Abuse Prevention, sub-item 5.c.(13), the first and second sentences, respectively are hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item E., Fraud and Abuse Prevention, sub-item 10, is hereby amended to include sub-items 10.a. through 10.c. as follows:

If the Health Plan fails to timely submit an acceptable anti-fraud plan or fails to timely submit the annual report referenced in Section XII, Reporting Requirements, a sanction of $2,000 per calendar day, from the date the report is due to the Agency, shall be imposed under this Contract until MPI deems the Health Plan to be in compliance.

If the Health Plan fails to implement an anti-fraud plan or investigative unit, a sanction of $10,000 shall be imposed under this Contract.

If the Health Plan fails to timely report, or report all required information for all suspected or confirmed instances of provider or recipient fraud or abuse within fifteen (15) calendar days after detection to MPI, as specified in s. 409.91212, F.S., a sanction of $1,000 per calendar day will be imposed under this Contract, until MPI deems the Health Plan to be in compliance.

Attachment II, Core Contract Provisions, Section X, Administration and Management, Item E., Fraud and Abuse Prevention, sub-item 11.b. is hereby deleted in its entirety and replaced as follows:

In addition to the disclosure required under 42 CFR 455.106, the Health Plan shall also disclose to DHHS OIG with a copy to MPI within ten (10) business days after discovery, the identity of any person described in 42 CFR 1002.3 and 42 CFR 1001.1001(a)(1), and to the extent not already disclosed, to additionally disclose any person who: has ownership or control interest in a Health Plan network provider or subcontractor, or is an agent or managing employee of a Health Plan network provider or subcontractor, and meets at least one of the following requirements:

Has been convicted of a crime as identified in s. 1128 of the Social Security Act and/or conviction of a crime related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs;

Has been denied initial entry into the Health Plan’s network for program integrity-related reasons; or

Is a provider against whom the Health Plan has taken any action to limit the ability of the provider to participate in the Health Plan’s provider network, regardless of what such an action is called. This includes, but is not limited to, suspension actions, settlement agreements and situations where an individual or entity voluntarily withdraws from the program or Health Plan provider network to avoid a formal sanction.

Attachment II, Core Contract Provisions, Section XII, Reporting Requirements, Item B., Report Tables is hereby amended as follows:

The item heading is hereby amended to now read B., Reporting Tables. All references in the Contract to B. Report Tables shall hereinafter refer to B. Reporting Tables, as appropriate.

Sub-item 1., the header for Table 1, Effective September 1, 2012, Summary of Reporting Requirements is hereby amended as follows:

Table 1 Effective September 1, 2013, Summary of Reporting Requirements, Section V, Exhibit 5, Covered Services, Section VIII, Quality Management, and Section XV, Financial Requirements; respectively are hereby amended to now read as follows:

Sub-item 2., Report Tables is hereby amended as follows:

Other Health Plan submissions (not in Table 1) required by the Agency are as follows:

Sub-item 2., the header for Table 2 Effective September 1, 2012, Summary of Submission Requirements is hereby amended as follows:

Table 2 Effective September 1, 2013, Summary of Submission Requirements, Section II, General Overview, Item D., General Responsibilities of the Health Plan; Section IV, Enrollee Services, Community Outreach and Marketing, Item A., Enrollee Services; Section X, Administration and Management, Item D., Encounter Data; Section XV, Financial Requirements, Item I., Fidelity Bonds; Section XVI, Terms and Conditions, Item Y., General Insurance Requirements; and Item Z., Workers’ Compensation Insurance; respectively, are hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section XIV, Sanctions, Item A., General Provisions, sub-item 3. is hereby amended to now read as follows:

If the Agency imposes monetary sanctions, the Health Plan must pay the monetary sanctions to the Agency within thirty (30) calendar days from receipt of the notice of sanction. If the Health Plan fails to pay, the Agency reserves the right to recover the money by any legal means, including but not limited to the withholding of any payments due to the Health Plan. If the Deputy Secretary determines that the Agency should reduce or eliminate the amount imposed, the Agency will return the appropriate amount to the Health Plan within sixty (60) calendar days from the date of a final decision rendered.

Attachment II, Core Contract Provisions, Section XIV, Sanctions, Item E., Performance Measure Sanctions, sub-item 4., the lead-in paragraph, first sentence is hereby amended to now read as follows:

The Health Plan may receive a monetary sanction of up to $10,000.00 for each performance measure group where the group score is lower than three (3).

Attachment II, Core Contract Provisions, Section XV, Financial Requirements, Item I., Fidelity Bonds, the third and fourth sentences are hereby deleted in their entirety and replaced as follows:

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, Item O., Subcontracts, sub-item 2.d.(12)(d) is hereby amended to now read as follows:

The entity’s role in preventing and detecting fraud, waste and abuse, and each person’s responsibility relating to detection and prevention.

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, Item P., Hospital Provider Contracts is hereby deleted in its entirety and replaced as follows:

Hospitals must notify the Health Plan of enrollee pregnancies and births where the mother is a Health Plan enrollee. The hospital provider contract must also specify which entity (Health Plan or hospital) is responsible for completing the DCF Excel spreadsheet and submitting it to the appropriate DCF Customer Call Center. The hospital provider contract must also indicate that the Health Plan’s name shall be indicated as the referring agency when the DCF Excel spreadsheet is completed. (See Attachment II, Section III, Eligibility and Enrollment); and

Effective January 1, 2014, include PPC reporting requirements as specified in Attachment II, Section V, Covered Services, Item H., Coverage Provisions, sub-item 10.a.(12).

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, Item Q., Termination Procedures, sub-item 1. is hereby amended to now read as follows. Sub-items 1.a. and 1.b. are unchanged.

In conjunction with the Standard Contract, Section III., Item A., Termination, all provider contracts and subcontracts shall contain termination procedures. The Health Plan agrees to extend the thirty (30) calendar-day notice found in the Standard Contract, Section III., Item A., Termination, sub-item 1., Termination at Will, to one-hundred twenty (120) calendar days’ notice. Depending on the volume of Health plan enrollees affected, the Agency may require an extension of the termination date. Once the Agency receives the request for termination, the Agency will remove the Health Plan from receipt of new voluntary enrollments, mandatory assignments and reinstatements going forward.

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, Item V., Ownership and Management Disclosure, sub-item 4.a. is hereby deleted in its entirety and replaced as follows:

Upon Agency notice of implementation of a managed care electronic screening verification process, by requesting screening results through the Agency’s background screening system (see the Agency’s background screening website). If the person’s fingerprints are not retained in the Care Provider Background

The Health Plan shall complete and email a Background Screening (BGS) Managed Care User Registration Agreement to HSD at: ***@***;

In accordance with s. 435.12(2)(c), F.S., the Health Plan shall register with the Clearinghouse and maintain the employment status of all employees within the Clearinghouse. The Health Plan shall report initial employment status and changes to the Clearinghouse within ten (10) business days after the initial employment or change.

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, Item Y., General Insurance Requirements, and Item Z., Workers’ Compensation Insurance, respectively are hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section XVI, Terms and Conditions, is hereby amended to include Item GG., Public Records Requests as follows:

The Health Plan shall keep and maintain public records that ordinarily and necessarily would be required in order to perform services under the Contract;

The Health Plan shall provide the public with access to public records on the same terms and conditions that the Agency would provide the records and at a cost that does not exceed the cost provided in s. 119.0701, F.S., or as otherwise provided by law;

The Health Plan shall ensure that public records that are exempt or confidential and exempt from public records disclosure requirements are not disclosed except as authorized by law;

The Health Plan shall meet all requirements for retaining public records and transfer, at no cost, to the Agency all public records in possession of the Health Plan upon termination of the Contract and destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. All records stored electronically must be provided to the Agency in a format that is compatible with the information technology systems of the Agency.

If the Health Plan does not comply with a public records request, the Agency shall enforce the Contract provisions in accordance with the Contract.

Attachment II, Core Contract Provisions, Section XVII, Liquidated Damages, Item B., Performance Measures, sub-item 3., the first sentence is hereby amended to now read as follows:

Attachment II, Core Contract Provisions, Section XVII, Liquidated Damages, Item C., Issues and Amounts, is hereby deleted in its entirety and replaced as follows:

Attachment II, Core Contract Provisions, Exhibit 13, Capitated Non-Reform Health Plans (CAP-Non-REFORM), Method of Payment, is hereby amended to include sub-item I., ACA PCP Payments to Capitated Plans, as follows:

The Agency shall notify the Health Plan of the supplemental payment being made.

Such payment shall be made through the Medicaid fiscal agent. The Health Plan shall address errors found regarding such reports in accordance with Attachment II, Exhibit 13, Method of Payment, Item E., Errors, of this Contract.

Attachment II, Core Contract Provisions, Exhibit 15, Financial Requirements, All Capitated Health Plans, Item A., Insolvency Protection, sub-item 2. is hereby amended to now read as follows:

The restricted Insolvency protection account may be drawn upon with the authorized signatures of two (2) persons designated by the Health Plan and two (2) representatives of the Agency. The Multiple Signature Verification Agreement Form shall be resubmitted to BMHC within thirty (30) calendar days of Contract execution and resubmitted within thirty (30) calendar days after a change in authorized Health Plan personnel occurs. If the authorized persons remain the same, the Health Plan shall submit an attestation to this effect annually by April 1 of each Contract year to BMHC along with a copy of the latest bank statement. The Health Plan may obtain a sample Multiple Signature Verification Agreement form from the Agency or its agent or download from the BMHC website at:

Attachment III, Business Associate Agreement (Rev. Aug 09), is hereby deleted in its entirety and replaced with Attachment III-A, Business Associate Agreement (Rev. Aug 13), attached hereto and made a part o the Contract. All references in this Contract to Attachment III shall hereinafter refer to Attachment III-A.

Definitions. Unless specifically stated in this Attachment, the definition of the terms contained herein shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164.

Protected Health Information. For purposes of this Attachment, protected health information shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164, limited to the information created, received, maintained or transmitted by the Vendor from, or on behalf of, the Agency.

Security Incident. For purposes of this Attachment, security incident shall means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system and includes any event resulting in computer systems, networks, or data being viewed, manipulated, damaged, destroyed or made inaccessible by an unauthorized activity.

Applicability of HITECH and HIPAA Privacy Rule and Security Rule Provisions. As provided by federal law, Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), also known as the Health Information Technology Economic and Clinical Health (HITECH) Act, requires a Business Associate (Vendor) that contracts with the Agency, a HIPAA covered entity, to comply with the provisions of the HIPAA Privacy and Security Rules (45 C.F.R. 160 and 164).

Use and Disclosure of Protected Health Information. The Vendor shall comply with the provisions of 45 CFR 164.504(e)(2)(ii). The Vendor shall not use or disclose protected health information other than as permitted by this Contract or by federal and state law. The sale of protected health information or any components thereof is prohibited except as provided in 45 CFR 164.502(a)(5). The Vendor will use appropriate safeguards to prevent the use or disclosure of protected health information for any purpose not in conformity with this Contract and federal and state law. The Vendor will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic protected health information the Vendor creates, receives, maintains, or transmits on behalf of the Agency.

Use and Disclosure of Information for Management. Administration, and Legal Responsibilities. The Vendor is permitted to use and disclose protected health information received from the Agency for the proper management and administration of the Vendor or to carry out the legal responsibilities of the Vendor, in accordance with 45 C.F.R. 164.504(e)(4). Such disclosure is only permissible where required by law, or where the Vendor obtains reasonable assurances from the person to whom the protected health information is disclosed that: (1) the protected health information will be held confidentially, (2) the protected health information will be used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and (3) the person notifies the Vendor of any instance of which it is aware in which the confidentiality of the protected health information has been breached.

Disclosure to Third Parties. The Vendor will not divulge, disclose, or communicate protected health information to any third party for any purpose not in conformity with this Contract without prior written approval from the Agency. The Vendor shall ensure that any agent, including a subcontractor, to whom it provides protected health information received from, or created or received by the Vendor on behalf of, the Agency agrees to the same terms, conditions, and restrictions that apply to the Vendor with respect to protected health information. The Vendor’s subcontracts shall fully comply with the requirements of 45 CFR 164.314(a)(2)(iii).

Access to Information. The Vendor shall make protected health information available in accordance with federal and state law, including providing a right of access to persons who are the subjects of the protected health information in accordance with 45 C.F.R. 164.524.

Amendment and Incorporation of Amendments. The Vendor shall make protected health information available for amendment and to incorporate any amendments to the protected health information in accordance with 45 C.F.R. 164.526.

Accounting for Disclosures. The Vendor shall make protected health information available as required to provide an accounting of disclosures in accordance with 45 C.F.R. 164.528. The Vendor shall document all disclosures of protected health information as needed for the Agency to respond to a request for an accounting of disclosures in accordance with 45 C.F.R. 164.528.

Access to Books and Records. The Vendor shall make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the Vendor on behalf of the Agency, available to the Secretary of the Department of Health and Human Services (“HHS”) or the Secretary’s designee for purposes of determining compliance with the HHS Privacy Regulations.

Reporting. The Vendor shall make a good faith effort to identify any use or disclosure of protected health information not provided for in this Contract.

To Agency. The Vendor will report to the Agency, within ten (10) business days of discovery, any use or disclosure of protected health information not provided for in this Contract of which the Vendor is aware. The Vendor will report to the Agency, within twenty-four (24) hours of discovery, any security incident of which the Vendor is aware. A violation of this paragraph shall be a material violation of this Contract. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the Vendor to have been, accessed, acquired, or disclosed during such breach.

To Individuals. In the case of a breach of protected health information discovered by the Vendor, the Vendor shall first notify the Agency of the pertinent details of the breach and upon prior approval of the Agency shall notify each individual whose unsecured protected health information has been, or is reasonably believed by the Vendor to have been, accessed, acquired, used or disclosed as a result of such breach. Such notification shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. Where there is insufficient, or out-of-date contract information (including a phone number, email address, or any other form of appropriate communication) that precludes written (or, if specifically requested, electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are 10 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting on the Web site of the covered entity involved or notice in major print of broadcast media, including major media in the geographic areas where the individuals affected by the breach likely reside. In any case deemed by the Vendor to require urgency because of possible imminent misuse of unsecured protected health information, the Vendor may also provide information to individuals by telephone or other means, as appropriate.

To Media. In the case of a breach of protected health information discovered by the Vendor where the unsecured protected health information of more than 500 persons is reasonably believed to have been, accessed, acquired, used, or disclosed, after prior approval by the Agency, the Vendor shall provide notice to prominent media outlets serving the State or relevant portion of the State involved.

To Secretary of Health and Human Services (HHS). The Vendor shall cooperate with the Agency to provide notice to the Secretary of HHS of unsecured protected health information that has been acquired or disclosed in a breach.

Vendors Who Are Covered Entities. In the event of a breach by a contractor or subcontractor of the Vendor, and the Vendor is a HIPAA covered entity, the Vendor shall be considered the covered entity for purposes of notification to the Secretary of HHS pursuant to 45 CFR 164.408. The Vendor shall be responsible for filing the notification to the Secretary of HHS and will identify itself as the covered entity in the notice. If the breach was with respect to 500 or more individuals, the Vendor shall provide a copy of the notice to the Agency, along with the Vendor’s breach risk assessment for review at least 15 business days prior to the date required by 45 C.F.R. 164.408 (b) for the Vendor to file the notice with the Secretary of HHS. If the breach was with respect to less than 500 individuals, the Vendor shall notify the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(c) and shall contemporaneously submit copies of said notifications to the Agency..

Content of Notices. All notices required under this Attachment shall include the content set forth Section 13402(f), Title XIII of the American Recovery and Reinvestment Act of 2009 and 45 C.F.R. 164.404(c), except that references therein to a “covered entity” shall be read as references to the Vendor.

Financial Responsibility. The Vendor shall be responsible for all costs related to the notices required under this Attachment.

Mitigation. Vendor shall mitigate, to the extent practicable, any harmful effect that is known to the Vendor of a use or disclosure of protected health information in violation of this Attachment.

Termination. Upon the Agency's discovery of a material breach of this Attachment, the Agency shall have the right to assess liquidated damages as specified elsewhere in the contact to which this Contract is an attachment, and/or to terminate this Contract.

Effect of Termination. At the termination of this Contract, the Vendor shall return all protected health information that the Vendor still maintains in any form, including any copies or hybrid or merged databases made by the Vendor; or with prior written approval of the Agency, the protected health information may be destroyed by the Vendor after its use. If the protected health information is destroyed pursuant to the Agency's prior written approval, the Vendor must provide a written confirmation of such destruction to the Agency. If return or destruction of the protected health information is determined not feasible by the Agency, the Vendor agrees to protect the protected health information and treat it as strictly confidential.