STATE OF VERMONT CONTRACT SUMMARY AND CERTIFICATION - Fonn AA-14 (4/1/2009)
CONTRACT1Nl'ORMAl'ION:'
,
CRl1:Cg. IF:')'(c~:QON~l~,C1';';'tr:1y';;
.__....__ ._____.. _ __
Contract #: 11660
Amendment II: 2
Agency/Department:
I-Iuman Services/ Department of Corrections
Contractor Vendor No: 144300
Contractor:
Corrections Corporation of America
Contractor Address:
10 Burton Hills Blvd, Nashville, TN
Stm1ing Date:
07/01/20CW1@
Ending Date:
06/30/2011
Summary of contract or amendment: Supplemental Housing for Vennont inmates to include Florence, AZ.

I

1.

ILFINANCIAbJNl'bR!0Ai,.i~·-Maximum Payable:
$17.,])24,5_87,93
Prior Maximum:
$
Prior Contract # (If Renewal):
$
% Cumulative Change:
Current Amendment:
$
Cumulative amendments:
Maximum # Units:
# Unit Change:
Prior II Units: II
Rate:
$ 2,8Jl.Q
Prior Rate:
$ 61,53
Source of Funds - Business Unit(s): 03590
VISION 507XXX Series Account: 507600
General Fund: 100 %
Federal Fund:
%
Other Fund:
Fund eode:
%
Dept. lD: 3480006000
Dept. lD:
Dept. lD:
ilC·sUITABruTY Of
PERSONAL SERVICES eA, O"N""';';;;l'RA""j';' 'C"';T"',:''
_
_ _ _ _ _ _ _ _ _ __ _

%

_~~~~~l-

[2;J

Yes

DYes
DYes

0

No

[2;J
[2;J

No
No

Does this contractor meet all 3 parts of the "ABC' definition of independent contractor?
(See Bulletin 3,5) Ifnot, please indicate why this work is being ananged through a contract.
Is agency liable for income tax withholding or FICA?
Should contractor be paid on the state payroll?

rhe agency has taken reasonable steps to control the price of the contract and to allow qualified businesses to compete for the work
authorized by this contract. The agency has done this through:
Standard bid or RFP
[2;J Simplified Bid
0 Sole Sourced
0 Qualification Based Selection

o

V~-TYPf:(5FC()NTRACT:-·--

,

- - . - - - - -. .

..

-~---~---~--------

0

18U)ers(lnaI5ervice

Construction

---,~

0

•.

-~-,..--,---------------------------------

ArchitectJEngineer

0

Commodity

o Privatization

0

Other

\1L_<':2!'!r:!:~!;"O~F~~lN",1~'E",-R£",:"o.=S",>!:,-,-----;-;--:---,--;--~-------;--;;-c--c-----;-_;_--__:---c----;--;----;---­

By signing below, ! certify that no person able to control or influence award of this contract had a pecuniary interest in its award or
performance, either personally or through a member of his or her household, family, or business.
DYes

[gJ No

Is there an "appearance" of a conflict of interest so that a reasonable person may conclude that this contractor was
selected for improper reasons: (lfyes, explain)

[2;J Yes
[2;J Yes

0
0

No
No

0

I2J

No

Contract must be approved by the Attorney General under 3 VSA §311 (a)(l 0)
1 request the Attorney General review this contract as to form
No, Already per fanned by in-house AAG or counsel: ___
(initial)
Contract must be approved by the CIO/Commissioner of OIl; for IT hardware, software or services and
Telecommunications over $150,000
eon tract must be approved by the eMO; for Marketing services over $15,000
Contract must be approved by Commissioner of Human Resources (privatization and retiree contracts)
Contract must be approved by the Secretary of Administration

Yes

0
0

Yes
Yes
[2;J Yes

[2;J No
[2;J No

0

No

SIlL AGENeY/DEPARTMENT HEAD CERTIFICATION; AlrRROvAl,i
I hU", :~de reasona Ie·

~ ~s...!£?Jhe

accuracy of the above infomlation:

~~r~ -.~~~~~~~~~-------ate

gen

/ Department Head

Date

Approval by Agency Secretary or Other Department Head (if
required)

Date

Approved ~c:~er: Human Resources

5:/

Dtte

~

Date
elo
Date
CMO
Secretary JkcinJnistrati<)1"J i L
________~(i~n~it~ia~I)~-c~~__________ (~in~i~ti~a~I)__________________________ ~______~,~~~~tL~_______________

REC'O MAY 1 IJ 2ata

CHANGE # 2

AMENDMENT
It is agreed by and between the State of Vennont, Department of Corrections (hereafter called "State") and Corrections Corporation of
America of Tennessee, (hereafter called "Contractor") that contract #11660 dated 07/0112007 between said State and Contractor is
hereby amended as follows:
SECOND AMENDMENT TO CONTRACT BETWEEN THE STATE OF VERMONT, DEPARTMENT OF
CORRECTIONS AND
CORRECTIONS CORPORATION OF AMERICA

This Second Amendment is entered into this 15'" day of May, 2010, by and between the State of Vermont Dep311ment of Corrections
(hereinafter "VTDOC") and COlTections Corporation of America, 10 Burton Hills Boulevard, Nashville, Tennessee, 37215
(hereinafter "Contractor') or "CCA") and in recognition of the following:
WHEREAS, the parties hereto have previously entered into a contract, effective July 1,2007, wherein CCA has agreed to house,
guard and provide all necessary care for certain inmates currently under the care and custody of VTDOC at CCA's Lee Adjustment
Center, North Fork Correctional Facility, Tallahatchie County COlTectional Facility and West Tennessee Detention Facility; and
WHEREAS, the parties desire to provide for the housing of designated VTDOC inmates at CCA's Florence Correctional Center
("Florence") and to define new terms that are applicable to the relationship with respect to VTDOC inmates assigned to Florence;
NOW THEREFORE, the parties do enter into and make this Second Amendment to the Agreement and agree as follows:

1.

To Attachment G, Section 1, Description of Services, (a) Facilities add the following at the beginning of the fourth
paragraph:
"The parties may mutually agree to house VTDOC imnates at Florence."

2.

In Attachment G, Section 6, Transportation oflnmates, is revised to read as follows:
"VTDOC shall send with each inmate, the original or duly authenticated copies of commitments and any other official papers or
documents authorizing detention and all inmate information specified in Section 5 above. Except as otherwise indicated,
transportation of an offender for purposes of litigation arising as a result of the Contractor's acts and/or omissions in the
performance of this contract shall be at Contractor's expense.
At no expense to VTDOC, Contractor shall provide two (2) thirty-man transports each month for round trips between Vermont
and the Facilities for the purpose of transporting inmates. A round trip is travel between Vermont and one facility. The transports
are intended to be two round trips total per month, not from each facility where VTDOC inmates are housed. For purposes of this
paragraph 6, West Tennessee Detention Facility may be combined with a transport to and from Lee Adjustment Center, such that
it counts as one round trip, provided such may be accomplished with the personnel and equipment allocated for one thirty-man
round trip transport and provided that Contractor shall decide in which order and manner this combined trip occurs. In the event
that VTDOC and Contractor desire to utilize simultaneous housing in Lee Adjustment Center, North Fork COlTectional Facility,
Tallahatchie County Correctional Facility, and the West Tennessee Detention Center, VTDOC and CCA shall mutually agree to
associated revisions to the transportation requirements prior to VTDOC inmates being transferred to the fourth facility. Each
month, the Contractor and VTDOC will mutually decide how the following month's transports will be used. The Contractor and
VTDOC shall cooperate to include inmates being returned to and from Vermont for court appearances or family visits during the
regularly scheduled transports whenever possible. Additional transportation needed for the return of the offender to the physical
custody of VTDOC or the subsequent return of the offender by VTDOC to the Facility shall be at VTDOC's expense and at the
responsibility VTDOC.
Notwithstanding any provision of this Agreement to the contrary, VTDOC shall be responsible for the cost to transport the first 80
Vermont offenders that are transferred to West Tennessee per the First Amendment to this Contract and for the cost to transport
VTDOC offenders to and from Florence, except that the Contractor shall be responsible for the cost of transporting offenders
transferring to Florence at Contractorls request from another Contractor Facility."

3.

To Attachment G, Section 21, Cost and Reimburseml'.nt, add the following paragraph:

- 1-

The per diem for VTDOC inmates assigned to Florence shall be $68.00 per inmate per day.
4.

To Attachment G, Section 29, Vermont Legal Materials and Law Library Access, add the following:
"Notwithstanding any provision herein to the contrary, VTDOC inmates housed at Florence shall be provided access to Vermontspecific legal materials by requesting such materials from the VTDOC Legal Education Director."

5.

All other terms of the Agreement not amended herein shall remain unchanged.

Additionally, it is hereby agreed and understood that this contract has no minimum amount. The Contractors' services will be
required on an "as needed" basis.
To replace existing Attachment C with new Attachment C, revised April 6, 2009.
To replace existing Attachment E with new Attachment E, revised January 25, 2010.
To replace existing Attachment F with new Attachment F, revised December 8, 2009.

Except as modified by this above amendment, and any and all previous amendments to this contract, all provisions of this contract
#11660 dated 07/01/2007 shall remain unchanged and in full force and effect.
The effective date of this amendment is May 15,2010.

IN WITNESS WHEREOF, intending to be legally bound, the panies have caused their authorized representatives to execute this
Second Amendment to be effective on the date first written above.

VERMONT DEPARTMENT OF CORRECTIONS
Andrew Pall ito
Commissioner of Corrections

~~.~'~/'

Andrew Paliito

CORRECTIONS CORPORATION OF AMERICA
Natasha K. Metcalf
Vice President, Partnership Development
10 Burton Hills Boulevard

..~
--J,

'LN. aSh. ville, TN.. 37.215

!J

h:,;,cL-,tl ,\;1h
/. . l\t
I /, /,
X~')l'<SlI'L4-:
- '--'-'17'
' I~/__
+--~_t.:~_,
Natasha K. Metcalf
. Date

-2 -

ATTACHMENT C
CUSTOMARY PROVISIONS FOR CONTRACTS AND GRANTS

1.

Entire Agreement. This Agreement, whether in the fonn of a Contract, State Funded Grant, or Federally Funded Grant,
represents the entire agreement between the parties on the subject matter. All prior agreements, representations, statements,
negotiations, and understandings shall have no effect.

2,

Applicable Law. This Agreement will be governed by the laws of the State ofVennont.

3.

Definitions: For purposes of this Attachment, "Party" shall mean the Contractor, Grantee or Subrecipient, with whom the State of
Vermont is executing this Agreement and consistent with the form of the Agreement.

4.

Appropriations: If appropriations are insufficient to support this Agreement, the State may cancel on a date agreed to by the
parties or upon the expiration or reduction of existing appropriation authority. In the case that this Agreement is funded in whole
or in part by federal or other non-State funds, and in the event those funds become unavailable or reduced, the State may suspend
or cancel this Agreement immediately, and the State shall have no obligation to fund this Agreement from State revenues.

5.

No Employee Benefits For Party: The PaIty understands that the State will not provide any individual retirement benefits, group
life insurance, group health and dental insurance, vacation or sick leave, workers compensation or other benefits or services
available to State employees, nor will the state withhold any state or federal taxes except as required under applicable tax laws,
which shall be detel1nined in advance of execution of the Agreement. The Party understands that all tax returns required by the
Internal Revenue Code and the State of Vermont, including but not limited to income, withholding, sales and use, and rooms and
meals, must be filed by the Party, and information as to Agreement income will be provided by the State of Vermont to the
Internal Revenue Service and the Vermont Department of Taxes.

6.

Independence, Liability: The Party will act in an independent capacity and not as officers or employees of the State.
The Party shall defend the State and its officers and employees against all claims or suits arising in whole or in part from any act
or omission of the Palty or of any agent of the Party. The State shall notifY the Party in the event of any such claim or suit, and
the Party shall immediately retain counsel and otherwise provide a complete defense against the entire claim or suit. The Party
shall notify its insurance company and the State within 10 days of receiving any claim for damages, notice of claims, pre-claims,
or service of judgments or claims, for any act or omissions in the performance o1'thi5 Agreement,
After a final judgment or settlement the Party may request recoupment of specific defense costs and may file suit in Washington
Superior Court requesting recoupment. Toe Party shall be entitled to recoup costs only upon a showing that such costs were
entirely unrelated to the defense of any claim arising from an act or omission of the Party.
The PaI1y shall indemnifY the State and its officers and employees in the event that the State, its officers or employees become
legally obligated to pay any damages or losses arising from any act or omission of the Party.

7. Insurance: Before commencing work on this Agreement the Party must provide certificates of insurance to show that the
following minimum coverage is in effect. It is the responsibility of the Party to maintain current certificates of insurance on file
with the state through the tenn of the Agreement. No warranty is made that the coverage and limits listed herein are adequate to
cover and protect the interests ofthe Party for the Party's operations. These are solely minimums that have been established to
protect the interests of the State.

Workers Compensation: With respect to all operations performed, the Party shall carry workers' compensation insurance in
accordance with the laws of the State where services are provided,

General Liability and Property Damage: With respect to all operations perfol1ned under the Agreement, the Party shall
carry general liability insurance having all major divisions of coverage including, but not limited to:
Premises - Operations
Products and Completed Operations
Personal Injury Liability
Contractual Liability
The policy shall be on an occurrence form and limits shall not be less than:
$1,000,000 Per Occurrence
$1,000,000 General Aggregate
$ 1,000,000 Products/Completed Operations Aggregate
-3-

$ 50,000 Fire/ Legal/Liability

Party shall name the State of Vermont and its officers and employees as additional insureds for liability arising out of this
Agreement.

Automotive Liabilitv: The Party shall carry automotive liability insurance covering all motor vehicles, including hired and
non-owned coverage, used in connection with the Agreement Limits of coverage shall not be less than: $1,000,000
combined single limit
Party shall name the State of Vermont and its officers and employees as additional insureds for liability arising out of this
Agreement,

Professional Liability: Before commencing work on this Agreement and throughout the term of this Agreement, the Party
shall procure and maintain professional liability insurance for any and all services performed under this Agreement, with
minimum coverage 0£$1,000,000 per occurrence, and $~gregate,

8.

Reliance by the State on Representations: All payments by the State under this Agreement will be made in reliance upon the
accuracy of all prior representations by the Party, including but not limited to bills, invoices, progress reports and other proofs of
work,

9.

Requirement to Have a Single Audit: In the case that this Agreement is a Grant that is funded in whole or in pmt by federal
funds, and if this Subrecipient expends $500,000 or more in federal assistance during its fiscal year, the Subrecipient is required to
have a single audit conducted in accordance with the Single Audit Act, except when it elects to have a program specific audit.
The Subrecipient may elect to have a program specific audit if it expends funds under only one federal program and the federal
program's laws, regulating or grant agreements do not require a financial statement audit of the Party.
A Subrecipient is exempt if the Party expends less than $500,000 in total federal assistance in one year.
The Subrecipient will complete the Certification of Audit Requirement annually within 45 days after its fiscal year end, If a
single audit is required, the sub-recipient will submit a copy of the audit report to the primary pass-through Party and any other
pass-through Party that requests it within 9 months, If a single audit is not required, the Subrecipient will submit the Schedule of
Federal Expenditures within 45 days, These forms will be mailed to the Subreeipient by the Department of Finance and
Management near the end of its fiscal year, These fonms are also available on the Finance & Management Web page at:
http://finance.vermont.gov/forms

10. Records Available for Audit: The Party will maintain all books, documents, payroll papers, accounting records and other
evidence pertaining to costs incurred under this agreement and make them available at reasonable times during the period of the
Agreement and for three years thereafter for inspection by any authorized representatives of the State or Federal Government. If
any litigation, claim, or audit is sta,ted before the expiration of the three year period, the records shall be retained until all
litigation, claims or audit findings involving the records have been resolved. The State, by any authorized representative, shall
have the right at all reasonable times to inspect or otherwise evaluate the work perfonmed or being perfonmed under this
Agreement.
11. Fair Employment Practices and Americans with Disabilities Act: Party agrees to comply with the requirement of Title
21 V,S,A, Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent applicable, Party shall also ensure, to
the lull extent required by the Americans with Disabilities Act of 1990 that qualified individuals with disabilities receive
equitable access to the services, programs, and activities provided by the Party under this Agreement. Party further agrees to
include this provision in all subcontracts,
12. Set Off: The State may set off any sums which the Party owes the State against any sums due the Party under this Agreement;
provided, however, that any set off of amounts due the State of Vermont as taxes shall be in accordance with the procedures more
specifically provided hereinafter.
13. Taxes Due to the State:
a,

Party understands and acknowledges responsibility, if applicable, for compliance with State tax laws, including income
tax withholding for employees performing services within the State, payment of use tax on property used within the
State, corporate and/or personal income tax on income earned within the State.

b,

Pmty certifies under the pains and penalties of perjury that, as of the date the Agreement is signed, the Party is in good
standing with respect to, or in full compliance with, a plan to pay any and all taxes due the State of Venn on!.

c.

Party understands that final payment under this Agreement may be withheld if the Commissioner of Taxes determines
that the Party is not in good standing with respect to or in full compliance with a plan to pay any and all taxes due to the
State of Vermont.
-4-

Party also understands the State may set off taxes (and related penalties, interest and fees) due to the State of Vennont, but only
if the Party has failed to make an appeal within the time allowed by law, or an appeal has been taken and finally detennined and
the Party has no further legal recourse to contest the amounts due.

14. Child Support: (Applicable ifthe Party is a natural person, not a corporation or partnership.) Party states that, as of the date the
Agreement is signed, he/she:
a.

is not under any obligation to pay child support; or

b.

is under such an obligation and is in good standing with respect to that obligation; or

c.

has agreed to a payment plan with the Vermont Office of Child Support Services and is in full compliance with that plan.

Party makes this statement with regard to support owed to any and all children residing in Vermont. In addition, if the Party is a
resident of Venn ant, Party makes this statement with regard to support owed to any and all children residing in any other state
or territory of the United States.

15. Sub-Agreements: Party shall not assign, subcontract or subgrant the perfonnance of his Agreement or any portion thereof to any
other Party without the prior written approval of the State. Party also agrees to include in subcontract or subgrant agreements a tax
certification in accordance with paragraph 13 above.
Notwithstanding the foregoing, the State agrees that the Party may assign this agreement, including all of the Party's rights and
obligations hereunder, to any successor in interest to the Party arising out of the sale of or reorganization of the Party.

16. No Gifts or Gratuities: Party shall not give title or possession of any thing of substantial value (including property, currency,
travel andlor education programs) to any officer or employee of the State during the tenn of this Agreement.
17. Copies: All written reports prepared under this Agreement will be printed using both sides of the paper.
18. Certification Regarding Debarment: Party certifies under pains and penalties of peljury that, as of the date that this Agreement
is signed, neither Party nor Party's principals (officers, directors, owners, or partners) are presently debarred, suspended, proposed
for debarment, declared ineligible or excluded from participation in federal programs or programs supported in whole or in part
by federal funds.
State of Vermont ..~ Attachment C
Revised AHS - 4-06-09

-5-

Attachment E

BUSINESS ASSOCIATE agreement
THIS BUSINESS ASSOCIATE AGREEMENT ("AGREEMENT") IS ENTERED INTO BY AND BETWEEN THE STATE

OF VERMONT AGENCY OF HUMAN SERVICES OPERATING BY AND THROUGH ITS DEPARTMENT, OFFICE, OR
DIVISION OF THE DEPARTMENT OF CORRECTIONS ("COVERED ENTITY") AND CORRECTIONS CORPORATION
OF AMERICA ("BUSINESS ASSOCIATE") AS OF MAY 15, 2010 ("EFFECTIVE DATE"). THIS AGREEMENT
SUPPLEMENTS AND IS MADE A PART OF THE CONTRACT TO WHICH IT IS AN ATTACHMENT.

Covered Entity and Business Associate enter into this Agreement to comply with standards promUlgated under the Health Insurance
Portability and Accountability Act of 1996 ("HIPAA") including the Standards for the Privacy of Individually Identifiable Health
Information at 45 CFR Parts 160 and 164 ("Privacy Rule") and the Security Standards at 45 CFR Parts 160 and 164 ("Security Rule"),
as amended by subtitle D of the Health Infonnation Technology for Economic and Clinical Health Act.
The parties agree as follows:
1.

Dcfinitions. All capitalized terms in this Agreement have the meanings identified in this Agreement, 45 CFR Part 160, or 45
CFRPart 164.

The term "Services" includes all work performed by the Business Associate for or on behalf of Covered Entity that requires the
use and/or disclosure of protected health information to perform a business associate function described in 45 CFR 160.103
under the definition of Business Associate.

The term "Individual" includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).
The tenn "Breach" means the acquisition, access, use or disclosure of protected health information (PHI) in a manner not

permitted under the HIPAA Privacy Rule, 45 CFR part 164, subpart E, which compromises the security or privacy of the PHI.
"Compromises the security or privacy of the PHI" means poses a significant risk of financial, reputational or other harm to the

individual.
2.

Permitted and Required Uses/Disclosures of PHI.
2.1 Except as limited in this Agreement, Business Associate may use or disclose PHI to perform Services, as specified in the

underlying contract with Covered Entity. Business Associate shall not use or disclose PHI in any manner that would
constitute a violation of the Privacy Rule if used or disclosed by Covered Entity in that manner. Business Associate may
not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
2.2

Business Associate may make PHI available to its employees who need access to perfonn Services provided that Business
Associate makes such employees aware of the use and disclosure restrictions in this Agreement and binds them to comply

with such restrictions. Business Associate may only disclose PHI for the purposes authorized by this Agreement: (a) to its
agents (including subcontractors) in accordance with Sections 8 and 16 or (b) as otherwise permitted by Section 3.
3.

Business Activities. Business Associate may use PHI received in its capacity as a "Business Associate" to Covered Entity if
necessary for Business Associate's proper management and administration or to carry out its legal responsibilities. Business
Associate may disclose PHI received in its capacity as "Business Associate" to Covered Entity for Business Associate's proper

management and administration or to carry out its legal responsibilities if a disclosure is Required by Law or if (a) Business
Associate obtains reasonable written assurances via a written agreement from the person to whom the information is to be

disclosed that the PHI shall remain confidential and be used or further disclosed only as Required by Law or for the purpose for
which it was disclosed to the person and (b)
the person notifies Business Associate, within three business days (who in turn will notifY Covered Entity within three business
days after receiving notice of a Breach as specified in Section 5.1), in writing of any Breach of Unsecured PHI of which it is
aware. Uses and disclosures of PHI for the purposes identified in this Section must be of the minimum amount of PHI necessmy
to accomplish such purposes.

4.

Safeguards. Business Associate shall implement and use appropriate safeguards to prevent the use or disclosure of PHI other
than as provided for by this Agreement. With respect to any PHI that is maintained in or transmitted by electronic media,
Business Associate shall comply with 45 CFR sections 164.308 (administrative safeguards), 164.310 (physical safeguards),
164.312 (technical safeguards) and 164.316 (policies and procedures and documentation requirements). Business Associate
shall identify in writing upon request from Covered Entity all of the safeguards that it uses to prevent impennissible uses or
disclosures of PHI.

5.

Documenting and Reporting Breaches.

5.1 Business Associate shall report to Covered Entity any Breach of Unsecured PHI as soon as it (or any of its employees or
agents) become aware of any such Breach, and in no case later than three (3) business days after it (or any of its employees
-6-

or agents) becomes aware of the Breach, except when a law enforcement official determines that a notification would
impede a criminal investigation or cause damage to national security.

5.2 Business Associate shall provide Covered Entity with the names of the individuals whose Unsecured PHI has been, or is
reasonably believed to have been, the subject of the Breach and any other available information that is required to be given
to the affected individuals, as set forth in 45 CFR §164.404(c), and, if requested by Covered Entity, information necessary
for Covered Entity to investigate the impennissible use or disclosure. Business Associate shall continue to provide to
Covered Entity infonnation concerning the Breach as it becomes available to it.
5.3

\\!hen Business Associate detennines that an impermissible acquisition, use or disclosure of PHI by a member of its

workforce does not pose a significant risk of harm to the affected individuals, it shall document its assessment of risk.
Such assessment shall include: 1) the name of the person(s) making the assessment, 2) a brief summary of the facts, and 3)
a brief statement of the reasons supporting the determination of low risk of harm. When requested by Covered Entity,
Business Associate shall make its risk assessments available to Covered Entity.

6.

Mitigation and Corrective Action. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known
to it of an impermissible use or disclosure of PHI, even if the impermissible use or disclosure does not constitute a Breach.
Business Associate shall draft and carry out a plan of corrective action to address any incident of impermissible use or disclosure

of PH!. If requested by Covered Entity, Business Associate shall make its mitigation and corrective action plans available to
Covered Entity.
7.

Providing Notice of Breaches.
7.1

If Covered Entity determines that an impermissible acquisition, access, use or disclosure of PHI for which one of Business
Associate's employees or agents was responsible constitutes a Breach as defined in 45 CFR § 164.402, and if requested by
Covered Entity, Business Associate shall provide notice to the individuals whose PHI was the subject of the Breach. When
requested to provide notice, Business Associate shall consult with Covered Entity about the timeliness, content and method
of notice, and shall receive Covered Entity's approval concerning these elements. The cost of notice and related remedies
shall be borne by Business Associate.

7.2 The notice to affected individuals shall be provided as soon as reasonably possible and in no case later than 60 calendar days
after Business Associate rep0l1ed the Breach to Covered Entity.
7.3

The notice to affected individuals shall be written in plain language and shall include, to the extent possible, I) a brief
description of what happened, 2) a description oftbe types of Unsecured PHI that were involved in the Breach, 3) any steps
individuals can take to protect themselves from potential harm resulting hom the Breach, 4) a brief description of what the
Business associate is doing to investigate the Breach, to mitigate halm to individuals and to protect against further
Breaches, and 5) contact procedures for individuals to ask questions or

obtain additional information, as set forth in 45 CFR § 164.404(c).
7.4

8.

Business Associate shall notify individuals of Breaches as specified in 45 CFR § 164.404(d) (methods of individual notice).
In addition, when a Breach involves more than 500 residents of Vermont, Business associate shall, if requested by Covered
Entity, notity prominent media outlets serving Vermont, following the requirements set forth in 45 CFR § 164.406.

Agreements bv Third Parties. Business Associate shall ensure that any agent (including a subcontractor) to whom it provides
PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity agrees in a written
agreement to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such
PHI. For example, the written contract must include those restrictions and conditions set forth in Section 14. Business Associate
must enter into the written agreement before any use or disclosure of PHI by such agent. The written agreement must identify

Covered Entity as a direct and intended third party beneficiary with the right to enforce any breach orthe agreement concerning
the use or disclosure of PHI. Business Associate shall provide a copy of the written agreement to Covered Entity upon request.
Business Associate may not make any disclosure of PHI to any agent without the prior written consent of Covered Entity.
9.

Access to PHI. Business Associate shall provide access to PHI in a Designated Record Set to Covered Entity or as directed by
Covered Entity to an Individual to meet the requirements under 45 CFR 164.524. Business Associate shall provide such access
in the time and manner reasonably designated by Covered Entity. Within three (3) business days, Business Associate shall
forward to Covered Entity for handling any request for access to PHI that Business Associate directly receives from an
Individual.

10.

Amendment of PHI. Business Associate shall make any amendments to PHI in a Designated Record Set that Covered Entity
directs or agrees to pursuant to 45 CFR 164.526, whether at the request of Covered Entity or an Individual. Business Associate
shan make such amendments in the time and manner reasonably designated by Covered Entity. Within three (3) business days,
-7-

Business Associate shall forward to Covered Entity for handling any request for amendment to PHI that Business Associate
directly receives from an Individual.

11. Accounting of Disclosure s. Business Associate shall document disclosures of PHI and all infonnation related to such disclosures
as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in
accordance with 45 CFR 164.528. Business Associate shall provide such infonnation to Covered Entity or as directed by
Covered Entity to an Individual, to penn it Covered Entity to respond to an accounting request. Business Associate shall provide
such infonnation in the time and manner reasonably designated by Covered Entity. Within three (3) business days, Business
Associate shall forward to Covered Entity for handling any accounting request that Business Associate directly receives from an
Individual.
12.

Books and Records. Subject to the attorney-client and other applicable legal privileges, Business Associate shall make its
internal practices, books, and records (including policies and procedures and PHI) relating to the use and disclosure of PHI
received from Covered Entity or created or received by Business Associate on behalf of Covered Entity available to the
Secretary in the time and manner designated by the Secretary. Business Associate shall make the same information available to
Covered Entity (without regard to the attorney-client or other applicable legal privileges) upon Covered Entity's request in the
time and manner reasonably designated by Covered Entity so that Covered Entity may determine whether Business Associate is
in compliance with this Agreement.

13.

Termination.

14.

13.1

This Agreement commences on the Effective Date and shall remain in effect until terminated by Covered Entity or until
all of the PHI provided by Covered Entity to Business Associate or created or received by Business Associate on behalf
of Covered Entity is destroyed or returned to Covered Entity subject to Section 17.7.

13.2

If Business Associate breaches any material term of this Agreement, Covered Entity may either: (a) provide
an opportunity for Business Associate to cure the breach and Covered Entity may terminate this Contract without
liability or penalty if Business Associate does not cure the breach within the time specified by Covered Entity; or (b)
immediately tenninate this Contract without liability or penalty if Covered Entity believes that cure is not reasonably
possible; or (c) if neither termination nor cure are feasible, Covered Entity shall report the breach to the Secretary.
Covered Entity has the right to seek to cure any breach by Business Associate and this right, regardless of whether
Covered Entity cures such breach, does not lessen any right or remedy available to Covered Entity at law, in equity, or
under this Contract, nor does it lessen Business Associate's responsibility for such breach or its duty to cure such breach.

ReturnlDestruction of PHI.

14.1

Business Associate in connection with the expiration or termination of this Contract shall return or destroy all PHI
received from Covered Entity or created or received by Business Associate on behalf of Covered Entity pursuant to this
Contract that Business Associate still maintains in any fonn or medium (including electronic) within thirty (30) days
after such expiration or termination. Business Associate shall not retain any copies of the PHI. Business Associate shall
certify in writing for Covered Entity (l) when all PHI has been returned or destroyed and (2) that Business Associate
does not continue to maintain any PHI. Business Associate is to provide this certification during this thirty (30) day
period.

14.2

Business Associate shall provide to Covered Entity notification of any conditions that Business Associate believes make
the return or destruction of PHI infeasible. If Covered Entity agrees that return or destruction is infeasible, Business
Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI
to those purposes that make the return or destruction infeasible for so long as Business Associate maintains such PHI.

15.

Penalties and Training. Business Associate understands that: (a) there may be civil or criminal penalties for misuse or
misappropriation of PHI and (b) violations of this Agreement may result in notilication by Covered Entity to law enforcement
officials and regulatory, accreditation, and licensure organizations. If requested by Covered Entity, Business Associate shall
participate in training regarding the use, conlidentiality, and security of PHI.

16.

Security Rule Obligations. The following provisions of this Section apply to the extent that Business Associate creates,
receives, maintains or transmits ElectroniC PHI on behalf of Covered Entity.
16.1

Business Associate shall implement and use administrative, physical, and technical safeguards in compliance with 45
CFR sections 164.308, 164.3 I 0, and 164.3 12 with respect to the Electronic PHI that it creates, receives, maintains or
transmits on behalf of Covered Entity. Business Associate shall identify in writing upon request lrom Covered Entity all
of the safeguards that it uses to protect such Electronic PHI.

-8-

16.2

Business Associate shaH ensure that any agent (including a subcontractor) to whom it provides Electronic PHI agrees in
a written agreement to implement and use administrative, physical, and technical safeguards that reasonably and

appropriately protect the Confidentiality, Integrity and Availability of the Electronic PHI. Business Associate must enter
into this written agreement before any use or disclosure of Electronic PHI by such agent. The written agreement must

identify Covered Entity as a direct and intended third pmty beneficiary with the right to enforce any breach of the
agreement concerning the use or disclosure of Electronic PHI. Business Associate shall provide a copy of the written
agreement to Covered Entity upon request. Business Associate may not make any disclosure of Electronic PHI to any
agent without the prior written consent of Covered Entity.

16.3

Business Associate shall report in writing to Covered Entity any Security Incident pertaining to such Electronic PHI
(whether involving Business Associate or an agent, including a subcontractor). Business Associate shall provide this
written report as soon as it becomes aware of any such Security Incident and in no case later than three (3) business days
after it becomes aware of the incident Business Associate shall provide Covered Entity with the infonnation necessary

for Covered Entity to investigate any such Security Incident.
16.4

17.

Business Associate shall comply with any reasonable policies and procedures Covered Entity implements to obtain
compliance under the Security Rule.

Miscellaneous.

17. I

In the event of any conflict or inconsistency between the tenns of this Agreement and the tenns of the Contract,
the terms of this Agreement shall govern with respect to its subject matter. Otherwise the terms of the Contract
continue in effect.

17.2

Business Associate shall cooperate with Covered Entity to amend this Agreement from time to time as is necessary for
Covered Entity to comply with the Privacy Rule, the Security Rule, or any other standards promulgated under HIPAA.

17.3

Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy Rule, Security
Rule, or any other standards promulgated under HIPAA.

17.4

In addition to applicable Vermont law, the parties shall rely on applicable federal law (e.g., HIPAA, the Privacy Rule and
Security Rule) in construing the meaning and effect of this Agreement.

17.5

As between Business Associate and Covered Entity, Covered Entity owns all PHI provided by Covered Entity to
Business Associate or created or received by Business Associate on behalf of Covered Entity.

17.6

Business Associate shall abide by the terms and conditions of this Agreement with respect to all PHI it receives from
Covered Entity or creates or receives on behalf of Covered Entity under this Contract even if some of that information
relates to specific services for which Business Associate may not be a "Business Associate" of Covered Entity under the

Privacy Rule.
17.7

The provisions of this Agreement that by their terms encompass continuing rights or responsibilities shall survive the

expiration or termination of this Agreement. For example: (a) the provisions of this Agreement shall continue to apply if
Covered Entity determines that it would be infeasible for Business Associate to return or destroy PHI as provided in
Section 14.2 and (b) the obligation of Business Associate to provide an accounting of disclosures as set forth in Section
11 survives the expiration or termination of this Agreement with respect to accounting requests, if any, made after such
expiration or tennination.

(AHS Rev: 112511 0)

-9-

ATTACHMENTF
AGENCY OF HUMAN SERVICES' CUSTOMARY CONTRACT PROVISIONS

1. Agency of Human Services - Field Services Directors will share oversight with the department (or field office) that is a party to
the contract for provider performance using outcomes, processes, terms and conditions agreed to under this contract.

2.

2-\-1 Data Base: The Contractor providing a health or human services within Vermont, or near the border that is readily
acces,sible to residents of Vermont, will provide relevant descriptive infonnation regarding its agency, programs andlor contact
and will adhere to the "Inclusion/Exclusion" policy of Vermont's 2-1-1. If included, the Contractor will provide accurate and up to
date information to their data base as needed. The "Inclusion/Exclusion" policy can be found at www.vermont21 tgrg

3.

Medicaid Program Contractors:
Inspection of Records: Any contracts accessing payments for services through the Global Commitment to Health Waiver and
Vermont Medicaid program must fulfill state and federal legal requirements to enable the Agency of Human Services (AHS), the
United States Department of Health and Human Services (DHHS) and the Government Accounting Office (GAO) to:
Evaluate through inspection or other means the quality, appropriateness, and timeliness of services performed; and Inspect
and audit any 'financial records of such Contractor or subcontractor.
Subcontracting for Medicaid Services: Having a subcontract does not tenninate the Contractor, receiving funds under Vermont's
Medicaid program, from its responsibility to ensure that all activities under this agreement are carried out. Subcontracts must
specifY the activities and repOliing responsibilities of the Contractor or subcontractor and provide for revoking delegation or
imposing other sanctions if the Contractor or subcontractor's perfonnance is inadequate, The Contractor agrees to make available
upon request to the Agency of Human Services; the Office of Velmont Health Access; the Department of Disabilities, Aging and
Independent Living; and the Center for Medicare and Medicaid Services (CMS) all contracts and subcontracts between the
Contractor and service providers.
Medicaid Notification ofTennination Requirements: Any Contractor accessing payments for services under the Global
Commitment to Health Waiver and Medicaid programs who terminates their practice will follow the Office of Vermont Health
Access, Managed Care Organization enrollee notification requirements,
Encounter Data: Any Contractor accessing payments for services through the Global Commitment to Health Waiver and
Vermont Medicaid programs must provide encounter data to the Agency of Human Services andlor its departments and ensure
that it can be linked to enrollee eligibility files maintained by the State.

4,

Non-discrimination Based on National Origin as evidenced bv Limited English Proficiency. The Contractor agrees to
comply with the non-discrimination requirements of Title VI of the Civil Rights Act of 1964, 42 USC Section 2000d, et seq .. and
with the federal guidelines promulgated pursuant to Executive Order 13166 of2000, which require that contractors and
subcontractors receiving federal funds must assure that persons with limited English proficiency can meaningfully access
services. To the extent the Contractor provides assistance to individuals with limited English proficiency through the use of oral
or written translation or interpretive services in compliance with this requirement, such individuals cannot be required to pay for
such services,

5.

Voter Registration. When designated by the Secretary of State, the Contractor agrees to become a voter registration agency as
defined by 17 V.S.A. §2103 (41), and to comply with the requirements of state and federal law pertaining to such agencies.

- 10-

6.

Drug Free Workplace Act. The Contractor will assure a drug-free workplace in accordance with 45 CFR Part 76.

7.

Privacy and Security Standards.
Protected Health Information: The Contractor shall maintain the privacy and security of all individually identifiable health
information acquired by or provided to it as a pat1 ofthe pelfom1ance of this contract. The Contractor shall follow federal and
state law relating to privaey and security of individually identifiable health information as applicable, including the Health
Insuranee Portability and Accountability Act (H1PAA) and its federal regulations.
Substance Abuse Treatment Information: The confidentiality of any alcohol and drug abuse treatment information acquired by or
provided to the Contractor or subcontractor shall be maintained in compliance with any applicable state or federal laws or
regulations and specifically set out in 42 CFR rart 2.
Other Confidential Consumer Information: The Contractor agrees to comply with the requirements of AHS Rule No. 08-048
concerning access to information. The Contractor agrees to comply with any applicable Vermont State Statute, including but not
limited to 12 VSA § 1612 and any applicable Board of Health confidentiality regulations. The Contractor shall ensure that all of its
employees and subcontractors performing services under this agreement understand the sensitive nature of the infonnation that
they may have access to and sign an affinnation of understanding regarding the infonnation's confidential and non-public nature.
Social Security numbers: The Contractor agrees to comply with all applicable Vermont State Statutes to assure protection and
security of personal information, including protection from identity theft as outlined in Title 9, Vermont Statutes Annotated, Ch.
62.

8.

Abuse Registry. The Contractor agrees not to employ any individual, use any volunteer, or otherwise provide reimbursement to any
individual in the perfonnance of services connected with this agreement, who provides care, custody, treatment, transportation, or
supervision to children or vulnerable adults if there is a substantiation of abuse or neglect or exploitation against that individual. The
Contractor will check the Adult Abuse Registry in the Department of Disabilities, Aging and Independent Living. Unless the
Contractor holds a valid child care license or registration from the Division of Child Development, Department for Children and
Families, the Contractor shall also check the Central Child Abuse Registry. (See 33 V.S.A. §4919(a) (3) & 33 V.S.A. §6911 (c) (3)).

9.

Reporting of Abuse, Neglect, or Exploitation. Consistent with provisions of 33 V.S.A. §4913(a) and §6903, any agent or
employee of a Contractor who, in the performance of services connected with this agreement, has contact with clients or is a
caregiver and who has reasonable cause to believe that a child or vulnerable adult has been abused or neglected as defined in
Chapter 49 or abused, neglected, or exploited as defined in Chapter 69 of Title 33 V.S.A. shall make a report involving children to
the Commissioner of the Department tor Children and Families within 24 hours or a report involving vulnerable adults to the
Division of Licensing and Protection at the Depat1ment of Disabilities, Aging, and Independent Living within 48 hours. This
requirement applies except in those instances where particular roles and functions are exempt from reporting under state and
federal law. Repol1s involving children shall contain the information required by 33 V.S.A. §4914. Reports involving vulnerable
adults shall contain the information required by 33 V.S.A. §6904. The Contractor will ensure that its agents or employees receive
training on tl,e reporting of abuse or neglect to children and abuse, neglect or exploitation of vulnerable adults.

- II -

10. Intellectual PropertylWork Product Ownership. All data, technical information, materials first gathered, originated,
developed, prepared, or obtained as a condition of this agreement and used in the performance of this agreement - including, but
not limited to all reports, surveys, plans, charts, literature, brochures, mailings, recordings (video Of audio), pictures, drawings,
analyses, graphic representations, software computer programs and accompanying documentation and printouts, notes and
memoranda, written procedures and documents, which are prepared for or obtained specifically for this agreement - or are a
result of the services required under this grant - shall be considered Itwork for hire" and remain the property of the State of
Vermont, regardless of the state of completion - unless otherwise specified in this agreement. Such items shall be delivered to the
State of Vermont upon 30 days notice by the State. With respect to software computer programs and I or source codes first
developed for the State, all the work shall be considered "work for hire)" Le., the State, not the Contractor or subcontractor, shall
have full and complete ownership of all software computer programs, documentation andlor source codes developed.
The Contractor shall not sell or copyright a work product or item produced under this agreement without explicit permission from
the State.
If the Contractor is operating a system or application on behalf of the State of Vermont, then the Contractor shall not make
information entered into the system or application available for uses by any other party than the State of Vermont, without prior
authorization by the State. Nothing herein shall entitle the State to pre-existing Contractor's materials.

II. Security and Data Transfers. Thc State shall work with the Contractor to ensure compliance with all applicable State and
Agency of Human Services' policies and standards, especially those related to privacy and security. The State will advise the
Contractor of any new policies, procedures, or protocols developed during the term of this agreement as they are issued and will
work with the Contractor to implement any required.
The Contractor will ensure the physical and data security associated with computer equipment - including desktops, notebooks,
and other portable devices - used in connection with this agreement. The Contractor will also assure that any media or mechanism
used to store or transfer data to or from the State includes industry standard security mechanisms such as continually up-to-date
malware protection and encryption. The Contractor will make every reasonable effort to ensure media or data files transfen-ed to
the State are virus and spyware free. At the conclusion of this agreement and after successful delivery of the data to the State, the
Contractor shall securely delete data (including archival backups) from the Contractor's equipment that contains individually
identifiable records, in accordance with standards adopted by the Agency of Human Services.

12. Co mputing and Communication: The Contractor shall select, in consultation with the Agency of Human Services' Information
Technology unit, one of the approved methods for secure access to the State's systems and data, if required. Approved methods
are based on the type of work performed by the Contractor as part of this agreement. Options include, but are not limited to:

1.

Contractor's provision of certified computing equipment, peripherals and mobile devices, on a separate Contractor's network
with separate internet access. The Agency of Human Services' accounts mayor may not be provided.

2.

State supplied and managed equipment and accounts to access state applications and data, including State issued active
directory accounts and application specific accounts, which follow the National Institutes of Standards and Technology
(NIST) security and the Health Insurance Portability & Accountability Act (HIPAA) standards.

The State will not supply e-mail accounts to the Contractor.

13. Lobbying. No federal funds under this agreement may be used to influence or attempt to influence an omcer or employee of any
agency, a member of Congress, an officer or employee of Congress, or an employee ofa member of Congress in connection with
the awarding of any federal contract, continuation, renewal, amendments other than federal appropriated funds.
14. Non -discrimination. The Contractor will prohibit discrimination on the basis of age under the Age Discrimination Act of J 975,
on the basis of handicap under section 504 of the Rehabilitation Act of 1973, on the basis of sex under Title IX of the Education
Amendments of 1972, or on the basis of race, color or national origin under Title VI of the Civil Rights Act of 1964. No person
shall on the grounds of sex (including, in the case of a woman, on the grounds that the woman is pregnant) or on the grounds of
religion, be excluded from participation in, be denied the benefits of, or be subjected to discrimination, to include sexual
harassment, under any program or activity supported by state andlor federal funds.

- 12 -

15.

Environmental Tobacco Smoke. Public Law 103-227, also known as the Pro-children Act of 1994 (Act), requires that
smoking not be permitted in any portion of any indoor facility owned or leased or contracted for by an entity and used
routinely or regularly for the provision of health, child care, early childhood development services, education or library
services to children under the age of 18, if the services are funded by federal programs either directly or through state or
local governments, by federal grant, contract, loan or loan guarantee. The law also applies to children's services that are

provided in indoor facilities that are constructed, operated, or maintained with such Federal funds.
The law does not apply to children's services provided in private residences; portions of facilities used for inpatient drug
or alcohol treatment; service providers whose sole source of applicable federal funds is Medicare or Medicaid; or
facilities where Women, Infants, & Children (WIC) coupons are redeemed.
Failure to comply with the provisions of the law may result in the imposition of a civil monetary penalty of up to $ 1,000

for each violation and/or the imposition of an administrative compliance order on the responsible entity.
Contractors are prohibited from promoting the use of tobacco products for all clients. Facilities supported by state and
federal funds are prohibited from making tobacco products available to minors.

Attachment F - Revised AHS -12-08-09

16.

The Contractor's proprietary corporate infonnation including, but not limited to, its fonns, systems, software and

processes developed in the regular course of Contractor's business and data, technical information and materials that
pertain to another customer, another facility or another inmate popUlation shall remain the property of the contractor
and is not the property of the State of Vennon!.

Commissioner Andrew Pallita
Vermont Department of Corr,ections

Sign~~

~~J'b'-'-./_"_ _

- I 3-