SEALED BID REQUEST FOR PROPOSAL STATEWIDE SECURITY SERVICES (REBID)

Transcription

1 Department of Buildings and General Services Office of Purchasing & Contracting 109 State Street [phone] Montpelier VT [fax] Agency of Administration SEALED BID REQUEST FOR PROPOSAL STATEWIDE SECURITY SERVICES (REBID) ISSUE DATE: December 22, 2017 BIDDERS CONFERENCE: QUESTIONS DUE BY: RFP RESPONSES DUE BY: January 31, :00PM Eastern February 8, :00PM Eastern February 20, :30PM Eastern PLEASE BE ADVISED THAT ALL NOTIFICATIONS, RELEASES, AND AMENDMENTS ASSOCIATED WITH THIS RFP WILL BE POSTED AT: THE STATE WILL MAKE NO ATTEMPT TO CONTACT INTERESTED PARTIES WITH UPDATED INFORMATION. IT IS THE RESPONSIBILITY OF EACH BIDDER TO PERIODICALLY CHECK THE ABOVE WEBPAGEFOR ANY AND ALL NOTIFICATIONS, RELEASES AND AMENDMENTS ASSOCIATED WITH THIS RFP. STATE CONTACT: BRIAN BERINI, COMMODITIES PROCUREMENT ADMINISTRATOR TELEPHONE: (802) FAX: (802)

2 1. OVERVIEW: 1.1. SCOPE AND BACKGROUND: Through this Request for Proposal (RFP) The Office of Security (hereinafter the State ) is seeking to establish contracts with one or more companies that can provide Statewide Security Services CONTRACT PERIOD: Contracts arising from this RFP will be for a period of two years with an option to renew for up to two additional twelve-month periods. The State anticipates the start date will be March 1, SINGLE POINT OF CONTACT: All communications concerning this RFP are to be addressed in writing to the State Contact listed on the front page of this RFP. Actual or attempted contact with any other individual from the State concerning this RFP is strictly prohibited and may result in disqualification BIDDERS CONFERENCE: A bidders conference will be held at Commissioner s Conference Room at 2 Governor Aiken Avenue - Montpelier, VT at the date and time indicated on the front page of this RFP QUESTION AND ANSWER PERIOD: Any vendor requiring clarification of any section of this RFP or wishing to comment or take exception to any requirements of the RFP must submit specific questions in writing no later than the deadline for question indicated on the first page of this RFP. Questions may be ed to the point of contact on the front page of this RFP. Any comments, questions, or exceptions not raised in writing on or before the last day of the question period are waived. At the close of the question period a copy of all questions or comments and the State's responses will be posted on the State s web site Every effort will be made to post this information as soon as possible after the question period ends, contingent on the number and complexity of the questions. 2. DESCRIPTION OF WORK: Contractor shall provide statewide security services in accordance with the detailed specifications outlined below STATIC POST LOCATIONS AND RESPONSIBILITIES: SITE 1: 108 Cherry Street, Burlington VT A lead officer must be identified, and posts rotated every two hours. Post Days Shifts VT Department of Health South Entry post VT Department for Children and Families North Entry post Roving Post: Cover the parking garage from 6:30am to 8:30 am. Ensure vehicles entering have proper State of Vermont employee credentials. VT Department of Health WIC Program South Lobby Post Monday-Friday Monday-Friday Monday-Friday 1st and 3rd Wednesday/month 7:30 am 5:30 pm 7:30 am 5:30 pm 6:00 am 4:30 pm 7:00 pm 8:00 pm SITE 2: 426 Industrial Avenue, Williston VT Post Days Shifts 2

3 Front Entrance Security desk Monday-Friday 7:00 am 5:00 pm SITE 3: Guilford Welcome Center Post Cover front desk and conduct high visibility patrols of the grounds, including: electrical/boiler room; exterior buildings; and both parking lots for litter; ensure walkways and parking lots are free of ice; ensure interior walking surfaces are not slippery; apply ice melt when conditions require it. Sunday- Saturday 11:00 pm 7:00 am SITE 4: 27 Federal Street, St. Albans VT This post requires coverage on an as-needed basis. State shall provide 8 hour notification Post Days Shifts Once per month 4:30 pm 8:30 Department of Health - Front Lobby pm SITE 5: 4 Market Street, South Burlington VT Posts Days Shifts Wednesdays 4:30 pm 7:00 Department of Motor Vehicles pm SITE 6: Rover Chittenden County Will conduct high visibility patrols of state facilities in Chittenden County. Will conduct security standbys and escorts when required. Check for signs of criminal activity, visibility to act as a crime deterrent SITE 7: Waterbury State Office Complex, State Drive, Waterbury VT Posts Days Shifts 2 Positions, Agency of Human Services HQ Mondays thru Fridays 6:00 am 6:00 pm 3

4 Additional Sites Agency of Human Services locations with advanced notice via the BGS Office of Security as required Video monitoring station with advanced notice from the office of security when required Additional; sites may be added and/or removed at the discretion of the State. The State may require additional coverage and emergency coverage at any State property and may require the needs for armed and licensed Security Officers MANAGEMENT: Contractor, in addition to the standard insurance requirements defined in Attachment C, shall have Employee Dishonesty Bond coverage with limits not less $100,000 per claim, $100,000 aggregate Contractor shall perform fingerprint supported criminal background checks on all security officers performing work under this contract at the time of hire and annually thereafter. Contractor shall provide the State of copy of background results for any record reported Contractor shall comply with State of Vermont, Department of Human Resources Personnel Policies and Procedures Section 3.0 Equal Employment Opportunity/Affirmative Action. Attachment F Contractor shall comply with State of Vermont, Department of Human Resources Personnel Policies and Procedures Section 3.1 Sexual Harassment policies. Attachment E. Exhibit Contractor shall communicate and meet regularly or as needed with the State s Safety and Security Program Manager to facilitate contractual performance management Contractor shall comply with the US Department of Health and Human Services Summary of the HIPPA Privacy Rule. Attachment G. Exhibit On a daily basis, Contractor shall maintain a State supplied electronic log of activities and incidents and verify that the entries are true and accurate. Failure to comply with requirement shall be considered a violation of the contract terms Contractor shall enter all incidents into the State s Incident Reporting system as soon as possible and no later than the end of the Security Officer s shift that was involved with or received the report of the incident/event using the incident reporting system or other reporting system designated and approved by the State Contractor shall provide Security uniforms that clearly identify personnel as Security Officers; uniforms must be approved by the BGS Office of Security Contractor shall be responsible for the security and maintenance of all keys and/or access and identification cards allocated to its employees. Any access badge issued to an employee who is terminated must be immediately returned to the State; and Contractor shall notify the State immediately of employee terminations, so the State can disable the badge. Contractor will be responsible for replacing any lost keys Contractor shall designate a lead/supervisory officer as the primary point of contact at sites with multiple posts, to communicate with the Contractor and State and ensure duties are performed Contractor shall be required to notify the building maintenance personnel of any maintenance related issues that are discovered by Security Officers during shift Contractor is responsible for ensuring Security Officers are reporting for shift and fulfilling the staffing requirements of each post Contractor shall not issue supplementary procedures, guidance or post orders to its Security Officers performing under this contract without express approval of the State prior to issuance. 4

5 The State shall provide direct communication with the Contractor regarding issues, concerns or performance dissatisfaction. Contractor shall remediate the issue within 48 hours to the satisfaction of the State. Contractor shall provide a written notification of the corrective action taken within 10 business days Contractor is responsible for ensuring all Security Officers working under this contract maintain current licensing requirements. Security Officers will not be allowed to start until a copy of their current security license is provided to the BGS Office of Security Failure to adhere to the standards set forth in this contract may result in financial reductions for failure to maintain performance standards Any officer failing to meet performance standards may be removed from the contract for cause Any officer with a documented disciplinary violation may be removed from the contract. For emergency removals the Contractor will immediately cover the shift of the removed officer AVAILABILITY: Contractor must be available to provide services 24 hours a day 7 day a week and be able to initiate response within a 4-hour notice and the ability to respond at any location within the State of Vermont Contractor shall provide a cell phone for each officer post to facilitate communication with State employees/clients of that building. The communication device must have texting and capabilities. Wireless internet access may not be available at all sites Contractor shall plan and coordinate post coverage in a manner that precludes the need for overtime pay. Overtime pay is not an authorized expense Any open post must be immediately reported to the BGS Office of Security by the Contractor SECURITY OFFICERS QUALIFICATIONS: Security Officers must be licensed with the Vermont Secretary of State s Office of Professional Regulation. Contractor must provide copies of professional licenses for all Security Officers providing services under this contract and must have a current license before starting on their first shift Contractor shall provide the State a copy of their professional development policies and a list of professional development provided Security Officers over the past two calendar years Security Officers must be proficient in reading and writing English Contractor shall provide the State a professional development schedule that provides the course description, course objectives; whether the training/course is mandatory or optional; instructor and credentials; and the date and time of course/training offered for the next two calendar years Security Officers must have first aid responder training and shall be certified in CPR and First AED Security Officers shall be knowledgeable about the surrounding area; local and state resources and services Security Officers must successfully complete a basic security training academy as prescribed by the BGS Office of Security before being placed on post (curriculum pending) Security Officers must be proficient in the use of computers and MS Office Products Security Officers must be 18 years of age or older Security Officers must be in good physical condition Security Officers must be an effective communicator Security Officers must possess a valid state driver s license SECURITY OFFICERS DUTIES: 5

6 Security Officers shall comply with and be knowledgeable with the post orders set forth by the State of Vermont Security Officers shall deliver professional customer service to the public and the employees of the State of Vermont and other organizations to include, but not limited to, local governmental agencies (emergency first responders, social workers, investigators, VIPs, volunteer workers, etc) Security Officers shall wear State approved, Contractor issued security uniforms and maintain a neat and professional appearance and grooming standards set forth by the BGS Office of Security Security Officers shall be able to maintain long periods on their feet and perform frequent patrols of property and investigate unusual or suspicious activity and respond to various incidents Security Officers shall comply with environmental safety protocols at each site Security Officers shall recognize and respond quickly to potential safety issues Security Officers shall, in addition to post orders, perform frequent but randomly timed security checks of property including: inspect buildings for damage or safety violations; ensure exterior doors and accessible windows are closed and secured and monitor lobby and lobby restrooms Security Officers shall operate building alarms as needed or necessary. State shall provide instruction and protocols to Contractor for handling building alarms Security Officers shall complete an electronic daily log throughout their shift Security Officers shall complete Incident Reports (online) in the state reporting system Security Officers shall identify unauthorized individuals attempting to gain access to state controlled facilities and or vehicles Upon request, Security Officers shall be called to escort State employees to their personal vehicles located at the office s designated parking areas Security Officers may be required to operate weapon detection devices to screen individuals and prevent passage of prohibited articles into restricted areas. Training in the operation of those device will be required and given in advance Security Officers may be required to operate surveillance equipment to detect suspicious or illegal activities Prevent loss and theft, assault, disorderly conduct Write clear and concise reports of daily activities and irregularities, and incidents to include but not limited to such as equipment or property damage, theft, presence of unauthorized persons, or unusual occurrences Warn persons of rule infractions or violations, and apprehend or evict violators from premises, using reasonably necessary force when required Make contact with individuals about rule violations or safety concerns Respond to alarms and investigate disturbances and make proper notifications Prevent unauthorized individuals from entering restricted areas Use non-lethal weapons and / or physical force to maintain law and order and protect state employees and visitors to state facilities if necessary Must be able to operate a motor vehicle in a safe manner to transport individuals or respond to specified locations or to provide security patrols of an area Recertify on non-lethal use of force on an annual basis after initial certification to the standard set forth by the BGS Office of Security Security Officers must fully understand the BGS Emergency Procedures Plans and their related duties in support of the EPP during a drill and an emergency Physical Demands: 6

7 Work is often performed in a typical non-office environment requiring: Standing and/or walking for extended periods of time Reaching by extending hand(s) or arm(s) in any direction Dexterity sufficient to manipulate objects with fingers, for example operating a computer keyboard Basic agility for lifting and maneuvering up to 50 lbs. of weight Communication skills using the written and/or spoken word Vision sufficient to see objects within normal parameters, peripherally and at a distance A great deal of physical effort, often required to balance, stoop, kneel, crouch or crawl Potential of exposure to physical assault 2.7. Training Security Officers will be required to successfully complete 114 hours of training before starting. The training will be provided by the Contractor. All instructors and lesson plans will be required to be reviewed and approved by the BGS Office of Security The training will consist of the following classes: Role of security Officers - 2 hours Terrorism awareness - 1 hour Legal powers and limitations 4 hours Ethics and conduct (including Vermont Board rules) 4 hours Patrol procedures 4 hours Communication and public relations 4 hours Observation and note taking 4 hours Emergency response 8 hours Access control 2 hours Evidence 2 hours Taking witness/victim statements 2 hours Dealing with the mentally ill 4 hours Report writing 4 hours Emergencies, Threats, and Evacuations 4 hours Protecting People, Buildings, Property, and Assets 4 hours Protective Investigations 2 hours Control the crowd 2 hours Protective operations details - 4 hours Handling Difficult People management of aggressive behavior 8 hours Driver Safety - 1 Hour Workplace Violence / ALICE 5 hours Evidence / Preserving the Incident Scene 2 hours Defensive tactics / use of force 16 hours Police baton 8 hours 7

8 OC spray 4 hours Human Rights Act and Bias-Related Crime - 1 hour De-escalation procedures 2 hours state facility rules and regulations -1 hour HazMat Awareness 4 hours Final exam 1 hour 2.8. Security Officers will also be required to successfully complete 40 hours of on-the-job training within 90 working days. Any Security Officer that does not successfully complete on-the-job training will be removed from the contract The Contractor is required to provide any training that may be required by VOSA or the BGS Safety Office. Online training may include, but not limited to, Bloodborne Pathogens and FEMA s Incident Command System (ICS) 100 and 200 courses Security Officers will be required to attend and successfully complete Annual In-Service Training consisting of 24 hours annually including first-aid CPR and AED Any Security Officer working a screening post equipped with a magnetometer / x-ray machine will be required to attend 16 hours of training provided by BGS Office of Security. 3. GENERAL REQUIREMENTS: 3.1. PRICING: Bidders must price the terms of this solicitation at their best pricing. Any and all costs that Bidder wishes the State to consider must be submitted for consideration. If applicable, all equipment pricing is to include F.O.B. delivery to the ordering facility. No request for extra delivery cost will be honored. All equipment shall be delivered assembled, serviced, and ready for immediate use, unless otherwise requested by the State Prices and/or rates shall remain firm for the initial term of the contract. The pricing policy submitted by Bidder must (i) be clearly structured, accountable, and auditable and (ii) cover the full spectrum of materials and/or services required Cooperative Agreements. Bidders that have been awarded similar contracts through a competitive bidding process with another state and/or cooperative are welcome to submit the pricing in response to this solicitation Retainage. In the discretion of the State, a contract resulting from this RFP may provide that the State withhold a percentage of the total amount payable for some or all deliverables, such retainage to be payable upon satisfactory completion and State acceptance in accordance with the terms and conditions of the contract BEST AND FINAL OFFER: Best and Final Offer (BAFO). At any time after submission of Responses and prior to the final selection of Bidder(s) for Contract negotiation or execution, the State may invite Bidder(s) to provide a BAFO The state reserves the right to request BAFOs from only those Bidders that meet the minimum qualification requirements and/or have not been eliminated from consideration during the evaluation process Evaluation of Responses and Selection of Bidder(s). The State shall have the authority to evaluate Responses and select the Bidder(s) as may be determined to be in the best interest of the State and consistent with the goals and performance requirements outlined in this RFP WORKER CLASSIFICATION COMPLIANCE REQUIREMENTS: In accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), Bidders must comply with the following provisions and requirements. 8

9 Self Reporting: For bid amounts exceeding $250,000.00, Bidder shall complete the appropriate section in the attached Certificate of Compliance for purposes of self-reporting information relating to past violations, convictions, suspensions, and any other information related to past performance relative to coding and classification of workers. The State is requiring information on any violations that occurred in the previous 12 months Subcontractor Reporting: For bid amounts exceeding $250,000.00, Bidders are hereby notified that upon award of contract, and prior to contract execution, the State shall be provided with a list of all proposed subcontractors and subcontractors subcontractors, together with the identity of those subcontractors workers compensation insurance providers, and additional required or requested information, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54). This requirement does not apply to subcontractors providing supplies only and no labor to the overall contract or project. This list MUST be updated and provided to the State as additional subcontractors are hired. A sample form is available online at The subcontractor reporting form is not required to be submitted with the bid response EXECUTIVE ORDER 05-16: CLIMATE CHANGE CONSIDERATIONS IN STATE PROCUREMENTS: For bid amounts exceeding $25, Bidders are requested to complete the Climate Change Considerations in State Procurements Certification, which is included in the Certificate of Compliance for this RFP. After consideration of all relevant factors, a bidder that demonstrates business practices that promote clean energy and address climate change as identified in the Certification, shall be given favorable consideration in the competitive bidding process. Such favorable consideration shall be consistent with and not supersede any preference given to resident bidders of the State and/or products raised or manufactured in the State, as explained in the Method of Award section. But, such favorable consideration shall not be employed if prohibited by law or other relevant authority or agreement METHOD OF AWARD: Awards will be made in the best interest of the State. The State may award one or more contracts and reserves the right to make additional awards to other compliant bidders at any time if such award is deemed to be in the best interest of the State. All other considerations being equal, preference will be given first to resident bidders of the state and/or to products raised or manufactured in the state, and then to bidders who have practices that promote clean energy and address climate change, as identified in the applicable Certificate of Compliance Evaluation Criteria: Consideration shall be given to the Bidder s project approach and methodology, qualifications and experience, ability to provide the services within the defined timeline, cost, and/or success in completing similar projects, as applicable, and to the extent specified below. WEIGHTED MEASURES 1. 30% Cost 2. 30% Ability to fully cover all listed sites for all required shifts 3. 15% Ability to provide manpower geographically across the state of Vermont 4. 15% Ability to provide short-notice additional site coverage as required 5. 10% Experience in Government Security 3.6. STATEMENT OF RIGHTS: The State of Vermont reserves the right to obtain clarification or additional information necessary to properly evaluate a proposal. Vendors may be asked to give a verbal presentation of their proposal after submission. Failure of vendor to respond to a request for additional information or clarification could result in rejection of that vendor's proposal. To secure a project that is deemed to be in the best interest of the State, the State reserves the right to accept or reject any and all bids, in whole or in part, with or without cause, and to waive technicalities in submissions. The State also reserves the right to make purchases outside of the awarded contracts where it is deemed in the best interest of the State CONTRACT TERMS: The selected bidder(s) will be expected to sign a contract with the State, including the Standard Contract Form and Attachment C as attached to this RFP for reference. The contract will obligate the bidder to provide the services and/or products identified in its bid, at the prices listed. 9

10 PAYMENT TERMS: All invoices are to be rendered by the Contractor on the vendor's standard billhead and forwarded directly to the institution or agency ordering materials or services and shall specify the address to which payments will be sent. Payment terms are Net 30 days from receipt of an error-free invoice with all applicable supporting documentation. Percentage discounts may be offered for prompt payments of invoices; however, such discounts must be in effect for a period of 30 days or more in order to be considered in making awards. 4. CONTENT AND FORMAT OF RESPONSES: The content and format requirements listed below are the minimum requirements for State evaluation. These requirements are not intended to limit the content of a Bidder s proposal. Bidders may include additional information or offer alternative solutions for the State s consideration. However, the State discourages overly lengthy and costly proposals, and Bidders are advised to include only such information in their response as may be relevant to the requirements of this RFP NUMBER OF COPIES: Submit three (3) unbound copies and an electronic copy (CD or Flash drive) in pdf format COVER LETTER: Confidentiality. To the extent your bid contains information you consider to be proprietary and confidential, you must comply with the following requirements concerning the contents of your cover letter and the submission of a redacted copy of your bid (or affected portions thereof) The successful response will become part of the contract file and will become a matter of public record, as will all other responses received. If the response includes material that is considered by the bidder to be proprietary and confidential under the State s Public Records Act, 1 V.S.A. 315 et seq., the bidder shall submit a cover letter that clearly identifies each page or section of the response that it believes is proprietary and confidential. The bidder shall also provide in their cover letter a written explanation for each marked section explaining why such material should be considered exempt from public disclosure in the event of a public records request, pursuant to 1 V.S.A. 317(c), including the prospective harm to the competitive position of the bidder if the identified material were to be released. Additionally, the bidder must include a redacted copy of its response for portions that are considered proprietary and confidential. Redactions must be limited so that the reviewer may understand the nature of the information being withheld. It is typically inappropriate to redact entire pages, or to redact the titles/captions of tables and figures. Under no circumstances can the entire response be marked confidential, and the State reserves the right to disqualify responses so marked Exceptions to Terms and Conditions. If the bidder wishes to propose an exception to any terms and conditions set forth in the Standard Contract Form and its attachments, such exceptions must be included in the cover letter to the RFP response. Failure to note exceptions when responding to the RFP will be deemed to be acceptance of the State contract terms and conditions. If exceptions are not noted in the response to this RFP but raised during contract negotiations, the State reserves the right to cancel the negotiation if deemed to be in the best interests of the State. Note that exceptions to contract terms may cause rejection of the proposal BACKGROUND AND EXPERIENCE. Provide details concerning the form of business organization, company size and resources; describe particular experience relevant to the proposed project, and list all current or past State projects. If a Bidder intends to use subcontractors, the Bidder must identify in the proposal the names of the subcontractors, the portions of the work the subcontractors will perform, and address the background and experience of the subcontractor(s), as above REFERENCES. Provide the names, addresses, and phone numbers of at least three companies with whom you have transacted similar business in the last 12 months. You must include contact names who can talk knowledgeably about performance REPORTING REQUIREMENTS: Provide a sample of any reporting documentation that may be applicable to the Detailed Requirements of this RFP PRICING: Bidders shall submit their pricing information in the Price Schedule attached to the RFP. Bidders may be required to submit pricing information separate from their bid package if specifically required above. 10

11 4.7. CERTIFICATE OF COMPLIANCE: This form must be completed and submitted as part of the response for the proposal to be considered valid. 5. SUBMISSION INSTRUCTIONS: 5.1. CLOSING DATE: Bids must be received by the due date and at the location specified on the front page of this RFP The bid opening will be held at 109 State Street, Third Floor, Montpelier, VT and is open to the public SECURITY PROCEDURES: Please be advised extra time will be needed when visiting and/or delivering information to 109 State Street. All individuals visiting 109 State Street must present a valid government issued photo ID when entering the facility SEALED BID INSTRUCTIONS: All bids must be sealed and must be addressed to the State of Vermont, Office of Purchasing & Contracting, 109 State Street Third Floor, Montpelier, VT BID ENVELOPES MUST BE CLEARLY MARKED SEALED BID AND SHOW THE REQUISITION NUMBER AND/OR PROPOSAL TITLE, OPENING DATE AND NAME OF BIDDER All bidders are hereby notified that sealed bids must be received and time stamped by the Office of Purchasing & Contracting located at 109 State Street Third Floor, Montpelier, VT by the time of the bid opening. Bids not in possession of the Office of Purchasing & Contracting at the time of the bid opening will be returned to the vendor, and will not be considered. Any delay deemed caused by Security Procedures will be at the bidder s own risk Office of Purchasing & Contracting may, for cause, change the date and/or time of bid openings or issue an addendum. If a change is made, the State will make a reasonable effort to inform all bidders by posting at: All bids will be publicly opened. Typically, the Office of Purchasing & Contracting will open the bid, read the name and address of the bidder, and read the bid amount. However, the Office of Purchasing & Contracting reserves the right to limit the information disclosed at the bid opening to the name and address of the bidder when, in its sole discretion, the Office of Purchasing & Contracting determines that the nature, type, or size of the bid is such that the Office of Purchasing & Contracting cannot immediately (at the opening) determine that the bids are in compliance with the RFP. As such, there will be cases in which the bid amount will not be read at the bid opening. Bid openings are open to members of the public. Bid results are a public record however, the bid results are exempt from disclosure to the public until the award has been made and the contract is executed DELIVERY METHODS: SECURITY PROCEDURES: Note that security procedures concerning delivery of any mail or parcels to 109 State Street may delay receipt of mail/parcel pieces by one business day U.S. MAIL: Bidders are cautioned that it is their responsibility to originate the mailing of bids in sufficient time to ensure bids are received and time stamped by the Office of Purchasing & Contracting prior to the time of the bid opening EXPRESS DELIVERY: If bids are being sent via an express delivery service, be certain that the RFP designation is clearly shown on the outside of the delivery envelope or box. Express delivery packages will not be considered received by the State until the express delivery package has been received and time stamped by the Office of Purchasing & Contracting. Due to security procedures express deliveries must be received by 10:30 AM in order to be received by the Office of Purchasing & Contracting that same day HAND DELIVERY: Hand carried bids shall be delivered to a representative of the Office of Purchasing & Contracting prior to the bid opening ELECTRONIC: Electronic bids will not be accepted. 11

12 FAX BIDS: Faxed bids will be accepted. The faxed bid must be prefixed with SEALED BID. It is the Bidder s responsibility to originate the faxed message in sufficient time to insure receipt by the State prior to the time of the bid opening. All pages must be printed and in the possession of the State prior to the date and time of the bid opening or the bid will not be considered. Bidders are cautioned that bids submitted by fax may be compromised prior to the time of the sealed bid opening. Faxed information is accessible when transmitted and confidentiality cannot be guaranteed. State reserves the right to reject a faxed bid if it appears that the faxed bid is incomplete or portions of the faxed bid are illegible. 6. ATTACHMENTS: 6.1. Attachment C: Standard State Contract Provisions (7/1/2016) 6.2. Certificate of Compliance 6.3. Price Schedule 6.4. Worker Classification Compliance Requirement; Subcontractor Reporting Form 6.5. Attachment E - State of Vermont, Department of Human Resources Personnel Policies and Procedures Section 3.1 Sexual Harassment policies. Exhibit Attachment F - State of Vermont, Dept. of Human Resources Personnel Policies and Procedures section 3.0 Equal Employment Opportunity /Affirmative Action 6.7. Attachment G - US Department of Health and Human Services Summary of the HIPPA Privacy Rule. Exhibit 3 12

13 ATTACHMENT C: STANDARD STATE PROVISIONS FOR CONTRACTS AND GRANTS REVISED JULY 1, Definitions: For purposes of this Attachment, Party shall mean the Contractor, Grantee or Subrecipient, with whom the State of Vermont is executing this Agreement and consistent with the form of the Agreement. Agreement shall mean the specific contract or grant to which this form is attached. 2. Entire Agreement: This Agreement, whether in the form of a Contract, State Funded Grant, or Federally Funded Grant, represents the entire agreement between the parties on the subject matter. All prior agreements, representations, statements, negotiations, and understandings shall have no effect. 3. Governing Law, Jurisdiction and Venue; No Waiver of Jury Trial: This Agreement will be governed by the laws of the State of Vermont. Any action or proceeding brought by either the State or the Party in connection with this Agreement shall be brought and enforced in the Superior Court of the State of Vermont, Civil Division, Washington Unit. The Party irrevocably submits to the jurisdiction of this court for any action or proceeding regarding this Agreement. The Party agrees that it must first exhaust any applicable administrative remedies with respect to any cause of action that it may have against the State with regard to its performance under the Agreement. Party agrees that the State shall not be required to submit to binding arbitration or waive its right to a jury trial. 4. Sovereign Immunity: The State reserves all immunities, defenses, rights or actions arising out of the State s sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver of the State s immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason of the State s entry into this Agreement. 5. No Employee Benefits For Party: The Party understands that the State will not provide any individual retirement benefits, group life insurance, group health and dental insurance, vacation or sick leave, workers compensation or other benefits or services available to State employees, nor will the state withhold any state or federal taxes except as required under applicable tax laws, which shall be determined in advance of execution of the Agreement. The Party understands that all tax returns required by the Internal Revenue Code and the State of Vermont, including but not limited to income, withholding, sales and use, and rooms and meals, must be filed by the Party, and information as to Agreement income will be provided by the State of Vermont to the Internal Revenue Service and the Vermont Department of Taxes. 6. Independence: The Party will act in an independent capacity and not as officers or employees of the State. 7. Defense and Indemnity: The Party shall defend the State and its officers and employees against all third party claims or suits arising in whole or in part from any act or omission of the Party or of any agent of the Party in connection with the performance of this Agreement. The State shall notify the Party in the event of any such claim or suit, and the Party shall immediately retain counsel and otherwise provide a complete defense against the entire claim or suit. The State retains the right to participate at its own expense in the defense of any claim. The State shall have the right to approve all proposed settlements of such claims or suits. In the event the State withholds approval to settle any such claim, then the Party shall proceed with the defense of the claim but under those circumstances, the Party s indemnification obligations shall be limited to the amount of the proposed settlement initially rejected by the State. 13

14 After a final judgment or settlement the Party may request recoupment of specific defense costs and may file suit in Washington Superior Court requesting recoupment. The Party shall be entitled to recoup costs only upon a showing that such costs were entirely unrelated to the defense of any claim arising from an act or omission of the Party in connection with the performance of this Agreement. The Party shall indemnify the State and its officers and employees in the event that the State, its officers or employees become legally obligated to pay any damages or losses arising from any act or omission of the Party or an agent of the Party in connection with the performance of this Agreement. The Party agrees that in no event shall the terms of this Agreement nor any document required by the Party in connection with its performance under this Agreement obligate the State to defend or indemnify the Party or otherwise be liable for the expenses or reimbursement, including attorneys fees, collection costs or other costs of the Party except to the extent awarded by a court of competent jurisdiction. 8. Insurance: Before commencing work on this Agreement the Party must provide certificates of insurance to show that the following minimum coverages are in effect. It is the responsibility of the Party to maintain current certificates of insurance on file with the State through the term of the Agreement. No warranty is made that the coverages and limits listed herein are adequate to cover and protect the interests of the Party for the Party s operations. These are solely minimums that have been established to protect the interests of the State. Workers Compensation: With respect to all operations performed, the Party shall carry workers compensation insurance in accordance with the laws of the State of Vermont. Vermont will accept an outof-state employer's workers compensation coverage while operating in Vermont provided that the insurance carrier is licensed to write insurance in Vermont and an amendatory endorsement is added to the policy adding Vermont for coverage purposes. Otherwise, the party shall secure a Vermont workers compensation policy, if necessary to comply with Vermont law. General Liability and Property Damage: With respect to all operations performed under this Agreement, the Party shall carry general liability insurance having all major divisions of coverage including, but not limited to: Premises - Operations Products and Completed Operations Personal Injury Liability Contractual Liability The policy shall be on an occurrence form and limits shall not be less than: $1,000,000 Each Occurrence $2,000,000 General Aggregate $1,000,000 Products/Completed Operations Aggregate $1,000,000 Personal & Advertising Injury Automotive Liability: The Party shall carry automotive liability insurance covering all motor vehicles, including hired and non-owned coverage, used in connection with the Agreement. Limits of coverage shall not be less than $500,000 combined single limit. If performance of this Agreement involves construction, or the transport of persons or hazardous materials, limits of coverage shall not be less than $1,000,000 combined single limit. 14

15 Additional Insured. The General Liability and Property Damage coverages required for performance of this Agreement shall include the State of Vermont and its agencies, departments, officers and employees as Additional Insureds. If performance of this Agreement involves construction, or the transport of persons or hazardous materials, then the required Automotive Liability coverage shall include the State of Vermont and its agencies, departments, officers and employees as Additional Insureds. Coverage shall be primary and non-contributory with any other insurance and self-insurance. Notice of Cancellation or Change. There shall be no cancellation, change, potential exhaustion of aggregate limits or non-renewal of insurance coverage(s) without thirty (30) days written prior written notice to the State. 9. Reliance by the State on Representations: All payments by the State under this Agreement will be made in reliance upon the accuracy of all representations made by the Party in accordance with the Contract, including but not limited to bills, invoices, progress reports and other proofs of work. 10. False Claims Act: The Party acknowledges that it is subject to the Vermont False Claims Act as set forth in 32 V.S.A. 630 et seq. If the Party violates the Vermont False Claims Act it shall be liable to the State for civil penalties, treble damages and the costs of the investigation and prosecution of such violation, including attorney s fees, except as the same may be reduced by a court of competent jurisdiction. The Party s liability to the State under the False Claims Act shall not be limited notwithstanding any agreement of the State to otherwise limit Party s liability. 11. Whistleblower Protections: The Party shall not discriminate or retaliate against one of its employees or agents for disclosing information concerning a violation of law, fraud, waste, abuse of authority or acts threatening health or safety, including but not limited to allegations concerning the False Claims Act. Further, the Party shall not require such employees or agents to forego monetary awards as a result of such disclosures, nor should they be required to report misconduct to the Party or its agents prior to reporting to any governmental entity and/or the public. 12. Federal Requirements Pertaining to Grants and Subrecipient Agreements: A. Requirement to Have a Single Audit: In the case that this Agreement is a Grant that is funded in whole or in part by federal funds, the Subrecipient will complete the Subrecipient Annual Report annually within 45 days after its fiscal year end, informing the State of Vermont whether or not a Single Audit is required for the prior fiscal year. If a Single Audit is required, the Subrecipient will submit a copy of the audit report to the granting Party within 9 months. If a single audit is not required, only the Subrecipient Annual Report is required. For fiscal years ending before December 25, 2015, a Single Audit is required if the subrecipient expends $500,000 or more in federal assistance during its fiscal year and must be conducted in accordance with OMB Circular A-133. For fiscal years ending on or after December 25, 2015, a Single Audit is required if the subrecipient expends $750,000 or more in federal assistance during its fiscal year and must be conducted in accordance with 2 CFR Chapter I, Chapter II, Part 200, Subpart F. The Subrecipient Annual Report is required to be submitted within 45 days, whether or not a Single Audit is required. B. Internal Controls: In the case that this Agreement is a Grant that is funded in whole or in part by Federal funds, in accordance with 2 CFR Part II, , the Party must establish and maintain effective internal control over the Federal award to provide reasonable assurance that the Party is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of 15

16 the United States and the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). C. Mandatory Disclosures: In the case that this Agreement is a Grant funded in whole or in part by Federal funds, in accordance with 2CFR Part II, , Party must disclose, in a timely manner, in writing to the State, all violations of Federal criminal law involving fraud, bribery, or gratuity violations potentially affecting the Federal award. Failure to make required disclosures may result in the imposition of sanctions which may include disallowance of costs incurred, withholding of payments, termination of the Agreement, suspension/debarment, etc. 13. Records Available for Audit: The Party shall maintain all records pertaining to performance under this agreement. Records means any written or recorded information, regardless of physical form or characteristics, which is produced or acquired by the Party in the performance of this agreement. Records produced or acquired in a machine readable electronic format shall be maintained in that format. The records described shall be made available at reasonable times during the period of the Agreement and for three years thereafter or for any period required by law for inspection by any authorized representatives of the State or Federal Government. If any litigation, claim, or audit is started before the expiration of the three-year period, the records shall be retained until all litigation, claims or audit findings involving the records have been resolved. 14. Fair Employment Practices and Americans with Disabilities Act: Party agrees to comply with the requirement of 21 V.S.A. Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent applicable. Party shall also ensure, to the full extent required by the Americans with Disabilities Act of 1990, as amended, that qualified individuals with disabilities receive equitable access to the services, programs, and activities provided by the Party under this Agreement. 15. Set Off: The State may set off any sums which the Party owes the State against any sums due the Party under this Agreement; provided, however, that any set off of amounts due the State of Vermont as taxes shall be in accordance with the procedures more specifically provided hereinafter. 16. Taxes Due to the State: A. Party understands and acknowledges responsibility, if applicable, for compliance with State tax laws, including income tax withholding for employees performing services within the State, payment of use tax on property used within the State, corporate and/or personal income tax on income earned within the State. B. Party certifies under the pains and penalties of perjury that, as of the date the Agreement is signed, the Party is in good standing with respect to, or in full compliance with, a plan to pay any and all taxes due the State of Vermont. C. Party understands that final payment under this Agreement may be withheld if the Commissioner of Taxes determines that the Party is not in good standing with respect to or in full compliance with a plan to pay any and all taxes due to the State of Vermont. D. Party also understands the State may set off taxes (and related penalties, interest and fees) due to the State of Vermont, but only if the Party has failed to make an appeal within the time allowed by law, or an appeal has been taken and finally determined and the Party has no further legal recourse to contest the amounts due. 17. Taxation of Purchases: All State purchases must be invoiced tax free. An exemption certificate will be furnished upon request with respect to otherwise taxable items. 16

17 18. Child Support: (Only applicable if the Party is a natural person, not a corporation or partnership.) Party states that, as of the date the Agreement is signed, he/she: A. is not under any obligation to pay child support; or B. is under such an obligation and is in good standing with respect to that obligation; or C. has agreed to a payment plan with the Vermont Office of Child Support Services and is in full compliance with that plan. Party makes this statement with regard to support owed to any and all children residing in Vermont. In addition, if the Party is a resident of Vermont, Party makes this statement with regard to support owed to any and all children residing in any other state or territory of the United States. 19. Sub-Agreements: Party shall not assign, subcontract or subgrant the performance of this Agreement or any portion thereof to any other Party without the prior written approval of the State. Party shall be responsible and liable to the State for all acts or omissions of subcontractors and any other person performing work under this Agreement pursuant to an agreement with Party or any subcontractor. In the case this Agreement is a contract with a total cost in excess of $250,000, the Party shall provide to the State a list of all proposed subcontractors and subcontractors subcontractors, together with the identity of those subcontractors workers compensation insurance providers, and additional required or requested information, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54). Party shall include the following provisions of this Attachment C in all subcontracts for work performed solely for the State of Vermont and subcontracts for work performed in the State of Vermont: Section 10 ( False Claims Act ); Section 11 ( Whistleblower Protections ); Section 14 ( Fair Employment Practices and Americans with Disabilities Act ); Section 16 ( Taxes Due the State ); Section 18 ( Child Support ); Section 20 ( No Gifts or Gratuities ); Section 22 ( Certification Regarding Debarment ); Section 23 ( Certification Regarding Use of State Funds ); Section 31 ( State Facilities ); and Section 32 ( Location of State Data ). 20. No Gifts or Gratuities: Party shall not give title or possession of anything of substantial value (including property, currency, travel and/or education programs) to any officer or employee of the State during the term of this Agreement. 21. Copies: Party shall use reasonable best efforts to ensure that all written reports prepared under this Agreement are printed using both sides of the paper. 22. Certification Regarding Debarment: Party certifies under pains and penalties of perjury that, as of the date that this Agreement is signed, neither Party nor Party s principals (officers, directors, owners, or partners) are presently debarred, suspended, proposed for debarment, declared ineligible or excluded from participation in federal programs, or programs supported in whole or in part by federal funds. Party further certifies under pains and penalties of perjury that, as of the date that this Agreement is signed, Party is not presently debarred, suspended, nor named on the State s debarment list at: Certification Regarding Use of State Funds: In the case that Party is an employer and this Agreement is a State Funded Grant in excess of $1,001, Party certifies that none of these State funds will be used to interfere with or restrain the exercise of Party s employee s rights with respect to unionization. 17

18 24. Conflict of Interest: Party shall fully disclose, in writing, any conflicts of interest or potential conflicts of interest. 25. Confidentiality: Party acknowledges and agrees that this Agreement and any and all information obtained by the State from the Party in connection with this Agreement are subject to the State of Vermont Access to Public Records Act, 1 V.S.A. 315 et seq. 26. Force Majeure: Neither the State nor the Party shall be liable to the other for any failure or delay of performance of any obligations under this Agreement to the extent such failure or delay shall have been wholly or principally caused by acts or events beyond its reasonable control rendering performance illegal or impossible (excluding strikes or lock-outs) ( Force Majeure ). Where Force Majeure is asserted, the nonperforming party must prove that it made all reasonable efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued performance of its obligations under this Agreement, substantially fulfilled all non-excused obligations, and timely notified the other party of the likelihood or actual occurrence of an event described in this paragraph. 27. Marketing: Party shall not refer to the State in any publicity materials, information pamphlets, press releases, research reports, advertising, sales promotions, trade shows, or marketing materials or similar communications to third parties except with the prior written consent of the State. 28. Termination: In addition to any right of the State to terminate for convenience, the State may terminate this Agreement as follows: A. Non-Appropriation: If this Agreement extends into more than one fiscal year of the State (July 1 to June 30), and if appropriations are insufficient to support this Agreement, the State may cancel at the end of the fiscal year, or otherwise upon the expiration of existing appropriation authority. In the case that this Agreement is a Grant that is funded in whole or in part by federal funds, and in the event federal funds become unavailable or reduced, the State may suspend or cancel this Grant immediately, and the State shall have no obligation to pay Subrecipient from State revenues. B. Termination for Cause: Either party may terminate this Agreement if a party materially breaches its obligations under this Agreement, and such breach is not cured within thirty (30) days after delivery of the non-breaching party s notice or such longer time as the non-breaching party may specify in the notice. C. No Implied Waiver of Remedies: A party s delay or failure to exercise any right, power or remedy under this Agreement shall not impair any such right, power or remedy, or be construed as a waiver of any such right, power or remedy. All waivers must be in writing. 29. Continuity of Performance: In the event of a dispute between the Party and the State, each party will continue to perform its obligations under this Agreement during the resolution of the dispute until this Agreement is terminated in accordance with its terms. 30. Termination Assistance: Upon nearing the end of the final term or termination of this Agreement, without respect to cause, the Party shall take all reasonable and prudent measures to facilitate any transition required by the State. All State property, tangible and intangible, shall be returned to the State upon demand at no additional cost to the State in a format acceptable to the State. 31. State Facilities: If the State makes space available to the Party in any State facility during the term of this Agreement for purposes of the Party s performance under this Agreement, the Party shall only use the space in accordance with all policies and procedures governing access to and use of State facilities which 18

19 shall be made available upon request. State facilities will be made available to Party on an AS IS, WHERE IS basis, with no warranties whatsoever. 32. Location of State Data: No State data received, obtained, or generated by the Party in connection with performance under this Agreement shall be processed, transmitted, stored, or transferred by any means outside continental United States, except with the express written permission of the State. (End of Standard Provisions) 19

20 STATEWIDE SECURITY SERVICES (REBID) DATE: December 22, 2017 Page 1 of 3 CERTIFICATE OF COMPLIANCE For a bid to be considered valid, this form must be completed in its entirety, executed by a duly authorized representative of the bidder, and submitted as part of the response to the proposal. A. NON COLLUSION: Bidder hereby certifies that the prices quoted have been arrived at without collusion and that no prior information concerning these prices has been received from or given to a competitive company. If there is sufficient evidence to warrant investigation of the bid/contract process by the Office of the Attorney General, bidder understands that this paragraph might be used as a basis for litigation. B. CONTRACT TERMS: Bidder hereby acknowledges that is has read, understands and agrees to the terms of this RFP, including Attachment C: Standard State Contract Provisions, and any other contract attachments included with this RFP. C. FORM OF PAYMENT: Does Bidder accept the Visa Purchasing Card as a form of payment? Yes No D. WORKER CLASSIFICATION COMPLIANCE REQUIREMENT: In accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), the following provisions and requirements apply to Bidder when the amount of its bid exceeds $250, Self-Reporting. Bidder hereby self-reports the following information relating to past violations, convictions, suspensions, and any other information related to past performance relative to coding and classification of workers, that occurred in the previous 12 months. Summary of Detailed Information Date of Notification Outcome Subcontractor Reporting. Bidder hereby acknowledges and agrees that if it is a successful bidder, prior to execution of any contract resulting from this RFP, Bidder will provide to the State a list of all proposed subcontractors and subcontractors subcontractors, together with the identity of those subcontractors workers compensation insurance providers, and additional required or requested information, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), and Bidder will provide any update of such list to the State as additional subcontractors are hired. Bidder further acknowledges and agrees that the failure to submit subcontractor reporting in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54) will constitute non-compliance and may result in cancellation of contract and/or restriction from bidding on future state contracts.

21 STATEWIDE SECURITY SERVICES (REBID) DATE: December 22, 2017 Page 2 of 3 E. Executive Order 05 16: Climate Change Considerations in State Procurements Certification Bidder certifies to the following (Bidder may attach any desired explanation or substantiation. Please also note that Bidder may be asked to provide documentation for any applicable claims): 1. Bidder owns, leases or utilizes, for business purposes, space that has received: Energy Star Certification LEED, Green Globes, or Living Buildings Challenge Certification Other internationally recognized building certification: 2. Bidder has received incentives or rebates from an Energy Efficiency Utility or Energy Efficiency Program in the last five years for energy efficient improvements made at bidder s place of business. Please explain: 3. Please Check all that apply: Bidder can claim on-site renewable power or anaerobic-digester power ( cow-power ). Or bidder consumes renewable electricity through voluntary purchase or offset, provided no such claimed power can be double-claimed by another party. Bidder uses renewable biomass or bio-fuel for the purposes of thermal (heat) energy at its place of business. Bidder s heating system has modern, high-efficiency units (boilers, furnaces, stoves, etc.), having reduced emissions of particulate matter and other air pollutants. Bidder tracks its energy consumption and harmful greenhouse gas emissions. What tool is used to do this? Bidder promotes the use of plug-in electric vehicles by providing electric vehicle charging, electric fleet vehicles, preferred parking, designated parking, purchase or lease incentives, etc.. Bidder offers employees an option for a fossil fuel divestment retirement account. Bidder offers products or services that reduce waste, conserve water, or promote energy efficiency and conservation. Please explain: 4. Please list any additional practices that promote clean energy and take action to address climate change:

22 STATEWIDE SECURITY SERVICES (REBID) DATE: December 22, 2017 Page 3 of 3 F. Acknowledge receipt of the following Addenda: Addendum No.: Addendum No.: Addendum No.: Dated: Dated: Dated: Bidder Name: Address: Contact Name: Fax Number: Telephone: By: Signature of Bidder (or Representative) Name: (Type or Print) END OF CERTIFICATE OF COMPLIANCE

23 RFP STATEWIDE SECURITY SERVICES (REBID) PRICE SCHEDULE A. Hourly Labor Rates: Service Category/Title of Positions Hourly Rate Security Officer $ $ $ $ $ $ $ $ B. Site Support. Designate Sites that full coverage (including all shifts) can be provided: SITE LOCATION SITE 1: 108 Cherry Street, Burlington VT Yes / No SITE 2: 426 Industrial Avenue, Williston VT SITE 3: Guilford Welcome Center SITE 4: 27 Federal Street, St. Albans VT SITE 5: 4 Market Street, South Burlington VT SITE 6: Rover Chittenden County SITE 7: Waterbury State Office Complex, State Drive, Waterbury VT C. This contract can be extended up to two (2) additional 12-month periods with mutual agreement between both parties: Optional Year 3 Increase: Not to Exceed % Optional Year 4 Increase: Not to Exceed % Name of Bidder: Signature of Bidder: Date: Page one of one

24 OCR PRIVACY BRIEF SUMMARY OF THE HIPAA PRIVACY RULE HIPAA Compliance Assistance

25 SUMMARY OF THE HIPAA PRIVACY RULE Contents Introduction... 1 Statutory & Regulatory Background... 1 Who is Covered by the Privacy Rule... 2 Business Associates...3 What Information is Protected... 3 General Principle for Uses and Disclosures... 4 Permitted Uses and Disclosures... 4 Authorized Uses and Disclosures... 9 Limiting Uses and Disclosures to the Minimum Necessary Notice and Other Individual Rights Administrative Requirements Organizational Options Other Provisions: Personal Representatives and Minors State Law Enforcement and Penalties for Noncompliance Compliance Dates Copies of the Rule & Related Materials End Notes i

26 SUMMARY OF THE HIPAA PRIVACY RULE Introduction The Standards for Privacy of Individually Identifiable Health Information ( Privacy Rule ) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services ( HHS ) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 ( HIPAA ). 1 The Privacy Rule standards address the use and disclosure of individuals health information called protected health information by organizations subject to the Privacy Rule called covered entities, as well as standards for individuals' privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights ( OCR ) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties. A major goal of the Privacy Rule is to assure that individuals health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed. This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier for entities to review the complete requirements of the Rule, provisions of the Rule referenced in this summary are cited in notes at the end of this document. To view the entire Rule, and for other additional helpful information about how it applies, see the OCR website: In the event of a conflict between this summary and the Rule, the Rule governs. Links to the OCR Guidance Document are provided throughout this paper. Provisions of the Rule referenced in this summary are cited in endnotes at the end of this document. To review the entire Rule itself, and for other additional helpful information about how it applies, see the OCR website: Statutory & Regulatory Background The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law , was enacted on August 21, Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions. HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within OCR Privacy Rule Summary 1 Last Revised 05/03

27 three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments. The final modifications were published in final form on August 14, A text combining the final regulation and the modifications can be found at 45 CFR Part 160 and Part 164, Subparts A and E on the OCR website: Who is Covered by the Privacy Rule The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the covered entities ). For help in determining whether you are covered, use the decision tool at: Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities. 4 Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations ( HMOs ), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of governmentfunded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center, 5 or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers compensation, automobile insurance, and property and casualty insurance. Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule. 6 Using electronic technology, such as , does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all providers of services (e.g., institutional providers such as hospitals) and providers of medical or health services (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care. OCR Privacy Rule Summary 2 Last Revised 05/03

28 Health Care Clearinghouses. Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa. 7 In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse s uses and disclosures of protected health information. 8 Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions. Business Associates Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing. 9 Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity. Business Associate Contract. When a covered entity uses a contractor or other nonworkforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. 10 Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that have an existing written contract or agreement with business associates prior to October 15, 2002, which is not renewed or modified prior to April 14, 2003, are permitted to continue to operate under that contract until they renew the contract or April 14, 2004, whichever is first. 11 Sample business associate contract language is available on the OCR website at: Also see OCR Business Associate Guidance. What Information is Protected Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." 12 OCR Privacy Rule Summary 3 Last Revised 05/03

29 Individually identifiable health information is information, including demographic data, that relates to: the individual s past, present or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual. 13 Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g. De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. 14 De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: 1) a formal determination by a qualified statistician; or 2) the removal of specified identifiers of the individual and of the individual s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual. 15 General Principle for Uses and Disclosures Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual s protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual s personal representative) authorizes in writing. 16 Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action. 17 See OCR Government Access Guidance. Permitted Uses and Disclosures Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and OCR Privacy Rule Summary 4 Last Revised 05/03

30 (6) Limited Data Set for the purposes of research, public health or health care operations. 18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make. (1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information. (2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities. 19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship. See OCR Treatment, Payment, Health Care Operations Guidance. Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another. 20 Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual 21 and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual. Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity. 22 Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below. 23 Obtaining consent (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. 24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent. OCR Privacy Rule Summary 5 Last Revised 05/03

31 (3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. Facility Directories. It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual s informal permission to list in its facility directory the individual s name, general condition, religious affiliation, and location in the provider s facility. 25 The provider may then disclose the individual s condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation. For Notification and Other Purposes. A covered entity also may rely on an individual s informal permission to disclose to the individual s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person s involvement in the individual s care or payment for care. 26 This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual s care of the individual s location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts. (4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as incident to, an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the minimum necessary, as required by the Privacy Rule. 27 See OCR Incidental Uses and Disclosures Guidance. (5) Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual s authorization or permission, for 12 national priority purposes. 28 These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information. Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by OCR Privacy Rule Summary 6 Last Revised 05/03

32 statute, regulation, or court orders). 29 Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and postmarketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. 30 See OCR Public Health Guidance; CDC Public Health and HIPAA Guidance. Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence. 31 Health Oversight Activities. Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule) for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs. 32 Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided. 33 Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person s death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime. 34 OCR Privacy Rule Summary 7 Last Revised 05/03

33 Decedents. Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law. 35 Cadaveric Organ, Eye, or Tissue Donation. Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue. 36 Research. Research is any systematic investigation designed to develop or contribute to generalizable knowledge. 37 The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual s authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought. 38 A covered entity also may use or disclose, without an individuals authorization, a limited data set of protected health information for research purposes (see discussion below). 39 See OCR Research Guidance; NIH Protecting PHI in Research. Serious Threat to Health or Safety. Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat). Covered entities may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal. 40 Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs. 41 OCR Privacy Rule Summary 8 Last Revised 05/03

34 Workers Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers compensation laws and other similar programs providing benefits for work-related injuries or illnesses. 42 See OCR Workers Compensation Guidance. (6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed. 43 A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set. Authorized Uses and Disclosures Authorization. A covered entity must obtain the individual s written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. 44 A covered entity may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances. 45 An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual s authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes. All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data. The Privacy Rule contains transition provisions applicable to authorizations and other express legal permissions obtained prior to April 14, Psychotherapy Notes 47. A covered entity must obtain an individual s authorization to use or disclose psychotherapy notes with the following exceptions 48 : The covered entity who originated the notes may use them for treatment. A covered entity may use or disclose, without an individual s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity s compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law. Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service. 49 The Privacy Rule carves out the following health-related activities from this definition of marketing: Communications to describe health-related products or services, or payment OCR Privacy Rule Summary 9 Last Revised 05/03

35 for them, provided by or included in a benefit plan of the covered entity making the communication; Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan s enrollees that add value to, but are not part of, the benefits plan; Communications for treatment of the individual; and Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual. Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity s receipt of direct or indirect remuneration from a third party must reveal that fact. See OCR "Marketing" Guidance. Limiting Uses and Disclosures to the Minimum Necessary Minimum Necessary. A central aspect of the Privacy Rule is the principle of minimum necessary use and disclosure. A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request. 50 A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary. When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose. See OCR Minimum Necessary Guidance. The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual s personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules. Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of OCR Privacy Rule Summary 10 Last Revised 05/03

36 protected health information to which access is needed, and any conditions under which they need the information to do their jobs. Disclosures and Requests for Disclosures. Covered entities must establish and implement policies and procedures (which may be standard protocols) for routine, recurring disclosures, or requests for disclosures, that limits the protected health information disclosed to that which is the minimum amount reasonably necessary to achieve the purpose of the disclosure. Individual review of each disclosure is not required. For non-routine, non-recurring disclosures, or requests for disclosures that it makes, covered entities must develop criteria designed to limit disclosures to the information reasonably necessary to accomplish the purpose of the disclosure and review each of these requests individually in accordance with the established criteria. Reasonable Reliance. If another covered entity makes a request for protected health information, a covered entity may rely, if reasonable under the circumstances, on the request as complying with this minimum necessary standard. Similarly, a covered entity may rely upon requests as being the minimum necessary protected health information from: (a) a public official, (b) a professional (such as an attorney or accountant) who is the covered entity s business associate, seeking the information to provide services to or for the covered entity; or (c) a researcher who provides the documentation or representation required by the Privacy Rule for research. Notice and Other Individual Rights Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices. 51 The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. See OCR Notice Guidance. Notice Distribution. A covered health care provider with a direct treatment relationship with individuals must deliver a privacy practices notice to patients starting April 14, 2003 as follows: o o o Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (for telephonic service delivery); By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; and In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates. OCR Privacy Rule Summary 11 Last Revised 05/03

37 Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request. 52 A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information. The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement. 53 Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement. A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the named insured, that is, the subscriber for coverage that also applies to spouses and dependents. Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice. 54 The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient s written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation. Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity s designated record set. 55 The designated record set is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider s medical and billing records about individuals or a health plan s enrollment, payment, claims adjudication, and case or medical management record systems. 56 The Rule excepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion. 57 Covered entities may impose reasonable, cost-based fees for the cost of copying and postage. Amendment. The Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is OCR Privacy Rule Summary 12 Last Revised 05/03

38 inaccurate or incomplete. 58 If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the information to the individual s detriment. 59 If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. The Rule specifies processes for requesting and responding to a request for amendment. A covered entity must amend protected health information in its designated record set upon receipt of notice to amend from another covered entity. Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity s business associates. 60 The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date. The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual s personal representative; (c) for notification of or to persons involved in an individual s health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities. Restriction Request. Individuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual s health care or payment for health care, or disclosure to notify family members or others about the individual s general condition, location, or death. 61 A covered entity is under no obligation to agree to requests for restrictions. A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical emergency. 62 Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs. 63 For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card. Health plans must accommodate reasonable requests if the individual indicates that the disclosure of all or part of the protected health information could endanger the individual. The health plan may not question the individual s statement of endangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled. OCR Privacy Rule Summary 13 Last Revised 05/03

39 Administrative Requirements HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the flexibility and scalability of the Rule are intended to allow covered entities to analyze their own needs and implement solutions appropriate for their own environment. What is appropriate for a particular covered entity will depend on the nature of the covered entity s business, as well as the covered entity s size and resources. Privacy Policies and Procedures. A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule. 64 Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity s privacy practices. 65 Workforce Training and Management. Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity). 66 A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions. 67 A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule. 68 Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule. 69 Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure. 70 For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See OCR Incidental Uses and Disclosures Guidance. Complaints. A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule. 71 The covered entity must explain those procedures in its privacy practices notice. 72 Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS. Retaliation and Waiver. A covered entity may not retaliate against a person for exercising rights provided by the Privacy Rule, for assisting in an investigation by HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates the Privacy Rule. 73 A covered entity may not OCR Privacy Rule Summary 14 Last Revised 05/03

40 require an individual to waive any right under the Privacy Rule as a condition for obtaining treatment, payment, and enrollment or benefits eligibility. 74 Documentation and Record Retention. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented. 75 Fully-Insured Group Health Plan Exception. The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan. 76 Organizational Options The Rule contains provisions that address a variety of organizational issues that may affect the operation of the privacy protections. Hybrid Entity. The Privacy Rule permits a covered entity that is a single legal entity and that conducts both covered and non-covered functions to elect to be a hybrid entity. 77 (The activities that make a person or organization a covered entity are its covered functions. 78 ) To be a hybrid entity, the covered entity must designate in writing its operations that perform covered functions as one or more health care components. After making this designation, most of the requirements of the Privacy Rule will apply only to the health care components. A covered entity that does not make this designation is subject in its entirety to the Privacy Rule. Affiliated Covered Entity. Legally separate covered entities that are affiliated by common ownership or control may designate themselves (including their health care components) as a single covered entity for Privacy Rule compliance. 79 The designation must be in writing. An affiliated covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions. Organized Health Care Arrangement. The Privacy Rule identifies relationships in which participating covered entities share protected health information to manage and benefit their common enterprise as organized health care arrangements. 80 Covered entities in an organized health care arrangement can share protected health information with each other for the arrangement s joint health care operations. 81 Covered Entities With Multiple Covered Functions. A covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions. 82 The covered entity may not use or disclose the protected health information of an individual who receives services from one covered function (e.g., health care provider) for another covered function (e.g., health plan) if the individual is not involved with the other function. OCR Privacy Rule Summary 15 Last Revised 05/03

41 Group Health Plan disclosures to Plan Sponsors. A group health plan and the health insurer or HMO offered by the plan may disclose the following protected health information to the plan sponsor the employer, union, or other employee organization that sponsors and maintains the group health plan 83 : Enrollment or disenrollment information with respect to the group health plan or a health insurer or HMO offered by the plan. If requested by the plan sponsor, summary health information for the plan sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan. Summary health information is information that summarizes claims history, claims expenses, or types of claims experience of the individuals for whom the plan sponsor has provided health benefits through the group health plan, and that is stripped of all individual identifiers other than five digit zip code (though it need not qualify as de-identified protected health information). Protected health information of the group health plan s enrollees for the plan sponsor to perform plan administration functions. The plan must receive certification from the plan sponsor that the group health plan document has been amended to impose restrictions on the plan sponsor s use and disclosure of the protected health information. These restrictions must include the representation that the plan sponsor will not use or disclose the protected health information for any employment-related action or decision or in connection with any other benefit plan. Other Provisions: Personal Representatives and Minors Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual s protected health information, as well as the individual s rights under the Rule. 84 A personal representative is a person legally authorized to make health care decisions on an individual s behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when a covered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual. Special case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children. If State and other law is silent concerning parental access to the minor s protected health information, a covered entity has discretion to provide or deny a parent access to the minor s health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See OCR Personal Representatives Guidance. OCR Privacy Rule Summary 16 Last Revised 05/03

42 State Law Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply. 85 Contrary means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA. 86 The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits. Exception Determination. In addition, preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law: Is necessary to prevent fraud and abuse related to the provision of or payment for health care, Is necessary to ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation, Is necessary for State reporting on health care delivery or costs, Is necessary for purposes of serving a compelling public health, safety, or welfare need, and, if a Privacy Rule provision is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law. Enforcement and Penalties for Noncompliance Compliance. Consistent with the principles for achieving compliance provided in the Rule, HHS will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Rule. 87 The Rule provides processes for persons to file complaints with HHS, describes the responsibilities of covered entities to provide records and compliance reports and to cooperate with, and permit access to information for, investigations and compliance reviews. Civil Money Penalties. HHS may impose civil money penalties on a covered entity of $100 per failure to comply with a Privacy Rule requirement. 88 That penalty may not exceed $25,000 per year for multiple violations of the identical Privacy Rule requirement in a calendar year. HHS may not impose a civil money penalty under specific circumstances, such as when a violation is due to reasonable cause and did not involve willful neglect and the covered entity corrected the violation within 30 days of when it knew or should have known of the violation. OCR Privacy Rule Summary 17 Last Revised 05/03

43 Criminal Penalties. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA faces a fine of $50,000 and up to one-year imprisonment. 89 The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to ten years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm. Criminal sanctions will be enforced by the Department of Justice. Compliance Dates Compliance Schedule. All covered entities, except small health plans, must be compliant with the Privacy Rule by April 14, Small health plans, however, have until April 14, 2004 to comply. Small Health Plans. A health plan with annual receipts of not more than $5 million is a small health plan. 91 Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts. 92 See What constitutes a small health plan? Copies of the Rule & Related Materials The entire Privacy Rule, as well as guidance and additional materials, may be found on our website, OCR Privacy Rule Summary 18 Last Revised 05/03

44 End Notes 1 Pub. L FR FR C.F.R , Even if an entity, such as a community health center, does not meet the definition of a health plan, it may, nonetheless, meet the definition of a health care provider, and, if it transmits health information in electronic form in connection with the transactions for which the Secretary of HHS has adopted standards under HIPAA, may still be a covered entity C.F.R , ; see Social Security Act 1172(a)(3), 42 U.S.C. 1320d-1(a)(3). The transaction standards are established by the HIPAA Transactions Rule at 45 C.F.R. Part C.F.R C.F.R (b) C.F.R C.F.R (e), (e) C.F.R C.F.R C.F.R C.F.R (d)(2), (a) and (b). 15 The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the safe harbor method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R (b) C.F.R (a) C.F.R (a)(2). OCR Privacy Rule Summary 19 Last Revised 05/03

45 18 45 C.F.R (a)(1) C.F.R (c) C.F.R C.F.R C.F.R C.F.R (a)(2) C.F.R (b) C.F.R (a) C.F.R (b) C.F.R (a)(1)(iii). 28 See 45 C.F.R C.F.R (a) C.F.R (b) C.F.R (a), (c) C.F.R (d) C.F.R (e) C.F.R (f) C.F.R (g) C.F.R (h). 37 The Privacy Rule defines research as, a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. 45 C.F.R C.F.R (i) CFR (e) C.F.R (j) C.F.R (k) C.F.R (l) C.F.R (e). A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (i) Names; (ii) Postal address information, other than town or city, State and zip code; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses: (vi) Social security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix) Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers, including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifiers, including finger and voice prints; (xvi) Full face photographic images and any comparable images. 45 C.F.R (e)(2) C.F.R A covered entity may condition the provision of health care solely to generate protected health information for disclosure to a third party on the individual giving authorization to disclose the OCR Privacy Rule Summary 20 Last Revised 05/03

46 information to the third party. For example, a covered entity physician may condition the provision of a physical examination to be paid for by a life insurance issuer on an individual s authorization to disclose the results of that examination to the life insurance issuer. A health plan may condition enrollment or benefits eligibility on the individual giving authorization, requested before the individual s enrollment, to obtain protected health information (other than psychotherapy notes) to determine the individual s eligibility or enrollment or for underwriting or risk rating. A covered health care provider may condition treatment related to research (e.g., clinical trials) on the individual giving authorization to use or disclose the individual s protected health information for the research. 45 C.F.R. 508(b)(4) CFR Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. 45 C.F.R C.F.R (a)(2) C.F.R and (a)(3) C.F.R (b) and (d) C.F.R (a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity s own fundraising C.F.R (c) C.F.R (d) C.F.R (c) C.F.R C.F.R A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed by a licensed health care professional (who is designated by the covered entity and who did not participate in the original decision to deny), when a licensed health care professional has determined, in the exercise of professional judgment, that: (a) the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b) the protected health information makes reference to another person (unless such other person is a health care provider) and the access requested is reasonably likely to cause substantial harm to such other person; or (c) the request for access is made by the individual s personal representative and the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person. A covered entity may deny access to individuals, without providing the individual an opportunity for review, in the following protected situations: (a) the protected health information falls under an exception to the right of access; (b) an inmate request for protected health information under certain circumstances; (c) information that a provider creates or obtains in the course of research that includes treatment for which the individual has agreed not to have access as part of consenting OCR Privacy Rule Summary 21 Last Revised 05/03

47 to participate in the research (as long as access to the information is restored upon completion of the research); (d) for records subject to the Privacy Act, information to which access may be denied under the Privacy Act, 5 U.S.C. 552a; and (e) information obtained under a promise of confidentiality from a source other than a health care provider, if granting access would likely reveal the source. 45 C.F.R C.F.R Covered entities may deny an individual s request for amendment only under specified circumstances. A covered entity may deny the request if it: (a) may exclude the information from access by the individual; (b) did not create the information (unless the individual provides a reasonable basis to believe the originator is no longer available); (c) determines that the information is accurate and complete; or (d) does not hold the information in its designated record set (a)(2) C.F.R C.F.R (a) C.F.R (a). In addition, a restriction agreed to by a covered entity is not effective under this subpart to prevent uses or disclosures permitted or required under (a)(2)(ii), (a) or C.F.R (b) C.F.R (i) C.F.R (a) C.F.R C.F.R (b) C.F.R (e) C.F.R (f) C.F.R (c) C.F.R (d) C.F.R (b)(1)(vi) C.F.R (g) C.F.R (h) C.F.R (j) C.F.R (k) C.F.R , C.F.R C.F.R Common ownership exists if an entity possesses an ownership or equity interest of five percent or more in another entity; common control exists if an entity has the direct or indirect power significantly to influence or direct the actions or policies of another entity. 45 C.F.R The Privacy Rule at 45 C.F.R identifies five types of organized health care arrangements: A clinically-integrated setting where individuals typically receive health care from more than one provider. An organized system of health care in which the participating covered entities hold themselves out to the public as part of a joint arrangement and jointly engage in OCR Privacy Rule Summary 22 Last Revised 05/03

48 utilization review, quality assessment and improvement activities, or risk-sharing payment activities. A group health plan and the health insurer or HMO that insures the plan s benefits, with respect to protected health information created or received by the insurer or HMO that relates to individuals who are or have been participants or beneficiaries of the group health plan. All group health plans maintained by the same plan sponsor. All group health plans maintained by the same plan sponsor and all health insurers and HMOs that insure the plans benefits, with respect to protected health information created or received by the insurers or HMOs that relates to individuals who are or have been participants or beneficiaries in the group health plans C.F.R (c)(5) C.F.R (g) C.F.R (f) C.F.R (g) C.F.R C.F.R C.F.R Pub. L ; 42 U.S.C. 1320d Pub. L ; 42 U.S.C. 1320d C.F.R C.F.R Fully insured health plans should use the amount of total premiums that they paid for health insurance benefits during the plan s last full fiscal year. Self-insured plans, both funded and unfunded, should use the total amount paid for health care claims by the employer, plan sponsor or benefit fund, as applicable to their circumstances, on behalf of the plan during the plan s last full fiscal year. Those plans that provide health benefits through a mix of purchased insurance and self-insurance should combine proxy measures to determine their total annual receipts. OCR Privacy Rule Summary 23 Last Revised 05/03

49

50

51

52

53

54

55

56

57

58