(a) As necessary, adhering to the privacy and security requirements for protected health information and medical records under federal HIPAA and State MCMRA and making the transmission of all electronic information compatible with the federal HIPAA requirements;

(b) Providing training and information to employees regarding confidentiality obligations as to health and financial information and securing acknowledgement of these obligations from employees to be involved in the contract; and

(c) Otherwise providing good information management practices regarding all health information and medical records.

34.2 Based on the determination by the Department that the functions to be performed in accordance with the Services to Be Performed set forth in Part I constitute business associate functions as defined in HIPAA, the selected offeror shall execute a business associate agreement as required by HIPAA regulations at 45 CFR §164.501 and set forth in Appendix L. The fully executed business associate agreement must be submitted within 10 working days after notification of selection, or within 10 days after award, whichever is earlier. Upon expiration of the ten-day submission period, if the Department determines that the selected offeror has not provided the HIPAA agreement required by this solicitation, the Procurement Officer, upon review of the Office of the Attorney General and approval of the Secretary, may withdraw the recommendation for award and make the award to the next qualified offeror.

34.3 Protected Health Information as defined in the HIPAA regulations at 45 CFR 160.103 and 164.501, means information transmitted as defined in the regulations, that is individually identifiable; that is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and that is related to the past, present, or future physical or mental health or condition of an individual, to the provision of healthcare to an individual, or to the past, present, or future payment for the provision of healthcare to an individual. The definition excludes certain education records as well as employment records held by a covered entity in its role as employer.

(This clause should be added to contracts were there is a strong possibility of unskilled or entry level employment. The actual DHR Agreement must be included in the solicitation as an Appendix item. Delete if not applicable.)

########## 35. Hiring Agreement

By submitting a bid or proposal in response to this solicitation, the Bidder/Offeror agrees to execute and comply with the enclosed Maryland Department of Human Resources (DHR) Hiring Agreement (Attachment ). The Hiring Agreement is to be executed by the Bidder/Offeror and delivered to the procurement officer within ten days following receipt of Notice by the Bidder/Offeror that it is being recommended for contract award. The Hiring Agreement will become effective concurrently with the award of the contract.

The Hiring Agreement provides that the contractor and DHR will work cooperatively to promote hiring by the contractor of qualified entry-level Maryland Temporary Case Assistance customers to fill entry-level job openings resulting from this procurement, in accordance with §13-224, State Finance and Procurement Article.

(This clause should be added to contracts when there is the probability of customers with limited ability in speaking English. Delete if not applicable.)

########## 36. Limited English Proficiency

50