(technical element) and \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (financial element), which are incorporated into this contract by reference.

Note: Incorporation by reference does not necessarily create a public record permissible for disclosure.

(The following clauses may be required under certain funding or other conditions. Use these clauses only when appropriate. Delete any clauses not used and renumber as needed.)

(Mandatory clause for Federally funded contracts involving healthcare entities or individuals, the employment of healthcare entities or individuals, or subcontracting with healthcare entities or individuals that may be named on the DHHS List of Excluded Individuals/Entities.)

########## 33 Federal Department of Health and Human Services (DHHS) Exclusion Requirements

The Contractor agrees that it will comply with federal provisions (pursuant to §§1128 and 1156 of the Social Security Act and 42 CFR 1001) that prohibit payments under certain federal health care programs to any individual or entity that is on the List of Excluded Individuals/Entities maintained by DHHS. By executing this contract, the Contractor affirmatively declares that neither it nor any employee is, to the best of its knowledge, subject to exclusion. The Contractor agrees, further, during the term of this contract, to check the List of Excluded Individuals/Entities prior to hiring or assigning individuals to work on this contract, and to notify OOE immediately of any identification of the contractor or an individual employee as excluded, and of any DHHS action or proposed action to exclude the contractor or any contractor employee.

(HIPAA Clauses. One of these clauses should be used whenever the contract deals with medical information/records, third party clients or medical billing/payments. Delete any/all clauses if not applicable.)

(Use this clause when the DHMH unit is not a covered entity. The blank at the beginning would reference any statutory requirement unique to the DHMH unit/program, or, if there is none, the first two sentences are combined to reference 'any applicable State…' )

########## 34 Confidentiality

The Contractor agrees to keep information obtained in the course of this contract confidential in compliance with \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_. The Contractor agrees further to comply with any applicable State and federal confidentially requirements regarding collection, maintenance and use of health and financial information. This includes, where appropriate, the federal Health Insurance Portability and Accountability Act (HIPAA, 42 U.S.C. § 1320d et seq. and implementing regulations at 45 CFR Parts 160 and 164) and the Maryland Confidentiality of Medical Records Act (Md. Code Ann. Health- General §§4-301 et seq., MCMRA). This obligation includes providing training and information to employees regarding confidentiality obligations as to health and financial information and securing acknowledgement of these obligations from employees to be involved in the contract. This obligation further includes restricting use and disclosure of the records, generally providing safeguards against misuse of information, keeping a record of any disclosures of information, providing all necessary procedural and legal protection for any disclosures of information, promptly responding to any requests by the Agency for information about its privacy practices in general or with respect to a particular individual, modifying

48