### 

## DEPARTMENT OF ADMINISTRATIVE SERVICES

**DIVISION 55**

**STATE PURCHASING**

**125-055-0005**

**Definitions**

As used in OAR 125-055-0005 to 125-055-0045: 

(1) "Agency" means a public agency, as defined in ORS 279.835(4). 

(2) “Community Rehabilitation Program” (CRP) means a nonprofit agency for individuals with disabilities providing or facilitating one or more of the following services to individuals with disabilities, enabling them to maximize their opportunities for employment: 

(a) Medical, psychiatric, psychological, social, and vocational services; 

(b) Physical, occupational and recreational therapy; 

(c) Speech, language, and hearing therapy; 

(d) Assessment for determining eligibility and vocational rehabilitation needs; 

(e) Job development, placement, and retention services; 

(f) Psychosocial rehabilitation services; 

(g) Supported employment services; 

(h) Services to family members, if necessary, to enable the applicant or eligible individual to achieve an employment outcome; and 

(i) Personal assistance services. 

(3) "Competitive Employment" means work performed by an individual in the competitive labor market on a full-time basis with no more than reasonable accommodation (as required by the Americans with Disabilities Act, 42 USC §§12101 to 12213) for which the individual is compensated within the range of customary wages and levels of benefits paid in the community for the same or similar work performed by individuals who are not disabled. 

(4) “Department” means the Oregon Department of Administrative Services. 

(5) "Individual with a Disability," as defined in ORS 279.835(3), means a person who has a physical or mental impairment (a residual, limiting condition resulting from an injury, disease or congenital defect) that so limits the person's functional capabilities (such as mobility, communication, self-care, self-direction, work tolerance or work skills) that the individual is not able to engage in normal competitive employment over an extended period of time and, as a result, must rely on the provision of specialized employment opportunities. 

(6) "Price" means the cost to Agencies of the products and services procured through the QRF Program, as determined under OAR 125-055-0030. 

(7) "Procurement List" means a listing of those QRFs currently qualified under OAR 125-055-0015 to participate in the QRF Program and includes, as required by ORS 279.850(1), a list of the products and services offered by QRFs and determined by the Department, under OAR 125-055-0020, to be suitable for purchase by Agencies. 

(8) "Qualified Rehabilitation Facility (QRF)" means a nonprofit corporation operating as a CRP: 

(a) Organized under the laws of the United States or of this state and operated in the interest of Individuals with a Disability, and the net income of which does not inure in whole or in part to the benefit of any shareholder or other individual; 

(b) That complies with any applicable occupational health and safety standard required by the laws of the United States or of this state; and 

(c) That in the manufacture of products and in the provision of services, whether or not the products or services are procured under the QRF Program, during the fiscal year employs Individuals with a Disability for not less than 75 percent of the total work hours of direct labor required for the manufacture or provision of the products or services. 

(9) “QRF Program” means the program created by ORS 279.835 to 279.855. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0010**

**Policy**

(1) As required by ORS 279.850(1), Agencies that intend to procure a product or service that is listed on the Procurement List must procure that product or service, at the Price determined by the Department, from a QRF if the product or service is of specifications appropriate to the Agency's procurement needs and is available within the time required by the Agency. 

(2) It is the policy of the Department to assist QRFs by administering a program to: 

(a) Identify contracting opportunities in the public sector for QRFs; 

(b) Ensure that QRFs meet the standards set forth in the QRF Program; and 

(c) Assist and facilitate Agencies in entering into contracts with QRFs for the provision of products and services. 

(3) In administering the QRF Program, the Department, Agencies and QRFs must keep in mind the purpose of the law: to encourage and assist Individuals with a Disability to achieve maximum personal independence through useful and productive gainful employment by assuring an expanded and constant market for QRF products and services. 

(4) In promoting the policy of this section and ORS 279.850(2), the Department’s Chief Procurement Officer (CPO) may appoint uncompensated volunteer members to serve on an advisory council to make recommendations to the CPO concerning the facilitation and administration of the QRF Program. The CPO's authority to appoint advisory council members includes the authority to remove and replace members in the CPO’s sole discretion. Meetings of the advisory council are not subject to the public meetings law (ORS 192.610 to 192.710). However, the Department will post notice of the times and places of meetings of the advisory council on a website maintained by the Department. The Department reserves the right to change the meeting time and place after the posting of the meeting notice. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10

**125-055-0015**

**Application for QRF Participation**

(1) A CRP that seeks to participate in the QRF Program must submit a complete application to the Department on a Department-prescribed form. Exhibits submitted with the application must include: 

(a) IRS 501(c)(3) letter; 

(b) Articles of Incorporation; 

(c) Bylaws; 

(d) Mission Statement; 

(e) A description of how the applicant is operating as a CRP; and 

(f) A written plan for the applicant’s compliance with the direct labor requirement of ORS 279.835(5). 

(2) The Department reserves the right to require applicants to provide additional information. 

(3) If the Department determines that the applicant is qualified, it will send the applicant notice of QRF status. If the Department does not find the applicant qualified, it will reject the application and notify the applicant in writing of the criteria not satisfied. 

(4) The applicant may submit a written appeal to the Department within ten (10) calendar days of the date of the rejection notice. The appeal must state the error in the Department’s decision. If the applicant does not appeal the Department’s decision, the decision is final. 

(5) On appeal, if the Department determines the applicant is then qualified, it will send written notice to the applicant of QRF status. If the Department finds no error in its determination, it will provide the applicant a written notice confirming the decision. The Department’s written notice under this subsection constitutes a final order under ORS 183.484. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0016**

**QRF Status and Annual Reporting**

(1) A QRF is required, during the QRF's fiscal year, to employ Individuals with a Disability for not less than 75 percent of the total work hours of direct labor required for the manufacture or provision of all products or services produced by the QRF. The 75 percent direct labor requirement need not be met with respect to each product or service provided by the QRF, or with respect to each contract the QRF enters into under the QRF Program. 

(2) All participating QRFs must submit, on a Department-prescribed form, information from their preceding fiscal year. The Department will evaluate this information to determine compliance with ORS 279.835(5). 

(3) The QRF must submit its annual report to the Department within 120 calendar days after the close of the QRF's fiscal year. 

(4) A QRF may request an extension in writing prior to the 120-day deadline. The request must state the reason for the extension and the anticipated date of submission. 

(5) The Department will evaluate the annual report for accuracy and compliance with ORS 279.835(5). If the Department determines that the QRF meets the requirements, it will send written notice of qualification to the QRF. 

(6) If the Department determines that a QRF is noncompliant with any requirements of ORS 279.835(5), the Department will issue a written notice to the QRF. The written notice will state the reasons the QRF is not compliant and provide potential remedies. 

(a) A QRF receiving notice of noncompliance under this subsection must respond to the Department within thirty (30) calendar days of the date of the Department's notice. The QRF’s response must acknowledge receipt of the notice and describe a corrective action plan. 

(b) If the QRF does not respond within thirty (30) calendar days from the date of the written notice, the Department will issue to the QRF written notice of the proposed termination of the QRF’s participation in the QRF Program. The Department’s written decision under this subsection constitutes a final order under ORS 183.484. 

(c) The Department may require the QRF, as part of the required cure, to submit to the Department quarterly audit reports concerning the direct labor requirement of ORS 279.835(5). The Department may require the quarterly audits to be conducted and reported by a CPA in accordance with OAR 125-055-0035. 

(7) If the QRF fails to achieve compliance within the time prescribed by the Department, the QRF will receive a written notice of termination. 

(a) The QRF may submit a written appeal to the Department within ten (10) calendar days of the date of the termination notice. The appeal must state the QRF's grounds for appealing the decision. If the QRF does not appeal the Department's decision, the termination of the QRF’s participation in the QRF Program is final. 

(b) On appeal, if the Department determines the QRF is then qualified, it will send the QRF notice of qualification. If the Department does not find the QRF qualified, it will provide the QRF a written decision that states the reasons for that determination. The Department's written decision under this subsection constitutes a final order under ORS 183.484. 

(8) After any termination of a QRF's participation in the QRF Program, the QRF may not enter into or renew any contracts under the QRF Program. Termination of QRF status also constitutes sufficient grounds for an Agency to terminate any contract procured under the QRF Program. The Department will post notice of the termination of a QRF’s participation in the QRF Program on the website or other accessible online posting address administered through the Department. The QRF may re-apply no earlier than one year from the date the termination became final. 

(9) Nothing in this rule may be construed as prohibiting the Department and the QRF from resorting to informal dispute resolution measures such as non-binding arbitration or mediation. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0017**

**Record Keeping**

(1) All participating QRFs must maintain current records for each Individual with a Disability employed by the organization. The records must contain the disability documentation source and when required, a Competitive Employment statement. A Competitive Employment statement is not required for Individuals with a Disability qualified by the Social Security Administration due to their disability. 

(a) Competitive Employment Statement. The Competitive Employment statement is a Department form signed by the QRF executive and prepared by a person qualified by training and experience to evaluate the work potential, interests, aptitudes and abilities of Individuals with a Disability. 

(b) Acceptable Disability Documentation Sources: 

(A) A letter on United States Veterans Administration letterhead stating that the individual has been determined eligible for vocational services due to his or her disability; 

(B) A letter on Social Security Administration letterhead stating the individual is eligible for benefits due to his or her disability; 

(C) Documentation from the Oregon Department of Human Services (DHS) or a DHS-designated Community Developmental Disability Program that the individual has an existing disability. “Community Developmental Disability Program” means an entity that is responsible for planning and delivery of services for individuals with developmental disabilities operated by or under a contract with the DHS, Seniors and People with Disabilities Division or a local mental health authority; 

(D) Documentation from the Oregon Commission for the Blind that the individual has been determined to have a disability; 

(E) Documentation from a Qualified Mental Health Professional that the individual is determined to have mental illness. A “Qualified Mental Health Professional” means any person meeting the following minimum qualifications as defined in OAR 309-114-0005: 

(i) Graduate degree in psychology;

(ii) Bachelor’s or graduate degree in nursing and licensed in the State of Oregon; 

(iii) Graduate degree in social work or counseling; 

(iv) Graduate degree in a behavioral science field; 

(v) Graduate degree in recreational art, or music therapy; 

(vi) Bachelor’s degree in occupational therapist and licensed by the State of Oregon; or 

(vii) Bachelor’s or graduate degree in a relevant area. 

(F) Documentation on the Department’s “Documentation of Disability” form signed by a medical professional. “Medical Professional” means an individual licensed by: 

(i) The Oregon Medical Board; 

(ii) The Oregon Board of Naturopathic Medicine; 

(iii) The Oregon State Board of Nursing as a Nurse Practitioner; or 

(iv) The State Board of Psychologist Examiners. 

(2) To the full extent permitted by law, a QRF must make its records available for inspection by the Department, the Office of the Oregon Secretary of State and their officers and representatives. 

(3) If a QRF, its officers, employees or agents, knowingly make any false, fraudulent or untrue statement or representation in any application, certification or record required or authorized to be created, maintained or submitted under OAR 125, chapter 055, the Department may invoke the procedures authorized by OAR 125-055-0016(6) and (7) to secure appropriate action, including but not limited to requiring the correction or cure of the violation or the termination of the QRF’s participation in the QRF Program. In determining the sanction, the Department may consider the magnitude, number, and impact of the false statements or representations. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0020**

**Determination of Suitability of Product or Service**

(1) The Department will publish and maintain a Procurement List that identifies the products and services of QRFs suitable for procurement by Agencies. No Agency or QRF may enter into or renew a contract under the QRF Program for products or services not on the Procurement List. QRF products and services determined suitable will remain listed, subject to the Department’s examination of the QRF's annual report and compliance with subsection (2). 

(2) For a product or service to be suitable for addition to the Procurement List, each of the following criteria must be satisfied: 

(a) QRF Status. The organization’s QRF status must be current. 

(b) Ownership. A QRF must own the product or directly provide the service the QRF proposes to provide to Agencies through the QRF Program. For example, a product or service will not be suitable for procurement by Agencies where the QRF operates merely as a broker, distributor, licensor or sales agent for another person or entity in providing a product to an Agency. 

(c) Tied Products. A QRF's contract to provide a service cannot obligate an Agency to buy a product tied to that service unless the product is incidental to, or consumed in, the performance of the service. 

(d) No Excessive Prices. The price proposed by the QRF must not be excessive. When proposed pricing is determined by the Department to be excessive, the Department may require the QRF to demonstrate that the proposed pricing is not excessive. 

(e) Purpose. The QRF must demonstrate capacity to address the policy of the law as stated in ORS 279.840. To ensure that a QRF achieves this goal, the QRF must disclose to the Department: 

(A) The projected employment potential for Individuals with a Disability in connection with the proposed product or service; and 

(B) That appreciable value will be added to the products or services by Individuals with a Disability. The term "appreciable value" means a measurable addition of value, or an objectively observable improvement, enhancement or change, to the final product or service. No product or service may be suitable where the process of the manufacture, assembly or production of the product or the rendition of the service contains or is affected by any procedure, device or artifice under which the work of individuals with disabilities does not contribute, in a substantial, economically meaningful manner, to the value of the product or to the performance of the service, or under which the work of Individuals with a Disability is not a logical element of the chain of production. 

(f) Compensation. Individuals with a Disability must be compensated for their work at a rate of pay that is consistent with the applicable legal requirements of the state and federal governments. 

(g) Subcontractor Disclosure. Direct labor performed by subcontractors in the manufacture of a product or provision of a service to an Agency must be disclosed in the QRF’s direct labor ratios reported to the Department as required by OAR 125-055-0016(1). The QRF must disclose subcontractor utilization, partnerships or planned joint ventures, including: 

(A) the portion of the labor to be performed; 

(B) the equipment to be used or supplied by; and 

(C) the location of work performed by any subcontractor, partner or joint venturer (collectively, "subcontractor"). 

(h) Quality Standards and Delivery Schedules. The QRF must demonstrate the capability to meet the applicable specifications and to make the product or service available within the time required by the procuring Agency. 

(i) Additional Information. The Department reserves the right to request additional information such as start-up costs and estimated cost recovery, market research conducted by the QRF, and physical location of business space dedicated to the product or service. The Department may conduct on-site investigations of the QRF's work sites and production processes. 

(3) If the Department determines the product or service satisfies the criteria in subsection (2), it will notify the QRF of its decision. If the Department determines that the product or service does not satisfy the criteria in subsection (2), it will notify the QRF in writing of the criteria not satisfied. 

(4) The QRF may appeal the decision by submitting a written appeal to the Department within ten (10) calendar days from the date of the Department’s notice. The appeal must state the QRF's grounds for appealing the decision. On appeal, if the Department determines the product or service satisfies the criteria of subsection (2), it will notify the QRF of its decision. If on appeal, the Department does not find the product or service satisfies the criteria, it will provide the QRF a written decision stating the reasons for the determination. The Department's written decision under this subsection will constitute a final order under ORS 183.484. 

(5) The Department will post the suitability determination on the Department’s website and e-procurement system for thirty (30) calendar days. A person or entity who will be adversely affected by the listing in its ability to compete for public contracts for the proposed product or service may submit a written protest to the Department before the listing is effective. The protest must describe how the listing will adversely affect the person's or entity's ability to compete for public contracts for the proposed product or service and must demonstrate how the product or service fails to satisfy the criteria stated in subsection (2). The listing will become effective on the thirty-first day. 

(6) If the Department receives a written protest concerning the proposed listing, the Department will consider the protest and issue a written response to the protesting party. The Department will only consider protests made in writing and received before the close of business on the thirtieth day. In considering a timely protest, the Department may request further information from the protesting party and the QRF. 

(a) The Department's response to the protest will confirm, modify, or withdraw the proposed listing of the product or service. The Department will make its written determination available, by mail or by electronic means, to the protesting party and to the QRF.

(b) A protesting party or QRF who is adversely affected or aggrieved by the Department's response under this subsection may request that the Department institute contested case proceedings under ORS 183.411 to 183.470. A written request for a contested case must be received by the Department within fourteen (14) calendar days of the date of the Department’s response. The request for a contested case must describe how the requesting party is adversely affected or aggrieved by the response and how the Department erred in its decision. The Department may grant or deny the request. If the Department grants the request, the contested case will be limited to the issues raised before the Department in the protest. 

(7) At any time during the suitability determination process, the Department, QRF and protesting party may agree to informal dispute resolution measures such as non-binding arbitration or mediation in addition to the appeal procedures prescribed by subsections (4) through (6). 

(8) Existing Contractor. The placement of a product or service on the Procurement List will not operate to displace a contractor under an existing contract with an Agency. 

(9) Amending an Existing Suitability Determination. The QRF may submit a written request to the Department for modification of an existing suitability determination. The request must satisfy the criteria in subsection (2). 

(a) If the Department determines the information provided by the QRF satisfies the criteria in subsection (2), it will record an amendment to the existing suitability determination. The Department will follow the posting requirements of subsection (5). 

(b) If the Department determines the information provided by the QRF does not satisfy the criteria of subsection (2), it will send notice to the QRF. The QRF may appeal the Department’s decision under the process described in subsections (4) and (7). 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0025**

**Review of Suitability Determinations**

(1) The Department reserves the right to review suitability determinations as changes in rules, laws, market conditions and QRF contractor performance occur. Information that was not available to the Department during the initial determination that negatively impacts the suitability of the product or service may also cause a review. The review may result in removal of the product or service from the Procurement List. A QRF may appeal a decision to remove a product or service from the Procurement List in the manner provided in OAR 125-055-0020(4). 

(2) An Agency and a QRF may not alter the character or scope of the product or service so that it no longer is essentially the same product or service that was the subject of the suitability determination. In cases where such a change is sought, the Agency or the QRF must first request and receive from the Department a new or amended determination that the product or service, as changed, is suitable under OAR 125-055-0020(2). In cases where the change in specifications or amendment appears to affect the Price of a product or service as determined under OAR 125-055-0030, the Department also may conduct a new Price determination in response to the request. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0030**

**Determination of Price**

(1) Under ORS 279.845(1)(a), the Department will determine the Price of QRF products and services placed on the Procurement List. 

(2) The Price determined by the Department will be a reasonable and adequate Price that will recover for the QRF the cost of: 

(a) Raw materials; 

(b) Labor; 

(c) Overhead that can be allocated to the particular product or service for which the Price determination is being made, including the actual, reasonable costs of complying with the independent audit requirements of OAR 125-055-0035; 

(d) Delivery costs, which include the transportation of a product to the site designated by the Agency or the transportation of workers to and from a site at which they will perform services for a customer; and 

(e) An amount held in reserve for inventory and equipment replacement. 

(3) The QRF must submit its proposed Price to the Department based on the volume or scope of the work and specifications acceptable to the Agency. The Department reserves the right to review and amend a Price determination in light of reductions in or additions to the number of Agencies served under a multiple agency contract. 

(a) In submitting its proposed Price, the QRF must make full disclosure of known costs. The disclosure must include documentation on a form prescribed by the Department. The Department may require additional information. The disclosed costs must reflect a Price that will permit the QRF to recover the amounts prescribed in subsection (2) and ORS 279.845(1)(a). 

(b) If the QRF and the Agency agree on the terms and conditions of a proposed contract and the Price for the products or services to be provided under the proposed contract, the QRF and the Agency must present the proposed contract (including the agreed Price) to the Department for review and a determination of the Price. 

(4) Based on the volume or proposed scope of work and the costs disclosed by the QRF under subsection (3), the Department will determine a Price for the products or services offered under the proposed contract. Based on the disclosed costs, the Department will determine a Price to be reasonable and adequate to permit the QRF to recover the amounts prescribed in subsection (2). The Department will notify the QRF and the Agency of the Price. 

(5) In determining a reasonable and adequate Price of a product or service, the Department may consider: 

(a) Prices of similar products or services purchased in comparable quantities by federal agencies under the Javits-Wagner-O'Day Act, 41 USC Sec. 46 to 48c; 

(b) Prices of products or services of similar specifications and quantities previously purchased by Agencies from responsible contractors engaged in the business of selling similar products or services; 

(c) Prices that private businesses pay for similar products or services in similar quantities of comparable scope and specifications if purchasing from a reputable vendor engaged in the business of selling similar products or services; and 

(d) Prices of products or services of similar specifications and quantities purchased by Agencies from other QRFs. 

(6) QRFs and Agencies may not execute or implement any contract under the QRF Program until the Department has transmitted its notice of the Price determination. 

(7) Re-determination of Price. The Department may re-determine a Price at the request of a QRF, an Agency or at the discretion of the Department. Until the Department approves a new Price, the QRF must continue to provide the service or product at the existing Price. The Agency may not pay or agree to pay the QRF any amount other than the Price approved by the Department. The Department reserves the right to suspend the Price and set an interim Price. This re-determination may trigger a review of the suitability determination for the affected product or service under OAR 125-055-0025.

(a) In re-determining Price, the Department may consider the factors in subsections (2) and (3). The Department also may take into consideration changes that have taken place since the last Price determination that are pertinent to re-determining Price.

(b) Each re-determination of Price shall be based on changes in the scope of work, changes in the costs of producing the product or performing the service, or both. If the proposed re-determination is based on changes in QRF cost factors, the QRF must submit to the Department and the Agency a request for a Price change showing a breakdown of cost changes with appropriate documentation, as requested by the Department or Agency. 

(c) Agencies and QRFs may not make material changes to the specifications of a contract entered into under the QRF Program unless the changes are in writing and have been submitted to the Department for a re-determination of Price. 

(d) The Agency and QRF, in order to assist the Department in Price re-determinations, must submit to the Department the specific changes in the scope of work or other conditions which will be required during the contract period. 

(e) The QRF must submit a Price recommendation to the Agency and the Department for review and re-determination of Price as described in subsection (3). 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279.015(1)(b) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0035**

**Direct Labor Audits**

(1) If a QRF’s gross revenues generated under the QRF Program exceed $100,000 annually, the QRF must conduct an independent audit of direct labor to maintain qualifications and listing on the Procurement List. Independent audits must be conducted every other year as scheduled by the Department to determine compliance with ORS 279.835(5)(c). The audit must be conducted by an independent certified public accountant (CPA) in accordance with generally accepted auditing principles. The QRF must submit a letter of attestation and the compilation worksheet to the Department 120 calendar days after the close of the QRF's fiscal year. A QRF may request an extension in writing prior to the 120-day deadline. The request must state the reason for the extension and the anticipated date of submission. 

(2) For purposes of subsection (3): 

(a) "Direct labor" means all work required for the manufacture, preparation, processing and packing of products produced by a QRF and all work performed in rendition of services by a QRF. Direct labor does not include supervision, administration, shipping, or client-type services provided by a QRF to Individuals with a Disability served by the QRF, such as job training and therapeutic services. 

(b) "Supervision" means the direction, assignment, instruction and oversight of individuals performing direct labor and inspection of work performed or products for quality assurance. 

(c) "Administration" means the management activities of a QRF that include acquisition of equipment, parts, supplies and inventory, handling of the entity's payroll, personnel and accounting activities, executive decision-making and other business activities, generally of a centralized nature, that do not entail the "hands-on" production of a product or the performance of a service. 

(d) "Shipping" means the transportation of a product to the site designated by the acquirer of the product or the transportation of workers to and from the site at which they will perform services for a customer. 

(3) The examination and resulting audit report must be based on the following records and information: 

(a) A listing of all products and services provided by the entity in the QRF's fiscal year, including those products and services procured by Agencies under the QRF Program and those procured outside the QRF Program; 

(b) A list of all individuals covered by the audit scope employed by the QRF that are Individuals with a Disability who provided direct labor for the production of products or the performance of services during the fiscal year that is the subject of the audit examination, including employee name, unique employee identification number, job description and disability status; 

(c) A list of all individuals covered by the audit scope employed by the QRF, whether paid or unpaid, who are not Individuals with a Disability and provided direct labor required for the production of products or the performance of services during the fiscal year that is the subject of the audit examination, including employee name, unique employee identification number and job description; 

(d) A compilation of the total hours of direct labor performed by the QRF during the fiscal year; 

(e) Payroll reports for all individuals covered by the audit scope employed by the QRF during the fiscal year, including employee name, work hours paid, vacation hours, sick leave hours and training hours. Hours worked must be segregated from hours paid but not worked; 

(f) Time and billing records showing direct hours worked by each employee in the manufacture of goods or provision of services; 

(g) The QRF must have documentation of disability on file for each employee who is claimed to be an Individual with a Disability. The acceptable forms of disability documentation are defined in OAR 125-055-0017(1)(b); and 

(h) A Competitive Employment statement must be on file for each employee who is claimed to be an Individual with a Disability, except as described in OAR 125-055-0017(1). 

(4) The audit report must address the following elements: 

(a) A determination whether the QRF's time, billing and payroll records are sufficiently complete and reliable to demonstrate compliance with the 75 percent direct labor requirement of ORS 279.835(5)(c). The records must permit segregation of direct labor hours from other hours worked and paid, and allow for the assessment of direct hours worked by employees with disabilities, as well as by employees without disabilities; 

(b) If the CPA finds the records to be sufficiently complete and reliable, the CPA must test the QRF's calculations of total direct labor hours worked by employees with disabilities for the entire applicable fiscal year. Only direct labor hours worked may be included in the calculations. Vacation, sick leave, holiday, training hours and any other hours paid but not worked by the employee must be excluded from the calculation; 

(c) The CPA must apply sufficient statistical sampling techniques to obtain an 80 percent level of confidence that: 

(A) The direct labor by Individuals with a Disability during the QRF's fiscal year satisfied the 75 percent direct labor requirement under ORS 279.835(5)(c); and 

(B) The hours reported as worked by Individuals with a Disability were worked by individuals whose disabilities were documented under subsection (3)(g). 

(d) A determination whether adequate actions have been taken to resolve any prior adverse audit report findings or recommendations; and 

(e) The CPA that conducted the direct labor audit must sign an attestation that the QRF complied or did not comply with the 75 percent direct labor requirement of ORS 279.835(5)(c) during the applicable fiscal year. If the CPA attests that the QRF did not comply with the requirement of ORS 279.835(5)(c), the report must include a concise description of the nature and extent of the noncompliance. 

(5) The letter of attestation must be signed and dated by the CPA and by an officer of the QRF's board of directors. 

(6) Failure to comply with the requirements of ORS 279.835(5)(c) by a QRF constitutes sufficient grounds to terminate the QRF’s participation in the QRF Program and constitutes sufficient grounds for an Agency to terminate, or to suspend performance of the work under, a contract with the QRF. 

(7) The cost of the audit required by this rule is an overhead expense that the QRF may recover and which must be taken into account in determining the Price under OAR 125-055-0030.

(8) If the Department determines that a QRF is in material noncompliance with any requirement imposed on it by this rule, including the direct labor requirement of ORS 279.835(5)(c), the Department will issue to the non-complying QRF a written notice to cure the noncompliance. The written notice will state the reasons that the QRF is not in compliance and provide potential remedies. 

(a) A QRF receiving notice of noncompliance under this subsection must respond to the Department within thirty (30) calendar days of the date of the Department's notice. The QRF’s response must acknowledge receipt of the notice and describe a corrective action plan. 

(b) If the QRF does not submit a written response within thirty (30) calendar days from the date of the written notice or such additional time as may be permitted by the Department, the Department may issue, to the QRF, written notice of the proposed termination of participation in the QRF Program. 

(c) The Department reserves the right to require a QRF to submit to the Department quarterly audit reports concerning the QRF's compliance with the direct labor requirement of ORS 279.835(5)(c). The Department may require, at its discretion, that the quarterly audits be conducted and reported by a CPA in accordance with subsection (5). If a QRF subject to this requirement satisfies the direct labor requirement in the first two consecutive quarterly audits, the Department may waive the quarterly audit requirement for that QRF. 

(d) If the QRF fails to achieve compliance within the time prescribed in the Department's written notice, the Department may terminate the QRF's participation in the QRF Program. The Department will issue to the QRF a written notice of termination. 

(e) After termination of QRF status, the QRF may not enter into or renew any contracts under the QRF Program. Termination of the QRF's participation in the QRF Program constitutes sufficient grounds for any Agency to terminate any contract with the QRF. 

(f) One year after the effective date of termination of QRF status, a CRP may re-apply for QRF status under OAR 125-055-0015 and listing on the Procurement List under OAR 125-055-0020. 

(9) If a QRF fails the direct labor requirement of ORS 279.835(5)(c), that QRF will be required to submit an independent audit report the following year. If the subsequent annual audit discloses that the QRF failed to satisfy the direct labor requirement, the Department will issue a notice of termination to the QRF. 

(10) The QRF may submit a written appeal to the Department within ten (10) calendar days from the date of the notice of termination issued under subsection (8)(d). The appeal must state the QRF's grounds for appealing the decision. If the QRF does not appeal the Department's decision, termination of participation in the QRF Program is final. 

(11) On appeal, if the Department determines that the QRF complied with the direct labor requirement of ORS 279.835(5)(c), it will notify the QRF of its decision. If on appeal, the Department determines that the QRF failed to comply with the direct labor requirement of ORS 279.835(5)(c), it will provide the QRF a written decision stating the reasons for the determination. The Department's written decision under this subsection constitutes a final order under ORS 183.484. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10 

**125-055-0040**

**General Provisions**

(1) Contracting Authority. The Department and other Agencies must contract directly with a QRF for a contract to qualify for the exception from the competitive procurement requirement in ORS 279A.025 for contracts under the QRF Program. Contracts between multiple Agencies and a QRF satisfy this requirement that the Agencies must contract directly with a QRF. 

(2) Contract Disputes. Contract performance issues and disputes arising out of contracts entered into under the QRF Program, such as disputes concerning timely delivery of products or performance of services or compliance with specifications, must be resolved exclusively between the QRF and the Agency that is a party to the contract, and will not be resolved by the Department (except where the Department is a party to the contract with the QRF). 

(3) Temporary Services for State Agencies. In each contract for the provision of temporary services entered into by a state agency under the QRF Program, the QRF must monitor the prior and current work assignments of its employees who work under the contract to ensure that no employee performs services for the state in excess of a total of 1,040 hours in a 12-month period. A QRF temporary service provider must obtain a written statement from the employee attesting to the total hours worked as a temporary employee for any state agency during the last 12 months. A state agency filling behind an employee on approved leave may continue beyond 1,040 hours in a 12-month period only when the temporary employee replaces a single employee on approved leave. The temporary appointment may not exceed the period of the approved leave. 

(4) Competitive Public Contract Bidding by a QRF. If a QRF submits, to any Agency, a competitive bid, proposal, quote or other offer in a competitive procurement for a public contract that is not subject to ORS 279.850(1)(c), then regardless of whether the offer was accepted, that QRF may not, at any time during the initial term of the contract for which the QRF submitted a competitive offer, make any claim to the Agency that instituted the procurement for the contract that the product or service that was the subject of the offer should have been subject to the requirements of the QRF Program. 

(5) An Agency may conduct a competitive procurement for a product or service between or among two or more QRFs under ORS 279.850(1)(c). In the procurement, the Agency may give a preference to a QRF that best demonstrates that the QRF: 

(a) Complies with all applicable local ordinances and resolutions that govern labor standards; and 

(b) Provides wages, health care benefits, alternative dispute resolution services, and pension or other retirement arrangements that are better, in the aggregate, than the average wages, health care benefits, alternative dispute resolution services, and pension or other retirement arrangements that private employers provide to employees performing the same or similar job duties in the relevant industry in the county in which the selected QRF will deliver the products or perform the services. 

(c) The Agency may grant the preference authorized by ORS 279.850(1)(c) by using the factors described in subsections (a) and (b) of this section as criteria for which the Agency may award comparative evaluation points, percentages, or values in conducting the substantial equivalent of a request-for-proposals competition. 

(d) In no event, however, may the amount or percentage preference given to a QRF proposer exceed 15 percent of the maximum number or percentage of evaluation points or values the Agency prescribes in the Agency’s solicitation of offers in the competition. 

(6) When an Agency terminates a QRF contract for services (as defined in OAR 125-246-0110) and enters into a new contract with a successor QRF to replace or substantially replace the terminated contract, the Agency must provide in the new contract that the successor QRF must, throughout a period that ends no fewer than 90 days after the effective date of the new contract, offer employment to those individuals with disabilities who were working under the terminated contract at the time of termination. The new contract must require the offer of employment: 

(a) At wages at least as favorable as those afforded the individuals with disabilities under the terminated services contract; and 

(b) For individuals with disabilities who work 28 hours per week or more, with health benefits at least as favorable as those afforded the individuals with disabilities under the terminated services contract. 

(c) The successor QRF must offer employment to the individuals with disabilities who worked under the terminated services contract in good faith and without subterfuge or artificial impediments that obstruct the hiring of the individuals. However, the successor QRF may subject those individuals to its established hiring procedures and may require the individuals to complete a probationary period to demonstrate that they meet the qualifications the successor QRF applies even handedly to new hires. 

(d) This section does not apply to a contract to replace a QRF contract that an Agency did not terminate, but which expired or otherwise ceased to be effective in accordance with its terms. 

(7) An Agency may, under ORS 279.850(2)(b), disqualify a QRF from entering into a QRF agreement with the Agency after providing the QRF notice and a reasonable opportunity to be heard in accordance with subsections (a) and (b) of this section. 

(a) The Agency must provide the QRF written notice of a proposed disqualification. The Agency shall deliver the notice by personal service or by registered or certified mail, return receipt requested. The notice must: 

(A) State that the Agency intends to disqualify or suspend the QRF under ORS 279.850; 

(B) State the reasons for the proposed disqualification; 

(C) Include a statement of the QRF’s right to a hearing if requested in writing within the time stated in the notice and that if the Agency does not receive the QRF's written request for a hearing within the time stated, the QRF will have waived its right to a hearing; 

(D) Include a statement of the authority under which the hearing will be held; 

(E) Include a reference to the particular sections of the statutes, rules, and contract provisions involved; 

(F) State the proposed disqualification period; and 

(G) State that the QRF may be represented by legal counsel. 

(b) Hearing. The Agency shall schedule a hearing in response to the Agency's receipt of the QRF's timely hearing request. Within a reasonable time prior to the hearing, the Agency must notify the QRF of the time and place of the hearing and provide information on the procedures, right of representation, and other rights related to the conduct of the hearing. 

(c) Notice of Decision. The Agency must provide written notice of the disqualification determination to the QRF. The Agency shall deliver the notice by personal service or by registered or certified mail, return receipt requested. The notice must contain: 

(A) The effective date and period of the disqualification; 

(B) The grounds for the disqualification; and 

(C) A statement of any QRF appeal rights and applicable appeal deadlines. 

(8) For the purposes of ORS 279.850, a record of “repeatedly violating” local ordinances or resolutions that govern labor standards means reliable documentation, supported by substantial evidence, that the QRF violated applicable ordinances or resolutions more than two times within the requisite period. The requisite period under this section either is: (i) within the then-current term of the QRF’s agreement with Agency; or (ii) within the previous three years. 

(9) For the purposes of ORS 279.850, local ordinances or resolutions that govern labor standards means ordinances or resolutions, duly adopted by a local government body (as defined in ORS 174.116), that regulate employee working conditions. Working conditions consist of employee: 

(a) Wage rates or salaries; 

(b) Hours of labor, work days, leave, and workplace safety conditions; 

(c) Health insurance or health care benefits; 

(d) Retirement or pension benefits; and 

(e) Dispute resolution procedures. 

(10) A QRF must not enter into a public contract with an Agency under the QRF Program unless the contract complies with OAR 125-055-0005 to 125-055-0040 and the products or services that are the subject of the contract are listed on the Procurement List. Any liabilities or expenses that may arise from the establishment of a contract that violates this subsection will be those exclusively of the QRF and Agency. 

(11) The Department reserves the right to extend any deadline or time within which a QRF or a party to any proceedings under OAR 125-055-0015 to 125-055-0040 must take any action under those rules if the affected party applies in writing for relief to the Department and demonstrates in writing that special circumstances warrant the grant of such relief. For the purpose of this subsection, special circumstances that warrant the grant of relief include emergencies that reasonably can be regarded as imposing an obstacle to the QRF's or party's ability to meet the deadline or achieve the correction of a violation of rules. Special circumstances are circumstances beyond the reasonable control of the individual or organization including, but not limited to, the illness or other incapacity of key officers of the organization seeking relief, emergency reorganizations or replacements of the corporate structure, board of directors or executive officers of the organization, acts of God and comparable practical impediments to an individual’s or organization's ability to meet a deadline or achieve the correction of a violation of rules. The grant or denial of relief under this subsection must be determined by the Department official specifically delegated that task. The Department also reserves the right to waive or to permit the correction of minor or technical violations of OAR 125-055-0015 to 125-055-0040. 

Stat. Auth.: ORS 279.845(1) & 184.340   
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855   
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10; DAS 4-2015, f. 12-29-15, cert. ef. 1-1-16

**125-055-0045**

**Purchases under ORS 279.855**

(1) QRFs, residential programs and public benefit corporations recognized by ORS 279.855 may acquire equipment, materials, supplies and services under the same conditions as state agencies that, under ORS 279A.040, are not subject to the requirement that the Department provide for their acquisition of such items. Accordingly, QRFs, residential programs and public benefit corporations must enter into an agreement with the Department in order to participate in the Oregon Cooperative Procurement Program (ORCPP). The agreement must have substantially the same form, content and obligations as the standard agreement prescribed by the Department that state agencies must execute in order to participate. In addition, QRFs, residential programs and public benefit corporations must comply with the applicable subsections of this rule to acquire equipment, materials, supplies or services under ORS 279.855. 

(2) QRFs that currently are approved under OAR 125-055-0015 may purchase equipment, materials, supplies and services through the Department in the same manner as state agencies, as provided in ORS 279A.140 to 279A.155 and 279A.250 to 279A.290. 

(3) A residential program seeking to purchase equipment, materials, supplies or services through the Department under ORS 279.855 must make a written request to the Department to which is attached a true and correct copy of its currently effective contract with the Department of Human Services to provide services to youth in the custody of the state. In addition, the residential program must submit a letter from the Oregon Department of Human Services, on the letterhead of that department or of a division of that department, that contains the following information: 

(a) The services the residential program must provide, including the scope of those services, under the currently effective contract with the Department of Human Services; 

(b) The Department of Human Services contract number; 

(c) The starting date and expiration date of the contract; and 

(d) The name, original signature, mailing address and telephone number of the Department of Human Services' Contract Administrator for the contract. 

(4) A public benefit corporation seeking to purchase equipment, materials, supplies or services through the Department under ORS 279.855 must make a written request to the Department to which is attached: 

(a) A certification by an authorized officer of the public benefit corporation that the applicant qualifies as a public benefit corporation under ORS 65.001; 

(b) A true and correct copy of documentation, which may include the corporation's currently effective articles of incorporation, that demonstrates that the corporation is tax exempt under 501(c)(3) of the Internal Revenue Code and that the corporation is not a religious corporation as defined in ORS 65.001; 

(c) A true and correct copy of at least one currently effective contract between the public benefit corporation and a state agency or unit of local government by which the corporation's contract performance is funded at least in part with state funds; and 

(d) A letter from the state agency or unit of local government that confirms the existence and effectiveness of the contract submitted under subsection (4)(c), on the letterhead of the state agency or unit of local government, that contains the following information: 

(A) The services the public benefit corporation must provide, including the scope of those services, under the contract submitted under subsection (4)(c); 

(B) The contract number; 

(C) The starting date and expiration date of the contract; and 

(D) The name, original signature, mailing address and telephone number of the state agency or unit of local government's Contract Administrator for the contract. 

(5) Neither the Department nor the State of Oregon will be liable for any obligation or debt entered into on behalf of a QRF, a residential program or a public benefit corporation, and likewise will not be liable for any obligation or debt incurred by a QRF, a residential program or a public benefit corporation, in making purchases. 

(6) Each residential program and public benefit corporation that makes any purchase of equipment, materials, supplies or services through the Department under ORS 279.855 must notify the Department in writing whenever a contract that is necessary for the organization to qualify under ORS 279.855 expires, is terminated, or is not renewed, and whenever the organization otherwise ceases to qualify under ORS 279.855 or this rule. 

Stat. Auth.: ORS 279.845(1) & 184.340  
Stats. Implemented: ORS 279A.025(4) & 279.835 - 279.855  
Hist.: DAS 4-2003, f. & cert. ef. 9-8-03; DAS 6-2004(Temp), f. & cert. ef. 12-28-04 thru 6-24-05; DAS 8-2005, f. & cert. ef. 6-21-05; DAS 3-2010, f. & cert. ef. 10-8-10

**125-055-0100**

**Purpose — HIPAA Privacy and Security Rule Implementation; HITECH Act Implementation.**

(1) The purpose of these rules is to set forth the requirements that a contractor who is a Business Associate of an Agency must abide by in order to comply with the Business Associate provisions of HIPAA and the implementing Privacy Rule and Security Rule and of the HITECH Act. The Privacy Rule and Security Rule, as amended by the HITECH Act, require an Agency, to obtain certain written assurances from a Business Associate, that the Business Associate will comply with the Business Associate requirements set forth in 45 CFR 164.502(e) and 164.504(e). The Privacy Rule requires that a Covered Entity obtain certain written assurances before the Business Associate may create, receive, maintain or transmit Protected Health Information. The requirements contained in this Rule apply both to Contracts for trade services and personal services, as defined in OAR 125-246-0110. 

(2) This Rule will be interpreted as broadly as necessary to implement and comply with HIPAA, the Privacy Rule and the Security Rule, and the HITECH Act. Any ambiguity in this Rule shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the Privacy Rule and the Security Rule, and the HITECH Act. 

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

**125-055-0105**

**Definitions**

For purposes of rules 125-055-0100 through 125-055-0130 the following terms shall have the meanings set forth below. Capitalized terms not defined herein shall have the same meaning as those terms in the Privacy Rule and the Security Rule and the HITECH Act, including, but not limited to, 42 USC Section 17938 and 45 CFR Section 160.103. 

(1) "Agency" means an agency of the State of Oregon subject to the procurement authority of DAS pursuant to ORS 279A.140 and that is: 

(a) A Covered Entity; or 

(b) A Business Associate of an Agency that is a Covered entity. 

(2) "Business Associate" has the meaning given that term in 45 CFR 160.103. 

(3) "Contract" means the written agreement between an Agency and a Contractor setting forth the rights and obligations of the parties. 

(4) "Covered Entity" has the meaning given that term in 45 CFR 160.103. 

(5) “Electronic Media” means: 

(a) Electronic storage media; and 

(b) Transmission media used to exchange information already in electronic storage media. 

(6) “Electronic Protected Health Information” has the meaning given that term in 45 CFR 160.103. 

(7) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d – 1320d-8, Public Law 104-191, sec. 262 and sec. 264. 

(8) “HITECH Act” means the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Title XIII of division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (“ARRA”), Public Law 111-5, including any implementing regulations. 

(9) “Health Care Provider” means the persons or entities that furnish, bill for or are paid for Health Care in the normal course of business, as more fully defined in ORS 192.519. 

(10) "Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E. 

(11) “Protected Health Information” has the meaning given that term in 45 CFR 160.103. 

(12) “Required by Law” has the meaning given that term in 45 CFR section 164.103. 

(13) "Rule" means this Oregon Administrative rule 125-055-0100 through 125-055-0130. 

(14) “Secretary” means the Secretary of Health and Human Services (HHS) or any other officer or employee of HHS to whom the authority involved has been delegated. 

(15) “Security Rule” means the security standards for Electronic Protected Health Information found at 45 CFR Parts 160, 162, and 164. 

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 192.519; ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

**125-055-0115**

**Business Associate Contract Provisions**

(1) A Contractor that is a Business Associate of an Agency must: 

(a) Not use or disclose Protected Health Information or Electronic Protected Health Information other than as permitted or required by this Rule and the Contract, or as Required By Law. 

(b) Use appropriate safeguards to prevent use or disclosure of the Protected Health Information and Electronic Protected Health Information other than as provided for by this Rule and the Contract. 

(c) Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information or Electronic Protected Health Information by Business Associate in violation of the requirements of this Rule and the Contract. 

(d) Report to Agency, as promptly as possible, any use or disclosure of the Protected Health Information or Electronic Protected Health Information not provided for by this Rule and the Contract of which it becomes aware. 

(e) Ensure that any agent, including a subcontractor, to whom it provides Protected Health Information or Electronic Protected Health Information created, received, maintained or transmitted by it on behalf of Agency agrees to the same restrictions and conditions that apply through this Rule and the Contract to Business Associate with respect to such information. 

(f) Provide access, at the request of Agency, and in the time and manner designated by Agency, to Protected Health Information or Electronic Protected Health Information in a Designated Record Set, to Agency or, as directed by Agency, to an Individual in order to meet the requirements under 45 CFR 164.524. 

(g) Make any amendment(s) to Protected Health Information or Electronic Protected Health Information in a Designated Record Set that the Agency directs or agrees to pursuant to 45 CFR 164.526 at the request of Agency or an Individual, and in the time and manner designated by Agency. 

(h) Make internal practices, books, and records, including policies and procedures relating to the use and disclosure of Protected Health Information and Electronic Protected Health Information created, received, maintained or transmitted by Business Associate on behalf of, Agency available to Agency and to the Secretary, in a time and manner designated by Agency or the Secretary, for purposes of the Secretary determining Agency's compliance with the Privacy Rule or Security Rule. 

(i) Document disclosures of Protected Health Information and Electronic Protected Health Information and information related to such disclosures as would be required for Agency to respond to a request by an Individual for an accounting of disclosures of Protected Health Information and Electronic Protected Health Information in accordance with 45 CFR 164.528. 

(j) Provide to Agency or an Individual, in a time and manner to be designated by Agency, information collected in accordance with subsection (i) of this section to permit Agency to respond to a request by an Individual for an accounting of disclosures of Protected Health Information and Electronic Protected Health Information in accordance with 45 CFR 164.528. 

(2) A Contractor that is a Business Associate of an Agency may, except as otherwise limited or prohibited by this Rule: 

(a) Use or disclose Protected Health Information and Electronic Protected Health Information to perform functions, activities, or services for, or on behalf of, Agency as specified in the Contract and this Rule, provided that such use or disclosure would not violate the Privacy Rule, Security Rule, the HITECH Act, or other applicable federal or state laws or regulations if done by Agency or the minimum necessary policies and procedures of the Agency. All other uses of Protected Health Information and Electronic Protected Health Information are prohibited. 

(b) Use Protected Health Information and Electronic Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. 

(c) Disclose Protected Health Information and Electronic Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are Required By Law. 

(d) Disclose Protected Health Information and Electronic Protected Health Information to a subcontractor if the Business Associate enters into a business associate agreement with that subcontractor that complies with this Rule. 

(e) Use Protected Health Information and Electronic Protected Health Information to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1). 

(3) A Contractor that is a Business Associate of an Agency may not aggregate or compile Agency's Protected Health Information or Electronic Protected Health Information with the Protected Health Information or Electronic Protected Health Information of other Covered Entities unless the Contract permits Business Associate to perform Data Aggregation services. If the Contract permits Business Associate to provide Data Aggregation services, Business Associate may use Protected Health Information to provide Data Aggregation services requested by Agency as permitted by 45 CFR 164.504(e)(2)(i)(B) and subject to any limitations contained in this Rule. If Data Aggregation services are requested by Agency, Business Associate is authorized to aggregate Agency's Protected Health Information with Protected Heath Information of other Covered Entities that the Business Associate has in its possession through its capacity as a business associate to such other Covered Entities provided that the purpose of such aggregation is to provide Agency with data analysis relating to the Health Care Operations of Agency. Under no circumstances may Business Associate disclose Protected Health Information of Agency to another Covered Entity absent the express authorization of Agency. 

(4) Obligations of Agency: 

(a) An Agency that has entered into a Contract with a Business Associate shall notify Business Associate of any: 

(A) Limitation(s) in its notice of privacy practices of Agency in accordance with 45 CFR 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information and Electronic Protected Health Information. Agency may satisfy this obligation by providing Business Associate with Agency's most current Notice of Privacy Practices. 

(B) Changes in, or revocation of, permission by Individual to use or disclose Protected Health Information or Electronic Protected Health Information, to the extent that such changes may affect Business Associate's use or disclosure of Protected Health Information and Electronic Protected Health Information. 

(C) Restriction to the use or disclosure of Protected Health Information or Electronic Protected Health Information that Agency has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information or Electronic Protected Health Information. 

(b) Agency shall not request Business Associate to use or disclose Protected Health Information or Electronic Protected Health Information in any manner that would not be permissible under the Privacy Rule or Security Rule if done by Agency, except as permitted by section (1)(b)(B) above. 

(5) Security Requirements. A Business Associate of an Agency is subject to the Security Rule’s Business Associate requirements for Electronic Protected Health Information and must comply with both the Privacy Rule and the Security Rule requirements applicable to a Business Associate. In addition to the Privacy Rule requirements set forth in this Rule, the Contractor must: 

(a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Agency, and develop and enforce related policies, procedure, and documentation standards (including designation of a security official). 

(b) Ensure that any agent, including a subcontractor, to whom it provides Electronic Protected Health Information agrees to implement reasonable and appropriate safeguards to protect it by entering into a business associate agreement; and 

(6) Breach. 

(a) In the event of Discovery of a Breach of Unsecured Protected Health Information a Business Associate of an Agency must: 

(A) Notify the Agency of such Breach. The notification of a Breach to the Agency must be made as soon as possible and Business Associate shall confer with the Agency as soon as practicable thereafter, but in no event, shall notification to the Agency be later than 30 calendar days after the Discovery of a Breach. Notification shall include identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been accessed, acquired or disclosed during such Breach and any other information as may be reasonably required by the Agency necessary for the Agency to meet its notification obligations; 

(B) Confer with the Agency as to the preparation and issuance of an appropriate notice to each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been accessed, acquired or disclosed as a result of such Breach; 

(C) Where the Breach involves more than 500 individuals, confer with the Agency as to the preparation and issuance of an appropriate notice to prominent media outlets within the State or as appropriate, local jurisdictions; and, 

(D) Confer with the Agency as to the preparation and issuance of an appropriate notice to the Secretary of Unsecured Protected Health Information that has been acquired or disclosed in a Breach. If the Breach was with respect to 500 or more individuals, such notice to the Secretary must be provided immediately. If the Breach was with respect to less than 500 individuals, a log may be maintained of any such Breach and the log must be provided to the Secretary annually documenting such Breaches occurring during the year involved. 

(b) Except as set forth in (c) below, notifications required by this section must be made without unreasonable delay and in no case later than 60 calendar days after the Discovery of a Breach. Any notice must be provided in the manner and content required by the HITECH Act, sections 13402(e) and (f), and 45 CFR 164.404–164.410. 

(c) Any notification required by this section may be delayed by a law enforcement official in accordance with the HITECH Act, section 13402(g). 

(d) For purposes of this section, the terms “Breach” and “Unsecured Protected Health Information” have the meaning set forth in 45 CFR 164.402. A Breach will be considered as “Discovered” in accordance with the HITECH Act, section13402(c), 45 CFR 164.404(a)(2), and 45 CFR 164.410(a)(2). 

(7) Violations of this Rule. 

(a) Upon Agency's knowledge of a material breach by Business Associate of the requirements of this Rule, Agency shall: 

(A) Notify Business Associate of the breach and specify a reasonable opportunity in the notice for Business Associate to cure the breach or end the violation, and terminate the Contract if Business Associate does not cure the breach of the requirements of this Rule or end the violation within the time specified by Agency; 

(B) Immediately terminate the Contract if Business Associate has breached a material term of this Rule and cure is not possible in Agency's reasonable judgment; or 

(C) If neither termination nor cure is feasible, Agency shall report the violation to the Secretary. 

(b) The rights and remedies provided in this Rule are in addition to the rights and remedies provided in the Contract. 

(c) Effect of Termination. 

(A) Except as provided in subsection (c)(B) below upon termination of the Contract, for any reason, Business Associate shall, at Agency’s option, return or destroy all Protected Health Information and Electronic Protected Health Information received from Agency, or created or received by Business Associate on behalf of Agency. This provision shall apply to Protected Health Information and Electronic Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information and Electronic Protected Health Information. 

(B) In the event that Business Associate determines that returning or destroying the Protected Health Information or Electronic Protected Health Information is infeasible, Business Associate shall provide to Agency notification of the conditions that make return or destruction infeasible. Upon Agency's written acknowledgement that return or destruction of Protected Health Information or Electronic Protected Health Information is infeasible, Business Associate shall extend the protections of this Rule to such Protected Health Information and Electronic Protected Health Information and limit further uses and disclosures of such Protected Health Information and Electronic Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information and Electronic Protected Health Information.

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

**125-055-0120**

**Order of Precedence**

In the event of a conflict between this Rule and the provisions of the Contract, this Rule shall control. In the event of a conflict between this Rule and the Privacy Rule or the Security Rule or the HITECH Act, or the provisions of the Contract and the Privacy Rule or the Security Rule or the HITECH Act, the Privacy Rule and the Security Rule and the HITECH Act shall control. The requirements set forth in this Rule are in addition to any other provisions of law applicable to the Contract. Provided, however, this Rule shall not supercede any other federal or state law or regulation governing the legal relationship of the parties, or the confidentiality of records or information, except to the extent that HIPAA and the HITECH Act preempt those laws or regulations. Any ambiguity in the Contract shall be resolved to permit Agency and Business Associate to implement and comply with HIPAA, the HITECH Act, the Privacy Rule and the Security Rule. 

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

**125-055-0125**

**Methods of Compliance**

In addition to referencing compliance with this Rule in a Contract with a Business Associate, Agency may comply with this Rule in any of the following ways: 

(1) Memorandum of Understanding. If a Business Associate is a government entity, the parties may comply with the requirements of this Rule by entering into a memorandum of understanding that accomplishes the objectives of this Rule and meets the Business Associate requirements of the Privacy Rule and the Security Rule. 

(2) Amendment. Agency may comply with the requirements of this Rule by executing an amendment or rider that amends Agency's Contract and that contains the contract provisions required by this Rule. 

(3) Required by Law. If a Business Associate is Required by Law to perform a function or activity on behalf of an Agency or to provide a service described in the definition of Business Associate to an Agency, such Agency may disclose Protected Health Information to the Business Associate to the extent necessary to comply with the legal mandate without meeting the requirements of this Rule, provided that the Agency attempts in good faith to obtain satisfactory assurances required by OAR 125-055-0115, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

**125-055-0130**

**Standards in Individual Contracts**

(1) Agency and Business Associate may enter into a Contract that contains more stringent standards than those set forth in this Rule as long as such standards do not violate the requirements of the Privacy Rule or the Security Rule or the HITECH Act. 

(2) Agencies shall use one of the forms provided or approved by the Department of Administrative Services when entering into personal services contracts as defined in OAR 125-246-0110. For revised forms up to a cumulative value of $150,000 and before an Agency may use a revised form, it must obtain its Designated Procurement Officer’s approval of any revisions to the form’s terms and conditions. For revised forms exceeding a cumulative value of $150,000 and before an Agency may use a revised form, it must obtain Department of Justice approval of any revisions to the revised form’s terms and conditions. 

Stat. Auth.: ORS 184.305, 184.340 & 279A.140   
Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264   
Hist.: DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14