HomeMy WebLinkAboutResolution - 2023-R0155 - MOU HHS001323700001 for Syndromic Surveillance System with DSHSResolution No. 2023-R0155
Item No. 6.12
March 21, 2023
RESOLUTION
BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF LUBBOCK:
THAT the Mayor of the City of Lubbock is hereby authorized and directed to execute for and
on behalf of the City of Lubbock, the Department of State Health Services (DSHS)
Memorandum of Understanding (MOU), MOU I-IHS001323700001, regarding accessing
electronic health data through the TxS2 system for the purpose of supporting public health
syndromic surveillance to protect the health of the citizens of Texas, by and between the City
of Lubbock and the State of Texas acting by and through DSHS, and all related documents.
Said MOU is attached hereto and incorporated in this resolution as if fully set forth herein and
shall be included in the minutes of the City Council.
Passed by the City Council on
ATTEST:
A A�-
C. urtney Ifaz, I Vityy retary
APPROVED AS TO CONTENT:
Bill Howeyfon, Deputy City Manager
March 21, 2023
TRA AY , MAYOR
APPROVED AS TO FORM:
Ryan B oke, Senior Assistant City Attorney
RES.DSHS MOU No. FIFIS001323700001 TxS2
3.1.23
DocuSign.Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Resolution No. 2023-RO155 MOU # HHS001323700001
DEPARTMENT OF STATE HEALTH SERVICES
MEMORANDUM OF UNDERSTANDING
This Memorandum of Understanding ("MOU") is entered into by and between the Texas
Department of State Health Services ("DSHS") and City of Lubbock ("Local Health
Department" or "LHD"). DSHS and LHD, may be referred to individually as a "Party"
and collectively as the "Parties." DSHS has authority to operate Texas Syndromic
Surveillance ("TxS2"), the statewide syndromic surveillance system, under Chapter 81 of
the Health and Safety Code.
This MOU establishes the Parties' roles and responsibilities regarding access to electronic
health data (collectively referred to as "Limited Data Set") through the TxS2 system for
the purpose of supporting public health syndromic surveillance to protect the health of
Texas citizens. The Limited Data Set will, at a minimum, meet requirements for the
Medicare and Medicaid Electronic Health Record ("EHR") Incentive Programs for the
meaningful use of certified EHR technology to improve patient care. More information on
accessing data can be found at the following URL: http://www.dshs.state.tx.us/txs2.
Under this MOU, LHD will access the TxS2 system to support its ongoing analysis of data
and the search for combinations of signs and symptoms of disease in a population. LHD's
efforts are expected to be useful in the following manner: identifying and responding to
naturally occurring diseases such as influenza and food-bome illness; detecting and
mitigating the effects of terrorist incidents; and serving other public health uses consistent
with applicable law. Any other uses of the Limited Data Set are prohibited.
I. Limited Data Set — Types of Data.
A. Definitions — The following definitions relate to various entities level of access for
four types of data identified in the Limited Data Set table (see Section I(B), below):
"Aggregate -level data" means a view of the data with no details of the
individual cases that comprise the aggregate data. A user has the ability to
make graphs and tables, or create queries, that identify overall counts for a
specific health issue, but information related to specific individuals cannot
be identified. Users of Aggregate -level data can choose to view information
based on a geography or demographic characteristics.
• "Record -level data" means a view of the data that includes all of the
Aggregate -level data capabilities and the ability to view information related
to specific individuals, including health -related information and a medical
- 1 -
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
record number that is specific to the hospital where the individual is a
patient. Nonetheless, TxS2 data is de -identified, meaning that universal
identifiers, such as names, addresses, and SSNs, are not found in Record -
level data.
B. Limited Data Set Table — There are multiple types of data within TxS2. Depending
on the user's organization, the user's access to the data will vary on the following
two bases: (1) level of data, i.e. access to Aggregate -level data or Record -level data;
and (2) geographic expanse of data, i.e. access statewide or confined to a limited
geographic area. The table below details data access by user organization and type
of data.
Type of Data
DSHS/HHSC staff and
LHDs with an
Hospitals have access to:
TxS2 Contractor have
appropriate MOU have
access to:
access to:
ER Data (from
Record -level data
Record -level data within
Record -level data for
electronic health
statewide
Public Health Region
entirety of respective
records)
(PHR) and Aggregate-
hospital system
level data statewide
Poison Data
Aggregate -level data
Aggregate -level data
No data availability
statewide (Note: TxS2
statewide
staff have access to
Record -level data for
administrative work,
including ensuring that
data is correct and flowing
into the database.)
EMS Data
Record -level data for
Record -level data for
No data availability
jurisdiction and contiguous
jurisdiction and
jurisdictions and
contiguous jurisdictions
Aggregate -level statewide
and Aggregate -level data
statewide
Death Record Data
Record -level data
Record -level data for
No data availability
statewide
jurisdiction and
contiguous jurisdictions
II. Roles and Responsibilities of Parties.
The Parties will:
A. Access and receive the Limited Data Set in a secure, confidential manner in
compliance with ATTACHMENT A, DATA USE AGREEMENT TACCHO VERSION
(LOCAL CITY AND COUNTY ENTITIES), OCTOBER 23, 2019, and in compliance
with all applicable federal and state laws governing the protection of health -related
information.
-2-
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
B. Use industry best practices to secure, protect, and manage the Limited Data Set. If
LHD exports data from the TxS2 system, LHD assumes responsibility for the
security and privacy of the exported data.
C. Use and share data for public health purposes only, or as otherwise permitted by
federal law, state law, or this MOU.
D. Not attempt to determine the identity of, nor contact, any person whose information
is contained in the Limited Data Set, unless such actions are necessary as part of a
public health investigation or otherwise fall within the authority of the Party, as
provided under federal or state law.
E. Promptly provide written notice to the other Party of any use or disclosure of the
Limited Data Set that violates the terms of this MOU or applicable federal or state
law.
III. Roles and Responsibilities of DSHS.
DSHS will:
A. Develop, monitor, and maintain the TxS2 system to receive the Limited Data Set
from Data Providers.
B. Receive and store data in one or more servers, located in a secure data environment
maintained by DSHS.
C. Provide policies and procedures for using TxS2, and requesting access to view data
on TxS2. These policies and procedures related to TxS2 will be posted at the
following URL: http://www.dshs.state.tx.us/txs2.
D. Provide the following authorized users with access, as specified, to view and
analyze data:
1. A LHD participating in TxS2 will have access to the Limited Data Set as
identified in the table located at Section I(B) of this MOU, and pursuant to
Health and Safety Code Section 1001.089(b)(1).
2. Hospitals that participate in TxS2 will have access to Record -level data within
its facility and Aggregate -level data statewide.
3. An external contractor, identified in the table located at Section I(B) of this
MOU as "TxS2 Contractor," will have access to data as needed for TxS2
system maintenance.
4. The Centers for Disease Control and Prevention ("CDC"), to whom DSHS
sends Record -level data in support of the National Syndromic Surveillance
Program.
5. All other government agencies with whom DSHS, by law, must share data.
E. Sponsor trainings and provide technical assistance on TxS2 usage and capabilities.
F. Remove user access to TxS2, as requested by the LHD, within five business days
of receipt of the LHD's written request.
G. Maintain a list of all authorized users of TxS2 and provide the list of authorized
users within the LHD's PHR to the requesting LHD within five business days of
receiving such request.
H. Respond to LHD written requests to provide Limited Data Set access to individuals
or entities not otherwise authorized to view data under this MOU within 10 business
days of receiving such request.
-3-
DocuSign Envelope ID: E637EDB6-B654-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
IV. Roles and Responsibilities of LHD.
LHD will:
A. Comply with all DSHS policies and procedures for requesting access to view data
on TxS2. These policies and procedures related to TxS2 will be posted at the
following URL: http://www.dshs.state.tx.us/txs2.
B. Provide a list of designated personnel authorized to access TxS2.
C. Participate in DSHS-sponsored training on TxS2 usage and capabilities.
D. Notify DSHS of designated personnel that no longer have authorization to view
TxS2 within five business days of removing access.
E. Maintain a list of all authorized users of TxS2 and, upon written request by DSHS,
provide the list of authorized users to DSHS within five business days.
F. Use the Limited Data Set for enhanced surveillance of public health conditions or
threats, early event detection, situational awareness, retrospective analysis, and
other public health uses.
G. Not use or disclose the Limited Data Set other than as provided by this MOU or as
otherwise provided by federal or state law.
H. Submit a written request to DSHS, and obtain written permission from DSHS, prior
to providing access to the Limited Data Set to anyone not authorized to view data
under the terms of this MOU.
I. Ensure that any authorized users, including a subcontractor, to whom LHD provides
the Limited Data Set agrees to the same restrictions and conditions as the Parties in
this MOU, and that those authorized users are in compliance with applicable federal
and state law.
V. Term of the MOU.
This MOU is effective on the date last signed below and terminates on the fifth anniversary
of the effective date, unless otherwise renewed or terminated pursuant to the terms and
conditions of this MOU. The Parties may extend this MOU for an additional one-year
term, subject to mutually agreeable terms and conditions.
The Parties agree to review this MOU on an annual basis and provide written notice to the
other Party if one party determines that a material change to the MOU is needed. If the
Parties agree that the MOU needs to be amended then the Parties will execute a written
amendment (see Section VI, below).
VI. Amendments.
The Parties to this MOU may modify this MOU only through the execution of a written
amendment signed by both Parties.
VII. Termination of MOU.
Either DSHS or LHD may terminate this MOU by providing written notice to the other
Party at least 30 calendar days prior to the designated termination date and by sending the
written notice via certified mail, return receipt requested, to the other Party's primary
contact (See Section VIII, below).
-4-
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
VIII. Primary Contacts.
All communications between the Parties shall be made through the primary contacts to the
maximum extent possible. The primary contacts are:
For DSHS:
Syndromic Surveillance Team
DSHS
P.O. Box 149347, Mail Code 1926
Austin, TX 78714-9347
(512) 776-7770 (Office)
(512) 776-7509 (Fax)
syndromic.surveillance@dshs.state.tx.us
For LHD:
Rachel Dolan, Assistant Director
City of Lubbock
P.O. Box 2000
Lubbock, TX 79457
(806) 775-2917
rdolan@mylubbock.us
Each Party may change its Primary Contact by written notice to the other Party. In this
instance written notice includes email.
IX. Miscellaneous.
A. Assignment. LHD will not assign all or any portion of its rights under or interests
in this MOU or delegate any of its duties without prior written consent of DSHS.
Any written request for assignment or delegation must be accompanied by written
acceptance of the assignment or delegation by the assignee or delegation by the
delegate. Except where otherwise agreed in writing by DSHS, any assignment or
delegation will not release LHD from its obligations under this MOU.
B. No Waiver of Sovereign Immunity. The Parties agree that no provision of this
MOU is in any way intended to constitute a waiver by DSHS of any immunities
from suit or from liability that DSHS may have by operation of law.
C. Governing Law and Venue. This MOU is governed by the laws of the State of
Texas and interpreted in accordance with Texas law. Proper venue for a claim
arising from this MOU will be in a court of competent jurisdiction in Travis County,
Texas.
D. Precedence of Attachment A, Data Use Agreement TACCO Version (Local
City and County Entities), October 23, 2019. The Data Use Agreement's
("DUA's") defined terms "CONTRACTOR," "HHS," "Effective Date," and "Base
Contract" are respectively synonymous with the following terms of this document:
LHD, DSHS, Effective Date, and this document. A conflict between the terms and
conditions of the DUA and the remainder of this MOU will be resolved in favor of
the terms and conditions of the DUA.
E. MOU Amount. The total not -to -exceed amount of this MOU is $0.00. No funds
will be exchanged between the Parties for any purpose under this MOU. Each
Party will bear its own costs and expenses, if any, under this MOU.
1511
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
SIGNATURE PAGE FOLLOWS
1011
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
MOU # HHS001323700001
SIGNATURE PAGE FOR
MEMORANDUM OF UNDERSTANDING
BETWEEN
DSHS
AND
CITY OF LUBBOCK
DSHS CONTRACT No. HHS001323700001
By signing below, the Parties acknowledge that they have read the MOU and agree to its
terms, and that the persons whose signatures appear below have the requisite authority to
execute this MOU on behalf of the named party.
DSHS DocuSigned by:
W
B�J � J R11�dfiR'I � F
Signature of Authorized Official
April 11, 2023
Date of Signature
Dave Gruber Associate Commissioner for RLHS
Printed Name and Title
LHD DocuSigned by:
By: �7R1nFF��f'11dRf1
Signature of Authorized Official
April 6, 2023
Date of Signature
Tray Payne, Mayor Mayor
Printed Name and Title
THE FOLLOWING DOCUMENT IS ATTACHED AND INCORPORATED AS PART OF THE
MOU:
ATTACHMENT A - HHS DATA USE AGREEMENT TACCHO VERSION (LOCAL
CITY AND COUNTY ENTITIES), OCTOBER 23, 2019
-7-
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
ATTACHMENT A
HHS DATA USE AGREEMENT
TACCO VERSION (LOCAL CITY AND COUNTY ENTITIES) OCTOBER 23, 2019
This Data Use Agreement ("DUA"), effective as of the date the Base Contract into which
it is incorporated is signed ("Effective Date"), is entered into by and between a Texas Health and
Human Services Enterprise agency ("HHS"), and the Contractor identified in the Base Contract, a
political subdivision of the State of Texas ("CONTRACTOR").
ARTICLE 1.
PURPOSE; APPLICABILITY; ORDER OF PRECEDENCE
The purpose of this DUA is to facilitate creation, receipt, maintenance, use, disclosure or
access to Confidential Information with CONTRACTOR, and describe CONTRACTOR's rights
and obligations with respect to the Confidential Information. 45 CFR 164.504(e)(1)-(3). This DUA
also describes HHS's remedies in the event of CONTRACTOR's noncompliance with its
obligations under this DUA. This DUA applies to both Business Associates and contractors who
are not Business Associates who create, receive, maintain, use, disclose or have access to
Confidential Information on behalf of HHS, its programs or clients as described in the Base
Contract.
As of the Effective Date of this DUA, if any provision of the Base Contract, including any
General Provisions or Uniform Terms and Conditions, conflicts with this DUA, this DUA controls.
ARTICLE 2.
DEFINITIONS
For the purposes of this DUA, capitalized, underlined terms have the meanings set forth in
the following: Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (42
U.S.C. § 1320d, et seq.) and regulations thereunder in 45 CFR Parts 160 and 164, including all
amendments, regulations and guidance issued thereafter; The Social Security Act, including Section
1137 (42 U.S.C. §§ 1320b-7), Title XVI of the Act; The Privacy Act of 1974, as amended by the
Computer Matching and Privacy Protection Act of 1988, 5 U.S.C. § 552a and regulations and
guidance thereunder; Internal Revenue Code, Title 26 of the United States Code and regulations and
publications adopted under that code, including IRS Publication 1075; OMB Memorandum 07-18;
Texas Business and Commerce Code Ch. 521; Texas Government Code, Ch. 552, and Texas
Government Code §2054.1125. In addition, the following terms in this DUA are defined as follows:
"Authorized Purpose" means the specific purpose or purposes described in the Statement
of Work of the Base Contract for CONTRACTOR to fulfill its obligations under the Base Contract,
or any other purpose expressly authorized by HHS in writing in advance.
"Authorized User" means a Person:
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 1 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A - HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(1) Who is authorized to create, receive, maintain, have access to, process, view,
handle, examine, interpret, or analyze Confidential Information pursuant to this DUA;
(2) For whom CONTRACTOR warrants and represents has a demonstrable need to
create, receive, maintain, use, disclose or have access to the Confidential Information; and
(3) Who has agreed in writing to be bound by the disclosure and use limitations
pertaining to the Confidential Information as required by this DUA.
"Confidential Information" means any communication or record (whether oral, written,
electronically stored or transmitted, or in any other form) provided to or made available to
CONTRACTOR, or that CONTRACTOR may, for an Authorized Purpose, create, receive, maintain,
use, disclose or have access to, that consists of or includes any or all of the following:
(1) Client Information;
(2) Protected Health Information in any form including without limitation, Electronic
Protected Health Information or Unsecured Protected Health Information (herein "PHI");
(3) Sensitive Personal Information defined by Texas Business and Commerce Code
Ch. 521;
(4) Federal Tax Information;
(5) Individually Identifiable Health Information as related to HIPAA, Texas HIPAA
and Personal Identifying Information under the Texas Identity Theft Enforcement and Protection
Act;
(6) Social Security Administration Data, including, without limitation, Medicaid
information;
(7) All privileged work product;
(8) All information designated as confidential under the constitution and laws of the
State of Texas and of the United States, including the Texas Health & Safety Code and the Texas
Public Information Act, Texas Government Code, Chapter 552.
"Legally Authorized Representative" of the Individual, as defined by Texas law, including
as provided in 45 CFR 435.923 (Medicaid); 45 CFR 164.502(g)(1) (HIPAA); Tex. Occ. Code §
151.002(6); Tex. H. & S. Code § 166.164; and Estates Code Ch. 752.
ARTICLE 3.
CONTRACTOR'S DUTIES REGARDING CONFIDENTIAL INFORMATION
3.01 Obligations of CONTRACTOR
CONTRACTOR agrees that:
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 2 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(A) CONTRACTOR will exercise reasonable care and no less than the same
degree of care CONTRACTOR uses to protect its own confidential, proprietary and trade
secret information to prevent any portion of the Confidential Information from being used in
a manner that is not expressly an Authorized Purpose under this DUA or as Required by Law.
45 CFR 164.502(b)(1); 45 CFR 164.514(d)
(B) Except as Required by Law, CONTRACTOR will not disclose or allow access
to any portion of the Confidential Information to any Person or other entity, other than
Authorized User's Workforce or Subcontractors (as defined in 45 C.FIL 160.103) of
CONTRACTOR who have completed training in confidentiality, privacy, security and the
importance of promptly reporting any Event or Breach to CONTRACTOR's management, to
carry out CONTRACTOR's obligations in connection with the Authorized Purpose.
HHS, at its election, may assist CONTRACTOR in training and education on specific or
unique HHS processes, systems and/or requirements. CONTRACTOR will produce
evidence of completed training to HHS upon request. 45 C.F.R. 164.308(a)(5)(i); Texas
Health & Safety Code §181.101
All of CONTRACTOR's Authorized Users, Workforce and Subcontractors with access to a state
computer system or database will complete a cybersecurity training program certified under Texas
Government Code Section 2054.519 by the Texas Department of Information Resources or offered
under Texas Government Code Sec. 2054.519(f).
(C) CONTRACTOR will establish, implement and maintain appropriate
sanctions against any member of its Workforce or Subcontractor who fails to comply with this
DUA, the Base Contract or applicable law. CONTRACTOR will maintain evidence of
sanctions and produce it to HHS upon request.45 C.F.R. 164.308(a)(1)(ii)(C); 164.530(e);
164.410(b); 164.530(b)(1)
(D) CONTRACTOR will not, except as otherwise permitted by this DUA,
disclose or provide access to any Confidential Information on the basis that such act is
Required by Law without notifying either HHS or CONTRACTOR's own legal counsel to
determine whether CONTRACTOR should object to the disclosure or access and seek
appropriate relief. CONTRACTOR will maintain an accounting of all such requests for
disclosure and responses and provide such accounting to HHS within 48 hours of HHS'
request. 45 CFR 164.504(e)(2)(ii)(A)
(E) CONTRACTOR will not attempt to re -identify or further identify
Confidential Information or De -identified Information, or attempt to contact any Individuals
whose records are contained in the Confidential Information, except for an Authorized
ose, without express written authorization from HHS or as expressly permitted by the
Base Contract. 45 CFR 164.502(d)(2)(1) and (ii) CONTRACTOR will not engage in
prohibited marketing or sale of Confidential Information. 45 CFR 164.501, 164.508(a)(3)
and (4); Texas Health & Safety Code Ch. 18L 002
(F) CONTRACTOR will not permit, or enter into any agreement with a
Subcontractor to, create, receive, maintain, use, disclose, have access to or transmit
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 3 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
Confidential Information to carry out CONTRACTOR's obligations in connection with the
Authorized Purpose on behalf of CONTRACTOR, unless Subcontractor agrees to comply
with all applicable laws, rules and regulations. 45 CFR 164.502(e)(1)(ii); 164.504(e)(1)(i)
and (2).
(G) CONTRACTOR is directly responsible for compliance with, and enforcement
of, all conditions for creation, maintenance, use, disclosure, transmission and Destruction of
Confidential Information and the acts or omissions of Subcontractors as may be reasonably
necessary to prevent unauthorized use. 45 CFR 164.504(e)(5); 42 CFR 431.300, et seq.
(H) If CONTRACTOR maintains PHI in a Designated Record Set which is
Confidential Information and subject to this Agreement, CONTRACTOR will make PHI
available to HHS in a Designated Record Set upon request. CONTRACTOR will provide PHI
to an Individual, or Legally Authorized Representative of the Individual who is requesting
PHI in compliance with the requirements of the HIPAA Privacy Regulations.
ations.
CONTRACTOR will release PHI in accordance with the HIPAA Privac�Re Regulations upon
receipt of a valid written authorization. CONTRACTOR will make other Confidential
Information in CONTRACTOR's possession available pursuant to the requirements of
HIPAA or other applicable law upon a determination of a Breach of Unsecured PHI as defined
in HIPAA. CONTRACTOR will maintain an accounting of all such disclosures and provide
it to HHS within 48 hours of HHS' request. 45 CFR 164.524and 164.504(e)(2)(ii)(E).
(I) If PHI is subject to this Agreement, CONTRACTOR will make PHI as
required by HIPAA available to HHS for review subsequent to CONTRACTOR's
incorporation of any amendments requested pursuant to HIPAA. 45 CFR
164.504(e)(2)(ii)(E) and (F).
(J) If PHI is subject to this Agreement, CONTRACTOR will document and make
available to HHS the PHI required to provide access, an accounting of disclosures or
amendment in compliance with the requirements of the HIPAA Privacy Regulations. 45 CFR
164.504(e)(2)(ii)(G) and 164.528.
(K) If CONTRACTOR receives a request for access, amendment or accounting
of PHI from an individual with a right of access to information subject to this DUA, it will
respond to such request in compliance with the HIPAA Privacy Regulations.
CONTRACTOR will maintain an accounting of all responses to requests for access to or
amendment of PHI and provide it to HHS within 48 hours of HHS' request. 45 CFR
164.504(e)(2).
(L) CONTRACTOR will provide, and will cause its Subcontractors and agents
to provide, to HHS periodic written certifications of compliance with controls and
provisions relating to information privacy, security and breach notification, including
without limitation information related to data transfers and the handling and disposal of
Confidential Information. 45 CFR 164.308; 164.530(c); 1 TA 202.
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 4 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(M) Except as otherwise limited by this DUA, the Base Contract, or law
applicable to the Confidential Information, CONTRACTOR may use PHI for the proper
management and administration of CONTRACTOR or to carry out CONTRACTOR's
legal responsibilities. Except as otherwise limited by this DUA, the Base Contract, or law
applicable to the Confidential Information, CONTRACTOR may disclose PHI for the
proper management and administration of CONTRACTOR, or to carry out
CONTRACTOR's legal responsibilities, if 45 CFR 164.504(e)(4)(A).
(1) Disclosure is Required by Law, provided that CONTRACTOR complies with
Section 3.01(D); or
(2) CONTRACTOR obtains reasonable assurances from the person or entity to
which the information is disclosed that the person or entity will:
(a) Maintain the confidentiality of the Confidential Information in
accordance with this DUA;
(b) Use or further disclose the information only as Required by Law or for
the Authorized Purpose for which it was disclosed to the Person; and
(c) Notify CONTRACTOR in accordance with Section 4.01 of any Event
or Breach of Confidential Information of which the Person discovers or should
have discovered with the exercise of reasonable diligence. 45 CFR
164.504(e)(4)(ii)(B).
(l) Except as otherwise limited by this DUA, CONTRACTOR will, if required
by law and requested by HHS, use commercially reasonable efforts to use PHI to provide data
aggregation services to HHS, as that term is defined in the HIPAA, 45 C.F.R. § 164.501 and
permitted by HIPAA. 45 CFR 164.504(e)(2)(i)(B)
(0) CONTRACTOR will, on the termination or expiration of this DUA or the
Base Contract, at its expense, send to HHS or Destroy, at HHS's election and to the extent
reasonably feasible and permissible by law, all Confidential Information received from HHS
or created or maintained by CONTRACTOR or any of CONTRACTOR's agents or
Subcontractors on HHS's behalf if that data contains Confidential Information.
CONTRACTOR will certify in writing to HHS that all the Confidential Information that has
been created, received, maintained, used by or disclosed to CONTRACTOR, has been
Destroyed or sent to HHS, and that CONTRACTOR and its agents and Subcontractors have
retained no copies thereof. Notwithstanding the foregoing, HHS acknowledges and agrees
that CONTRACTOR is not obligated to send to HHSC and/or Destroy any Confidential
Information if federal law, state law, the Texas State Library and Archives Commission
records retention schedule, and/or a litigation hold notice prohibit such delivery or
Destruction. If such delivery or Destruction is not reasonably feasible, or is impermissible by
law, CONTRACTOR will immediately notify HHS of the reasons such delivery or
Destruction is not feasible, and agree to extend indefinitely the protections of this DUA to the
Confidential Information and limit its further uses and disclosures to the purposes that make
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 5 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952098
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
the return delivery or Destruction of the Confidential Information not feasible for as long as
CONTRACTOR maintains such Confidential Information. 45 CFR 164.504(e)(2)(ii)(J)
(P) CONTRACTOR will create, maintain, use, disclose, transmit or Destroy
Confidential Information in a secure fashion that protects against any reasonably anticipated
threats or hazards to the security or integrity of such information or unauthorized uses. 45
CFR 164.306; 164.530(c)
(Q) If CONTRACTOR accesses, transmits, stores, and/or maintains Confidential
Information, CONTRACTOR will complete and return to HHS at
infosecurity@hhsc.state.tx.us the HHS information security and privacy initial inquiry (SPI)
at Attachment 1 . The SPI identifies basic privacy and security controls with which
CONTRACTOR must comply to protect HHS Confidential Information. CONTRACTOR
will comply with periodic security controls compliance assessment and monitoring by HHS
as required by state and federal law, based on the type of Confidential Information
CONTRACTOR creates, receives, maintains, uses, discloses or has access to and the
Authorized Purpose and level of risk. CONTRACTOR's security controls will be based on
the National Institute of Standards and Technology (NIST) Special Publication 800-53.
CONTRACTOR will update its security controls assessment whenever there are significant
changes in security controls for HHS Confidential Information and will provide the updated
document to HHS. HHS also reserves the right to request updates as needed to satisfy state
and federal monitoring requirements. 45 CFR 164.306.
(R) CONTRACTOR will establish, implement and maintain reasonable
procedural, administrative, physical and technical safeguards to preserve and maintain the
confidentiality, integrity, and availability of the Confidential Information, and with respect to
PHI, as described in the HIPAA Privacy and Security Regulations, or other applicable laws
or regulations relating to Confidential Information, to prevent any unauthorized use or
disclosure of Confidential Information as long as CONTRACTOR has such Confidential
Information in its actual or constructive possession. 45 CFR 164.308 (administrative
safeguards); 164.310 (physical safeguards); 164.312 (technical safeguards);
164.530(c)(privacy safeguards).
(S) CONTRACTOR will designate and identify, a Person or Persons, as Privacy
Official 45 CFR 164.530(a)(1) and Information Security Official, each of whom is authorized
to act on behalf of CONTRACTOR and is responsible for the development and
implementation of the privacy and security requirements in this DUA. CONTRACTOR will
provide name and current address, phone number and e-mail address for such designated
officials to HHS upon execution of this DUA and prior to any change. If such persons fail to
develop and implement the requirements of the DUA, CONTRACTOR will replace them
upon HHS request. 45 CFR 164.308(a)(2).
(T) CONTRACTOR represents and warrants that its Authorized Users each have
a demonstrated need to know and have access to Confidential Information solely to the
minimum extent necessary to accomplish the Authorized Purpose pursuant to this DUA and
the Base Contract, and further, that each has agreed in writing to be bound by the disclosure
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 6of15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A - HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
and use limitations pertaining to the Confidential Information contained in this DUA. 45
CFR 164.502; 164.514(d).
(U) CONTRACTOR and its Subcontractors will maintain an updated, complete,
accurate and numbered list of Authorized Users, their signatures, titles and the date they
agreed to be bound by the terms of this DUA, at all times and supply it to HHS, as directed,
upon request.
(V) CONTRACTOR will implement, update as necessary, and document
reasonable and appropriate policies and procedures for privacy, security and Breach of
Confidential Information and an incident response plan for an Event or Breach, to comply
with the privacy, security and breach notice requirements of this DUA prior to conducting
work under the Statement of Work. 45 CFR 164.308, 164.316, 164.514(d); 164.530(i)(1).
(W) CONTRACTOR will produce copies of its information security and privacy
policies and procedures and records relating to the use or disclosure of Confidential
Information received from, created by, or received, used or disclosed by CONTRACTOR for
an Authorized Purpose for HHS's review and approval within 30 days of execution of this
DUA and upon request by HHS the following business day or other agreed upon time frame.
45 CFR 164.308; 164.514(d).
(X) CONTRACTOR will make available to HHS any information HHS requires
to fulfill HHS's obligations to provide access to, or copies of, PHI in accordance with HIPAA
and other applicable laws and regulations relating to Confidential Information.
CONTRACTOR will provide such information in a time and manner reasonably agreed upon
or as designated by the Se cre of the U.S. Department of Health and Human Services, or
other federal or state law. 45 CFR 164.504(e)(2)(1)a).
(Y) CONTRACTOR will only conduct secure transmissions of Confidential
Information whether in paper, oral or electronic form, in accordance with applicable rules,
regulations and laws. A secure transmission of electronic Confidential Information in motion
includes, but is not limited to, Secure File Transfer Protocol (SFTP) or Encryption at an
appropriate level. If required by rule, regulation or law, HHS Confidential Information at rest
requires Encryption unless there is other adequate administrative, technical, and physical
security. All electronic data transfer and communications of Confidential Information will be
through secure systems. Proof of system, media or device security and/or Encryption must be
produced to HHS no later than 48 hours after HHS's written request in response to a
compliance investigation, audit or the Discovery of an Event or Breach. Otherwise, requested
production of such proof will be made as agreed upon by the parties. De -identification of HHS
Confidential Information is a means of security. With respect to de -identification of PHI,
"secure" means de -identified according to HIPAA Privacy standards and regulatory guidance.
45 CFR 164.312; 164.530(d).
(Z) For each type of Confidential Information CONTRACTOR creates, receives,
maintains, uses, discloses, has access to or transmits in the performance of the Statement of
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 7 of 15
DocuSign Envelope ID: E637EDB6-B664-4251 -AE61 -1 B9D1 C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
Work, CONTRACTOR will comply with the following laws rules and regulations, only to
the extent applicable and required by law:
• Title 1, Part 10, Chapter 202, Subchapter B, Texas Administrative Code;
• The Privacy Act of 1974;
• OMB Memorandum 07-16;
• The Federal Information Security Management Act of 2002 (FISMA);
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
as defined in the DUA;
• Internal Revenue Publication 1075 — Tax Information Security Guidelines
for Federal, State and Local Agencies;
• National Institute of Standards and Technology (NIST) Special Publication
800-66 Revision 1— An Introductory Resource Guide for Implementing the
Health Insurance Portability and Accountability Act (HIPAA) Security
Rule;
• NIST Special Publications 800-53 and 800-53A — Recommended Security
Controls for Federal Information Systems and Organizations, as currently
revised;
• NIST Special Publication 800-47 — Security Guide for Interconnecting
Information Technology Systems;
• NIST Special Publication 800-88, Guidelines for Media Sanitization;
• NIST Special Publication 800-111, Guide to Storage of Encryption
Technologies for End User Devices containing PHI; and
Any other State or Federal law, regulation, or administrative rule relating to the specific HHS
program area that CONTRACTOR supports on behalf of HHS.
(AA) Notwithstanding anything to the contrary herein, CONTRACTOR will treat
any Personal Identifying Information it creates, receives, maintains, uses, transmits, destroys
and/or discloses in accordance with Texas Business and Commerce Code, Chapter 521 and
other applicable regulatory standards identified in Section 3.01(2), and Individually
Identifiable Health Information CONTRACTOR creates, receives, maintains, uses,
transmits, destroys and/or discloses in accordance with HIPAA and other applicable
regulatory standards identified in Section 3.01(2).
ARTICLE 4.
BREACH NOTICE, REPORTING AND CORRECTION REQUIREMENTS
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 8 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
4.01 Breach or Event Notification to HHS. 45 CFR 164.400-414.
(A) CONTRACTOR will cooperate fully with HHS in investigating, mitigating to
the extent practicable and issuing notifications directed by HHS, for any Event or Breach of
Confidential Information to the extent and in the manner determined by HHS.
(B) CONTRACTOR'S obligation begins at the Discovery of an Event or Breach
and continues as long as related activity continues, until all effects of the Event are mitigated
to HHS's reasonable satisfaction (the "incident response period"). 45 CFR 164.404.
(C) Breach Notice:
(1) Initial Notice.
(a) For federal information, including without limitation, Federal
Tax Information, Social Security Administration Data, and Medicaid Client
Information, within the first, consecutive clock hour of Discovery, and for
all other types of Confidential Information not more than 24 hours after
Discovery, or in a timeframe otherwise approved by HHS in writing, initially
report to HHS's Privacy and Security Officers via email at:
privacy@HHSC.state.tx.us and to the HHS division responsible for this
DUA; and IRS Publication 1075; Privacy Act of 1974, as amended by the
Computer Matching and Privacy Protection Act of 1988, 5 U.S.C. § 552a;
OMB Memorandum 07-16 as cited in HHSC-CMS Contracts for
information exchange.
(b) Report all information reasonably available to
CONTRACTOR about the Event or Breach of the privacy or security of
Confidential Information. 45 CFR 164.410.
(c) Name, and provide contact information to HHS for,
CONTRACTOR's single point of contact who will communicate with HHS
both on and off business hours during the incident response period.
(2) Formal Notice. No later than two business days after the Initial Notice
above, provide formal notification to privacy@HHSC.state.tx.us and to the HHS
division responsible for this DUA, including all reasonably available information
about the Event or Breach, and CONTRACTOR's investigation, including without
limitation and to the extent available: For (a) - (m) below: 45 CFR 164.400414.
(a) The date the Event or Breach occurred;
(b) The date of CONTRACTOR's and, if applicable,
Subcontractor's Discovery;
(c) A brief description of the Event or Breach; including how it
occurred and who is responsible (or hypotheses, if not yet determined);
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 9 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(d) A brief description of CONTRACTOR's investigation and the
status of the investigation;
(e) A description of the types and amount of Confidential
Information involved;
(f) Identification of and number of all Individuals reasonably
believed to be affected, including first and last name of the Individual and if
applicable the, Legally Authorized Representative, last known address,
age, telephone number, and email address if it is a preferred contact method,
to the extent known or can be reasonably determined by CONTRACTOR at
that time;
(g) CONTRACTOR's initial risk assessment of the Event or
Breach demonstrating whether individual or other notices are required by
applicable law or this DUA for HHS approval, including an analysis of
whether there is a low probability of compromise of the Confidential
Information or whether any legal exceptions to notification apply;
(h) CONTRACTOR's recommendation for HHS's approval as to
the steps Individuals and/or CONTRACTOR on behalf of Individuals,
should take to protect the Individuals from potential harm, including without
limitation CONTRACTOR's provision of notifications, credit protection,
claims monitoring, and any specific protections for a Legally Authorized
Representative to take on behalf of an Individual with special capacity or
circumstances;
(i) The steps CONTRACTOR has taken to mitigate the harm or
potential harm caused (including without limitation the provision of
sufficient resources to mitigate);
0) The steps CONTRACTOR has taken, or will take, to prevent
or reduce the likelihood of recurrence of a similar Event or Breach;
(k) Identify, describe or estimate the Persons, Workforce,
Subcontractor, or Individuals and any law enforcement that may be involved
in the Event or Breach,
(1) A reasonable schedule for CONTRACTOR to provide regular
updates during normal business hours to the foregoing in the future for
response to the Event or Breach, but no less than every three (3) business
days or as otherwise directed by HHS, including information about risk
estimations, reporting, notification, if any, mitigation, corrective action, root
cause analysis and when such activities are expected to be completed; and
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 10 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(m) Any reasonably available, pertinent information, documents or
reports related to an Event or Breach that HHS requests following
Discovery.
4.02 Investigation, Response and Mitigation. 45 CFR 164.308, 310 and 312;164.530
(A) CONTRACTOR will immediately conduct a full and complete investigation,
respond to the Event or Breach, commit necessary and appropriate staff and resources to
expeditiously respond, and report as required to and by HHS for incident response purposes
and for purposes of HHS's compliance with report and notification requirements, to the
reasonable satisfaction of HHS.
(B) CONTRACTOR will complete or participate in a risk assessment as directed
by HHS following an Event or Breach, and provide the final assessment, corrective actions
and mitigations to HHS for review and approval.
(C) CONTRACTOR will fully cooperate with HHS to respond to inquiries and/or
proceedings by state and federal authorities, Persons and/or Individuals about the Event or
Breach.
(D) CONTRACTOR will fully cooperate with HHS's efforts to seek appropriate
injunctive relief or otherwise prevent or curtail such Event or Breach, or to recover or protect
any Confidential Information, including complying with reasonable corrective action or
measures, as specified by HHS in a Corrective Action Plan if directed by HHS under the Base
Contract.
4.03 Breach Notification to Individuals and Reporting to Authorities. Tex. Bus. &
Comm. Code §521.053; 45 CFR 164.404 (Individuals), 164.406 (Media);
164.408 (Authorities)
(A) HHS may direct CONTRACTOR to provide Breach notification to
Individuals, regulators or third -parties, as specified by HHS following a Breach.
(B) CONTRACTOR shall give HHS an opportunity to review and provide
feedback to CONTRACTOR and to confrrn that CONTRACTOR's notice meets all
regulatory requirements regarding the time, manner and content of any notification to
Individuals, regulators or third -parties, or any notice required by other state or federal
authorities, including without limitation, notifications required by Texas Business and
Commerce Code, Chapter 521.053(b) and HIPAA. HHS shall have ten (10) business days to
provide said feedback to CONTRACTOR. Notice letters will be in CONTRACTOR's name
and on CONTRACTOR's letterhead, unless otherwise directed by HHS, and will contain
contact information, including the name and title of CONTRACTOR's representative, an
email address and a toll -free telephone number, if required by applicable law, rule, or
regulation, for the Individual to obtain additional information.
(C) CONTRACTOR will provide HHS with copies of distributed and approved
communications.
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 11 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(D) CONTRACTOR will have the burden of demonstrating to the reasonable
satisfaction of HHS that any notification required by HHS was timely made. If there are delays
outside of CONTRACTOR's control, CONTRACTOR will provide written documentation of
the reasons for the delay.
(E) If HHS delegates notice requirements to CONTRACTOR, HHS shall, in the
time and manner reasonably requested by CONTRACTOR, cooperate and assist with
CONTRACTOR's information requests in order to make such notifications and reports.
ARTICLE 5.
STATEMENT OF WORK
"Statement of Work" means the services and deliverables to be performed or provided by
CONTRACTOR, or on behalf of CONTRACTOR by its Subcontractors or agents for HHS that are
described in detail in the Base Contract. The Statement of Work, including any future amendments
thereto, is incorporated by reference in this DUA as if set out word-for-word herein.
ARTICLE 6.
GENERAL PROVISIONS
6.01 Oversight of Confidential Information
CONTRACTOR acknowledges and agrees that HHS is entitled to oversee and monitor
CONTRACTOR's access to and creation, receipt, maintenance, use, disclosure of the
Confidential Information to confirm that CONTRACTOR is in compliance with this DUA.
6.02 HHS Commitment and Obligations
HHS will not request CONTRACTOR to create, maintain, transmit, use or disclose PHI in
any manner that would not be permissible under applicable law if done by HHS.
6.03 HHS Right to Inspection
At any time upon reasonable notice to CONTRACTOR, or if HHS determines that
CONTRACTOR has violated this DUA, HHS, directly or through its agent, will have the
right to inspect the facilities, systems, books and records of CONTRACTOR to monitor
compliance with this DUA. For purposes of this subsection, HHS's agent(s) include, without
limitation, the HHS Office of the Inspector General or the Office of the Attorney General of
Texas, outside consultants or legal counsel or other designee.
6.04 Term; Termination of DUA; Survival
This DUA will be effective on the date on which CONTRACTOR executes the DUA, and
will terminate upon termination of the Base Contract and as set forth herein. If the Base
Contract is extended or amended, this DUA shall be extended or amended concurrent with
such extension or amendment.
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 12 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(A) HHS may immediately terminate this DUA and Base Contract upon a material
violation of this DUA.
(B) Termination or Expiration of this DUA will not relieve CONTRACTOR of its
obligation to return or Destroy the Confidential Information as set forth in this DUA and to
continue to safeguard the Confidential Information until such time as determined by HHS.
(C) If HHS determines that CONTRACTOR has violated a material term of this
DUA; HHS may in its sole discretion:
(1) Exercise any of its rights including but not limited to reports, access
and inspection under this DUA and/or the Base Contract; or
(2) Require CONTRACTOR to submit to a Corrective Action Plan,
including a plan for monitoring and plan for reporting, as HHS may determine
necessary to maintain compliance with this DUA; or
(3) Provide CONTRACTOR with a reasonable period to cure the
violation as determined by HHS; or
(4) Terminate the DUA and Base Contract immediately, and seek relief in
a court of competent jurisdiction in Texas.
Before exercising any of these options, HHS will provide written notice to
CONTRACTOR describing the violation, the requested corrective action CONTRACTOR
may take to cure the alleged violation, and the action HHS intends to take if the alleged
violated is not timely cured by CONTRACTOR.
(D) If neither termination nor cure is feasible, HHS shall report the violation to the
Secre1M of the U.S. Department of Health and Human Services.
(E) The duties of CONTRACTOR or its Subcontractor under this DUA survive
the expiration or termination of this DUA until all the Confidential Information is Destroyed
or returned to HHS, as required by this DUA.
6.05 Governing Law, Venue and Litigation
(A) The validity, construction and performance of this DUA and the legal relations
among the Parties to this DUA will be governed by and construed in accordance with the laws
of the State of Texas.
(B) The Parties agree that the courts of Texas, will be the exclusive venue for any
litigation, special proceeding or other proceeding as between the parties that may be brought,
or arise out of, or in connection with, or by reason of this DUA.
6.06 Injunctive Relief
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 13 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
(A) CONTRACTOR acknowledges and agrees that HHS may suffer irreparable
injury if CONTRACTOR or its Subcontractor fails to comply with any of the terms of this
DUA with respect to the Confidential Information or a provision of HIPAA or other laws or
regulations applicable to Confidential Information.
(B) CONTRACTOR further agrees that monetary damages may be inadequate to
compensate HHS for CONTRACTOR's or its Subcontractor's failure to comply. Accordingly,
CONTRACTOR agrees that HHS will, in addition to any other remedies available to it at law
or in equity, be entitled to seek injunctive relief without posting a bond and without the
necessity of demonstrating actual damages, to enforce the terms of this DUA.
6.07 Responsibility.
To the extent permitted by the Texas Constitution, laws and rules, and without waiving any
immunities or defenses available to CONTRACTOR as a governmental entity,
CONTRACTOR shall be solely responsible for its own acts and omissions and the acts and
omissions of its employees, directors, officers, Subcontractors and agents. HHS shall be
solely responsible for its own acts and omissions.
6.08 Insurance
(A) As a governmental entity, and in accordance with the limits of the Texas Tort
Claims Act, Chapter 101 of the Texas Civil Practice and Remedies Code, CONTRACTOR
either maintains commercial insurance or self -insures with policy limits in an amount
sufficient to cover CONTRACTOR's liability arising under this DUA. CONTRACTOR will
request that HHS be named as an additional insured. HHSC reserves the right to consider
alternative means for CONTRACTOR to satisfy CONTRACTOR's financial responsibility
under this DUA. Nothing herein shall relieve CONTRACTOR of its financial obligations set
forth in this DUA if CONTRACTOR fails to maintain insurance.
(B) CONTRACTOR will provide HHS with written proof that required insurance
coverage is in effect, at the request of HHS.
6.08 Fees and Costs
Except as otherwise specified in this DUA or the Base Contract, if any legal action or other
proceeding is brought for the enforcement of this DUA, or because of an alleged dispute,
contract violation, Event, Breach, default, misrepresentation, or injunctive action, in
connection with any of the provisions of this DUA, each party will bear their own legal
expenses and the other cost incurred in that action or proceeding.
6.09 Entirety of the Contract
This DUA is incorporated by reference into the Base Contract as an amendment thereto
and, together with the Base Contract, constitutes the entire agreement between the parties.
No change, waiver, or discharge of obligations arising under those documents will be valid
unless in writing and executed by the party against whom such change, waiver, or discharge
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 14 of 15
DocuSign Envelope ID: E637EDB6-B664-4251-AE61-1B9D1C952D98
Attachment A — HHS Data Use Agreement TACCO Version (Local City and County Entities), October 23, 2019
is sought to be enforced. If any provision of the Base Contract, including any General
Provisions or Uniform Terms and Conditions, conflicts with this DUA, this DUA controls.
6.10 Automatic Amendment and Interpretation
If there is (i) a change in any law, regulation or rule, state or federal, applicable to HIPPA
and/or Confidential Information, or (ii) any change in the judicial or administrative
interpretation of any such law, regulation or rule„ upon the effective date of such change,
this DUA shall be deemed to have been automatically amended, interpreted and read so
that the obligations imposed on HHS and/or CONTRACTOR remain in compliance with
such changes. Any ambiguity in this DUA will be resolved in favor of a meaning that
permits HHS and CONTRACTOR to comply with HIPAA or any other law applicable to
Confidential Information.
HHS Data Use Agreement
TACCHO VERSION (Local City and County Entities) October 23, 2019
Page 15 of 15
Approved as to content:
TaL L)I�—
Katherine Wells, Director of Public Health
Approved as to form:
Attest:
cm "&'� 0'/
Courtney Paz, Inte ' City cretary