jan12'21 pm 2:41 rcudjan12'21 pm 2:41 rcud state of new hampshire department of health and...

Lori A. ShibintUc

Commissioner

Lori A. Wetver

Deputy Commissioner

JAN12'21 PM 2:41 RCUD

STATE OF NEW HAMPSHIRE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

OFFICE OF THE COMMISSIONER

129 PLEASANT STREET, CONCORD, NH 03J01-3857603-271-9200 1-800.8S2.334$ Ext. 9200

Fax:603-271-4912 TDD Access: 1-800-735-2964 www.dhhs.nh.gov

December 31,2020

His Excellency. Governor Christopher T. Sununuand the Honorable Council

State House

Concord, New Hampshire 03301I

INFORMATIONAL ITEM

Pursuant to RSA 4:45. RSA 21-P:43, and Section 4 of Executive Order 2020-04 asextended by Executive Orders 2020-05, 2020-08, 2020-09, 2020-10, 2020-14, 2020-15, 2020-16,2020-17, 2020-18, 2020-20, 2020-21, 2020-23, and 2020-24, Governor Sununu has authorizedthe Department of Health and Human Services, Office of the Commissioner, to enter into aRetroactive, Sole Source amendment to an existing contract with Alvarez & Marsal Public SectorServices, LLC (VCtfTBD). Washington, DC, to continue conducting a strategic assessment of theDepartment's operations and assist with implementing cost savings, operational efficiency, andservice delivery initiatives that explicitly address the financial and operational impacts of theCOVID-19 pandemic, by increasing the price limitation by $1,032,000 from $1,580,000 to$2,612,000 and by extending the completion date from October 30,2020, to December 30,2020.effective retroactive to October 30, 2020. 100% Other Funds (Governor's Office for EmergencyRelief and Recovery).

The original contract was approved by the Governor on August 31, 2020, and submittedto the September 23, 2020, Governor and Council agenda as informational item B,

Funds are available in the following account for State Fiscal Year 2021, with the authorityto adjust budget line items within the price limitation through the Budget Office, if needed andjustified.

05-95-9^95Q010-19290000 HEALTH AND SOCIAL SERVICES, DEPT OF HEALTH ANDHUMAN SVCS, HHS: HUMAN SERVICES, OFFICE OF THE COMMISSIONER - GOFERRFUNDS

State

Fiscal

Year

Class /

AccountClass Title

Job

Number

Current

Budget

Increased

(Decreased)Amount

Revised

Budget

2021 103-502507Contracts for

Oper Svc95010799

$1,580,000 $1,032,000 $2,612,000

Total $1,580,000 $1,032,000 $2,612,000

EXPLANATION

This amendment is Retroactive because more time was needed to negotiate and finalizethe scope of the work prior to the Contractor accepting the terms of the agreement. This

The DeparimeiU of Health and Human Services' Mis$ion is to join communities and familiesin providing opportunities for citizens to achieve health and independence.

Hte ExcePency. Governor Christopher T. Sur)unuar>d the Honorabie Council

of 2

amendment is Sole Source because the original contract was approved as Sole Source andMOP 150 requires any subsequent amendments to be Identified as Sole Source.

The purpose of this amendment is for the Contractor to continue conducting a strategicassessment of the Department's operations to quantify the financial impact the COVID-19pandemic has had on the Department's expenditures and revenues and general operations. TheContractor will continue to Identify programmatic quality improvements to increase the efficiencyof Department operations, produce cost savings, and improve the delivery of services during andafter the COVID-19 pandemic. Further, the Contractor will assist the Department withimplementing cost-saving, operational efficiency, and service delivery initiatives based on thedirection from Department leadership. '

The Contractor will provide the Department with a report and recommendations that drive

cost savings, explicitly consider the impact of and the short-term and long-term challengespresented by the COVID-19 pandemic, align with the Department's strategic priorities andmission, and quantify the capital and human resources necessary for implementation. TheContractor will work collaboratively with the Department to implement any recommendations theDepartment determines will further the Department's mission, decrease costs, and increase theeffectiveness and efficiency of operations.

The Contractor will continue to examine the Department's operations and service deliverymodel to understand the impacts of COVID-19. Further, the Contractor will meet with seniorleadership to discuss strategic priorities, legislative and funding challenges presented by theCOVID-19 pandemic, and long-term goals and solutions. The Contractor will analyze theDepartment's statewide service delivery model and supporting organizational structure, withspecific focus on service delivery "prior to and in response to the COVID-19 pandemic, whichincludes, but is not limited to, the New Hampshire Medicaid Program's delivery model and fundingstructure, and direct client services provided by District Offices, the New Hampshire Hospital,Glencliff Home, and the Sununu Youth Services Center.

The Contractor will continue to conduct a budget analysis that considers the COVID-19pandemic's impact on revenue sources, lapses, budgeted amounts, and actual expenditures. TheContractor will analyze the Department's COVID-19 expenditures and identify federal fundingsources that are available to reimburse the Department for any eligible costs.

As referenced in the Exhibit A of the original contract, the"parties have the option to extendthe agreement for up to three (3) additional years, contingent upon satisfactory delivery ofservices, available funding, agreement of the parties, and Governor and Council approval. TheDepartment is exercising its option to renew services for 2 months of the 3 years available.

Source of Funds; CFDA #21.019, FAIN #TBD - 100% Federal Funds.

Respectfully submitted.

Lori A. Shibinette

Commissioner

DocuSign Envelope ID: 586AD187-E0D1-45CB-A53A-5D0E5581A3EB

State of New HampshireDepartment of Health and Human Services

Amendment #1 to the COVID-19 DHHS Operations Assessment Contract

This 1®^ Amendment to the COVID-19 DHHS Operations Assessment contract (hereinafterreferred to as "Amendment #1") is by and between the State of New Hampshire, Department ofHealth and Human Services (hereinafter referred to as the "State" or "Department") and Alvarezand Marsal Public Sector Services, LLC (hereinafter referred to as "the Contractor"), a LimitedLiability Company with a place of business at Metropolitan Square, 655 15^ Street, NW, Suite600, Washington, DC 20005.

WHEREAS, pursuant to an agreement (the "Contract") approved by the Governor on August 31,2020, the Contractor agreed to perform certain services based upon the terms and conditionsspecified in the Contract and In consideration of certain sums specified; and

WHEREAS, pursuant to Form P-37, General Provisions, Paragraph 17 the Contract may beamended upon written agreement of the parties and appropriate State approval; and

WHEREAS, the parties agree to extend the term of the Contract, increase the price limitation,and modify the scope of services to support continued delivery of these services; and

NOW THEREFORE, in consideration of the foregoing and the mutual covenants and conditionscontained in the Contract and set forth herein, the parties hereto agree to amend as follows:

1. Form P-37 General Provisions, Block 1.7, Completion Date, to read:

December 30, 2020

2. Form P-37, General Provisions, Block 1.8, Price Limitation, to read:

$2,612,000

3. Modify Exhibit A, Revisions to Standard Contract Provisions, Section 1.4, Paragraph 8,Event of Default/Remedies, subparagraph 8.5 to read:

I

8.5 Except for Contractor's liability for any data security breaches caused by theContractor, as referenced in Exhibit K, DHHS Information SecurityRequirements (Section IV, Procedures for Security, Paragraph 11),notwithstanding anything to the contrary, in no event shall the Contractor beliable to the State, whether a claim be in tort, contract or otherwise, for anyamount in excess of the total professional fees paid pursuant to thisAgreement except to the extent the damages were caused primarily from thefraud or willful misconduct of the Contractor relating to the Services. In noevent shall the Parties be liable for any consequential, special, indirect,

• incidental, punitive, or exemplary loss, damage, or expense relating to thisAgreement (including, without limitation, loss of profit, data, revenue,goodwill, or similar damages) even if advised of the possibility of suchdamages. This paragraph shall survive termination of this Agreement

4. Modify Exhibit A, Revisions to Standard Contract Provisions, Section 1.6, Paragraph 12,Assignment/Delegation/Subcontract, subparagraph 12.3 as follows:

Alvarez & Marsal Public Sector Services, LLC Amendment #1

SS-2021-OCOM-06-CONSU Page 1 of 3

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5D0E5581A3EB

12.3. Except for modifications mutually approved in writing by the Department andthe Contractor, Subcontractors are subject to the same contractualconditions as the Contractor and the Contractor is responsible to ensuresubcontractor compliance with those conditions. The Contractor shall havewritten agreements with all subcontractors, specifying the work to beperformed and how corrective action shall be managed if the subcontractor'sperformance is inadequate. The Contractor shall manage thesubcontractor's performance on an ongoing basis and take corrective actionas necessary. The Contractor shall annually provide the Stale with a list ofall subcontractors provided for under this Agreement and notify the State ofany inadequate subcontractor performance.

5. Modify Exhibit B, Scope of Services, by deleting it in its entirety and replacing it with ExhibitB, Scope of Services - Amendment #1, which is attached hereto and incorporated byreference herein.

6. Modify Exhibit C, Payment Terms, Section 3 as follows:

The Department will pay the Contractor at a rate of $120,000 per week, beginningNovember 1, 2020, through December 30. 2020, to provide services specified inExhibit B - Amendment #1, Scope of Services. The last week of service shall bepro-rated to $72,000.

7. Add Exhibit I, Health Insurance Portability and Accountability Act (HIPAA) BusinessAssociate Agreement, which is attached hereto and incorporated by reference'herein.

8. Modify Exhibit K, DHHS Security Requirements, by deleting it in its entirety and replacingit with Exhibit K - Amendment #1, DHHS Security Requirements, which is attached heretoand incorporated by reference herein.



OocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5D0E5581A3EB

All terms and conditions of the Contract not modified by this Amendment remain in full force andeffect. This amendment shall be effective as of October 30, 2020, subject to the Governor'sapproval issued under the Executive Order 2020-04, as extended by Executive Orders 2020-05,2020-08, 2020-09, 2020-10, 2020-14, 2020-15, 2020-16, 2020-17, 2020-18, 2020-20, 2020-21,2020-23, and 2020-24.

IN WITNESS WHEREOF, the parties have set their hands as of the date written below.

State of New HampshireDepartment of Health and Human Services

12/29/2020

Date

-OocuSignvd by:

NamVH^fflflTOunds

Title: Chief Financial Officer

Alvarez and Marsal Public Sector Services, LLC

12/29/2020

Date

-OocuSigiMd by:

N a ®

Title* Managing Director

The preceding Amendment, having been reviewed by this office, is approved as to form,substance, and execution.

OFFICE OF THE ATTORNEY GENERAL

12/30/2020

Date

OoeuSicntd by:

NamV"^^"^^^" nos;Title: Attorney



DocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5D0E5581A3EB

New Hampshire Department of Health and Human ServicesCOVID-19 DHHS Operations Assessment

EXHIBIT B - Amendment #1

Scope of Services

1. Statement of Work

Phase 1 - August 24, 2020, through October 30, 2020

1.1. The Contractor shall conduct a strategic assessment of the Department ofHealth and Human Services' (Department) operations to quantify the financialimpact of the COVID-19 pandemic on the Department's expenditures andrevenues; and identify programmatic quality improvements to increase theefficiency of Department operations, produce cost savings, and improve the

. delivery of services during and after, the COVID-19 pandemic. To complete theassessment the Contractor shall examine the Department's operations andservice delivery model by:

1.1.1. Discussing strategic priorities, legislative and funding challenges presentedby the COVID-19 pandemic, and long-term goals, with Departmentleadership.

1.1.2. Analyzing the Department's statewide service delivery model andsupporting organizational structure, with specific focus on service deliveryprior to and in response to the COVID-19 pandemic, which includes, but Is notlimited to:

1.1.2.1. The New Hampshire Medicaid Program's delivery model and fundingstructure.

1.1.2.2. Direct client services provided by the Departrrient, that includes, butis not limited to the following priority areas:

1.1.2.2.1. District Offices.

1.1.2.2.2. Child Support Services.

1.1.2.2.3. New Hampshire Hospital.

1.1.2.2.4. Sununu Youth Services Center.

1.1.2.2.5. Glencliff Home.

1.1.2.3. Other services provided by Contractors on behalf of the Departmentthat include, but are not limited to:

1.1.2.3.1. Integrated Delivery Networks (7 agreements).

1.1.2.3.2. Regional Public Health Networks (13 agreements).

1.1.2.3.3. Community Mental Health Centers (10 agreements).

1.1.2.3.4. "Doorways" Access and Delivery Hub for Opioid Use DisorderServices (10 agreements).

1.1.2.3.5. Primary Care Services (9 agreements).88-2021-OCOM-06-CONSU-01-A01 Contractor Initials

•0$

ALVAREZ & MAR8AL PUBLIC 12 /29/20208ECT0R 8ERVICE8 LLC Page 1 of 7 Date ' '

DocuSign Envelope ID: 586AD1B7-E0D1-45C8-A53A-5D0E5581A3EB



1.1.2.3.6. Adult Day Care Services (5 agreements).

1.1.2.3.7. Developmental and Acquired Brain Disorder Services (10agreements).

1.1.2.3.8. Nutrition and Support Services (15 agreements).

1.1.2.3.9. Comprehensive Family Support Services (11 agreements).

1.1.2.3.10. Family Planning Services (9 agreements).

1.1.2.3.11. ServiceLInk Aging & Disability Resource Center Services (7agreements).

1.1.3. Conducting a budget analysis and reviewing the Department's financialstructure, internal fiscal management practices, and internal controls, asapplicable. Activities must Include a review of the Department's current,future, and past biennial budgets, which considers the impact the COVID-19pandemic has had on revenue sources, lapses, budgeted amounts, andactual expenditures. The Contractor shall analyze all of the Department'sCOVID-19 expenditures and identify federal funding sources that areavailable to reimburse the Department for any eligible costs.

1.1.4. Evaluating the Department's current organizational structure by reviewingorganizational charts at the Division, Bureau, and Program levels, and HumanResource reports detailing all filled and vacant and funded and unfundedpositions.

1.1.5. Interviewing Department employees to discuss and observe businessprocesses and workflows. Specific consideration must be given recentchanges due to.the COVID-19 pandemic.

1.1.6. Reviewing and analyzing documentation relevant to the assessment, thatIncludes, but is not limited to, include financial. Information security,performance evaluations or audits conducted by the Department, State orFederal governments. Single Audit and Dedicated Funds reports, Lean or SixSigma analyses, and any other relevant reports.

1.1.7. Identifying and establishing a baseline understanding of the Department'scritical Information Technology systems, that may include, but is not limitedto:

1.1.7.1. Bridges - Division for Children, Youth, and Families.

1.1.7.2. New Heights Eligibility System - Division of Economic and HousingStability.

1.1.7.3. Web Information Technology System (WITS) - Division forBehavioral Health

SS-2021-OCOM-06-CONSU-01-A01 Contractor Initials

ALVAREZ & MARSAL PUBLIC l?/?q/?0?0SECTOR SERVICES LLC Page 2 of 7 Date____




1.1.7.4. Medicaid Management Information Systems (MMIS) - Bureau ofInformation Services.

1.1.7.5. Options - Division of Elderly and Adult Services.

1.1.7.6. New Hampshire Hospital Information Technology Systems.

1.1.7.7. NECSES - Division of Economic and Housing Stability.

1.1.8. Performing other activities necessary to complete the strategic assessment,including but not limited to programmatic SWOT (Strength, Weakness,Opportunity and Threat) analyses, operational capacity assessments, andperformance reviews.

1.2. Based on the results ofthe strategic assessment detailed in 1.1., the Contractorshall work collaboratively with the Department to identify cost savingsopportunities that offer high to medium Return on Investment (ROI) or otheroperational changes to drive efficiency or performance, and then commencesupport for implementation on those opportunities as time allows with a focuson the Department realizing savings by the end of calendar year 2020.

1.3. The Department will provide the Contractor with a key point of contact tofacilitate timely access to information technology systems and data.Department buildings and work space, scheduling Department employees forinterviews or observations, and other resources as necessary.

Phase 2 - November 1, 2020 through December 30, 2020

1.4. The Department will review the report provided under section 2.1. and provideapproval and any required modifications to the Contractor within ten (20)business days of receipt.

1.5. The Contractor shall work collaboratively with the Department to implementcost savings opportunities selected by the Department from the report providedunder section 2.1 that offer high to medium ROI and can be implemented in six(6) to nine (9) months.

1.6. The Contractor shall review and analyze additional opportunities as selectedby the Department's Project Manager.

1.7. For the implementation of selected initiatives, the Contractor shall create andsubmit a work plan that identifies tasks and subtasks with correlated timelinesand resources. The Department will review and approve the work plan.

1.8. The Contractor shall revise the work plan based on Department direction astasks change or expand to mitigate risks and issues. Specific initiatives include,but are not limited'to:

1.8.1. Process improvements to increase IV-E funding penetration;■DS


ALVAREZ & MARSAL PUBLIC , 12/29/2020SECTOR SERVICES LLC Page 3 of 7 Date ' '



EXHIBIT 8 - Amendment #1

1.8.2. Review of eligibility protocols in preparation for the end of the COVID-19public health emergency; and

1.8.3. Additional implementation initiatives at the mutual agreement of theparties.

1.9. The Contractor shall provide project management, including risk management,and complete work plan tasks

1.10. The Contractor shall conduct a focused review of other opportunities selectedby the Department that were not initially prioritized for review in the work plan.The Contractor shall conduct an analysis of each opportunity to estimate returnon investment, tasks, resources, and timelines for implementation. Selectedopportunities may include:

1.10.1. Optional 1915 authority for home and community based services.

1.10.2. Funding options for care coordination.

1.10.3. Implementation of Electronic Visit Verification (EW).

1.10.4. Psychiatric Residential Services for Youth. Grants Management.

1.10.5. Additional opportunities mutually agreed upon by the parties

1.11. The Contractor shall be available, upon request by the Department, to attendprivate or public meetings or hearings with the Governor and ExecutiveCouncil, New Hampshire Legislature, and other organizations as needed, todiscuss the work performed under this contract.

2. Accountabilities

2.1. The Contractor shall submit a report by October 26, 2020, identifying costsavings opportunities that have high to medium ROI and other operationalchanges to drive efficiency or performance that can be either completed in lessthan six months or incorporated into the Department's State Fiscal Year 2022-2023 biennial budget. All solutions must:

2.1.1. Explicitly consider the impact of and the short and long-term challengespresented by the COVID-19 pandemic;

2.1.2. Align with the Department's strategic priorities and mission;

2.1.3. Quantify the capital and human resources necessary for implementation;

2.1.4. Reduce costs without sacrificing quality of services or performance; and

2.1.5. Comply with or identify any necessary changes to existing State andFederal laws and regulations.

-OS


— OS

ALVAREZ & MARSAL PUBLIC 12/29/2020SECTOR SERVICES LLC Page 4 of 7 Date ' '

DocuSign Envelope ID: 586AD1B7-E0D1^5CB-A53A-5O0E5581A3EB



3. Staffing

3.1. The Contractor shall allocate the necessary staffing resources to ensure that allservices required under sections 1 and 2 of Exhibit B Scope of Services aredelivered timely and in accordance with applicable requirements.

3.2. In consideration of the heightened risk presented by the COVID-19 public healthemergency the Contractor's team will work primarily offsite, with onsite presenceat the request of the Department's Project Manager.

4. Confidentiality

4.1. In order to provide services under this Agreement, the Contractor will need toparticipate in internal discussions among State employees, and view internalState documents and written communications. All confidential information,

including, but not limited to, individually identifiable health information shall betreated as confidential by the Contractor in accordance with all federal, state orlocal laws and regulations governing the confidentiality and privacy of individuallyidentifiable health information, including, without limitation, the Health InsurancePortability and Accountability Act of 1996 (HIPAA) and any regulation and officialguidelines promulgated thereunder.

4.1.1. Prior to granting access to confidential information, the Stale shall ensurethat all members of the Contractor's Team have completed, signed, andreturned the Department's Confidentiality Agreement.

5. Exhibits Incorporated

5.1. The Contractor shall use and disclose Protected Health Information that it receives

in its performance of the services under this Agreement in compliance with theStandards for Privacy of Individually Identifiable Health Information (Privacy Rule)(45 CFR Parts 160 and 164) under the Health Insurance Portability andAccountability Act (HIPAA) of 1996, and in accordance with the attached ExhibitI, Business Associate Agreement, which has been executed by the parties.

5.2. The Contractor shall manage all confidential data related to this Agreement inaccordance with the terms of Exhibit K - Amendment #1, DHHS Information

Security Requirements, which is attached hereto and incorporated by referenceherein. The Contractor shall only analyze, review, and store Confidential Data,as defined by Exhibit K - Amendment #1, DHHS Information SecurityRequirements, on equipment owned and issued by the Department.

5.3. The Contractor shall comply with all Exhibits D through H, and J, which areattached hereto and incorporated by reference herein.

SS-2021-OCOM-06-CONSU-01-A01

ALVAREZ & MARSAL PUBLIC

SECTOR SERVICES LLC Page 5 of 7

Contractor Initials

Date12/29/2020




6. Additional Terms

6.1. Impacts Resulting from Court Orders or Legislative Changes

6.1.1. The Contractor agrees that, to the extent future state or federallegislation or court orders may have an impact on the Servicesdescribed herein, the State has the right to modify Service prioritiesand expenditure requirements under this Agreement so as to achievecompliance therewith.

6.2. Credits and Copyright Ownership

6.2.1. All documents, notices, press releases, research reports and othermaterials prepared during or resulting from the performance of theservices of the Contract shall include the following statement, "Thepreparation of this (report, document etc.) was financed under aContract with the State of New Hampshire, Department of Health andHuman Services, with funds provided in part by the State of NewHampshire and/or such other funding sources as were available orrequired, e.g., the United States Department of Health and HumanServices."

6.2.2. All materials produced or purchased under the contract shall haveprior approval from the Department before printing, production,distribution or use.

6.2.3. The Department shall retain copyright ownership for any and alloriginal materials produced, including, but not limited to:

6.2.3.1. Brochures.

6.2.3.2. Resource directories.

6.2.3.3. Protocols or guidelines.

6.2.3.4. Posters.

6.2.3.5. Reports.

However, the Contractor shall retain ownership of its methodologies,processes, techniques, ideas, concepts, trade secrets, and know-howembodied in the Deliverables and the Department shall not publicizeany reports or other work product to the extent such retainContractor's name without the Contractor's consent, except asrequired by applicable law. The Department may adopt a report orother work product as its own without requesting permission from theContractor,'and there shall be no restrictions on transfer,.distribution,or publication, provided that the Department removes all referencesto the Contractor.


ALVAREZ &MARSAL PUBLIC l?/?q/?0?0SECTOR SERVICES LLC Page 6 of 7 Date___ll_

DocuSign Envelope 10: 586AD1B7-E0D1-45CB-A53A-5DOE5581A3EB



6.2.4. The Contractor shall not reproduce any materials produced under thecontract without prior written approval from the Department.

7. Records

7.1. The Contractor shall retain the following records for a period of five years afterfinal payment is made, in accordance with record retention requirements issuedby the US Department of Treasury, Office of Inspector General, which includebut are not limited to:

7.1.1. Books, records, documents and other electronic or physical data evidencingand reflecting all costs and other expenses incurred by the Contractor in theperformance of the Contract, and all income received or collected by theContractor.

7.1.2. All records must be maintained in accordance with accounting proceduresand practices, which sufficiently and properly reflect all such costs andexpenses, and which are acceptable to the Department, and to include,without limitation, all ledgers, books, records, and original evidence of costssuch as purchase requisitions and orders, vouchers, requisitions for materials,inventories, valuations of in-kind contributions, labor time cards, payrolls, andother records requested or required by the Department.

7.2. During the term of this Agreement and the period for retention hereundef, theDepartment, Governor's Office for Emergency Relief and Recover (GOFERR),the -United States Department of Treasury, or the Office of Management andBudget (0MB) and any of their designated representatives shall have accessto all reports and records maintained pursuant to the Agreement for purposesof audit, examination, excerpts and transcripts. Upon payment of the pricelimitation hereunder, the Agreement and all the obligations of the partieshereunder (except such obligations as, by the terms of the Agreement are tobe performed after the end of the term of this Agreement and/or survive thetermination of the Agreement) shall terminate, provided however, that if, uponreview of the invoice the Department shall disallow any expenses claimed bythe Contractor as costs hereunder the Department shall retain the right, at itsdiscretion, to deduct the amount of such expenses as are disallowed or torecover such sums from the Contractor.

88-2021-OCOM-06-CONSU-01-A01

ALVAREZ & MAR8AL PUBLIC

8ECT0R 8ERVICE8 LLC Page 7 of 7

Contractor Initials

Date12/29/2020


New Hampshire Department of Health and Human Services

Exhibit I

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

BUSINESS ASSOCIATE AGREEMENT

The Contractor identified in Section 1.3 of the General Provisions of the Agreement agrees tocomply with the Health Insurance Portability and Accountability Act. Public Law 104-191 andwith the Standards for Privacy and Security of individually Identifiable Health Information, 45CFR Parts 160 and 164 applicable to business associates. As defined herein, "BusinessAssociate" shall mean the Contractor and subcontractors and agents of the Contractor thatreceive, use or have access to protected health information under this Agreement and "CoveredEntity" shall mean the State of New Hampshire. Department of Health and Human Services.

(1) Definitions.

a. "Breach" shall have the same meaning as the term "Breach" in section 164.402 of Title 45.Code of Federal Regulations.

b. "Business Associate" has the meaning given such term in section 160.103 of Title 45. Codeof Federal Regulations.

c. "Covered Entitv" has the meaning given such term in section 160.103 of Title 45,Code of Federal Regulations.

d. "Desionated Record Set" shall have the same meaning as the term "designated recordset"in 45 CFR Section 164.501.

e. "Data Aoareqation" shall have the same meaning as the term "data aggregation" in 45 CFRSection 164.501.

f. "Health Care Ooerations" shall have the same meaning as the term "health careoperations"in 45 CFR Section 164.501.

g. "HITECH Act" means the Health Information Technology for Economic and Clinical HealthAct, Title XIII, Subtitle D. Part 1 & 2 of the American Recovery and Reinvestment Act of2009.

h. "HIPAA" means the Health Insurance Portability and Accountability Act of1996. Public Law104-191 and the Standards for Privacy and Security of Individually Identifiable HealthInformation, 45 CFR Parts 160,162 and 164 and amendments thereto.

i. "Individual" shall have the same meaning as the term "individual" in 45 CFR Section 160.103and shall include a person who qualifies as a personal representative in accordance with 45CFR Section 164.501(g).

j. "Privacv Rule" shall mean the Standards for Privacy of Individually Identifiable HealthInformation at 45 CFR Parts 160 and 164, promulgated under HIPAA by the United StatesDepartment of Health and Human Services.

k. "Protected Health Information" shall have the same meaning as the term "protected healthinformation" in 45 CFR Section 160.103, limited to the information created or received by

DS'Business Associate from or on behalf of Covered Entity.

3/2014 Exhibit I Contractor Inilial

Health Insurance Portability ActBusiness Associate Agreement 12/29/2020

Page 1 of 6 Date



Exhibit I

I. "Required bv Law" shall have the same meaning as the term "required by law" in 45CFRSection 164.103.

m. "Secretary" shall mean the Secretary of the Department of Health and Human Services orhis/her deslgnee.

n. "Security Rule" shall mean the Security Standards for the Protection of Electronic ProtectedHealth Information at 45 CFR Part 164, Subpart C, and amendments thereto.

o. "Unsecured Protected Health Information" means protected health information that is notsecured by a technology standard that renders protected health Information unusable,

unreadable, or indecipherable to unauthorized individuals and is developed or endorsed bya standards developing organization that is accredited by the American National StandardsInstitute.

p. Other Definitions - All terms not otherwise defined herein shall have the meaningestablished under 45 C.F.R. Parts 160, 162 and 164, as amended from time to time, and theHITECH

Act.

(2) Business Associate Use and Disclosure of Protected Health information

a.. Business Associate shall not use, disclose, maintain or transmit, and Covered Entityshall not provide or disclose to Business Associate, Protected Health Information (PHI)except as reasonably necessary to provide the services outlined under Exhibit A of theAgreement. Further. Business Associate, including but not limited to all its directors,officers, employees and agents, shall not use, disclose, maintain or transmit PHI in any -manner that would constitute a violation of the Privacy and Security Rule.

b. Business Associate may use or disclose PHI:I. For the proper management and administration of the Business Associate:II. -As required by law, pursuant to the terms set forth in paragraph d. below; orIII. For data aggregation purposes for the health care operations of Covered

Entity.

c. To the extent Business Associate is permitted under the Agreement to disclose PHI to athird party. Business Associate must obtain, prior to making any such disclosure, (i)reasonable assurances from the third party that such PHI will be held confidentially andused or further disclosed only as required by law or for the purpose for which it wasdisclosed to the third party; and (ii) an agreement from such third party to notify BusinessAssociate, in accordance with the HIPAA Privacy, Security, and Breach Notification Rulesof any breaches of the confidentiality of the PHI, to the extent it has obtained knowledgeof such breach.

d. The Business Associate shall not, unless such disclosure is reasonably necessary toprovide services under Exhibit A of the Agreement, disclose any PHI in response to arequest for disclosure on the basis that it is required by law, without first notifyingCovered Entity so that Covered Entity has an opportunity to object to the discloswfasajidto seek appropriate relief. If Covered Entity objects to such disclosure, the Busij

3/2014 Exhibit I Contractor Initials

Health Insurance Portability Act

Business Associate Agreement 12/2972020Page 2 of 6 Date

DocuSign Envelope ID: 586AD1B7-E0O1-45CB-A53A-5D0E5581A3EB


Exhibit I

Associate shall refrain from disclosing the PHI until Covered Entity has exhausted allremedies.

e. If the Covered Entity notifies the Business Associate that Covered Entity has agreed tobe bound by additional restrictions over and above those uses or disclosures or securitysafeguards of PHI pursuant to the Privacy and Security Rule, the Business Associateshall be bound by such additional restrictions and shall not disclose PHI in violation ofsuch additional restrictions and shall abide by any additional security safeguards.

(3) Obligations and Activities of Business Associate.

a. Business Associate and Covered Entity agree that this Exhibit I constitutes a QualifiedService Organization Agreement ("QSOA") and that in receiving, storing, processing, orotherwise dealing with any patient records (as defined in 42 CFR Part 2.11) from a Part 2program of Covered Entity, Business Associate shall act as a qualified serviceorganization (QSO) on Covered Entity's behalf, according to the applicable provisions of42 use s.290dd-2 and 42 CFR Part 2.

b. Business Associate acknowledges that in receiving, storing, processing, or otherwiseusing, disclosing, or dealing with any patient records from the Part 2 program of CoveredEntity, it is fully bound by all applicable provisions of 42 USC s.290dd-2 and 42 CFR Part2. This includes but is.not limited to, if necessary, resisting any efforts in judicialproceedings to obtain access to patient identifying information related to substance usedisorder diagnosis, treatment, or referral for treatment except as permitted by theregulations in 42 CFR Part 2.

c. Accordingly, except as otherwise limited in this Agreement, Business Associate may useor disclose Protected Health Information to perform functions, activities, or services for, oron behalf of Covered Entity, provided that such use or disclosure would not violate thePrivacy and Security Rules if done by the Covered Entity.

d. Covered Entity is responsible and shall follow all requirements for obtaining appropriatepatient consent necessary for Business Associate to use, disclose, maintain, or transmitPHI as reasonably necessary to provide the services under the Agreement.

e. The Business Associate shall, in compliance with 45 CFR 410, notify the CoveredEntity's Privacy Officer promptly and without unreasonable delay (and in no event laterthan five (5) business days) after the Business Associate becomes aware of any use ordisclosure of protected health information not provided for by the Agreement includingbreaches of unsecured protected health information and/or any security incident thatmay have an impact onthe protected health information of the Covered Entity.

f. The Business Associate shall promptly perform a risk assessment when it becomesaware of any of the above situations. The risk assessment shall include, but not belimited to:

0 The nature and extent of the protected health information involved, including thetypes of identifiers and the likelihood of re-identification;

0 The unauthorized person used the protected health information or to wfyofftthedisclosure was made;

3/2014 Exhibit I Contractor Initial!

Health Insurance Portability Act ^Business Associate Agreement 12/29/2020

Page 3 of 6 Date



Exhibit I

0 Whether tne proieciea neaiin inTormaiion was aciuaiiy acquirea or viewea; ana0 The extent to which the risk to the protected health information has been

mitigated.

The Business Associate shall complete the risk assessment within 5 days of thebreach and immediately report the findings of the risk assessment in writing to theCovered Entity.

g. The Business Associate shall comply with all sections of the Privacy, Security, andBreach Notification Rule specifically applicable to Business Associates. v

h. Business Associate shall make available all of its internal policies and procedures, booksand records relating to the use and disclosure of PHI received from, or created orreceived by the Business Associate on behalf of Covered Entity to the Secretary forpurposes of determining Covered Entity's compliance with HIPAA and the Privacy andSecurity Rule.

i. Business Associate shall require all of its business associates that receive, use or haveaccess to PHI under the Agreement, to agree in writing to adhere to the samerestrictions and conditions on the use and disclosure of PHI contained herein, includingthe duty to return or destroy the PHI as provided under Section 3 (I). The Covered Entityshall be considered a direct third party beneficiary of the Contractor's business associateagreements with Contractor's intended business associates, who will be receiving PHIpursuant to this Agreement, with rights of enforcement and indemnification from suchbusiness associates who shall be governed by standard Paragraph #13 of the standardcontract provisions (P-37) of this Agreement for the purpose of use and disclosure ofprotected health information.

j. Within ten (10) business days of receipt of a written request from Covered Entity,Business Associate shall make available during normal business hours the records,books, agreements, policies and procedures relating to the use and disclosure of PHIto the Covered Entity to the extent necessary for purposes of enabling Covered Entityto determine Business Associate's compliance with the terms of this Exhibit I.

k. Within ten (10) business days of receiving.a written request from Covered Entity,•Business Associate shall provide access to PHI in a Designated Record Set to theCovered Entity, or as directed by Covered Entity, to an individual in order to meet therequirements under 45 CFR Section 164.524.

I. Within ten (10) business days of receiving a written request from Covered Entity for anamendment of PHI or a record about an individual contained in a Designated RecordSet, the Business Associate shall make such PHI available to Covered Entity foramendment and incorporate any such amendment to enable Covered Entity to fulfill itsobligations under 45 CFR Section 164.526.

m. Business Associate shall document such disclosures of PHI and information related to

such disclosures as would be required for Covered Entity to respond to a request by anindividual for an accounting of disclosures of PHI in accordance with 45 CFR Section164.528.

3/2014 Exhibit I Contractor initial!Health Insurance Portability ActBusiness Associate Agreement 12/29/2020

Page 4 of 6 Date



Exhibit I

fv wiinin len p v) Dusiness aays or receiving a vynnen request irom uoverea tnmy ror arequest for an accounting of disclosures of PHI, Business Associate shall make availableto Covered Entity such information as Covered Entity may require to fulfill its obligationsto provide an accounting of disclosures with respect to PHI in accordance with 45 CFRSection 164.528.

o. In the event any individual requests access to, amendment of, or accounting of PHIdirectly from the Business Associate, the Business Associate shall within five (5)business days forward such request to Covered Entity. Covered Entity shall have theresponsibility of responding to forwarded requests. However, if forwarding theindividual's request to Covered Entity would cause Covered Entity or the BusinessAssociate to violate HIPAA and the Privacy and Security Rule, the Business Associateshall instead respond to the individual's request as required by such law and notifyCovered Entity of such response as soon as practicable.

p. Upon termination of the Agreement, for any reason, the Business Associate shallreturn or destroy, as specified by Covered Entity, all PHI received from, or created orreceived by the Business Associate in connection with the Agreement, and shall notretain any copies or back-up tapes of such PHI, in accordance with Exhibit K, SectionIII of the Agreement. If return or destruction is not feasible, or the disposition of the PHIhas been otherwise agreed toln the Agreement, Business Associate shall continue toextend the protections of the Agreement, to such PHI and limit further uses anddisclosures of such PHI to those purposes that make the return or destructioninfeasible, for so long as Business Associate maintains such PHI. If Covered Entity, inits sole discretion, requires that the Business Associate destroy any or all PHI, theBusiness Associate shall certify to Covered Entity that the PHI has been destroyed.

(4) Obligations of Covered Entity

a. . Covered Entity shall notify Business Associate of any changes or llmitation(s) In ItsNotice of Privacy Practices provided to individuals in accordance with 45 CFR Section164.520, to the extent that such change or limitation may affect Business Associate'suse or disclosure of PHI.

b. Covered Entity shall promptly notify Business Associate of any changes in, or revocationof permission provided to Covered Entity by individuals whose PHI may be used ordisclosed by Business Associate under this Agreement, pursuant to 45 CFR Section164.506 or 45 CFR Section 164.508.

c. Covered entity shall promptly notify Business Associate of any restrictions on the use ordisclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522,to the extent that such restriction may affect Business Associate's use or disclosure ofPHI.

(5) Termination for Cause

In addition to Paragraph 9 of the standard terms and conditions (P-37) of thisAgreement the Covered Entity may immediately upon written notice terminate theAgreement upon Covered Entity's knowledge of a breach by Business Associate of theBusiness Associate Agreement set forth herein as Exhibit I, or alternatively proytd^^

3/2014 Exhibit I Contractor Initial!

Heaith Insurance Portability Act 'Business Associate Agreement 12/29/2020

Page 5 of 6 Date

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A.5D0E5581A3EB


Exhibit I

opportunity W BUfelhfeife Ais66ial6 (6 sucn oreacn wiinin a iimerrame specmea oyCovered Entity, if Covered Entity determines that neither termination nor cure isfeasibie, Covered Entity shall report the violation any breach of unsecured ProtectedHealth Information to the Secretary as required by 45 CFR Section 164.408.

(6) Miscellaneous

a. Definitions and Requlatorv References. All terms used, but not otherwise defined herein,shall have the same meaning as those terms in the Privacy and Security Rule, amendedfrom time to time. A reference in the Agreement, as amended to include this Exhibit I, toa Section in the Privacy and Security Rule means the Section as in effect or asamended.

b. Amendment. Covered Entity and Business Associate agree to take such action as isnecessary to amend the Agreement, from time to time as is necessary for CoveredEntity to comply with the changes in the requirements of HIPAA, the Privacy andSecurity Rule, and applicable federal and state law.

c. Data Ownership. The Business Associate acknowledges that it has no ownership rightswith respect to the PHI provided by or created on behalf of Covered Entity.

d. Interpretation. The parties agree that any ambiguity in the Agreement shall be resolvedto permit Covered Entity to comply with HiPAA, the Privacy and Security Rule.

e. Segregation, if any term or condition of this Exhibit I or the application thereof to anyperson(s) or circumstance is held invalid, such invalidity shall not affect other terms orconditions which can be given effect without the invalid term or condition; to this end theterms and conditions of this Exhibit I are declared severable.

f. Survival. Provisions in this Exhibit I regarding the use and disclosure of PHI, return ordestruction of PHI, extensions of the protections of the Agreement in section (3) I. thedefense and indemniftcation provisions of section (3) e and Paragraph 13 of thestandard terms and conditions (P-37), shall sun/ive the termination of the Agreement.

IN WITNESS WHEREOF, the parties hereto have duly executed this Exhibit I.

Department of Health and Human Services Alvarez and Marsal Public Sector Services, LLC

The State Name of the Contractor'DocuSigned by:

uthorized Representative

OocuSigned by:

^^attJce«f>Authorized Representative

Kerrin A. Rounds wanda Seller

Name of Authorized Representative Name of Authorized Representative '

3/2014 Exhibit I Contractor InitialHealth Insurance Portability ActBusiness Associate Agreement 12/30/2020

Page 6 of 6 Date

OocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5D0E5581A3EB


Exhibit i

Chief Financial Officer

Title of Authorized Representative

12/29/2020

Date

Managing Director

Title of Authorized Representative

12/29/2020

Date

3/2014 Exhibit I

Health Insurance Portability ActBusiness Associate Agreement

Page 7 of 6

Contractor Initials

Date12/29/2020



Exhibit K - Amendment #1

DHHS Information Security Requirements

This Exhibit K is made a part of and subject to the terms and conditions set forth in that certain professionalservices agreement (Subject:_ SS-2021-OCOM-06-CONSU-OI-AOI) entered into between the NewHampshire Department of Health and Human Ser\'ices and Alvarez & Marsal Public Sector Services, LLC(the "Agreement)

A. Definitions

The following terms may be reflected and have the described meaning in this document;

1. "Breach" means the loss of control, compromise, unauthorized disclosure,unauthorized acquisition, unauthorized access, or any similar term referring tosituations where persons other than authorized users and for an other than authorizedpurpose have access or potential access to personally identifiable information,whether physical or electronic. With regard to Protected Health Information," Breach"shall have the same meaning as the term "Breach" in section 164.402 of Title 45,Code of Federal Regulations.

2. "Computer Security Incident" shall have the same meaning "Computer SecurityIncident" in section two (2) of NIST Publication 800-61, Computer Security IncidentHandling Guide, National Institute of Standards and Technology, U.S. Department ofCommerce.

3. "Confidential Information" or "Confidential Data" means all confidential information

disclosed by one party to the other such as all medical, health, financial, publicassistance benefits and personal information including without limitation. SubstanceAbuse Treatment Records, Case Records, Protected Health Information andPersonally Identifiable Information.

Confidential Information also includes any and all information owned or managed bythe State of NH - created, received from or on behalf of the Department of Health andHuman Services (DHHS) or accessed In the course of performing contracted services- of which collection, disclosure, protection, and disposition is governed by state orfederal law or regulation. This information includes, but is not limited to ProtectedHealth Information (PHI), Personal Information (PI), Personal Financial Information(PFl), Federal Tax Information (FTI), Social Security Numbers (SSN), Payment CardIndustry (PCI), and or other sensitive and confidential information.

4. "End User" means any person or entity (e.g., contractor, contractor's employee,business associate, subcontractor, other downstream user, etc.) that receives DHHSdata or derivative data in accordance with the terms of this Contract.

5. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and theregulations promulgated thereunder.

6. "Incident" means an act that potentially violates an explicit or implied security policy,which includes attempts (either failed or successful) to gain unauthorized access to asystem or its data, unwanted disruption or denial of service, the unauthorized use of a

vs. Last update 10/09/18 Exhibit K Contractor InitialsDHHS information

Security Requirements

DS

Page 1 of 10 Date 1^/29/2020





system for the processing or storage of data; and changes to system hardware,firmware, or software characteristics without the owner's knowledge, instruction, orconsent. Incidents include the loss of data through theft or device misplacement, lossor misplacement of hardcopy documents, and misrouting of physical or electronic mail,all of which may have the potential to put the data at risk of unauthorized access, use,disclosure, modification or destruction.

7. "Open Wireless Network" means any network or segment of a network that is notdesignated by the State of New Hampshire's Department of InformationTechnology or delegate as a protected network (designed, tested, and approved,by means of the State, to transmit) will be considered an open network and notadequately secure for the transmission of unencrypted PI, PFI, PHI or confidentialDHHS data.

8. "Personal Information" (or "PI") means information which can be used to distinguish ortrace an individual's identity, such as their name, social security number, personalinformation as defined In New Hampshire RSA 359-C:19, biometric records, etc..alone, or when combined with other personal or identifying information which is linkedor linkable to a specific individual, such as date and place of birth, mother's maidenname, etc.

9. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable HealthInformation at 45 C.F.R. Parts 160 and 164, promulgated under HIPAA by the UnitedStates Department of Health and Human Services.

10. "Protected Health Information" (or "PHI") has the same meaning as provided in thedefinition of "Protected Health Information" in the HIPAA Privacy Rule at 45 C.F.R. §160.103.

11. "Security Rule" shall mean the Security Standards for the Protection of ElectronicProtected Health Information at 45 C.F.R. Part 164, Subpart C, and amendmentsthereto. '

12. "Unsecured Protected Health Information" means Protected Health Information that is

not secured by a technology standard that renders Protected Health Informationunusable, unreadable, or indecipherable to unauthorized individuals and is developedor endorsed by a standards developing organization that is accredited by the AmericanNational Standards Institute.

I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR

A. Business Use and Disclosure of Confidential Information.

1. The Contractor must not use, disclose, maintain or transmit Confidential Informationexcept as reasonably necessary as outlined under this Contract. Further, Contractor,including but not limited to all its directors, officers, employees and agents, must not use.

V5. Last update 10/09/18 Exhibit K Contractor InitialsDHHS Information


OS

Page 2 of 10 Date 12/29/2020





disclose, maintain or transmit PHI in any manner that would constitute a violation of thePrivacy and Security Rule.

2. The Contractor must not disclose any Confidential Information in response to a requestfor disclosure on the basis that it is required by law, in response to a subpoena, etc.,without first notifying DHHS so that DHHS has an opportunity to consent or object to thedisclosure.

3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additionalrestrictions over and above those uses or disclosures or security safeguards of PHIpursuant to the Privacy and Security Rule, the Contractor must be bound by suchadditional restrictions and must not disclose PHI in violation of such additional restrictions

and must abide by any additional security safeguards.

4. The Contractor agrees that DHHS Data or derivative there from disclosed to an End Usermust only be used pursuant to the terms of this Contract.

5. The Contractor agrees DHHS Data obtained under this Contract may not be used for anyother purposes that are not indicated in this Contract.

6. The Contractor agrees to grant access to the data to the authorized representatives ofDHHS for the purpose of inspecting to confirm compliance with the terms of this Contract.

7. The Department will provide laptops to the Contractor to view or analyze any data setsthat contain Confidential Data. The Department will configure laptops and user accounts(including email and file sen/er access) to minimize the risk of data loss. Including:

7.1 Ensuring such laptops are whole disk encrypted and password protected.

7.2 Disabling the USB ports from use for all Department devices provided to A&M.

7.3 Ensuring such laptops are adequately configured to prevent malware.

8. The Contractor agrees to utilize and not modify any hardware or software configurationfor the devices being provided, nor will any USB devices be inserted into Departmentissued devices.

9. All Confidential Data shared between the Contractor and Department employees will bestored on the Department resources provided to the Contractor during the contract period,including emails and files associated with the contract deliverables.

10. The Department will only transmit Confidential Data to the Contractor using only aDepartment-designated secure site, file repository, or Department email system whichenforces encryption.

11. The Department will make best efforts to de-identify datasets (including those with PHI),provided to the Contractor where feasible.

12. The Department will provide or disclose PHI that is clearly identified as PHI and that is onlyaccessible to Contractor on Department resources (specifically. Department's equipmentthat Is connected to its network storing such PHI) during the term of the Agreement.Notwithstanding anything to the contrary contained herein. Contractor shall not have anyresponsibility for the integrity and security of the Department's equipment and technical

vs. Last update 10/09/18 Exhibit K Contractor InitialsOHHS Information


OS

Page 3 of 10 Date 12/29/2020

DocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5O0E5581A3EB




and physical infrastructure of Department's network and premises, including but not limitedto the configuration and technical security of Department's equipment (i.e., laptops)provided by the Department to the Contractor in order to access and utilize PHI. TheContractor may act under the assumption and reliance that any storage on theDepartment's equipment or on the Department's network and/or transmission of PHI orPHI solely within the network and/or infrastructure of the Department is adequately secureand permitted under the HIPAA Rules. The Contractor shall not attempt to modify or alterthe physical equipment or attempt to bypass any securities implemented on the equipmentprovided by the Department. Any alterations to the software or hardware by the Contractorwould be considered a breach of contract and the Contractor would be responsible for anyincurred damages to include but not limited to: HIPAA violations, physical damage, otherregulatory and compliance violations.

II. METHODS OF SECURE TRANSMISSION OF DATA

1. Application Encryption. If End User is transmitting DHHS data containing ConfidentialData between applications, the Contractor attests the applications have beenevaluated by an expert knowledgeable in cyber security and that said application'sencryption capabilities ensure secure transmission via the internet.

2. Computer Disks and Portable Storage Devices. End User may not use computer disksor portable storage devices, such as a thumb drive, as a method of transmitting DHHSdata.

3. Encrypted Email. End User may only employ email to transmit Confidential Data ifemail is enervated and being sent to and being received by email addresses ofpersons authorized to receive such information. '

4. Encrypted Web Site. If End User is employing the Web to transmit Confidential Data,the secure socket layers (SSL) must be used and the web site must be secure. SSLencrypts data transmitted via a Web site.

5. File Hosting Services, also known as File Sharing Sites. End User may not use filehosting services, other than Contractor instances of the service Box to transmitConfidential Data.

6. Ground Mail Service. End User may only transmit Confidential Data via certified groundmail within the continental U.S. and when sent to a named individual.

7. Laptops and PDA. If End User is employing portable devices to transmit ConfidentialData said devices must be encrypted and password-protected.

8. Contractor will utilize encryption at rest and in transit to secure Confidential Data.

9. SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. IfEnd User Is employing an SFTP to transmit Confidential Data, End User will structurethe Folder and access privileges to prevent inappropriate disclosure of information.

vs. Last update 10/09/18 Exhibit K Contractor InitialsDHHS Information


-OS

Page 4 of 10 Date 12/29/2020

DocuSign Envelope ID: 586AD1B7-E0D1-45CB.A53A-5D0E5581A3EB




SFTP folders and sub-folders used for transmitting Confidential Data will be coded for 24-hour auto-deletion cycle (i.e. Confidential Data will be deleted every 24 hours).

10. Wireless Devices. If End User is transmitting Confidential Data via wireless devices, alldata must be encrypted to prevent inappropriate disclosure of information.

RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS

The Contractor will only retain the data and any derivative of the data for the duration of thisContract. After such time, the Contractor will have 30 days to destroy the data arid anyderivative in whatever form it may exist, unless, otherwise required by law or permitted underthis Contract. To this end, the parties must:

A. Retention

1. The Contractor agrees it will not store, transfer or process data collected inconnection with the services rendered under this Contract outside of the United

States. This physical location requirement shall also apply in the implementation ofcloud computing, cloud service or cloud storage capabilities, and includes backupdata and Disaster Recovery locations.

2. The Contractor agrees to ensure proper security monitoring capabilities are in placeto detect potential security events that can impact State of NH systems and/orDepartment confidential information for contractor provided systems.

3. The Contractor agrees to provide security awareness and education for its End Usersin support of protecting Department confidential information.

4. The Contractor agrees to retain all electronic and hard copies of Confidential Datain a secure location and identified in section IV. A.2

5. The Contractor agrees Confidential Data stored in a Cloud must comply with allapplicable statutes and regulations regarding the privacy and security. All serversand devices must have currently-supported and hardened operating systems, thelatest anti-viral, anti-hacker, anti-spam, anti-spyware, and anti-malware utilities. Theenvironment; as a whole, must have aggressive intrusion-detection and firewallprotection.

6. The Contractor agrees to and ensures its complete cooperation with the State'sChief Information Officer in the detection of any security vulnerability of the hostinginfrastructure.

B. Disposition

1. If the Contractor will maintain any Confidential Information on its systems {or its subcontractor systems), the Contractor will maintain a documented process for securelydisposing of such data upon request or contract termination; and will obtain writtencertification for any State of New Hampshire data destroyed by the Contractor or

vs. Last update 10/09/18 Exhibit K Contractor initialsDHHS Information


■OS

Page 5 of 10 Date 1-2/29/2020





any subcontractors as a part of ongoing, emergency, and or disaster recoveryoperations. The Contractor will provide written attestation to the Department uponrequest in accordance with the guidance in NIST Special Publication 800-88, Rev 1,Guidelines for Media Sanitization.

2. Unless otherwise specified, within thirty (30) days of the termination of this Contract;Contractor agrees to destroy all hard copies of Confidential Data using a securemethod such as micro-cross shredding.

3. Unless otherwise specified, within thirty (30) days of the termination of this Contract,Contractor agrees to completely destroy all electronic Confidential Data by meansof data erasure, also known as secure data wiping.

IV. PROCEDURES FOR SECURITY

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and anyderivative data or files, as follows:

1. The Contractor will maintain proper security controls to protect Department confidentialinformation collected, processed, managed, and/or stored in the delivery of contractedservices.

2. The Contractor will maintain policies and procedures to protect Department confidentialinformation throughout the information lifecycle, where applicable, (from creation,transformation, use, storage and secure destruction) regardless of the media used tostore the data (i.e., tape, disk, paper, etc.).

3. The Contractor will maintain appropriate authentication and access controls tocontractor systems that collect, transmit, or store Department confidential informationwhere applicable.

4. The Contractor will ensure proper security monitoring capabilities are in place to detectpotential security events that can impact State of NH systems and/or Departmentconfidential Information for contractor provided systems.

5. The Contractor will provide regular security awareness and education for its End Usersin support of protecting Department confidential information.

6. If the Contractor will be sub-contracting any core functions of the engagementsupporting the services for State of New Hampshire, the Contractor will maintain aprogram of an internal process or processes that defines specific security expectations,and monitoring compliance to security requirements that at a minimum match those forthe Contractor, including breach notification requirements.

7. The Contractor will work with the Department to sign and comply with all applicableState of New Hampshire and Department system access and authorization policies andprocedures, systems access forms, and computer use agreements as part of obtaining



08

PageeoflO Date 12/29/2020

OocuSign Envelope ID; 586AD1B7-E0D1-45CB.A53A-5D0E5581A3EB




and maintaining access to any Department system(s). Agreements will be completedand signed by the Contractor and any applicable sub-contractors prior to systemaccess being authorized.

8. Reserved

9. The Contractor will work with the Department at its request to complete a SystemManagement Survey. The purpose of the survey is to enable the Department andContractor to monitor for any changes in risks, threats, and vulnerabilities that mayoccur over the life of the Contractor engagement. The survey will be completedannually, or an alternate time frame at the Departments discretion with agreement bythe Contractor, or the Department may . request the survey be completed when thescope of the engagement between the Department and the Contractor changes.

10. the Contractor will not store any State of New Hampshire or Department data outsidethe boundaries of the United States unless prior express written consent is obtainedfrom the Information Security Office leadership member within the Department.

11. Data Security Breach Liability. In the event of any security breach Contractor shallmake efforts to investigate the causes of the breach, promptly take measures to preventfuture breach and minimize any damage or loss resulting from the breach. For thosebreaches caused by the actions of the Contractor, the State shall recover from theContractor all costs of response and recovery from the breach, including but not limitedto: credit monitoring services, mailing costs and costs associated with website andtelephone call center services necessary due to the breach.

12. Contractor must, comply with all applicable statutes and regulations regarding theprivacy and security of Confidential Information, and must in all other respects maintainthe privacy and security of PI and PHI at a level and scope that is not less than thelevel and scope of requirements applicable to applicable government contractors,including, but not limited to, provisions of any applicable law that govern protections forindividually identifiable health information and as applicable under State law.

13. Contractor agrees to establish and maintain appropriate administrative, technical, andphysical safeguards to protect the confidentiality of the Confidential Data and toprevent unauthorized use or access to it.

14. The Contractor must notify NHDHHS Information Security via the email addressprovided In this Exhibit, of any Incidents or Breaches immediately after the Contractorhas determined that the aforementioned has occurred and that Confidential Data mayhave been exposed or compromised.

15. Contractor must restrict access to the Confidential Data obtained under this Contract

to only those authorized End Users who have an authorized need for such DHHSData to perform their official duties in connection with purposes identified in thisContract.

>os


Security RequirementsPage 7 of 10 Date 12/29/2020





16. The Contractor must ensure that all End Users:

a. comply with such safeguards as referenced in Section IV A. above, implementedto protect Confidential Information that is furnished by DHHS under this Contractfrom loss, theft or inadvertent disclosure.

b. safeguard this information at all times.

c. ensure that laptops and other electronic devices/media containing PHI, PI, or PFIare encrypted and password-protected.

d. send emails containing Confidential Information only if encrvpted and being sentto and being received by email addresses of persons authorized to receive suchinformation.

e. limit disclosure of the Confidential Information to the extent permitted by law.

f. Confidential Information received under this Contract and individually identifiabledata derived from DHHS Data, must be stored in an area that is physically andtechnologically secure from access by unauthorized persons during duty hoursas well as non-duty hours (e.g.. door locks, card keys, biometric identifiers, etc.).

g. only authorized End Users may tra^nsmit the Confidential Data, including anyderivative files containing personally identifiable information, and in all cases,such data must be encrypted at all times when In transit, at rest, or when storedon portable media as required in section IV above.

h. in all other instances Confidential Data must be maintained, used and disclosedusing appropriate safeguards, as determined by a risk-based assessment of thecircumstances Involved.

i. understand that their user credentials (user name and password) must not beshared with anyone. End Users will keep their credential information secure.This applies to credentials used to access the site directly or indirectly through athird party application.

Contractor is responsible for oversight and compliance of their End Users. DHHSreserves the right to conduct onsite inspections to monitor compliance with this Contract,including the privacy and security requirements provided in herein, HIPAA, and otherapplicable laws and Federal regulations until such time the Confidential Data is disposedof in accordance with this Contract. Onsite inspections shall be conducted no more thanannually at the cost of the Department with reasonable notice to the Contractor - partiesagree this stipulation is waived if the Inspection is in relationship to a security incident orbreach related to Confidential Data.

V. LOSS REPORTING

A. The Contractor must notify NHDHHS Information Security via the email addressprovided in this Exhibit, of any Incidents or Breaches immediately after the

V5, Lasl update 10/09/18 Exhibit K Contractor initialsDHHS Information


DS

Page 8 of 10 Date 1-2/29/2020





Contractor has determined that the aforementioned has occurred and that

Confidential Data may have been exposed or compromised.

1. Parties acknowledge and agree that unless notice to the contrary is providedby Department in its sole discretion to Contractor, this Section V.Iconstitutes notice by Contractor to Department of the ongoing existence andoccurrence or attempts of Unsuccessful , Security Incidents for which noadditional notice to Department shall be required. "Unsuccessful SecurityIncidents" means, without limitation, pings and other broadcast attacks onContractor's firewalls, port scans, unsuccessful log-on attempts, denial ofservice attacks, and any combination of the above, so long as no suchIncident results in unauthorized access, use or disclosure of PHI.

B. In addition to, and notwithstanding, Contractor's compliance with all applicableobligations and procedures. Contractor's procedures must also address how theContractor will:

1. Identify Incidents:

2. Determine If Confidential Data is involved in Incidents;

3. Report suspected or confirmed Incidents or breach to the Department as required inthis Exhibit. The Department will provide the Contractor with a NH DHHS SecurityContractor Incident Risk Assessment Report for completion;

4. Within 24-hrs of initial notification to the Department, complete the NH DHHS SecurityContractor Incident Risk Assessment Report and email it to the Department'sInformation Security Office at the email address provided herein;

5. Identify and convene a core response group to determine the risk level of Incidentsand determine risk-based responses to Incidents and mitigation measures, prepare toinclude the Department in the incident response calls throughout the incidentresponse investigation;

6. Identify incident/breach notification method and timing;

7. Within one business week of the conclusion of the Incident/Breach responseinvestigation a final written Incident Response Report and Mitigation Plan issubmitted to the Department's Information Security Office at the emailaddress provided herein;

8. Address and report incidents and/or Breaches that implicate personalinformation (PI) to the Department in accordance with NH RSA 359-C:20 andthis Agreement;

9. Address and report Incidents and/or Breaches per the HIPAA BreachNotification Rule, and the Federal Trade Commission's Health BreachNotification Rule 16 CFR Part 318 and this Agreement.

V5. Last update 10/09/18 ' Exhibit K Contractor InitialsDHHS Information


OS

Page 9 of 10 Date 12/29/2020

DocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5O0E5581A3EB




C. All legal notifications required as a result of a breach of information, or potentialbreach, collected pursuant to this Contract shall be coordinated with the State. TheContractor shall ensure that any subcontractors used by the Contractor shall similarlynotify the State of a Breach, or potential Breach immediately upon discovery, shallmake a full disclosure, including providing the State with all available information,and shall cooperate fully with the State, as defined above.

VI. CONFLICT OF TERMS

In the event of any conflict or inconsistency between other Contract provisions) and theInformation Security Requirements Exhibit, this Exhibit shall control and govern the rights andinformation security and inciden^breach obligations of the parties.

VII. PERSONS TO CONTACT

A. DHHS Security Officer:

[email protected]

V5. Lasl update 10/09/18 Exhibit K Contractor InitialsDHHS information


-OS

Page 10 of 10 Date 12/29/2020


State of New Hampshire

Department of State

CERTIFICATE

1, Williain M. Gardner, Secretary of State of the State of New Hampshire, do hereby certify that ALVAREZ &. MARSAL

PUBLIC SECTOR SERVICES, LLC is a Delaware Limited Liability Company registered to transact business in New

Hampshire on November 01, 2019. 1 further certifV that all fees and documents required by the Secretary of State's office have

been received and is in good standing as far as this office is concerned.

Business ID; 830474

Certificate Number 0004981825

OSf

Ik

o

A

(N TESTIMONY WHEREOF,

t hereto set my hand and cause to be affixed

the Seal of the State of New Hampshire,

this 19th day of August A.D. 2020.

w.

William M. Gardner

Secretary of State


CERTIFICATE OF AUTHORITY

1. Thomas Shaffer, hereby certify that:(Name of the elected Officer of the Corporation/LLC; cannot be contract signatory)

1. 1 am a duly elected Clerk/Secretary/Officer of Alvarez & Marsal Public Sector Services, LLC.(Corporation/LLC Name)

2. The following is a true copy of a vote taken at a meeting of the Board of Directors/shareholders, duly called andheld on December 29. 2020, at which a quorum of the Directors/shareholders were present and voting.

(Date)

VOTED: That Wanda Seller / Managing Director (may list more than one person)(Name and Title of Contract Signatory)

is duly authorized on behalf of Alvarez & Marsal Public Sector Services, LLC to enter into contracts or agreementswith the State of New Hampshire and any of its agencies or departments and further is authorized to execute anyand all documents, agreements and other instruments, and any amendments, revisions, or modifications thereto,which may in his/her judgment be desirable or necessary to effect the purpose of this vote.

3. I hereby certify that said vote has not been amended or repealed and remains in full force and effect as of thedate of the contract/contract amendment to which this certificate is attached. This authority remains valid forthirty (30) days from the date of this Certificate of Authority. I further certify that it is understood that the State ofNew Hampshire will rely on this certificate as evidence that the person(s) listed above currently occupy theposition(s) indicated and that they have full authority to bind the corporation. To the extent that there are anylimits on the authority of any listed individual to bind the corporation in contracts with the State of New Hampshire,all such limitations are expressly stated herein.

Dated: 12/29/20

Signature of Elected OfficerName: Thomas Shaffer

Title: Managing Director and Co-National Practice Leader

Rev. 03/24/20


ACOKO- CERTIFICATE OF LIABILITY INSURANCE OATCtMUaOWYYY)

8/21/2020

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THISCERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND. EXTEND OR ALTER THE COVERAGE AFFORDED BYTHEPOUCIESBELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZEDREPRESENTATIVE OR PRODUCER. AND THE CERTIFICATE HOLDER.

IMPORTANT: If the certificate holder Is en ADDITIONAL INSURED, the poilcy(lts) must have AOOmONAL' INSURED provliloni or be endorsed.If SUBROGATION IS WAIVED, Subject to tt>o terms and conditions of the policy, certain policies may require an endorsement. A statement onthis certificate does not confer riahts to the certificate holder In lieu of such endorsemenKs).

PROOUCEP

Nathan Butwln Company, Inc.60 Cutter Mill Rd. Ste. 4l4Greet Neck. NY 11021

Eiiqn Goldman |

i-K. e.d: (516) 466-4200 Ti?. ko.:(51 6) 466-4213!#^«.info®butwfn.com )

wsuRfRui AFPOfloiHC coveaxce NAICi

•Nsupen A: Federal Insurance Comoanv 01295

INSURSD

Alverez & MarstI Holdings, LLC600 Madison Ave,

8th Floor

New York, NY 10022

iNsuitpR A; The Hartford Insurance Co 37478

INtUfllftC:

INSURCRC:

MSURCRP:

COVERAGES CERTIFICATE NUMBER: REVISION NUMBER:

THIS IS TO CeftTlFY THAT THE POLICIES OP INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIODINDICATED. NOTWITHSTANDING ANY REQUIREMENT. TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THISCERTIFICATE MAY BE ISSUED OR MAY PERTAIN. THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS.EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.

IN9PI

ilB.TY^ or MSUIUHCC

AOM.

mao.COUUeRCIAL OCNCRAl LIABIUTY

0CUUMSMAOE I OCCUR

GEWVACCB6

POLICY

'GATg LIMIT APPLIES

□sm □l£SPeR;

LOC

other:

SUDRjcom. POLICY NUMBER LIMITB

35846225 4/12/2020 4/12/2021EACH OCCURRENCE

PRFt IEb oc^rrcfKAl

MEO EXP (Any Oft* ptfW)

PERSONAL A AOV injury

GENERAL aGCREGaTE

PRODUCTS • COMP^ AGOEmploy Benefits

1,000,000

1,000,00010,000

1,000,0002.000,000Included

1,000,000

AUTOUODILe UABILnY

ANY AUTOOWNEOAUTOS ONLY

M^^ONLY

COMSINEO SINGLE UMITlEu

1,000,000

73535272 4/12/2020 4/12/2021 BOOILY INJURY (Ptf P>fWl

BOPILY INJURY IPtf xtdtfNVl

UHeRELLALIAS

EXCESSLUO

OCCUR

CLAIUS4M0E 70S47592 4/12/2020 4/12/2021EACH OCCURRENCE

22.000,000

22,000,000

X RETEMnOHl 10,000wOftXERB COHPCNSAnONAMD EUPLOrERr UABAITY

IUPAATNER^XECUTIVEEXaUDEO? n 12WBAB6U5L 6/1/2020 6/1/2021

y PER OTH-^ STATUTE ER

E.L. EACH ACCIDENT1,000,000

E.L. DISEASE • EA EMPLOYEE1,000.000

II r«*, BMOlbt underOESCRIPnON QE OPERATIONS ftlcw E.L. DISEASE • POLICY LIMIT

1,000,000

Property 35846225 4/12/2020 4/12/2021 Limit 3,065,000

oeSCRlPnOM OE OPCRATKMS / LOCATTOmS < VENClCS IACORO let. Addittonal R*m«flu ScAMuM. nwy M MUctitd H mere (PK« I* reQulred)

CERTIFICATE HOLDER

Stete of Now HampshireDepertmont of Keelth end Human Services129 Plessant StreetConcord, NH 03301-38S7

CANCELLATION

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORETHE EXPIRATION DATE THEREOF. NOTICE W1U BE DELIVERED INACCORDANCE WITH THE POLICY PROVISIONS.

AUTHORIZED REPRESENTATIVE

'(pun 6M.mcLnACORD 25 (2016/03) C> 1988-2015 ACORD CORPORATION. Ail rights roBorvod.

The ACORD name and logo are registered marks of ACORD

DocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5D0E5581A3EBSEP09'20Pri 2:49 OAS

Lofi A. SUbisettc

Cemfflinloocr

Leri A. Wrtvcr

Dcpaty CeBotuioecr

STATE OF NEW HAMPSHIRE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

OFFICE OF THE COMMISSIONER

129 PLEASANT STREET. CONCORD. NH mOlStSl

603-n-9200 l-«nMS2-3MSExt920QFai:603<271<49l2 TOD Acccn: I-800-735-2964 www.dblu.nb.gov

September 1, 2020

His Excellency, Governor Christopher T. Sununuand the Honorable Council

State House

Concord. New Hampshire 03301

INFORMATIONAL ITEM

Pursuant to RSA 4:45, RSA 21-P:43. and Section 4 of Executive Order 2020-04 asextended by Executive Orders 2020-05. 2020-08, 2020-09, 2020-10, 2020-14, 2020-15, and2020-16, Governor Sununu has authorized the Department of Health and Human Senrices, Officeof the Commissioner, to enter into a Retroactive. Sole Source contract with Alvarez & MarsalPublic Sector Services, LLC (VC#TBD), Metropolitan Square, 655 15"* Street, NW, Suite 600,Washington. DC 20005, in the amount of $1.580,000. for conducting a strategic assessment ofthe Department's operations, wtiich explicitly considers the financial and operational impacts ofthe COViD-19 pandemic, and making recommendations to produce cost savings, increaseoperational efficiency, and improve the delivery of services, with the option to extend contractedservices for up to three (3) years, effective retroactive to August 24. 2020, through October 30.2020.100% Other Funds (Governor's Office for Emergency Relief and Recovery).

Funds are available In the following account for State Fiscal Year 2021, with the authorityto adjust budget line items within the price limitation through the Budget Office, If needed andjustified.

05-95-95-950010-19290000 HEALTH AND SOCIAL SERVICES, DEPT OF HEALTH ANDHUMAN SVCS, HHS: HUMAN SERVICES, OFFICE OF THE COMMISSIONER - QOFERRFUNDS

State

Fiscal Year

Class /

AccountClass Title Job Numt>er Total Amount

2021 103-502507 Contrscts for Oper Svc 95010799 $1,580,000

Total $1,680,000

EXPLANATION

This item is Sole Source because the Contractor is a leading global professional servicesfirm that specializes in identifying and assisting organizations with the Implementation ofmeaningful, cost-saving, and service enhancing recommendations. The COVID-19 pandemichas caused significant stress on the Department's existing service delivery model and currentbudget. The Contractor was able to begin providing services immediately and will deliverrecommendations to decrease costs in the short-term and lor>g-term that will save the Depa^entmoney in this biennium and subsequent budgets. This Item is Retroactive because theDepartment needed the Contractor to begin immediately to allow for adequate time to implement

Th$ Deparlmtnl of Iftollh ond Human S«rvict$' Minion it to join communiliei and familitiin providing opportuniiiet for citixtnt to ochitvt htoUh ond indeptndenet.

DocuSign Envelope ID: 586AD1B7-E0D1-45C8-A53A-5DOE5581A3EB

Hit Excellency. Governor Christopher T. Sununuend the Honorable Council

Page 2 of 2

any cost savings recomrT^endations to achieve them In State Fiscal Year 2021 and incorporatethem Into the next biennial budget cycle.

The purpose of this agreement is for the Contractor to conduct a strategic assessmentof the Department's operatior^ to quantify the financial Impact the COVIO-19 pandemic has hadon the Department's expenditures and revenues and general operations. The Contractor willidentify programmatic quality improvements to increase the efficiency of Department operations,produce cost savings, and improve the delivery of services duririg and after the COVID-19pandemic.

To complete the assessment, the Contractor will examine the Department's operationsand service delivery model to understand the impacts of COVID-19. Further, the Contractor willmeet with senior leadership to discuss strategic priohties, legislative and funding challengespresented by the COVID-19 pandemic, and long-term goals and solutions. The Contractor willanalyze the Department's Btatevnde service delivery model and supporting organizationalstructure, with specific focus on service delivery prior to and in response to the COVID-19pandemic, which includes, but Is not limited to, the New Hampshire Medtcaid Program's deliverymodel and funding structure, end direct client services provided by District Offices, the NewHampshire Hospital. Glenclrff Home, and the Sununu Youth Senrices Center. The Contractor willalso analyze the Department's contracted service delivery system.

The Contractor will conduct a budget analysis that considers the COVID-19 pandemic'simpact on revenue sources, lapses, budgeted amounts, and actual expenditures. The Contractorwill analyze the Departrhent's COVID'19 expenditures and identify federal funding sources thatare available to reimburse the Department for any eligible costs.

The Contriactor will provide the Department with a report and recommendations that drivecost savings, expiicHly consider the impact of and the short-term and long-term challengespresented by the COVID-19 pandemic, align with the Department's strategic priorities andmission, and quantify the capital and human resources necessary for Implementation. TheContractor will work collaboratively wHh the Depariment to Implement any recommendations theDepartment determines will further the Department's mission, decrease costs, and Increase theeffectiveness and efficiency of operations.

As referenced in Exhibit A of the attached contract, the parties have the option to extendthe agreement for up three (3) additional years, contingent upon satisfactory delivery of services,available funding, agreement of the parties and required governmental approval.

Source of Funds; CFDA #21.019, FAIN #TBD - 100% Federal Funds.

Respectfully submitted,

Lori A. ShibinetteCommissioner

OocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5O0E5581A3EB

FORM NUMBER P.37 (version 12/1 )/20l9)

SubJeci:_SS-2021 -OCOM.06-CONSU

Noiice: TTiU agreement and all of its attachments shall become public upon submission to Goverpor andExecutive Council for approval. Any Information that is private, confidential or proprietary mustbe clearly identified to the agency and agreed to In writing prior to signing the contract.

agreement

The Stale of New Hampshire artd the Contractor hereby mutually agree as follows:

GENERAL PROVISIONS

I. IDENTIFICATION.

1.1 State Agency Name


1.2 State Agency Address

129 Pleasant Street

Concord. NH 03301.3857

1.3 Contractor Name

ALVAREZ & MARSAL PUBLIC SECTOR

SERVICES. LLC

1.4 Contractor Address

Metropolitan Square, 655 15th Street, NW, Suite 600Washington, DC 20005

1.5 Contractor Phone

Number

(605)295.2591

1.6 Account Number

1929-502507 95010799

1.7 Completion Date

October 30, 2020

1.8 Price Limitation

SI,580,000

1.9 Contracting OfTicer for Stale Agency

Nathan D. White, Director

1.10 State Agency Telephone Number

(603)271-9631

1.lU ContractorS^t^ture > 1.12 Name and Title of Contractor Signatory

1.13 State Agency Signature 1.14 Name and Title of State Agency Signatory

Lol^i .S(>binc'Hc1 Cnmmi<^<.\hr)P/

Srt^ Approval by the N.H. Depanmem of Administfation, Division of Personnel 0/applicable)

By: Director. On:

1.16 Approval by the Anomey General (Form, Substance and £%ec\i\\an) (ifapplicable)

b/26/2020

1.17 Approval by the Governor and Executive Council (ifapplicable)

G&C Item number; G&C Meeting Date:

Page 1 of 4Contractor Initials

Date 3[Sp5lO


2. SERVICES TO BE PERFORMED. The Siale of NewHampshire, acting through the agency identified in block t.l("State"), engages contractor tdentified in block 1.3("Contractor") to perform, and the Contractor shall perform, thework or sale of goods, or both, identified and more p^icularlydescribed In the attached EXHIBIT 8 which is incorporatedherein by reference ("Services*').

3. EFFECTIVE DATE/COMPLETION OF SERVICES.3.1 Notwithstanding any provision of this Agreemern to thecontrary, end subject to the approval of the Governor andExecutive Council of the State of New Hampshire, if applicable,this Agreement, and alt obligations of the parties hereunder, shallbecome effective on the date the Governor and ExecutiveCouncil approve this Agreement as indicated in block 1.17,unless no such approval is required, In which case the Agreementshall become efTective on the date the Agreement is signed bythe State Agency as shown in block 1.13 ("Effective Date").3.2 If the Contractor commences the Services prior to theEffective Date, all Services performed by the Contractor prior tothe Effective Date shall be perfonned at the sole risk of theContractor, and In the event that this Agreement does not become'effective, the State shall have no liability to the ..Contractor,including without limitation, any obligation to pay theContractor for any costs incurred or Services performed.Contractor must complete all Services by the Completion Dalespecified in block 1.7.

4. CONDITIONAL NATURE OF AGREEMENT,Notwithstandirtg any provision of this Agreement to thecontrary, all obligations of the State hereunder, including,without limitation, the continuance of payments hereunder, arecontingent upon the availability arid continued appropriation off\inds affected by any state or fedei^l legislative or executiveaction that reduces, eliminates or otherwise modifies thefipproprlaiion or availability of funding for this Agreement andthe Scope for Services provided in EXHIBIT B. In whole or inpart. In no event shall the State be liable for any paymentshereunder in excess of such available appropriated funds. In theevent of a reduction or termination of appropriated funds, theState shall have the right to withhold payment until such fundsbecome available, if ever, and shall have the right to reduce orterminate the Services under this Agreement immediately upongiving the Contractor notice of such reduction or termination.The Stale shall not be required to transfer funds from any otheraccount or source to the Account identified in block 1.6 in theevent fuiids In that Account are reduced or unavailable.

5. CONTRACT PRICE/PRICE LIMITATION;PAYMENT.

5.1 The contract price, method ofpayment, and terms ofpaymentare identified and more particularly described in EXHIBIT Cwhich is incorporated herein by reference.5.2 The payment by the Slate of the contract price shall be theonly and the complete reimbursement to the Contractor for allexpenses, of whatever nature incurred by the Contractor in theperformance hereof, and shall be the only .and the complete

compensation to the Contrador for the Services. The Slate shallhave no liability to the Contractor other than the contract price.5.3 The State reserves the right to offset from any amountsotherwise payable to the Contractor under this Agreement thoseliquidated amounts required or permitted by N.H. RSA 80:7through RSA 80:7-c or any other provision oflaw.5.4 Notwithstanding any provision in this Agreerhent to thecontrary, and notwithstanding unexpeaed circumstances, in noevent shall the total of all payments authorized, or actually madehereunder, exceed the Price Limitation set forth in block 1.8.

6. COMPLIANCE BY CONTRACTOR WITH LAWS

AND REGULATIONS/ EQUAL EMPLOYMENTOPPORTUNITY.

6.1 In connection with the performance of the Services, theContractor shall comply with all applicable statutes, laws,regulations, and orders of federal, state, county or municipalauthorities which impose any obligation or duty upon theContractor, including, but not limited to. civil rights and equalemployment opportunity laws. In addition, if this Agreement isfundetl in any part by monies of the United States, (he Contractorshall comply with all federal executive orders, rules, regulationsand statutes, and with any rules, regulations and guidelines as theStale or the United States issue to implement these regulation^The Contractor shall also comply with all applicable intellectualproperty laws.6.2 During the term of this Agreement, the Contractor shall notdiscriminate against employees or applicants for employmentbecause of race, color, religion, creed, age, sex. handicap, sexualorientation, or national origin and w|}| take affirmative action toprevent such discrimination.6.3. The Contractor agrees to permit the Slate or United Statesaccess to any of the Contractor's books, records and accounts forthe purpose of ascertaining compliance with all rules, regulationsand orders, and the covenants, terms and conditions of thisAgreement.

7. PERSONNEU

7.1 The Contractor shall at its own expense provide all personnelnecessary to perform the Services. The Contractor warrants thatall personnel engaged in the Services shall be qualified toperform the Services, and shall be properly licensed andotherwise authorized to do so under all applicable laws.7.2 Unless otherwise authorized in writing, during the term ofthis Agreement, and for a period of six (6) months after theCompletion Date In block 1.7, the Contractor shall not hire, andshall not permit any subcontractor or other person, firm orcorporation with whom It is engaged in a combined eftbrt toperform the Services to hire, any person who is a State employeeor ofllcial, who is materially involved in the procurement,administration or perfonnance of this Agreement. Thisprovision shall survive termination of (his Agreement.7.3 The Contractitig Officer specified in block 1.9. or his or hersuccessor, shall be the Slate's representative. In the event of anydispute concerning the interpretation of this Agreement, theContracting Officer's decision shall be final for the State.


Date j/


8. EVENT OF DEFAULT/REMEDIES.

8.1 Any one or more of the following sets or omissions of theConrrsctor shall constitute an event of default hereunder ("Eventof Default"):8.1.1 failure to perform the Services satisfactorily or onschedule;

8.1.2 failure to submit any report required hereunder; and/or8.1.3 failure to perform any other covenant, term or condition ofthis Agreement.8.2 Upon the occurrence of any Event of Default, the State maylake any one, or more, or all, of the following actions:8.-2.1 give the Contractor a written notice specifying the Event ofDefault and requiring it to be remedied within, in the absence ofa greater or lesser specification of time, thirTy(30) days from thedate of the notice; and if the Event of Default is not timely cured,terminate this Agreement, effective two (2) days af^cr giving theContractor notice of termination;8.2.2 give the Contractor a written notice specifying the Event ofDefault and suspending all payments to be made under thisAgreement and ordering that the portion of Ihe contract pricewhich would otherwise accrue to the Contractor during theperiod from the date of such notice until such time as the Statedetermines that the Contractor has cured the Event of Defaultshall never be paid to the Contractor;8.2.3 give the Contractor a written notice specifying the Event ofDefault and set off against any other obligations the State mayowe to the Contractor any damages the State suffers by reason ofany Event of Default; and/or8.2.4 give the Contractor a written notice specifying the Event ofDefault, treat the Agreement as breached, terminate the

■ Agreement and pursue any of its. remedies at law or in equity, orboth.

8.3. No failure by the Slate to enforce any provisions hereof afterany Event of Default shall be deemed a waiver of Its rights withregard to that Event of Default, or any subsequent Event ofDefault. No express failure to enforce any Event of Default shallbe deemed a waiver of the right of the State to enforce each andall of the provisions hereof upon any further or other Event ofDefault on the pan of the Contractor.

9. TERMINATION.

9.1 Notwithstanding paragraph 8, the Stale may. ai its solediscretion, terminate the Agreement for any reason, in whole orin part, by thirty (30) days written notice to the Contractor thatthe State is exercising Its option to terminate the Agreement.9.2 In the event of an early termination of this Agreement forany reason other than the completion of the Services, theContractor shall, at the State's discretion, deliver to theContracting OfTicer, not later than fifteen (15) days after Ihe dateof termination, a report ("Termination Report") describing indetail all Services performed, and Ihe contract price earned, toand including the date of termination. The form, subject matter,content, and number of copies of the Termination Report shallbe identical to those ofany Final Report described in the attachedEXHIBIT B. In addition, at the Stale's discretion, the Contractorshall, within IS days of notice of early termination, develop and

Page 3

submit to the State a Transition Plan for services under the

Agreement.

10. DATA/ACCESS/CONFIDENTIALITY/

PRESERVATION.

10.1 As used in this Agreement, the word "data" shall mean ellinformation and things developed or obtained during theperformance of, or acquired or developed by reason of. thisAgreement, including, but not limited to, all studies, reports,files, formulae, surveys, maps, charts, sourxl recordings, videorecordings, pictorial reproductions, drawings, analyses, graphicrepresentations, computer programs, compmter printouts, notes,letters, memoranda, papers, end documents, all whetherfinished or unfinished.

10.2 All data and any property which has been received fromihe.Statc or purchased with funds provided for that purposeunder this Agreement, shall be the property of the State, andshall be returned to the State upon demand or upon terminationof this Agreement for wy reason.10.3 Confidemiality of data shall be governed by N.H. RSAchapter 91 A or other existing law. Disclosure of data requiresprior written approval of the State.

11. CONTRACTOR'S RELATION TO THE STATE. In the

performance of this Agreement the Contractor is in all respectsan independent contractor, and is neither an agent nor anemployee of the State. Neither the Contractor nor any of itsofficers, employees, agents or memben shall have authority tobind the Stale or receive any benefits, workers' compensation orother emoluments provided by the State to Its employees.

12. ASSICNMENT/DELECATION/SUBCONTRACTS.

12.1 The Contractor shall not assign, or otherwise transfer anyinterest in this Agreement without the prior written notice, whichshall be provided to.(he State at least fifteen (IS) days prior tothe assignment, and a written consent of the State. For purposesof this paragraph, a Change of Control shall constituteassignment. "Change ^ of Control" means (a) merger,consolidation, or a transaction or series of related transactions inwhich a third party, together with its affiliates, becomes thedirect or indirect owner of flffy percent (50%):or more of thevoting shares or similar equity interests, or combined votingpower of the Contractor, or (b) the sale of all or substantially allof the assets of the Contractor.

12.2 None of the Services shall be subcontracted by (heContractor without prior written notice and consent of the State.The Stale is entitled to copies of all subcontracts and assignmentagreements and shall not be bound by any provisions containedin a subcontract or an assignment agreement to which it is not aparty.

13. INDEMNIFICATION. Unless otherwise exempted by law,the Contractor shall indemnify and hold harmless the State, itsofficers and employees, from and against any and all claims,liabilities and costs for any personal injury or property damages,patent or copyright infringement, or other claims asserted againstthe State, its officers or employees, which arise out of (or whichmay be claimed to arise out oO the acts or omission of the

of 4

Contractor Initials

Date SW 7020


Contractor, or subcontractor), including but not limited to thenegligence, reckless or imeniional conduct. The Slate shall notbe liable for any costs incurred by the Contractor arising underthis paragraph I}. Notwithstanding the foregoing, nothing hereincontained shall be deemed to constitute a waiver of the sovereignimmunity of the Slate, which immunity is hereby reserved to theSlate. This covenant in paragraph 13 shall survive thetermination of this Agreement.

14. INSURANCE.

14.1 The Contraaor shall, at its sole expense, obtain andcontinuously maintain in force, and shall require anysubcontractor or assignee to obtain and maintain in force, thefollowing insurance:14.1.1 commercial general liability insurance against all claimsof bodily injury, death or property damage,-in amounts of notless than SI.000,000 per occurrence and S2,000,000 aggregateor excess; and14.1.2 special cause of loss coverage form covering all propertysubject to subparagraph 10.2 herein, in an amount i>ot less than80% of the whole replacement value of the property.14.2 The policies dewribed in subparagraph 14.1 herein shall beon policy forms and endoraements approved for use in the Stateof New Hampshire by the N.H. Department of Insurance, andissued by insurers licensed in the State of New Hampshire.14.3 The Contractor shall furnish to the Contracting Officeridentified in block 1.9. or his or her successor, a ceniflcate(s) ofinsurance for all insurance required under this Agreement.Contractor shall also furnish to the Contracting Officer identifiedin block 1.9, or his or her successor, cetlificatefs) of insurancefor all renewal(s) of insurance required under this Agreement no.later than ten (10) days prior to (he expiration date of eachinsurance policy. The certificateCs) of insurance and anyrenewals (hereof shall be anached and are incorporated herein byreference.

15. WORKERS'COMPENSATION.15.1 By signing this agreement, the Contractor agrees, cenifiesand warrants that the Contractor is in compliance with or exemptfrom, the requirements of N.H. RSA chapter 281-A ("Worktrs'Compensation ").15.2 To the extent the Contractor is subject to the requirementsof N.H. RSA chapter 281-A, Contractor shall maintain, andrequire any subcontractor or assignee to secure and maintain,payment of Workers' Compensation in connection withactivities which the person proposes to undertake pursuant to thisAgreement. TTie Contractor shall furnish the Contracting Officeridentified In block 1.9, or his or her successor, proof of Workers'Compensation in the manner described in N.H. RSA chapter281-A and any applicable rcncwal(s) thereof, which shall be

• attached and are incorporated herein by reference. The Stateshall not be responsible for payment of any Workers'Compensation premiums or for any other claim or benefit forContractor, or any subcontractor or employee of Contractor,which might arise under applicable Slate of New HampshireWorkers' Compensation laws in connection with theperformance of the Services under this Agreement.

16. NOTICE. Any notice by a party hereto to the other partyshall be deemed to have been duly delivered or given at the timeof mailing by certified mail, postage prepaid, In a United StatesPost Office addressed to the parties at the addresses given inblocks 1.2 and 1.4, herein.

17. amendment. This Agreement may be amended, waivedor discharged only by an instrument in writing signed by theparties hereto and only afler approval of such amendment,waiver or discharge by the Governor and Executive Council ofthe State of New Hampshire unless no such approval is requiredunder the circumstances pursuant to State law, rvie or policy.

18. CHOICE OF LAW AND FORUM. This Agrecinem shallbe governed, interpreted and construed in accordance with thelaws of the State of New Hampshire, and is binding upon andinures to the bencHt of the parties and their respective successonand assigns. The wording used In this Agreement is the wordingchosen by (he parties to express iheir mutual intent, and no ruleof construction shall be applied against or in favor of any party.Any actions arising out of this Agreement shall be brought andmaintained in New Hampshire Superior Court which shall haveexclusive jurisdiction thereof.

19. CONFLICTING TERMS. In the event of a conflictbetween the terms of this P>37 form (as modified in EXHIBITA) and/or attachments and amendment thereof, (he terms of theP-37 (as modified in EXHIBIT A) shall control.

20. THIRD PARTIES. The parties hereto do not Intend tobenefit any third parties and (his Agreement shall not beconstrued to confer any such benefit.

21. HEADINGS. The headings throughout (he Agreement erefor reference purposes only, and the words contained thereinshall in no way be held to explain, modify, amplify or aid in theinterpretation, construction or meaning of the provisions of thisAgreement.

22. SPECIAL -PROVISIONS. Additional or modifyingprovisions set forth in the anached EXHIBIT A ere incorporatedherein by reference.

23. SEVERABILITV. In the event any ofthe provisions of thisAgreement are held by a court of competent jurisdiction to becontrary to any state or federal law, the remaining provisions ofthis Agreement will remain in full force and effect.

24. ENTIRE AGREEMENT. This Agreement, which may beexecuted in a number of counterparts, each of which shall be

. deemed an original, constitutes- the entire agreement andunderstanding between the parties, and supersedes all prioragreements end understandings with respect to the subject matterhereof.


Dale H[>>4(-iOZO

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5DOE5581A3EB


EXHIBIT A

REVISIONS TO STANDARD CONTRACT PROVISIONS

1. Revisions to Form P*37, General Provisions

1.1 Paragraph 3, Subparagraph 3.1, Effective Date/Completion of Services, isamended as follows:

3.1 Notwithstanding any provision of this Agreement to the contrary, andsubject to the approval of the Governor issued under the ExecutiveOrder 2020-04, as extended by Executive Orders 2020-05, 2020-08,2020-09, 2020-10, 2020-14, 2020-15, and 2020-16, of the State ofNew Hampshire, this Agreement, and ail obligations of the partieshereunder, shall become effective August 24, 2020 ("EffectiveDate").

1.2 Paragraph 3, Effective Date/Completion of Services is amended by addingsubparagraph 3.3 as follows:

3.2 The parties hiay extend the Agreement for up to three (3) additionalyears from the Completion pate, only if the Department utilizes adifferent funding source other than that included in Exhibit CPayment Terms. Section 1, for any extensions beyond December 30,2020, contingent upon satisfactory delivery of services, availablefunding, agreement of the parties, and required governmentalapproval.

1.3 Paragraph 6, Compliance By Contractor With Laws and Regulations/EqualEmployment Opportunity, is amended to include subparagraph 6.4 as follows;

6.4 Because Contractor and its affiliates comprise a consulting firm (the"Firm") that serves clients on an international basis in numerouscases, both in and out of court, it is possible that the Firm may haverendered or will render services to, or have business associations

with, other entities or people which had or have or may haverelationships with the State. The Finn will not be prevented orrestricted by virtue of providing the services under this contract fromproviding services to other entities or individuals, including entities orindividuals whose interests may be in competition or conflict with theState's, provided the Firm makes appropriate arrangements toensure that the confidentiality of information is, maintained.Notwithstanding the foregoing, in the event the Firm providesservices in matters which conflict with the State's interests regardingthe matters in which A&M is providing sen/ices hereunder, the Firm

SS'2021-OCOK4<06^ONSU Exhibit A - Rovbions to Standard Contract Provisions Cor^tractor Inttlsb

ALVAREZ & MARSAL PUBLIC

SECTOR SERVICES. LLC Pago 1 of 4 Dato,i|2il2oIo



EXHIBIT A

must provide notice of such relationship to the State and the Statemay, at its discretion, terminate this Contract.

1.4 Paragraph 8. Event of Default/Remedies.' is amended to includesubparagraphs 8.4,8.5, and 8.6 as follows:

8.4 The Contractor may terminate this Agreement upon notice if theState misrepresents or fails to disclose material facts, fails to payundisputed fees or expenses, or makes K unethical for the Contractorto continue performance of the engagement, or other just causeexists.

8.5 Notwithstanding anything to the contrary, in no event shall theContractor be liable to the State, whether a claim be in tort, contractor otherwise, for any amount in excess of the total professional feespaid pursuant to this Agreement except to the extent the damageswere caused primarily from the fraud or willful misconduct of theContractor relating to the Services. In no event shall the Parlies beliable for any consequential, special, Indirect, incidental, punitive, orexemplary loss, damage, or expense relating to this Agreement(including, without limitation, loss of profit, data, revenue, goodwill,or similar damages) even if advised of the possibility of suchdamages. This paragraph shall survive termination of thisAgreement.

8.6 The State's liability under this Agreement shall be limited to monetarydamages not to exceed the total fees paid, but in no event shall itexceed the contract price pursuant to Paragraph 5.2. The Contractoragrees that it has an adequate remedy at law for any breach of thisAgreement by the State and hereby waives any right to specificperformance or other equitable remedies against the State.

1.5 Paragraph 10, Data/Access/Confidentiality/Preservation, Subparagraphs 10.2and 10.3 are amended as follows:

10.2 All data and any property which has been received from the State orpurchased with funds provided for that purpose under thisAgreement, shall be the property of the State, and shall be returnedto the State upon demand or upon termination of this Agreement forany reason. Notwithstanding anything to the contrary, the Contractorshall retain all right, title and Interest in all of its pre-existingintellectual property and all methodologies, processes, techniques,ideas, concepts, electronic and written workpapers, trade secrets.

SS-2021 -OCOM-Oe-CONSU Exhtoil A • Revisions <o SiindsnJ Conlroa Pfovtsloni Coniractof InUiais

ALVAREZ & MARSAL PUBLICSECTOR SERVICES. LLC PoQ8 2of4 Oalo

jiT

DocuSign Envelope ID: 586AO1B7-E0D1-45CB-A53A-5D0E5581A3EB

New Hampshire Department of Health and Human ServicesC0VID*19 DHHS Operations Assessment

EXHIBIT A

and know-how embodied in any data that the Contractor maydevelop or supply in connection with this Agreement.

10.3 Confidentiality of data shall be governed by N.H. RSA chapter 91-Aor other existing law. Disclosure of data requires prior writtenapproval of the State. If any party subpoenas or requests or any data,the Contractor will inform the State thereof.

1.6 Paragraph 12. Assignment/Delegation/Subcontracts, is amended by addingsubparagraph 12.3 as follows:

12.3. Subcontractors are subject to the same contractual conditions as theContractor and the Contractor is responsible to ensure subcontractorcompliance with those conditions. The Contractor shall have writtenagreements with all subcontractors, specifying the work io beperformed and how corrective action shall be managed if thesubcontractor's performance is inadequate. The Contractor shallmanage the subcontractor's performance on an ongoing basis and

■ take corrective action as necessary. The Contractor shall annuallyprovide the State with a list of all subcontractors provided for under

■ this Agreement and notify the State of any inadequate subcontractorperformance.

1.7. Paragraph 13. Indemnification, is amended as followrs:13. indemnification. Unless otherwise exempted by law. the

Contractor shall indemnify and hold harmless the State, its officersand employees, from and against any and all claims, liabilities andcosts for:

(i) any personal bodily injury or real and/or tangible personal propertydamages asserted against the State, its officers or employees to theextent caused by the acts or omission of the Contractor, orsubcontractors, in the performance of the Sen/ices that constitutenegligence, reckless or intentional conduct; and

(ii) patent or copyright infringement by the Services, provided that theforegoing shall not apply to the extent the claim of Infringement arisesout of: (1) the use of the Services other than in accordance with theterms of this Agreement and any applicable documentation orinstructions supplied to the State; (2) any modification to the Servicesnot expressly agreed to in writing by the parties; or (3) thecombination of the Services with any materials not providedor approved by the Contractor.

The State shall not be liable for any costs Incurred by the Contractorarising under this paragraph 13. Notwithstanding the foregoing,

SS-202l-6cOfcW»^NSU Exhlbil A • Rdv>ik>n» \o SuixJ»f<J Cowrae* ProvWons Contractw InHtato

ALVAREZ&MARSALPUBLICSECTOR SERVICES, LLC 3 of 4 Dale



EXHIBIT A

nothing herein contained shall be deemed to constitute a waiver ofthe sovereign immunity of the State, which immunity is herebyreserved to the State. This covenant in paragraph 13 shall survivethe termination of this Agreement.

1.8 Paragraph 17. Amendment, is deleted and replaced to read as follows:

17. AMENDMENT. This Agreement may be amended, waived ordischarged only by an Instrument in writing signed by the partieshereto and only after approval of such amendment, waiver' ordischarge by the Governor under his emergency authority pursuantto RSA 4:45 and RSA 21-P if required, or the Governor and Councilof the Slate of New Hampshire if required.

1.9 Paragraph 25. Additional Funding, is added to read as follows:

25. ADDITIONAL FUNDING. It is understood and agreed between theparlies that no portion of the funds included in Form P-37 GeneralProvisions, Box 1.8. may t>e used for the purpose of obtainingadditional Federal funds under any other law of the United States,except if authorized under that law.

1.10 Paragraph 26. Procurement, is added to read as follows;

26. PROCUREMENT. Contractor shall comply with all provisions of 2CFR 200 Subpart D - Post Federal Award Requirements -Procurement Standards, with special emphasis on financialprocurement (2 CFR 200 Subpart F - Audit Requirements) andproperty management (2 CFR 200 Subpart D - Post Federal AwardRequirements - Property Standards.

A$$-2021-OCOM-06-C0N$U E*hlbH A - Rovbiofts to SiindBfd Contract Provoions Contractor lniH»i».

ALVAREZ 8 MARSALPU8UC r^ . )(SECTOR SERVICES, LLC Peg* 4 o( 4 Dala 0|k|



EXHIBIT 8

Scope of Services

1. Statement of Work

1.1. The Contractor shall conduct a strategic assessment of the Department ofHealth and Human Services' (Department) operations to quantify the financialimpact of the COVID-19 pandemic on the Department's expenditures andrevenues; and identify programmatic quality improvements to increase theefficiency of Department operations, produce cost savings, and improve thedelivery of services during and after the COVID-19 parxlemic. To complete theassessment the Contractor shall examine the Department's operations andservice delivery model by:

1.1.1. Discussing strategic priorities, legislative and funding challenges presentedby the COVID-19 pandemic, and long-term goals, with Departmentleadership.

. 1.1.2. Analyzing the Department's statewide service delivery model andsupporting organizational structure, with specific focus on service deliveryprior to and in response to the COVID-19 pandemic, which includes, but is notlimited to:

1.1.2.1. The New Hampshire Medicaid Program's delivery model and fundingstructure.

1.1.2.2. Direct client services provided by the Department, that includes, butis not limited to the following priority areas:

1.1.2.2.1. District Offices.

1.1.2.2.2. Child Support Services.

1.1.2.2.3. New Hampshire Hospital.

1.1.2.2.4. Sununu Youth Services Center.

1.1.2.2.5. Glencliff Home.

1.1.2.3. Other services provided by Contractors on behalf of the Departmentthat include, but are not limited to:

1.1.2.3.1. Integrated Delivery Networks (7 agreements).

1.1.2.3.2. Regional Public Health Networks (13 agreements).

1.1.2.3.3. Community Mental Health Centers (10 agreements).

1.1.2.3.4. "Doorways" Access and Delivery Hub for Opioid Use DisorderServices (10 agreements).

1.1.2.3.5. Primary Care Services (9 agreements).

1.1.2.3.6. Adult Day Care Sen/ices (5 agreements).

33-202l-OCOM-OS-CONSU Contractor Initials

ALVAREZ « MARSAL PUBLIC Hwfl * ,3ECT0R 3ERVlceS LLC Page 1 of 7 Date QlAlW/n


New Hampshire Oepartment of Health and Human ServicesC0VID*19 DHHS Operations Assessment

EXHIBIT B

1.1.2.3.7. Developmental and Acquired Brain Disorder Services (10agreements).

1.1.2!3.8. Nutrition and Support Services (15 agreements).

1.1.2.3.9. Comprehensive Family Support Services (11 agreements).

1.1.2.3.10. Family Planning Services (9 agreements).

1.1.2.3.11. ServlceLink Aging & Disability Resource Center Services (7agreements).

1.1.3. Conducting a budget analysis and revie\wing the Department's financialstructure, internal fiscal management practices, and intemal controls, asapplicable. Activities must include a review of the Department's current,future, and past biennial budgets, which considers the Impact the COVID-19pandemic has had on revenue sources, lapses, budgeted amounts, andactual expenditures.^The Contractor shall analyze all of the Department'sCOVID-19 expenditures and identify federal funding sources that areavailable to reimburse the Department for any eligible costs.

1.1.4. Evaluating the Department's current organizational structure by reviewirigorganizational charts at the Division, Bureau, and Program levels, and HumanResource reports detailing all filled and vacant and funded and unfundedpositions.

1.1.5. Interviewing Department employees to discuss and observe businessprocesses and workflows. Specific consideration must be given recentchanges due to the COVID-19 pandemic.

1.1.6. Reviewing and analyzing documentation relevant to the assessment thatincludes, but Is not limited to. include financial. Information security,performance evaluations or audits conducted by the Department, State orFederal governments. Single Audit and Dedicated Funds reports. Lean or SixSigma analyses, and any other relevant reports.

1.1.7. Identifying and establishing a baseline understanding of the Department'scritical Information Technology systems, that may Include, but is not limitedto:

1.1.7.1. Bridges - Division for Children, Youth, and Families.

1.1.7.2. New Heights Eligibility System - Division of Economic and HousingStability.

1.1.7.3. Web Information Technology System (WITS) - Division forBehavioral Health

1.1.7.4. . Medicaid Management Information Systems (MMIS) - Bureau ofInformation Services.

1.1.7.5. Options - Division of Elderly and Adult Services.SS-2021-OCOM-O^CONSU Contractor InHials

ALVAREZ & MARSAL PUBLICSECTOR SERVICES LLC Page 2 of 7 Dole



EXHIBIT B

1.1.7.6. New Hampshire Hospital Information Technology Systems.

1.1.7.7. NECSES - Division of Economic and Housing Stability.

1.1.8. Performing other activities necessary to complete the strategic assessment,including but not limited to programmatic- SWOT (Strength. Weakness,Opportunity and Threat) analyses, operational capacity assessments, andperformance reviews.

1.2. Based on the results of the strategic assessment detailed in 1.1., the Contractorshall work collaboratively with the Department to identify cost savingsopportunities that offer high to medium Return on Investment (ROI) or otheroperatiorral changes to drive efficiency or performance, and then commencesupport for implementation on those opportunities as time allows with a focuson the Department realizing savings by the end of calendar year 2020.

1.3. The Department will provide the Contractor with a key point of contact, tofacilitate timely access to information technology systems and data,Departnrient buildings and work space, sctieduling Department employees forinterviews or observations, and other resources as necessary.

2. Accountabilities

2.1. The Contractor shall hold an inltiai engagement meeting with Departmentleadership on or before August 28, 2020. The Department and Contractor shalladdress;

2.1.1. Goals and objectives.

2.1.2. Resources needed and any potential constraints.

2.1.3. Schedule of events.

2.1.4. Development of a work plan.

2.1.5. Review of deliverables.

2.1.6. Deliverable acceptance procedures.

2.2. Following the initial engagement meeting, the Contractor shall meet withDepartment leadership, beginning the first week of September 2020, aminimum of twice per month, for the purpose of providing status updatesthrough the Completion Date of this Agreement. The Contractor shall provideupdates detailing the work completed, challenges encountered, any potentialscope changes, cost savings opportunities, and any other relevant informationrequested by the Department.

2.3. The Contractor shall submit a report by October 26. 2020, identifying costsavings opportunities that have high to medium ROI and other operationalchanges to drive efficiency or performance that can be either completed in lessthan six months or incorporated into the Department's State Fiscal Year 2022-2023 biennial budget. All solutions must: ^

SS-2021-OCOM-06-CONSU Conlraaor Initials

ALVAREZ & MARSAL PUBLICSECTOR SERVICES LLC Page 3 of 7 OaU



EXHIBIT 8

2.3.1. Explicitly consider the impact of and the short and long-term challengespresented by the COVID-19 pandemic:

2.3.2. Align with the Department's strategic priorities and mission;

2.3.3. Quantify the capital and human resources necessary for implementation;2.3.4. Reduce costs without sacrificing quality of services or performance; and

2.3.5. Comply with or identify any necessary changes to existing State andFederal laws and regulations.

2.4. The Department will review the report provided under 2.3. and provide approvaland any required modifications to the Contractor within ten (10) business daysof receipt.

2.5. The Contractor shall be available, upon request by the Department, to attendprivate or public meetings or hearings with the Governor and ExecutiveCouncil. New Hampshire Legislature, and other organizations as needed, todiscuss the work performed under this contract.

3. Staffing

3.1.The Contractor shall allocate the necessary staffing resources to ensure that allservices required under sections 1 and 2 of Exhibit B Scope of Services aredelivered timely and in accordance with applicable requirements.

3.2. The Contractor shall maintain a team of five (5) full-time employees through theCompletion Date of this Agreement, with at least four (4) expected on-site at theDepartment's primary location of business at 129 Pleasant Street, Concord NH03301-3852. In addition, the Contractor shall maintain four (4) addrtional senior-level employees on a part-time basis, who may be either on-site or remote,through the Completion Date of this Agreement.

3.3. In the event that the COVID-19 pandemic presents significant health risks, theDepartment and the Contractor virill collaborate to determine an appropriatealternative staffing solution.

4. Confidentiality

4.1. In order to provide services under this Agreement, the Contractor will need toparticipate in internal discussions among State employees, and view internalState documents and written communications. All confidential information,including, but not limited to. individually identifiable health Information shall betreated as confidential by the Contractor in accordance with all federal, stale orlocal laws and regulations governing the confidentiality and privacy of individuallyidentifiable health information, Including, without limitation, the Health InsurancePortability and Accountability Act of 1996 (HIPAA) and any regulation and officialguidelines promulgated thereunder.

SS-2021-OCOM-06-CONSU Conlractor Initials,

ALVAREZ A MARSAL PUBLICSECTOR SERVICES LLC Peg® 4 of 7 Date

id-HMX)



EXHIBIT B

4.1.1. Prior to granting access to confidential Information, the State shall ensurethat all members of the Contractor's Team have completed, signed, andretumed the Department's Confidentiality Agreement.

5. Exhibits Incorporated

5.1. The Contractor will not have access to protected health information and theDepartment's standard Exhibit I, Business Associate Agreement, is not applicableto this Agreement.

5.2. The Contractor shall manage all confidential data related to this Agreement inaccordance with the terms of Exhibit K. DHHS Information Security Requirements,which is attached hereto and incorporated by reference herein. The Contractorshall also comply with all Exhibits D through H, and J, vMch are attached heretoand incorporated by reference herein.

6. Additional Terms

6.1. Impacts Resulting from Court Orders or Legislative Changes

6.1.1. The Contractor agrees that, to the extent future state or federallegislation or court orders may have an Impact on the Servicesdescribed herein, the Stale has the right to modify Service prioritiesand expenditure requirements under this Agreement so as to achievecompliance therewith.

6.2. Credits and Copyright Ownership

6.2.1. All documents, notices, press releases, research reports and othermaterials prepared during or resulting from the performance of theservices of the Contract shall include the following statement. "Thepreparation of this (report, document etc.) wras financed under aContract with the State of New Hampshire, Depar^ent of Health andHuman Services, with funds provided tn part by the State of NewHarnpshire and/or such other funding sources as were available orrequired, e.g., the United States Department of Health and HumanSen/Ices."

6.2.2. All rriaterials produced or purchased under the contract shall haveprior approval from the Department before printing, production,distribution or use.

6.2.3. The Department shall retain copyright ownership for any and alloriginal materials produced, including, but not limited to: .

6.2.3.1. Brochures.

6;2.3.2. Resource directories.

6.2.3.3. Protocols or guidelines.

S$-2021-OCOM-06.CONSU Conlractor Initials

ALVAREZ & MARSAL PUBLICSECTOR SERVICES LLC Page 5 of 7 Oal



EXHIBIT B

6.2.3.4. Posters.

6.2.3.5. Reports.

However, the Contractor shall retain ownership of its methodologies,processes, techniques, ideas, concepts, trade secrets, and know-howembodied in the Deliverables and the Department shall not publicizeany reports or other work product to the extent such retainContractor's name without the Contractor's consent,' except asrequired by applicable law. The Department may adopt a report orother work product as its own without requesting permission from theContractor, and there shall be no restrictions on transfer, distribution,or publication, provided that the Department removes all referencesto the Contractor.

6.2.4. The Contractor shall not reproduce any materials produced under thecontract without prior written approval from the Department.

7. Records

7.1. The Contractor shall retain the following records for a period of five years afterfinal payment is made, in accordance with record retention requirements issuedby the US Department of treasury, Office of Inspector General, which includebut are not limited to:

7.1.1. Books, records, documents and other electronic or physical dataevidencing and reflecting all costs and other expenses incurred by theContractor in the performance of the Contract, and all income receivedor collected by the Contractor.

7.1.2. All records must be maintained in accordance with accountingprocedures and practices, which sufTiciently and properly reflect all suchcosts and expenses, and which are acceptable to the Department, andto include, without limitation, all ledgers, books, records, and originalevidence of costs such as purchase requisitions and orders, vouchers,requisitions for materials, inventories, valuations of in-kind contributions,labor time cards, payrolls, and other records requested or required bythe Department.

7.2. During the term of this Agreement and the period for retention hereunder. theDepartment, Governor's Office for Emergency Relief and Recover (GOFERR).the United States Department of Treasury, or the Office of Management andBudget (0MB) and any of their designated representatives shall have accessto all reports and records maintained pursuant to the Agreement for purposesof audit, examination, excerpts and transcripts. Upon payment of the pricelimitation hereunder, the Agreement and all the obligations of the parlieshereunder (except such obligations as, by the terms of the Agreement are tobe performed after the end of the term of this Agreement and/or survive the

SS-2021-OCOM-06-CONSU Contractor Initials

ALVAREZ & MARSAL PUBLIC \ 1 .,SECTOR SERVICES LLC Page 6 of 7 Dale J2HI ci'



EXHIBIT B

termination of the Agreement) shall terminate, provided however, that if, uponreview of the invoice the Department shall disallow any expenses claimed bythe Contractor as costs hereunder the Department shall retain the right, at itsdiscretion, to deduct the amount of such expenses as are disallowed or torecover such sums from the Contractor.

SS-2021-OCOM'06*CONSU Contractor Initials

ALVAREZ & MARSAl PUBLIC

SECTOR SERVICES LLC Page 7 of 7 Dele

—


New Hampshire Department of Health and Human ServicesCOVID*19 DHHS Operations Assessment

EXHIBIT C

Payment Terms

1. This Agreement is funded by 100% Other Funds from the Governor's Office forEmergency Relief and Recovery (GOFERR) under Federal Funds received bythe State under the Coronaviois Aid Relief and Economic Secuirty (CARES)Act. as awarded on March 27,2020, by the U.S. Department of State Treasury.CFDA 21.019, FAIN to be determined.

2. For the purposes of this Agreement, the Department has identified theContractor as a Contractor, in accordance with 2 CFR 200.330.

3. The Department will pay the Contractor at a rate of $158,000 per week toprovide services specified in Exhibit 8 Scope of Services.

4. The Contractor shall submit an invoice in a form satisfactory to the Departmentby the fifteenth (16th) working day of the following month. The Contractor shallensure the invoice is completed, dated and returned to the Department in orderto initiate payment.

5. All invoices shall be emailed to [email protected].

6. The Department shall make payment to the Contractor within thirty (30) daysof receipt of each invoice, sutjsequent to approval of the submitted invoice andif sufficient funds are available, subject to Paragraph 4 of the GeneralProvisions Form Number P-37 of this Agreement.

\

7. The final invoice shall be due to the Department no later than forty (40) daysafter the contract completion date specified in Form P-37, General ProvisionsBjock 1.7 Completion Date.

8. The Contractor shall maintain and provide the Department upon request, asummary of all hours collectively worked by the team providing services underExhibit B Scope of Services.

9. The Contractor must provide the services in Exhibit B. Scope of Services, incompliance with funding requirements.

10. The Contractor agrees that funding under this Agreement may be withheld, inwhole or in part in the event of non-compliance with the terms and conditionsof Exhibit B. Scope of Services or any Federal or State law, rule or regulationapplicable to the sen/ices provided, or if the said services or products have notbeen satisfactorily completed in accordance with the terms and conditions ofthis agreement.

ALVAREZ 8 MARSAL PUBLIC

SECTOR SERVICES, LLC Exhibit C Cont/aclor InKials

SS-2021-OCOM-06-CONSU Page t o11 Data


New Hampshire Department of Health and Human ServicesExhibit D

CERTIFICATiON REGARDING DRUQ-FREE WORKPLACE REQUIREMENTS

The Contractor identified In Section 1.3 of the General Provisions agrees to comply with the provisions ofSections 5151-5160 of the Drug-Free Workplace Act of 1986 (Pub. L. 100-690, Title V. Subtitle D; 41U.S.C. 701 et seq.). and further agrees to have the Contractor's representative, as identified in Sections1.11 and 1.12 of the General Provisions execute the following Certification:.

ALTERNATIVE I • FOR GRANTEES OTHER THAN INDIVIDUALS

US DEPARTMENT OF HEALTH AND HUMAN SERVICES - CONTRACTORSUS DEPARTMENT OF EDUCATION • CONTRACTORS

US DEPARTMENT OF AGRICULTURE - CONTRACTORS

This certification is required by the regulations implementir>g Sections 5151-5160 of the Drug-FreeWorkplace'Act of 1968 (Pub. L. 100-690, Title V. Subtitle 0; 41 U.S.C. 701 et seq.). The January 31.1989 regulations were amended artd published as Part II of the May 25,1990 Federal Reg'ister (pages21681-21691). and require certification by grantees (and by inference, sub-grantees and subcontractors). prior to award, that they will maintain a drug-free workplace. Section 3017.630(c) of theregulation provides that a grantee (and by inference, sub-grantees and sub-contractors) that is a Statemay elect to make one certification to the Department in each federal fiscal year in lieu of certificates foreach grant during the federal fiscal year covered by the certification. The certificate set out t^low is amaterial representation of fact upon which reliance is placed when the agency awards the grant Falsecertification or violation of the certification shall be grounds for suspension of payments, suspension ortermination of grants, or 9ovemrr>ent wide suspension or debarment Contractors using this form shouldsend It to:

Commissioner

NH Department of Health and Human Services129 Pleasant Street.Concord. NH 03301-6505

1. The grantee certifies that it will or will continue to provide a drug-free workplace by:1.1. Publishing a statement rtotifying employees that the unlawful manufacture, distribution,

dispensing, possession or use of a controlled substance is prohibited in the grantee'sworkplace and specifying the actions that will be taken against employees for violalion of suchprohibition;

1.2. Establishing an ongoing drug-free awareness program to inform employees about1.2.1. The dangers of drug abuse in the workplace:1.2.2. The grantee's policy of maintaining a drug-free workplace;1.2.3. Any available drug counseling, rehabilitation, and employee assistance programs; and1.2.4. The penalties that may be imposed upon employees for drug abuse violations

occurring In the workplace;1.3. Making it a requirement that each employee to be engaged in the performance of the grant be

given a copy of the statement required by Section 1.1.1.4. Notifying the employee in the statement required by paragraph (a) that, as a condition of

employment under the grant, the employee will1.4.1. Abide by the terms of the statement; and1.4.2. Notify the employer in writing of his or her conviction for a violalion of a criminal drug

statute occurring in the workplace no later than r>ve calendar days after suchconvlclion; ■

1.5. Notifying the agency in wriling, within ten calendar days after receiving notice undersubparagraph 1.4.2 from an employee or otherwise receiving actual notice of such conviction.Employers of convicted employees must provide notice, including position title, to every grantofficer on whose grant activity the convicted employee was working, unless the Federal agency

ExMblt D - Cedificatjon regarding Drug Free Contractor InliiabWorkplace Rtquiramenu

CtfOHKS/iioro Pa9e1ol2 Date

DocuSign Envelope ID: 586AD1B7-E0O1-45CB-A53A-5O0E5581A3EB

N«w Hampshire Department of Health and Human ServicesExhibit D

has designated a qentrat point for the receipt of such notices. Notice shall .include theidentification number(s) of each affected'grant;

1.6. Taking one of the following actions, within 30 calendar days of receiving notice undersubparagraph 1.4.2, with respect to any employee .who is so convicted1.6.1. Taking appropriate personnel action against such an employee, up to and including

termination, consistent with the requirements of the Rehabilitation Act of 1973, asamended; or

1.6.2. Requiring such employee to participate satisfactorily in a drug abuse assistance orrehabilitation program approved for such purposes t)y a Federal, State, or local health,law enforcement, or other appropriate agency;

1.7. Making a good faith effort to continue to rnaintain a drug>free workplace throughimplementation of paragraphs 1.1, 1.2,1.3,1.4, i.S, and 1.6.

2. The grantee may insert in the space provided below the site(s) for the performance of work done inconnection with the specific grant.

Place of Performance (street address, city, county, state,'zip code) (list each location)

Check □ if there are workplaces on file that are not identified here.

Contractor Name:

Date.14 70 70^

Exhibit D - Ce<tjflc«tion regarding Drug Fraa Comractor Initials.Workplaca Requirements

CUX)HKS/ll07O

ilftce Requirements .Page 2 of 2 Date If 7 120

OocuSign Envelope ID: 586AD1B7.E0D1-45CB-A53A-5D0E5581A3E8

New Hampshire Department of Health and Human ServicesExhibit E

CERTtFiCATIQN REQARDING LOBBYING

The Vendor identified in Section 1.3 of the General Pro\rtstons agrees to comply with the provisions ofSection 319 of Public Law 101-121. Government wide Guidance for New Restrictions on Lobbying, and31 U.S.C. 1352. and further agrees to have the Contractor's representative, as Identified in Sections 1.11and 1.12 of the General Provisions execute the following Geftification:

US DEPARTMENT OF HEALTH AND HUMAN SERVICES - CONTRACTORSUS DEPARTMENT OF EDUCATION - CONTRACTORSUS DEPARTMENT OF AGRICULTURE - CONTRACTORS

Programs (Indicate applicable program covered):•Temporary Assistance to Needy Families under Title IV-A•Child Support Enforcement Program under Tide IV-0^Social Services Block Grant Program under Tide XX•Medlcaid Program under Title XIX•Community Services Block Grant under Title Vi•Child Care Development Block Grant under Title IV

The undersigned cerdfies. to the best of his or her knowledge and belief, that:

1. No Federal appropriated funds have been paid or will be paid by or on behalf of the undersigned, toany person for Influencing or attempting to influence an officer or employee of any agency, a Memberof Congress, an ofTicer or employee of Congress, or an employee of a Member of Congress inconnection with the awarding of any Federal contract, continuation, renewal, amendment, ormodification of any Federal contract. granL loan, or cooperative agreement (and by specific mentionsub-grantee or sub-contractor).

2. If any funds other than Federal appropriated funds have been paid or wlll be paid to any person forinfluencing or attempting to influence an officer or employee of any agency, a Member of Congress,an officer or employee of Congress, or an employee of a Member of Congress in connection with thisFederal contract grant loan, or cooperative agreement (and by specific mention sub-grantee or subcontractor), the undersigned shall complete and submit Standard fôrm LLL, (Disclosure Form toReport Lobbying, in accordance with Its instructions, attached and identified as Standard Exhibit E-l.)

3. The undersigned shall require that the language of this certification be included In the awarddocument for sub-awards at all tiers (including suticontracts, sub-grants, and contracts under grants,loans, and cooperative agreements) and that aD sub-recipients shall certify and disclose accordingly.

This certification Is a material representation of fact upon which reliance was placed when this transactionwas made or entered into. Submission of this cortificalion is a prerequisite for making or entering into Ihistransaction Imposed by Section 1352, Title 31. U.S. Code. Any person who fails to file the requiredcertlficalion shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 foreach such failure. v .

Vendor Name: £a\aJ! Ap-•'SÂ. \

S - - - -\ Name: v\JQ^vâA

Title:

iExhibi E -C«f1iriCJUonR®g«dino Lobbying Vendor InltMli

CU«»«3/n07.1 Pago 10(1 D'"*


New Hampshire Department of Health and Human ServicesExhibit F

- CERTIFICATION REGARDING DEBARMENT. SUSPENSION

AND OTHER RESPONSIBILITY MATTERS

The Vendor identified in Section 1.3 of the Generai Provisions agrees to compiy with the provisions ofExecutive Office of the President. Executive Order 12549 and 45 CFR Part 76 regarding Debarment,Suspension, and Other Responsibility Matters, and further agrees to have the Contractor'srepresentative, as identified in Sections 1.11 and 1.12 of the Generai Provisions execute the followingCertification;

iNSTRUCnONS FOR CERTIFICATION

1. By signing and submitting this proposai (contract), the prospective prin^ary participant Is providing thecertification set out below.

2. The inability of a person to provide the certification required below will not necessarily result in,denialof participation In this covered transaction. If necessary, the prospective participant shall subrhll anexplanatipn of why it cannot provide the certificatjon. The certification or explanation will beconsidered in connection with the NH Department of Health and Human Services' (DHHS)determination whether to enter into this transaction. However, failure of the prospective primaryparticipant to furnish a certification or an explanation shall disqualify such person from participation inthis transaction.

3. The certification in this clause is a material representation of fact upon which reliance was placedwhen DHHS determined to enter into this transaction. If H is later determined that the prospectiveprimary participant knowingly rendered an erroneous certification, in addition to other reo^ediesavailable to the Federal Govemment. DHHS may terminate this transaction for cause or'default.

4. The prospective primary participant shall provide immediate written notice to the DHHS agency towhom this proposal (contract) is submitted if at any time the prospective primary participant learnsthat its certification was erroneous when submitted or has become erroneous by reason of changedcircumstances.

5. "n>6 terms "covered transaction.' 'debarred." "suspended." "ineligible." "lower tier coveredtransaction." 'participant,* "person," "primary covered transaction," •principal,* "proposal," and"voluntarily excluded.' as used in Is clause, have the meanings set out in the Definitions andCoverage sections of the rules implementing Executive Order 12549; 45 CFR Part 76. See theattached definitions.

6. The prospective primary participant agrees by submitting this proposal (contract) that, should theproposed covered transaction be entered Into, it shall not knowingly enter into any lower tier coveredtransaction with a person vrho Is debarred, suspended, declared Ineligible, or voluntarily excludedfrom participation in this covered transaction, unless authorized by DHHS.

7. The prospective primary participant further agrees by submitting this proposal that it will include theclause titled 'Certification Regarding Debarment. Suspension, Ineligibility and Voluntary Exclusion •Lower Tier Covered Transactions." provided by DHHS. without modification, in all lower tier coveredtransactions and in all solicitations for lower tier covered transactions.

6. A participant In a covered transaction may rely upon a certificdtion of a prospective participant in alower tier covered transaction that It is not debarred, suspended, Ineligible, or involuntarily excludedfrom the covered transaction, unless it knows that the certification Is erroneous. A participant maydecide the method and frequency by which It determines the eligibility of its principals. Eachparltcipant may, but is not required to, check the Nonprocurement List (of excluded parties).

9. Nothing contained in the foregoing shall be construed to require establishment of a system of recordsin order to render in good faith the certification required by this clause. The knowledge arid

EtfiiMt F - C«niflc«t>on Re9ardlng Debarment. Su»pen$ion Vendor Initials,And Other Responsibility Matters

ciMWHS/uoro PagetcfZ Pete o j


New Hempshlre Department of Heafth end Human ServicesExhibit F

inforrrwtion of a participant Is not required to exceed that which Is normally possessed by a prudentperson In the ordinary course of business dealings.

10. Except for transactions authorized under paragraph 6 of these instructions, if a participant In acovered transaction knowingly enters into a lower tier covered transaction with a person who Issuspended, debarred. Ineligible, or voluntarily excluded from participation in this transaction. Inaddition to other remedies available to the F^eral government. DHHS may terminate this transactionfor cause or default.

PRIMARY COVERED TRANSACTIONS11. The prospective primary participant certifies to the best of Its knowledge and belief, that It and its

principals:11.1. are not presently debarred; suspended, proposed for det>arment declared ineligible, or

voluntarily excluded from covered transactions by any Federal department or agency;.11.2. have not within a three-year period preceding this proposal (contract) been convicted of or had

a civil judgment rendered against them fa commission of fraud or a almlnal offense Inconnection with obtaining, attempting to obtain, or performing a public (Federal. State or local)transaction or a contract under a public transaction; violation of Federal or State antrtruststatutes or commission of embezzlement, theft, forgery, bribery, falsification a destruction ofrecords. rr>aking false statements, or receiving stolen property;

T1.3. are not presently Indicted for otherwise criminally or civilly charged by a govemmental entity(Federal. State or local) vnth commission of any of the offenses enumerated in paragraph (l)(b)of this certification; and

11 .A. have not within a ttiree-year period preceding this application/proposal had one or more putrfictransactions (Federal. State or local) terminated for cause or defaulL

12. Where the prospective primary participant is unable to certify to any of the statements in thiscertification, such prospective participant shall attach an explanation to this proposal (contract).

LOWER TIER COVERED TRANSACTIONS

13. By signing and submitting this lower tier proposal (contract), the prospective lower tier participant, asdefined in 45 CFR Part 76. certifies to the best of its knowledge and belief that it and its principals:

• 13.1. are not presently debarred, suspended, proposed for debanment, declared ineligible, orvoluntarily excluded from participation in this transaction by any federal department or agency.

13.2. where the prospective lower tier participant Is unable to certify to any of the above, suchprospective partidpant shall attach an explanation to this proposal (contract).

14. The prospective lower tier participant further agrees by submitting this proposal (contract) that it willinclude this clause entitled 'Certification Regarding Debarment. Suspension, Inellgibility, andVoluntary Exclusion - Lower Tier Covered Transactions," without modification in all lower tier coveredtransactions and in all solicitations for lower tier covered transactions.

Vendor Name: ex cx^<A.

^I'HU2z> j ..Date ' ~ Name: v.U\aAq,

ExN^t F - C«ftiric«Uon RtgtrOing Oebarmont Su9p«o$ion Vendor hHialsAAnd Other Re*pon»ibil«y Matters a

curOHMSnions P#g#2of2 Date

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5O0E5581A3E8

New Hampshire Department of Health and Human ServicesExhibit O

CERTIFICATION OF COMPLIANCE WITH REQUIREMENTS PERTAINING TO

FEDERAL NONDISCRIMINATION. EQUAL TREATMENT OF FAITH-aASED ORGANIZATIONS ANDWHISTLEBLOWER PROTECTIONS

The Vendor Identified in Section 1.3 of the General Provisions agrees by signature of the Contractor'srepresentative as Identified in Sections 1.11 and 1.12 of the General Provisions, to execute the followingcertification:

Vendor will comply, and will require any subgrantees or subcontractors to comply, with any applicablefederal ncndlscrimination requirements, which may include:

. (he Omnibus Crime Control and Safe Streets Act of 1966 (42 U.S.C. Section 3789d) which prohibitsrecipienta of federal funding under this statute from discriminating, either in employment practices or inthe delivery of services or benefrts. on the t>asis of race, color, religion, national origin, and sex. The Actrequires certain recipients to produce an Equal Erhployment Opportunity Plan;

• the Juvenile Justice Delinquency Prevention Act of 2002 (42 U.S.C. Section 5672(b)) which adopts byreference, the civil rights obligations of the Safe Streets Act Recipients of federal funding under thisstatute are prohibited from dlscrimtnating, either In employment practices or in the delivery of services orbenefits, on the leasts of race, color, religion, national origin, and sex. The Act includes EqualEmployment Oppcrlunity Plan requirements;

. the Civil Rights Act of 1984 (42 U.S.C. Section 2000d. which prohibits recipients of federai financialassistance from discriminating on the basis of race, color, or national origin in any program or activity);

• the Rehabilitation Act of 1973,(29 U.S.C. Section 794), which prohibits recipients of Federal rmancialassistance from discriminating on the basis of disability, in regard to employment and the delivery ofservices or benefits, in any program or activity:

- the Americans with Disabilities Act of 1990 (42 U.S.C. Sections 12131-34), which prohibitsdiscrimination and ensures equal opportunity for persons with disabilities in employment, State and localgovernment services, public accommodations, commercial facilities, and transportation;• the Education Amendments of 1972 (20 U.S.C. Sections 1681. 1683,1685-86). which prohibits •discrimination on the basis of sex In federally assisted education programs;

-the Age Discrimiriation Act of 1975 (42 U.S.C. Sections 6106-07), which prohibits discrimination on thebasis of age in programs or activities receiving Federal financial assistance, it does r>ot includeemployment discrimirtation;

- 28 C.F.R. pt. 31 (U.S. Department of Justice Regulations - OJJDP Grant Programs); 28 C.F.R. pt. 42(U.S. Department of Justice Regulations - Nondtscrlmination; Equal Employment Opportunity: Policiesand Procedures); Executive Order No. 13279 (equal protection of the laws for faith-based and communityorganizations); Executive Order No. 13559, which provide fundamental principles and policy-makingcriteria for partnerships with faith-based and neighborhood organizations;

• 28 C.F.R. pt. 38 (U.S. Department of Justice Regulations - Equal Treatment for Faith-BasedOrganizations): and WhisUeblovrer protections 41 U.S.C. §4712 and The National Defense AuthorizationAct (NDAA) for Fiscal Year 2013 (Pub. L. 112-239. enacted January 2.2013) the Pilot Program forEnhancement of Contract Employee Whistleblower Protections, which protects employees againstreprisal for certain whistle blowing activities in connection with federal grants and contracts.

The certificate set out l)elow is a material representation of fact upon which reliance is placed when theagency awards the grant. False certification or violation of the certificdtion shall be grounds forsuspension of payments, suspension or termination of grants, or government wide suspension ordebarmenL

EiMbU G

Vendor Inrtiab

trC«T<c<bnc* •ennejrwMru lo F*dir« NendMntrinM^. E»je Ttnwi>r< «(«n0 wtwaMMr praMctioM

«7/U

R»> lorji'K Pefle 1 ol 2 Date

DocuSign Envelope ID: 586AD1B7-E0D1-45CB-A53A-5DOE5581A3EB

New Hampshire Department of Health and Human ServicesExhibit G -

In the event a Federal or State court or Federal or State administrative a9ency makes a finding ofdiscrimination after a due process hearing on the grounds of race, color, religion, national origin, or sexagainst a recipient of.funds, the recipient will forward a copy of the finding to the Office for Civil Rights, tothe applicable contracting agency or division within the Department of Health and Human Services, andto the Department of Health and Hurrian Services Office of the Ombudsrr^an.

The Vendor identified in Section 1.3 of the General Provisions agrees by signature of the Contractor'srepresentative as identified In Sections 1.11 and 1.12 of the General Provisions, to execute the followingcertification:

1. By signing and submitting this proposal (contract) the Vendor agrees to comply with the provisionsindicated above^

Date

Vendor Nante:

0\rejci'6*'Title:

Exnibll G

Vendor inkle b CtniOadon flCgmpUnM wtn f*oA«n*nl* p«n«Mro lo Ftdwa Nond>*emiinMion. £9*1 T(««n«ni«« r<i0i.aM«d Oroaraueeni'

mo vmummw praMciin

Pago 2 ot 2 DMtiltHlOlO

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5DOE5581A3EB

New Hempehlre Department of Health and Human ServicesExhibit H

CERTIFICATION REGARDING ENVIRONMENTAL TOBACCO SMOKE

Public Law 103-227. Part C - Environmental Tobacco Smoke, also known as the Pro-Children Act of 1994(Act), requires that smoking not be permitted in any portion of any indoor facSity owned or leased orcontracted (or by an entity and used routinely or regularly for the provision of health, day care, education,or Pbrary services to children under the age of 18, if the services are funded by Federal programs either,directly or through State or tocal governments, by Federal grant, contract, loan, or loan guarantee. Thelaw dMS not apply to children's services provided in private residences, fedtities funded solely byMedicare or Medicaid funds, and portions of facilities used for Inpatlent drug or alcohol treatment. Failureto comply with the provisions of the law may result in the imposition of a civil monetary penalty of up to$1000 per day and/or the imposition of an administrative compUance order on the responsible entity.

The Vendor Identified In Section 1.3 of the General Provisions agrees, by signature of the Contractor'srepresentative as Identified in Section 1.11 and 1.12 of the General Provisions, to execute the followingcertification;

1. By signing and submitting this contract, the Vendor agrees to ntake reasonable efforts to comply withall applicable provisions of Public Law 103-227, Part 0, kr)Own as the Pro-Children Act of 1994.

Vendor Name:

. QaJk"YVIcmo v^ ^ 0 <

ExhibKH-Certification Regftfd2r>g Vendor InKialsEnvirorvnenial Tobacco Smoke

cu/DKHSfiio7i3 , Page t of I Date,



Exhibit I

HEALTH INfiURAMCe PQRTABILITV AMD ACCQUMTABILITY

ACT miPAAt BUStNESS ASSOCIATE AGREEMENT

Exhibit I is not applicable to this Agreement.

Remainder of page intentionally left blank.

Contrsclor Initiats

■D«'g

OocuSign Envelope ID; 586AD1B7-E0D1-45CB.A53A-5D0E5581A3EB

New Hampehiro Oopaitment of Heatth and Human ServicesExhibit J

CCRTIFICATtON REQARDINQ THE FEDERAL FUNDINiS ACCOUNTABILrTY AND TRANSPARENCYACTIFFATAICOMPUANCE

The FederB) Funding AcoountabQity end Transparency Act (FPATA) requires prime awardees of individualFederal grants equal to or greater than $25,000 and awarded on or after October 1.2010, to report ondata related to executive compensation and associated first-tier sub-grants of $25,000 or more. If theinitial sward Is below $25,000 but subsequent grant modifications result in e total award equal to or over$25,000, the avrard is subject to the FFATA reporting requirements, as of the date of the award.In accordance vrith 2 CFR Part 170 (Reporting Subaward and Executive Compensation Information), theOepartment of Health and Human Services (DHHS) must report the following information for anysubaward or contract award subject to the FFATA reporting requirements:1. Name of entity2. Amount of award

3. Funding agency4. f<<AlCS code for contracts / CFDA program number for grants5. Program source6. Award titte descriptive of the purpose of the binding action7. Location of tha entity6. Principle place of performance9. Unique Identifief of the entity (DUNS 0)10. Total com'pensation and names of the top five, executives if:

10.1. More than 60% of annual gross revenues are from the Federal government, and thoserevenues are greater than $2SM annuatty and

10.2. Compensation Information is not already available through reporting to the SEC.

Prime grant recipients must submit FFATA required data by the end of the month, plus 30 days, In whichthe award or award amendment is rr^de.The Contractor Identified in Section 1.3 of the General Provisions agrees to comply with the provisions ofThe Federal Funding Accountability and Transparency Act, Public Law 109-262 and Public Law 110-252,and 2 CFR Part 170 (Reporting Subavrard and Executive Compensation Information), and further agreesto have the Contractor's representative, as'Identified in Sections 1.11 and 1.12 of the General Provisionsexecute the following Certification: ^The below named Contractor egrees to provide needed Information as outlined above to the NHDepartment of Health and Human Services and to comply with all appDcable provisions of the FederalFlnaf>clal Accountability and Transparency Act

Contractor Name

Date

TiUe:

ExhIbA J - CenXlc«Uon Rogardlng UM PftOdral Funding Contractor tnklibAecountaM&ty And Tr«nsp«/»ncy Ad <FFATA) CompSanco

cmorats/uoro Page 10(2 OaJo


New Hampshire Department of Health and Human ServicesExhibit J

FORMA

As the Contrdctor identiHed In Section 1.3 of the General Provisions. I certify that the responses to thebelow listed questions are true and accurate.

1. The DUNS number for your entity is:

2. In your business or organization's preceding completed fiscal year, did your business or organizationreceive (1) 60 percent or nxHe of your annual gross revenue in U.S. federal contracts, sut>contracts,loans, grants, sub^rants. and/or cooperative agreements; and (2) $25,000,000 or more in annualgross revenues from U.S. federal contracts, subcontracts, loans, grants, subgrants, and/orcooperative agreements?

NO YES

If the answer to #2 above is NO, stop here

If'the answer to #2 above is YES. please answer the following:

3. Does the public have access to Information about the compensation of ttte executives in yourbusiness or organization through periodic reports filed under section 13(a) or 15(d) of (he SecuritiesExchange Act of 1934 .(15 U.S.C.78m(a). 78o(d)) or section 6104 of the Internal Revenue Code of

'1986?

NO YES

If the answer to #3 above Is YES, stop here

If the answer to #3 above is NO, please answer the following;

4. The names and compensation of the five most highly compensated officers in your business ororganization are as follows:

Name:

Name:

Name:

Name;

Name:

Amount:

Amount:

Amount:

Amount:

Amount

COOHHyi 10713

Exhibit J - CenlTicstion Rogarding the Federal FundingAccountability And Trantptrertcy Act (FFATA) Compliar>ce

Page 2 of 2

Contractor Iniilab

Date



Exhibit K


This Exhibit K is made a part of and subject to the terms and conditions set forth in that certain professionalservices agreement (SubJeci:_SS-2021-OCOM-06-CONSU) entered into between the New HampshireDepartment of Health and Human Services and Alvarez & Marsal Public Sector Services, LLC (the"Agreement)

A. Definitions

The rollowir>g terms may be reflected and have the described meaning in this document:

1. 'Breach' means the loss of control, compromise, unauthorized disclosure,unauthorized acquisition, unauthorized access, or any similar term referring tosituations where persons other than authorized users and for an other than authorizedpurpose have access or potential access to personally identifiable infofmation,whether physical or electronic. With regard to Protected Health Information. 'Breach'shall have the same meaning as the term 'Breach' in section 164.402 of Title 45.Code of Federal Regulations.

2. "Computer Security Incident' shall have the same meaning 'Computer SecurityIncident' In section two (2) of NIST Publication 800-61, Computer Security IncidentHandling Guide. National Institute of Standards and Technology. U.S. Department ofCommerce.

3. 'Confidential Information* or 'Confidential Data' means all confidential informationdisclosed by one party to the other such as all medical, health, financial, publicassistance nefits and personal information Including without limitation, SubstanceAbuse Treatment Records, Case Records, Protected Health Information andPersonally Identifiable Information.

Confidential Information also includes any and all information owned or managed bythe State of NH • created, received from or on behalf of the Department of Health andHuman Services (DHHS) or accessed in the course of performing contracted services• of which collection, disclosure, protection, and disposition is govemed by state orfederal law or regulation. This information includes, but Is not limited to ProtectedHealth Information (PHI). Personal Information (PI), Personal Financial Information(PFI). Federal Tax Information (FTI), Social Security Numbers (SSN). Payment CardIndustry (PCI), and or other sensitive and confidential information.

4. 'End User* means any person or entity (e.g., contractor, contractor's employee,business associate, subcontractor, other downstream user, etc.) that receives DHHSdata or derivative data In accordance with the terms of this Contract.

5. 'HIPAA' means the Health Insurance Portability and Accountability Act of 1996 and theregulations promulgated thereunder.

6. 'Incident' means an act that potentially violates an explicit or implied security policy,which Includes attempts (either failed or successful) to gain unauthorized access to a

V5. Leslupdst* 1<yD9/18 ExNbriK ContrsctorinitlsbDHHS tnlonnaiiofi

S»cuflty RequlremanlsPoge 1 of 8 Oate


New Hampehlre Department of Health and Human Services

Exhibit K


system or its data, unwanted disruption or denial of service, the unauthorized use of asystem for the processing or storage of data; and changes to system hardware,firmware, or software characteristics without the owner's knowledge, instruction, orconsent, incidents include the loss of data through theft or device misplacement, lossor misplacement of hardcopy documents, and misrouting of physical or electronic mail,all of which may have the potential to put the data at risk of unauthorized access, use,disclosure, modification or destruction.

7. 'Open Wireless Network' means any network or segment of a network that is notdesignated by the State of New Hampshire's Department of InformationTechnology or delegate as a protected network (designed, tested, and approved,by means of the State, to transmit) will be considered an open network and notadequately secure for the transmission of unencrypted PI, PFI, PHI or confidentialDHHS data.

8. 'Personal information' (or 'PI') means information which can be used to distinguish ortrace an Individual's Identity, such as their name, social security numt)er, personalinforn^ation as defined in New Hampshire RSA 359-0:19. biometric records, etc.,alone, or when combined with other personal or identifying information which is linkedor linkable to a specific individual, such as date and place of birth, mother's maidenname, etc.

9. 'Privacy Rule' shall mean the Standards for Privacy of Individually Identifiable HealthInformation at 45 C.F.R. Parts 160 and 164. promulgated under HIPAA by the.UnitedStates Department of Health and Human Services.

10. 'Protected Health Information* (or 'PHI') has the same meaning as provided in thedefinition of 'Protected Health Information" in the HIPAA Privacy Rule at 45 C.F.R. §160.103.

11. 'Security Rule' shall mean the Security Standards for the Protection of ElectronicProtected Health Information at 45 C.F.R. Part 164, Subparl C, and amendmentsthereto.

!

12. 'Unsecured Protected Health Information' means Protected Health Information that isnot secured by a technology standard that renders Protected Health Informationunusable, unreadable, or indecipherable to unauthorized Individuals and is developedor endorsed by a standards developing organization that is accredited by the AmericanNational Standards. Institute.

I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR

A. Business Use and Disclosure of Confidential Information.

1. The Contractor must not use. disclose, maintain or. transmit Confidential Information

except as reasonably necessary as outlined under this Contract. Further. Contractor.

vs. List updats tQX>9/18 Exhibit K ContractorIrtitlalsOHHS Information

Soccrily Roqui/emonis w / -xL i 7a 7 / /P8gi2of6 Oaio V/^ I /^rL-C/

DocuSign Envelope ID; 586AD1B7-E0O1-45CB-A53A-5D0E5581A3EB


Exhibit K


including but not limited to all Its directors, officers, employees and agents, must notuse. disclose, maintain or transmit PHI in any manner ttiat would constitute a violationof the Privacy and Security Rule.

2. The Contractor must not disclose any Confidential Information in response to a requestfor disclosure on the basis that it is required by law. in response to a subpoena, etc..without first notifying DHHS so that DHHS has an opportunity to consent or object tothe disclosure.

3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additionalrestrictions over and above those uses or disclosures or security safeguards of PHIpursuant to the Privacy and Security Rule, the Contractor must be bound by suchadditional restrictions and must not disclose PHI In violation of such additional

restrictions and must abide by any additional security safeguards.

4. The Contractor agrees that DHHS Data or derivative there from disclosed to an EndUser must only be used pursuant to the terms of this Contract.

5. The Contractor agrees DHHS Data obtained under this Contract may not be used forany other purposes that are not indicated in this Contract.

6. The Contractor agrees to grant access to the data to the authorized representatives ofDHHS for the purpose of inspecting to confirm compliance with the terms of thisContract.

II. METHODS OF SECURE TRANSMISSION OF DATA

1. Application Encryption. If End User is transmitting OHMS data containing ConfidentialData between applications, the Contractor attests the applications have beenevaluated by an expert knowledgeable in cyber security and that said application'sencryption capabilities ensure secure transmission via the internet.

2. Computer Disks and Portable Storage Devices. End User may not use computer disksor portable storage devices, such as a thumb drive, as a method of transmitting DHHSdata.

3. Encrypted Email. End User may only employ email to transmit Confidential Data ifemail is encrvoted and being sent to and being received by email addresses ofpersons authorized to receive such Information.

4. Encrypted Web Site. If End User is employing the Web to transmit Confidential Data,the secure socket layers (SSL) must be used and the web site must be secure. SSLencrypts data transmitted via a Web site.

5. File Hosting Services, also known as File Sharing Sites. End User may not use filehosting services, other than Contractor instances of the service Box to transmitConfidential Data.

6. Ground Mail Service. End User may only transmit Confidential Data via certified groundmail within the continental U.S. and when sent to a named individual.

V5. Lntupdsts 10/09/16 Exhibit K Contractor InitialsDHHS Inrormation

SecuHty Requlremonls U hA / /Page 3 of 6 Oaio,'



Exhibit K


7. Laptops and PDA. If End User Is employing portable devices to transmit ConfidentialData said devices must be encrypted and password-protected.

6. Contractor will utilize encryption at rest and in transit to secure Confidential Data.

9. SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. IfEnd User is employing an SFTP to transmit Confidential Data, End User will structurethe Folder and access privileges to prevent inappropriate disclosure of information.SFTP folders and sub-folders used for transmitting Confidential Data will be coded for 24-hour auto-deletion cycle (i.e. Confidential Data will be deleted every 24 hours).

10. Wireless Devices. If End User is transmitting Confidential Data via wireless devices, alldata must be encrypted to prevent inappropriate disclosure of information.

III. RETENTION AND OISPOSITION OF IDENTIFIABLE RECORDS

The Contractor wilt only retain the data artd any derivative of the data for the duration of thisContract. After such time, the Contractor will have 30 days to destroy the data and anyderivative in whatever form it may exist, unless, otherwise required, by law or permitted underthis Contract. To this end, the parties must;

A. Retention

1. The Contractor agrees it will not store, transfer or process data collected inconnection with the services rendered under this Contract outside of the United

States. This physical location requirement shall also apply in the implementation ofcloud computing, cloud service or doud storage capatxlities, and includes backupdata and Disaster Recovery locations.

2. The Contractor agrees to ensure proper security monitoring capabilities are in placeto detect potential security events that can impact State of NH systems and/orDepartment confidential information for contractor provided systems.

3. The Contractor agrees to provide security awareness and education for its End Usersin support of protecting Department confidential information.

4. The Contractor agrees to retain all electronic and hard copies of Confidential Datain a secure location and identified in section IV. A.2

5. The Contractor agrees Confidential Data stored in a Cloud must comply with allapplicable statutes and regulations regarding the privacy and security. All serversand devices must have currently-supported and hardened operating systems, thelatest anti-viral, anti-hacker, anti-spiam, anti-spyware, and anti-matware utilities. Theenvironment, as a whole, must have aggressive intrusion-detection and firewallprotection.

6. The Contractor agrees to and ensures its complete cooperation with the State'sChief Information Officer in the detection of any security vulnerability of the hostinginfrastructure.

vs. Le5l update l0/09/iB Exhibit K Contractor initlata,DHHS intomiation

Security RequirementsPage 4 of 8 Date

£



Exhibit K


B. Disposition

1. If the Contractor will maintain any Confidential Information on its systems (or its subcontractor systems), the Contractor will maintain a documented process for securelydisposing of such data upon request or contract termination; and will obtain writtencertification for ariy State of New Hampshire data destroyed by the Contractor orany subcontractors as a part of or>going. emergency, and or disaster recoveryoperations. The Contractor will provide written attestation to the Department uponrequest.

2. Unless othenvlse specified, within thirty (30) days of the termination of this Contract,. Contractor agrees to destroy all hard copies of Confidential Data using a secure

method such as shredding.

3. Unless otherwise specified, within thirty (30) days of the termination of this Contract.Contractor agrees to completely destroy all electronic Confidential Data by meansof data erasure, also known as secure data wiping.

IV. PROCEDURES FOR SECURITY

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and anyderivative data or files, as follows;

1. The Contractor will maintain proper security controls to protect Department confidentialinformation collected, processed, managed, and/or stored in the delivery of contractedservices.

2. The Contractor will maintain policies and prociedures to protect Department confidentialinformation throughout the information iifecycle, wtiere applicable, (from creation,transformation, use, storage and secure destruction) regardless of the media used tostore the data (i.e., tape. disk, paper, etc.).

3. The Contractor wilt maintain appropriate authentication and access controls tocontractor systems that collect, transmit, or store Department confidential informationwhere applicable.

4. The Contractor will ensure proper security monitoring capabilities are In place to detectpotential security events that can impact State of NH systems and/or Departmentconfidential information for contractor provided systems.

5. The Contractor will provide regular security awareness and education for its End Usersin support of protecting Department conftdential information.

6. If the Contractor will be sub-contracting any core functions of the engagementsupporting the services for State of New Hampshire, the Contractor will maintain aprogram of an internal process or processes that defines specific security expectations,

vs. L«stupdat»1<V03/l8 Exhibit K CoAtraclorinltlalsDHHS Informatlort

DocuSign Envelope ID; 586AD1B7-E0D1-45CB-A53A-5O0E5581A3E8


Exhibit K

DHHS information Security Requirements

and monitohng compliance to security requirements that at a minimum match those forthe Contractor, including breach notification requirements.

7. The Contractor will work with the Department to sign and comply with all applicableState of New Hamp^ire and Department system access and authorization policies andprocedures, systems access forms, and computer use agreements as part of obtainingand maintaining access to any Department systemfs). Agreements will be corhpletedand signed by the Contractor and any applicable subcontractors prior to systemaccess being authorized.

8. If the Department and Contractor determine the Contractor is a Business Associatepursuant to 45 CFR 160.103, the Contractor will execute a HIPAA Business AssociateAgreement (BAA) to the extent reasonably acceptable to Contractor with theDepartment and is responsible for maintaining compliance with the agreement.

9. The Contractor will work with the Department at its request to complete a SystemManagerhent Survey. The purpose of the survey is to enable the Department andContractor to monitor for any changes in risks, threats, and vulnerabilities that mayoccur over the life of the Contractor engagement. The survey will be completedannually, or an alternate time frame at the Departments discretion with agreement bythe Contractor, or the Department may request the survey be completed when thescope of the engagement betNveen the Department and the Contractor changes.

10. The Contractor will not store any State of New Hampshire or Department data outsidethe boundaries of the United States unless prior express written consent is obtainedfrom the Information Security Office leadership member v^thin the Department.

11. Data Security Breach Liability. In the event of any security breach Contractor shallmake efforts to investigate the causes of the breach, promptly take measures to preventfuture breach and minimize any damage or loss resulting from the breach. Subject tothe terms of the Agreement (P-37 as modified by Exhibit A), the Slate shall recoverfrom the Contractor all costs of response and recovery from the breach, including butnot limited to: credit monitoring services, mailing costs and costs associated withwebsite and telephone call center services necessary due to the breach.

12. Contractor must, comply v/ith all applicable statutes and regulations regarding theprivacy and security of Confidential Information, and must in all other respects maintainthe privacy and security of PI and PHI at a level and scope that is not less than thelevel and scope of requirements applicable to applicable government contractors,including, but not limited to, provisions of any applicable law that govern protections forindividually identifiable health information and as applicable under State law.

13. Contractor agrees to establish and maintain appropriate administrative, technical, andphysical safeguards to protect the confidentiality of the Confidential Data in Contractor'and to prevent unauthorized use or access to It while under the control of Contractor..

V5. Ust update lOOS/18 Exhtoi) K Contiador Initial*DHHS Information

Security RequirementsPage 6 Of 8. Date DnHilD^



Exhibit K


14. Contractor agrees to maintain a documented breach notification and incident responseprocess which includes an obligation to investigate security incidents and suspectedbreaches of information contained in Contractor systems. The Contractor will notify theState's Privacy Officer and the State's Security Officer of any security t>reach of theState's Confidential Data within Contractor's possession without undue delay, at theemail addresses provided in Section VI.

15. Contractor must restrict access to the Confidential Data obtair>ed under this Contract

. to only those authorized End Users who have a reasonable need for such DHHSOata to perform their official duties in connection with purposes identified in thisContract.

16. The Contractor must ensure that all End Users;

a. comply with such safeguards as referenced in Section IV A. above; Implementedto protect Confidential Information that is furnished by DHHS under this Contractfrom loss, theft or inadvertent disclosure.

b. safeguard this information at all tinges.

c. ensure that laptops and other electronic devices/media containing PHI, Pl.orPFIare encrypted and password-protected.

d. send emails containing Confidential Information only if encrypted and being sentto and being received by email addresses of persons authorized to receive suchinformation.

6. limit disclosure of the Confidential Information to the extent permitted by law.

f. Confidential Information received under this Contract and individually identifiabledata derived from DHHS Data, must be stored in an area that is physically andtechhologlcally secure from access by unauthorized persons during duty hoursas well as non-duty hours (e.g., door locks, card keys, biometric identifiers, etc.).

g. only authorized End Users may transmit the Confidential Data, Including anyderivative files containing personally identifiable information, and In a!) cases,such data must be encrypted at all times when in transit, at rest, or when storedon portable media as required in section IVat>ove.

h. in all other Instances Confidential Data must be maintained, used and disclosedusing appropriate safeguards, as determined by a risk-based assessment of thecircumstances involved.

i. understand that their user credentials (user name and password) must not beshared with anyone. End Users will keep their credential information secure.This applies to credentials used to access the site directly or Indirectly through athird party application.

Contractor is responsible for oversight and compliance of their End Users. DHHSreserves the right to conduct onsite inspections to monitor compliance with this Contract,

vs. Last update l(VOd/ld Ej})ibltK Cont/ector initiab.DHHS InfotnuUon

Security RequirementsP«9e7ofe Ofite



Exhibit K


including the privacy and security requirements provided in herein, HIPAA, and otherapplicable lavra and Federal regulations until such time the Confidential Data is disposedof in accordance with this Contract. Onsite inspections shall be conducted no more thanannually at the cost of the Department with reasonable notice to the Contractor.

V. LOSS REPORTING

The Contractor must notify the State's Privacy Officer and Security Officer of Breacheswithout undue delay in accordance with IV(14) above, at the email addresses provided inSection Vl.

In addKlon to, and notwithstanding, Contractor's compliance with all applicable obligationsand procedures. Contractor's procedures must also address how the Contractor will;

1. Identify Incidents;

' 2. Determine if personally identifiable information is involved In Incidents;

3. Report suspected or confirmed Incidents as required in this Exhibit or P-37;

4. IdentKy and convene a core response group to determine the risk level of Incidentsand determine risk*based responses to Incidents; and

5. Determine whether Breach notification is required, and, if so, identify appropriateBreach notification methods, timing, source, and contents from among differentoptions, and bear costs associated with the Breach notice as well as any mitigationmeasures.

Incidents and/or Breaches that implicate PI must be addressed and reported, asapplicable, in accordance with NH RSA 359-0:20.

VI. PERSONS TO CONTACT

A. DHHS Privacy Officer;

[email protected]

B. DHHS Security Officer:

[email protected]

vs. Lfislupdftte tO/09/18 ExhlWlK Contrsdorlnidal)DHHS Info/mation

SacurityRequlrcdienisimyKaqutremenu

Page e of 8 Date 0 I \/0/lJ

jan12'21 pm 2:41 rcudjan12'21 pm 2:41 rcud state of new hampshire department of health and...

Documents