HomeMy WebLinkAboutRES-2022-148BOARD OF COUNTY COMMISSIONERS
COUNTY OF KITTITAS
STATE OF WASHINGTON
RESOLUTION TO AUTHORIZEEXE,CUTION OF AN AMBNDMENT TO THE
PROFESSIONAL SERVICES AGREEMENT BETWEEN WASHINGTON STATE
HEALTH CARE AUTHORITY AND KITTITAS COUNTY
RESOLUTION No. 2022 - |I
WHEREAS: The State of Washington, acting by and through the Health Care Authority, issued
a Request for Application for the purpose of developing or implementing or
continuing to expand Medication for Opiod Use Disorder in Jails Program; and
WHEREAS: Kittitas County submitted a timely response to the Request for Application; and
WHEREAS: Health Care Authority reviewed all properly submitted Responses and has
identified Kittitas County as the Apparent Successful Bidder; and
WHEREAS: Health Care Authority has previously determined that entering into a contract with
Kittitas County will meet Health Care Authority's needs and will be in the State's
best interest: and
WHEREAS: The Board of County Commissioners for Kittitas County authorized the original
Agreement by Resolution2022-072 onMarch 15,2022 for the award amount of
$271,035.00; and
WHEREAS: Health Care Authority has awarded $252,000.00 in additional funds to Kittitas
County for the furtherance of this project; and
NOW THEREFORE BE IT HEREBY RESOLVED that the amended Agreement between
Washington State Healthcare Authority and the Kittitas County Jail shall commence on
July 1 ,2022 and continue to June 30,2023 and accepts this grant money and the terms of
the contract.
ADOPTED this wday of 2022
BOARD OF COUNTY COMMISSIONERS
KrTTI IbS_Q p_UNTY, WAS Hr N G T O N
ABSENT
Chair
Vice-Chair
\\\\\llIIlll"
CO
llilrlll\
C ommlssloner
TO FORM4ea 7
Julie Kjorsvik D. R. Mitchel (Deputy) Prosecuting Attorney
of the Board- Mandy Buchholz
DocuSign Envelope lD: 03BADF22-351A-431 9-8F35-8DC62D187726
Washington State
Health Care th*rity
CONTRACT
AMENDMENT
HCA Contract No.: K5885
Amendment No.: 1
THIS AMENDMENT TO THE
whose name appears below,
CONTRACT is between the Washington State Health Care Authority and the party
and is effective as of the date set forth below.
CONTRACTOR NAME
Kittitas County
CONTRACTOR doing business as {DBA)
Kittitas County Sheriff - Jail
CONTRACTOR ADDRESS
205 W 5th Ave, Sle 1/Jail
Ellensburg, WA 98926
CONTRACTOR CONTRACT MANAGER
Name: Kittitas County
Email: clay.myers@co. kittitas.wa. us
AMENDMENT START DATE
July 1 ,2022
AMENDMENT END DATE
June 30, 2023
CONTRACT END DATE
June 30, 2023
Prior Maximum Contract Amount
$271,035
Amount of lncrease
$252,000
Total Maximum Compensation
$523,035
WHEREAS, HCA and Contractor previously entered into a Contract to develop and implement or expand the
MOUD in Jails program, and;
WHEREAS, HCA and Contractor wish to amend the Contract pursuant to Section 4.3, Amendmenfs to extend
the term, add additional funds, incorporate work expectations and deliverables for the new term, and
incorporate a Data security requirements;
NOW THEREFORE, the parties agree the Contract is amended as follows:
1. $ection 3.2. TERM. The term of this contract is extended through June 30, 2023
2. Section 3.3. COMPENSATION. The maximum compensation is increased by $252,000 for new Total
Maximum Compensation of $523,035.
3. Schedule A-1, Statement of Work is attached and incorporated herein to reflect work expectations
and deliverables for the period July 1 ,2022 through June 30, 2023.
4. Attachment 1, Confidential lnformation Security Requirements is hereby replaced in its entirety
with Attachment {, Data Use Security and Confidentiality, attached hereto.
5. Attachment 2, Data Security Requirements is attached and incorporated herein.
6. Attachment 3, HCA Small Numbers Standards is attached and incorporated herein.
7. Attachment 4, Certificate of Destruction is attached and incorporated herein.
L Section 3.7, lncorporation of Documents and Order of Precedence is amended to include the new
attachments included in this Amendment and shall now read as follows:
Each of the documents listed below is by this reference incorporated into this Contract, ln the event of an
inconsistency, the inconsistency will be resolved in the following order of precedence:
a. Applicable Federal and State of Washington statutes and regulations;
Washington State
Health Care Authority Page 1 HCA Contract No. K5885-1
DocuSign Envelope lD: 03BADF22-351A-431 9-8F35-EDC62D187726
b" Recitals
c. Special Terms and Conditions;
d. GeneralTerms and Conditions;
e. Attachment 1: Data Use Security and Confidentiality;
f. Attachment 2: Data Security Requirements,
g. Attachment 3: HCA Small Numbers Standards
h. Attachment 4: Certificate of Destruction
i. Schedule A: Statement of Work;
j. Exhibit A: HCA RFA #2021HCA42 for Medication for Opioid Use Disorder (MOUD) in Jails
Program, dated December 29,2021;
k. Exhibit B: Contractor's Response dated January 20,2A22; and
l. Any other provision, term or material incorporated herein by reference or otherwise
incorporated.
9. This Amendment will be effective July 1 ,2022 ("Effective Date").
10. All capitalized terms not othenrvise defined herein have the meaning ascribed to them in the Contract.
11. All other terms and conditions of the Contract remain unchanged and in full force and effect.
The parties signing below warrant that they have read and understand this Amendment and have authority to
execute the Amendment. This Amendment will be binding on HCA only upon signature by both parties.
CONTRACTOR SIGMTURE
e/"g rnlltL
PRINTEO NAME AND TITLE
gIIEAFF
DATE SIGNED
7 " 13 ^h1-
HCA SIGNATURE
7-;!o"usisnea ty,
I'f.-ulL -+*;'-
PRINTED NAME AND TITLE
Rachelle Amerine
Contracts Ad mi n istrator
DATE SIGNED
7119t2022
Washington State
Health Care Authority Page 2 HCA Contract No. K588r1
1
SCHEDULE A.1
Statement of Work
July 1, 2022-June 30, 2023
Purpose. To provide medication for opioid use disorder (MOUD) in jails to incarcerated individuals who
present with an opioid use disorder {OUD). To support a full MOUD program which includes the following
an OUD assessment, discussion of MOUD options between the incarcerated individual and provider,
initiation prior to the onset of withdrawal or continuation of MOUD, release and reentry planning to
include connection with continued treatment, same day release appointment when possible or MOUD to
bridge patient until next appointment and naloxone upon release. Reentry planning may also include
assisting the incarcerated individual with sign-up of Medicaid, reestablishing Medicaid and connection
with the Managed Care Organizations (MCOs).
Health Equity - This project also intends to address inequities in OUD treatment and recovery services byproviding medically necessary treatment for opioid use disorder to incarcerated individuals. MOUD in jails
programs should understand cultural barriers and provide culturally appropriate services and recognize
the need for inclusion of people with lived experiences in the development of the MOUD in jails progr"mr.
Additionally, this project intends to identify stigma and educate staff to ensure ongoing collaboration and
openness to change.
2. Performance Work Statement. The Contractor shall ensure funds are responsibly used towards the MOUD
program in the jail/jails and provide the core components or a progressive plan to achieve the core
components which includel
a. FDA approved medication for opioid use disorder {MOUD) must be available and offered to all
incarcerated individuals who present with ouD at intake. lndividuals with ouD may decline MouD
at any time, but ongoing discussions on MOUD may be offered.b. Methadone, buprenorphine, naltrexone should all be offered unless: (a) an opioid treatment
program (OTP) is not within reasonable driving distance from the jail, in which case the jail is not
required to offer methadone as an option; or (blthere is no available buprenorphine provider in
the community to which the patient will likely release, in which case the jail is not required to offer
buprenorphine as an option. Naltrexone may be provided in oralformulation while the patient is
incarcerated, but iniectable long-acting naltrexone must be offered as an option prior to release.c. MOUD must be eontinued for those who are atready taking MOUD upon entering the facility.
MOUD is continued using the same medication, at the same dose unless ordered otherwise by the
prescriber based on clinical need (documented in the patient's medical record)with the exception
of injectable long-acting naltrexone which may be converted to an equivalent oral dose until just
prior to release and the injectable form is restarted. Methadone may be transitioned to
buprenorphine if the jail is not a licensed opioid treatment program (OTP) and the nearest OTp is
not within reasonable driving distance from the jail. The presence of other illicit or controlled
substances should not result in discontinuation of MOUD (consistent with the 2020 ASAM
National Practice Guideline for the Treatment of Opioid Use Disorderl.
d. Assessing for risk of acute withdrawal must be done upon intake. Assessing for opioid use
disorder {OUD) absent a risk of acute withdrawal must also be done, but it may be done after
intake, as long as the delay does not impair the ability to begin treatment prior to release. The
incarcerated individual must be educated on treatment choices and the process for continuation of
access to MOUD, during incarceration, and upon release. (See resources for validated tool
suggestions.)
e. lndividuals entering the facility who are physically dependent on opioids, must be offered MOUD
treatmenU withdrawal (including withdrawal using buprenorphine or methadone) is not acceptable
unless the patient provides an informed refusal of treatment or the patient elects MOUD treatment
with naltrexone, in which case withdrawal is clinically required. Use of other medications
(clonidine, anti-emetics, anti-diarrheals, analgesics) may be used as adjuncts or may be used in
Washington State
Health Care Authority Page 3 HCA Contract No. K5885-1
place of opioid agonist or partial agonist if the individual so chooses, but they may not be the only
withdrawal treatment available.
f. Methadone and buprenorphine must be administered daily or more frequently. Alternate-day
("Balloon") dosing of buprenorphine may be used in rare cases based on a clinical need, the
decision for which is arrived at jointly between the healthcare provider and patient and is well-
documented in the patient's medical record.g. Release planning and reentry coordination completed as soon as possible to ensure an effective
plan is in place prior to release or in the event of an unexpected release of an incarcerated
individual who needs continued treatment and services.
h. Provide at least 2 doses of naloxone and naloxone administration training to all incarcerated
individuals with OUD upon release.
i. Schedule the first community appointment with a treatment facility.j. Provide * in hand upon release and at no cost to the individual - sufficient doses of MOUD to
bridge patient until scheduled MOUD follow-up appointment at community treatment facility (does
not apply to patients treated with injectable MouD).
i. lndividuals who are at risk of being released directly from court are informed, prior to
going to eourt, that they may request to be transported back to the jail by staff to receive
these medications prior to going home.
ii. ln situations where an appointment cannot be made, e.g., after-hours bail-out, resident is
given enough medication to last until the next available appointment at the community
treatment facility. lf that date is unknown, the individual is given a minimum of a7-day
supply.
iii. ln situations where medications cannot be provided upon release, e.g., unscheduled
release at a time when medical staff are not present in the jail, the individual is informed
that he/she may either return to the jail in the morning to receive bridge medications or, if
no medical staff are present the following day, will have a prescription for the same
bridging medication called to a local pharmacy, at no cost to the individual.k. Ensure policies and procedures are in place to mitigate medication diversion.
3. Scope of Work Activities.
a. Kittitas County Jail will achieve the core components of the MOUD program through the following
activities:
i. Purchase of MOUD: buprenorphine {Suboxone} and Sublocade. purchasing and storage of
all MOUD must follow the laws and rules pertaining to locked storage of controlled
substances and any pharmacy or prescription laws that pertain.
ii. An MOUD clerical position will be hired with expertise in the health care system to support
the program reporting and data collection requirements and assast the program manager.
This position will also develop the operation of the new electronic medical file system.iii. Hire MOUD nurse for three days per week for jail to provide 7 day per week coverage.iv. Technology improvements: an electronic medical file system, startup, monthly
subscription, and server. This system will replace various systems including the outdated
and inefficient use of paper files for medical records. This system will allow for Kittitas
County Jail to collect and share data for reporting requirements.
v. Tablets and cases for telehealth services, video conferencing and workstation technology
and supplies for staff specific to this program. Three medication carts will also be
purchased for each facility area.
vi. Work collaboratively with the University of Washington Addictions, Drug and Alcohol
lnstitute {ADAI) technical assistance staff to identify training needs and participate in peer-
to-peer and educational learning opportunities.
b. Kittitas County Jail is enhancing the current MOUD program with this funding. The improvements
made will allow for staff to be more effective in improving the standard of care and
implementation of the core components of this contract.
Washington State
Health Care Authoity Page 4 HCA Contrael No. K588*l
4. Data Collection.
a, Participation requires performance monitoring activities, including requiring timely and accurate
data reporting to the Health Care Authority, Division of Behavioral Health, and Becovery (HCA
DBHR). Further evaluation, including on- and off-site data collection may be conducted by HCA
DBHR or a third-party.
b. The contractor will submit a monthly report, template provided by HCA DBHR, by the 1Oth day of
the month with the following participant information, (identified as having a current OUD), for the
previous month:
i. Full name
ii. Date of birth
iii. Provider One #, SSN or another unique identifier
iv. Date of booking
v. Date MOUD started: continued or induction?
vi. Date of release if applicable
vii. Scheduled first MOUD appointment upon release
viii. Which MOUD provided upon release
c. lnformation will be collected via the Secure file Transfer (SFTI which HCA will assist with setting
up. lt will be shared with Research Data and Analysis (RDA) for evaluation purposes.
5. Contract ManagementlAccounting.
a. Submit invoices for payment, ensure specific tools, such as job descriptions, policies and
procedures, and statements of work. are developed, and staff are adequately trained on these
tools, to ensure consistent and appropriate practice.
b. Attend monthly meetings with HCA DBHR program administrator to discuss project contract
requirements, compliance, problem-solving and attend trainings. Attend additional meetings as
required or deemed necessary by the HCA DBHR program administrator.
c. Contractor will cooperate with periodic site visits by the HCA DBHR program administrator or
designee and make all relevant records and personnel available.
d. Submit a monthly report as detailed in the Deliverables Table with the invoice to the HCA DBHR
program admi nistrator.
FY2023 Contract Deliverables Table
Activity Deliverable Due Date Pavment
Monthly progress
reports
Report must include
status of hiring staff,
status of MOUD
purchases and other
supplies requested in
the budget, core
components (Section 2)
being met or progress
towards meeting the
core components,
barriers and successes,
tech nical assista nce and
training participation,
staff changes and
additional information
as needed.
Monthly:
Reports due on the
10'h of every month
beginning with
August 10,2A22.
$10,500 x 12
months=
$126,000
Washington State
Health Care Authority Paga 5 HCA Contract No. K5885-1
Monthly Data
Collection
spreadsheet
Data spreadsheet filled
out completely and
shared via SFT
Monthly:
Due on the 1Oth of
every month
beginning with
August 1A,2022.
$10,500 x 12
months=
$126,000
6. Billing and Payment.
a, This contraet total is for $252,000.00 and is for services rendered between July 1, 2e22, and June
34,2023.
b. lnvoice System, The Contractor shall submit invoices using State Form A-19 lnvoice Voucher, or
such other form as designated by HCA. Consideration for services rendered shall be payable upon
receipt of properly completed invoices which shall be submitted to the program administrator,
Rachel Meade, Rachel.meade@hca.wa.gov, by the Contractor monthly. The invoices shall describe
and document to HCA's satisfaction a description of the work performed, activities accomplished,
the progress of the project, and fees, Payments shall be in accordance with delivery and approval
of deliverables as outlined in the Deliverables Table.
c. Payment. Payment shall be considered timely if made by HCA within thirty (301 days after receipt
and acceptance by HCA of the properly completed invoices. Payment shall be sent to the address
designated by the Contractor on page one (1) of this Contract. HCA may, at its sole discretion,
withhold payment claimed by the Contractor for services rendered if Contractor fails to
satisfactorily eomply with any term or condition of this Contract.d. Claims for payment submitted by the Contractor to HCA for amounts due and payable under this
agreement that were incurred prior to the expiration date shall be paid by HCA if received by HCA
within 90 days after the expiration date.
e, HCA shall not reimburse the Contractor for any fees and expenses which exceed the maximum
consideration of this contract.
Washington State
Health Care Authoity Page 6 HCA Contract No. K588r1
Attachment 1
Data Use, Security, and Confidentiality
1. Definitions
ln addition to the definitions set out in section 2, Definitions, of the Contract, the definitions below apply to this
Schedule:
"Authorized User" means an individual or individuals with an authorized business need to access HCA's
Confidential lnformation under this Contract.
"Breach" means the acquisition, access, use, or disclosure of Data in a manner not permitted under law,
including but not limited to the HIPAA Privacy Rule which compromises the security or privacy of the
Protected Health lnformation, with the exclusions and exceptions listed in 45 C.F.R. 164.402.
"Client" means an individual who is eligible for or receiving services through HCA program(s).
"Confidential lnformation" means information that is exempt from disclosure to the public or other
unauthorized persons under Chapter 42.56 RCW or other federal or state laws. Confidential lnformation
comprises both Category 3 and Category 4 Data as described in Section 4, Data Ctassification, which
includes, but is not limited to, Personal lnformation and Protected Health lnformation. For purposes of this
Contract, Confidential lnformation means the same as "Data."
"Contract Administrator" means the HCA individual designated to receive legal notices and to administer,
amend, or terminate this Contract.
"Gontract Manager" means the individual identified on the cover page of this Contract who will provide
oversight of the activities conducted under this Contract.
"Govered Entity" means HCA, which is a Covered Entity as defined in 45 C.F.R. S 160.103, in its conduct of
covered functions by its health care components.
"Designated Record Set" means a group of records maintained by or for a Covered Entity, that is: the
medical and billing records about individuals mainlained by or for a covered health care provider; the
enrollment, payment, claims adjudication, and case or medical management record systems maintained by or
for a health plan; or used in whole or part by or for the Covered Entity to make decisions about individuals.
"Disclosure" means the release, transfer, provision of, access to, or divulging in any other manner of
information outside the entity holding the information.
"Electronic Protected Health lnformation" or "ePHl" means Protected Health lnformation that is
transmitted by electronic media or maintained in any medium described in lhe definition of electronic media at
45 C.F.R. S 160.103.
"HIPAA" means the Health lnsurance Portability and Accountability Act of 1996, Pub. L. 104-191, as
amended by the American Recovery and Reinvestment Act of 2009 ('ARRA"), Sec. 13400 - 13424, H.R. 1
(200e) (HITECH Acg.
"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts
160 and Part 164.
"lndividual(s)" means the person(s) who is the subject of PHI and includes a person who qualifies as a
personal representative in accordance with 45 C.F.R. g 164.502(9).
"Limited Data Set(s)" means a data set that meets the requirements of 45 C.F.R. SS 164.514(eX2) and
164.51a(e)(3).
Washington Stale
Haalth Carc Authotry Page 7 HCA Contract No. K5885-1
2.
3.
"Minimum Necessary" means the least amount of PHI necessary to accomplish the purpose for which the
PHI is needed.
"Permissible Use" means only those uses authorized in this Contract and as specifically defined herein.
"Personal lnformation" means information identifiable to any person, including, but not limited to,
information that relates to a person's name, health, finances, education, business, use or receipt of
governmental services or other activities, addresses (including or excluding zip code), telephone numbers,
social security numbers, driver's license numbers, credit card numbers, any other identifying numbers, and
any financial identifiers.
"Protected Health lnformation" or "PHl" means information that relates to the provision of health care to an
individual; the past, present, orfuture physicalor mental health or condition of an individual; or past, present
or future payment for provision of health care to an individual. 45 C.F.R. 160 and 164. PHI includes
demographic information that identifies the individual or about which there is reasonable basis to believe, can
be used to identify the individual. 45 C.F.R. 160.103. PHI is information transmitted, maintained, or stored in
any form or medium. 45 C.F.R. 164.501. PHI does not include education records covered by the Family
Educational Right and Privacy Act, as amended, 20 USC 1131g(e{e(b)(iv).
"ProviderOne" means the Medicaid Management lnformation System, which is the State's Medicaid
payment system managed by HCA.
"Regulation" means any federal, state, or local regulation, rule, or ordinance.
"Contractor" means the entity that is identified on the cover page of this Contract and is a party to this
Contract, and includes the entity's owners, members, officers, directors, partners, trustees, employees, and
Subcontractors and their owners, members, officers, directors, partners, trustees, and employees.
"Subcontract" means any separate agreement or contract between the Contractor and an individual or entity
("Subcontractor'') to perform any duties that give rise to a business requirement to access the Data that is the
subject of this Contract.
"Use'includes the sharing, employment, application, utilization, examination, or analysis, of PHlwithin an
entity that maintains such information
Description of Data to be Shared / Data Licensing Statements
Data Licensing Statements are the written statements that determine the following issues, at a minimum:
a. ldentification of the purpose of the file;
b. ldentification of costs (if any)
c. ldentification of transmission method; and
d. ldentification of the file layout.
Attachment 1A contains the Data Licensing statement for this contract
Data Classification
The State classifies data into categories based on the sensitivity of the data pursuant to the Security policy
and standards promulgated by the Office of the state of Washington Chief lnformation Officer. (See Section 4,
Data Security, of Secunng lf Assets Standards No. 141.10 in the State Technology Manualat
Washingtan State
Health Care Authority Page I HCA Contract No. K5885-1
hltos:/locio.wa.qovlpoliciesll4l-securinq-information-technoloov-assetsl14110-securino-information-
technoloqv-assets. Section 4 is herebv incorporated bv reference.)
The Data that is the subject of this Contract is classified as indicated below:
D Category 1 - Public lnformation
Public information is information that can be or currently is released to the public. lt does not need
protection from unauthorized disclosure, but does need integrity and availability protection controls
tr Category 2 - Sensitive lnformation
Sensitive information may not be specifically protected from disclosure by law and is for official use only
Sensitive information is generally not released to the public unless specifically requested.
D Category 3 - Confidential lnformation
Confidential information is information that is specifically protected from disclosure by law. lt may include
but is not limited to:
a. Personal lnformation about individuals, regardless of how that information is obtained;
b. lnformation concerning employee personnel records;
c. lnformation regarding lT infrastructure and security of computer and telecommunications
systems;
X Category 4 - Confidential lnformation Requiring Special Handling
Confidential information requiring special handling is information that is specifically protected from
disclosure by law and for which:
a. Especially strict handling requirements are dictated, such as by statutes, regulations, or
agreements;
b. Serious consequences could arise from unauthorized disclosure, such as threats to health and
safety, or legal sanctions.
4. Constraints on Use of Data/Limited License
4.1, Subject to the Terms and Conditions of this Contract, HCA hereby grants Contractor a limited
license for the access and Permissible Use of Data. This grant of access may not be deemed as
providing Contractor with ownership rights to the Data. The Data being shared/accessed is owned
and belongs to HCA.
4.2 Data shared under this Contract includes data protectedby 42 C.F.R. Part2.ln accordance with 42
C.F.R. S 2.32, this Data has been disclosed from records protected by federal confidentiality rules
(42 C.F.R. Part 2). The federal rules prohibit Contractor from making any further disclosure(s) of the
Data that identifies a patient as having or having had a substance use disorder either directly, by
reference to publicly available information, or through verification of such identification by another
person unless further disclosure is expressly permitted by the written consent of the individual
whose information is being disclosed or as otherwise permittedby 42 C.F.R. Paft2. A general
authorization for the release of medical or other information is NOT sufficient for this purpose (42
C.F.R. S 2.31). The federal rules restrict any use of the SUD data to investigate or prosecute with
Wasf,hgfon Slate
Haalth Care Authority Page 9 HCA Contraet No. K5885-1
regard to a crime any patient with a substance use disorder, except as provided at 42 C.F.R. gg
2.12(c)(5) and 2.65.
4.3.This Contract does not constitute a release of the Data for the Contractor's discretionary use.
Contractor must use the Data received or accessed under this Contract only to carry out the
purpose and justification of this Contract as set out in the Data Licensing Statement(s). Any
analysis, use, or reporting that is not within the Purpose of this Contract is not permitted without
HCA's prior written consent.
4.4. This Contract does not constitute a release for Contractor to share the Data with any third parties,
including Subcontractors, even if for authorized use(s) under this Contract, without the third party
release being approved in advance by HCA and identified in the Data Licensing Statement(s).
4.5. Derivative Data Product Review and Release Process. All reports derived from Data shared under
this Contract, produced by Contractor that are created with the intention of being published for or
shared with external customers (Data Product(s)) must be sent to HCA for review of usability, data
sensitivity, data accuracy, completeness, and consistency with HCA standards prior to disclosure.
This review will be conducted and response of suggestions, concerns, or approval provided to
Receving Party within 10 business days,
a. Small Numbers. Contractor will adhere to HCA Small Numbers Standards, Attachment 2. HCA
and Contractor may agree to individual Permissible Use exceptions to the Small Numbers
Standards, in writing (email acceptable),
4.6. Any disclosure of Data contrary to this Contract is unauthorized and is subject to penalties identified
in law.
5. Data Modification(s)
Any modification to the Purpose, Justification, Description of Data to be SharedlData Licensing Statement(s),
and Permissible Use, is required to be approved through HCA's Data Request Process. Contractor must
notify HCA's Contract Manager of any requested changes to the Data elements, Use, records linking needs,
research needs, and any other changes from this Contract, immediately to start the review process. Approved
changes will be documented in an Amendment to the Contract.
6. Security of Data
6.1. Data Protection
The Contractor must protect and maintain all Confidential lnformation gained by reason of this Contract
against unauthorized use, access, disclosure, modification or loss. This duty requires the Contractor to
employ reasonable security measures, which include restricting access to the Confidential lnformation by
a. Allowing access only to staff that have an authorized business requirement to view the
Confidential I nformation.
b. Physically securing any computers, documents, or other media containing the Confidential
lnformation.
6.2. Data Security Standards
Contractor must comply with the Data Security Requirements set out in Attachment 1 and the Washingtol
OCIO Security Standard, 141^1A (httos:l/ocio.wa.qov/policies/141-securinq-information-technoloov-
Washington State
Health Care Authority Page 1A HCA Contract No. K5885-1
7
assetsll4l 10-securinq-information{echnoloqv-asselg.) The Securitv Standard 141.10 is herebv
incorporated bv reference into this Contract.
6.3. Data Disposition and Retention
a. Contractor will dispose of HCA Data in accordance with this section.
b. Upon request by HCA, or at the end of the Contract term, or when no longer needed,
Confidential lnformationlData must be disposed of as set out in Attachment 1, Section 5 Data
Disposition, except as required to be maintained for compliance or accounting purposes.
Contractor will provide written certification to HCA of disposition using Attachment 4,
C e ft if i c at i o n of D e stru ct i on /Dl'sposifrbn of C o nf i d e nt i a I I n fo rm ati on .
Data Confidentiality and Non-Disclosure
7.1. DataConfidentiality.
The Contractor will not use, publish, transfer, sell, or otherwise disclose any Confidential lnformation
gained by reason of this Contract for any purpose that is not directly connected with the purpose,
justification, and Permissible Use of this Contract, as set out in the attached Data Licensing Statement(s)
except: (a) as provided by law; or (b) with the prior written consent of the person or personal
representative of the person who is the subject of the Data.
7.2. Non-Disclosure of Data
The Contractor must ensure that all employees or Subcontractors who will have access to the Data
described in this Contract (including both employees who will use the Data and lT support staff) are
instructed and made aware of the use restrictions and protection requirements of this Contract before
gaining access to the Data identified herein. The Contractor will also instruct and make any new employe
aware of the use restrictions and protection requirements of this Contract before they gain access to the
Data.
The Contractor will ensure that each employee or Subcontractor who will access the Data signs the User
Agreement on Non-Disclasure of Confidential lnformafion, Attachment 3 hereto. The Contractor will retair
the signed copy of lhe User Agreement on Non-Disclosure of Confidentiat lnformation in each employee'r
personnel file for a minimum of six years from the date the employee's access to the Data ends. The
documentation must be available to HCA upon request.
7.3. Penalties for Unauthorized Disclosure of Data
State laws (including RCW 74.04.060 and RCW 70.02.020) and federal regulations (including HIPAA
Privacy and Security Rules, 45 C.F.R. Part 160 and Part 164; Confidentiality of Alcoholand Drug Abuse
Patient Records, 42 C.F.R., Parl2; and Safeguarding lnformation on Applicants and Beneficiaries, 42
C.F.R. Part 431, Subpart F) prohibit unauthorized access, use, or disclosure of Confidential lnformation.
Violation of these laws may result in criminal or civil penalties or fines.
The Contractor accepts full responsibility and liability for any noncompliance by itself, its employees, and
its Subcontractors with these laws and any violations of the Contract.
Data Shared with Subcontractors
The Contractor will not enter into any Subcontract without the express, written permission of HCA, which will
approve or deny the proposed subcontract in its sole discretion. lf Data access is to be provided to a
Subcontractor under this Contract it will only be for the Permissible Use authorized by HCA and the
Washington State
Health Care Authority
8.
Page 11 HCA Contraet No. K5885-1
9.
Contractor must include all of the Data security terms, conditions and requirements set forth in this Contract in
any such Subcontract. ln no event will the existence of the Subcontract operate to release or reduce the
liability of the Contractor to HCA for any breach in the performance of the Contractor's responsibilities.
Audit
9.1 At HCA's request or in accordance with OCIO 1411A, Contractor shall obtain audits covering Data
Security and Permissible Use. Contractor may cover both the Permissible Use and the Data
Security Requirements under the same audit, or under separate audits. The term, "independent
third-party' as referenced in this section means an outside auditor that ls an independent auditing
firm.
9.2 Data Security audits must demonstrate compliance with Data Security standards adopted by the
Washington State Office of the Chief lnformation Officer (OCIO), and as set forth in Attachment 1,
Data Security Requiremenfs. At a minimum, audit(s) must determine whether Data Security
policies, procedures, and controls are in place to ensure compliance with all Data Security
Requirements set forth herein and as required by state and federal law.
9.3.Permissible Use Audits must demonstrate compliance with Permissible Use standards as set forth
in this Contract and each Attachment A. Audit(s) must determine whether Permissible Use policies,
procedures, and controls are in place to ensure compliance with all Permissible Use requirements
in this Contract.
9.4 HCA may monitor, investigate, and audit the use of Personal lnformation received by Contractor
through this Contract. The monitoring and investigating may include the act of introducing data
containing unique but false information (commonly referred to as "salting" or "seeding")lhat can be
used later to identify inappropriate use or disclosure of Data.
9.5.During the term of this Contract and for six (6) years following termination or expiration of this
Contract, HCA will have the right at reasonable times and upon no less than five (5) business days
prior written notice to access the Contractor's records and place of business for the purpose of
auditing, and evaluating the Contractor's compliance with this Contract and applicable laws and
regulations.
Data Breach Notification and Obligations
10.1. The Breach or potential compromise of Data shared under this Contract must be reported to the
HCA Privacy Offieer at PrivacvOfficer@hca.wa.qov within one (1) business day of discovery.
10.2. lf the Breach or potential compromise of Data includes PHl, and the Contractor does not have full
details, it will report what information it has and provide full details within 15 business days of
discovery. To the extent possible, these reports must include the following:
a. The identification of each individual whose PHI has been or may have been improperly
accessed, acquired, used, or disclosed;
b. The nature of the unauthorized Use or disclosure, including a brief description of what
happened, the date of the event(s), and the date of discovery;
c. A description of the types of PHI involved;
10.
Washington State
Health Care Authority Page 12 HCA Contract No. K5885-1
11.
d. The investigative and remedialactions the Contractor or its Subcontractor took or will take to
prevent and mitigate harmful effects and protect against recurrence;
e. Any details necessary for a determination of the potential harm to Clients whose PHI is believed
to have been Used or disclosed and the steps those Clients should take to protect themselves;
and
f, Any other information HCA reasonably requests.
10.3. The Contractor must also take actions to mitigate the risk of loss and comply with any notification or
other requirements imposed by law or HCA including but not limited to 45 C.F.R. Part 164 Subpart
D; RCW42.56.590; RCW 19,255.010; orWAC 284-A4-625.
1A.4, lf notification must, in the sole judgement of HCA, must be made Contractor will further cooperate
and facilitate notification to necessary individuals, to the U.S. Department of Health and Human
Services (DHHS) Secretary, and to the media. At HCA's discretion, Contractor may be required to
directly perform notification requirements, or if HCA elects to perform the notifications, Contractor
must reimburse HCA for all costs associated with notification(s).
10.5. Contractor is responsible for all costs incurred in connection with a security incident privacy Breach,
or potential compromise of Data, including:
a. Computer forensics assistance to assess the impact of a Data Breach, determine root cause,
and help determine whether and the extent to which notification must be provided to comply
with Breach notification laws;
b. Notification and call center services for individuals affected by a security incident or privacy
Breach, including fraud prevention, credit monitoring, and identify theft assistance; and
c. Regulatory defense, fines, and penalties from any claim in the form of a regulatory proceeding
resulting from a violation of any applicable privacy or security law(s) or regulation(s).
10.6. Any breach of this section may result in termination of the Contract and the demand for return or
disposition, as described in Section 7.3, of all HCA Data.
1A.7. Contractor's obligations regarding breach notification survive the termination of this Contract and
continue for as long as Contractor maintains the Data and for any Breach or potential compromise,
Privacy Breach Response Goverage Requirements
For the term of this Contract and 3 years following its termination or expiration, Contractor must maintain
insurance to cover costs incurred in connection with a security incident, privacy Breach, or potential
compromise of Data, including:
a. Computer forensics assistance to assess the impact of a Data Breach, determine root cause,
and help determine whether and the extent to which notification must be provided to comply
with Breach notification laws;
b. Notification and call center services for individuals affected by a security incident, or privacy
Breach;
Washingtan State
Health Care hthority Page 13 HCA Contract No, K588s.l
c. Breach resolution and mitigation services for individuals affected by a security incident or
privacy Breach, including fraud prevention, credit monitoring, and identity theft assistance; and
d. Regulatory defense, fines, and penalties from any claim in the form of a regulatory proceeding
resulting from a violation of any applicable privacy or security law(s) or regulation(s).
12. SurvivalClauses
The terms and conditions contained in this Schedule that by their sense and context are intended to survive
the expiration or other termination of this Schedule must survive. Surviving terms include, but are not limited
to: Consfraints on Use of Data / Limited License, Security af Data, Data Confidentiality and Non-Disclosure of
Data, Audit, HIPAA Compliance, Data Breach Notification and Qbligations, Dispule Resolution, lnspection,
tnsttrance, Maintenance af Recerds, and Responsibility.
Washington State
Health Care Authorig Page 14 HCA Contract No. K5885-l
Attachment 1A: Data Licensing Statement
1. Background
The state of Washington, acting by and through the Health Care Authority (HCA), issued a
Request for Application (RFA) dated December 29,2021, (Exhibit A) for the purpose of developing
and implementing or continuing to expand Medication for Opioid Use Disorder (MOUD) in Jails
Program in accordance with its authority under chapters 39.26 and 41.05 RCW. The resulting
Statement of Work requires the jail to share specific Data with HCA regarding individuals with
Opioid Use Disorder
2. Justification and Authority for Data Sharing
The Data to be shared under this DSA are necessary to comply with 2021 Engrossed Senate Bill
5476 and Engrossed Substitute Bill 5092 directing HCA to implement and enhance medication for
Opioid Use Disorder in jail programs.
3. Purpose / Use I Description of Data
The purpose of this DSA is to provide terms and conditions under which HCA will allow the restricted
use of its Data to the Contractor, and under which the Contractor may receive and use the Data. This
DSA ensures that HCA Data is provided, protected, and used only for purposes authorized by state
and federal law governing such Data use.
The scope of this DSA only provides the Contractor with access and Permissible Use of Data; it does
not establish an agency relationship or independent contractor relationship between HCA and the
Contractor.
a. File Layout: The Parties will exchange Data using the mutually agreed upon file layouts below
The Parties may edit and/or change the Fle Layout as considered necessary.
Method of Access/Transfer: Once an established Secure Data Transfer connection with
the host computer at Contractor's location is confirmed, Contractor will provide Data
listed in File Layout list below, to HCA.
ii. Delivery Method: Secure File Transfer
iii. Frequency of Data Delivery: Contractor will transmit Data monthly, by the 1Oth day of
the month for the previous month.
iv. Costs: NIA
Contractor will be sharing with HCA the following Data elements:
i. Full name
ii. Date of birth
iii. Provider One #, SSN or another unique identifier
iv. Date of booking
v. Date MOUD started: continued or induction?
Washington State
Health Care Aulhority Page 15 HCA Contract No. K5885-1
vi. Date of release if applicable
vii. Scheduled first MOUD appointment upon release
viii. Which MOUD provided upon release
Washingtan State
Health Care Authority Page 16 HCA Contract Na. K5885-1
Attachment 2: Data Security Requirements
1. Definitions
ln addition to the definitions set out in the Data Use, Security, and Confidentiality Schedule, the
definitions below apply to this Attachment.
a. "Hardened Password" means a string of characters containing at least three of the foltowing
character classes: upper case letters; lower case letters; numerals; and special characters, such
as an asterisk, ampersand or exclamation point.
i. Passwords for external authentication must be a minimum of 10 characters long.
i. Passwords for internal authentication must be a minimum of 8 characters long.
ii. Passwords used for system service or service accounts must be a minimum of 20
characters long.
b. "Portable/Removable Media" means any data storage device that can be detached or removed
from a computer and transported, including but not limited to: optical media (e.g. CDs, DVDs);
USB drives; or flash media (e.9. CompactFlash, SD, MMC).
c. "Portable/Removable Devices" means any small computing device that can be transported,
including but not limited to: handheldslPDAslsmartphones; Ultramobile PCs, flash memory
devices (e.9. USB flash drives, personal media players); and laptop/notebooUtablet computers. lf
used to store Confidential lnformation, devices should be Federal lnformation Processing
Standards (FIPS) Level 2 compliant.
d. "Secured Area" means an area to which only Authorized Users have access. Secured Areas may
include buildings, rooms, or locked storage containers (such as a filing cabinet) within a room, as
long as access to the Confidential lnformation is not available to unauthorized personnel.
e. "Transmitting" means the transferring of data electronically, such as via email, SFTP,
webservices, AWS Snowball, etc.
f. "Trusted System(s)" means the following methods of physical delivery: (1) hand-delivery by a
person authorized to have access to the Confidential lnformation with written acknowledgement
of receipt; (2) United States Postal Service ('USPS") first class mail, or USPS delivery services
that include Tracking, such as Certified Mail, Express Mail, or Registered Mail; (3) commercial
delivery services (e.9. FedEx, UPS, DHL) which offer tracking and receipt confirmation; and (4)
the Washington State Campus mail system. For electronic transmission, the Washington State
Governmental Network (SGN) is a Trusted System for communications within that Network.
g. "Unique User lD" means a string of characters that identifies a specitic user and which, in
conjunction with a password, passphrase, or other mechanism, authenticates a user to an
information system.
2. Data Transmission
a. When transmitting HCA's Confidential lnformation electronically, including via email, the Data
must be encrypted using NIST 8O0-series approved algorithms
(htto:llcsrc.nist.qovlpubliqationslPubsSPs.html). This includes transmission over the public
internet.
Washington State
Haalth Care Authoity Page 17 HCA Contract Na. K5885-1
b. When transmitting HCA's Confidential lnformation via paper documents, the Contractor must use
a Trusted System and must be physically kept in possession of an authorized person
3. Protection of Data
The Contractor agrees to store and protect Confidential lnformation as described:
a. Data at Rest:
Data will be encrypted with NIST 80O-series approved algorithms. Encryption keys will be
stored and protected independently of the data. Access to the Data will be restricted to
Authorized users through the use of access control lists, a unique user lD, and a
Hardened Password, or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards. Systerns which contain or provide acclss to
Confidential lnformation must be located in an area that is accessible only to authorized
personnel, with access controlled through use of a key, card key, combination lock, or
comparable mechanism.
Data stored on PortablelRemovable Media or Devices:
(A) confidential lnformation provided by HCA on Removabre Media will be
encrypted with NIST 8O0-series approved algorithms. Encryption keys will be
stored and protected independently of the Data,
(B) HCA's data must not be stored by the Contractor on Portable Devices or Media
unless specifically authorized within the DSA. lf so authorized, the Contractor
must protect the Data by:
(1) Encrypting with NIST 80O-series approved algorithms. Encryption
keys will be stored and protected independenfly of the data;
t.
(2|Control access to the devices with a Unique User lD and Hardened
Password or stronger authentication method such as a physical
token or biometrics;
Keeping devices in locked storage when not in use;
Using check-in/check-out procedures when devices are shared;
Maintain an inventory of devices; and
Ensure that when being transported outside of a Secured Area, all
devices with Data are under the physical control of an Authorized
User.
(3)
(4)
(5)
(6)
b. Paper documents. Any paper records containing Confidential lnformation must be protected by
storing the records in a Secured Area that is accessible onty to authorized personnel. \Men not in
use, such records must be stored in a locked container, such as a file cabinet, locking drawer, or
safe, to which only authorized persons have access.
Washington Slate
Health Care Authority Page 18 HCA Contract No. K5885-1
4. Data Segregation
HCA's Data received under this DSA must be segregated or otherwise distinguishable from non-HCA
Data. This is to ensure that when no longer needed by the Contractor, all of HCA's Data can be
identified for return or destruction. lt also aids in determining whether HCA's Data has or may have been
compromised in the event of a security breach.
a. HCA's Data must be kept in one of the following ways
i. on media (e.9. hard disk, optical disc, tape, etc.) which will contain only HCA Data; or
i. in a logical container on electronic media, such as a partition or folder dedicated to HCA's
Data; or
ii. in a database that will contain only HCA Data; or
iii. within a database and will be distinguishable from non-HCA Data by the value of a
specific field or fields within database records; or
iv. when stored as physical paper documents, physically segregated from non-HCA Data in
a drawer, folder, or other container.
b. When it is not feasible or practicalto segregate HCA's Data from non-HCA data, then both HCA's
Data and the non-HCA data with which it is commingled must be protected as described in this
Attachment.
c. Contractor must designate and be able to identify all computing equipment on which they store,
process and maintain HCA Data. No Data at any time may be processed on or transferred to any
portable storage medium. Laptopltablet computing devices are not considered portable storage
medium devices for purposes of this DSA provided it is installed with end-point encryption.
5. Data Disposition
Consistent with Chapter 4Q.14 RCW Contractor shall erase, destroy, and render unrecoverable all HCA
Confidential Data and certify in writing that these actions have been completed within thirty (30) days of
the disposition requirement or termination of this DSA, whiehever is earlier. At a minimum, media
sanitization is to be performed according to the standards enumerated by NIST SP 800-8811 Guidelines
for Media Sanitization.
a. For HCA's Confidential lnformation stored on network disks, deleting unneeded Data is sufficient
as long as the disks remain in a Secured Area and otherwise meet the requirements listed in
Section 3, above. Destruction of the Data as outlined in this section of this Attachment may be
deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area.
6. Network Security
Contractor's network security must include the following
a. Network firewall provisioning;
b. lntrusion detection;
c. Qua(erly vulnerability assessments; and
Washington State
Health Care Authority Page 19 HCA Contract Na. K5885-1
d. Annual penetration tests.
7. Application Security
Contractor must maintain and support its software and subsequent upgrades, updates, patches, and
bug fixes such that the software is, and remains secure from known vulnerabilities.
L Computer $ecurity
Contractor shall maintain computers that access Data by ensuring the operating system and software
are updated and patched monthly, such that they remain secure from known vulnerabilities. Contractor
computer device(s) must also be installed with an Anti-Malware solution and signatures updated no less
than monthly.
9. Offshoring
Contractor must maintain all hardcopies containing Confidential lnformation only from locations in the
United States.
Contractor may not directly or indirectly (including through Subcontractors) transport any Data, hardcopy
or electronic, outside the United States unless it has advance written approvalfrom HCA.
Washington State
Health Care Authority Page 20 HCA Contract No. K5885-l
Attachment 3: HCA Small Numbers Standard
1. Why do we need a Small Numbers Standard?
It is the Washington State Health CareAuthority's (HCA) legal and ethical responsibility to protect the privacy
of its clients and members. However, HCA also supports open data and recognizes tfr6 aOitity of information
to be used to further HCA's mission and vision. As HCA continues down the path of Data Governance
maturity, establishing standards such as this is key in helping HCA analysts and management meet the needs
of external data requestors while maintaining the trust of our clients and members and tomplying with agency,
state and federal laws and policies.
Publishing data products that include small numbers creates two concerns. As a reported number gets
smaller, the risk of re-identifying an HCA client or member increases. This is especially true when i
combination of variables are included in the data product to arrive at the small number (e.g. location,
racelethnicity, age, or other demographic information).
Small numbers can also create questions around statistical relevance. When it comes to publicly posting data
products on HCA's internet site, or sharing outside the agency, the need to know the exact valu! in a celltnat
is less than 11 must be questioned.
As the agency moves away from traditional, static reports to a dynamic reporting environment (e.g. Tableau
visualizations), it is easier for external data consumers to arrive at small numbeis. Further, thoseLxternal
consumers have an increasing amount of their own data that could be used to re-identify individuals. As a
result, more rigor and a consistent approach needs to be in place to protect the privacy bf HCA's clients and
members. Until now, some HCA data teams have elected to follow small numbers guidelines established by
the Department of Health, which include examples of suppression methods for working with small numbers.
HCA is now establishing its own standard, but is planning to work with DOH and other agencies dealing with
healthcare data to try and develop a consistent small numbers methodology at a statewide level.
2. Scope
HCA often uses Category 4 data to create summary data products for public consumption. This Standard is
intended to define one of the requirements for a summary data product to be considered Category 1.
Specifically, it is intended to define the level of suppression that must be applied to an aggregiteo uata
product derived from Category 4 data for the data product to qualify as Category 1. Cat-gory 1 products are
data products that are shared external to the agency, in large part those products that are posted on HCA's
lnternet website (.www.hca.wa.gov). The primary scope of this Standard is for those data products posted
publicly (e.g. on the website), or, shared as public information.
The following are examples of when this Standard does not apply to data products are:
a. Those shared directly with an externalentity outside HCA, the Standard suppression of small
numbers would not be required. However, you should notify the recipient that the data products
contains sensitive information and should not be shared or published
b. Those exchanged under a data share agreement (DSA) that will not be posted or shared
outside the Contractor.
c. Those created for HCA-only internal use.
This standard does not supersede any federal and state laws and regulation
Washingfon Sfafra
Health Care Authority Page 21 HCA Contract No. K5885-1
3. Approach
ln 2017, an impromptu workgroup was formed to tackle the issue of small numbers and determine what the
general approach for handling data products that contain them would be. This initial effort was led by the
agency's Analytics, lnteroperability and Measurement (AlM) team who had an immediate need for guidance in
handling and sharing of data products containing small numbers. The result of that work was a set of lnterim
Small Numbers Guidelines, which required suppression of cells containing values of less than 10. ln addition,
data products that contain small numbers are considered Category 2 under HCA's Data Classification
Guidelines.
ln spring 2018, a new cross-divisional and chartered Small Numbers Workgroup was formed to develop a
formal agency standard. Representatives from each of the major HCA divisions that produce data and analytic
products were selected. The charter, complete with membership, can be found here (available to internal HCA
staff only). The Workgroup considered other state agency standards, and national standards and methods
when forming this standard. The Workgroup also consulted business users and managers to determine the
potential impact of implementing a small numbers suppression standard. All of this information was processed
and used to form the HCA Small Numbers Standard.
4. State and National Small Numbers Standards Considered
When developing these standards, HCA reviewed other organizations'small numbers standards at both a
state and federal level. At the state level, DOH recently published a revised Small Numbers Standard, which
emphasizes the need for suppression for both privacy concerns and statistical relevance. HCA also convened
a meeting of other state agencies to discuss their approach and policies (if any) around Small Numbers.
Feedback from that convening was also taken into consideration for this Standard as well.
Federal health organizations such as the Centers for Disease Control and Prevention (CDC) and the National
Center for Health Statistics (NCHS) also maintain small numbers standards. HCA's federal oversight agency
and funding partner, the Centers for Medicare and Medicaid Services (CMS) adopts suppression of any ceti
with a count of 10 or less.
5. WA Health Care Authority Small Numbers Standard
Any HCA external publication of data products are to be compliant with both HIPAA and Washington State
privacy laws. Data products are not to contain small numbers that could allow re-identification oflndividual
beneficiaries. HCA analysts are to adhere to the following requirements when developing Category 1 data
products for distribution and publication. Category 1 data is information that can be released to the public.
These products do not need protection from unauthorized disclosure, but do need integrity and availability
protection controls. Additionally, all contractors (state and private) that use HCA's data to produce derivative
reports and data products are required to adhere to this standard as well. HCA's Contracts team will ensure
that proper contractual references are included to this and all HCA Data Release and Publishing Standards.
The requirements discussed herein are not intended for Category 2, Category 3, or Category 4 data products.
6. HCA's Small Number Standard:
a. There are no automatic exemptions from this standard
b. (See Exception Request Process section below)
c. Standard applies for all geographical representations, including statewide.
d. Exceptions to this standard will be considered on a case-by-case basis (see Exception Requesf
Process section later in this document for more information).
e. Ensurethat no cellswith0 < n < 11 arereported (0 < n < 11 suppressed)
Washinglon State
Health Care Authoity Page 22 HCA Cantract Na. K5885-1
f. Apply a marginalthreshold of 1 - 10 and cellthreshold of 'l - 10 to alltabulations
g (0"n<llsuppressed).
h. To protect against secondary disclosure, suppress additional cells to ensure the primary suppressed
small value cannot be recalculated.
i. Suppression of percentages that can be used to recalculate a small number is also required.
j. Use aggregation to prevent small numbers but allow reporling of data. Age ranges are a very good
example of where aggregation can be used to avoid small numbers but avoid suppressing data (see
example below).
7. Small Numbers Examples
a. Example (Before Applying Standard)
b. Example (After Applying Standard)
Client Gender County ach Statewide
Male -_-1 14
Female 11 15 26
TOTAL 40
lln order to protect the privacy of individuals, cells in this data product that contain small numbers from 1
to 10 are not displayed.
The above examples show in order to comply with the standard, analysts must not only suppress direcily
those cells where n < 1 1, but also in this case secondary suppression is necessary of ine county and AC]
totals in orderto avoid calculation of those cells that contained small numbers.
c. Example (Suppression with no aggregation)
Age Range County ach Statewide
0-3 5 (would be suppressed)8 (would be suppressed)13 (would be
suppressed)
4-6 7 (would be suppressed)18 25 twould be
suppressed)
15 23 38
10-"t2 24 33 57
TOTAL 51 (would be suporessedl 82 (would be suppressed)133
d. Example (Using aggregation instead of suppression)
Age Ranqe County ach Statewide
0-6 12 26 38
7-9 15 23 38
Client Gender County Accountable Community of Health (ACH)Statewide
Male 6 I 14
Female 11 15 26
TOTAL 17 23 40
Washington State
Health Care Authority Page 23 HCA Contract Na. K5885-1
10-12 24 33 57
TOTAL 51 82 133
The above examples provide guidance for using aggregation to avoid small number suppression and still
provide analytic value to the end user. Aggregation is an excellent method to avoid presenting informatior
with many holes and empty values.
Washington State
Health CarB Authority Paga 24 HCA Contract No. K588*1
Attachment 4: Certification of Destruction/Disposal of Confidential lnformation
(To Be Filled Out and Returned to HCA Upon Termination of DSA)
NAME OF CONTRACTOR:DATA SHARE AGREEMENT (DSA}#:
(contractor) herby certifies that the data elements listed below or attached
received as a part of the data provided in accordance with DSA have been:tr DtsposED oF/DEsrRoyED ALL coptEs
You cenify that you returned or destroyed all identified confidential information received from HCA, or created,
maintained, or received by you on behalf of HCA. You certify that you did not retain any copies of the confidential
information received by HCA.
Description of lnformation Disposed of/ Destroyed
Date of Destruction
Method(s) of destroying/disposing of Confidential lnformation
Disposed ofiDestroyed by:
S nature Date
Printed Name:
Title:
HCA Contract No Page 1 of25