Governor and Executive Council Agenda item PDF - 2026-03-04 - agenda 27

Meeting Date

2026-03-04

Attachment Kind Label

Agenda item PDF

Attachment Relation

cross_meeting_reference

Agenda Numbers

27

Agency Names

Board Of Tax And Land Appeals

Parent Meeting Title

Governor and Executive Council meeting - 2026-03-04

Lori A. Weaver

Commissioner

Elkn M. Lapointc

Chief Executive OfTicer

STATE OF NEW HAMPSHIRE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

mw HAMPSHIRE HOSPITAL

36 CLINTON STREET, CONCORD, NH 03301

603-271-5300 1-800-852-3345 Ext 5300

Fax: 603-271-5395 TOD Access; 1-800-735-2964 www.dhhs.nh.gov

c27

January 11, 2024

His Excellency, Governor Christopher T. Sununu

and the Honorable Council

State House

Concord, New Hampshire 03301

REQUESTED ACTION

Authorize the Department of Health and Human Services, New Hampshire Hospital, to

enter into a Sole Source contract with Achievement Therapy Services. LLC (VC#166337),

Laconia, NH, in the amount of $284,856.00 for physical therapy services for patients at New

Hampshire Hospital, with the option to renew for up to two (2) additional years, effective July 1,

2024 upon Governor and Council approval, through June 30, 2026. 32% General Funds. 68%

Other Funds (Provider Fees).

Funds are available in the following account for State Fiscal Year 2025, and are

anticipated to be available in State Fiscal Year 2026, upon the availability and continued

appropriation of funds in the future operating budget, with the authority to adjust budget line items

within the price limitation and encumbrances between state fiscal years through the Budget Office,

if needed and justified.

05-95-94-940010-8750 Health and Social Services, Dept. of Health and Human Services,

HHS; New Hampshire Hospital, Acute Psychiatric Services

State

Fiscal

Year

Class / Account Class Title Job Number Total Amount

2025 101-500729 Medical Providers 94053100 $142,428.00

2026 101-500729 Medical Providers 94053100 $142,428.00

Total $284,856.00

EXPLANATION

This request is Sole Source because the Contractor has expertise in effectively providing

physical therapy for the specialized mental health population at New Hampshire Hospital, and

modifying approaches to evaluation and treatment in a manner that meets the specialized needs

and co-morbidities of individuals in a mental health hospital setting. The Contractor is currently

integrated within the structure and daily routine at New Hampshire Hospital, whereas a different

contractor would require significant additional resources assigned to overseeing the delivery of

services. This would place additional strain on the already overloaded staff at New Hampshire

Hospital, and lead to less effective and timely physical therapy services for the patients.

His Excellency. Governor Christopher T. Sununu

and the Honorable Council

The purpose of this request to provide physical therapy services to individuals admitted to

New Hampshire Hospital in order to promote movement, reduce pain, restore function, and

prevent disability. The Contractor will provide physical therapy services to individuals admitted to

New Hampshire Hospital who demonstrate a medical necessity for services. Physical therapy

services provided by the Contractor promote patient recovery and may increase the rate of

discharge and discharge options into the community. The Contractor will provide services, in

accordance with individual medical orders written by New Hampshire Hospital staff, that enable

individuals to achieve improved independence and function; reduce pain and reliance on pain

medication; reduce the risk of falling; and slow the progression of. or reverse, disability caused

by disease or injury.

Approximately 700 individuals will be served annually.

The Department will monitor services through the review of progress and discharge notes,

and by overseeing the delivery of sen/ices onsite.

As referenced in Exhibit A of the attached agreement, the parties have the option to extend

the agreement for up two (2) additional years, contingent upon satisfactory delivery of services,

available funding, agreement of the parties and Governor and Council approval.

Should the Governor and Council not authorize this request, the Department may be

unable to support continued physical therapy services to individuals admitted to New Hampshire

Hospital, which may slow the rate of discharge; reduce the number of community discharge

environments where individuals can live; increase the amount of pain and opioid medication

required: and increase the rate of falls, disabilities, medical complications and other sen^ices

required by individuals..

Area served; New Hampshire Hospital.

In the event that the Other Funds become no longer available, additional General Funds

will not be requested to support this program.

Respectfully submitted.

Lori A. Weaver

Commissioner

The Department of Health and Human Services'Mission is to Join communities and families

in providing opportunities for citizens to achiei>e health and independence.

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

Subject: Physical Therapy Services SS-2025-NHH. 01-PHYSI-01

FORM NUMBER P-37 (version 2/23/202:

Notice: This agreement and all of its attachments shall become public upon submission to Governor and

Executive Council for approval. Any information that is private, confidential or proprietary must

be clearly identified to the agency and agreed to in writing prior to signing the contract.

1.

AGREEMENT

The State of New Hampshire and the Contractor hereby mutually agree as follows:

GENERAL PROVISIONS

IDENTIFICATION.

1.1 Slate Agency Name

New Hampshire Department of Health and Human Services

1.2 State Agency Address

129 Pleasant Street

Concord, NH 03301-3857

1.3 Contractor Name

Achievement Therapy Services, LLC

1.4 Contractor Address

63 Port Way, Laconia, NH 03246

1.5 Contractor Phone

Number

603-493-0430

1.6 Account Unit and Class

05-95-94-940010-8750-101-50

0729

1.7 Completion Date

6/30/2026

1.8 Price Limitation

$284,856

1.9 Contracting Officer for State Agency

Robert W. Moore, Director

I.IO State Agency Telephone Number

(603) 271-9631

1.11 Contractor Signature

> 0ocu$lgn«4 by;

(u/diAA

1.12 Name and Title of Contractor Signatory

Iwona Szetela-Hecka

Manager

1.13 51fa^e"^gency"Signature

^ DoeuSign«d by:

Date: 1/4/2024

1.14 Name and Title of State Agency Signatory

Ellen Marie Lapointe

Chief Executive Officer

1. iB N.H. Department of Administration, Division of Personnel (ifapplicable)

By: Director, On:

1.16 Approval by the Attorney General (Form, Substance and Execution) (//applicable)

^»~OocuSlgn«d by:

By: r On: VIV/O^^

1.17 Approval by the Governor and Executive Council (ifapplicable)

G&C Item number: G&C Meeting Date;

Page t of 4

Contractor Initials

DatcV3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

2. SERVICES TO BE PERFORMED. The State of New

Hampshire, acting through the agency identified in block 1.1

("State"), engages contractor identified in block 1.3 ("Contractor")

to perform, and the Contractor shall perform, the work or sale of

goods, or both, identified and more particularly described in the

attached EXHIBIT B which is incorporated herein by reference

("Services").

3. EFFECTIVE DATE/COMPLETION OF SERVICES.

3.1 Notwithstanding any provision of this Agreement to the

contrary, and subject to the approval of the Governor and

Executive Council of the State of New Hampshire, if applicable,

this Agreement, and all obligations of the parties hereunder, shall

become effective on the date the Governor and Executive Council

approve this Agreement, unless no such approval is required, in

which case the Agreement shall become effective on the date the

Agreement is signed by the State Agency as shown in block 1.13

("Effective Date").

3.2 If the Contractor commences the Services prior to the Effective

Date, all Services performed by the Contractor prior to the

Effective Date shall be performed at the sole risk of the Contractor,

and in the event that this Agreement does not become effective, the

State shall have no liability to the Contractor, including without

limitation, any obligation to pay the Contractor for any costs

incurred or Services performed.

3.3 Contractor must complete all Sendees by the Completion Date

specified in block 1.7.

4. CONDITIONAL NATURE OF AGREEMENT.

Notwithstanding any provision of this Agreement to the contrary,

all obligations of the State hereunder, including, without limitation,

the continuance of payments hereunder, arc contingent upon the

availability and continued appropriation of funds. In no event shall

the State be liable for any payments hereunder in excess of such

available appropriated funds. In the event of a reduction or

termination of appropriated funds by any state or federal legislative

or executive action that reduces, eliminates or otherwise modifies

the appropriation or availability of funding for this Agreement and

the Scope for Services provided in EXHIBIT B, in whole or in part,

the State shall have the right to withhold payment until such funds

become available, if ever, and shall have the right to reduce or

terminate the Services under this Agreement immediately upon

giving the Contractor notice of such reduction or termination. The

State shall not be required to transfer funds from any other account

or source to the Account identified in block 1.6 in the event funds

in that Account are reduced or unavailable.

5. CONTRACT PRICE/PRICE LIMITATION/ PAYMENT.

5.1 The contract price, method of payment, and terms of payment

are identified and more particularly described in EXHIBIT C

which is incorporated herein by reference.

5.2 Notwithstanding any provision in this Agreement to the

contrary, and notwithstanding unexpected circumstances, in no

event shall the total of all payments authorized, or actually made

hereunder, exceed the Price Limitation set forth in block 1.8. The

payment by the State of the contract price shall be the only and the

complete reimbursement to the Contractor for all expenses, of

whatever nature incurred by the Contractor in the performance

hereof, and shall be the only and the complete compensation to the

Contractor for the Services.

5.3 The State reser\'es the right to offset from any amounts

otherwise payable to the Contractor under this Agreement those

liquidated amounts required or permitted by N.H. RSA 80:7

through RSA 80;7-c or any other provision of law.

5.4 The State's liability under this Agreement shall be limited to

monetary damages not to exceed the total fees paid. The Contractor

agrees that it has an adequate remedy at law for any breach of this

Agreement by the Slate and hereby waives any right to specific

performance or other equitable remedies against the State.

6. COMPLIANCE BY CONTRACTOR WITH LAWS AND

REGULATIONS/EQUAL EMPLOYMENT

OPPORTUNITY.

6.1 In connection with the performance of the Services, the

Contractor shall comply with all applicable statutes, laws,

regulations, and orders of federal, state, county or municipal

authorities which impose any obligation or duty upon the

Contractor, including, but not limited to, civil rights and equal

employment opportunity laws and the Governor's order on Respect

and Civility in the Workplace, Executive order 2020-01. In

addition, if this Agreement is funded in any part by monies of the

United States, the Contractor shall comply with all federal

executive orders, rules, regulations and statutes, and with any rules,

regulations and guidelines as the State or the United States issue to

implement these regulations. The Contractor shall also comply

with all applicable intellectual property laws.

6.2 During the term of this Agreement, the Contractor shall not

discriminate against employees or applicants for employment

because of age, sex, sexual orientation, race, color, marital status,

physical or mental disability, religious creed, national origin,

gender identity, or gender expression, and will take affirmative

action to prevent such discrimination, unless exempt by state or

federal law. The Contractor shall ensure any subcontractors

comply with these nondiscrimination requirements.

6.3 No payments or transfers of value by Contractor or its

representatives in connection with this Agreement have or shall be

made which have the purpose or effect of public or commercial

bribery, or acceptance of or acquiescence in extortion, kickbacks,

or other unlawful or improper means of obtaining business.

6.4. The Contractor agrees to permit the State or United States

access to any of the Contractor's books, records and accounts for

the purpose of ascertaining compliance with this Agreement and

all rules, regulations and orders pertaining to the covenants, terms

and conditions of this Agreement.

7. PERSONNEL.

7.1 The Contractor shall at its own expense provide all personnel

necessary to perform the Services. The Contractor warrants that all

personnel engaged in the Services shall be qualified to perform the

Services, and shall be properly licensed and otherwise authorized

to do so under all applicable laws.

7.2 The Contracting Officer specified in block 1.9, or any

successor, shall be the State's point of contact pertaining to this

Agreement.

Contractor Initials

Datcl/3/2024

OocuSign Envelope ID: BB497329.7353-43A8-91A1-1C79E763C63C

8. EVENT OF DEFAULT/REMEDIES.

8.1 Any one or more of the following acts or omissions of the

Contractor shall constitute an event of default hereunder ("Event

of Default"):

8.1.1 failure to perform the Services satisfactorily or on schedule;

8.1.2 failure to submit any report required hereunder; and/or

8.1.3 failure to perform any other covenant, term or condition of

this Agreement.

8.2 Upon the occurrence of any Event of Default, the State may

take any one, or more, or all, of the following actions:

8.2.1 give the Contractor a written notice specifying the Event of

Default and requiring it to be remedied within, in the absence of a

greater or lesser specification of time, thirty (30) calendar days

from the date of the notice; and if the Event of Default is not timely

cured, terminate this Agreement, effective two (2) calendar days

after giving the Contractor notice of termination;

8.2.2 give the Contractor a written notice specifying the Event of

Default and suspending all payments to be made under this

Agreement and ordering that the portion of the contract price which

would otherwise accrue to the Contractor during the period from

the date of such notice until such time as the Stale determines that

the Contractor has cured the Event of Default shall never be paid

to the Contractor;

8.2.3 give the Contractor a written notice specifying the Event of

Default and set off against any other obligations the State may owe

to the Contractor any damages the State suffers by reason of any

Event of Default; and/or

8.2.4 give the Contractor a written notice specifying the Event of

Default, treat the Agreement as breached, terminate the Agreement

and pursue any of its remedies at law or in equity, or both.

9. TERMINATION.

9.1 Notwithstanding paragraph 8, the State may, at its sole

discretion, terminate the Agreement for any reason, in whole or in

part, by thirty (30) calendar days written notice to the Contractor

that the State is e.xercising its option to terminate the Agreement.

9.2 In the event of an early termination of this Agreement for any

reason other than the completion of the Services, the Contractor

shall, at the State's discretion, deliver to the Contracting Officer,

not later than fifteen (15) calendar days after the date of

termination, a report ("Termination Report") describing in detail

all Services performed, and the contract price earned, to and

including the date of termination. In addition, at the State's

discretion, the Contractor shall, within fifteen (15) calendar days

of notice of early termination, develop and submit to the State a

transition plan for Services under the Agreement.

10. PROPERTY OWNERSHIP/DISCLOSURE.

10.1 As used in this Agreement, the word "Property" shall mean

all data, information and things developed or obtained during the

performance of, or acquired or developed by reason of, this

Agreement, including, but not limited to, all studies, reports, files,

formulae, surveys, maps, charts, sound recordings, video

recordings, pictorial reproductions, drawings, analyses, graphic

representations, computer programs, computer printouts, notes,

letters, memoranda, papers, and documents, all whether finished or

unfinished.

10.2 All data and any Property which has been received from the

State, or purchased with funds provided for that purpose under this

Agreement, shall be the property of the State, and shall be returned

to the State upon demand or upon termination of this Agreement

for any reason.

10.3 Disclosure of data, information and other records shall be

governed by N.H. RSA chapter 91-A and/or other applicable law.

Disclosure requires prior written approval of the State.

11. CONTRACTOR'S RELATION TO THE STATE. In the

performance of this Agreement the Contractor is in all respects an

independent contractor, and is neither an agent nor an employee of

the State. Neither the Contractor nor any of its officers, employees,

agents or members shall have authority to bind the State or receive

any benefits, workers' compensation or other emoluments

provided by the State to its employees.

12. ASSIGNMENT/DELEGATION/SUBCONTRACTS.

12.1 Contractor shall provide the State written notice at least fifteen

(15) calendar days before any proposed assignment, delegation, or

other transfer of any interest in this Agreement. No such

assignment, delegation, or other transfer shall be effective without

the written consent of the State.

12.2 For purposes of paragraph 12, a Change of Control shall

constitute assignment. "Change of Control" means (a) merger,

consolidation, or a transaction or series of related transactions in

which a third party, together with its affiliates, becomes the direct

or indirect owner of fifty percent (50%) or more of the voting

shares or similar equity interests, or combined voting power of the

Contractor, or (b) the sale of all or substantially all of the assets of

the Contractor.

12.3 None of the Ser\'iccs shall be subcontracted by the Contractor

without prior written notice and consent of the State.

12.4 The State is entitled to copies of all subcontracts and

assignment agreements and shall not be bound by any provisions

contained in a subcontract or an assignment agreement to which it

is not a party.

13. INDEMNIFICATION. The Contractor shall indemnify,

defend, and hold harmless the State, its officers, and employees

from and against all actions, claims, damages, demands,

judgments, fines, liabilities, losses, and other expenses, including,

without limitation, reasonable attorneys' fees, arising out of or

relating to this Agreement directly or indirectly arising from death,

personal injury, properly damage, intellectual property

infringement, or other claims asserted against the State, its officers,

or employees caused by the acts or omissions of negligence,

reckless or willful misconduct, or fraud by the Contractor, its

employees, agents, or subcontractors. The State shall not be liable

for any costs incurred by the Contractor arising under this

paragraph 13. Notwithstanding the foregoing, nothing herein

contained shall be deemed to constitute a waiver of the Stale's

sovereign immunity, which immunity is hereby reser\'ed to the

State. This covenant in paragraph 13 shall sur\'ive the termination

of this Agreement.

Contractor Initiah

Date^/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-lC79e763C63C

14. INSURANCE.

14.1 The Contractor shall, at its sole expense, obtain and

continuously maintain in force, and shall require any subcontractor

or assignee to obtain and maintain in force, the following

insurance:

14.1.1 commercial general liability insurance against all claims of

bodily injury, death or property damage, in amounts of not less than

51,000,000 per occurrence and 52,000,000 aggregate or excess;

and

14.1.2 special cause of loss coverage form covering ail Property

subject to subparagraph 10.2 herein, in an amount not less than

80% of the whole replacement value of the Property.

14.2 The policies described in subparagraph 14.1 herein shall be on

policy forms and endorsements approved for use in the State of

New Hampshire by the N.H. Department of Insurance, and issued

by insurers licensed in the State of New Hampshire.

14.3 The Contractor shall furnish to the Contracting Officer

identified in block 1.9, or any successor, a ccrtificate(s) of

insurance for all insurance required under this Agreement. At the

request of the Contracting Officer, or any successor, the Contractor

shall provide certificate(s) of insurance for all rcncwal(s) of

insurance required under this Agreement. The certificatc(s) of

insurance and any renewals thereof shall be attached and arc

incorporated herein by reference.

15. WORKERS' COMPENSATION.

15.1 By signing this agreement, the Contractor agrees, certifies and

warrants that the Contractor is in compliance with or exempt from,

the requirements of N.H. RSA chapter 281-A ("Workers'

Compensation").

15.2 To the extent the Contractor is subject to the requirements of

N.H. RSA chapter 281-A, Contractor shall maintain, and require

any subcontractor or assignee to secure and maintain, payment of

Workers' Compensation in connection with activities which the

person proposes to undertake pursuant to this Agreement. The

Contractor shall furnish the Contracting Officer identified in block

1.9, or any successor, proof of Workers' Compensation in the

manner described in N.H. RSA chapter 281-A and any applicable

rcnewal(s) thereof, which shall be attached and are incorporated

herein by reference. The State shall not be responsible for payment

of any Workers' Compensation premiums or for any other claim or

benefit for Contractor, or any subcontractor or employee of

Contractor, which might arise under applicable State of New

Hampshire Workers' Compensation laws in connection with the

performance of the Services under this Agreement.

16. WAIVER OF BREACH. A State's failure to enforce its rights

with respect to any single or continuing breach of this Agreement

shall not act as a waiver of the right of the State to later enforce any

such rights or to enforce any other or any subsequent breach.

17. NOTICE. Any notice by a party hereto to the other party shall

be deemed to have been duly delivered or given at the time of

mailing by certified mail, postage prepaid, in a United States Post

Office addressed to the parties at the addresses given in blocks 1.2

and 1.4, herein.

18. AMENDMENT. This Agreement may be amended, waived or

discharged only by an instrument in writing signed by the parties

hereto and only after approval of such amendment, waiver or

discharge by the Governor and Executive Council of the State of

New Hampshire unless no such approval is required under the

circumstances pursuant to State law, rule or policy.

19. CHOICE OF LAW AND FORUM.

19.1 This Agreement shall be governed, interpreted and construed

in accordance with the laws of the State of New Hampshire except

where the Federal supremacy clause requires otherwise. The

wording used in this Agreement is the wording chosen by the

parties to express their mutual intent, and no rule of construction

shall be applied against or in favor of any party.

19.2 Any actions arising out of this Agreement, including the

breach or alleged breach thereof, may not be submitted to binding

arbitration, but must, instead, be brought and maintained in the

Merrimack County Superior Court of New Hampshire which shall

have exclusive jurisdiction thereof.

20. CONFLICTING TERMS. In the event of a conflict between

the terms of this P-37 form (as modified in EXHIBIT A) and any

other portion of this Agreement including any attachments thereto,

the terms of the P-37 (as modified in EXHIBIT A) shall control.

21. THIRD PARTIES. This Agreement is being entered into for

the sole benefit of the parties hereto, and nothing herein, express or

implied, is intended to or will confer any legal or equitable right,

benefit, or remedy of any nature upon any other person.

22. HEADINGS. The headings throughout the Agreement are for

reference purposes only, and the words contained therein shall in

no way be held to explain, modify, amplify or aid in the

interpretation, construction or meaning of the provisions of this

Agreement.

23. SPECIAL PROVISIONS. Additional or modifying

provisions set forth in the attached EXHIBIT A are incorporated

herein by reference.

24. FURTHER ASSURANCES. The Contractor, along with its

agents and affiliates, shall, at its own cost and expense, execute any

additional documents and take such further actions as may be

reasonably required to carry out the provisions of this Agreement

and give effect to the transactions contemplated hereby.

25. SEVERABILITV. In the event any of the provisions of this

Agreement are held by a court of competent jurisdiction to be

contrary to any state or federal law, the remaining provisions of

this Agreement will remain in full force and effect.

26. ENTIRE AGREEMENT. This Agreement, which may be

executed in a number of counterparts, each of which shall be

deemed an original, constitutes the entire agreement and

understanding between the parties, and supersedes all prior

agreements and understandings with respect to the subject matter

hereof.

Contractor Initials

•OS

Datel/3/2024

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT A

Revisions to Standard Agreement Provisions

1. Revisions to Form P-37, General Provisions

1.1. Paragraph 3. Subparagraph 3.1, Effective Date/Completion of Services, is

amended as follows:

3.1. Notwithstanding any provision of this Agreement to the contrary, and

subject to the approval of the Governor and Executive Council of the

State of New Hampshire as indicated in block 1.17, this Agreement, and

all obligations of the parties hereunder, shall become effective on July 1,

2024 ("Effective Date").

1.2. Paragraph 3, Effective Date/Completion of Services, is amended by adding

subparagraph 3.3 as follows:

3.3. The parties may extend the Agreement for up to two (2) additional years

from the Completion Date, contingent upon satisfactory delivery of

services, available funding, agreement of the parties, and approval of the

Governor and Executive Council.

1.3. Paragraph 12, Assignment/Delegation/Subcontracts, is amended by adding

subparagraph 12.3 as follows:

12.3. Subcontractors are subject to the same contractual conditions as the

Contractor and the Contractor is responsible to ensure subcontractor

compliance with those conditions. The Contractor shall have written

agreements with all subcontractors, specifying the work to be performed,

and if applicable, a Business Associate Agreement in accordance with

the Health Insurance Portability and Accountability Act. Written

agreements shall specify how corrective action shall be managed. The

Contractor shall manage the subcontractor's performance on an ongoing

basis and take corrective action as necessary. The Contractor shall

annually provide the State with a list of all subcontractors provided for

under this Agreement and notify the State of any inadequate

subcontractor performance.

1.4. Paragraph 14, Insurance, Subparagraph 14.1.1 is amended as follows:

14.1.1 Professional liability insurance in amounts of not less than

$1,000,000 for each claim and $3,000,000 in the aggregate;

1.5. Paragraph 14, Insurance, Subparagraph 14.1.2 is deleted it in its entirety.

Achievement Therapy Services. LLC A-1.2 Contractor Iniliais(StV

SS-2025-NHH-01-PHYSI-01 Date 1/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

Scope of Services

1. Statement of Work

1.1. The Contractor must provide physical therapy services to patients at New

Hampshire Hospital.

1.2. For the purpose of this Agreement, any reference to days will be calendar days,

unless otherwise identified as business days. Business days are Monday

through Friday, excluding State of New Hampshire holidays.

1.3. The Contractor must provide physical therapy services by a New Hampshire

licensed physical therapist(s) and provide the Department with a copy of the

license(s) within five (5) business days of the Effective Date of this Contract, or

within five (5) business days of any newly issued license.

1.4. The Contractor must accept all patients referred by New Hampshire Hospital.

1.5. The Contractor must provide physical therapy services as directed by the New

Hampshire Hospital's medical staff (Medical Staff), within seven (7) days of the

referral date, for up to 30 days of treatment, as prescribed.

1.6. The Contractor must, at a minimum, submit a physical therapy evaluation report

for each patient referred for treatment no later than within one (1) business day

from the date of the patient's examination. The Contractor must;

1.6.1. Conduct an examination of the patient's medical issue or other health-

related condition that limits the patient's ability to move and perform

functional activities of daily living;

1.6.2. Diagnose the patient's limits in terms of their ability to move and

perform functional activities of daijy living;

1.6.3. Develop a plan using treatment techniques to promote the patient's

ability to move, reduce pain, restore function, and prevent disability;

1.6.4. Develop a plan, as needed for the patient, to prevent loss of mobility

before it occurs by developing fitness and wellness-oriented

programs for a healthier and more active lifestyle; and

1.6.5. Develop a plan that includes measurable goals and intended

outcome(s), treatment technique(s), potential for progress and

prognosis, and the duration and frequency of therapy services.

1.7. The Contractor must provide physical therapy services to each patient

according to the physical therapy plan as approved by the Medical Staff on site

at the New Hampshire Hospital.

1.8. The Contractor must review each patient's health information, including but not

limited to:

1.8.1. Physical therapy referral information. -OS

SS-2025-NHH-01-PHYSI-01 B-2.0 Contractor InitialsM.

Achievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID; BB497329-7353^3A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

1.8.2. Diagnosis and available medical history as entered in the electronic

health record.

1.8.3. Medical orders.

1.8.4. Ongoing progress notes from Medical staff, nursing staff, and

rehabilitation staff.

1.9. The Contractor must document all physical therapy provided to patients and

write progress notes for each therapy session that include the treatment

technique(s) provided, response to treatment, and duration of each session.

The Contractor must ensure each visit note is submitted within 24 hours of the

end of each session.

1.10. The Contractor must submit a physical therapy discharge note, re-evaluation

certification note, or re-evaluation for the Medical Staffs approval at the end of

a patient's treatment referral period to either:

1.10.1. Discharge the patient from physical therapy; or

1.10.2. After 30 days from the beginning of the prior order, request a re-

certification order for treatment to continue or modify therapy services

for an additional 30 days to achieve the anticipated goals and

outcomes. The Contractor must ensure the recertification order is

approved by Medical Staff prior to continuing treatment with the

patient. The Contractor agrees that a recertification order may only

be repeated one (1) time(which equals 60 days of additional

treatment; or

1.10.3. Request a re-evaluation order after 90 days from the initiation of

treatment, which is the initial 30 day order, plus two (2) recertification

periods of 30 days each. The Contractor must ensure re-evaluation

notes include:

1.10.3.1. Measurable goals;

1.10.3.2. Intended outcomes;

1.10.3.3. Treatment techniques;

1.10.3.4. Progress and prognosis; and

1.10.3.5. Recommended number of visits per week.

1.11. The Contractor must develop and implement physical therapy discharge plans

or re-evaluation plans with the patient and Medical Staff. All discharge plans

must be approved by the Medical Staff.

1.12. The Contractor must have knowledge of the state and federal requirements for

providing physical therapy services to patients with Medicaid or Medicare

insurance coverage, including but not limited to:

SS-2025-NHH-01-PHYSI-01 B-2.0 Contractor InitialsM.

Achievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID; 8B497329-7353-43A8-91A1.1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

1.12.1. Evaluation and/or re-evaluation criteria.

1.12.2. Expectations for reasonable progress.

1.12.3. Documentation requirements.

1.12.4. Recertification periods.

1.12.5. Discharge procedures.

1.13. The Contractor must complete the orientation of New Hampshire Hospital's

policies and safety requirements before commencement of services and every

two (2) years thereafter, at the discretion of the Department, which includes,

but is not limited to, training on the following topics:

1.13.1. Boundaries.

1.13.2. Cultural Awareness.

1.13.3. Rehabilitation Orientation.

1.13.4. Cues to Crisis.

1.13.5. Infection Control.

1.13.6. Fire Safety.

1.14. The Contractor must perform other administrative and logistical duties,

including, but not limited to:

1.14.1. Developing a list of needed materials required for individual patient

interventions, which may include braces, and reviewing the list with

the designated NHH rehabilitation Supervisor for approval.

1.14.2. Coordinating with the NHH Rehabilitation Supervisor to purchase

approved items.

1.14.3. Contacting NHH Support Services directly to inquire on materials

stocked in-house that are required for interventions.

1.14.4. Retrieving frequently used items such as functional mobility adaptive

equipment being temporarily loaned to patients from NHH Support

Services.

1.14.5. Responding to emails, telephone messages or other communications

from NHH staff within one (1) business day of receiving the

communications.

1.15. The Contractor must maintain records that include, at a minimum, the patient's

name and medical record number, date, time, duration of therapy, description

of the treatment, and patient's progress.

1.16. The Contractor must document when patients refuse, or are inappropriate for,

evaluation or treatment sessions, when there is a delay in the initiation or

SS-2025-NHH-01.PHYSI-01 B-2.0 Contractor InitialsM

Achievement Therapy Services, LLC Dale 1/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

execution of evaluation or treatment sessions, and when the intended

treatment frequency noted in the plan of care is not achieved.

1.17. The Contractor must participate in meetings with the Department on a weekly

basis, or as otherwise requested by the Department.

1.18. Background Checks

1.18.1. Prior to permitting any individual to provide services under this

Agreement, the Contractor must ensure that said individual has

undergone:

1.18.1.1. A criminal background check, at the Contractor's

expense, and has no convictions for crimes that represent

evidence of behavior that could endanger individuals

served under this Agreement; and

1.18.1.2. A name search of the Department's Bureau of Elderly and

Adult Services (BEAS) State Registry, pursuant to RSA

161-F:49, with results indicating no evidence of behavior

that could endanger individuals served under this

Agreement.

1.19. Department Owned Devices, Systems and Network Usage

1.19.1. If Contractor End Users are authorized by the Department's

Information Security Office to use a Department issued device (e.g.

computer, tablet, mobile telephone) or access the Department

network in the fulfilment of this Agreement, the selected Vendor must:

1.19.1.1. Sign and abide by applicable Department and New

Hampshire Department of Information Technology (NH

DolT) use agreements, policies, standards, procedures

and guidelines, and complete applicable trainings as

required;

1.19.1.2. Use the information that they have permission to access

solely for conducting official Department business and

agree that all other use or access is strictly forbidden

including, but not limited, to personal or other private and

non-Department use, and that at no time must they

access or attempt to access information without having

the express authority of the Department to do so;

1.19.1.3. Not access or attempt to access information in a manner

inconsistent with the approved policies, procedures,

and/or agreement relating to system entry/access;

1.19.1.4. Not copy, share, distribute, sub-license, modify, reverse

engineer, rent, or sell software licensed, develop^^, or

SS-2025-NHH-01-PHYSI-01 B-2.0 Contractor Initials

Achievement Therapy Services. LLC Date 1/3/2024

OocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

being evaluated by the Department, and at all times must

use utmost care to protect and keep such software strictly

confidential in accordance with the license or any other

agreement executed by the Department;

1.19.1.5. Only use equipment, software, or subscription(s)

authorized by the Department's Information Security

Office or designee;

1.19.1.6. Not install non-standard software on any Department

equipment unless authorized by the Department's

Information Security Office or designee;

1.19.1.7. Agree that email and other electronic communication

messages created, sent, and received on a Department-

issued email system are the property of the Department

of New Hampshire and to be used for business purposes

only. Email is defined as "internal email systems" or

"Department-funded email systems."

1.19.1.8. Agree that use of email must follow Department and NH

DolT policies, standards, and/or guidelines; and

1.19.1.9. Agree when utilizing the Department's email system:

1.19.1.9.1.To only use a Department email address

assigned to them with a

affiliate.DHHS.NH.Gov".

1.19.1.9.2. Include in the signature lines information

identifying the End User as a non-Department

workforce member; and

1.19.1.9.3. Ensure the following confidentiality notice is

embedded underneath the signature line:

CONFIDENTIALITY NOTICE: "This message may

contain information that is privileged and confidential

and is intended only for the use of the individual(s)

to whom it is addressed. If you receive this message

in error, please notify the sender immediately and

delete this electronic message and any attachments

from your system. Thank you for your cooperation."

1.19.1.10. Contractor End Users with a Department issued email,

access or potential access to Confidential Data, and/or a

workspace in a Department building/facility, must:

1.19.1.11. Complete the Department's Annual Information Security

& Compliance Awareness Training prior to acce%§ing.

SS-2025-NHH. 01-PHYSI-01

Achievement Therapy Services, LLC

B-2.0

Contractor Initials M.

Date 1/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1.1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

viewing, handling, hearing, or transmitting Department

Data or Confidential Data.

1.19.1.12. Sign the Department's Business Use and Confidentiality

Agreement and Asset Use Agreement, and the NH DolT

Department wide Computer Use Agreement upon

execution of the Contract and annually throughout the

Contract term.

1.19.1.13. Agree End User's will only access the Department'

intranet to view the Department's Policies and

Procedures and Information Security webpages.

1.19.1.14. Agree, if any End User is found to be in violation of any of

the above-Department terms and conditions of the

Contract, said End User may face removal from the

Contract, and/or criminal and/or civil prosecution, if the

act constitutes a violation of law.

1.19.1.15. Agrees to notify the Department a minimum of three

business days prior to any upcoming transfers or

terminations of End Users who possess Department

credentials and/or badges or who have system privileges.

If End Users who possess Department credentials and/or

badges or who have system privileges resign or are

dismissed without advance notice, the Contractor agrees

to notify the Department's Information Security Office or

designee immediately.

1.19.2. Workspace Requirement

1.19.2.1. If applicable, the Department will work with Contractor to

determine requirements for providing necessary

workspace and State equipment for its End Users.

1.20. Website and Social Media

1.20.1. State of New Hampshire's Website Copyright

1.20.1.1. All right, title and interest in the State WWW site, including

copyright to all Data and information, must remain with

the State of New Hampshire. The State of New

Hampshire must also retain all right, title and interest in

any user interfaces and computer instructions embedded

within the WWW pages. All WWW pages and any other

Data or information must, where applicable, display the

State of New Hampshire's copyright.

2. Exhibits Incorporated

SS-2025-NHH-01-PHYSI-01 B-2.0 Contractor InitialsM.

Achievement Therapy Services, LLC Date 1/3/2024

DocuStgn Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

2.1. The Contractor must manage all confidential data related to this Agreement In

accordance with the terms of Exhibit D, DHHS Information Security

Requirements.

2.2. The Contractor must use and disclose Protected Health Information In

compliance with the Standards for Privacy of Individually Identifiable Health

Information (Privacy Rule) (45 CFR Parts 160 and 164) under the Health

Insurance Portability and Accountability Act (HIPAA) of 1996, and in

accordance with the attached Exhibit E, Business Associate Agreement, which

has been executed by the parties.

3. Additional Terms

3.1. Impacts Resulting from Court Orders or Legislative Changes

3.1.1. The Contractor agrees that, to the extent future state or federal

legislation or court orders may have an impact on the Services

described herein, the State has the right to modify Service priorities

and expenditure requirements under this Agreement so as to achieve

compliance therewith.

3.2. Federal Civil Rights Laws Compliance: Culturally and Linguistically Appropriate

Programs and Services

3.2.1. The Contractor must submit, within ten (10) days of the Agreement

Effective Date, a detailed description of the communication access

and language assistance services to be provided to ensure

meaningful access to programs and/or services to Individuals with

limited English proficiency: individuals who are deaf or have hearing

loss; individuals who are blind or have low vision; and individuals who

have speech challenges.

3.3. Credits and Copyright Ownership

3.3.1. All documents, notices, press releases, research reports and other

materials prepared during or resulting from the performance of the

services of the Agreement must include the following statement, "The

preparation of this (report, document etc.) was financed under an

Contract with the State of New Hampshire, Department of Health and

Human Services, with funds provided In part by the State of New

Hampshire and/or such other funding sources as were available or

required, e.g., the United States Department of Health and Human

Services."

3.3.2. All materials produced or purchased under the Agreement must have

prior approval from the Department before printing, production,

distribution or use.

SS-2025-NHH-01-PHYSi-01 B-2.0 Contractor InitialsM.

Achievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

3.3.3. The Department must retain copyright ownership for any and all

original materials produced, including, but not limited to;

3.3.3.1. Brochures.

3.3.3.2. Resource directories.

3.3.3.3. Protocols or guidelines.

3.3.3.4. Posters.

3.3.3.5. Reports.

3.3.4. The Contractor must not reproduce any materials produced under the

Agreement without prior written approval from the Department.

4. Records

4.1. The Contractor must keep records that include, but are not limited to:

4.1.1. Books, records, documents and other electronic or physical data

evidencing and reflecting all costs and other expenses incurred by the

Contractor in the performance of the Contract, and all income

received or collected by the Contractor.

4.1.2. All records must be maintained in accordance with accounting

procedures and practices, which sufficiently and properly reflect all

such costs and expenses, and which are acceptable to the

Department, and to include, without limitation, all ledgers, books,

records, and original evidence of costs such as purchase requisitions

and orders, vouchers, requisitions for materials, inventories,

valuations of in-kind contributions, labor time cards, payrolls, and

other records requested or required by the Department.

4.1.3. Statistical, enrollment, attendance or visit records for each recipient

of services, which records must include all records of application and

eligibility (including all forms required to determine eligibility for each

such recipient), records regarding the provision of services and all

invoices submitted to the Department to obtain payment for such

services.

4.1.4. Medical records on each patient/recipient of services.

4.2. During the term of this Agreement and the period for retention hereunder, the

Department, the United States Department of Health and Human Services, and

any of their designated representatives must have access to all reports and

records maintained pursuant to the Agreement for purposes of audit,

examination, excerpts and transcripts.

4.3. If, upon review of the Final Expenditure Report the Department must fallow

SS-2025-NHH-01-PHYSI-01 B-2.0 Contractor Initials M.

Actiievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID; BB497329.7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT B

any expenses claimed by the Contractor as costs hereunder, the Department

retains the right, at its discretion, to deduct the amount of such expenses as

are disallowed or to recover such sums from the Contractor.

SS-2025-NHH-01-PHYSI-01 B-2.0, Contractor InitialsM.

Achievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID: BB497329-7353-43Ae-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT C

Payment Terms

1. This Agreement is funded by:

1.1. 32% General funds.

1.2. 68% Other funds (Provider Fees).

2. For the purposes of this Agreement the Department has identified:

2.1. The Contractor as a Subreciplent, in accordance with 2 CFR 200.331.

3. Payment shall be at an all-inclusive rate of $83.00 per hour for physical therapy

services, for an estimated average of thirty three (33) hours per week, fifty-two (52)

weeks per year. There will be no minimum number of guaranteed hours per week.

The hours available to work will be dependent on the number of clients Identified by

the Medical Staff and the clients' approved number of treatment hours.

4. The Contractor shall submit an invoice with supporting documentation to the

Department no later than the fifteenth (15th) working day of the month following the

month in which the services were provided. The Contractor shall ensure each

invoice:

4.1. Includes the Contractor's Vendor Number issued upon registering with New

Hampshire Department of Administrative Services.

4.2. Is submitted in a form that is provided by or otherwise acceptable to the

Department.

4.3. Identifies and requests payment for allowable costs incurred in the previous

month.

4.4. Includes supporting documentation of allowable costs with each invoice that

may include, but are not limited to, time sheets, payroll records, receipts for

purchases, and proof of expenditures, as applicable.

4.5. Is completed, dated and returned to the Department with the supporting

documentation for allowable expenses to initiate payment.

4.6. Is assigned an electronic signature, includes supporting documentation, and

is emailed to NHHFinancialServicesfSjdhhs.nh.qov or mailed to:

Financial Manager

Department of Health and Human Services

New Hampshire Hospital

36 Clinton Street

Concord, NH 03301

5. The Department shall make payments to the Contractor within thirty (30) days of

receipt of each invoice and supporting documentation for authorized expenses,

subsequent to approval of the submitted invoice.

SS-2026-NHH-01-PHYSI-01 C-2.0 Contraclor InitialsiSlL

Achievement Therapy Services, LLC Dale 1/3/2024

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Physical Therapy Services

EXHIBIT C

6. The final invoice and supporting documentation for authorized expenses shall be

due to the Department no later than forty (40) days after the contract completion

date specified in Form P-37, General Provisions Block 1.7 Completion Date.

7. Notwithstanding Paragraph 17 of the General Provisions Form P-37, changes

limited to adjusting amounts within the price limitation and adjusting encumbrances

between State Fiscal Years and budget class lines through the Budget Office may

be made by written agreement of both parties, without obtaining approval of the

Governor and Executive Council, if needed and justified.

8. Audits

8.1. The Contractor must email an annual audit to dhhs.act@dhhs.nh.gov if any

of the following conditions exist;

8.1.1. Condition A - The Contractor expended $750,000 or more in federal

funds received as a subrecipient pursuant to 2 CFR Part 200, during

the most recently completed fiscal year.

8.1.2. Condition B - The Contractor is subject to audit pursuant to the

requirements of NH RSA 7:28, lll-b, pertaining to charitable

organizations receiving support of $1,000,000 or more.

8.1.3. Condition C - The Contractor is a public company and required by

Security and Exchange Commission (SEC) regulations to submit an

annual financial audit.

8.2. If Condition A exists, the Contractor shall submit an annual Single Audit

performed by an independent Certified Public Accountant (CPA) to

dhhs.act@dhhs.nh.gov within 120 days after the close of the Contractor's

fiscal year, conducted in accordance with the requirements of 2 CFR Part

200, Subpart F of the Uniform Administrative Requirements, Cost

Principles, and Audit Requirements for Federal awards.

8.2.1. The Contractor shall submit a copy of any Single Audit findings and

any associated corrective action plans. The Contractor shall submit

quarterly progress reports on the status of implementation of the

corrective action plan.

8.3. If Condition B or Condition C exists, the Contractor shall submit an annual

financial audit performed by an independent CPA within 120 days after the

close of the Contractor's fiscal year.

8.4. In addition to, and not in any way in limitation of obligations of the

Agreement, it is understood and agreed by the Contractor that the

Contractor shall be held liable for any state or federal audit exceptions and

shall return to the Department all payments made under the Agreement to

which exception has been taken, or which have been disallowed because

of such an exception.

SS-2025-NHH-01-PHYSI-01 C-2.0 Contractor Initials

Achievement Therapy Services, LLC Date 1/3/2024

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

A. Definitions

The following terms may be reflected and have the described meaning in this document:

1. "Breach" means the loss of control, compromise, unauthorized disclosure,

unauthorized acquisition, unauthorized access, or any similar term referring to

situations where persons other than authorized users and for an other than authorized

purpose have access or potential access to personally identifiable information,

whether physical or electronic. With regard to Protected Health Information," Breach"

shall have the same meaning as the term "Breach" in section 164.402 of Title 45,

Code of Federal Regulations.

2. "Computer Security Incident" shall have the same meaning "Computer Security

Incident" in section two (2) of MIST Publication 800-61, Computer Security Incident

Handling Guide, National Institute of Standards and Technology, U.S. Department of

Commerce.

3. "Confidential Information" or "Confidential Data" means all confidential information

disclosed by one party to the other such as all medical, health, financial, public

assistance benefits and personal information including without limitation, Substance

Abuse Treatment Records, Case Records, Protected Health Information and

Personally Identifiable Information.

Confidential Information also includes any and all information owned or managed by

the State of NH - created, received from or on behalf of the Department of Health and

Human Services (DHHS) or accessed in the course of performing contracted services

- of which collection, disclosure, protection, and disposition is governed by state or

federal law or regulation. This Information includes, but is not limited to Protected

Health Information (PHI), Personal Information (PI), Personal Financial Information

(PFI), Federal Tax Information (FTI), Social Security Numbers (SSN), Payment Card

Industry (PCI), and or other sensitive and confidential information.

4. "End User" means any person or entity (e.g., contractor, contractor's employee,

business associate, subcontractor, other downstream user, etc.) that receives DHHS

data or derivative data in accordance with the terms of this Contract.

5. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and

the regulations promulgated thereunder.

6. "Incident" means an act that potentially violates an explicit or implied security policy,

which includes attempts (either failed or successful) to gain unauthorized access to a

system or its data, unwanted disruption or denial of service, the unauthorized use of

a system for the processing or storage of data; and changes to system hardware,

firmware, or software characteristics without the owner's knowledge, instruction, or

consent. Incidents include the loss of data through theft or device misplacement, loss-DS

Contractor Initials

(S(V

V5. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

or misplacement of hardcopy documents, and misrouting of physical or electronic

mail, all of which may have the potential to put the data at risk of unauthorized access,

use, disclosure, modification or destruction.

7. "Open Wireless Network" means any network or segment of a network that is not

designated by the State of New Hampshire's Department of Information Technology

or delegate as a protected network (designed, tested, and approved, by means of the

State, to transmit) will be considered an open network and not adequately secure for

the transmission of unencrypted PI, PFI, PHI or confidential DHHS data.

8. "Personal Information" (or "PI") means information which can be used to distinguish

or trace an individual's identity, such as their name, social security number, personal

information as defined in New Hampshire RSA 359-C:19, blometric records, etc.,

alone, or when combined with other personal or identifying information which is linked

or linkable to a specific individual, such as date and place of birth, mother's maiden

name, etc.

9. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health

Information at 45 C.F.R. Parts 160 and 164, promulgated under HIPAA by the United

States Department of Health and Human Sen/ices.

10. "Protected Health Information" (or "PHI") has the same meaning as provided in the

definition of "Protected Health Information" in the HIPAA Privacy Rule at 45 C.F.R. §

160.103.

11. "Security Rule" shall mean the Security Standards for the Protection of Electronic

Protected Health Information at 45 C.F.R. Part 164, Subpart C, and amendments

thereto.

12. "Unsecured Protected Health Information" means Protected Health Information that is

not secured by a technology standard that renders Protected Health Information

unusable, unreadable, or indecipherable to unauthorized individuals and is developed

or endorsed by a standards developing organization that is accredited by the

American National Standards Institute.

RESPONSIBILITIES OF DHHS AND THE CONTRACTOR

A. Business Use and Disclosure of Confidential Information.

1. The Contractor must not use, disclose, maintain or transmit Confidential Information

except as reasonably necessary as outlined under this Contract. Further, Contractor,

including but not limited to all its directors, officers, employees and agents, must not

use, disclose, maintain or transmit PHI in any manner that would constitute a violation

of the Privacy and Security Rule.

Contractor Initials

V5. Last update 10/09/18 1/3/2024

Date

DocuSIgn Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

2. The Contractor must not disclose any Confidential Information in response to a request

for disclosure on the basis that it is required by law, in response to a subpoena, etc.,

without first notifying DHHS so that DHHS has an opportunity to consent or object to

the disclosure.

3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additional

restrictions over and above those uses or disclosures or security safeguards of PHI

pursuant to the Privacy and Security Rule, the Contractor must be bound by such

additional restrictions and must not disclose PHI in violation of such additional

restrictions and must abide by any additional security safeguards.

4. The Contractor agrees that DHHS Data or derivative there from disclosed to an End

User must only be used pursuant to the terms of this Contract.

5. The Contractor agrees DHHS Data obtained under this Contract may not be used for

any other purposes that are not indicated in this Contract.

6. The Contractor agrees to grant access to the data to the authorized representatives of

DHHS for the purpose of inspecting to confirm compliance with the terms of this

Contract.

II. METHODS OF SECURE TRANSMISSION OF DATA

1. Application Encryption. If End User is transmitting DHHS data containing Confidential

Data between applications, the Contractor attests the applications have been evaluated

by an expert knowledgeable in cyber security and that said application's encryption

capabilities ensure secure transmission via the internet.

2. Computer Disks and Portable Storage Devices. End User may not use computer disks

or portable storage devices, such as a thumb drive, as a method of transmitting DHHS

data.

3. Encrypted Email. End User may only employ email to transmit Confidential Data if email

is encrypted and being sent to and being received by email addresses of persons

authorized to receive such information.

4. Encrypted Web Site. If End User is employing the Web to transmit Confidential Data, the

secure socket layers (SSL) must be used and the web site must be secure. SSL encrypts

data transmitted via a Web site.

5. File Hosting Services, also known as File Sharing Sites. End User may not use file hosting

services, such as Dropbox or Google Cloud Storage, to transmit Confidential Data.

6. Ground Mail Service. End User may only transmit Confidential Data via certified ground

mail within the continental U.S. and when sent to a named individual.

7. Laptops and PDA. If End User is employing portable devices to transmit Confidential Data

said devices must be encrypted and password-protected.

Contractor Initials

V5. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID: BB497329-7353-43AS-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

8. Open Wireless Networks. End User may not transmit Confidential Data via an open

wireless network. End User must employ a virtual private network (VPN) when remotely

transmitting via an open wireless network.

9. Remote User Communication. If End User is employing remote communication to access

or transmit Confidential Data, a virtual private network (VPN) must be installed on the End

User's mobile device(s) or laptop from which information will be transmitted or accessed.

10. SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. If End

User is employing an SFTP to transmit Confidential Data. End User will structure the

Folder and access- privileges to prevent inappropriate disclosure of information. SFTP

folders and sub-folders used for transmitting Confidential Data will be coded for 24-hour

auto-deletion cycle (i.e. Confidential Data will be deleted every 24 hours).

11. Wireless Devices. If End User is transmitting Confidential Data via wireless devices, all

data must be encrypted to prevent inappropriate disclosure of information.

RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS

The Contractor will only retain the data and any derivative of the data for the duration of this

Contract. After such time, the Contractor will have 30 days to destroy the data and any

derivative in whatever form it may exist, unless, otherwise required by law or permitted under

this Contract. To this end, the parties must:

A. Retention

1. The Contractor agrees it will not store, transfer or process data collected in

connection with the services rendered under this Contract outside of the United

States. This physical location requirement shall also apply in the implementation of

cloud computing, cloud service or cloud storage capabilities, and includes backup

data and Disaster Recovery locations.

2. The Contractor agrees to ensure proper security monitoring capabilities are in place

to detect potential security events that can impact State of NH systems and/or

Department confidential information for contractor provided systems.

3. The Contractor agrees to provide security awareness and education for its End

Users in support of protecting Department confidential information.

4. The Contractor agrees to retain all electronic and hard copies of Confidential Data

in a secure location and identified in section IV. A.2

5. The Contractor agrees Confidential Data stored in a Cloud must be in a

FedRAMP/HITECH compliant solution and comply with all applicable statutes and

regulations regarding the privacy and security. All servers and devices must have

currently-supported and hardened operating systems, the latest anti-viral,

antihacker, anti-spam, anti-spyware, and anti-malware utilities. The environment, as

a whole, must have aggressive intrusion-detection and firewall protection.

-DS

Contractor Initials

(SfV

V5. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID: BB497329.7353^3A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

6. The Contractor agrees to and ensures its complete cooperation with the State's

Chief Information Officer in the detection of any security vulnerability of the hosting

infrastructure.

B. Disposition

1. If the Contractor will maintain any Confidential Information on its systems (or its sub

contractor systems), the Contractor will maintain a documented process for securely

disposing of such data upon request or contract termination; and will obtain written

certification for any State of New Hampshire data destroyed by the Contractor or

any subcontractors as a part of ongoing, emergency, and or disaster recovery

operations. When no longer in use, electronic media containing State of New

Hampshire data shall be rendered unrecoverable via a secure wipe program in

accordance with industry-accepted standards for secure deletion and media

sanitization, or otherwise physically destroying the media (for example, degaussing)

as described in NIST Special Publication 800-88, Rev 1, Guidelines for Media

Sanitization, National Institute of Standards and Technology, U. S. Department of

Commerce. The Contractor will document and certify in writing at time of the data

destruction, and will provide written certification to the Department upon request.

The written certification will include all details necessary to demonstrate data has

been properly destroyed and validated. Where applicable, regulatory and

professional standards for retention requirements will be jointly evaluated by the

State and Contractor prior to destruction.

2. Unless otherwise specified, within thirty (30) days of the termination of this Contract,

Contractor agrees to destroy all hard copies of Confidential Data using a secure

method such as shredding.

3. Unless otherwise specified, within thirty (30) days of the termination of this Contract,

Contractor agrees to completely destroy all electronic Confidential Data by means

of data erasure, also known as secure data wiping.

IV. PROCEDURES FOR SECURITY

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and any

derivative data or files, as follows;

1. The Contractor will maintain proper security controls to protect Department confidential

information collected, processed, managed, and/or stored in the delivery of contracted

services.

2. The Contractor will maintain policies and procedures to protect Department confidential

information throughout the information lifecycle, where applicable, (from creation,

transformation, use, storage and secure destruction) regardless of the media used to

store the data (i.e., tape, disk, paper, etc.).

-DS

Contractor Initials

V5. Last update 10/09/18 1/3/2024

Oaie

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

3. The Contractor will maintain appropriate authentication and access controls to

contractor systems that collect, transmit, or store Department confidential information

where applicable.

4. The Contractor will ensure proper security monitoring capabilities are in place to detect

potential security events that can impact State of NH systems and/or Department

confidential information for contractor provided systems.

5. The Contractor will provide regular security awareness and education for its End Users

in support of protecting Department confidential information.

6. If the Contractor will be sub-contracting any core functions of the engagement

supporting the services for State of New Hampshire, the Contractor will maintain a

program of an internal process or processes that defines specific security expectations,

and monitoring compliance to security requirements that at a minimum match those for

the Contractor, including breach notification requirements.

7. The Contractor will work with the Department to sign and comply with all applicable

State of New Hampshire and Department system access and authorization policies and

procedures, systems access forms, and computer use agreements as part of obtaining

and maintaining access to any Department system(s). Agreements will be completed

and signed by the Contractor and any applicable sub-contractors prior to system access

being authorized.

8. If the Department determines the Contractor is a Business Associate pursuant to 45

CFR 160.103, the Contractor will execute a HIPAA Business Associate Agreement

(BAA) with the Department and is responsible for maintaining compliance with the

agreement.

9. The Contractor will work with the Department at its request to complete a System

Management Survey. The purpose of the survey is to enable the Department and

Contractor to monitor for any changes In risks, threats, and vulnerabilities that may

occur over the life of the Contractor engagement. The survey will be completed

annually, or an alternate time frame at the Departments discretion with agreement by

the Contractor, or the Department may request the survey be completed when the

scope of the engagement between the Department and the Contractor changes.

10. The Contractor will not store, knowingly or unknowingly, any State of New Hampshire

or Department data offshore or outside the boundaries of the United States unless prior

express written consent is obtained from the Information Security Office leadership

member within the Department.

11. Data Security Breach Liability. In the event of any security breach Contractor shall make

efforts to investigate the causes of the breach, promptly take measures to prevent

Contractor Initials

V5. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

future breach and minimize any damage or loss resulting from the breach. The State

shall recover from the Contractor all costs of response and recovery from

the breach, including but not limited to: credit monitoring services, mailing costs and

costs associated with website and telephone call center services necessary due to the

breach.

12. Contractor must, comply with all applicable statutes and regulations regarding the

privacy and security of Confidential Information, and must in all other respects maintain

the privacy and security of PI and PHI at a level and scope that is not less than the level

and scope of requirements applicable to federal agencies, including, but not limited to,

provisions of the Privacy Act of 1974 (5 U.S.C. § 552a), DHHS Privacy Act Regulations

{45 C.F.R. §5b), HIPAA Privacy and Security Rules (45 C.F.R. Parts 160 and 164) that

govern protections for individually identifiable health information and as applicable

under State law.

13. Contractor agrees to establish and maintain appropriate administrative, technical, and

physical safeguards to protect the confidentiality of the Confidential Data and to prevent

unauthorized use or access to it. The safeguards must provide a level and scope of

security that is not less than the level and scope of security requirements established

by the State of New Hampshire, Department of Information Technology. Refer to

Vendor Resources/Procurement at https://www.nh.gov/doit/vendor/index.htm for the

Department of Information Technology policies, guidelines, standards, and

procurement information relating to vendors.

14. Contractor agrees to maintain a documented breach notification and incident response

process. The Contractor will notify the State's Privacy Officer and the State's Security

Officer of any security breach immediately, at the email addresses provided in Section

VI. This Includes a confidential information breach, computer security incident, or

suspected breach which affects or includes any State of New Hampshire systems that

connect to the State of New Hampshire netwoi1<.

15. Contractor must restrict access to the Confidential Data obtained under this Contract

to only those authorized End Users who need such DHHS Data to perform their official

duties In connection with purposes identified in this Contract.

16. The Contractor must ensure that all End Users:

a. comply with such safeguards as referenced in Section IV A. above, implemented

to protect Confidential Information that is furnished by DHHS under this Contract

from loss, theft or inadvertent disclosure.

b. safeguard this information at all times.

c. ensure that laptops and other electronic devices/media containing PHI, PI, or

PFI are encrypted and password-protected.

DS

[iContractor Initials

V

V5. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79e763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

d. send emails containing Confidential Information only if encrypted and being sent

to and being received by email addresses of persons authorized to receive such

information.

e. limit disclosure of the Confidential Information to the extent permitted by law.

f. Confidential Information received under this Contract and Individually identifiable

data derived from DHHS Data, must be stored in an area that is physically and

technologically secure from access by unauthorized persons during duty hours

as well as non-duty hours (e.g., door locks, card keys, biometric identifiers, etc.).

g. only authorized End Users may transmit the Confidential Data, Including any

derivative files containing personally identifiable information, and in all cases,

such data must be encrypted at all times when in transit, at rest, or when stored

on portable media as required in section IV above.

h. In all other instances Confidential Data must be maintained, used and disclosed

using appropriate safeguards, as determined by a risk-based assessment of the

circumstances involved.

i. understand that their user credentials (user name and password) must not be

shared with anyone. End Users will keep their credential Information secure.

This applies to credentials used to access the site directly or indirectly through a

third party application.

Contractor is responsible for oversight and compliance of their End Users. DHHS

reserves the right to conduct onsite inspections to monitor compliance with this Contract,

including the privacy and security requirements provided in herein, HIPAA, and other

applicable laws and Federal regulations until such time the Confidential Data is disposed

of in accordance with this Contract.

V. LOSS REPORTING

The Contractor must notify the State's Privacy Officer and Security Officer of any Security

Incidents and Breaches immediately, at the email addresses provided in Section VI.

The Contractor must further handle and report Incidents and Breaches involving PHI in

accordance with the agency's documented Incident Handling and Breach Notification

procedures and in accordance with 42 C.F.R. §§ 431.300 - 306. In addition to, and

notwithstanding. Contractor's compliance with all applicable obligations and procedures.

Contractor's procedures must also address how the Contractor will;

1. Identify Incidents:

2. Determine if personally identifiable information is involved in Incidents;

3. Report suspected or confirmed Incidents as required in this Exhibit or P-37;

Contractor Initials

vs. Last update 10/09/18 1/3/2024

Date

DocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human Services

Exhibit D

DHHS Information Security Requirements

4. Identify and convene a core response group to determine the risk level of Incidents and

determine risk-based responses to Incidents; and

5. Determine whether Breach notification Is required, and, if so, identify appropriate Breach

notification methods, timing, source, and contents from among different options, and

bear costs associated with the Breach notice as well as any mitigation measures.

Incidents and/or Breaches that implicate PI must be addressed and reported, as applicable,

in accordance with NH RSA 359-6:20.

VI. PERSONS TO CONTACT

A. DHHS Privacy Officer:

DHHSPrivacyOfficer@dhhs.nh.gov B.

DHHS Security Officer:

DHHSInformationSecurltyOffice@dhhs.nh.gov

Contractor Initials

V5. Last update 10/09/18 1/3/2024

DocuSign Envelope ID: BB497329-7353-43A8.91A1.1C79E763C63C

New Hampshire Department of Health and Human

Exhibit E

BUSINESS ASSOCIATE AGREEMENT

The Contractor identified in Section 1.3 of the General Provisions of the Agreement (Form P-37)

("Agreement"), and any of its agents who receive use or have access to protected health

information (PHI), as defined herein, shall be referred to as the "Business Associate." The State

of New Hampshire, Department of Health and Human Services, "Department" shall be referred

to as the "Covered Entity," The Contractor and the Department are collectively referred to as "the

parties."

The parties agree, to comply with the Health Insurance Portability and Accountability Act, Public

Law 104-191, the Standards for Privacy and Security of Individually Identifiable Health

Information, 45 CFR Parts 160, 162, and 164 (HIPAA), provisions of the HITECH Act, Title XIII,

Subtitle D, Parts 1&2 of the American Recovery and Reinvestment Act of 2009, 42 USC 17934,

et sec., applicable to business associates, and as applicable, to be bound by the provisions of

the Confidentiality of Substance Use Disorder Patient Records, 42 USC s. 290 dd-2, 42 CFR Part

2, (Part 2), as any of these laws and regulations may be amended from time to time.

(1) Definitions

a. The following terms shall have the same meaning as defined in HIPAA, the HITECH

Act, and Part 2, as they may be amended from time to time:

"Breach," "Designated Record Set," "Data Aggregation," Designated Record

Set," "Health Care Operations," "HITECH Act," "Individual." "Privacy Rule,"

"Required by law," "Security Rule," and "Secretary."

b. Business Associate Agreement, (BAA) means the Business Associate Agreement

that Includes privacy and confidentiality requirements of the Business Associate

working with PHI and as applicable. Part 2 record(s) on behalf of the Covered Entity

under the Agreement.

c. "Constructively Identifiable," means there is a reasonable basis to believe that the

information could be used, alone or in combination with other reasonably available

information, by an anticipated recipient to identify an individual who is a subject of

the information.

d. "Protected Health Information" ("PHI") as used in the Agreement and the BAA,

means protected health information defined in HIPAA 45 CFR 160.103, limited to

the information created, received, or used by Business Associate from or on behalf

of Covered Entity, and includes any Part 2 records, if applicable, as defined below.

e. "Part 2 record" means any patient "Record," relating to a "Patient," and "Patient

Identifying Information," as defined in 42 CFR Part 2.11.

f. "Unsecured Protected Health Information" means protected health information that

is not secured by a technology standard that renders protected health information

unusable, unreadable, or indecipherable to unauthorized individuals and is

developed or endorsed by a standards developing organization that is accredited

by the American National Standards Institute.

(2) Business Associate Use and Disclosure of Protected Health Information

a. Business Associate shall not use, disclose, maintain, store, or transmit Protected

Health Information (PHI) except as reasonably necessary to provide the services

outlined under the Agreement. Further, Business Associate, including b^eaDt

Exhibit E iStV

Contractor Initials

Business Associate Agreement

1/3/2024

V2.0

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human

Exhibit E

limited to all its directors, officers, employees, and agents, shall protect any PHI as

required by HIPPA and 42 CFR Part 2, and not use, disclose, maintain, store, or

transmit PHI in any manner that would constitute a violation of HIPAA or 42 CFR

Part 2.

b. Business Associate may use or disclose PHI, as applicable;

I. For the proper management and administration of the Business Associate;

II. As required by law, according to the terms set forth in paragraph c. and d. below;

III. According to the HIPAA minimum necessary standard;

IV. For data aggregation purposes for the health care operations of the Covered

Entity; and

V. Data that is de-Identified or aggregated and remains constructively identifiable

may not be used for any purpose outside the performance of the Agreement.

c. To the extent Business Associate is permitted under the BAA or the Agreement to

disclose PHI to any third party or subcontractor prior to making any disclosure, the

Business Associate must obtain, a business associate agreement or other

agreement with the third party or subcontractor, that complies with HIPAA and

ensures that all requirements and restrictions placed on the Business Associate as

part of this BAA with the Covered Entity, are included in those business associate

agreements with the third party or subcontractor.

d. The Business Associate shall not, disclose any PHI in response to a request or

demand for disclosure, such as by a subpoena or court order, on the basis that it

is required by law, without first notifying Covered Entity so that Covered Entity can

determine how to best protect the PHI. If Covered Entity objects to the disclosure,

the Business Associate agrees to refrain from disclosing the PHI and shall.cooperate with the Covered Entity in any effort the Covered Entity undertakes to

contest the request for disclosure, subpoena, or other legal process. If applicable

relating to Part 2 records, the Business Associate shall resist any efforts to access

part 2 records in any judicial proceeding.

(3) Obliaalions and Activities of Business Associate

a. Business Associate shall implement appropriate safeguards to prevent

unauthorized use or disclosure of all PHI in accordance with HIPAA Privacy Rule

and Security Rule with regard to electronic PHI, and Part 2, as applicable.

b. The Business Associate shall immediately notify the Covered Entity's Privacy

Officer at the following email address, DHHSPrivacyOfficer@dhhs.nh.gov after the

Business Associate has determined that any use or disclosure not provided for by

its contract, including any known or suspected privacy or security incident or breach

has occurred potentially exposing or compromising the PHI. This includes

inadvertent or accidental uses or disclosures or breaches of unsecured protected

health information.

c. In the event of a breach, the Business Associate shall comply with the terms of this

Business Associate Agreement, all applicable state and federal laws and

regulations and any additional requirements of the Agreement.

d. The Business Associate shall perform a risk assessment, based on the information

available at the time it becomes aware of any known or suspected privaoyoor

Exhibit E (SH:

Contractor Initials ^— 'Business Associate Agreement

1/3/2024

V2.0

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human

Exhibit E

security breach as described above and communicate the risk assessment to the

Covered Entity. The risk assessment shall include, but not be limited to:

I. The nature and extent of the protected health information involved, including the

types of identifiers and the likelihood of re-identification;

II. The unauthorized person who accessed, used, disclosed, or received the

protected health Information;

III. Whether the protected health information was actually acquired orviewed; and

IV. How the risk of loss of confidentiality to the protected health information

has been mitigated.

e. The Business Associate shall complete a risk assessment report at the conclusion

of its incident or breach investigation and provide the findings in a written report to

the Covered Entity as soon as practicable after the conclusion of the Business

Associate's investigation.

f. Business Associate shall make available all of its internal policies and procedures,

books and records relating to the use and disclosure of PHI received from, or

created or received by the Business Associate on behalf of Covered Entity to the

US Secretary of Health and Human Services for purposes of determining the

Business Associate's and the Covered Entity's compliance with HIPAA and the

Privacy and Security Rule, and Part 2, if applicable.

g. Business Associate shall require all of its business associates that receive, use or

have access to PHI under the BAA to agree in writing to adhere to the same

restrictions and conditions on the use and disclosure of PHI contained herein.

h. Within ten (10) business days of receipt of a written request from Covered Entity,

Business Associate shall make available during normal business hours at its offices

all records, books, agreements, policies and procedures relating to the use and

disclosure of PHI to the Covered Entity, for purposes of enabling Covered Entity to

determine Business Associate's compliance with the terms of the BAA and the

Agreement.

i. Within ten (10) business days of receiving a written request from Covered Entity,

Business Associate shall provide access to PHI in a Designated Record Set to the

Covered Entity, or as directed by Covered Entity, to an individual in order to meet

the requirements under 45 CFR Section 164.524.

j. Within ten (10) business days of receiving a written request from Covered Entity for

an amendment of PHI or a record about an individual contained in a Designated

Record Set, the Business Associate shall make such PHI available to Covered

Entity for amendment and incorporate any such amendment to enable Covered

Entity to fulfill its obligations under 45 CFR Section 164.526.

k. Business Associate shall document any disclosures of PHI and information related

to any disclosures as would be required for Covered Entity to respond to a request

by an individual for an accounting of disclosures of PHI in accordance with 45 CFR

Section 164.528.

I. Within ten (10) business days of receiving a written request from Covered Entity for

a request for an accounting of disclosures of PHI, Business Associate shall make

available to Covered Entity such information as Covered Entity may require to fulfill

PRl°'inits obligations to provide an accounting of disclosures with respect to

Exhibit E

_. - Conlraclor Initials

Business Assoaate Agreement

1/3/2024

V2.0

OocuSign Envelope ID; BB497329-7353-43A8-91A1-1C79E763C63C

New Hampshire Department of Health and Human

Exhibit E

accordance with 45 CFR Section 164.528.

m. In the event any individual requests access to, amendment of, or accounting of PHI

directly from the Business Associate, the Business Associate shall within five (5)

business days fonward such request to Covered Entity. Covered Entity shall have

the responsibility of responding to fonwarded requests. However, if fonwarding the

individual's request to Covered Entity would cause Covered Entity or the Business

Associate to violate HIPAA and the Privacy and Security Rule, the Business

Associate shall instead respond to the individual's request as required by such law

and notify Covered Entity of such response as soon as practicable.

n. Within thirty (30) business days of termination of the Agreement, for any reason,

the Business Associate shall return or destroy, as specified by Covered Entity, all

PHI received from or created or received by the Business Associate in connection

with the Agreement, and shall not retain any copies or back-ups of such PHI in any

form or platform.

VI. If return or destruction is not feasible, or the disposition of the PHI has been

otherwise agreed to in the Agreement, or if retention is governed by state

or federal law, Business Associate shall continue to extend the protections

of the Agreement, to such PHI and limit further uses and disclosures of such

PHI to those purposes that make the return or destruction infeasible for as

long as the Business Associate maintains such PHI. If Covered Entity, in its

sole discretion, requires that the Business Associate destroy any or all PHI,

the Business Associate shall certify to Covered Entity that the PHI has been

destroyed.

(4) Oblioations of Covered Entity

a. Covered Entity shall post a current version of the Notice of the Privacy Practices

on the Covered Entity's website:

https://www.dhhs.nh.gov/oos/hipaa/publications.htm in accordance with 45 CFR

Section 164.520.

b. Covered Entity shall promptly notify Business Associate of any changes in, or

revocation of permission provided to Covered Entity by individuals whose PHI may

be used or disclosed by Business Associate under this BAA, pursuant to 45 CFR

Section 164.506 or 45 CFR Section 164.508.

c. Covered entity shall promptly notify Business Associate of any restrictions on the

use or disclosure of PHI that Covered Entity has agreed to in accordance with 45

CFR 164.522, to the extent that such restriction may affect Business Associate's

use or disclosure of PHI.

(5) Termination of Agreement for Cause

a. In addition to the General Provisions (P-37) of the Agreement, the Covered Entity

may immediately terminate the Agreement upon Covered Entity's knowledge of a

material breach by Business Associate of the Business Associate Agreement. The

Covered Entity may either immediately terminate the Agreement or provide an

opportunity for Business Associate to cure the alleged breach within a timeframe

specified by Covered Entity.

(6) Miscellaneous

a. Definitions, Laws, and Regulatory References. All laws and regulations

Exhibil E

Contractor Initials

US^Ij,

ISH:

Business Associate Agreement

1/3/2024

V2,0

DocuStgn Envelope 10: BB497329-7353-43A8-91A1-107967630630

New Hampshire Department of Health and Human

Exhibit E

herein, shall refer to those laws and regulations as amended from time to time. A

reference in the Agreement, as amended to include this Business Associate

Agreement, to a Section in HIPAA or 42 Part 2, means the Section as in effect or

as amended.

b. Change In law - Covered Entity and Business Associate agree to take such action

as is necessary from time to time for the Covered Entity and/or Business Associate

to comply with the changes In the requirements of HIPAA, 42 CFR Part 2 other

applicable federal and state law.

c. Data Ownership - The Business Associate acknowledges that it has no ownership

rights with respect to the PHI provided by or created on behalf of Covered Entity.

d. Interpretation - The parties agree that any ambiguity in the BAA and the

Agreement shall be resolved to permit Covered Entity and the Business Associate

to comply with HIPAA and 42 CFR Part 2.

e. Segregation - If any term or condition of this BAA or the application thereof to any

person(s) or circumstance is held Invalid, such invalidity shall not affect other terms

or conditions which can be given effect without the invalid term or condition; to this

end the terms and conditions of this BAA are declared severable. •

f. Survival - Provisions in this BAA regarding the use and disclosure of PHI, return

or destruction of PHI, extensions of the protections of the BAA in section (3) g. and

(3) n.l., and the defense and indemnification provisions of the General Provisions

(P-37) of the Agreement, shall survive the termination of the BAA.

IN WITNESS WHEREOF, the parties hereto have duly executed this Business Associate

Agreement.

Department of Health and Human Services ACHIEVEMENT THERAPY SERVICES LLC

The State

y——OocuSianed by;

Name of the Contractor

A DocuSio"*'! by:

Signature of Authorized Representative Signature of Authorized Representative

Ellen Marie Lapointe Iwor^a Szetela-Hecka

Name of Authorized Representative Name of Authorized Representative

chief Executive officer Manager

Title of Authorized Representative Title of Authorized Representative

1/4/2024 1/3/2024

Date Date

Exhibit E

Business Associate Agreement

V2.0

Contractor Initials

Date

1/3/2024

DocuSign Envelope ID: BB497329-7353-43A8-91A1.1C79E763C63C

DocuSlgn Envelope ID: 659FFS'lA-0F69-4464-A612-e84C392E2799

State of New Hampshire

Department of State

CERTIFICATE.

I, David M. Sconlan, Sccrciar)' of Stale of the Stale of New Hampshire, do hereby ccnif)' ihat "ACHIEVEMENT" THERAPY

SERVICES, LLC is a New Hampshire Limited Liability Company registered to transact business in New Hampshire on April 04,

2007.1 further certify that all fees and documents required by the Sccrctao' of Stale's office have been received and is in good

standing as far as this ofTice is concerned.. Business ID: 575S39

Ccrlificate Number: 0006303903

Opf

la.

so ■0

N

IN TESTIMONY WHEREOF,

I hereto SCI my hand and cause to be afTi.xcd

the Seal of the State of New Hampshire,

this 30ih day of August A.D. 2023.

David M. Scanlan

Sccfctar>' of State

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C

CERTIFICATE OF AUTHORITY. hereby certify that:

(Name of the elecled Officer of the Corporation/LLC; cannot be contracl^natory)

1.1 am a duly elected Clerk/Secretary/Offlcer of

(Corporation/LLC Name) • I

2. The followlna Isfi true copy of a vote taken at a meeting of the Board of DIrectore/shareholders, duly called and

held on 20yS. at which a quorum of the Directore/shareholders were present and voting.

* (Date)

VOTED: That iU/igWA Cz.&tELA - ffgoc A _(may list more than one person)(Name and Title of Coetracl Signatory),

Is duty authorized on behalf of^. a enter Into contracts or agreements with the State/'fhJh'eoljfcljrporalibn/LLC)

of New Hampshire and any of Its agencies or departments and further Is authorized to execute any and all

documents, agreements and other Instruments, and any amendments, revisions, or modifications thereto, which

may In his/her Judgment be desirable or necessary to effect the purpose of this vote.

3.1 hereby certify that said vote has not been amended or repealed and remains In full force and effect as of the

date of Ihe contract/contract amendment to which this certificate Is attached, This authority was valid thirty (30)

days prior to and remains valid for thirty (30) days from the date of this Certificate of Authority. 1 further certify

that it is understood that the State of New Hampshire will rely on this certificate as evidence that the person(s)

listed above currently occupy the po8ition(s) Indicated and that they have full authprtiy to bind the corporation. Tothe extent that there are any limits on the authority of any listed individual to bind^h^c^r^^tion In ^jjntracts withthe State of New Hampshire, all such limitations are expressly stated herein.

Dated: __ _ _

Signature ofE

Name:

Title:

n

y 2-^

Rev. 03/24/20

DocuSign Envelope ID: BB497329-7353-43AS-91A1-1C79E763C63C

Q002/002

CERTIFICATE OF LIABILITY INSURANCE |tS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIOHTS UPON THE CERTtFtCATE HOLDER THIS

^ AFFIRMATIVELV OR NEOATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POUCIEGCERTIFICATE OF INSURANCE DOES NOT C0N8TITUTB A CONTRACT BETWEEN THE ISSUING INSURERfS), AUTHORIZEDREPRESENTATIVE OR PRODUCER AND THE CERTIFICATE HOLDER. vnitw#

•• additional INSUREO. the poUey(Ist) must hsvs ADDITIONAL INSURED piovlslons or bs snderaod.If WBMOATIM IS WAn^, subjoot to Ihs towns snd oondWoits of the poUoy, csrtiln poUeisf msy roqutro an sndonsmsnt A atatemsnt on

PRODUCflR

Afrinlty Insumnce Service, Inc.

1100 VIrglnle Drive, Suite 260

Fort Weshlnoton. PA 16034-3278

Customer Ssrvlcs

1.888-288.3534

annam cu8tofner.8srvloeAhpsoooyer.corr)

stsimews) AppoittSM eovouoE NABS

MSURtDA:

wsuneo

Achlaveflisnt Therapy Ssrvlees LLC

63 Port Way

Laeortle, NH 03246

mstmens:

MsuftefiOi

MURBRD;

Msunen e i Ameilcon Casualty Company of Rsadng. PA 20427

IWeUSEftP;

mill

THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NMMED ABOVE FOR THE POLICY PFRIOO

INDICATED. NOTWrTHSTANOlNO ANY REQUIREMENT. TERM OR CONDITrON OF ANY CONTRACT OR OTHEfi^oSu^ TOmIoT tSsinsurance afforded by the POUCIES OESCR&ED^IN « SLBji^^EXCLUSIONS AND CONOmONS OF SUCH POUCIES. UMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.

fsasTm-TTNOFMSMUNCE nrrirvni PouertiUMBge (JHTTS

COmieReiAL OCNSfUl UASUTY

I CUIM»MAOg □ OCCUR

OEWl AOOREOATB UttTr APPUES PER;

HlpOtlCYQS^ I I LOG

IotMPB;Auroiioau LUMJTY

ANY AUTO

OWNED

AUTOS ONLY

HIREO

AUTOS ONLY

SCHEDULED

nIS^VWEDAUTOS ONLY

WOTPnnnnn

I EACH OCCURRENCE

L

woexPiAfnemMfter) Is

PERSONAL 4 ADVMJURV

GENERAL AOOREOATt

PROOUCT9 • COMPtOP AOO

IMOlfUMir

BOOCV mJURY(Pw pmon)

eODLY KIURY (Pw mcMobQ

SKsaar^

UVSReLUUAS

excess UAB

fi SS.

OCCUR

CLAIM8MADE

iRSTOfflONl

WOAKCM CONPeNSATIQN

AND CMPLOVERT UABILnY

ANTPROPRierORiPARTNBVGaECUTIVE

OPFtcDVMeMseRexcLupa)?

(MnM^ la HN)tf MLSvMNbaufidw -

DEsOrPTION op OPgRATtONS hate*

Profsfistonsi Lteblll^

N/A

EACHOCCURRPICa

AOOREOATE

lig^

ei.EACHAeCX>eNT

&LmEASG • EA EMPLOYTE

6L.DI3EAB6.P0LJCVLtMfT is

0622066941 12/23/2023 12/23/2024 UebHlty (Eech dalm) 1.000.000

UobUI^ (Aogragsta) 3,000,000

OeSORTTIOM OP OPERATIONS/LOCATIONS/VEWCteS (ACOR0101, ASdNMN Rnwto SolMtfvN. rwy b« flUMM SaiM tpra to raeMrW)

CERTIFICATE HQLOeR

NHDHHS

f20 FVessenI Strael

Concord, NH, 0$S01

aHOULO ANY OF TUB ABOVE DESCRIBED POUCCe Bfi CANCELLED BEFORE

THE EXPIRATION DATS TTteREOF. NOTICE WUl BE oeUVERED IN

ACCORDANCE WITH THE POUCY PROVtSlONS.

AVTHOSlZeO REPneseNTATIVI

1

ACORO 25 (20ie/OS) The ACORO noms end logo ora regletored rnorks of ACORD

DocuSign Envelope ID: BB497329-7353-43A8-91A1-1C79E763C63C ^002/002

To Whom It May Concern 01/05/24

Achievement Therapy Services LLC has only 2 principal owners and no employees

Sincerely

Jarosiaw Hecka (Principle/Manager)

o