2022-137-E-Health-Duke University - Charlene Wong-Federal awarding agency

Browse Search

28 | Page The regulatory procedures that pertain to suspension and termination are state d in section 35 of the Standard Terms and Conditions (Termination ). 27. Use of Data and Work Products . As described in section 18 of the Standard Terms and Conditions (Use of Data and Work Products), a t any phase of the project or at its conclusion, the Recipient shall submit copies of analytic data file(s) with appropriate documentation, representing the data developed/used in end-product analyses generated under the award, if so requested by the PO . The analytic file(s) may include primary data collected, acquired or generated under the award and/or data furnished by CMS. All data files and any other information and products related to this Cooperative Agree ment shall become the property of CMS after they are submitted to CMS. All proprietary information and technology of the Recipient are and shall remain the sole property of the Rec ipient. 28. Management Review/Audit. The funding authorized by this award is subject to any periodic future financial management review or audit. 29. Management Tool. CMS reserves the right to require Recipients to use a management tool for tracking model milestone information, and/or for submitting the QPRs, APRs, and the Final Report, including but not limited to GrantSolutions . CMS will provide the Recipient with access to this management tool and related instructions. 30. Privacy and Security of Health Information. The Recipient acknowledges that it is a covered entity, as that term is defined in 45 CFR § 160.103, and will execute business associate agreements with any persons or entities that will perform operations under the model that involve the use or disclosure of protected health information (PHI) on behalf of the Recipient. The Recipient shall have all appropriate administrative, technical, and physical safeguards in place before the project period start date to protect the privacy and security of PHI in accordance with 45 CFR § 164.530(c). The Recipient shall maintain the privacy and security of all model-related information that identifies individuals in accordance with the HIPAA Privacy and Security Rules and all relevant guidance applicable to the use and disclosure of PHI by covered entities, as well as applicable state laws and regulations. In addition, the Recipient shall ensure that its subrecipients’ policies and procedures are at least as stringent (i.e., protective of privacy) as those governing the use and disclosure of PHI by the Recipient under 45 CFR P arts 160 and 164. The Recipient and its subrecipients shall consult with their own counsel and refer to the HIPAA guidance materials at http://www.hhs.gov/ocr for further information about the HIPAA requirements in 45 CFR P arts 160 and 164. 31. Section 508 Compliance. The Recipient shall ensure that its systems and materials, and those of its subrecipients, comply with section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794(d)) as amended by the Workforce Investment Act of 1998 (P.L. 105-220) if such systems and materials are to be used by federal agencies . For example, when the Federal Government procures Electronic and Information Technology (EIT), 508(a)(1) requires the EIT to allow federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to federal employees and individuals of the public without disabilities. DocuSign Envelope ID: 7832B0E4-F34E-430E-A3C2-1A6A14F29307