Sacramento City Council
March 10, 2026

City of Sacramento
City Council - 2PM Report
915 I Street Sacramento, CA 95814
www.cityofsacramento.org
File ID: 2026-00534 3/10/2026
[Contract] Designation of the City of Sacramento as a Hybrid Entity under HIPAA and Contract for CalAIM Billing and Administrative Services
File ID: 2026-00534
Location: Citywide
Recommendation: Adopt 1) a Resolution reauthorizing acceptance of Designation of the City of Sacramento as a Hybrid Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and rescinding Resolution No. 2024-0276; and 2) a Resolution a) authorizing the City Manager or designee to execute a contract with Housing for Health California (HHCA) for billing and administrative services for DCR’s participation in the California Advancing and Innovating Medi-Cal (CalAIM) program; b) authorizing the City Manager or designee to execute a related business associate agreement with HHCA as the services include transmitting protected health information; and c) authorizing the City Manager or designee to adjust the revenue and expenditure budgets (Operating Grants, Fund 2702) in the Homeless Housing Initiative (I23001000) multi-year operating project (MYOP) to support homeless-services programs to reflect actual CalAIM reimbursements received.

Contact: Brian Pedro, Director, (916) 808-7816, [email protected]; Tim Swanson, Assistant Director, (916) 808-7923, [email protected]; Department of Community Response
Attachments:
1-Description/Analysis
2-HHCA MOU
3-BAA
4-Resolution - Hybrid Entity
5-Resolution - CalAIM Contracts
Description/Analysis
Issue Detail: The Health Insurance Portability and Accountability Act of 1996 (HIPAA Act), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of healthcare coverage, standardize healthcare transactions and implement requirements surrounding health information privacy and security.

File ID: 2026-00534 3/10/2026
In general, HIPAA addresses Protected Health Information (PHI) that is maintained or transmitted by a covered entity. Covered entities are:
· Health plans,
· Healthcare clearing houses, and
· Healthcare providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations.

The City of Sacramento (“City”) is a covered entity under HIPAA because it conducts certain types of transactions related to health care - primarily the prehospital emergency medical services provided to the public through the Sacramento Fire Department. Nevertheless, most City functions do not involve a connection to those types of transactions. As such, the City performs both covered and non- covered functions. A legal entity that performs both covered and non-covered functions may designate itself a hybrid entity under HIPAA, a designation the City currently holds (Resolution No. 2024-0276).

A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to its non-healthcare components of the organization. The entity must designate, as part of its covered functions, any component (e.g. department) that would meet the definition of a covered entity, if it were a separate legal entity. All covered healthcare components must comply with HIPAA, and the covered entity retains oversight, compliance and enforcement obligations. (See 45 CFR 164.103 and 45 CFR 164.105.)
The Department of Community Response (DCR) is requesting that the City designate it as a covered health care component under HIPAA to enable it to provide services under the California Advancing and Innovating Medi-Cal (CalAIM) program, which involves the management and transmission of PHI. A multi-year initiative from the State of California’s Department of Health Care Services (DHCS), CalAIM is designed to improve the Medi-Cal program with expanded benefits and a broadened delivery system that makes it more accessible and equitable. People experiencing homelessness are one of CalAIM’s populations of focus; heavy users of emergency rooms are another.

CalAIM enables Medi-Cal Managed Care Plans (MCPs) to couple clinical care with a range of non- medical services, which will be reimbursed by Medi-Cal. These non-medical services, known as Community Supports, are designed to help Medi-Cal members meet critical social needs, including housing-related needs.

In January 2025, DHCS opened an application period for its Providing Access and Transforming Health (PATH) initiative to build up the capacity and infrastructure of on-the-ground entities to successfully participate in the Medi-Cal delivery system. In May 2025, DCR applied for PATH

File ID: 2026-00534 3/10/2026
Capacity and Infrastructure Transition, Expansion and Development (CITED) funding to develop and implement a CalAIM program focused on providing Community Supports. In November 2025, DCR was notified that though its application was not approved for the originally applied for PATH CITED funding, DHCS was awarding DCR a related funding opportunity, CITED Intergovernmental Transfer (IGT) funding, in the amount of $336,142, which was accepted by the City (Resolution No. 2026- 0007).

As stated in the PATH CITED application as well as the staff report to accept the CITED IGT funding, DCR does not plan to contract directly with a Managed Care Provider (MCP) to implement its CalAIM Community Supports program. Instead, DCR plans to utilize a “hub organization,” which is contracted with local MCPs, for billing and administrative services. Because DCR is a small department with limited FTEs, using a hub-model approach for the CalAIM administrative functions will allow staff to intensely focus their efforts on building and quickly expanding service provision. To that end, DCR recommends the City Council approve a one-year contract with hub organization Housing for Health California (HHCA).

HHCA’s responsibilities will include CalAIM billing and claim services, as well as training and compliance for staff with MCP guidelines and policies under Community Support provisions. In addition to the proposed agreement, DCR will also enter into a Business Associate Agreement with HHCA to ensure that the organization will appropriately safeguard PHI that is created, maintained, or transmitted on behalf of the City in compliance with applicable provisions of HIPAA and the HITECH Act.

As part of the CalAIM reimbursement for Community Support provision, HHCA will be entitled to 10% of the reimbursable amount, with the remainder going to DCR. With the City facing continued budget constraints, the CalAIM Community Support Program will help DCR create a self-sustaining funding source while continuing to support the City’s unhoused community.

DCR’s Community Supports program will standardize and enhance access to several CalAIM services, including Housing Transition Navigation Services, Housing Deposits, Housing Tenancy and Sustaining Services, Day Habilitation Programs and Transitional Rent. Dedicated DCR staff will oversee the provision of these services across the City’s shelter locations as well as within its street outreach program.

Policy Considerations: Pursuant to Sacramento City Code Section 3.04.020, any agreement involving an expenditure of $250,000 or more requires City Council approval.

Economic Impacts: Not applicable.

Environmental Considerations: This report concerns administrative activities and government fiscal activities that do not constitute a “project” and are not subject to the provisions of California

File ID: 2026-00534 3/10/2026
Environmental Quality Act (CEQA) (CEQA Section 15378(b)(2)). Additionally, pursuant to CEQA Guidelines section 15061(b)(3), these activities are exempt from the California Environmental Quality Act (CEQA) because they do not have the potential for causing a significant effect on the environment.

Sustainability: Not applicable.

Commission/Committee Action: Not applicable.

Rationale for Recommendation: Designating the Department of Community Response as a covered health care component under HIPAA and entering into a contract with hub-organization HHCA will allow DCR to provide reimbursable CalAIM services to people experiencing homelessness and generate additional funds for the department to support ongoing operational needs.

Financial Considerations: The upfront cost of $2,500 for legal services, onboarding, and training; and the optional fees for use of HHCA’s Electronic Health Record System (including a flat fee of $5,000 and monthly fee of $63.33 per user) will be funded from DCR’s FY2025/26 Approved Operating Budget. The 10% fee of the City’s CalAIM reimbursables, excluding housing deposits, will be retained by HHCA from the City’s CalAIM reimbursements that HHCA receives on behalf of the City.

Sufficient funding is available (Measure U Fund, Fund 2401) in DCR’s FY2025/26 Approved Operating Budget, and from anticipated CalAIM reimbursables, to execute the contract with Housing for Health California, with DCR’s total reimbursable amount not to exceed $999,999. As a matter of process, HHCA will first receive the entire reimbursable amount from the MCPs before remitting 90% of that amount to DCR.

Local Business Enterprise (LBE): Not applicable.

Background: Covered Entity: A health plan, a healthcare clearing house, or a health provider who transmits any health information in electronic form in connection with a covered transaction. (45 CFR 160.103.)
Covered Function: Those functions of a covered entity of which the performance makes the entity a health plan, healthcare provider, or healthcare clearinghouse. (45 CFR 164.103.) Hybrid Entity: A single legal entity that is a covered entity whose business activities include both covered and non-covered functions, and that designates its healthcare components, i.e., any that would meet the definition of a covered entity or business associate if it were a separate legal entity. (45 CFR 164.103, 45 CFR 164.105 (a)(2)(iii)(D).)

File ID: 2026-00534 3/10/2026
Healthcare Component: A component, or combination of components, of a hybrid entity. (45 CFR 164.103.)
Business Associate: A person or entity that creates, receives, maintains or transmits protected health information to perform certain functions or activities on behalf of a covered entity, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity, and the provision of the service involves the disclosure of protected health information. (45.160.103.)

CONTRACT #: PRC004053 PROJECT: I23001000 CONTRACT NAME: CalAIM HHCA MOU NOT-TO-EXCEED AMOUNT: $999,999AGREEMENT TERM: SOLICITATION: N/A AUTHORIZED RENEWALS: LBE (Y/N): NDEPARTMENT/DIVISION: None DCR/Office of the Director COUNCIL FILE ID: 2026-00534

CALIFORNIA ADVANCING AND INNOVATING MEDI-CAL (CalAIM) MEMORANDUM OF UNDERSTANDING dated March 10, 2026, for purposes of identification is entered into by and between the City of Sacramento ), a municipal corporation, and Housing for Health Orange County, DBA ), a Delaware non- BACKGROUND A. In January 2022, the California Department of Health Care Services launchedCalifornia Advancing and Innovating Medi-Cal (CalAIM). CalAIM enables Medi-CalManaged Care Plans (MCPs) to couple clinical care with a range of new non-medicalservices, which will be reimbursed by Medi-Cal.B. To better identify and address the social drivers of health affecting Medi-Cal membersand to improve member outcomes, DHCS has implemented a range of CalAIM initiatives,including Community SupportsCommunity Supports are services typically provided by Medi-Cal MCPs to address socialdrivers of health. Community Supports include services such as Housing TransitionNavigation Services, Housing Deposits, Housing Tenancy and Sustaining Services, and DayHabilitation.Enhanced Care Management is a statewide Medi-Cal benefit available tomembers with complex needs. Enrolled members receive comprehensive caremanagement from a single lead care manager who coordinates all their health andhealth-related care, including physical, mental, and dental care, and social services.C. HHCA has separately entered into ancillary services contracts with local Medi-Cal MCPsfor the provision of Community Supports and ECM program initiatives. The MCP Agreements are attached hereto and incorporated herein as Exhibit A.D. The City and will provideCommunity Supports and ECM to individuals and engaging in the outreach services offered by the City.E. HHCA will offer the City the administrative infrastructure to submit requests forreimbursement and to receive reimbursement from the MCPs referenced in Section C

F. above for the provision of Community Supports and ECM to Medi-Cal beneficiaries).G. Pursuant to the MCP Agreements, HHCA will manage several aspects of the coordinatedapproach the CalAIM regulatory guidelines require, including but not limited to: 1)management of client referrals and authorizations for service(s); 2) training andmaintaining regulatory compliance with the MCP guidelines and policies under theCommunity Supports and Enhanced Care Management Program; 3) adhering to timelyand appropriate responses for grievances and audits by the MCP; 3) coordination ofassistance with the MCP on all communications, policies, and regulatory guidelines; 4)billing, claims, and dispute resolution; and 5) California Department of Health CareServices policy updates and regulatory guidance.H. The Parties enter into this MOU to clarify and outline the responsibilities of each Party inthe administration of the MCP Agreements. The Parties will perform their responsibilitiesin compliance with the MCP Agreements, and any applicable federal, state, and local lawsand regulations.Based on the foregoing background, the Parties agree as follows: 1. Term. This MOU takes effect on March 10, 2026 and will terminateeffective March 09, 2027. If the CalAIM program is terminated at any point, this MOU shallautomatically and immediately terminate early.2. Performance of Tasks. Each Party shall perform the respective tasks listed in Exhibit Battached hereto and incorporated herein.3. Confidentiality of Protected Information and Data Sharing. The Parties shall ensure that theminimum necessary Member information and data for accomplishing the goals of this MOUare exchanged timely and maintained securely and confidentially and in compliance with therequirements set forth below. The Parties must share information in compliance withapplicable law, which includes the Health Insurance Portability and Accountability Act and itsother State and Federal privacy laws.This MOU shall only be effective upon the execution of a written Business AssociateAgreement between the Parties to safeguard protected health information.4. Compensation. HHCA shall be entitled to retain ten percent (10%) of the City,excluding Housing Deposits. Within 30 days of the execution of this MOU, the City shall alsodisburse to HHCA a total sum not-to-exceed $2,500.00 for legal services, onboarding, andtraining. EHR System, HHCA shallbe paid for use of its EHR as set forth in Exhibit C.

Any changes related to compensation shall only be effective upon the execution of a written amendment to this MOU. 5. Compliance with Non-Discrimination and Equal Employment Opportunity Laws. It is theIn performing the tasks identified in Exhibit B, the Parties shall not unlawfully discriminate,harass or allow harassment on the basis of race, color, sex, creed, religious creed, nationalorigin, age, marital status, ancestry, medical condition, disability (including HIV and AIDS),sexual orientation, gender identity, or any other protected characteristic.The Parties shall comply with, and will require that all employees, subrecipients, contractors and subcontractors comply with, the following non-discrimination and equal opportunity laws. Any failure to comply with these provisions shall constitute a material breach of this MOU, which may result in the termination of this MOU or such other remedy as the Parties may deem appropriate. a) The Parties and their Subcontractors, if any, will send to each labor union orrepresentative of workers with which they have a collective bargaining agreement orother contract or understanding a notice, to be provided by the Federal Government orthe State, advising the labor union or workers representative of and theirSubcontractors commitments under the provisions herein and shall post copies of thenotice in conspicuous places available to employees and applicants for employment.b) The Parties and their Subcontractors, if any, will comply with all provisions of and furnishall information and reports required by Section 503 of the Rehabilitation Act of 1973, asamended, the Vietnam Era Veterans' Readjustment Assistance Act of 1974 (38 U.S.C.4212) and applicable United States Department of Labor regulations.c) The Parties and their Subcontractors, if any, will furnish all information and reportsrequired by Federal law, and will permit access to their books, records, and accounts bythe State and their designated representatives and the Secretary of Labor for purposes ofinvestigation to ascertain compliance with such rules, regulations, and orders.d) The Parties shall observe and comply with all Federal and State laws and regulations, andrequirements established in Federal and/or State programs. The Parties understand andagree that payments made by the MCPs are, in whole or in part, derived from Federalfunds, and therefore the Parties are subject to certain laws that are applicable toindividuals and entities receiving Federal funds.e) The Parties agree to comply with all applicable Federal laws, regulations, reportingrequirements including Title VI of the Civil Rights Act of 1964, Section 504 of theRehabilitation Act of 1973, the Age Discrimination Act of 1975, the Americans withDisabilities Act, and to require any Subcontractor to comply accordingly.

f) The Parties and Subcontractors shall comply with the provisions of the Fair Employment and Housing Act (Government Code, Section 12900 et seq.) and the applicable regulations promulgated thereunder, (Title 2, CCR, Section 7285.0 et seq.). The applicable regulations of the Fair Employment and Housing Commission implementing Government Code, Section 12990, set forth in Chapter 5 of Division 4 of Title 2 of the CCR are incorporated into this MOU by reference and made a part hereof as if set forth in full. g) Neither the Parties nor their Subcontractors, if any, shall discriminate against Members because of race, color, national origin, creed, ancestry, religion, language, age, marital status, sex, sexual orientation, gender identity, heath status, physical or mental disability, or identification with any other persons or groups defined in California Penal Code 422.56, in accordance with Title VI of the Civil Rights Act of 1964, 42 USC Section 2000d (race, color, national origin); Section 504 of the Rehabilitation Act of 1973 (29 USC § 794) (nondiscrimination under Federal grants and programs); Title 45 CFR Part 84 (nondiscrimination on the basis of handicap in programs or activities receiving Federal financial assistance); Title 28 CFR Part 36 (nondiscrimination on the basis of disability by public accommodations and in commercial facilities); Title IX of the Education Amendments of 1973 (regarding education programs and activities); Title 45 CFR Part 91 and the Age Discrimination Act of 1975 (nondiscrimination based on age); as well as Government Code Section 11135 (ethnic group identification, religion, age, sex, color, physical or mental handicap); Civil Code Section 51 (all types of arbitrary discrimination); Section 1557 of the Patient Protection and Affordable Care Act; and all rules and regulations promulgated pursuant thereto, and all other laws regarding privacy and confidentiality. 6. Insurance Requirements. During the entire term of this MOU, HHCA shall maintain the insurance coverage described in the Insurance Terms below. Full compensation for all premiums that HHCA is required to pay for the insurance coverage described herein shall be included in the compensation specified under this MOU. No additional compensation will be provided for insurance premiums. Any available insurance proceeds in excess of the specified minimum limits and coverages shall be available to the City. If HHCA maintains broader coverage and/or higher limits than the minimums shown below, the City requires and shall be entitled to the broader coverage and/or the higher limits maintained by HHCA. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to the City. a) General Liability Minimum Scope and Limits of Insurance Coverage. Commercial General Liability Insurance is required providing coverage at least as broad as ISO CGL Form 00 01 on an occurrence basis for bodily injury, including death, of one or more persons, property damage, and personal injury, arising out of activities performed by or on behalf of the

HHCA and subcontractors, products and completed operations of HHCA and subcontractors, and premises owned, leased, or used by HHCA and subcontractors, with limits of not less than one million dollars ($1,000,000) per occurrence. The policy shall provide contractual liability and products and completed operations coverage for the term of the policy. If a general aggregate limit applies, either the general aggregate limit shall apply separately (ISO CG 25 03 or 25 04) or the general aggregate limit shall be twice the required occurrence limit. The City, its officials, employees and volunteers shall be covered by policy terms or endorsement as additional insureds as respects general liability arising out of: activities performed by or on behalf of HHCA and subcontractors; products and completed operations of HHCA and subcontractors; and premises owned, leased, or used by HHCA and subcontractors. b)Automobile Liability Minimum Scope and Limits of Insurance Coverage.___ Automobile Liability Insurance is required providing coverage at least as broad as ISO Form CA 00 01 for bodily injury, including death, of one or more persons, property damage and personal injury, with limits of not less than one million dollars ($1,000,000) per occurrence. The policy shall provide coverage for owned, non-owned and/or hired autos as appropriate to the operations of HHCA. The City, its officials, employees and volunteers shall be covered by policy terms or endorsement as additional insureds as respects auto liability. _X_ No automobile liability insurance is required, and by signing this MOU, HHCA certifies as follows: HHCA certifies that a motor vehicle will not be used in the performance of any work or services under this agreement. If, however, HHCA does transport items under this MOU, or this MOU is amended to require any employees of HHCA to use a vehicle to perform services under the MOU, HHCA understands that it must maintain and provide evidence of Automobile Liability Insurance providing coverage at least as broad as ISO Form CA 00 01 for bodily injury, including death, of one or more persons, property damage and personal injury, with limits of not less than one million dollars ($1,000,000) per occurrence. The policy shall provide coverage for owned, non-owned and/or hired autos as appropriate to the operations of HHCA c)Excess Insurance. HHCA may use Umbrella or Excess Policies to meet the required liabilitylimits. This form of insurance will be acceptable provided that any umbrella or excesspolicies provide all of the insurance coverages required and meet the other requirementsfor the primary policies as set forth in this Agreement. Umbrella and/or Excess policiesleast as broad as provided in the underlying primary policy.

Umbrella or excess policies shall contain, or be endorsed to provide that the City, its officials, employees, and volunteers shall be covered as additional insureds, as well as a provision that it will apply on a primary basis for the benefit of the City. Any insurance or self-insurance maintained by City, its officials, employees, or volunteers will be in excess of umbrella or excess coverage and will not contribute to it. No insurance or self-insurance maintained by the City that applies to a loss covered herein, whether Primary or Excess, and which also applies to a loss covered hereunder, shall be called upon to contribute to a loss until Primary and Excess liability policies are exhausted. d) . (Check the applicable provision.) _X_ Liability Insurance with limits of not less than one million dollars ($1,000,000). The Workers' Compensation policy shall include a waiver of subrogation in favor of the City. ___ No work or services will be performed on or at CITY facilities or CITY Property, required. ___ MOU, HHCA certifies as follows: HHCA certifies that its business has no employees, and that it does not employ anyone, and is therefore exempt from the legal requirements to provide Workers' Compensation insurance. If, however, HHCA hires any employee during the term of this MOU, HHCA Insurance with a limit of not less than one million dollars ($1,000,000) is required. The he City e) Professional Liability Minimum Scope and Limits of Insurance Coverage. Professional Liability Insurance for errors and omissions, or malpractice with limits of not less than one million dollars ($1,000,000): _X__ Is ___ Is not [check one] required for this Agreement. i. If Professional Liability insurance is provided on a claims made basis: 1. The Retroactive Date must be shown and must be before the date of the MOU or the beginning of work performed pursuant to this MOU. 2. Insurance must be maintained and evidence of insurance must be provided for at least three (3) years after completion of the MOU.

3. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the MOU effective date,HHCA (3) years after completion of work performed pursuant to this MOU.f)Other Insurance Provisions. The policies must contain, or be endorsed to contain, thefollowing provisions:i. HHCA's insurance coverage, including excess insurance, shall be primary and non-contributory insurance as respects the City, its officials, employees and volunteers.Any insurance or self-insurance maintained by the City, its officials, employees orvolunteers will be in excess of HHCA's insurance and will not contribute with it.ii. Any failure to comply with reporting provisions of the policies will not affect coverageprovided to the City, its officials, employees or volunteers.iii. Coverage shall state that HHCA's insurance applies separately to each insured againstwhom claim is made or suit is brought, except with respect to the limits of the insurer'sliability.iv. HHCA shall provide the City with 30 days written notice of cancellation or materialchange in the policy language or terms.g) Waiver of Subrogation. HHCA hereby grants to City a waiver of any right to subrogationwhich any insurer may acquire against the City by virtue of the payment of any loss undersuch insurance. HHCA agrees to obtain any endorsement that may be necessary to affectthis waiver of subrogation, but this provision applies regardless of whether or not the Cityhas received a waiver of subrogation endorsement from an insurer.h)Acceptability of Insurance. Insurance must be placed with insurers with a Bests' rating ofnot less than A:VI. Self-insured retentions, policy terms or other variations that do notcomply with the requirements of this Exhibit C must be declared to and approved by theCity in writing before execution of this MOU.i)Verification of Coverage.i. HHCA shall furnish City with certificates and required endorsements evidencing theinsurance required. Certificates of insurance must be signed by an authorizedrepresentative of the insurance carrier. Copies of policies shall be delivered to the CityRepresentative on demand.ii. HHCA shall send all insurance certificates and endorsements, including policyrenewals, during the term of this MOU directly to:

City of Sacramento c/o Exigis LLC PO Box 947 Murrieta, CA 92564 iii. Certificate Holder must be listed as:City of Sacramentoc/o Exigis LLCPO Box 947Murrieta, CA 92564iv. The City may cancel this MOU if the certificates of insurance and endorsementsrequired have not been provided before execution of this MOU. The City maywithhold payments to HHCA and/or cancel the MOU if the insurance is canceledor HHCA otherwise ceases to be insured as required herein.j)Subcontractor Insurance Coverage. HHCA shall require and verify that all subcontractorsmaintain insurance coverage that meets the minimum scope and limits of insurancecoverage specified in this MOU.7. Representatives. Any notice, request, report, or demand under this Agreement must be inwriting and will be considered properly given and effective only when mailed or delivered inthe manner provided by this section 7 to the persons identified below or their successors. Amailed notice, application, request, report, or demand will be effective or will be consideredto have been given on the third calendar day after it is deposited in the United States Mail(certified mail and return receipt requested), addressed as set forth below, with postageprepaid. A notice, application, request, report, or demand sent in any other manner will beeffective or will be considered properly given when actually delivered. Any party may changeits address for these purposes by giving written notice of the change to the other party in themanner provided in this section.If to the City: City of Sacramento Department of Community Response 1000 I Street, Suite 180 Sacramento, California 95814 Attention: Brian Pedro, Director Phone: 916-808-7816/Email: [email protected] If to HHCA:

Housing for Health Orange County, DBA Housing for Health California 17701 Cowan STE 200 Irvine, CA 92614 Attention: Heather Dion, Chief Administrative Officer Phone: 949-401-9591 Email: [email protected] 8. Indemnity.a)Indemnity: HHCA shall defend, hold harmless, and indemnify City, its officers, andemployees, and each and every one of them, from and against all actions, damages, costs,liabilities, claims, demands, losses, judgments, penalties, and expenses of every type anddescription, whether arising on or off the site of the work or services performed underthis MOUoutside attorneys and any fees and expenses incurred in enforcing this provision(hereafor death, damage to personal, real, or intellectual property, damage to the environment,contractual or other economic damages, or regulatory penalties, arising out of or in anyway connected with performance of or failure to perform this MOU by HHCA, anysubcontractor (including lower-tier subcontractors) or agent of HHCA, their respectiveofficers and employees, and anyone else for whose acts of omissions any of them may beliable, whether or not the Liabilities (i) are caused in part by a party indemnifiedhereunder, or (ii) are litigated, settled, or reduced to judgment; provided that theforegoing indemnity does not apply to liability for damages for death or bodily injury topersons, injury to property, or other loss, damage, or expense, to the extent arising fromthe active negligence or willful misconduct of, or defects in design furnished by, City, itsagents, servants, or independent contractors who are directly responsible to City, exceptwhen such agents, servants, or independent contractors are under the supervision andcontrol of HHCA or any subcontractor (including lower-tier subcontractors) or agent ofHHCA.b)Insurance Policies; Intellectual Property Claims: The existence or acceptance by City ofany of the insurance policies or coverages described in this MOU will not affect or limitof HHCA hereunder. This Section will not apply to any intellectual property claims, actions,lawsuits or other proceedings subject to the provisions of HHCA Information Section,above.c)Survival. The provisions of this section will survive any expiration or termination of thisMOU.9. Termination.

a)Termination for Cause. Either Party may terminate this MOU if the other Party breachesany of its obligations under this MOU and such breach is not cured within thirty (30) daysafter receipt of written notice of the breach.b)Termination for Convenience. Either Party may terminate this MOU with a minimum ofwritten notice. Upon receipt of the written notice to terminate the MOU, theParties shall collaborate to create a comprehensive plan of care coordination for anyclients actively being serviced under the MCP Agreements to ensure continuity of care.10. Books and Records. The Parties shall maintain Member case files as well as all accountingand financial records for all services related to this MOU for a minimum of seven (7) yearsfrom the onset of services, in accordance with generally accepted accounting practices. Casefiles shall be available to both Parties during the duration of this period of time for audit,review, and performance measurement upon reasonable written notice.The City will be responsible for tracking and reporting client data and outcomes using a mutually agreed-upon system and will complete any required reports and data requests. HHCA is the lead and fiscal agent for services and shall provide a standardized format for client files, to meet the requirements of the MCP Agreements attached hereto as Exhibit A and to maximize opportunities to track Member outcomes. HHCA shall maintain records of its costs for performance under this MOU and records of all reimbursable expenses. HHCA shall keep and make records available for inspection and audit by representatives of the City upon reasonable written notice. 11. Monitoring and Audit Requirements. HHCA has the right to audit the City at least onceannually. HHCA will monitor the activities for progress and compliance with MCPrequirements. Upon completion of a monitoring visit, HHCA will provide a letter to the Cityaddressing any concerns or recommended corrective action items. The City will provide aletter of response within thirty (30) days of receipt that addresses any concerns,recommendations and/or action items. HHCA may also schedule follow-up meetings with theCity to ensure that all concerns, recommendations, and/or action items have beensufficiently addressed. At discretion, HHCA may conduct periodic compliance auditsto ascertain compliance with this MOU and the MCP Agreements.HHCA may also review annual audit and/or other monitoring reports to ensure continued good standing and fiscal controls. HHCA will be audited financially by the MCPs, and in response, HHCA may also perform an annual performance audit of the City. This audit will include review of general MOU compliance, accounting and business practices, staffing and training, program accessibility, document standards, supportive services, participant feedback, reporting, grievances, and the staying informed and connected and fostering collaboration.

12. Miscellaneous.a)Successors and Assigns. This MOU shall be binding on the heirs, executors, administrators,successors and assigns of the Partiesb)Interpretation. This MOU is to be interpreted and applied in accordance withCalifornia law.c)Waiver of Breach. A partys failure to insist on strict performance of this MOU or toexercise any right or remedy upon the other party's breach of this MOU will notconstitute a waiver of the performance, right, or remedy. A party's waiver of theother party's breach of any term or provision in this MOU is not a continuing waiveror a waiver of any subsequent breach of the same or any other term or provision. Awaiver is binding only if set forth in writing and signed by the waiving party.d)Severability. If a court with jurisdiction rules that any nonmaterial part of this MOUis invalid, unenforceable, or contrary to law or public policy, then the rest of thisMOU remains valid and fully enforceable.e)Counterparts. This MOU may be executed in counterparts, each of which will bedeemed an original and all of which together will constitute one and the sameinstrument. A facsimile or pdf signature shall be deemed an original signature.f)Compliance with all Laws, Requirements, and Orders. The Parties shall comply with allapplicable laws, regulations, orders of public officials, and requirements in connectionwith this MOU.g)Authority to Sign. The individuals signing this MOU for the Parties represent that they areauthorized to do so and that no further action beyond their signature is required to bindthe Parties to this MOU. City shall have no obligations whatsoever under this MOU, unlessand until this MOU is executed by the City Manager or the City Manager's authorizeddesignee.h)Integration and Modification. This MOU sets forth the parties' entire understandingregarding the matters set forth above and is intended to be their final, complete, andexclusive expression of those matters. It supersedes all prior or contemporaneousagreements, representations, and negotiationswritten, oral, express, or impliedandmay be modified only by another written Agreement signed by both parties.

MCMCP ECM/CS Prv Agreement 2021 v1.

ANTHEM BLUE CROSS MEDI-CAL MANAGED CARE PROGRAM ECM / CS PROVIDER AGREEMENT WITH Housing for Health OC DBA Housing for Health MCMCP ECM/CS Prv Agreement 2021 v1.8
ANTHEM BLUE CROSS MEDI-CAL MANAGED CARE PROGRAM ECM / CS ANCILLARY PROVIDER AGREEMENT TABLE OF CONTENTS I. Definitions 1 II. Services/Obligations 3 III. Confidentiality/Records 12 IV. Insurance 13 V. Relationship of the Parties 14 VI. Indemnification and Limitation of Liability 14 VII. Dispute Resolution and Arbitration 15 VIII. Term and Termination 16 IX. General Provisions 19 EXHIBITS A Provider Reimbursement A-1B Covered Services B-1C Provider County Service Area C-1D Copies of Licenses and Certificates D-1E Scope of Work E-1F Disclosure of Ownership and Control Interest Statement F-1 1 MCMCP ECM/CS Prv Agreement 2021 v1.

This Enhanced Care Management (ECM) / Community Supports (CS) Provider Agreement (hereinafter "Agreement") is made and entered into by and between the Medicaid Division of Blue Cross of California doing business as Anthem Blue Cross and its affiliates (hereinafter "Anthem") and _______________________________________________________________(hereinafter "Provider"). In consideration of the mutual promises and covenants herein contained, the sufficiency of which is acknowledged by the parties, the parties agree as follows: ARTICLE I DEFINITIONS 1.1 "Affiliate" means an entity owned or controlled either directly or through a parent or subsidiary entity by Anthem, or under common control with Anthem. 1.2 "Anthem Rate" means the lesser of Provider's Charges for Covered Services, or the total payment amount that Provider and Anthem have agreed upon as set forth in Exhibit A and made a part of this Agreement. The Anthem Rate is payment-in-full to Provider for Covered Services when Anthem is financially responsible to pay Provider for those Covered Services. 1.3 “Anthem Medi-Cal Managed Care Plan” is the healthcare service plan maintained and operated by Anthem pursuant to state contracts with the California Department of Health Care Services. Enrollees of an Anthem Medi-Cal Managed Care Plan are Medi-Cal beneficiaries. 1.4 "Charges" means the amount that Provider routinely bills and accepts as payment for products, services and supplies. 1.5 "Claim" means either the uniform bill claim form, electronic claim form in the format prescribed by Anthem or an invoice in a format prescribed by Anthem and submitted by Provider for payment by Anthem for Health Services provided to a Covered Individual. 1.6 "Clean Claim” means a claim that can be processed without obtaining additional information from Provider or from a third party. A Clean Claim does not include a claim being reviewed for Medical Necessity, or include a claim where the claim or Provider is under investigation for fraud, waste or abuse. [42 CFR 447.45(b)] 1.7 "Cost Share" means, with respect to Covered Services, the amount that a Covered Individual is required to pay under the terms of his or her Health Benefit Plan. Such payment may be referred to as a copayment, deductible, or other Covered Individual payment responsibility, and may either be a fixed amount or a percentage of the applicable payment owed for the Covered Services. 1.8 "Covered Individual" means for Medi-Cal beneficiaries, an “Eligible Beneficiary” as defined in the contract between Anthem and a state/federal Medicaid Program, who is enrolled in an Anthem Medi-Cal Managed Care Plan or Affiliate at the time Covered Services are provided. For purposes related to this Agreement, including all schedules, attachments, exhibits, manual(s), notices and communications related to this Agreement, the term "Covered Individual" may be used interchangeably with the terms Medi-Cal, Medicaid, Covered Person, Member, Enrollee, or Subscriber, and the meaning of each is synonymous with any such other. 1.9 "Covered Services" means Medically Necessary Health Services provided by Provider to a Covered Individual as determined exclusively by Anthem in accordance with guidelines, standards, policies or regulations promulgated by the California Department of Healthcare Services or Anthem. To be a Covered Service, the services must be provided by Provider on a date when the person was both eligible with, and enrolled in, an Anthem Medi-Cal Managed Care Plan or Affiliate.

Housing for Health OC, DBA Housing for Health
2 MCMCP ECM/CS Prv Agreement 2021 v1.8

1.10 “Delegated Entity” or “Delegated Provider” means a risk bearing organization as defined in Health and Safety Code section 1375.4, that when applicable, is financially responsible for Covered Services provided by Provider and the entity to whom Provider shall seek payment from for those delegated Covered Services. 1.11 "Emergency Medical Condition" means a medical condition manifesting itself by acute symptoms of sufficient severity (including, severe pain) that a prudent layperson, who possesses an average knowledge of health and medicine, could reasonably expect the absence of immediate medical attention to result in the following: (1) placing the health of the individual (or, with respect to a pregnant woman, the health of the woman or her unborn child) in serious jeopardy; (2) serious impairment to bodily functions; or (3) serious dysfunction of any bodily organ or part. [see, 42 CFR 438.114] 1.12 "Health Benefit Plan" means either the document(s) describing the benefits and services covered under a Medi-Cal Managed Care Plan administered by Anthem pursuant to a contract with the California Department of Health Care Services whereby Anthem has agreed to provide managed care services to Medi-Cal beneficiaries enrolled in the Anthem Medi-Cal Managed Care Plan. Items, services or supplies not described in a Health Benefit Plan are not Covered Services. 1.13 "Health Services" means those services or supplies that Provider is licensed or certified, equipped and staffed to provide and are routinely provided to Provider’s individual patients. 1.14 "Medically Necessary" or "Medical Necessity" means, except as otherwise defined by the applicable Health Benefit Plan, procedures, supplies, equipment or services that are determined to be: (a) appropriate for the symptoms, diagnosis or treatment of the medical condition; (b) provided for the diagnosis or direct care and treatment of the medical condition; (c) within standards of good medical practice within the organized medical community; (d) not primarily for the convenience of the Covered Individual's physician or another provider, and (e) the most appropriate procedures, supplies, equipment or service which can safely be provided. The most appropriate procedures, supplies, equipment or service or supply must satisfy all of the following criteria: (i) there must be valid scientific evidence demonstrating that the expected health benefits from the procedure, supply, equipment or service are clinically significant and produce a greater likelihood of benefit, without a disproportionately greater risk of harm or complications, for the Covered Individual with the particular medical condition being treated than other alternatives; (ii) generally accepted forms of treatment that are less invasive have been tried and found to be ineffective or are otherwise unsuitable; and (iii) for inpatient facility admissions, the inpatient stay is necessary due to the kind of services the Covered Individual is receiving or the severity of the medical condition, and safe and adequate care cannot be received by the Covered Individual as an outpatient or in a less intensified medical setting. 1.15 "Network Participating Provider" means a provider, including physician, hospital, and ancillary healthcare provider, who has entered into a contract with Anthem to provide Health Services to Covered Individuals and participate in one or more of Anthem’s provider networks. 1.16 “Overpayment” means any funds that Provider receives or retains for providing services or supplies to Covered Individuals to which the Provider, after applicable reconciliation, is not entitled to keep. 1.17 “Provider Operations Manual” means the Anthem Medi-Cal Provider Operations Manual. The Provider Operations Manual is incorporated herein by this reference and applies to all Anthem Medi-Cal Managed Care Plans. 1.18 "Surcharge" means a fee which is charged to a Covered Individual by Provider for Health Service(s) but has not been approved by the applicable state regulatory authority, and is neither disclosed nor provided for in the Covered Individual's Health Benefit Plan. 3 MCMCP ECM/CS Prv Agreement 2021 v1.8

1.19 Enhanced Care Management (ECM): a whole-person, interdisciplinary approach to care that addresses the clinical and non-clinical needs of high-need and/or high-cost Members through systematic coordination of services and comprehensive care management that is community-based, interdisciplinary, high-touch, and person-centered as referenced in Exhibit B. 1.20 Community Supports (CS): Pursuant to 42 CFR 438.3(e)(2), CS are services or settings that are offered in place of services or settings covered under the California Medicaid State Plan and are medically appropriate, cost-effective alternatives to services or settings under the State Plan as referenced in Exhibit B. ARTICLE II SERVICES/OBLIGATIONS 2.1 Covered Individual Identification. Anthem shall provide a means of identifying a Covered Individual by issuing a paper, plastic, or other identification document to the Covered Individual, or by a telephonic, paper or electronic communication to the Provider. The identification will provide sufficient information so that Provider may contact Anthem to determine a Covered Individual's participation in a Health Benefit Plan. The identification alone will be insufficient to establish a Covered Individual's eligibility at the time a Health Service is provided. As such, Provider acknowledges and agrees that possession of such identification document or ability to access eligibility information telephonically or electronically, in and of itself does not qualify the holder thereof as a Covered Individual, nor does the lack thereof mean that the person is not a Covered Individual. 2.1.1 Provider agrees that it will confirm that the person presenting the identification document is in fact the Covered Individual. Provider agrees that Anthem shall not be responsible for any fraudulent, deceptive or misuse of a Covered Individual’s identification document. 2.1.2 Anthem will provide verification of a Covered Individual's eligibility when Provider requests such verification. Provider acknowledges and agrees that any eligibility information provided by Anthem will not be deemed, interpreted, or considered as approval or authorization of the Medical Necessity of any Health Services provided, nor that any services provided are Covered Services. 2.2 Provider Services. Provider agrees to provide Covered Individuals with those Health Services and/or supplies set forth in Exhibit B, attached hereto and incorporated by reference herein, within the county location(s) listed in Exhibit C. 2.2.1 Provider agrees to adhere to the ECM / CS Scope of Work (SOW) as reference in Exhibit E attached hereto and incorporated by reference herein. 2.3 Provider Non-discrimination. 2.3.1 Provider agrees that its primary consideration shall be the quality of health care services rendered to Covered Individuals. As such, Provider agrees that it will provide Health Services to Covered Individuals in a manner similar to and within the same time availability in which Provider provides Health Services to any other individual. Provider will not differentiate, or use any policy or practice that has the effect of discriminating against any Covered Individual because of race, color, creed, national origin, ancestry, religion, sex, marital status, age, disability, payment source, health status or need for health care services, the filing of any compliant or grievance, status as a litigant, status as a Medicaid beneficiary, sexual orientation, or any other basis prohibited by law. Provider shall not be required to provide any type, or kind of Health Service to Covered Individuals that the Provider does not customarily provide to others. 4 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.3.2 As required by Anthem’s Medi-Cal contracts with the State of California, Provider, its agents and employees, shall not unlawfully discriminate, harass, or allow harassment against any employee or applicant for employment because of sex, sexual orientation, race, color, ancestry, religious creed, national origin, physical disability (including HIV and AIDS), mental disability, medical condition (including health impairments related to or associated with a diagnosis of cancer for which a person has been rehabilitated or cured), age (over 40), marital status, and use of family and medical care leave pursuant to state or federal law. Provider shall insure that the evaluation and treatment of its employees and applicants for employment are free from such discrimination and harassment. Provider, its agents and employees, shall ensure that the evaluation and treatment of its employees and applicants for employment are free from such discrimination and harassment. Provider, its agents and employees, shall comply with the provisions of the Fair Employment and Housing Act (Government Code Section 12990 (a-f) et seq.) and the applicable regulations promulgated there under (Title 2, California Code of Regulations, Section 11099 et seq.). The applicable regulations of the Fair Employment and Housing Commission implementing Government Code Section 12990 (a-f), set forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations, are incorporated into this Agreement by reference and made a part hereof as if set forth in full. 2.4 Standard of Care. Provider shall provide Health Services to Covered Individuals at a level of care and competence that equals or exceeds the generally accepted and professionally recognized standard of practice at the time of treatment, all applicable rules and/or standards of professional conduct, and any controlling governmental licensing requirements. Should a Covered Individual suffer any complication or preventable adverse event as a direct result of the treatment and care provided by Provider, Provider agrees that Anthem does not have to pay Provider for the Medically Necessary treatment or care required to treat the complication or preventable adverse event that resulted from Provider’s negligence. 2.5 Cost Effective Care. Provider shall provide Covered Services in the most cost effective setting and manner. 2.6 Publication and Use of Provider Information. For the term of this Agreement, Provider agrees that Anthem may use, publish, disclose, and display information and disclaimers, as applicable, relating to Provider. Anthem will make good faith efforts to share data with Provider prior to initial disclosure or publication of any information related to a procedure or service for its transparency initiative(s) impacting Provider, such as but not limited to, Anthem Care Comparison. 2.6.1 To the extent permitted by the requirements of the Knox-Keene Act, including Health and Safety Code Section 1395.5, for the term of this Agreement, Provider agrees to provide, and authorize Anthem to publish, its name, tax identification number or other provider identification number, and other information reasonably required by an employer, individual or government entity in Anthem marketing and informational materials. Anthem agrees that Provider may identify itself as a Network Participating Provider in the Network(s) in which Provider participates without prior approval from Anthem, provided Provider strictly follows the publishing guidelines for use of Anthem's name, symbols, trademarks, or service marks, as set forth in the provider manual(s), and that such participation in the Network is then in effect. Provider's ability to identify its participation as a Network Participating Provider without Anthem's consent excludes the issuance of any press release. Anthem shall have the right of prior approval of any other use of Anthem's symbols, trademarks, or service marks presently existing or later established. Except as provided in this section, each party reserves the right to control the use of its name and all symbols, trademarks, or service marks presently existing or later established. With the exception of limited downloading and copying rights which may be expressly posted by Anthem on its web sites, and which may be amended in Anthem's sole discretion, no rights are granted to Provider to reproduce, store, transmit or modify the content of such web sites in any 5 MCMCP ECM/CS Prv Agreement 2021 v1.8
manner, to link to the home page, to deeplink to any content, or frame any portion of the web sites without Anthem's written permission. 2.7 Use of Symbols and Marks. Neither party to this Agreement shall publish, copy, reproduce, or use in any way the other party's symbols, service mark(s) or trademark(s) without the prior written consent of such other party. Notwithstanding the foregoing, the parties agree that they may each identify Provider as an Anthem Medi-Cal Managed Care Plan Network Participating Provider. 2.8 Submission of Provider Claims. 2.8.1 Provider shall submit all Claims for Covered Services within three hundred sixty-five (365) days from the date Covered Services are rendered to a Covered Individual using the national standard specifications and code sets as referenced in Exhibit A. In the event Provider is unable to submit claims using the national standard (UB04 or CMS 1500) specifications and DHCS-defined code sets, Provider shall submit an invoice to Anthem with a minimum set of data elements necessary for Anthem to convert the invoice to an encounter for submission to DHCS. If Anthem is the secondary payor, the three hundred sixty-five (365) day period will not begin until Provider receives notification of the primary payor's financial responsibility. 2.8.2 Provider agrees to bill Anthem at least monthly for any Covered Individual receiving extended Health Services from Provider. An extended Health Service is any on-going treatment in excess of 30 days. 2.8.3 Depending on the specific services provided to Covered Individuals under this ancillary provider agreement, Provider shall submit Claims on the applicable Universal Billing Form 04 (UB-04) promulgated by the National Uniform Billing Committee ("NUBC") or the CMS 1500 claim form, or any successor forms promulgated by either the NUBC or CMS. Claims shall be submitted in a format that is consistent with industry standards and acceptable to Anthem. Claims will be submitted electronically, or if electronic submission is not available, utilizing paper forms. Additionally, Provider Claims shall meet all billing requirements set forth in Anthem’s Provider Operations Manual. This manual provides additional guidance regarding Claim submission, including clarification on billing procedures for special circumstances such as when Anthem is the secondary payor. Provider agrees to comply with the billing procedures included in Anthem’s Provider Operations Manual. 2.8.4 Preventable Adverse Events ("PAEs"). When applicable, Provider shall include accurate and current CMS present-on-admission ("POA") indicators on all inpatient Claims submitted to Anthem for payment. Anthem will use such POA indicators and other applicable and CMS codes and conventions to identify PAEs and adjust inpatient payments to Provider under this Agreement consistent with instructions provided by CMS, and CMS’s practices and DRG groupers (hereinafter collectively, "CMS PAE Policies"). 2.8.5 Provider agrees that Anthem may obtain and review all Provider information, medical records, or documents regarding any Claim. When requested by Anthem, Provider shall furnish records, documents or other information necessary to verify the Health Services provided, the Charges for such Health Services, or to determine Anthem’s financial liability for the Health Services listed on a Claim or invoice. When Anthem requests the additional information, medical records or documents, Provider shall provide the requested material and information within ninety (90) days, or before the expiration of the three hundred sixty-five (365) day period referenced above, whichever is longer. All materials and information will be provided to Anthem at no cost to Anthem or the Covered Individual. Once Anthem determines its payment liability, all Clean Claims will be adjudicated in accordance with the terms and conditions of a Covered Individual's Health Benefit Plan. 2.9 Timely Payment of Clean Claims. 6 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.9.1 Anthem will adjudicate Clean Claims submitted by Provider within thirty (30) working days of the date Anthem receives the claim. For purposes of determining compliance with the stated time frames, the date of receipt is the date that Anthem receives the claim, as indicated by its date stamp on the claim. The date of payment is the date of the check or other form of payment. 2.9.2 Payment shall be made in accordance with above stated timeframe unless the Claim, or portion thereof, is contested. If all or part of a Claim is contested, Anthem will notify Provider in writing within thirty (30) working days of receipt of the Claim. Anthem may contest a Claim where Anthem has not received all information necessary to determine its liability for the Claim, or has not been granted reasonable access to information or material concerning Provider services. Information that may be necessary to determine Anthem’s liability includes reports or investigations concerning fraud, waste and abuse, necessary consents, releases, and assignments, a claim on appeal, relevant medical records, or other information necessary to determine Medical Necessity for the health care services provided. 2.9.3 The times frames set forth above shall in no way prevent or limit Anthem’s right to recover any partial or complete payments made to Provider for Covered Services when Anthem determines that it has for any reason overpaid a Claim. 2.10 Payment in Full and Hold Harmless. 2.10.1 Provider agrees that the Anthem Rates set forth in Exhibit A and made a part of this Agreement shall apply to Health Services provided to Covered Individuals when Anthem is financially responsible for payment of the Covered Services. 2.10.2 Provider agrees that it will only seek payment for Covered Services from Anthem, or when applicable, from a Delegated Entity that has agreed to be financially responsible for the payment of the Covered Services provided by Provider. When Anthem has delegated financial responsibility for services provided by Provider to a Delegated Entity, Provider shall look only to the Delegated Entity for payment of those services. 2.10.3 Provider agrees that in no event, including nonpayment or insolvency by Anthem or a Delegated Entity, will Provider or any person acting on Provider’s behalf, bill, charge, seek payment from, or have any recourse against a Covered Individual, or a person acting on the Covered Individual's behalf, for Covered Services provided pursuant to this Agreement. Provider agrees that it will not hold, or attempt to hold, a Covered Individual liable for the payment of Covered Services should Anthem, its Delegated Provider, or the State of California not pay Provider for Covered Services. Provider agrees not to balance bill a Covered Individual. If Anthem receives notice of any such conduct, it will take appropriate action. This section does not prohibit Provider from collecting payment from the Covered Individual for: 2.10.3.1 Applicable Cost Shares; 2.10.3.2 Health Services that are not Covered Services. However, Provider may seek payment for a Health Service that is not Medically Necessary or is experimental/investigational only if Provider obtains a written waiver that meets the following criteria: (a) The waiver notifies the Covered Individual that the Health Service is likely to be deemed not Medically Necessary, or experimental/investigational; 7 MCMCP ECM/CS Prv Agreement 2021 v1.8
(b) The waiver notifies the Covered Individual of the Health Service being provided and the date(s) of service; (c) The waiver notifies the Covered Individual of the approximate cost of the Health Service; and (d) The waiver is signed by the Covered Individual prior to receipt of the Health Service. 2.10.3.3 Any reduction in or denial of payment as a result of the Covered Individual's failure to comply with his/her utilization management program. 2.11 Provider Requirements for Services Provided to CCS Eligible Individuals. 2.11.1 Provider agrees that for Covered Individuals whose health condition is eligible for California Children’s Services (“CCS”), Provider will submit a referral for CCS coverage within the time limits specified by CCS and Anthem. Provider agrees to provide Anthem with the names of all Covered Individuals whose condition may make the Covered Individual eligible to receive CCS covered services. Provider will not seek payment from Anthem, and Anthem will not pay Provider, for Health Services denied by CCS because the referral was not timely submitted by Provider to CCS. 2.11.2 If Provider is certified by CCS to provide CCS covered services to eligible Covered Individuals, Provider agrees that such services shall be provided by, or provided by order of, a CCS paneled provider. Provider will not seek payment from Anthem, and Anthem will not pay Provider, for Health Services denied by CCS because the care or treatment was not provided by a paneled provider. 2.11.3 If Provider is not certified by CCS to provide CCS covered services to eligible Covered Individuals, Provider shall transfer the care and treatment of a CCS eligible Covered Individual to the nearest CCS certified Provider within the time limits set by CCS or Anthem. When possible, the transfer shall be to a CCS paneled Network Participating Provider. Provider will not seek payment from Anthem, and Anthem will not pay Provider, for CCS covered Health Services provided to the Covered Individual if Provider fails to transfer a Covered Individual to a CCS certified Provider. 2.11.4 Provider agrees that under no situation or circumstances will Provider bill, or seek payment from, Covered Individuals for CCS covered services that were not paid. 2.12 Appeals/Adjustment Requests. If Provider believes a Claim for Covered Services has been improperly adjudicated or paid by Anthem, Provider shall submit a provider dispute request appealing Anthem’s adjudication or payment of the Claim within one (1) year from the date of payment or explanation of payment. The provider dispute request shall be submitted in accordance with Anthem’s payment appeal or adjustment process contained in Anthem’s Provider Operations Manual. Provider acknowledges and agrees that a provider dispute request submitted more than one year after payment or explanation of payment, will be denied and no additional compensation will be paid to Provider on the Claim, and Provider will not be permitted to bill Anthem, or the Covered Individual for those services for which payment was denied. 2.13 Returning or Adjusting Overpayments. 2.13.1 Provider agrees to report and return all Overpayments it has received for services provided under this Agreement. Such Overpayments shall be reported and returned within 60 days after the date on which the Overpayment was first identified. [See, 42 U.S.C. 1320a-7k(d)]. 8 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.13.2 Anthem may recover any Overpayment made to Provider where Anthem determined that all or part of any payment was an Overpayment under this Agreement. Where Anthem determines an Overpayment occurred, Anthem will notify Provider of the Overpayment and request a refund from Provider, in accordance with applicable laws and regulations. If Provider does not contest Anthem’s notice of the Overpayment, Anthem will deduct from and set off against, the Overpayment amount from any amounts due and payable from Anthem to Provider for Covered Services provided at any time under this Agreement, in accordance with applicable laws and regulations. The Provider Operations Manual states the procedures concerning Overpayment recoveries. 2.13.3 Notwithstanding any other provision of this Agreement, a lien held by Provider under California Civil Code 3045.1, et seq. (or any similar law) shall not increase the maximum payment amount that Provider receives for providing Covered Services. Provider may only claim and collect under any such lien an amount which, when added to all amounts Provider has received from all other sources for such Covered Services, will not exceed the maximum compensation payable under this Agreement. Anthem may, under third party liability, third party recovery, or similar provisions of benefit agreements, service agreements, certificates or other documents setting forth terms and conditions of health coverage, become entitled to refunds of benefit amounts paid by Anthem. Anthem’s right to such a refund will not, in any case, alter the maximum compensation Provider is entitled to receive under this Agreement for Covered Services. 2.14 Coordination of Benefits/Subrogation. Provider agrees to cooperate with Anthem regarding subrogation and coordination of benefits as set forth in the Provider Operations Manual. Provider shall make reasonable inquiry of Covered Individuals to learn whether the Covered Individual has health insurance or health benefit coverage other than from Anthem, or is entitled to payment by a third party under any other insurance or plan of any type. Provider shall promptly notify Anthem after receipt of information regarding a Covered Individual who may have a claim involving subrogation or coordination of benefits. Provider acknowledges and agrees that the process for coordination of benefits to individuals whose coverage is based on their eligibility in a government healthcare program shall be as follows: 2.14.1 In all cases where Health Services are provided to a Covered Individual enrolled in an Anthem Medi-Cal Managed Care Plan, Anthem shall be the payor of last resort. As such, whenever benefits are to be coordinated with some other payor for Health Services provided to a Medi-Cal Managed Care Plan enrollee, Anthem shall be the secondary payor for all treatment and care provided to the Covered Individual. 2.14.2 In all cases where Health Services are provided to a Covered Individual who is enrolled in both the Medicare and Medi-Cal programs and Medicare is primary, Anthem’s payment as the secondary payor shall be limited to the Medicare beneficiary’s co-pay, deductible or co-insurance amount. 2.15 Fraud, Waste and Abuse. 2.15.1 Provider shall report to Anthem’s compliance officer any incident of suspected fraud, waste or abuse, as defined in title 42 Code of Federal Regulation section 455.2. Where Provider has a reason to believe that an incident of fraud, waste or abuse has occurred by Provider, or by Provider’s employee, agent, subcontractor, or other individual. Provider shall report that belief to Anthem within ten (10) working days of first suspecting any incident of fraud, waste or abuse. 2.15.2 Provider shall establish policies and procedures for identifying, investigating, and taking appropriate corrective action against suspected incidents of fraud, waste or abuse arising from the delivery of Health Services provided to any patient covered under an Anthem 9 MCMCP ECM/CS Prv Agreement 2021 v1.8
Medi-Cal Managed Care Plan. Upon the request of Anthem, or any state or federal agency, Provider shall discuss with the state or federal agency appropriate actions prior to and during the course of any investigation into fraud, waste or abuse. 2.15.3 This contract shall immediately terminate for cause if at any time during the lifetime of this agreement Provider is excluded from participating in a Federal health care program under 42 U.S.C. sections 1320a-7 or 1320a-7a. 2.16 Provider Subcontractors. Anthem agrees that Provider may fulfill its contractual duties and obligations under this Agreement through subcontractors or delegates (Subcontractors and delegates are collectively referred to as "subcontractors"), subject to the conditions stated below: 2.16.1 Provider shall provide Anthem with a minimum of thirty (30) days prior written notice before entering into any subcontractor agreement for Health Services when the Health Services being sub-contracted away from Provider are Health Services currently provided by Provider and are Provider’s obligation under this Agreement. 2.16.2 Provider acknowledges and agrees that it shall be solely responsible for paying subcontractor(s) for all Health Services provided by its subcontractor(s), and to indemnify and hold harmless Anthem, Covered Individuals and the Department of Health Care Services for any mistake, failure, or breach of this Agreement committed by subcontractor(s). 2.16.3 Provider agrees that it will require all subcontractors to abide by the terms and conditions of this Agreement when providing Health Services to Covered Individuals. 2.16.4 Provider agrees that it will require as a condition of any subcontract for Health Services, that the subcontractor make available for inspection and duplication the subcontract and the subcontractor’s books and records regarding Health Services provided to Covered Individuals. The subcontract agreement shall allow inspection and duplication by the Department of Managed Health Care, the Department of Health Care Services, MRMIB, the Center for Medicare and Medicaid Services, the Department of Justice, or Anthem consistent with the requirements of section 3.3 of this Agreement. 2.17 Compliance with Provider Operations Manual and Policies, Programs and Procedures. Provider acknowledges that the Provider Operations Manual is an integral part of the obligations contemplated by this agreement. As such, Provider agrees to abide by, and comply with, the Provider Operations Manual, and other policies, programs and procedures established and implemented by Anthem (collectively "Policies"). Anthem may modify the Provider Operations Manual and Policies by providing notice to Provider at least ninety (90) calendar days in advance of the effective date of material modifications thereto. 2.18 In Network Referrals and Transfers. Provider shall, when medically appropriate, refer and transfer Covered Individuals to Network Participating Providers. Provider acknowledges that as a condition to coverage and payment for services provided to a Covered Individual, the services must be authorized by Anthem, or by the Network Participating Provider responsible for the Covered Individual's care. Provider agrees to obtain telephone authorization from the Network Participating Provider for any unscheduled Health Services. If prior authorization cannot be obtained, Provider agrees to notify the Network Participating Provider no later than the next working day. 2.19 Programs and Provider Panels. Provider acknowledges that Anthem may have, develop, or contract to develop, various networks or programs that have a variety of provider panels, program components and other requirements. Provider agrees that Anthem may discontinue, or modify such networks or programs without notifying Provider or obtaining Provider’s acquiescence to the discontinuance or modification of such networks or programs. 10 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.20 Provider's Inability to Carry Out Duties. Provider shall promptly send written notice, in accordance with the Notice section of this Agreement, to Anthem of: 2.20.1 Any change in Provider's business address; 2.20.2 Any legal, governmental, or other action involving Provider which could materially impair the ability of Provider to carry out its duties and obligations under this Agreement, except for temporary emergency diversion situations; or 2.20.3 Any change in accreditation, Provider affiliation, insurance, licensure, certification or eligibility status, or other relevant information regarding Provider's practice or status in the medical community. 2.21 Provider Accreditation. Provider agrees that all times while the parties are contracted pursuant to this Agreement, it will maintain in good standing all licenses required by law, as well as its certification to participate in the Medicare and Medicaid programs. If applicable, Provider further agrees that it shall meet or exceed the standards required by the Joint Commission on the Accreditation of Healthcare Organizations (JCAHO), the Healthcare Facilities Accreditation Program (HFAP), or Medicare Program certification. Copies of such licenses, certifications and standards are attached as referenced in Exhibit D and made a part of this Agreement. Provider agrees to provide copies of all such, licenses, certifications and standards to Anthem each year that they are issued, and upon Anthem’s written request. 2.22 Marketing and Promotion. Provider agrees to make reasonable efforts to assist Anthem in its marketing of Health Benefit Plans. To the extent permitted by 42 C.F.R. section 438.104 and the Knox-Keene Act, including Health and Safety Code Section 1395.5, Provider shall ensure that it maintains Anthem signs and health promotion, membership, and marketing materials as reasonably requested by Anthem, consistent with the signage visibility and marketing support granted to third party payers other than Anthem. 2.23 Language Assistance Program. Anthem maintains a language assistance program that ensures limited English proficient ("LEP") Covered Individuals have access to language assistance when accessing health care services. When language assistance is needed by a Covered Individual, Provider agrees to coordinate, cooperate and comply with Anthem's language assistance program as set forth in Anthem's Provider Operations Manual. Provider shall comply with language assistance standards developed pursuant to Health & Safety Code §1367.04. 2.24 Utilization Management. Provider acknowledges that Anthem has an established utilization management program that will determine whether Health Services provided to Covered Individuals are Medically Necessary. Provider agrees that Anthem is responsible for the authorization of Covered Services provided to Covered Individuals and agrees to cooperate with Anthem’s utilization management process. 2.24.1 Provider shall request a pre-service authorization at least three (3) working days prior to any scheduled medical service or supply so as to avoid retrospective denial of payment for such services or supplies. 2.24.2 Provider further agrees to participate, when applicable, in the concurrent utilization management process and promptly notify Anthem in instances where it is anticipated that a Covered Individual’s care and treatment exceeds the care and treatment already authorized as Medically Necessary. 2.24.3 Provider agrees to be bound by Anthem’s utilization management determinations subject to the dispute resolution process contained in section 7.1.1. 11 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.25 Notice of Provider Ownership. As required by the Department of Health Care Services’ contract with Anthem, Provider agrees to provide the following information to Anthem and permit Anthem to disclose the information to the Department of Health Care Services. 2.25.1 The names of all officers and owners of Provider. 2.25.2 The names of all stockholders owning more than ten percent (10%) of the stock issued by Provider. 2.25.3 The names of all creditors holding more than five percent (5%) of the debt of Provider. The information required by this section is included in Exhibit F and made a part of this Agreement. Provider agrees to provide Anthem with written notice of any changes to the information listed in subsections 2.25.1 through 2.25.3 within days of the effective date of the change. 2.26 Federal, State and Contract Requirements. As a Medi-Cal managed care organization, Anthem is subject to Federal requirements mandated by the Social Security Act, state requirements contained in the Knox-Keene Act and the Welfare and Institutions Code, and obligations contained in its state contract with Department of Health Care Services. Any contractual provision required to be in this Agreement under any of the cited laws or contract shall bind Anthem and Provider, whether or not the contractual provision is expressly provided in this Agreement. Provider certifies that neither it nor its principals nor any of its subcontractors are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participating in any of such programs by any Federal agency or by any department, agency or political subdivision of the State. For purposes of this paragraph, “principal” means an officer, director, owner, partner, key employee, or other person with primary management or supervisory responsibilities, or a person who has a critical influence or substantive control over Provider’s operations. Provider shall be required to submit a Disclosure of Ownership and Control Interest Statement form included in Exhibit F during the initial contracting, recontracting and/or recredentialing process or upon request by Anthem. The Provider further agrees to notify Anthem within thirty-five (35) days of any changes to the required disclosures. 2.27 Provider agrees to submit all reports required by Anthem necessary to comply with Medi-Cal Managed Care Program requirements. Provider agrees to submit to Anthem complete, accurate, reasonable, and timely provider data and encounter data necessary for Anthem to comply with the Department of Health Care Services’ data reporting requirements. 2.28 Provider shall comply with applicable monitoring provisions of the contract between Anthem and Department of Health Care Services and any monitoring request by the Department of Health Care Services. Further, Provider agrees that Anthem shall revoke the delegation of activities or obligations, or specify other remedies in instances where Department of Health Care Services or Anthem determine that Provider has not performed satisfactorily. 2.29 Provider is entitled to all protections afforded to it under the Health Care Provider’s Bill of Rights, including but not limited to Health & Safety Code §1375.7. 2.30 Anthem agrees to provide cultural competency, sensitivity and diversity training for Provider and Provider Subcontractors. 2.31 If Provider is responsible for the coordination of care for Covered Individuals, Anthem agrees to share with Provider any utilization data that Department of Health Care Services has provided to Anthem and Provider agrees to receive the utilization data provided and use it as Provider is able for the purpose of Covered Individual care coordination. 12 MCMCP ECM/CS Prv Agreement 2021 v1.8

2.32 PROVIDER agrees to cooperate with Anthem's administration of its internal quality of care review and provider grievance resolution procedures. ARTICLE III CONFIDENTIALITY/RECORDS 3.1 Proprietary Information. All information and material provided by either party in contemplation of or in connection with this Agreement remains proprietary to the disclosing party. Neither party shall disclose any information proprietary to the other, or use such information or material except: (1) as otherwise set forth in this Agreement; (2) as may be required to perform obligations hereunder; (3) as required to deliver Health Services to a Covered Individual; (4) upon the express written consent of the parties; or (5) as required by law or regulation, except that either party may disclose such information to its legal advisors, lenders and business advisors, provided that such legal advisors, lenders and business advisors agree to maintain confidentiality of such information. 3.2 Confidentiality of Personally Identifiable Information. Both parties agree to abide by state and federal laws and regulations regarding confidentiality of the Covered Individual's personally identifiable information. 3.3 Access to Provider Records. 3.3.1 Provider agrees that Anthem or its authorized representative may review, audit, and duplicate data and other records maintained by Provider regarding services Provider provides to Covered Individuals, and the cost thereof to the extent permitted by state and federal law including but not limited to the Agreement between Anthem and the Department of Health Care Services. Records include but are not limited to: medical and clinical records, encounter data, and records relating to billing, payment and assignment. Provider shall make such records and information available to Anthem or its authorized representative at all reasonable times at Provider’s place of business upon Anthem’s request. Such books and records shall be made available to Anthem in a form maintained in accordance with the general standards applicable to such books or record keeping. 3.3.2 Provider further agrees that the Directors or their designated representatives from the California Department of Managed Health Care, the California Department of Health Care Services, the Department of Health and Human Services (“DHHS”), the Centers for Medicaid and Medicare Services (“CMS”), Inspector General and the Department of Justice may inspect, audit and copy all financial, medical or other records maintained by Provider as may be necessary to ensure Anthem's compliance with the requirements of the Knox-Keene Act, the Medi-Cal program, or Anthem’s contract with DHCS. [42 CFR 438.6(g)] Access to Provider’s records and data for any government inspection shall be consistent to the access provided to Anthem under section 3.3.1. Should any governmental regulatory entity request certified documents, information, or data as part of that entity’s inspection or audit, Provider agrees to have an authorized officer certify the accuracy of the documents, information or data produced by Provider. Furthermore, Provider agrees to make available all of its premises, facilities, equipment, books, records, contracts, computer and other electronic systems pertaining to the services Provider provides to Covered Individuals furnished under the terms of this Agreement. 3.3.3 Provider agrees that it will maintain its books, records and other papers for at least ten (10) years from the final date of the Medi-Cal Managed Care Program Agreement between Anthem and the Department of Health Care Services or from the date of completion of any audit, whichever is later. In addition, such obligation will not terminate upon the termination of this Agreement. Anthem agrees to reimburse Provider quarterly for reasonable expenses related to its review or audit not to exceed the lesser of ten (10) cents per page or a total of twenty-five dollars ($25.00) related to the duplication and preparation of requested records. Anthem maintains the right to audit such records to determine the 13 MCMCP ECM/CS Prv Agreement 2021 v1.8
appropriateness of payments made. Anthem's audit policy is described in its Provider Operations Manual. If Department of Health Care Services, CMS or DHHS Inspector General determines there is a reasonable possibility of fraud or similar risk, Department of Health Care Services, CMS or the DHHS Inspector General may inspect, evaluate, and audit the Provider at any time. Upon resolution of a full investigation of fraud, Department of Health Care Services has the right to suspend or terminate the Provider from participation in the Medi-Cal Managed Care Program; seek recovery of payments made to the Provider; impose other sanctions under the Medi-Cal State Plan contract between Department of Health Care Services and CMS, and direct Anthem to terminate this Agreement due to fraud. 3.3.4 Anthem agrees and acknowledges that Provider’s participation with the obligations contained in this section shall not be a waiver of Provider’s right to maintain as confidential all proceedings of its Quality Assurance Committee, Professional Review Committee, or any other similar committee whose deliberations and findings are protected by California Evidence Code Section 1156 through 1157.7. These confidentiality provisions shall remain in effect notwithstanding any subsequent termination of this Agreement. 3.4 Transfer of Medical Records. Provider shall share a Covered Individual's medical records, and forward medical records and clinical information in a timely manner to other health care providers treating a Covered Individual, at no cost to Anthem, the Covered Individual, or other treating healthcare providers. 3.5 Upon request by the Department of Health Care Services, Provider shall timely gather, preserve and provide to the Department, in the form and manner specified by the Department of Health Care Services, any information specified by the Department, subject to any lawful privileges, in Provider’s or its subcontractors' possession, relating to threatened or pending litigation by or against the Department of Health Care Services. (If Provider asserts that any requested documents are covered by a privilege, Provider shall: 1) identify such privileged documents with sufficient particularity to reasonably identify the document while retaining the privilege; and 2) state the privilege being claimed that supports withholding production of the document.) Such request shall include, but is not limited to, a response to a request for documents submitted by any party in any litigation by or against the Department of Health Care Services. Provider acknowledges that time may be of the essence in responding to such request. Provider shall use all reasonable efforts to immediately notify the Department of Health Care Services of any subpoenas, document production requests, or requests for records, received by Provider or its Subcontractors related to this Agreement or subcontracts entered into under this Agreement. The Department of Health Care Services shall reimburse reasonable costs incurred by Provider in complying with these requests, subject to limitations established by the Department of Health Care Services. ARTICLE IV INSURANCE 4.1 Anthem Insurance. Anthem shall self-insure or maintain insurance as shall be necessary to insure Anthem and its employees, acting within the scope of their duties. 4.2 Provider Insurance. 4.2.1 Provider, at its sole expense, agrees to self-insure or maintain professional liability and comprehensive general liability in amounts acceptable to Anthem as set forth in the Anthem Provider Operations Manual. 4.2.2 Upon Request by Anthem, Provider agrees to provide Anthem with copies of insurance policies or evidence of the ability to respond to any and all damages, as provided in section 4.2.1. 14 MCMCP ECM/CS Prv Agreement 2021 v1.8
ARTICLE V RELATIONSHIP OF THE PARTIES 5.1 Relationship of the Parties. For purposes of this Agreement, Anthem and Provider are and will act at all times as independent contractors. Nothing in this Agreement shall be construed, or be deemed to create, a relationship of employer or employee or principal and agent, or any relationship other than that of independent entities contracting with each other for the purposes of effectuating this Agreement. In no way shall Anthem be construed to be providers of Health Services or responsible for the provision of such Health Services. Provider shall be solely responsible to the Covered Individual for treatment and medical care with respect to the provision of Health Services. Provider may freely communicate with Covered Individuals regarding the treatment options available to them, including medication treatment options, regardless of benefit coverage limitations. 5.2 Blue Cross Blue Shield Association (BCBSA). Provider hereby expressly acknowledges its understanding that this Agreement constitutes a contract between Provider and Anthem, that Anthem is an independent corporation operating under a license from the Blue Cross and Blue Shield Association, an association of independent Blue Cross and/or Blue Shield Plans ("Association"), permitting Anthem to use the Blue Cross and/or Blue Shield Service Marks in the state where Anthem is located, and that Anthem is not contracting as the agent of the Association. Provider further acknowledges and agrees that it has not entered into this Agreement based upon representations by any Association person, entity or organization, and that no Association person, entity or organization other than Anthem shall be held accountable or liable to Provider for any of Anthem's obligations to Provider created under this Agreement. Provider has no license to use the Blue Cross and/or Blue Shield names, symbols, or derivative marks (the "Brands") and nothing in the Agreement shall be deemed to grant a license to Provider to use the Brands. Any references to the Brands made by Provider in its own materials are subject to review and approval by Anthem. This section shall not create any additional obligations on the part of Anthem, other than those obligations already created under other provisions of this Agreement. ARTICLE VI INDEMNIFICATION AND LIMITATION OF LIABILITY 6.1 Indemnification. Anthem and Provider shall each indemnify, defend and hold harmless the other party, and its directors, officers, employees, agents and subsidiaries, from and against any and all losses, claims, damages, liabilities, costs and expenses (including, without limitation, reasonable attorneys' fees and costs) arising from third party claims resulting from the indemnifying party's failure to perform its obligations under this Agreement, and/or the indemnifying party's violation of any law, statute, ordinance, order, standard of care, rule or regulation. The obligation to provide indemnification under this Agreement shall be contingent upon the party seeking indemnification providing the indemnifying party with prompt written notice of any claim for which indemnification is sought, allowing the indemnifying party to control the defense and settlement of such claim, provided however that the indemnifying party agrees not to enter into any settlement or compromise of any claim or action in a manner that admits fault or imposes any restrictions or obligations on an indemnified party without that indemnified party's prior written consent which will not be unreasonably withheld, and cooperating fully with the indemnifying party in connection with such defense and settlement. 6.2 Limitation of Liability. Regardless of whether there is a total and fundamental breach of this Agreement or whether any remedy provided in this Agreement fails of its essential purpose, in no event shall either of the parties hereto be liable for any amounts representing loss of revenues, loss of profits, loss of business, the multiple portion of any multiplied damage award, or incidental, indirect, consequential, special or punitive damages, whether arising in contract, tort (including negligence), or otherwise regardless of whether the parties have been advised of the possibility of such damages, arising in any way out of or relating to this Agreement. Further, in no event shall 15 MCMCP ECM/CS Prv Agreement 2021 v1.8
Anthem be liable to Provider for any extra-contractual damages relating to any claim or cause of action assigned to Provider by any person or entity. 6.3 Period of Limitations. Unless otherwise provided for in this Agreement, neither party shall commence any action at law or equity, including but not limited to, an arbitration demand, against the other to recover on any legal or equitable claim arising out of this Agreement more than two (2) years after the events which gave rise to such claim. The deadline for initiating an action shall not be tolled by the appeal process, meet and confer process, provider dispute resolution process or any other administrative process. To the extent a dispute is timely commenced, it will be administered in accordance with Article VII of this Agreement. ARTICLE VII DISPUTE RESOLUTION AND ARBITRATION 7.1 Dispute Resolution. All disputes between Anthem and Provider arising out of or related in any manner to this Agreement shall be resolved using the dispute resolution and arbitration procedures set forth below. Provider shall exhaust any other applicable provider appeal/provider dispute resolution procedures and any applicable state law exhaustion requirements as a condition precedent to Provider’s right to pursue the dispute resolution and arbitration procedures set forth below. 7.1.1 Medical Necessity/Experimental or Investigational Disputes. Any dispute concerning whether a service provided or to be provided by Provider to a Covered Individual is not a Covered Service because such service is not Medically Necessary, or is experimental or investigational shall be resolved by an independent review organization (IRO). If the issue has already been reviewed by an IRO at the Covered Individual's request, then Anthem and Provider agree to be bound by the findings of such IRO. If not, then the Provider shall choose the IRO from a list provided by Anthem containing two or more such organizations. Anthem and Provider agree to be bound by the findings of such IRO with respect to such dispute. Anthem and Provider further agree to equally split the costs charged by the IRO for conducting each case review. This process shall be the exclusive means for resolving medical necessity / experimental or investigational disputes. 7.1.2 With respect to disputes other than those addressed in subsection 7.1.1, to invoke the dispute resolution procedures in this Agreement, a party first shall send to the other party a written demand letter that contains a detailed description of the dispute and all relevant underlying facts, a detailed description of the amount(s) in dispute and how they have been calculated and any other information that the Anthem Provider Operations Manual may require Provider to submit with respect to such dispute. If the total amount in dispute as set forth in the demand letter is less than two million dollars ($2,000,000), exclusive of interest, costs, and attorneys' fees within twenty (20) calendar days following the date on which the receiving party receives the demand letter, the parties’ shall meet and confer in an effort to resolve the dispute. If the total amount in dispute as set forth in the demand letter is two million dollars ($2,000,000) or more, exclusive of interest, costs, and attorneys' fees, within ninety (90) calendar dates following the date of the demand letter, the parties shall engage in non-binding mediation in an effort to resolve the dispute unless both parties agree in writing to waive the mediation requirement. The parties shall mutually agree upon a mediator, and failing to do so, Judicial Arbitration and Mediation Services (JAMS) shall be authorized to appoint a mediator. 7.2 Arbitration. Any dispute within the scope of section 7.1 above that remains unresolved at the conclusion of the applicable process outlined in section 7.1 above shall be resolved by binding arbitration in the manner set forth below. Except to the extent as set forth below, the arbitration shall be conducted pursuant to the JAMS Comprehensive Arbitration Rules and Procedures, provided, however, that the parties may agree in writing to further modify the JAMS Comprehensive Arbitration Rules and Procedures. The parties agree to be bound by the findings of the arbitrator(s) 16 MCMCP ECM/CS Prv Agreement 2021 v1.8
with respect to such dispute, subject to the right of the parties to appeal such findings as set forth herein. No arbitration demand shall be filed until after the parties have completed the dispute resolution efforts described in section 7.1 above. An arbitration demand shall not aggregate more than one hundred (100) disputed claims involving Covered Individuals arising out of this Agreement. 7.2.1 Selection and Replacement of Arbitrator(s). If the total amount in dispute as set forth in the demand letter is less than two million dollars ($2,000,000), exclusive of interest, costs, and attorneys' fees, the dispute shall be decided by a single arbitrator selected, and replaced when required, in the manner described in the JAMS Comprehensive Arbitration Rules and Procedures. If the total amount in dispute as set forth in the demand letter is two million dollars ($2,000,000) or more, exclusive of interest, costs, and attorneys' fees, the dispute shall be decided by an arbitration panel consisting of three arbitrators, unless the parties agree in writing that the dispute shall be decided by a single arbitrator. 7.2.2 Appeal. If the total amount of the arbitration award is five million dollars ($5,000,000) or more, inclusive of interest, costs, and attorneys' fees, the parties shall have the right to appeal the decision of the arbitrator(s) pursuant to the JAMS Optional Arbitration Appeal Procedure. In reviewing a decision of the arbitrator(s), the appeal panel shall apply the same standard of review that a United States Court of Appeals would apply in reviewing a similar decision issued by a United States District Court in the jurisdiction in which the arbitration hearing was held. 7.2.3 Waiver of Certain Claims. The parties, on behalf of themselves and those that they may now or hereafter represent, each agree to and do hereby waive any right to join or consolidate claims in arbitration by or against other individuals or entities to pursue, on a class basis, any dispute; provided however, that if an arbitrator or court of competent jurisdiction determines that such waiver is unenforceable for any reason with respect to a particular dispute, then the parties agree that section 7.2 shall not apply to such dispute and that such dispute shall be decided instead in a court of competent jurisdiction. ARTICLE VIII TERM AND TERMINATION 8.1 Department of Health Care Services Contract Approval. Provider acknowledges that this Agreement, and any subsequent amendment to this Agreement, shall become effective only upon the written approval by the Department of Health Care Services, or by operation of law as follows: (i) for the initial Agreement, where the Department of Health Care Services has acknowledged receipt of the Agreement and neither approves or disapproves the Agreement within sixty (60) days of its receipt; (ii) for any amendment to the Agreement governing compensation, services, or term, where the Department of Health Care Services has acknowledged receipt of the amendment and neither approves or disapproves the amendment within thirty (30) days of its receipt. 8.2 Initial Term of Agreement. The initial term of this Agreement shall commence at 12:01 AM on the Effective Date and shall continue in effect for a term of one (1) year ("Initial Term"), automatically renewing for consecutive one (1) year terms unless otherwise terminated as provided herein. 8.3 Termination Without Cause. At any time, either party may terminate or renegotiate this Agreement without cause with such termination to be effective on or after the expiration date of the Initial Term, by giving at least one hundred and twenty (120) days prior written notice of termination to the other party. 8.4 Future Negotiations. Notwithstanding any provision to the contrary contained in this Agreement, if the parties enter into discussions or negotiations concerning a new Provider Agreement which is to take effect subsequent to the termination or expiration of this Agreement and the parties are unable to reach agreement on the terms of the new Provider Agreement prior to the effective date 17 MCMCP ECM/CS Prv Agreement 2021 v1.8
of termination or expiration, the Provider shall accept as payment in full the Anthem Rate in effect under this Agreement on the day immediately prior to the termination or expiration until such time as a new Provider Agreement is effective, or until ninety (90) days after the date upon which either the Provider or Anthem gives written notice to the other terminating negotiations (such time period to be referred to as the "Interim Period"). During the Interim Period, the non-price terms, including but not limited to any hold harmless provisions of this Agreement shall be applicable, and any limitations contained in the Agreement by which Provider charge increases are capped when calculating payment under a percentage of charge methodology shall also be extended into the Interim Period, as follows: all of the charge capping percentages, measurement periods, notification requirements and methodologies in effect on the day immediately prior to termination or expiration of the Agreement shall be extended into, and through the end of, the Interim Period. 8.5 Breach of Agreement. Except for circumstances giving rise to the Termination With Cause section, if either party fails to comply with or perform when due any material term or condition of this Agreement, the other party shall notify the breaching party of its breach in writing stating the specific nature of the material breach, and the breaching party shall have thirty (30) days to cure the breach. If the breach is not cured to the reasonable satisfaction of the non-breaching party within said thirty (30) day period, the non-breaching party may terminate this Agreement by providing written notice of such termination to the other party. The effective date of such termination shall be no sooner than sixty (60) days after such notice of termination. 8.6 Termination With Cause. 8.6.1 This Agreement may be terminated automatically and immediately by Anthem if: 8.6.1.1 Provider commits any act or conduct for which its license(s), permit(s), or governmental or board authorization(s) or approval(s) necessary for business operations or to provide Health Services is suspended, revoked, lost or voluntarily surrendered in whole or in part; or 8.6.1.2 Provider commits any act or conduct which results in a governmental, regulatory or accrediting entity placing Provider on probation; 8.6.1.3 Provider commits a fraud or makes any material misstatement or omission on any document related to this Agreement which it submits to Anthem or to a third party; or 8.6.1.4 Provider files for bankruptcy, makes an assignment for the benefit of its creditors without Anthem's written consent, or if a receiver is appointed over Provider’s business or assets; or 8.6.1.5 Provider's insurance coverage as required by this Agreement lapses for any reason; or 8.6.1.6 Provider fails to maintain Anthem's credentialing or certification standards; or 8.6.1.7 Anthem reasonably believes based on Provider's conduct or inaction, or allegations of such conduct or inaction, that the well-being or safety of patients may be jeopardized; or 8.6.1.8 Provider has been abusive to a Covered Individual; or 8.6.2 This Agreement may be terminated automatically and immediately by Provider if:
18 MCMCP ECM/CS Prv Agreement 2021 v1.8

8.6.2.1 Anthem commits any act or conduct for which its license(s), permit(s), or any governmental or board authorization(s) or approval(s) necessary for business operations are lost or voluntarily surrendered in whole or in part; or 8.6.2.2 Anthem commits a fraud or makes any material misstatements or omissions on any documents related to this Agreement which it submits to Provider or to a third party; or 8.6.2.3 Anthem files for bankruptcy, or if a receiver is appointed; or 8.6.2.4 Anthem’s insurance coverage as required by this Agreement lapses for any reason. 8.7 Transactions Prior to Termination. Termination shall have no effect on the rights and obligations of the parties arising out of any transaction occurring prior to the date of such termination. 8.8 Continuance of Care-Termination. If this Agreement is terminated, Provider shall continue to provide and be compensated for Covered Services under the terms of this Agreement to Covered Individuals who are Provider inpatients on the date of the termination until those Covered Individuals are discharged or can be safely transferred to another Network Participating Provider. If this Agreement is terminated for reasons other than the grounds set forth in the "Termination With Cause" provision, Provider, at Anthem's sole discretion, shall continue to provide and be compensated for Covered Services under the terms of this Agreement to Covered Individuals who at the time of termination are receiving services from Provider for one of the following conditions (as defined in Health and Safety Code Section 1373.96): (1) an acute condition; (2) a serious chronic condition; (3) a pregnancy; (4) a terminal illness; (5) care of a newborn child between birth and age thirty-six (36) months; or (6) performance of a surgery or other procedure that has been authorized by Plan (or the relevant delegated medical group/IPA) as part of a documented course of treatment and has been recommended and documented by Provider to occur within one hundred eighty (180) days of the termination date of this Agreement. For cases involving an acute condition, a terminal illness or a pregnancy, such services will continue through the duration of the acute condition, the terminal illness or the pregnancy, respectively. For cases involving a serious chronic condition, such services will continue until the course of treatment has been completed and arrangements have been made for a safe transfer to another participating Provider as determined by Plan in consultation with Provider, consistent with good professional practice, such period not to exceed twelve (12) months from the termination of this Agreement. For cases involving care of a newborn child, as specified above, such services will continue for a period not to exceed twelve (12) months from the termination of this Agreement. After the effective date of termination, this Agreement shall remain in effect for the resolution of all matters unresolved as of that date. In the event this Agreement is terminated, Provider agrees to assist Anthem in the transfer of Member medical care including making available to the Department and Anthem copies of medical records, patient files, and any other pertinent information held by Provider necessary for efficient case management of Members, as determined by the Director of the Department of Health Care Services. If applicable, Provider agrees to require its subcontractors to comply with this Section 8.8. The parties acknowledge that the cost of reproduction required by this provision will not be billed to members, but will be borne by the Provider. 8.9 Department of Health Care Services Notification. Provider agrees to timely notify the Department of Health Care Services of the termination of this Agreement. 8.10 Survival. In the event of termination of the Agreement, the following provisions shall survive: 8.10.1 Payment in Full and Hold Harmless (Section 2.10) 19 MCMCP ECM/CS Prv Agreement 2021 v1.8

8.10.2 Appeals/Adjustment Requests (Section 2.12) 8.10.3 Confidentiality/Records (Article III) 8.10.4 Indemnification and Limitation of Liability (Article VI) 8.10.5 Dispute Resolution and Arbitration (Article VII) 8.10.6 Continuance of Care-Termination (Section 8.8) ARTICLE IX GENERAL PROVISIONS 9.1 Amendment. Notwithstanding any other provision herein to the contrary, Anthem agrees to give Provider at least ninety (90) calendar days prior notice of any change by Anthem to a material term of this Agreement (except for any change necessary to comply with prospective changes required by the Department of Health Care Services, state or federal law or regulations or any accreditation requirements of a private sector accreditation organization and a shorter timeframe is required for compliance.) If Provider desires to negotiate the change (except for any change necessary to comply with state or federal law or regulations or any accreditation requirements of a private sector accreditation organization), Provider shall notify Anthem no later than thirty (30) days after receipt of Anthem's notice. If the parties are unable to agree to such change or if Provider elects not to engage in any negotiations (and the change is not necessary to comply with state or federal law or regulations nor any accreditation requirements of a private sector accreditation organization), Provider may terminate this Agreement, notwithstanding the provisions of Article VIII of this Agreement, by providing Anthem, no later than forty-five (45) business days after receipt of Anthem's notice of the material change, with written notice of such intent to terminate this Agreement. Any such termination would not be effective until ninety (90) calendar days after Anthem's receipt of Provider's notice of intent to terminate. Anthem agrees to inform Provider of prospective requirements added by the Department of Health Care Services to the contract between Anthem and the Department of Health Care Services before the requirement would be effective and Provider agrees to comply with the new requirements within 30 days of the effective date, unless otherwise instructed by the Department of Health Care Services and to the extent possible. 9.2 Assignment. Neither Provider nor Anthem shall assign this Agreement or their respective rights, duties or obligations under this Agreement without the express written consent of the non-assigning party. Provider and Anthem agree that consent to an assignment shall not be unreasonably withheld. Any attempted assignment in violation of this provision shall be void as to the non-assigning party. Notwithstanding the foregoing, Provider agrees that any assignment or delegation of Provider’s rights, duties or obligations under this Agreement or any Provider subcontract agreement shall be null and void unless prior written approval is obtained from the Department of Health Care Services. Provider acknowledges and agrees that this section shall not apply to any of Anthem’s duties or obligation that Anthem has capitated and delegated to a Delegated Entity. 9.3 Scope/Change in Status. Anthem and Provider agree that this Agreement applies to Health Services rendered at the locations as set forth on the Provider Locations Attachment of this Agreement. Anthem may limit this Agreement to Provider's locations, operations or business or corporate form, status or structure in existence on the Effective Date of this Agreement and prior to the occurrence of any of the following events:
20 MCMCP ECM/CS Prv Agreement 2021 v1.8

9.3.1 Provider otherwise changes its locations, business or operations, or business or corporate form or status; or 9.3.2 Provider is acquired or controlled by any other entity through any manner, including but not limited to purchase, merger, consolidation, alliance, joint venture, partnership, association, expansion; or 9.3.3 Provider acquires or controls any other medical Provider, service or beds through any manner, Including but not limited to asset only purchase, merger, consolidation, alliance, joint venture, partnership, association, or expansion; or 9.3.4 Provider (a) sells, transfers or conveys its business or any substantial portion of its business assets to another entity through any manner including but not limited to a stock, real estate or asset transaction or other type of transfer; or (b) enters into a management contract with another entity. 9.3.5 If Anthem consents in writing not to limit the Agreement to the original corporate entity, then Provider warrants and covenants that this Agreement will be assumed by the new entity unless the new entity already has an agreement with Anthem, in which case Anthem will determine which Agreement will prevail. Provider shall provide Anthem one hundred twenty (120) days prior written notice of any change in this section 9.3. 9.4 Definitions. Unless otherwise specifically noted, the definitions set forth in this Agreement will have the same meaning when used in any attachment, the Provider Operations Manual and Policies. 9.5 Entire Agreement. This Agreement (including items incorporated herein by reference) constitutes the entire understanding between the parties and supersedes all prior oral or written agreements between them with respect to the matters provided for herein. 9.6 Force Majeure. Neither party shall be deemed to be in violation of this Agreement if such party is prevented from performing any of its obligations hereunder for any reason beyond its reasonable control, including without limitation, acts of God, acts of any public enemy, floods, statutory or other laws, regulations, rules, or orders of the federal, state, or local government or any agency thereof. 9.7 Compliance with Medi-Cal Managed Care Program, Federal and State Laws. Anthem and Provider agree to comply with all requirements of the law relating to their obligations under this Agreement, all applicable requirements of the Medi-Cal Managed Care Program, and maintain in effect all permits, licenses and governmental and board authorizations and approvals as necessary for business operations, and as to Provider, its agents and employees, they shall be and remain licensed and certified (including Medicare certification in unqualified, unrestricted status) in accordance with all state and federal laws and regulations (including those applicable to utilization review and Claims payment) relating to the provision of Provider services to Covered Individuals. Provider shall supply evidence of such licensure, compliance and certifications to Anthem upon request. From time to time legislative bodies, boards, departments or agencies may enact, issue or amend laws, rules, or regulations pertinent to this Agreement. Both parties agree to immediately abide by all such laws, rules, or regulations to the extent applicable, and to cooperate with the other to carry out any responsibilities placed upon the other by such laws, rules, or regulations, subject to the other's right to terminate as set forth under this Agreement. In the event of a conflict between this section and any other provision in this Agreement, this section shall control. 9.7.1 In addition to the foregoing, Provider warrants and represents that at the time of entering into this Agreement, neither it nor any of its employees, contractors, subcontractors or agents are ineligible persons identified on the General Services Administrations' List of Parties Excluded from Federal Programs (available through the internet at http://www.epls.gov/ or its successor) and the HHS/OIG List of Excluded Individuals/Entities (available through the internet at http://www.oig.hhs. 21 MCMCP ECM/CS Prv Agreement 2021 v1.
gov/fraud/exclusions.asp or its successor), or as otherwise designated by the Federal government. If Provider or any employees, subcontractors or agents thereof becomes an ineligible person after entering into this Agreement or otherwise fails to disclose its ineligible person status, Provider shall have an obligation to (1) immediately notify Anthem of such ineligible person status and (2) within ten (10) days of such notice, remove such individual from responsibility for, or involvement with, the Provider's business operations related to this Agreement. 9.8 Governing Law. This Agreement shall be governed by and construed in accordance with, (1) the laws of the State of California unless such state laws are preempted by federal law, and (2), the laws and applicable regulations governing the Medi-Cal Managed Care contract between the Department of Health Care Services and Anthem. 9.9 Intent of the Parties. It is the intent of the parties that this fee-for-service Agreement is to be effective only in regards to their rights and obligations with respect to each other; it is expressly not the intent of the parties to create any independent rights in any third party or to make any third party a third party beneficiary of this Agreement, except to the extent Anthem utilizes a designee, which in such event shall give rights only within the scope of such designation, and to the extent specified in the Payment in Full and Hold Harmless section of this Agreement. 9.10 Non-Exclusive Participation. None of the provisions of this Agreement shall prevent Provider from participating in or contracting with any provider, preferred provider organization, health maintenance organization, or health insuring corporation, or any other health delivery or insurance program. Provider acknowledges that Anthem does not warrant or guarantee that Provider will be utilized by any particular number of Covered Individuals. 9.11 Notices. All notices required or permitted to be given under this Agreement shall be in writing and shall be delivered to the party to whom notice is to be given either (i) by personal delivery (notice shall be deemed given on the date of delivery), (ii) by United Parcel Post (UPS) or other next day delivery service (notice shall be deemed given on the date of actual receipt), (iii) by first-class mail, postage prepaid certified or registered return receipt requested (notice shall be deemed given on the date of actual delivery) and (iv) by cablegram or telegram with confirmation of transmission (notice shall be deemed given on the date on the confirmation) (v) facsimile transmission with confirmation (notice shall be deemed given on the date on the confirmation) and To ANTHEM Provider Engagement & Contracting Processing Anthem State Sponsored Programs 21515 Burbank Blvd, 2nd Floor Woodland Hills, California 91367 MS:CA9302-L02B Legal Department- State Sponsored Business 21515 Burbank Blvd, 3rd Floor Woodland Hills, CA 91367 Attn: SSB Counsel 852-8811 To PROVIDER at: PROVIDER email:
22 MCMCP ECM/CS Prv Agreement 2021 v1.8
All notices required or permitted to be given under this Agreement to the Department shall be in writing, deposited in the United States Postal Service as first class registered mail, postage prepaid to: Regular Mail: DEPARTMENT OF HEALTH CARE SERVICES Medi-Cal Managed Care Division MS# 4409 P.O. Box 997413 Sacramento, CA 95899-7413 Attn: Contracting Officer for Anthem Blue Cross Federal Express: DEPARTMENT OF HEALTH CARE SERVICES Medi-Cal Managed Care Division MS# 4409 1501 Capitol Avenue, 4th Floor Sacramento, CA 94814 [Note: for GMC counties use MS# 4409] 9.12 Severability. In case any one or more of the provisions of this Agreement shall be invalid, illegal, or unenforceable in any respect, the remaining provisions shall be construed liberally in order to effectuate the purposes hereof, and the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby. If one or more provisions of the Agreement are invalid, illegal or unenforceable and an amendment to the Agreement is necessary to maintain its integrity, the parties shall make commercially reasonable efforts to negotiate an amendment to this Agreement and any attachments or addenda to this Agreement which could reasonably be construed not to contravene such statute, regulation, or interpretation. In addition, if such invalid, unenforceable or materially affected provision(s) may be severed from this Agreement and/or attachments or addenda to this Agreement without materially affecting the parties' intent when this Agreement was executed, then such provision(s) shall be severed rather than terminating the Agreement or any attachments or addenda to this Agreement. 9.13 Waiver. Neither the waiver by either of the parties of a breach of any of the provisions of this Agreement, nor the failure of either of the parties, on one or more occasion, to enforce any of the provisions of this Agreement, shall thereafter be construed as a waiver of any subsequent breach of any of the provisions of this Agreement. 9.14 Interpretation. No provision of this Agreement shall be interpreted for or against any party because that party or his/her/its legal representative drafted the provision(s). (REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK) 23 MCMCP ECM/CS Prv Agreement 2021 v1.

Each party warrants that it has full power and authority to enter into this Agreement and the person signing this Agreement on behalf of either party warrants that he/she has been duly authorized and empowered to enter into this Agreement. THIS AGREEMENT CONTAINS A BINDING ARBITRATION PROVISION WHICH MAY BE ENFORCED BY THE PARTIESTHE EFFECTIVE DATE OF THIS AGREEMENT IS:ANTHEM Signature Signature, Authorized RepresentativeName NameTitle TitleDate DateTax ID ature, Authorized Representa
Heather StratmanChief Administrative Officer12/11/202487-3137292Housing for Health O,I., DBA Housing for Health

A-1 MCMCP ECM/CS Prv Agreement 2021 v1.8
EXHIBIT A PROVIDER REIMBURSEMENT Medi-Cal Reimbursement for authorized Health Services shall be at one hundred percent (100%) of the attached ANTHEM Medi-CAL Proprietary Fee Schedule (Fee Schedule) per county. Provider shall accept the above reimbursement for services or the Provider’s billed amount, whichever is less as payment in full for those Covered Services provided to Members. Anthem may update or adjust the Fee Schedule from time to time upon ninety (90) days prior written notice to Provider.

B-1 MCMCP ECM/CS Prv Agreement 2021 v1.8
EXHIBIT B COVERED SERVICES PROVIDER shall indicate which CS will be rendered and which ECM population of focus will be served. Provider shall render services and be compensated in the counties (service area) listed in Exhibit C. Anthem may add counties in Exhibit C, to Provider’s service area upon thirty (30) days written notice to Provider. Insert check mark indicating which CS services provider will render under this agreement: Housing Transition Navigation Services Housing Deposits Housing Tenancy and Sustaining Services Short-Term Post-Hospitalization Housing Recuperative Care (Medical Respite) Respite Services Day Habilitation Programs Nursing Facility Transition/Diversion to Assisted Living Facilities, such as Residential Care Facilities for Elderly (RCFE) and Adult Residential Facilities (ARF) Community Transition Services/Nursing Facility Transition to a Home Personal Care and Homemaker Services Environmental Accessibility Adaptations (Home Modifications) Medically Supportive Food/Meals/Medically Tailored Meals Sobering Centers Asthma Remediation Insert check mark indicating which of the ECM populations of focus provider will render services to under this agreement: Children and Youth Involved in Child Welfare Individuals Experiencing Homelessness (Adults and/or Families or Children/Youth) Individuals with Serious Mental Health and/or SUD Needs (Adults and/or Children/Youth) Individuals Transitioning from Incarceration (Adults and/or Children/Youth) Adults Living in the Community and At Risk for LTC Institutionalization Adult Nursing Facility Residents Transitioning to the Community Individuals At Risk for Avoidable Hospital or ED Utilization (formerly “High Utilizers” – Adults and/or Children/Youth) Children and Youth Enrolled in California Children’s Services (CCS) with additional needs beyond the CCS condition Individuals with Intellectual or Developmental Disabilities (I/DD) (Adults and/or Children/Youth) Pregnant and Postpartum Individuals At Risk for Adverse Perinatal Outcomes (Adults and/or Children/Youth) Birth Equity (Adults and/or Children/Youth) C-1MCMCP ECM/CS Prv Agreement 2021 v1.8
EXHIBIT C PROVIDER COUNTY SERVICE AREA Provider can service Members within the following counties as check marked below: Bay Area Gold Country Central Valley Eastern Sierra Los Angeles Kern Sacramento San Francisco Santa Clara Amador Calaveras El Dorado Tuolumne Fresno Kings Madera Tulare Alpine Inyo Mono Los Angeles Kern D-1 MCMCP ECM/CS Prv Agreement 2021 v1.8
EXHIBIT D COPIES OF LICENSES AND CERTIFICATES PROVIDER to attach copies of the following documents: 1. Disclosure of Ownership and Control Interest Statement (located within Exhibit F) 2. W-9 3. Proof of Insurance as applicable - Professional Liability Insurance Face Sheet - General Liability Face Sheet - Commercial Auto Policy Declaration 4. Background Check Attestation 5. Roster 6. Business Associate Agreement as applicable 7. Health Delivery Organization (HDO) Application as applicable E-1 MCMCP ECM/CS Prv Agreement 2021 v1.8
EXHIBIT E SCOPE OF WORK I. DEFINITIONS Key terms are defined as follows: 1. Authorized Representative (AR): An individual or organization that the Member designates to act on her behalf with respect to the implementation of ECM services. 2. CalAIM: a multi-year initiative by CA-DHCS to improve the quality of life and health outcomes high-risk populations by implementing broad delivery system reforms. Enhanced Care Management (ECM) is a key CalAIM initiative. 3. California Department of Health Care Services (DHCS): A Department within the California Health and Human Services Agency that administers Medi-Cal, a program that provides healthcare services to low-income people. 4. Community Supports (CS): Flexible wrap-around services that Anthem will integrate into its population health strategy. These services are not included in the State Plan, but are medically appropriate, cost-effective substitutes for state plan services included within the contract. Examples of Community Supports include but are not limited to housing transition and sustaining services, recuperative care, respite, home and community-based wrap around services for members to transition or reside safely in their home or community, and sobering centers. 5. ECM Participant (“Participant”): means an Anthem Medi-Cal Member who has been assigned by Anthem to receive ECM services from Provider. 6. ECM Provider: A Provider of ECM. ECM Providers are community-based entities with experience and expertise providing intensive, in-person care management services to individuals in one or more of the Populations of Focus for ECM. 7. CS Provider: A contracted Provider of DHCS-approved CS. CS Providers are entities with experience and/or training providing one or more of the CS approved by DHCS. 8. CS Provider Guide: Anthem’s detailed expectations CS providers including required policies and procedures, as well as best practice recommendations. The CS Provider Guide is an essential companion to this Scope of Work. 9. ECM Provider Guide: Anthem’s detailed expectations ECM providers including required policies and procedures, as well as best practice recommendations. The ECM Provider Guide is an essential companion to this Scope of Work. 10. Electronic Visit Verification (EVV): a federally mandated telephone and computer-based application program that electronically verifies in-home service visits. As a result, this program will aid in reducing fraud, waste, and abuse. The EVV program must verify each type of service performed, the individual receiving the service, the date of the service, the location of service delivery, the individual providing the service, and the time the service begins and ends. 11. Enhanced Care Management (ECM): a whole-person, interdisciplinary approach to care that addresses the clinical and non-clinical needs of high- need and/or high-cost Members through systematic coordination of services and comprehensive care management that is community-based, interdisciplinary, high-touch, and person-centered. ECM is a Medi-Cal benefit. 12. Lead Care Manager: A Member’s designated care manager for ECM, who works for the ECM Provider organization (except in circumstances under which the Lead Care Manager could be on staff with Anthem, as described in the DHCS-MCP ECM and CS Contract, Section 4: ECM Provider Capacity). The Lead Care Manager operates as part of the Member’s multi-disciplinary E-2 MCMCP ECM/CS Prv Agreement 2021 v1.8
care team and is responsible for coordinating all aspects of ECM and any Community Supports (CS). To the extent a Member has other care managers, the Lead Care Manager will be responsible for coordinating with those individuals and/or entities to ensure a seamless experience for the Member and non-duplication of services. 13. Managed Care Plan (MCP): An organization contracted by DHCS to administer a standard set of healthcare benefits for a population of Medi-Cal participants. Anthem Blue Cross is a Medi-Cal MCP. 14. Population of Focus (PoF): One of the DHCS-defined populations that are eligible for ECM, including: Children and Youth Enrolled in California Children’s Services (CCS) with Additional Needs Beyond the CCS Qualifying Condition, Children and Youth Involved in Child Welfare, Intellectual or Developmental Disabilities (I/DD), Pregnant and Postpartum Individuals At Risk for Adverse Perinatal Outcomes, Birth Equity, Individuals Transitioning from Incarceration, Individuals with Serious Mental Health and/or SUD Needs (SUD), Individuals Experiencing Homelessness, Individuals At Risk for Avoidable Hospital or ED Utilization, Adult Nursing Facility Residents Transitioning to the Community, and Adults Living in the Community and At Risk for LTC Institutionalization. These populations are subject to change. For the most recent and complete PoF descriptions see DHCS ECM Policy Guide. 15. Service Planning Area (SPA): A Los Angeles County Department of Public Health designated geographic regions. Los Angeles County is divided into 8 SPAs. 16. Subcontract: a written agreement entered into by the Provider with any of the following: A Provider of health care services who agrees to furnish ECM services. Or any other organization or person(s) who agree(s) to perform any administrative function or service for the Provider specifically related to fulfilling the Provider’s obligations to DHCS and Anthem under the terms of this Agreement. “Subcontractor” means an individual or entity who has a Subcontract with Provider that relates directly or indirectly to the performance of the Provider’s obligations under this Agreement with Anthem. Enhanced Care Management I. Service Overview 1. Certified Population(s) focus: ECM provider is certified and has agreed to render services to the population (s) of focus as referenced in Exhibit B. [Please identify any limitations or qualifications to accepting eligibility lists for any member who meets the population and ECM level of care criteria; e.g. only serve clients fleeing domestic violence] 2. Service Capacity 1. See Capacity Report II. ECM Provider Requirements Provider Experience and Qualifications 1. ECM Provider shall be experienced in serving the ECM Population(s) of Focus it will serve; 2. ECM Provider shall have experience and expertise with the services it will provide; 3. ECM Provider shall comply with all applicable state and federal laws and regulations and all ECM benefit requirements in the DHCS-MCP ECM and CS Contract and associated guidance; 4. ECM Provider shall have the capacity to provide culturally appropriate and timely in-person care management activities including accompanying Members to critical appointments when necessary; 5. ECM Provider shall be able to communicate in culturally and linguistically appropriate and accessible ways; E-3 MCMCP ECM/CS Prv Agreement 2021 v1.8

6. ECM Provider shall have formal agreements and processes in place to engage and cooperate with area hospitals, primary care practices, behavioral health Providers, Specialists, and other entities, including CS Providers, to coordinate care as appropriate to each Member; 7. ECM Provider shall use a care management documentation system or process that supports the documentation and integration of physical, behavioral, social service, and administrative data and information from other entities to support the management and maintenance of a Member care plan that can be shared with other Providers and organizations involved in each Member’s care. Care management documentation systems may include Certified Electronic Health Record Technology, or other documentation tools that can: document Member goals and goal attainment status; develop and assign care team tasks; define and support Member care coordination and care management needs; gather information from other sources to identify Member needs and support care team coordination and communication and support notifications regarding Member health status and transitions in care (e.g., discharges from a hospital, long-term care facility, housing status). 8. Contracted ECM Providers who are also contracted CS Providers should provide separate and distinct ECM and CS services to authorized members III. Medicaid Enrollment/Vetting for ECM Providers 1. If a State-level enrollment pathway exists, ECM Provider shall enroll as a Medi-Cal provider, pursuant to relevant DHCS APLs including Provider Credentialing/Recredentialing and Screening/Enrollment APL 19-004. a. If APL 19-004 does not apply to an ECM Provider, the ECM Provider must comply with Anthem’s process for vetting the ECM Provider, which may extend to individuals employed by or delivering services on behalf of the ECM Provider, to ensure it can meet the capabilities and standards required to be an ECM Provider. 2. Refer to the Anthem ECM Provider Guide, Contracting, for more details. IV. Identifying Members for ECM 1. ECM Provider is encouraged to identify Members who would benefit from ECM and send a request to Anthem, to determine if the Member is eligible for ECM, consistent with Anthem’s process for such request. 2. Refer to the Anthem ECM Provider Guide, Methods to identify eligible members, for more details. V. Member Assignment to an ECM Provider 1. MCP shall communicate new Member assignments to ECM Provider as soon as possible, but in any event no later than ten business days after ECM authorization. 2. With the exception noted below, ECM Provider shall immediately accept all members assigned by Anthem for ECM, provided that the member is attributed to a population of focus which the Provider is certified to serve. Provider shall not be allowed to serve a subset of preferred members to the exclusion of other eligible members in the population of focus (e.g., empaneled members, Provider referrals). The purpose of this policy is ensure sufficient capacity for all eligible members in a County. Provider may request to revisit this policy in the future. a. Exception: ECM Provider shall be permitted to decline a Member assignment if ECM Provider is at its pre-determined capacity. 1. ECM Provider shall immediately alert Anthem if it does not have the capacity to accept a Member assignment. 3. Upon initiation of ECM, ECM Provider shall ensure each Member assigned has a Lead Care Manager who interacts directly with the Member and/or their family member(s), guardian, E-4 MCMCP ECM/CS Prv Agreement 2021 v1.8
caregiver, and/or authorized support person(s), as appropriate, and coordinates all covered physical, behavioral, developmental, oral health, long-term services and supports (LTSS), Specialty Mental Health Services, Drug Medi-Cal/Drug Medi-Cal Organized Delivery System services, any Community Supports (CS), and other services that address social determinants of health (SDOH) needs, regardless of setting. 4. ECM Provider shall advise the Member on the process for changing ECM Providers, which is permitted at any time. a. ECM Provider shall advise the Member on the process for switching ECM Providers, if requested. b. ECM Provider shall notify Anthem if the Member wishes to change ECM Providers. c. MCP must implement any requested ECM Provider change within thirty (30) calendar days. 5. ECM Provider shall advise the Member on the process for changing Lead Care Manager, which is permitted at any time. a. ECM Provider shall advise the Member on the process for switching ECM Providers, if requested. b. MCP must implement any requested ECM Provider change within thirty (30) calendar days. 6. Refer to the Anthem ECM Provider Guide, ECM Core Services, for more details. VI. ECM Provider Staffing 1. At all times, ECM Provider shall have adequate staff to ensure its ability to carry out responsibilities for each assigned Member consistent with this Provider Standard Terms and Conditions, the DHCS-MCP ECM CS Contract and any other related DHCS guidance. 2. The ECM provider is expected to follow any DHCS provided guidance on staffing. 3. Refer to the Anthem ECM Provider Guide, Staffing, for additional staffing recommendations. VII. ECM Provider Outreach and Member Engagement 1. ECM Provider shall be responsible for conducting outreach to each assigned Member and engaging each assigned Member into ECM, in accordance with Anthem’s Policies and Procedures. 2. ECM Provider shall ensure outreach to assigned Members prioritizes those with the highest level of risk and need for ECM. 3. ECM Provider shall conduct outreach primarily through in-person interaction where Members and/or their family member(s), guardian, caregiver, and/or authorized support person(s) live, seek care, or prefer to access services in their community. ECM Provider may supplement in-person visits with secure teleconferencing and telehealth, where appropriate and with the Member’s consent. a. ECM Provider shall use the following modalities, as appropriate and as authorized by the Member, if in-person modalities are unsuccessful or to reflect a Member’s stated contact preferences: i. Mail ii. Email iii. Texts iv. Telephone calls v. Telehealth 4. ECM Provider shall comply with non-discrimination requirements set forth in State and Federal law and the Contract with Anthem. 5. Refer to the Anthem ECM Provider Guide, Outreach and engagement, for more details.

E-5 MCMCP ECM/CS Prv Agreement 2021 v1.8
VIII. Initiating Delivery of ECM 1. ECM Provider shall obtain, document, and manage Member authorization for the sharing of Personally Identifiable Information between Anthem and ECM, CS, and other Providers involved in the provision of Member care to the extent required by federal law. 2. Member authorization for ECM-related data sharing is not required for the ECM Provider to initiate delivery of ECM unless such authorization is required by federal law. 3. When federal law requires authorization for data sharing, ECM Provider shall communicate that it has obtained Member authorization for such data sharing back to Anthem. 4. ECM Provider shall notify Anthem to discontinue ECM under the following circumstances: a. The Member has met their care plan goals for ECM; b. The Member is ready to transition to a lower level of care; c. The Member no longer wishes to receive ECM or is unresponsive or unwilling to engage; and/or d. ECM Provider has not had any contact with the Member despite multiple attempts. 5. When ECM is discontinued, or will be discontinued for the Member, Anthem is responsible for sending a Notice of Action (NOA) notifying the Member of the discontinuation of the ECM benefit and ensuring the Member is informed of their right to appeal and the appeals process as instructed in the NOA. ECM Provider shall communicate to the Member other benefits or programs that may be available to the Member, as applicable (e.g., Complex Care Management, Basic Care Management, etc.). 6. Refer to the Anthem ECM Provider Guide, Initiating delivery of ECM, for more details. IX. ECM Requirements and Core Service Components of ECM 1. ECM Provider shall ensure ECM is a whole-person, interdisciplinary approach to care that addresses the clinical and non-clinical needs of high-need and/or high-cost Medi-Cal Members enrolled in managed care. ECM Provider shall ensure the approach is person-centered, goal oriented, and culturally appropriate. 2. ECM Provider shall: a. Ensure each Member receiving ECM has a Lead Care Manager; b. Coordinate across all sources of care management in the event that a Member is receiving care management from multiple sources; c. Alert Anthem to ensure non-duplication of services in the event that a Member is receiving care management or duplication of services from multiple sources; and d. Follow Anthem instruction and participate in efforts to ensure ECM and other care management services are not duplicative. 3. ECM Provider shall collaborate with area hospitals, Primary Care Providers (when not serving as the ECM Provider), behavioral health Providers, Specialists, dental Providers, Providers of services for LTSS and other associated entities, such as CS Providers, as appropriate, to coordinate Member care. 4. ECM Provider shall provide all core service components of ECM to each assigned Member, in compliance with Anthem’s Policies and Procedures, as follows: a. Outreach and Engagement of Anthem Members into ECM. b. Comprehensive Assessment and Care Management Plan, which shall include, but is not limited to: i. Engaging with each Member authorized to receive ECM primarily through in-person contact; When in-person communication is unavailable or does not meet the needs of the Member, the ECM Provider shall use alternative methods (including innovative use of telehealth) to provide culturally appropriate and accessible communication in accordance with Member choice.

E-6 MCMCP ECM/CS Prv Agreement 2021 v1.8
ii. Identify necessary clinical and non-clinical resources that may be needed to appropriately assess Member health status and gaps in care and may be needed to inform the development of an individualized Care Management Plan. iii. Developing a comprehensive, individualized, person-centered care plan by working with the Member and/or their family member(s), guardian, Authorized Representative (AR), caregiver, and/or authorized support person(s) as appropriate to assess strengths, risks, needs, goals and preferences and make recommendations for service needs; iv. Incorporating into the Member’s care plan identified needs and strategies to address those needs, including, but not limited to, physical and developmental health, mental health, dementia, SUD, LTSS, oral health, palliative care, necessary community- based and social services, and housing; v. Ensuring the care plan is reassessed at a frequency appropriate for the Member’s individual progress or changes in needs and/or as identified in the Care Management Plan; and vi. Ensuring the Care Management Plan is reviewed, maintained and updated under appropriate clinical oversight c. Enhanced Coordination of Care, which shall include, but is not limited to: i. Organizing patient care activities, as laid out in the Care Management Plan, sharing information with those involved as part of the Member’s multi-disciplinary care team, and implementing activities identified in the Member’s Care Management Plan; ii. Maintaining regular contact with all Providers, that are identified as being a part of the Member’s multi-disciplinary care team, who’s input is necessary for successful implementation of Member goals and needs; iii. Ensuring care is continuous and integrated among all service Providers and referring to and following up with primary care, physical and developmental health, mental health, SUD treatment, LTSS, oral health, palliative care, and necessary community-based and social services, including housing, as needed; iv. Providing support to engage the Member in their treatment, including coordination for medication review and/or reconciliation, scheduling appointments, providing appointment reminders, coordinating transportation, accompaniment to critical appointments, and identifying and helping to address other barriers to Member engagement in treatment; v. Communicating the Member’s needs and preferences timely to the Member’s multi-disciplinary care team in a manner that ensures safe, appropriate, and effective person-centered care; and vi. Ensuring regular contact with the Member and their family member(s), Authorized Representative, guardian, caregiver, and/or authorized support person(s), when appropriate, consistent with the care plan. d. Health Promotion, which shall adhere to federal care coordination and continuity of care requirements (42 CFR 438.208(b)) and shall include, but is not limited to: i. Working with Members to identify and build on successes and potential family and/or support networks; ii. Providing services to encourage and support Members to make lifestyle choices based on healthy behavior, with the goal of supporting Members’ ability to successfully monitor and manage their health; and iii. Supporting Members in strengthening skills that enable them to identify and access resources to assist them in managing their conditions and preventing other chronic conditions. e. Comprehensive Transitional Care, which shall include, but is not limited to:

E-7 MCMCP ECM/CS Prv Agreement 2021 v1.8
i. Developing strategies to reduce avoidable Member admissions and readmissions across all Members receiving ECM; ii. For Members who are experiencing, or who are likely to experience a care transition: 1. Developing and regularly updating a transition of care plan for the Member; 2. Evaluating a Member’s medical care needs and coordinating any support services to facilitate safe and appropriate transitions from and among treatment facilities, including admissions and discharges; 3. Tracking each Member’s admission and/or discharge to or from an emergency department, hospital inpatient facility, skilled nursing facility, residential or treatment facility, incarceration facility, or other treatment center and communicating with the appropriate care team members; 4. Coordinating medication review/reconciliation; and 5. Providing adherence support and referral to appropriate services. f. Member and Family Supports, which shall include, but are not limited to: i. Documenting a Member’s designated family member(s), AR, guardian, caregiver, and/or authorized support person(s) and ensuring all appropriate authorizations are in place to ensure effective communication between the ECM Providers, the Member and/or their family member(s), guardian, caregiver, and/or authorized support person(s) and Anthem, as applicable; ii. Activities to ensure the Member and/or their family member(s), AR, guardian, caregiver, and/or authorized support person(s) are knowledgeable about the Member’s condition(s) with the overall goal of improving the Member’s care planning and follow-up, adherence to treatment, and medication management, in accordance with Federal, State and local privacy and confidentiality laws; iii. Ensuring the Member’s ECM Provider serves as the primary point of contact for the Member and/or family member(s), AR, guardian, caregiver, and/or authorized support person(s); iv. Identifying supports needed for the Member and/or their family member(s), AR, guardian, caregiver, and/or authorized support person(s) to manage the Member’s condition and assist them in accessing needed support services; v. Providing for appropriate education of the Member and/or their family member(s), AR, guardian, caregiver, and/or authorized support person(s) about care instructions for the Member; and vi. Ensuring that the Member has a copy of their Care Plan and information about how to request updates. g. Coordination of and Referral to Community and Social Support Services, which shall include, but are not limited to: i. Determining appropriate services to meet the needs of Members, including services that address SDOH needs, including housing, and services offered by Anthem as CS; and ii. Coordinating and referring Members to available community resources and following up with Members to ensure services were rendered (i.e., “closed loop referrals”). X. Subcontracting 1. ECM Provider may subcontract with other entities or individuals in order to fulfill the obligations of ECM. Provider shall maintain policies and procedures, approved by Anthem, to ensure that Subcontractors fully comply with all terms and conditions of this Agreement, applicable regulations and DHCS regardless of sub-contracting arrangements, Provider retains overall responsibility for all duties outlined in this agreement. 2. If the ECM Provider subcontracts with other entities to administer ECM functions, the ECM Provider shall ensure agreements with each entity bind the entities to the terms and conditions set forth here E-8 MCMCP ECM/CS Prv Agreement 2021 v1.8
and that its Subcontractors comply with all requirements in these Standardized Terms and Conditions and the DHCS-MCP ECM CS Contract. 3. If the ECM Provider subcontracts, the Provider shall be responsible for all required reporting and coordination. 4. ECM Provider will disclose its subcontracting relationship to Anthem, and demonstrate subcontractor readiness 5. Anthem reserves the right to allow or disallow a Provider’s subcontractor XI. Delegation 1. When determined as necessary and appropriate through the Anthem Provider evaluation process, Anthem may delegate certain responsibilities to other providers, community-based organizations, or internal teams until it is determined that the Provider is ready to take on said responsibility. XII. Training 1. ECM Providers shall participate in all mandatory, Provider-focused ECM training and technical assistance provided by Anthem, including in-person sessions, webinars, and/or calls, as necessary. 2. Refer to the Anthem ECM Provider Guide, Training and technical assistance, for more details. XIII. Data Sharing to Support ECM 1. Anthem will provide to ECM Provider the following data at the time of assignment and periodically thereafter, and following DHCS and Anthem guidance for data sharing where applicable: a. Member assignment files, defined as a list of Medi-Cal Members authorized for ECM and assigned to the ECM Provider; b. Encounter and/or claims data; c. Physical, behavioral, administrative and SDOH data (e.g., Homeless Management Information System (HMIS data)) for all assigned Members; and d. Reports of performance on quality measures and/or metrics, as requested. 2. Refer to the Anthem ECM Provider Guide, Data exchange, for more details. XIV. Quality and Oversight 1. ECM Provider acknowledges that Anthem will conduct oversight of its participation in ECM to ensure the quality of ECM and ongoing compliance with program requirements, which may include site visits, audits and/or corrective actions. 2. ECM Provider shall respond to all Anthem requests for information and documentation to permit ongoing monitoring of ECM. 3. Program (e.g., ECM Director) and organization-level (e.g. CFO) leadership shall, at a minimum, attend bi-annual Performance Review meetings. 4. Provider shall comply with applicable monitoring provisions of the contract between Anthem and DHCS and any monitoring request by DHCS. Further, Provider agrees that Anthem shall revoke the delegation of activities or obligations, or specific other remedies in instances where DHCS or Anthem determine that Provider has not performed satisfactorily. 5. Refer to the Anthem ECM Provider Guide, Quality, monitoring and oversight, for more details.

E-9 MCMCP ECM/CS Prv Agreement 2021 v1.8
Community Supports I. Service Overview1. Community Supports are voluntary, flexible wrap-around services or settings providedby the Anthem and integrated into its population health management programs. The services areprovided as a substitute for utilization of other services or settings such as a hospital or skillednursing facility admission, discharge delays, or emergency department use. CS will be integratedwith care management for Members at medium to high levels of risk and fill gaps in state planbenefits to address medical or other needs that may arise from social determinants ofhealth. See Exhibit B for in scope Community Supports.II. CS Provider Requirements Provider Experience and Qualifications1. Experience and training in the elected CS.a. The CS Provider shall have experience and/or training in the Provision of the CS beingoffered.b. The CS Provider shall have the capacity to provide the CS in a culturally and linguisticallycompetent manner, as demonstrated by a successful history of providing such services,training or other factors identified by Anthem.2. If the CS Provider subcontracts with other entities to administer its functions of CS, the CSProvider shall ensure agreements with each entity bind each entity to applicable terms andconditions set forth here.3. The CS provider will perform all services as outlined in the Anthem CS Program Guide and in theDHCS CS Policy Guide.4. Contracted ECM Providers who are also contracted CS Providers should provide separate anddistinct ECM and CS services to authorized membersIII. Medicaid Enrollment/Vetting for CS Providers1. CS Providers for whom a State-level enrollment pathway exists, shall enroll in Medi-Cal, pursuantto relevant DHCS APLs including Provider Credentialing/Recredentialing andScreening/Enrollment APL 19-004.a. If APL 19-004 does not apply to an CS Provider, the CS Provider will comply with Anthem’sprocess for vetting the CS Provider, which may extend to individuals employed by ordelivering services on behalf of the CS Provider, to ensure it can meet the capabilities andstandards required to be an CS Provider.IV. Initiating Delivery of Community Supports1. CS Provider shall deliver contracted CS in accordance with DHCS service definitions andrequirements.2. CS Provider shall maintain staffing that allows for timely, high-quality service delivery of the CSthat it is contracted to provide.3. CS Provider shall:a. Accept and act upon member referrals from Anthem for authorized CS, unless the CSProvider is at its pre-determined capacity;i. Provider shall be permitted to decline a Member assignment if CS Provider is at its pre- determined capacity. ii. Provider shall immediately alert Anthem if it does not have the capacity to accept aMember assignment.b. Conduct outreach to the referred Member for authorized CS as soon as possible.Including by making best efforts to conduct initial outreach within 24 hours of assignment,if applicable;c. Be responsive to incoming calls or other outreach from Members, including by maintaininga phone line that is staffed or able to record voicemail 24 hours a day, 7 days a week;d. Coordinate with other Providers in the Member’s care team, including ECM Providers,other CS Providers and Anthem;e. Comply with cultural competency and linguistic requirements required by federal, State,and local laws, and in contract(s) with Anthem; and E-10 MCMCP ECM/CS Prv Agreement 2021 v1.8
f. Comply with non-discrimination requirements set forth in State and Federal law and theContract with Anthem.g. CS Provider will be reimbursed only for services that are authorized by Anthem. In theevent of a Member requesting services not yet authorized by Anthem, CS Provider shallsend prior authorization request(s) to Anthem, unless a different agreement is in place(e.g., if Anthem has given the CS Provider authority to authorize CS directly).4. When federal law requires authorization for data sharing, CS Provider shall obtain and/ordocument such authorization from each assigned Member, including sharing of protected healthinformation (PHI), and shall confirm it has obtained such authorization to Anthem.a. Member authorization for CS-related data sharing is not required for the CS Provider toinitiate delivery of CS unless such authorization is required by federal law.5. If an CS is discontinued for any reason, CS Provider shall support transition planning for theMember into other programs or services that meet their needs.6. CS Provider is encouraged to identify additional CS the Member may benefit from and send anyadditional request(s) for CS to Anthem for authorization.V. Payment for CS1. CS Provider shall record, generate, and send a claim or invoice to Anthem for CS rendered.a. If CS Provider submits claims, CS Provider shall submit claims to Anthem usingspecifications based on national standards and codes set to be defined by DHCS.b. In the event CS Provider is unable to submit claims to Anthem for CS-related servicesusing specifications based on national standards or DHCS defined standardspecifications code sets, CS Provider shall submit invoices with minimum necessary dataelements defined by DHCS, which includes information about the Member, the CSservices rendered, and CS Providers’ information to support appropriate reimbursementby Anthem, that will allow Anthem to convert CS invoice information into DHCS-definedstandard specifications and code sets for submission to DHCS.2. CS Provider shall not receive payment from Anthem for the provision of any CS not authorized byAnthem.3. CS Provider must have a system in place to accept payment from Anthem for CS rendered.a. Anthem will adjudicate Clean Claims submitted by Provider within thirty (30) working daysof the date Anthem receives the claim. For purposes of determining compliance with thestated time frames, the date of receipt is the date that Anthem receives the claim, asindicated by its date stamp on the claim. The date of payment is the date of the check orother form of payment.VI. Data Sharing to Support CS1. As part of the referral process, Anthem will ensure CS Provider has access to:a. Demographic and administrative information confirming the referred Member’s eligibility forthe requested service;b. Appropriate administrative, clinical, and social service information the CS Provider mightneed in order to effectively provide the requested service; andc. Billing information necessary to support the CS Provider’s ability to submit invoices toAnthem.2. Refer to the Anthem CS Provider Guide for more details.VII. Quality and Oversight1. CS Provider acknowledges Anthem will conduct oversight of its delivery of CS to ensure thequality of services rendered and ongoing compliance with all legal and contractual obligationsboth Anthem and the CS Provider have, including but not limited to, required reporting, audits,and corrective actions, among other oversight activities.VIII. Electronic Visit Verification (EVV)1. EVV must be implemented for all Medi-Cal Personal Care Services (PCS) and Home Health CareServices (HHCS) for in-home visits by a Provider. This includes, but is not limited to, PCS and E-11 MCMCP ECM/CS Prv Agreement 2021 v1.8
HHCS delivered as part of Community Supports – Personal Care and Homemaker Services, Respite Services, Day Habilitation Programs – and all other HHCS programs covered under the contract between DHCS and Anthem. Implementation of EVV is only required for PCS and HHCS delivered in a member’s home, including visits that begin in the community and end in the home (or vice versa). 2. Exclusions: a. The following services are not subject to EVV requirements: 1. HHCS or PCS that do not require an in-home visit are not subject to EVV requirements; 2. HHCS or PCS provided in congregate residential settings where 24-hour service is available are not subject to the EVV requirements; 3. HHCS or PCS rendered by an individual living in the member’s residence does not constitute an “in-home visit” and is not subject to EVV requirements, 4. Any services rendered through the Program of All-Inclusive Care for the Elderly; 5. HHCS or PCS that are provided to inpatients or residents of a hospital, nursing facility including skilled nursing facility or residence of nursing facility, intermediate care facility for individuals with intellectual disabilities, or an institution for mental diseases; 6. Durable Medical Equipment is not subject to EVV requirements. 3. State EVV Vendor: a. The State of California contracted with Sandata Technologies, LLC (Sandata) to provide a state-sponsored EVV system. Sandata is providing California with an EVV system that includes the ability to capture data elements during the visit, data portals that allow providers to view and report on visit activity, and an EVV Aggregator to provide California with EVV program oversight and analytics. The EVV Aggregator will also receive data from providers that choose to use their existing EVV system, support California’s Open EVV model, and provide a meaningful data and analytics dashboard. Additionally, training videos for the Aggregator and the Business Intelligence tool will be available online, which demonstrate functionality and capabilities. b. Anthem is not required to use the state-contracted EVV system. However, use of the Sandata EVV system is free to Anthem, and their subcontractors and network providers, to use for capturing and transmitting required EVV data components to the EVV Aggregator. If Anthem chooses to contract with a different EVV vendor, the resulting administrative service agreement must be filed with the Department of Managed Health Care. 4. All Medi-Cal PCS and HHCS providers must capture and transmit the following six mandatory data components: a. The type of service performed; b. The individual receiving the service; c. The date of the service; d. The location of service delivery; e. The individual providing the service; and f. The time the service begins and ends. 5. All network providers are required to comply with the EVV requirements when rendering PCS and HHCS, subject to federal EVV requirements. Anthem shall monitor provider to ensure compliance with these requirements in accordance with the established guidelines below: a. Monitor Provider for compliance with the EVV requirements and CalEVV Information Notice(s), and alert DHCS to any compliance issues. b. Supply Provider with technical assistance and training on EVV compliance. c. Require Provider to comply with an approved corrective action plan. d. Deny payment if the provider is not complying with EVV requirements and arrange for the participants to receive services from a provider who does comply. 6. If Provider is identified as non-compliant with these requirements, Anthem will not authorize the Network Provider to perform services and/or withhold the payment. If non-compliance is committed by the employee of Provider’s subcontractor, the specific non-compliant subcontractor employee will not be able to provide Medi-Cal PCS and HHCS services. 7. EVV System – Provider Self-Registration and Training E-12 MCMCP ECM/CS Prv Agreement 2021 v1.8
a. To the extent that Provider provides Community Supports – Personal Care and HomemakerServices, Respite Services, and Day Habilitation Programs, Anthem requires that theirProvider and its subcontractors complete the self-registration process immediately to gainaccess to the state-sponsored EVV system and EVV Aggregator and be trained on how tooperate the solution, and capture the six data elements with each in-home visit.1. Once registered, Provider and Provider’s subcontractors will gain access to extensivetraining and technical assistance, including self-guided learning modules and EVVsystem demonstrations, provided by Sandata.b. Information on the self-registration portal and the link can be found on the DHCS website at:https://www.dhcs.ca.gov/provgovpart/Pages/EVV.aspx8. Alternate EVV System:a. Anthem and its network have the option to implement EVV requirements using an alternateEVV system.b. Any alternate EVV system must comply with all business requirements and technicalspecifications, including the ability to capture and transmit the required data elements to theEVV Aggregator.c. Anthem, its subcontractors, and network providers who choose to use an alternative EVVsystem are required to register in the EVV self-registration portal and must participate instate-sponsored training provided by Sandata.9. All claims submitted by Provider for PCS and HHCS services must be submitted with allowableCurrent Procedural Terminology or Healthcare Common Procedure Coding System codes asoutlined in the Medi-Cal Provider Manual. MCPs and/or provider must also indicate proper Placeof Service Code or Revenue Code on claims and/or encounters to indicate the rendering of PCSor HHCS in a member’s home.10. DHCS will monitor Anthem’s’ implementation through existing data reporting mechanisms,including reviewing encounter data and will include EVV implementation and requirements in thescope of the annual medical audit.

BUSINESS ASSOCIATE AGREEMENT If, during the term of any Agreement between Supplier and Anthem, Inc. and/or any of its affiliates (“Anthem”), Supplier requires the use or disclosure of Protected Health Information, including creating, receiving, maintaining, or transmitting Protected Health Information, then Supplier shall be deemed a Business Associate of Anthem and the following provisions shall apply: This agreement (“Agreement”) shall be effective on the date of Supplier’s signature and is between the Supplier (“Business Associate”) identified in this Agreement and Anthem on behalf of itself and its affiliates who are Covered Entities or Business Associates and who have a business relationship with Business Associate, if any (hereinafter collectively “Company”). The purpose of this Agreement is to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations (45 C.F.R. Parts 160-164, including Subpart E of 45 CFR Part164) ("HIPAA"), any applicable state privacy laws, any applicable state security laws, any applicable implementing regulations issued by the Insurance Commissioner or other regulatory authority over data protected herein. Privacy of Protected Health Information 1. Permitted and Required Uses and Disclosures. Business Associate is permitted or required to Useor disclose Protected Health Information (“PHI”) it requests, creates, or receives for or fromCompany (or another business associate of Company) only as follows:a) Functions and Activities on Company’s Behalf. Business Associate is permitted to request,Use, or disclose PHI it creates or receives for or from Company (or another business associate ofCompany), consistent with HIPAA, only as described in this Agreement, or other agreementsduring their term that may exist between Company and Business Associate.b) Business Associate’s Operations. Business Associate may Use PHI it creates or receives foror from Company as necessary for Business Associate’s proper management and administration orto carry out Business Associate’s legal responsibilities. Business Associate may disclose such PHIas necessary for Business Associate’s proper management and administration or to carry outBusiness Associate’s legal responsibilities only if:(i) The Disclosure is Required by Law; or(ii) Business Associate obtains reasonable assurance evidenced by written contract, fromany person or organization to which Business Associate will disclose such PHI that theperson or organization will:a. Hold such PHI in confidence and Use or further disclose it only for thepurpose for which Business Associate disclosed it to the person or organization orRequired by Law; andb. Notify Business Associate (who will in turn promptly notify Company) of anyinstance of which the person or organization becomes aware in which theconfidentiality of such PHI was breached.c) Data Aggregation Services. Business Associate may provide Data Aggregation servicesrelating to the Health Care Operations of the Company the extent required to provide services toCompany or as otherwise expressly permitted by Company.Housing for Health OC, INC., DBA " Housing for Health

d) Minimum Necessary and Limited Data Set. In any instance when Business Associaterequests, Uses, or discloses PHI under this Agreement or in accordance with other agreementsthat exist between Company and Business Associate, Business Associate may request, Use ordisclose only the minimum amount of PHI necessary to accomplish the intended purpose. BusinessAssociation will Use a Limited Data Set, if applicable. Business Associate will not be obligated tocomply with this minimum necessary limitation with respect to requests, Uses, or discloses asoutlined in 45 C.F.R. § 164.502(b)(2).e) Use by Workforce. Business Associate shall advise members of its workforce of theirobligations to protect and safeguard PHI. Business Associate shall take appropriate disciplinaryaction against any member of its workforce who Uses or discloses PHI in contravention of thisAgreement.f) Disclosure to U.S. Department of Health and Human Services. Business Associate shall makeits internal practices, books, and records relating to the Use and Disclosure of PHI received fromCompany (or created or received by Business Associate on behalf of Company) available to theSecretary of the United States Department of Health and Human Services, for purposes ofdetermining Company’s compliance with 45 C.F.R. Parts 160-164. Unless the Secretary directsotherwise, Business Associate shall promptly notify Company of Business Associate’s receipt ofsuch request, so that Company can assist in compliance with that request.g) Substance Use Disorder Records. To the extent that PHI exchanged between the partiesincludes information on an individual's Substance Use Disorder, the parties agree to comply with theapplicable requirements of 42 C.F.R. Part 2 ("Confidentiality of Substance Use Disorder PatientRecords") including its provisions on disclosure and re-disclosure of said information.2. Prohibitions on Unauthorized Requests, Use or Disclosure. Business Associate will neither Use nordisclose Company’s PHI it creates or receives from Company or from another Business Associateof Company, except as permitted or required by this Agreement or as Required by Law or asotherwise permitted in writing by Company. This Agreement does not authorize Business Associateto request, Use, disclose, maintain or transmit PHI in a manner that will violate 45 C.F.R. Parts 160-164.3. Sub-Contractors and Agents. Business Associate will require any of its Subcontractors and/oragents that create, receive, maintain, or transmit such PHI to provide reasonable assurance,evidenced by written contract, that Subcontractor or agent will comply with the same privacy andsecurity commitments that are substantively equivalent to those in this Agreement with respect tosuch PHI, including the obligations described in Section 4 herein.4. Information Safeguards. Business Associate must use appropriate safeguards to comply withSubpart C of 45 CFR Part 164 and must implement, maintain and use a written information securityprogram that contains the necessary administrative, technical and physical safeguards that areappropriate in light of the Business Associate’s size and complexity in order to achieve thesafeguarding objectives as detailed in Social Security Act § 1173(d) (42 U.S.C. § 1320d-2(d)), 45C.F.R. Part 164.530(c), the HITECH Act and any other implementing regulations issued by the U.S.Department of Health and Human Services, as such may be amended from time to time and asrequired by the Required Information Security Controls exhibit attached to this agreement. Further,Business Associate shall comply with any applicable state data privacy or security law. BusinessAssociate shall notify Company should Business Associate determine it is unable to comply with anysuch law or regulation.Housing for Health OC, INC., DBA " Housing for Health

5. Audits and Surveys. Company shall have the right to audit and monitor all applicable activities andrecords of Business Associate to determine Business Associate’s compliance with the requirementsrelating to the maintenance, Use, Disclosure, and creation of PHI [and De-Identified Data (DID),if applicable]. At Company's request in lieu of a formal audit, the Business Associate shall provideCompany with information concerning its information safeguards and privacy practices as theypertain to PHI.During the term of this Agreement, Business Associate may be asked to complete a privacy andsecurity survey and/or attestation document designed to assist Covered Entity in understanding anddocumenting Business Associate’s security procedures and compliance with the requirementscontained herein. Business Associate’s failure to complete either of these documents within thereasonable timeframe specified by Covered Entity shall constitute a material breach of thisAgreement.Upon reasonable advance request, Business Associate shall provide Company access to BusinessAssociate’s facilities used for the maintenance or processing of PHI, and to its books, records,practices, policies and procedures concerning the Use and Disclosure of PHI, in order to determineBusiness Associate’s compliance with this Agreement. Any such access to Business Associatefacilities may be limited to the extent required to protect other entities' PHI or confidential information.Individual Rights 6. Access. Business Associate will promptly upon Company’s request make available to Companyor, at Company’s direction, to the Individual (or the Individual’s Personal Representative) forinspection and obtaining copies any PHI about the Individual which Business Associate created orreceived for or from Company and that is in Business Associate’s custody or control, so thatCompany may meet its access obligations pursuant to and required by applicable law, including butnot limited to 45 C.F.R. 164.524, and where applicable, the HITECH Act. Business Associate shallmake such information available in electronic format where directed by the Company.7. Amendment. Business Associate will, upon receipt of notice from Company, promptly amend orpermit Company access to amend any portion of the PHI which Business Associate created orreceived for or from Company, pursuant to and required by applicable law, including but not limitedto 45 C.F.R. Part 164.526.Business Associate will not respond directly to an Individual’s request for an amendment of theirPHI held in the Business Associate’s Designated Record Set. Business Associate will refer theIndividual to Company so that Company can coordinate and prepare a timely response to theIndividual.8. Disclosure Accounting. So that Company may meet its Disclosure accounting obligationspursuant to and required by applicable law, including but not limited to 45 C.F.R. Part 164.528Business Associate will promptly, but no later than within seven (7) days of the Disclosure, reportto Company for each Disclosure Business Associate makes of Company PHI not expresslyexcepted from the right to an accounting as described in 45 CFR 164.528(a)(1)(i)-(ix). Foreach Disclosure for which a report is required by this section, Business Associate will provide thefollowing information as described in 45 CFR 164.528(b).Except as provided below, Business Associate will not respond directly to an Individual’s requestfor an accounting of Disclosures. Business Associate will refer the Individual to Company so thatHousing for Health OC, INC., DBA " Housing for Health

Company can coordinate and prepare a timely accounting to the Individual. However, when Business Associate is contacted directly by an individual based on information provided to the individual by Company, Business Associate shall make the accounting of disclosures available directly to the individual, but only if required by the HITECH Act or any related regulations. 9. Confidential Communications and Restriction Agreements. Business Associate will promptly, uponreceipt of notice from Company, send an Individual’s communications to the identified alternateaddress. Business Associate will comply with any agreement Company makes that restricts Use orDisclosure of Company’s PHI pursuant to 45 C.F.R. §164.522(a), provided that Company notifiesBusiness Associate in writing of the restriction obligations that Business Associate must follow.Company will promptly notify Business Associate in writing of the termination or modificationof any confidential communication requirement or restriction agreement.Breach of Privacy and Security Obligations 10. Reporting. Business Associate will report to Company: (i) any Use or Disclosure of PHI notpermitted by this Agreement or in writing by Company; (ii) any Security Incident; (iii) any Breach, asdefined in the HITECH Act; or (iv) any other breach of a secure system, or the like, as such may bedefined under applicable state law (collectively a “Breach”). Except as described in subparagraph“c)” below, Business Associate will, without unreasonable delay, but no later than within one (1 )business day after Business Associate’s discovery of a Breach, make the report by sending areport to Company by such reasonable means of reporting as may be communicated to BusinessAssociate by Company. Business Associate shall cooperate with Company in investigating theBreach and in meeting Company’s obligations under the HITECH Act, and any other applicablesecurity breach notification laws or regulatory obligations.a) Report Contents. To the extent such information is available Business Associate’s report will atleast:(i) Identify the nature of the non-permitted or prohibited access, Use or Disclosure,including the date of the Breach and the date of discovery of the Breach;(ii) Identify the PHI accessed, used or disclosed, and provide an exact copy or replicationof the PHI, as appropriate, in a format reasonably requested by Company, and to theextent available;(iii) Identify the entity that and if applicable, the role of the individual, who caused the Breach andwho received the PHI;(iv) Identify what corrective action Business Associate took or will take to prevent furtherBreaches;(v) Identify what Business Associate did or will do to mitigate any deleterious effect of theBreach; and(vi) Provide such other information, including a written report, as Company may reasonablyrequest.b) Unsuccessful Security Incidents. Except as noted in paragraph 10 (c) below, the partiesacknowledge and agree that this section constitutes notice by Business Associate to Company ofthe ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as definedHousing for Health OC, INC., DBA " Housing for Health

below) for which no additional notice to Company shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, Use or disclosure of PHI. c) Medicare Vendor Reporting Requirements –To the extent that Business Associate is subject toany Center for Medicare and Medicaid (“CMS”) incident reporting requirements (including applicabletimeframes for such reporting) as detailed in the services agreement between Company andBusiness Associate (including any amendments, exhibits or addenda), Business Associate shallcomply with all such reporting requirements, in addition to those imposed hereby.11. Mitigation. Business Associate agrees to mitigate to the extent practicable, any harmful effect that isknown to Business Associate of any security incident related to PHI or any Use or Disclosure of PHIby Business Associate in violation of the requirements of this BA Agreement. To the extentCompany incurs any expense Company reasonably determines to be necessary to mitigate anyBreach or any other non-permitted Use or Disclosure of Individually Identifiable Information,Business Associate shall reimburse Company for such expense.12. Breach of Agreement. Without limiting the rights of the parties elsewhere set forth in the Agreementor available under applicable law, if Business Associate breaches its obligations under thisAgreement, Company may, at its option:a) Exercise any of its rights of access and inspection under paragraph 4 of thisAgreement;b) Require Business Associate to submit to a plan of monitoring and reporting, as Company maydetermine appropriate to maintain compliance with this Agreement and Company shall retain theright to report to the Secretary of HHS any failure by Business Associate to comply with suchmonitoring and reporting; orc) Immediately and unilaterally, terminate this Agreement and/or any other agreements betweenthe parties, without penalty to Company, and with or without an opportunity to cure the breach.Company’s remedies under this Section and set forth elsewhere in this Agreement or in any otheragreement between the parties shall be cumulative, and the exercise of any remedy shall notpreclude the exercise of any other. If for any reason Company determines that BusinessAssociate has breached the terms of this Agreement and such breach is not curable or if curable,has not been cured, but Company determines that termination of this Agreement and/or anyother agreements between the parties is not feasible, Company may report such breach to the U.S.Department of Health and Human Services.Compliance with Standard Transactions Sections 13 through 17 of this Agreement are only applicable to those Business Associates that conduct, in whole or in part Standard Transactions, for or on behalf of Company. 13. Business Associate will comply, and will require any Subcontractor or agent involved with theconduct of such Standard Transactions to comply, with each applicable requirement of 45 C.F.R.Part 162 for which HHS has established Standards. Business Associate will comply by a mutuallyagreed date, but no later than the date for compliance with all applicable final regulations, and willrequire any Subcontractor or agent involved with the conduct of such Standard Transactions, toHousing for Health OC, INC., DBA " Housing for Health

comply, with each applicable requirement of the Transaction Rule 45 C.F. R. Part 162. Business Associate agrees to demonstrate compliance with the Transactions by allowing Company to test the Transactions and content requirements upon a mutually agreeable date. Business Associate will not enter into, or permit its Subcontractors or agents to enter into, any trading partner agreement in connection with the conduct of Standard Transactions for or on behalf of Company that: a) Changes the definition, data condition or use of a data element or segment in a StandardTransaction.b) Adds any data elements or segments to the maximum defined data set;c) Uses any code or data element that is marked “not used” in the Standard Transaction’sImplementation Specification or is not in the Standard Transaction’s Implementation Specification;ord) Changes the meaning or intent of the Standard Transaction’s Implementation Specification.14. Concurrence for Test Modification to Standard Transactions. Business Associate agrees andunderstands that there exists the possibility that Company or others may request from HHS anexception from the Uses of a Standard in the HHS Transaction Standards. If this request is grantedby HHS, Business Associate agrees that it will participate in such test modification.15. Incorporation of Modifications to Standard Transactions Business Associate agrees andunderstands that from time-to-time, HHS may modify and set compliance dates for the TransactionStandards. Business Associate agrees to incorporate by reference into this Agreement any suchmodifications or changes.16. Code Set Retention (Only for Plans). Both parties understand and agree to keep open code setsbeing processed or used in the Agreement for at least the current billing period or any appealperiod, whichever is longer.17. Guidelines and Requirements. Business Associate further agrees to comply with any guidelines orrequirements adopted by Company consistent with the requirements of HIPAA and any regulationspromulgated thereunder, governing the exchange of information between Business Associate andthe Company.Obligations upon Termination 18. Return or Destruction. Upon termination, cancellation, expiration or other conclusion of theAgreement, Business Associate will if feasible return to Company or destroy all PHI, in whateverform or medium (including in any electronic medium under Business Associate’s custody orcontrol), that Business Associate created or received for or from Company, including all copies ofand any data or compilations derived from and allowing identification of any Individual who is asubject of the PHI. Business Associate will complete such return or destruction as promptly aspossible, but not later than 30 days after the effective date of the termination, cancellation,expiration or other conclusion of Agreement. Business Associate shall destroy all PHI in accordancewith any guidance set forth by the Secretary of HHS and/or any other government agency orother entity to whom HHS delegates such authority Business Associate will identify any PHI thatBusiness Associate created or received for or from Company that cannot feasibly be returned toCompany or destroyed, and will limit its further Use or Disclosure of that PHI to those purposes thatmake return or destruction of that PHI infeasible and will otherwise continue to protect theHousing for Health OC, INC., DBA " Housing for Health

security any PHI that is maintained pursuant to the security provisions of this Agreement for so long as the PHI is maintained. Upon request, Business Associate will certify in writing to Company that such return or destruction has been completed, will deliver to Company the identification of any PHI for which return or destruction is infeasible and, for that PHI, will certify that it will only Use or disclose such PHI for those purposes that make return or destruction infeasible. 19. Continuing Privacy and Security Obligation. Business Associate’s obligation to protect theprivacy and security of the PHI it created or received for or from Company will be continuous andsurvive termination, cancellation, expiration or other conclusion of this Agreement, so long as thedata is maintained.General Provisions 20. Definitions. Except as otherwise provided, the capitalized terms in this Agreement have themeanings set out in 45 C.F.R. Parts 160-164, as may be amended from time to time. The termProtected Health Information (“PHI”) includes any information without regard to its form or medium,gathered by Business Associate in connection with Business Associate’s relationship with CoveredEntity that identifies an individual or that otherwise would be defined as Protected Health Informationunder HIPAA. The term "business associate" in lower case shall have the meaning set out in 45 CFR160.103.21. Amendment. From time to time local, state or federal legislative bodies, boards, departments oragencies may enact or issue laws, rules, or regulations pertinent this Agreement. In such event,Business Associate agrees to immediately abide by all said pertinent laws, rules, or regulations andto cooperate with Company to carry out any responsibilities placed upon Company or BusinessAssociate by said laws, rules, or regulations.22. Conflicts. The terms and conditions of this Agreement will override and control any conflicting term orcondition of any other agreement between the parties with respect to the subject matter herein. Allnon-conflicting terms and conditions of the said other agreement(s) remain in full force andeffect.23. Owner of PHI. As between the parties, Company is the exclusive owner of PHI generated orused under the terms of the Agreement.24. Subpoenas. Business Associate will promptly inform Company of any subpoena Business Associatereceives with regard to PHI belonging to Company and cooperate with any Company request or effortto limit Disclosure pursuant to such subpoena.25. Disclosure of De-identified Data. The process of converting PHI to De-identified Data (DID) is setforth in 45 C.F.R Part 164.514. In the event that Company provides Business Associate with DID,Business Associate shall not be given access to, nor shall Business Associate attempt to developon its own, any keys or codes that can be used to re-identify the data. Business Associate shallonly Use DID as directed by Company.26. Creation of De-identified Data. In the event Business Associate wishes to convert PHI to DID, itmust first subject its proposed plan for accomplishing the conversion to Company for Company’sapproval, which shall not be unreasonably withheld provided such conversion meets therequirements of 45 C.F.R. Part 164.514. Business Associate may only Use DID as directed orotherwise agreed to by Company.Housing for Health OC, INC., DBA " Housing for Health

27. Assignment/Subcontract. Company shall have the right to review and approve any proposedassignment or subcontracting of Business Associate’s duties and responsibilities arising under theAgreement, as it relates to the Use or creation of PHI (or DID if applicable].28. Intent. The parties agree that there are no intended third party beneficiaries under this Agreement.29. Indemnity. Business Associate will indemnify and hold harmless Company and any Companyaffiliate, officer, director, employee or agent from and against any claim, cause of action, liability,damage, cost or expense, including attorneys’ fees and court or proceeding costs, arising out of orin connection with any non-permitted or prohibited Use or Disclosure of PHI or other breach of thisAgreement by Business Associate or any Subcontractor, agent, person or entity under BusinessAssociate’s control.IN WITNESS WHEREOF, Company and Business Associate execute this Agreement in multipleoriginals to be effective on the date of Business Associate’s Signature below:AnthemName of Business Associate Name of CompanyBy: By:Signature SignaturePrinted Name Printed NameTitle TitleDate Date Name
of
Business
As
SignatureHeather StratmanChief Administrative Officer12/11/2024 Housing for Health OC, INC., DBA " Housing for Health
Housing for Health OC. DBA Housing for Health

BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 1 Required Information Security Controls Exhibit As part of Anthem’s commitment to the protection of Confidential Information, Anthem has established its information security requirements for its suppliers as outlined in this Required Information Security Controls Exhibit (“Exhibit”). The Exhibit shall be effective as of the date the party identified in the attached Agreement (herein “Supplier”) first receives, maintains, transmits, accesses or otherwise comes into contact with Anthem Confidential Information. These requirements are intended to describe the minimum standard for physical, technical, and administrative controls affecting Confidential Information in relation to the services Anthem has retained Supplier to provide (herein “Services”). To the extent that any information security control in this Exhibit conflicts with the Agreement or any other writing between the parties, the most restrictive control applies. Anthem may suspend access to Anthem systems at any time if Anthem in its sole discretion, believes Supplier is not complying with any of its security commitments or if Anthem otherwise determines such suspension is necessary to protect the confidentiality, integrity or availability of Anthem Confidential information. Definitions Anthem Confidential Information (or Confidential Information), as may be defined in underlying agreements, is further clarified for purposes of this Exhibit to mean any data that is subject to applicable state and federal data security and privacy laws, regulations and guidance, including personally identifiable information and protected health information and any data that contains Anthem trade secrets, proprietary, competitive or sensitive information or systems information that could negatively impact Anthem if made public. Clean Room. A work environment where devices that may capture information by visual (e. g. camera or smart phone), audio (e.g. recorder, cell phone or smart phone), data transfer (e.g. memory stick, laptop, smart phone, tablet, etc.) or any other method and physically or electronically transport the information out of the work environment by unapproved methods are prohibited from entering the work environment. Devices that may capture data, but are not capable of transporting the information out of the work environment other than by IT approved electronic methods, such as resident data processing devices, are permitted if approved by Anthem Information Technology. This standard is implemented through physical security controls on the work environment and guard force procedures. Event. Any observable occurrence in a system and/or network that may indicate than an incident is occurring or has occurred. Incident. An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 2

1. Compliance1.1. Supplier will comply with all applicable state and federal data security laws, regulations andguidance, and shall abide by all required security controls as stated herein, based upon the nature of the Services provided, the data involved, and/or the location where such Services are rendered. Supplier is responsible for understanding which state and federal laws apply to the Services and the data in scope for the agreement. 1.2. Supplier is responsible for its subcontractors. For subcontractors who collect, transmit, share, store, control, process, manage or access Anthem Confidential Information, Supplier is responsible for assessing and monitoring subcontractor control environments for compliance with Anthem’s standards as documented in this Exhibit. Supplier shall ensure that any of its subcontractors having access to Anthem Confidential Information or the systems that contain it shall also be contractually bound to meet or exceed these information security provisions. If Supplier becomes aware of its subcontractor non-compliance with the controls of this Exhibit, Supplier must require its subcontractor to remediate within five (5) business days. If non-compliance could reasonably be expected to lead to an Incident if not corrected or if the non-compliance is not corrected in 5 days, then Supplier will notify Anthem at [email protected]. 2. Information Security Program2.1. Supplier must maintain a written information security program including documented policies,standards, and operational practices that meet or exceed the requirements and controls set forth in this Exhibit to the extent applicable to the Services and identify an individual within the organization responsible for its enforcement. Supplier’s written information security program shall address, at a minimum, all security requirements as listed in this Exhibit, as amended from time to time, and comply with all state and federal data security and privacy laws applicable to Anthem. This documentation will be reviewed by Supplier’s security official, or its designee, at least annually and shall be updated periodically with changes to organization, technology, or Services. When implementing security controls Supplier shall take a risk-based approach. Any control exceptions which represent risk will be formally documented, monitored, and periodically reviewed. 2.1.1. Supplier’s written information security program shall be made available to and reviewed by Anthem or Anthem’s representative prior to Supplier having access to any Anthem Confidential Information. At Anthem’s request and at no cost to Anthem, Supplier shall make commercially reasonable modifications to its written information security program or to its data security controls to conform to the requirements set forth in this Exhibit, and Anthem reserves the right, in its sole discretion, to terminate Supplier’s access to Confidential Information until such time as Supplier has made such modifications to its written information security program or data security controls. Supplier shall notify Anthem of any changes to systems, facilities or written information security program controls affecting Anthem Confidential Information. This notification should set forth in detail how such changes - will impact Confidential Information. 2.2. Supplier shall apply appropriate sanctions against workforce members who fail to comply with security policies and procedures. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 3

2.3. Supplier shall maintain an Incident Response Program that includes processes and procedures in place so that information security Events will be reported through appropriate communications channels as quickly as possible. Such processes and procedures for Event reports must be tested, reviewed and updated, by Supplier periodically. All employees, contractors and third-party users shall be made aware of their responsibility to report any information security Events prior to being granted access to any Anthem Confidential Information. If at any time during the Agreement, Supplier becomes aware of an information security Incident, Supplier will promptly, and in no event later than 24 hours, notify the Anthem Cybersecurity Incident Response Team at [email protected]. 2.4. Supplier shall periodically conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of sensitive data (including Anthem Confidential Information). The assessment must be reviewed by Supplier’s security official and used to inform the Supplier’s information security program. 3. Right to Assess, Audit and Certify3.1. Upon request, Supplier shall complete a security controls assessment reasonably related toconfirming compliance with this Exhibit conducted by Anthem or its designated subcontractor (“Security Assessment”). Anthem may require additional Security Assessments in connection with Statements of Work for new or additional Services. To the extent that the Security Assessment identifies any risks or deficiencies for which remediation is required, such remediation requirements or compensating controls (and the timeframes within which they must be successfully implemented) will be set forth in a corrective action plan. Supplier’s failure to complete any remediation requirements set forth in a corrective action plan within the required timeframe shall be deemed to be a material breach of the Agreement. 3.2. Certification in the HITRUST Common Security Framework (CSF) is required. 3.2.1. If the Supplier has a HITRUST (HITRUST) Common Security Framework (CSF) Certification applicable to the Services and/or applications in scope for the engagement as of the effective date and maintains it throughout the engagement, then that HITRUST certification will be accepted in lieu of the remote questionnaire of the VSRM Assessment only. Documentary evidence for HITRUST CSF certification must be provided to Anthem upon request that includes, at a minimum, sections of the HITRUST CSF report that demonstrate Supplier’s scoring across all domains and any Corrective Action Plans required as a condition of certification. Anthem may ask questions specifically related to the protection of Anthem Confidential Information if needed after review of documentation supporting the HITRUST CSF Certification. Provided, however, that Supplier’s HITRUST Certification does not waive Anthem’s rights to assess under Section 3.1 of this Exhibit or other audit rights, including rights to onsite facility inspection, agreed upon in the Business Associate Agreement or elsewhere in the Agreement. 3.3. For Suppliers without a HITRUST CSF certification at the time of engagement. 3.3.1. Supplier shall (i) complete and provide to Anthem a HITRUST CSF Report no later than 90 days after the effective date and 3.3.2. Obtain and provide to Anthem a HITRUST CSF Validated Report no later than 18 months after the effective date; and 3.3.3. Obtain and provide to Anthem a HITRUST CSF certification and associated documentation, including but not limited to complete validated reports and corrective action plans, no later than 24 months after the effective date. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 4

3.4. If Supplier has begun the process of obtaining a HITRUST CSF Certification before the effective date, then Supplier represents and warrant to Anthem that all corrective action plans that are necessary to obtain a HITRUST CSF Validated report and/or HITRUST CSF Certification and that have been identified to Supplier prior to the effective date shall be communicated to Anthem and documented as an attachment to this exhibit. Supplier shall promptly (and in any event within 30 days of identification) report in accordance with its notification obligations in the Agreement and to Anthem Information Security at [email protected] any findings through HITRUST engagement that materially impact Anthem Confidential Information and associated corrective action plans identified during a self-assessment or any third party assessment including any assessment related to Supplier’s independent certification/attestation. Supplier will provide Anthem with any further information associated with such findings as reasonably requested by Anthem. If at any time during the engagement, the HITRUST CSF Certification is withdrawn for any reason, Supplier will contact Anthem in accordance with its notification obligations in the Agreement and [email protected] within 24 hours of learning of the issue to provide Anthem with information and remediation plans regarding the withdrawal. 3.5. From time to time, Supplier may be requested to respond to, inform and provide updates regarding specific high risk security gaps or exposures that exist for new or emerging security vulnerabilities that are made publicly known for systems, applications, hardware devices, etc. In all instances Supplier will provide a response to any inquiry within 5 business days and will provide specific details as to the questions asked to ensure that Anthem can appropriately evaluate the risk or exposure to Anthem Confidential Information. 4. Encryption4.1. Anthem Confidential Information must be encrypted while in transit and at rest. The manner ofencryption must conform to existing industry-standard as defined under Federal Information Processing Standards. 4.2. At a minimum, Anthem Confidential Information will be encrypted on the following: 4.2.1 Public shared networks 4.2.2 Non-wired networks 4.2.3 Cloud services 4.2.4 Desktop and portable computing devices 4.2.5 Mobile devices 4.2.6 Portable media 4.2.7 Back-ups 4.2.8 Application or network servers 4.2.9 “Plug & play” storage devices. 4.3. Cryptographic key management procedures must be documented and include references to key lifecycle management (including provisioning, distribution, and revocation) and key expiration dates. 4.4. Access to encryption keys must be restricted to named administrators. Encryption keys must be protected in storage. Example methods of acceptable key storage include encrypting keys or storing keys within a hardware security module (HSM). Data-encrypting keys should not be stored on the same systems that perform encryption/decryption operations. 4.5. Anthem will manage encryption keys for Anthem Protected Health Information (PHI) or Personally Identifiable Information (PII) on Supplier systems or application in public cloud environments. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 5

5. Network and Systems Security 5.1. Supplier shall utilize and maintain a commercially available, industry standard malware detection program which includes an automatic update function to ensure detection of new malware threats. 5.2. An intrusion detection or prevention system which detects and/or prevents unauthorized activity traversing the network will be maintained. 5.3. Supplier shall have technical controls to detect, alert, and prevent the unauthorized movement of data from Supplier’s control (commonly referred to as Data Loss Prevention). 5.4. Networks or applications that contain Anthem Confidential Information must be separated from public networks by a firewall to prevent unauthorized access from the public network. 5.5. At managed interfaces, network traffic is denied by default and allowed by exception (i.e., deny all, permit by exception). 5.6. Supplier shall establish security and hardening standards for network devices, including Firewalls, Switches, Routers, Servers, and Wireless Access Points (baseline configuration, patching, passwords, access control). 5.7. Web content filtering must be in place to restrict external webmail, instant messaging, file sharing and other data leak vectors for any Supplier Personnel with direct or indirect access to Anthem Confidential Information. 5.8. Quarterly vulnerability scans must be performed, and intrusion detection and identity management systems must be installed and monitored on all systems and components that handle, process, or store Anthem Confidential Information. Upon request, report summaries, including confirmation of remediation for vulnerabilities identified as high- or medium-risk, must be provided to Anthem. 5.9. At a minimum, Supplier shall engage a qualified third party to perform annual penetration testing of Supplier’s networks containing Anthem Confidential Information. The scope of the penetration testing must, at a minimum, include all internal/external systems, devices and applications that are used to process, store, or transmit Confidential Data, physical security controls for all applicable facilities, and social engineering tests. Supplier must provide Anthem with summary results and a remediation plan at Anthem’s request. 5.10. Supplier shall ensure that no unencrypted Anthem Confidential Information is stored on any system that is internet facing. 6. Email Security 6.1. Supplier email systems used in the exchange of information must: 6.1.1. Use commonly accepted security features, including anti-virus, file inspection, and filtering of know bad IP addresses; 6.1.2. Be configured securely to protect against common email exploits, including spoofing, anonymous relay functionality, directory harvesting and denial of service attacks; 6.1.3. Use an encryption method for web client connectivity to email systems, and 6.1.4. Use an encryption method for Confidential Information in transit and at rest. 7. Mobile Device Security Controls 7.1. Supplier must have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and security requirements for all mobile devices. 7.2. Where Supplier permits Bring Your Own Device (BYOD), Supplier must have a BYOD policy that requires encryption of such devices and defines the device and eligibility requirements for BYOD usage in when Anthem Confidential Information will be viewed or stored on devices that are not Supplier-issued mobile devices. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 6

7.3. Supplier must post and communicate the mobile device policy and requirements through Supplier’s security awareness and training program. 7.4. Supplier must have a centralized mobile device management solution (MDM) deployed to all mobile devices that are permitted to store, transmit, or process Anthem Confidential Information. 7.5. Supplier’s Information Technology department must provide remote wipe or corporate data wipe for all mobile devices. 7.6. Supplier’s mobile device policy must require the use of encryption for either the entire device or for Anthem Confidential Information and must be enforceable through Supplier’s MDM solution or other technical controls. 7.7. Supplier must enforce password policies for enterprise-issued mobile devices and/or BYOD mobile devices using Supplier’s MDM solution or other technical controls. 7.8. Supplier’s Information Technology department must provide remote wipe or corporate data wipe for all mobile devices in where Anthem Confidential Information will be viewed or stored on mobile devices. 8. System and Application Controls8.1. All Anthem Confidential Information must be securely stored at all times to prevent loss and unauthorized access or disclosure. 8.2. Laptop and workstation systems that access Anthem Confidential Information remotely must utilize endpoint protection which includes a personal firewall and anti-malware protection. 8.3. Operating systems and application software used must be currently supported by the manufacture. 8.4. Current versions of operating system and application software must be maintained, and patches applied in a timely manner for all systems and applications that receive, maintain, process, or otherwise access Anthem Confidential Information. 8.5. Anthem Confidential Information must not be used in any non-production environment such as testing or quality assurance unless de-identification of the data has been performed. In the event that de-identification is not practical or feasible, compensating controls must be in place protecting the data to the same level of protection as afforded to the production environment. Anthem Confidential Information must not be placed into a non-production cloud computing environment. 8.6. Anthem Confidential Information must be segmented from non-Anthem Information so that appropriate controls are in place to identify the data as Anthem’s in all instances, including backup and removable media, and to appropriately restrict access only to users authorized to view the data. Logical separation must allow data to be deleted when it is no longer required. 8.7. Logical controls, virtual machine zoning, virtualization security and segregation must be in place to help prevent attacks and exposure in multi-tenancy environments. This may also be accomplished with tenant isolation, data isolation patterns, database per tenant, or application instances. 8.8. Supplier shall maintain an asset management system which records the movement of hardware and electronic media and any persons responsible therefore. 9. Software Development Lifecycle9.1. Supplier must use industry standards such as BSIMM, NIST, OWASP, etc. to build in security for its Systems Development Lifecycle (SDLC). 9.2. Supplier must use an automated source code analysis tool to detect and remediate security defects in code prior to production deployment. 9.3. Manual penetration testing for applications which are internet-facing or provided to Anthem members through Anthem portals or mobile applications on behalf of Anthem must be performed Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 7 by qualified testers which may be third party or internal workforce with appropriate credentials. 9.4. Supplier must have policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for the products/Services it provides to Anthem. 9.5. Supplier must have controls in place to prevent unauthorized access to its or Anthem’s application, program, or object source code and ensure that access is restricted to authorized Personnel only. 9.6. Supplier will not use national identifiers or Social Security Numbers as User IDs for logon to applications. 9.7. Supplier will participate in Anthem Information Security's Vendor Application Security Program by providing evidence of scanning and penetration testing including scope, methodology and confirmation of remediation. Supplier agrees to remediate vulnerabilities identified during this process in a manner and timeline acceptable to Anthem and consistent with healthcare industry standards. If evidence of scanning and penetration testing is not provided or Anthem determines does not meet healthcare industry standards, then Anthem reserves the right, at Supplier’s expense, to have vendor engage a third-party penetration test or perform the penetration testing or scanning necessary to gain evidence that Supplier’s vulnerability management processes and procedures meet the requirements of this Exhibit. 10. Data Destruction10.1. All Anthem Confidential Information, whether such information is in paper, electronic or otherform, requires secure disposal or destruction when no longer required. When requested by Anthem or upon the termination or expiration of the Agreement, Supplier must return to Anthem a valid copy of its Confidential Information. After receiving confirmation from Anthem that it has received the valid copy, Supplier must delete Anthem Confidential Information on its systems using security techniques consistent with accepted standards such as NIST 800-88 Guidelines for Media Sanitization. If media containing Anthem Confidential Information is to be reused then that device shall be sanitized according to NIST SP 800-88 Guidelines for Media Sanitization before it may be used by Supplier for any purpose. Physical Controls for the Protection of Anthem Confidential Information 10.2. All Anthem Confidential Information received or created in paper form must be protected from viewing by unauthorized persons. 10.3. A clean desk policy will be enforced to ensure proper safeguarding of all hard copy Anthem Confidential Information. 10.4. Visitor logs documenting all individuals who are not employed by Supplier or Supplier's subcontractors who gain access to the facility where Anthem Confidential Information is processed will be maintained. 10.5. Servers, enterprise data storage devices, backup tapes and media, and other computing devices that contain Anthem Confidential Information used to support network communications must be located in a secure and restricted access location within the facility. 10.6. Monitoring, cameras (e.g., CCTVs) must monitor ingress and egress to sensitive areas within the facility. The monitoring equipment (e.g. CCTV) feed must be monitored either internally or externally by a qualified team. Alerting procedures must be defined and notification performed to qualified Supplier personnel. Processes for retention and review of security logs (e.g. access and visitor logs, CCTV) must be in place. Cameras must be positioned in a way that Anthem Confidential Information is not readable on screens and/or on CCTV recordings or screen captures. 10.7. When investigation of an incident or breach is required, all relevant audit trails and CCTV Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 8 recordings shall be made available to Anthem upon request and in a timely manner. 11. Access Control11.1. Prior to gaining access to Anthem Confidential Information, workforce members will haveappropriate background checks completed in compliance with state and federal law.11.2. Security awareness training will be completed prior to access being granted to AnthemConfidential Information, and then completed on an annual basis going forward so long as access to Anthem Confidential Information continues. This training should include, at a minimum, guidance on defending against malware, protecting passwords, monitoring and reporting system notifications, social engineering, and handling sensitive data. 11.3. Physical and logical access will be granted to the minimum Anthem Confidential Information necessary to meet the requirements of the user’s scope of responsibilities. 11.4. Access reviews will be performed at least quarterly for privileged user accounts and twice annually for non-privileged user accounts. 11.5. Only those individuals providing Services to Anthem, or those who are responsible for administering or managing systems that contain Anthem Confidential Information, shall be authorized to access systems containing Anthem Confidential Information. 11.6. All users that are no longer required or authorized to access Anthem Confidential Information or systems that contain Anthem Confidential Information must have access promptly disabled. 11.7. Access to Anthem Confidential Information and systems that contain Anthem Confidential Information must be access controlled through the use of individual user IDs and passwords that meet healthcare industry standard complexity rules and password lifetimes. 11.8. If it is suspected a password has been compromised, the password must be immediately changed or reset. 11.9. Processes must be in place to create the audit trails or logs capable of determining who has accessed Anthem Confidential Information and/or systems that contain Anthem Confidential Information. Logging and/or audit trails must include all identity credentialing, authentication, and access control Events (including all success and failure Events). Logs and/or audit trails are subject to periodic audit. These logs and/or audit trails must then be archived for at least twelve months. These archived logs and/or audit trails must be searchable and or discoverable. 11.10. Remote access to systems or networks that contain Anthem Confidential Information, including but not limited to email, must use multi-factor authentication and a connection with Approved Encryption as defined in Section 4 of this Exhibit. 11.11. Upon request, Supplier shall provide reports within 48 hours for: 11.11.1. List of all individuals with access to Anthem Confidential Information and/or systems that contain Anthem Confidential Information and the level of access granted; and 11.11.2. List of activity associated with any user ID who has access to Anthem Confidential Information. 11.12. Account management capabilities, such as account lockouts for unsuccessful logon attempts, defined inactivity times, remote access allowances, specific success and failure Events, and management of elevated privilege accounts must be enforced. 11.13. Supplier will use web access management mechanism such as the CA Single Sign On product, the SecureAuth product, or OpenID Connect protocol for internet visible and cloud-based web applications. Housing for Health OC, INC., DBA " Housing for Health BA Agreement (Template revised June 2023) Anthem & FORM NUMBER: BAA1009 Page 9

12.Data Location and access from outside the United States12.1. Anthem Confidential Information, or backups thereof, is not permitted to be hosted or stored,offshore. Locations outside the United States may be utilized for the processing of data. However, all data must reside on servers located in the United States for the duration of the processing. 12.2. Supplier will follow best practices for securing workstations located outside the United States, including but not limited to: 12.2.1. Technical controls in place to prevent the storage or copying of Anthem Confidential Information on workstations; and 12.2.2. Scanning to detect Anthem Confidential Information on workstations; and 12.2.3. Filtering and blocking email and instant messaging containing Anthem Confidential Information; and 12.2.4. Disabling ports for removable media and printing unless explicitly authorized in an exception. 12.3. Supplier must use a Clean Room whenever regulated data such as Protected Health Information, Personally Identifiable Information, or cardholder data as defined by Payment Card Industry-Data Security Standard (PCI-DSS) is accessed from outside the United States. 12.4. Wireless access is prohibited from being used to access Anthem Confidential Information from offshore locations. 12.5. All work from locations outside the United States must be performed in Anthem- approved facilities. 13. Contingency Planning13.1. Supplier will have a documented Business Continuity and Disaster Recovery plans in place thatinclude information security controls. Such plans will be tested at least annually. 14. Payment Card Industry Data Security Standard14.1. If, in performing Services to or on behalf of Anthem, Supplier acts as a Merchant or payment cardprocessor as defined by the Payment Card Industry Data Security Standard (PCI DSS), then Supplier agrees to comply with the applicable PCI DSS requirements. 15. Litigation Holds15.1. Supplier must provide a detailed mechanism for how litigation holds will be implemented. This willinclude how metadata will be created, accessed, and stored in a cloud environment. 16. No Sale of Anthem Confidential Information Permitted16.1. The sale of Anthem Confidential Information, or derivatives thereof, especially Anthem memberdata (such as PHI, PII, or PCI data) is prohibited. For clarification, this prohibition applies regardless of whether or not the data has been de-identified. Housing for Health OC, INC., DBA " Housing for Health Enhanced Care Management (ECM) and Community Supports (CS) Background Check Attestation Heather StratmanHousing for Health OC, .DBA Housing for HealthHeather StratmanChief Administrative Officer87-313729212/11/2024 Medi-Cal Managed CareL.A. Care
https://providers.anthem.com/caAnthem Blue Cross is the trade name of Blue Cross of California. Anthem Blue Cross and Blue Cross of California Partnership P lan, Inc. are independent licensees of the Blue Cross Association. Anthem is a registered trademark of Anthem Insurance Companies, Inc. Blue Cross of California is contracted with L.A. Care Health Plan to provide Medi-Cal Managed Care services in Los Angeles County. ACAPEC-3240-21 October 2021 How to enroll in the state’s Medi-Cal programStep 1:Go to the Department of Health Care Services’ (DHCS)Provider Application and Validation for Enrollment (PAVE) Portal by visitinghttps://pave.dhcs.ca.gov/sso/login.do.Step 2:If you do not have a PAVE user profile, select Sign Up.Step 3:Complete the registration process (if applicable) and online application.Step 4:Once your application has been successfully submitted, include a screen shot of the PAVEApplication Dashboardwith your Anthem Blue Cross (Anthem) application.Important:When applying as a group provider, in addition to the DHCS group provider application, a complete rendering provider application must be submitted for each individual provider that belongs to the group.Frequently asked questionsQ:Whom do I contact if I need help filling out the application or if I’m not sure what application to use?A:In addition to the Message Center within the PAVE Portal, the following resources are available:PED Message Center 916-323-1945or the Online Inquiry Formunder the Contact Us section athttps://files.medi-cal.ca.gov/pubsdoco/prov_enroll.aspxPAVE Technical Support 866-252-1949Q:If I enroll with Medi-Cal Managed Care (Medi-Cal) for Fee-for-Service (FFS) through DHCS, do I have to see Medi-Cal FFS members?A:No, enrollment in Medi-Cal for FFS does not obligate you to accept Medi-Cal for FFS members.Q:What if none of the DHCS application packets apply to me?A:If you feel you do not need to apply, cannot apply, or if your application has been denied by DHCS, please email us (as indicated in Step 4above) to address your concern. Attach a copy of your denial letter if applicable.Q:If I am already an Anthem-contracted provider serving Medi-Cal members, do I need to do anything?A:Yes, this enrollment requirement applies to both existing and new Medi-Cal network providers.

Medi-Cal Managed CareProvider BulletinMarch 2022
https://providers.anthem.com/caAnthem Blue Cross is the trade name of Blue Cross of California. Anthem Blue Cross and Blue Cross of California Partnership Plan, Inc. are independent licensees of the Blue Cross Association. Anthem is a registered trademark of Anthem Insurance Companies, Inc. Blue Cross of California is contracted with L.A. Care Health Plan to provide Medi-Cal Managed Care services in Los Angeles County. ACAPEC-3449-22 March 2022 Enhanced Care Management and Community Supports taxonomy requirementCalifornia requires all Community Supports (CS) and Enhanced Care Management (ECM) providers to add taxonomies to their location national provider identifier (NPI) (for example, Type 2 or Group NPI) that indicates which services (CS/ECM –see below) the provider will offer at that location. This is a State of California requirement; as such, failure to add the taxonomy will result in inability for Anthem Blue Cross(Anthem) to execute an agreement. We apologize for the inconvenience and appreciate your efforts to ensure this request is complete. Please follow the instruction below to add the California state-suggested taxonomy to each location’s NPI that will offer the service. Step 1Determine which services your organization will provide from the list below. ServiceTaxonomyECM 171M00000X–Case manager/Care coordinatorHousing transition services 251X00000X –Supports brokerageHousing deposits 251X00000X –Supports brokerageHousing tenancy and sustainingservices 251X00000X –Supports brokerageShort-term post-hospital housing 385H00000X –Respite careRecuperative care (medical respite) 385H00000X –Respite careRespite services 385H00000X –Respite careDay habilitation programs 251C00000X –Day trainingAdult nursing facility (NF) transition to assistedliving facilitiesCommunity/NF transition services to homePersonal care and homemaker servicesEnvironmental accessibility adaptationsMedically supportive food/mealsSobering centersAsthma remediation71M00000X– Case manager/Care coordinator71M00000X– Case manager/Care coordinator3747P1801X– Personal care attendant 171W00000X– Contractor 332U00000X– Home delivered meals 261QR0405X– Rehabilitation, substance use disorder171W00000X– Contractor Step 2 Determine which business locations will offer the services.Step 3 Visit the National Plan and Provider Enumeration System (NPPES) site at https://nppes.cms.hhs.govto update your location NPI by adding the appropriate taxonomy code above depending on which services you plan to offer at that location.

Anthem Blue CrossEnhanced Care Management and Community Supports taxonomy requirementPage 2 of 2Example:Provider will offer asthma remediation, medically supportive food/meals, and day habilitation at 2020 Fake Street. That location NPI should be updated to include the following taxonomies (in addition to any other taxonomies already registered): 171W00000X332U00000X251C00000XStep 4 Once the taxonomies have been added to the appropriate location NPI, please notify Anthem (if your roster was already submitted) via email at [email protected] you have not yet submitted your roster, please do so via email at [email protected] additional direction is required, please visit the CMS NPPES FAQ athttps://nppes.cms.hhs.gov/webhelp/nppeshelp/NPPES%20FAQS.html.

Email is the quickest and most direct way to receive important information from Anthem Blue Cross.To start receiving email from us (including some sent in lieu of fax or mail), submit your information using the QR code to the right or via our online form (https://bit.ly/3lLgko8).

1Anthem HDO Application V.0/201
Health Care Delivery Organization and AncillaryApplicationPlease submit all applicable documents from the list below with your completed and signedapplication. Failure to submit a complete application and all applicable documents will result inthe application being returned and will prohibit Anthem Incorporated from completing thecredentialing and/or contracting process.Note: Submission of a completed application does not guarantee approval as a participatingprovider as additional information and/or documentation may be required by AnthemIncorporated.Required attachments:Copy of all federal, state and/or local licenses required to operate as a health carefacility (by location)Copy of Accreditation Certificate/letters ORCopy of most recent CMS or state survey (with deficiencies) including cover letter fromCMS or state agency stating facility is in substantial compliance or Corrective Action Planif deficiencies were citedCopy of Medicaid and Medicare Certification(s) or Certificate numbers on theapplicationW9Current copy of professional liability insurance and general liability insurance (mustindicate coverage limits, policy number, effective date and expiration date)Proof of established Quality Improvement ProgramCurrent copy of Pharmacy License in state where contracting (for ambulatory and homeinfusion therapy providers)Clinical Laboratory Improvement Act Certificate(s) for each location (for dialysis andlaboratory providers)As requested by our Network Provider Solutions additional paperwork or addendums to thisapplication may need to be completed.

Instructions:Complete the following pages and return to Anthem Incorporated with the requiredattachments.Provider typeAmbulatory surgery centerBirthing centerClinical laboratoriesDialysis center/ESRDFederally qualified healthcenter (FQHC)Home health agencyHome infusion therapyHospice facilityHospitalInpatient rehab hospitalOutpatient rehab center/hospitalPortable XRay supplierRural health clinic (RHC)Skilled nursing facilityBehavioral healthAmbulatory detoxCommunity mental health centerCrisis stabilization unitHospital—inpatient detoxHospital—psychiatricIntensive outpatient—psychiatricIntensive outpatient—substance abuseMental health clinic—outpatient servicesMethadone maintenance clinicPartial hospitalization—psychiatricPartial hospitalization—substance abusePsychiatric inpatient rehabilitationPsychiatric residential treatment facilityResidential treatment center—substance abuseSubstance abuse—inpatient rehabilitationSubstance abuse clinic—outpatient servicesProvider identificationLegal business name:Doing business as (if applicable):Primary contact person:Title:Email:Primary contact address:City: State: ZIP code:Phone: Fax:Credentialing informationCredentialing contact name:Title:Email:Credentialing address:City: State: ZIP code:Phone: Fax:Primary office/service addressDoes the facility have multiple locations?YesNo (If yes, attach a separate sheet for other locations.)Address line 1:Address line 2:City: State: ZIP code:County:Phone: Fax:Primary contact:Primary contact email:Phone: Website:Administrator (full name):

Housing for Health OC, Housing for Health Heather Stratman Chief Administrative Officer [email protected] 17701 Cowan STE 200 Irvine CA 92869 949-401-9591 888-624-6775

Medicaid #: Medicare #:TIN/EIN: NPI #:Taxonomy code(s):Does provider bill from this address?YesNoDoes this office meetADAaccessibility requirements?YesNoCheck all that apply:Handicapaccessible:BuildingParkingRestroomServices fordisabled:TTYAmerican Sign LanguageMental/physical impairmentAccessible by public transportation:BusSubwayRegional trainBilling informationContact name (billing contact):Title:Address line 1:Address line 2:City: State: ZIP code:Phone: Fax:Email:Website:Preferred method of communication:EmailFaxMailLicensure/operating certificateState: Date of license: License number: Expiration date:State: Date of license: License number: Expiration date:CLIA certificate #:Accreditation/certification (Attach a copy of current accreditation certificate or survey)A.AAAASFAAAHCAAPSFACHCACRBOC INTLCABCCAHCCCACCHAPCIHQCOACOLACTEAMDNV/NIAHOHFAPHQAAIMQTJCAIUMFDA CERT_______________Not accredited (if not accredited,please complete Section B below)Date of initial accreditation: Date of next survey:Date of last survey:
87-3137292 1124766704 Heather Stratman Chieft Administrative Officer 17701 Cowan STE 200 Irvine CA 92614 949- 401-9591 888-624-6775 [email protected] http://www.housingforhealthoc.org/

B.Has provider had an onsite survey by CMS or state?YesNo*Date of last recertification/annual state survey program review report:* If no, successful completion of an onsite visit is required to complete credentialing. You will be contacted toschedule the visit.Nonaccredited providers must provide a copy of their most recent government agency survey (may not beolder than 36 months) along with the Corrective Action Plan (if deficiencies werecited) or attach the letterfrom the government agency stating facility is in substantial compliance with most recent survey standards.Failure to provide documentation or complete the onsite survey may delay your ability to become aparticipating provider.General and professional liability insuranceGeneral liability coverage (Attach copy of current insurance face sheet/declaration page)Carrier name:Policy #:Effective date: Expiration date:Coverage per incident: $ Coverage aggregate: $Professional liability insuranceCarrier name:Policy #:Effective date: Expiration date:Coverage per incident: $ Coverage aggregate: $Provider directoryThe following information will be used for your provider directory listing.Office hoursMonday Tuesday Wednesday Thursday Friday Saturday SundayOpen:Close:About the facility1. Does the facility have experiences and skills in treating persons with:A. Physical disabilities?YesNoN/AB. Chronic illness?YesNoN/AC. HIV/AIDS?YesNoN/AD. Serious mental illness?YesNoN/A2. Do you have experience and skills in treating individuals who are:1. Homeless?YesNoN/A2. Deaf or hard of hearing?YesNoN/A3. Blind or visually impaired?YesNoN/AWhat languages (other than English) are spoken by you/facility staff fluently enough to treat patients whoonly speak that language?____________________________________________________________________________________________________________________________________________________________________________________8:00am 8:00am 8:00am 8:00am 8:00am5:00pm 5:00pm 5:00pm 5:00pm 5:00pmSpanish

Disclosure questionsIf you answer yes to any of the following questions, attach a detailed explanation.If any question does not apply, please answer no.Failure to answer or provide an explanation may result in a delay in processing the application.Do not use whiteout to correct/change answers; if you need to correct/change an answer, cross out theincorrect answer, initial it and then mark the correct answer.1. Does the business have evidence of:A. Professional liability claims history for each subcontractor?YesNoB. Disciplinary action taken against any business or professional license held in this orany other state or surrender of a license in this or any state?YesNoC. Any history of loss or limitation of privileges or disciplinary activity?YesNo2. Has the business’ general or professional liability insurance ever been denied,cancelled, nonrenewed or refused upon application for any reason other than by thefacility’s request?YesNo3. Has the business, under any current or former name or business entity, ever:A.Had licensure to do business in any applicable jurisdiction ever been denied,revoked, reduced, suspended or not renewed?YesNoB.Been suspended or excluded from receiving payment under Medicare orMedicaid?YesNoC.Had accreditation status reduced, terminated, suspended or revoked?YesNoD.Been under investigation by any government agency?YesNo4. Is the business’ professional liability insurance provided through a selfinsurance trustor program?**YesNo**If yes, an officer of the company (e.g. president, vice president, chief financial officer or chief operatingofficer) must sign the following attestation.On behalf of the applicant, I represent and warrant the following with respect to the selfinsurance programmaintained by the applicant or which provides professional liability insurance for the applicant:1.The selfinsurance program is adequately funded to provide the minimum required limits of liability asrequired by plan.2.The selfinsurance program has an actuarially validated reserve adequate for incurred claims, forincurred but not reported claims and future claims based on past experience.3.The selfinsurance program has a designated thirdparty administrator or other appropriately licensedclaims professional or attorney serving the program.4.The selfinsurance program has a designated medical malpractice defense firm or more than onedesignated medical malpractice defense firm.5.The selfinsurance program maintains excess insurance/reinsurance above the selffunded level if theselfinsured level alone is insufficient to meet required limits of the plan.6.The selfinsurance program maintains evidence of a surety bond or letter of credit as collateral to theselfinsured limit or a captive, selfmanagement of a large retention through a trust.7.The selfinsurance program maintains a total value of the program that at a minimum meets therequired limit of liability as set forth by plan.8.I have confirmed the foregoing with my auditor or the actuary for the selfinsurance fund.Attestation signature: Date:Printed name: Title:Note: Anthem Incorporated reserves the right to request documentation from the applicant to confirm theinformation disclosed in this attestation. foregoing
with
my
aud
12/11/2024 Heather Stratman Chief Administrative Officer

AttestationI, the undersigned authorized agent, hereby attest that the information submitted in, or in support of thisapplication is true, accurate and complete to the best of my knowledge and belief and is furnished in goodfaith. I understand that significant omissions or misrepresentations may result in denial of the applicationand/or participating agreement.A photocopy of this document shall be as effective as the original.Preparer’s name: Title:Signature: Date:
:

Heather Stratman Chief Administrative Officer 12/11/24

Community Supports (CS) Fee Schedule AttachmentCommunity Support Type DescriptionBilling Code Modifier Bill Unit Reporting UnitPayment MethodSan Francisco Santa Clara Los Angeles Sacramento Madera Fresno Kings Tulare Kern RuralsHousing Transition Navigation Service Supported housing H0043 U6 PMPM Per DiemBundled PMPM = 1 flat rate per month for both codes$493.90 $482.53 $396.56 $423.90 $394.30 $391.74 $384.10 $372.91 $372.91 $413.80Housing Transition Navigation ServiceComprehensive community support services H2016 U6 PMPM Per DiemMust collect all encounters$493.90 $482.53 $396.56 $423.90 $394.30 $391.74 $384.10 $372.91 $372.91 $413.80Housing Deposits Supported housing H0044 U2 Fixed Cost Fixed CostActual Costs billed per claim up to lifetime max.$7500 max $7500 max $7500 max $7500 max$7500 max$7500 max$7500 max$7500 max$7500 max$7500 maxHousing Tenancy and Sustaining Services Financial Management -Self Directed T2040 U6 PMPM 15 min. incr.Bundled PMPM = 1 flat rate per month for both codes$522.50 $510.47 $419.52 $448.45 $417.13 $414.42 $406.35 $394.50 $394.50 $437.76Housing Tenancy and Sustaining Services Financial Management -Self Directed T2050 U6 PMPM Per DiemMust collect all encounters$522.50 $510.47 $419.52 $448.45 $417.13 $414.42 $406.35 $394.50 $394.50 $437.76Housing Tenancy and Sustaining Services Supported Brokerage - Self Directed T2051 U6 PMPM Per Diem$522.50 $510.47 $419.52 $448.45 $417.13 $414.42 $406.35 $394.50 $394.50 $437.76Housing Tenancy and Sustaining Services Supported Brokerage - Self Directed T2041 U6 PMPM 15 min. incr.$522.50 $510.47 $419.52 $448.45 $417.13 $414.42 $406.35 $394.50 $394.50 $437.76Hospitalization Housing Supported housing H0043 U3 Per diem Per Diem Per diem$130.90 $127.89 $105.10 $112.35 $104.50 $103.82 $101.80 $98.83 $98.83 $109.67Short-Term Post Hospitalization Housing Supported housing H0044 U3 Per diem Per Month Per diem$130.90 $127.89 $105.10 $112.35 $104.50 $103.82 $101.80 $98.83 $98.83 $109.67Recuperative Care (Medical Respite)Residential Care - not otherwise specified T2033 U6 Per Diem Per DiemMust collect all encounters$248.60 $242.87 $199.60 $213.37 $198.47 $197.18 $193.34 $187.70 $187.70 $208.28Respite ServicesRespite Care Services - not in the home H0045 U615 min. incr. 15 min. incr.15 min. increment$10.45 $10.21 $8.39 $8.97 $8.34 $8.28 $8.12 $7.89 $7.89 $8.75Respite ServicesUnskilled respite care, not hospice S5151 U615 min. incr. 15 min. incr.15 min. increment$10.45 $10.21 $8.39 $8.97 $8.34 $8.28 $8.12 $7.89 $7.89 $8.75Respite ServicesRespite Care - in the home S9125 U615 min. incr. 15 min. incr.15 min. increment$10.45 $10.21 $8.39 $8.97 $8.34 $8.28 $8.12 $7.89 $7.89 $8.75Day Habilitation ProgramsHabilitation - educational T2012 U6 Per Diem Per DiemBundled Per diem = 1 flat rate per day for all codes$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation ProgramsHabilitation - prevocational T2014 U6 Per Diem Per DiemMust collect all encounters$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation ProgramsHabilitation - supported employmentT2018 U6 Per Diem Per Diem$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation Programs Day Habilitation T2020 U6 Per Diem Per Diem$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation ProgramsSkills training and development H2014 U615 min. incr. 15 min. incr.$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation ProgramsSkills training and development H2038 U6 Per Diem Per Diem$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation Programs Supported H2024 U6 Per Diem Per Diem$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75Day Habilitation ProgramsOngoing support to maintain employmentH2026 U6 Per Diem Per Diem$73.70 $72.00 $59.17 $63.25 $58.84 $58.46 $57.32 $55.65 $55.65 $61.75NF Transition/Diversion to Assisted Living Facility (RCFE)Community transition per service T2038 U4 PMPM Per servicePMPM - must collect all encounters$545.60 $533.03 $438.07 $468.27 $435.57 $432.74 $424.31 $411.94 $411.94 $457.11NF Transition/Diversion to Assisted Living Facility (RCFE) - ongoing supportCommunity transition wraparound services H2022 U5 Per Hour Per Diem Per Hour$41.80 $40.84 $33.56 $35.88 $33.37 $33.15 $32.51 $31.56 $31.56 $35.02 Community Supports (CS) Fee Schedule AttachmentCommunity Transition Services/Nursing Facility Transition to a HomeCommunity transition per service T2038 U5 PMPM Per servicePMPM - must collect all encounters$545.60 $533.03 $438.07 $468.27 $435.57 $432.74 $424.31 $411.94 $411.94 $457.11Environmental Accessibility Adaptations (Home Modifications) Home modifications S5165 U6 Fixed Cost Per serviceActual Costs billed per claim up to lifetime max.$7,500 max $7,500 max $7,500 max $7,500 max$7,500 max$7,500 max$7,500 ma$7,500 ma$7,500 ma7,500 maxMedically Tailored Meals/Medically Supportive Food - Home Home delivered prepared meal S5170 U6 Per Meal Per Meal Per Meal$13.20 $12.90 $10.60 $11.33 $10.54 $10.47 $10.27 $9.97 $9.97 $11.06Medically Tailored Meals/Medically Supportive Food - Grocery Meals - not otherwise specified (grocery box, voucher) S9977 U6 Per Week Per Diem Per Week$89.10 $87.05 $71.54 $76.47 $71.13 $70.67 $69.29 $67.27 $67.27 $74.65Medically Tailored Meals/Medically Supportive Food - Nutritional counseling, diet S9470 U6Per AssessmentPer Assessment Per Assessment$53.90 $52.66 $43.28 $46.26 $43.03 $42.75 $41.92 $40.70 $40.70 $45.16Sobering CentersAlcohol and/or drug services; ambulatory detoxification H0014 U6 Per Diem Per Diem Per Diem$204.60 $199.89 $164.28 $175.60 $163.34 $162.28 $159.12 $154.48 $154.48 $171.42Personal Care Services Homemaker services S5130 U615 min. 15 min. incr. 15 min. incr.$10.45 $10.21 $8.39 $8.97 $8.34 $8.29 $8.13 $7.89 $7.89 $8.76Personal Care Services Personal care services T1019 U615 min. 15 min. incr. 15 min. incr.$10.45 $10.21 $8.39 $8.97 $8.34 $8.29 $8.13 $7.89 $7.89 $8.76Asthma Remediation Home modifications S5165 U5 Fixed Cost Per serviceActual Costs billed per claim up to lifetime max.$7,500 max $7,500 max $7,500 max $7,500 max$7,500 max$7,500 max$7,500 ma$7,500 ma$7,500 ma7,500 max 1 Exhibit BScope of WorkDuties and Responsibilities of the CityCity shall perform, and require applicable subcontractors providing CalAIM services to perform,the following duties and responsibilities:1. Remain in good standing with relevant and applicable State licensing boards, the California Department of Health Care Services (DHCS), the Centers for Medicare & Medicaid Services (CMS), and the United States Department of Health and Human Services Office of Inspector General (DHHS-OIG). 2. Maintain all relevant and applicable certifications, licenses, and permits. 3. Provide Housing Transition Navigation Services, Housing Tenancy Sustaining Services, Housing Deposits, Daytime Habilitation, and other CalAIM services as agreed upon by the City and Housing for Health California (HHCA). 4. Provide Community Supports using a service model for potential clients and for assisting clients as indicated in the MCP Agreements attached as Exhibit A. 5. Work in good faith to meet HHCA’s service obligations and contract requirements as stated in the MCP Agreements attached as Exhibit A. 6. Provide the MCPs and HHCA with any and all correspondence with, and notices from, agencies of investigations and/or the issuance of criminal, civil and/or administrative sanctions (threatened or imposed) related to licensure, fraud and or abuse (execution of grand jury subpoena, search and seizure warrants, etc.), and/or participation status in CalAIM. 7. Ensure that Members are provided with linguistic interpreter services and interpreter services for Members who are deaf and hard of hearing, as necessary, to ensure effective communication regarding medical history and care. 8. Use interpreters when needed and when technical medical history or health information is to be discussed. The City will not require a Member to use friends or family as interpreters. However, a family member or friend may be used as an interpreter when: (a) requested by a Member; (b) doing so will not compromise the effectiveness of service and will not violate a Member’s confidentiality; and (c) the Member is advised that an interpreter is available at no cost. 9. Work in good faith to comply with the requirements of each MCP’s Compliance Plans and Policies, which may be amended from time to time. The MCPs shall make the 2 applicable Compliance Plans and Policies available to the City. The City shall make them available to the City’s subcontractors. 10. Ensure capacity to provide the specified Community Supports and other CalAIM servicesas agreed upon by the City and HHCA.11. Provide HHCA with all cumulative capacity information on a quarterly basis, whenrequested by DHCS.12. Meet with HHCA on a quarterly basis to provide capacity updates and businessdevelopment planning and forecasts.13. Respond to grievances, audits, and flagged accounts by provided due dates throughHHCA and in accordance with the MCP regulations.14. Complete reports requested by the MCPs via HHCA by provided due dates.15. Notify HHCA of any new employees who will work on CalAIM provision and any recentlyexited employees who worked on CalAIM provision and complete the necessaryreporting documentation.16. Attend (by at least one team member) every appropriate HHCA Operations Meeting.Virtual attendance is acceptable.17. Pass on any communication or information shared by HHCA to appropriate teammembers and subcontractors.18. Notify HHCA when lead staff contacts will be out of the office and provide alternate staffcontact information.19. Inform HHCA of any data breeches or “concerning” situations (e.g. inappropriateemployee behavior in which a Case Manager is deceitful with CalAIM claims/Members).The City will be required to provide a resolution to such breeches or inappropriatebehaviors.20. Submit monthly CalAIM claim forms to HHCA by specified due date(s) and alert HHCA ifassistance is needed. HHCA will train City employees in how to complete the claimforms required by each contracted Managed Care Plan for reimbursement.21. Immediately notify the HHCA Billing Department of any overpayments or claims enteredin error.22. Only subcontract for the provision of CalAIM services through written agreement fromHHCA. 3 23. Take affirmative action to ensure that all CalAIM Members are provided coveredservices without discrimination, except where medically necessary.CAHHCA shall have the following duties and responsibilities: 1. Maintain HHCA’s contracts with tothe MOU as Exhibit A for the provision of Community Supports and ECM program2. Serve as the lead agencyto theCity of Sacramento to ensure that the CalAIM services the City provides to eligibleMembers are reimbursable under CalAIM.3. P services to the City of Sacramento incompliance with the provisions of the A4. Act as the point of contact for receiving referrals from the qualifying individuals for approval by , or as otherwise agreed.5. Monitor and report the progress of CalAIM service provision by the City to the MCPs.6. Establishbut notlimited to CalAIM Community Supports reimbursements.7. Monitor the progress of the City’s CalAIM service provision at least annually.8. Conduct periodic compliance audits, as needed.9. Provide the City with access to HHCA’s , and related to HHCA’s work with the City, as reasonably requested. 4 10. Process claim forms received from the City within seven business days and send completed claim forms to the appropriate Managed Care Plan for reimbursement. HHCA will reconcile those claims as soon as they receive them from the Managed Care Plansand turn them around for payment to the City within three business days. 11. E ensure the proper disbursement of fundsprinciples. 12. Comply established in the MCP Agreements.

Exhibit CElectronic Health Record SystemThe City may opt to utilize the Housing for Health California (HHCA) Electronic Health Record System (EHR). The fee schedule for the EHR is as follows: Payments shall be made: 1.To HHCA: Initial $5000 Flat Rate for inclusion to the Electronic Health Record System, plusongoing monthly fees at the rate of $63.33 per City EHR user. The initial fee must be paidwithin 30 days of joining the EHR platform.2.User fees may be discounted from the monthly reimbursement schedule upon mutualagreement of the Parties.

Contract Routing SheetPayment / Performance Bond OnlyGeneral Routing InformationDepartment:Contract Coordinator: Email:Effective Date: Expiration Date:Grant/Project Name:Other Party:Original Not to Exceed Amount:Assessor’s Parcel Number(s):Project Number: Bid/RFQ/RFP#:Supplements/Addendums/Change OrdersAdjusted Amount of this Change (+/-): New Not to Exceed Amount:Change In Scope:Original Contract Number: Supplement Number:Council ApprovalOriginal Meeting Date: Council File ID:Supplement Meeting Date: Council File ID:Processing InformationReturn to Dept for RecordingConstruction Related Clerk’s Office toRecordReturn to Dept for Other Party SignatureReal EstateAdditional Originals Attached –Return to Dept. notes/instructions, including any other contract or council file ID numbers related to this agreement: SignSignSign Rev. 01302026Department Review and Routing SignSign

Business Associate Agreement By and Between the City of Sacramento and Housing for Health Orange CountyThis BUSINESS ASSOCIATE AGREEMENT (“BAA”) is made and entered into as of the Effective Date, defined herein, by and between the City of Sacramento, a California municipal corporation (“Covered Entity”) and Housing for Health Orange County, DBA Housing for Health California (“HHCA”), a Delaware non-profit corporation (“Business Associate”). In this BAA, Covered Entity and Business Associate are each a “Party” and, collectively, are the “Parties” and may be referred as such herein. This BAA is executed to ensure that the Business Associate will appropriately safeguard protected health information that is created, received, maintained, or transmitted on behalf of the Covered Entity in compliance with applicable provisions of HIPAA and the HITECH Act, described further herein. BACKGROUND I.Covered Entity is either a “covered entity” or “business associate” of a covered entity,as each are defined under the Health Insurance Portability and Accountability Act of 1996,Public Law 104-191, as amended by the HITECH Act (as defined below) and the relatedregulations promulgated by HHS (as defined below) (collectively, “HIPAA”) and, as such, isrequired to comply with HIPAA’s provisions regarding the confidentiality and privacy ofProtected Health Information (as defined below);II.The Parties have entered into or will enter into one or more agreements, including amemorandum of understanding, under which Business Associate provides or will providecertain specified services involving the use and/or disclosure of Protected Health Information to Covered Entity (collectively, the “Agreement”);III.In providing services pursuant to the Agreement, Business Associate will have accessto Protected Health Information;IV.By providing the services pursuant to the Agreement, Business Associate willbecome a “business associate” of the Covered Entity as such term is defined underHIPAA;V.Both Parties are committed to complying with all applicable federal and state lawsgoverning the confidentiality and privacy of health information, including, but not limitedto, the Standards for Privacy of Individually Identifiable Health Information found at 45CFR Part 160 and Part 164, Subparts A and E (collectively, the “Privacy Rule”); andVI.Both Parties intend to protect the privacy and provide for the security of ProtectedHealth Information disclosed to Business Associate pursuant to the terms of thisAgreement, HIPAA, and other applicable laws.AGREEMENT NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of Protected Health Information (“PHI”) by Covered Entity to Business

Associate under the Agreement in reliance on this BAA, the Parties agree as follows: 1.Definitions. For purposes of this BAA, the following definitions apply. Any capitalized termused in this BAA, but not otherwise defined, has the meaning given to that term in the Privacy Rule orpertinent law.A.“Affiliate” means a subsidiary or affiliate of Covered Entity that is, or has been,considered a covered entity, as defined by HIPAA.B.“Breach” means the acquisition, access, use, or disclosure of PHI in a manner notpermitted under the Privacy Rule which compromises the security or privacy of the PHI, asdefined in 45 CFR §164.402.C.“Breach Notification Rule” means the portion of HIPAA set forth in Subpart D of 45 CFRPart 164.D.“Business Associate” shall have the meaning given to such term under the PrivacyRule, the Security Rule, and the HITECH Act, including, but not limited to, 42 U.S.C. Section17938 and 45 C.F.R. Section 160.103.E.“Covered Entity” shall have the meaning given to such term under the Privacy Ruleand the Security Rule, including, but not limited to, 45 C.F.R. Section 160.103.F.“Data Aggregation” means, with respect to PHI created or received by BusinessAssociate in its capacity as the “business associate” under HIPAA of Covered Entity, thecombining of such PHI by Business Associate with the PHI received by Business Associate in itscapacity as a business associate of one or more other “covered entity” under HIPAA, to permitdata analyses that relate to the Health Care Operations (defined below) of the respectivecovered entities. The meaning of “data aggregation” in this BAA shall be consistent with themeaning given to that term in the Privacy Rule.G.“Designated Record Set” has the meaning given to such term under the Privacy Rule,including 45 CFR §164.501.B.H.“De-Identify” means to alter the PHI such that the resulting information meets therequirements described in 45 CFR §§164.514(a) and (b).I.“Electronic PHI” means any PHI maintained in or transmitted by electronic media asdefined in 45 CFR §160.103.J.“Health Care Operations” has the meaning given to that term in 45 CFR §164.501.K.“HHS” means the U.S. Department of Health and Human Services.L.“HITECH Act” means the Health Information Technology for Economic and ClinicalHealth Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law111-005.M.“Individual” has the same meaning given to that term i in 45 CFR §§164.501 and 160.130and includes a person who qualifies as a personal representative in accordance with 45 CFR§164.502(g).

N.“Privacy Rule” means that portion of HIPAA set forth in 45 CFR Part 160 and Part 164,Subparts A and E.O.“Protected Health Information” or “PHI” has the meaning given to the term “protectedhealth information” in 45 CFR §§164.501 and 160.103, limited to the information created orreceived by Business Associate from or on behalf of Covered Entity.P.“Security Incident” means the attempted or successful unauthorized access, use,disclosure, modification, or destruction of information or interference with system operations inan information system.Q.“Security Rule” means the Security Standards for the Protection of Electronic HealthInformation provided in 45 CFR Part 160 & Part 164, Subparts A and C.R.“Unsecured Protected Health Information” or “Unsecured PHI” means any “protectedhealth information” as defined in 45 CFR §§164.501 and 160.103 that is not rendered unusable,unreadable or indecipherable to unauthorized individuals through the use of a technology ormethodology specified by the HHS Secretary in the guidance issued pursuant to the HITECH Actand codified at 42 USC §17932(h).2.Use and Disclosure of PHI.A.Except as otherwise provided in this BAA, Business Associate may use or disclose PHI asreasonably necessary to provide the services described in the Agreement with Covered Entity,and to undertake other activities of Business Associate permitted or required of BusinessAssociate by this BAA or as required by law.B.Except as otherwise limited by this BAA or federal or state law, Covered Entity authorizesBusiness Associate to use the PHI in its possession for the proper management andadministration of Business Associate’s business and to carry out its legal responsibilities underthe Agreement. Business Associate may disclose PHI for its proper management andadministration, provided that (i) the disclosures are required by law; or (ii) Business Associateobtains, in writing, prior to making any disclosure to a third party (a) reasonable assurancesfrom this third party that the PHI will be held confidential as provided under this BAA and usedor further disclosed only as required by law or for the purpose for which it was disclosed to thisthird party and (b) an agreement from this third party to notify Business Associate immediatelyof any breaches of the confidentiality of the PHI, to the extent it has knowledge of the breach.C.Business Associate will not use or disclose PHI in a manner other than as provided in thisBAA, as permitted under the Privacy Rule, or as required by law. Business Associate will use ordisclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessaryamount of PHI to carry out the intended purpose of the use or disclosure, in accordance withSection 13405(b) of the HITECH Act (codified at 42 USC §17935(b)) and any of the act’simplementing regulations adopted by HHS, for each use or disclosure of PHI.D.Upon request, Business Associate will make available to Covered Entity any of CoveredEntity’s PHI that Business Associate or any of its agents or subcontractors have in theirpossession, including providing data aggregation services to the Covered Entity.

E.Business Associate may use PHI to report violations of law to appropriate federal andstate authorities, consistent with 45 CFR §164.502(j)(1).F.Business Associate agrees to follow any applicable guidance issued by HHS regardingwhat constitutes “minimum necessary” with respect to the use or disclosure of PHI. Untilthe time that any such guidance is issued, Business Associate shall limit its use or disclosureof PHI, to the extent practicable, to the limited data set (as defined in section 45 CFR §164.514(e)(2)) or, to the minimum necessary to accomplish the intended purpose of suchuse, disclosure, or request, respectively.G.If Business Associate is confronted with legal action to disclose any PHI, BusinessAssociate shall promptly notify (unless it is barred by law or legal order from doing so)Covered Entity of such fact, and cooperate with Covered Entity in the event Covered Entityseeks to obtain a protective order or other similar order on its own behalf.3.Safeguards Against Misuse of PHI. Business Associate will use appropriate safeguards toprevent the use or disclosure of PHI other than as provided by the Agreement or this BAA and BusinessAssociate agrees to implement administrative, physical, and technical safeguards that reasonably andappropriately protect the confidentiality, integrity and availability of the Electronic PHI that it creates,receives, maintains or transmits on behalf of Covered Entity. Business Associate agrees to takereasonable steps, including providing adequate training to its employees to ensure compliance with thisBAA and to ensure that the actions or omissions of its employees or agents do not cause BusinessAssociate to breach the terms of this BAA. Appropriate safeguards include, at a minimum, thosedescribed below:A. Security. To take all steps reasonably necessary to ensure the continuous security of allcomputerized data systems containing Electronic PHI, and to protect paper documentscontaining Electronic PHI, including, at a minimum:i. Achieving and maintaining compliance with the Security Rule (45 CFR Parts160 and 164), as necessary in conducting operations on behalf of Covered Entity under this BAA. ii. In case of a conflict between any of the security standards contained in anyof these enumerated sources of security standards, the most stringent shall apply. The most stringent means that safeguard which provides the highest level of protection to Electronic PHI from unauthorized disclosure. iii. Business Associate shall designate a security officer to oversee its datasecurity program who shall be responsible for carrying out the requirements of this section and for communicating on security matters with Covered Entity. 4.Reporting Disclosures of PHI and Security Incidents. Business Associate will report to CoveredEntity in writing any use or disclosure of PHI not provided for by this BAA of which it becomes aware, andBusiness Associate agrees to report to Covered Entity any Security Incident affecting Electronic PHI ofCovered Entity of which it becomes aware. Business Associate agrees to report any such event within fivebusiness days of becoming aware of the event.5.Reporting Breaches of Unsecured PHI.

A.Business Associate will notify Covered Entity in writing promptly upon the discovery of any Breach of Unsecured PHI in accordance with the requirements set forth in 45 CFR §164.410, but in no case later than 10 calendar days after discovery of a Breach. BusinessAssociate will reimburse Covered Entity for any costs incurred by it in complying with the requirements of Subpart D of 45 CFR §164 that are imposed on Covered Entity as a result of a Breach committed by Business Associate. Business Associate will without unreasonable delay investigate a Breach or Security Incident; and, within 72 hours of the discovery, submit an updated incident report to Covered Entity with the following information as such is reasonably available at the time of the submission: i) what data elements were involved and the extent of the data involved in the Breach; (ii) description of the unauthorized persons known or reasonably believed to have improperly used or disclosed PHI or confidential data; (iii) a description of where PHI or confidential data is believed to have been improperly transmitted, sent or utilized; and (iv) description of the potential causes of the improper use or disclosure. B.Business Associate will provide an updated report of the investigation to CoveredEntity within ten (10) business days of the discovery of the Breach. The report shall be submitted on the “Privacy Incident Report” form and shall include an assessment of all known factors relevant to a determination of whether a breach occurred under applicable provisions of HIPAA, the HITECH Act, and the HIPAA regulations. The report shall also include a corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the Covered Entity requests information in addition to that listed on the “Privacy Incident Report” form, Business Associate shall make reasonable efforts to provide the Covered Entity with such information in accordance with its obligations under applicable law. If, because of the circumstances of the Breach, Business Associate needs more than ten (10) business days from the discovery to submit a complete report, the Covered Entity may grant a reasonable extension of time, in which case Business Associate shall submit periodic updates until the complete report is submitted. If necessary, a Supplemental Report may be used to submit revised or additional information after the completed report is submitted, by submitting the revised or additional information on an updated “Privacy Incident Report” form. As communications between the Covered Entity and Business Associate pertaining to a Breach or Security Incident shall be considered highly confidential and shall not be disclosed to any third-party without the prior agreement of the non-disclosing party. C. Business Associate is responsible for reporting aa Breach as specified in 42 U.S.C. § 17932(b) and its implementing regulations. If, to Business Associate’s knowledge, a Breach involves more than 500 residents of the State of California or its jurisdiction, Business Associate shall notify the California Secretary of State of the breach within the time frame required under applicable California law. D.Upon discovery of a Breach or Security Incident, Business Associate shall take: i. Prompt corrective action to mitigate any risks or damages involved with the Breach and to protect the operating environment in which PHI is stored, and ii. Any action pertaining to such unauthorized disclosure required by applicable federal and state laws and regulations. 6.Mitigation of Disclosures of PHI. Business Associate will take reasonable measures to mitigate,to the extent practicable, any harmful effect that is known to Business Associate of any use or disclosure

of PHI by Business Associate or its agents or subcontractors in violation of the requirements of this BAA. 7.Agreements with Agents or Subcontractors. Business Associate will ensure that any of itsagents or subcontractors that have access to, or to which Business Associate provides, PHI agree inwriting to the restrictions and conditions concerning uses and disclosures of PHI contained in this BAAand agree to implement reasonable and appropriate safeguards to protect any Electronic PHI that itcreates, receives, maintains or transmits on behalf of Business Associate or, through the BusinessAssociate. Business Associate shall notify Covered Entity, or upstream Business Associate, of all subcontracts and agreements relating to the Agreement, where the subcontractor or agent receives PHI as described in section 1.M. of this BAA. Such notification shall occur within 30 (thirty) calendardays of the execution of the subcontract by placement of such notice on the Business Associate’sprimary website. Business Associate shall ensure that all subcontracts and agreements provide thesame level of privacy and security as this BAA. 8.Audit Report.Upon request, Business Associate will provide Covered Entity, or upstreamBusiness Associate, with a copy of its most recent independent HIPAA compliance report (AT-C 315),or other mutually agreed upon independent standards based third party audit report. Coveredentity agrees not to re-disclose Business Associate’s audit report. 9.Access to PHI by Individuals. A.Upon request, Business Associate agrees to furnish Covered Entity with copies of the PHI maintained by Business Associate in a Designated Record Set in the time and manner designated by Covered Entity to enable Covered Entity to respond to an Individual’s request foraccess to PHI under 45 CFR §164.524. B. In the event any Individual or personal representative requests access to the Individual’sPHI directly from Business Associate, Business Associate will, within ten business days, forwardthat request to Covered Entity. Any disclosure of, or decision not to disclose, the PHI requestedby an Individual or a personal representative and compliance with the requirements applicable to an Individual’s right to obtain access to PHI shall be the sole responsibility of Covered Entity. 10. Amendment of PHI. A.Upon request and instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set that is maintained by, or otherwise within the possession of, Business Associate as directed by Covered Entity in accordance withprocedures established by 45 CFR §164.526. Any request by Covered Entity to amend suchinformation will be completed by Business Associate within 15 (fifteen) business days of Covered Entity’s request. B. In the event that any Individual requests that Business Associate amend such Individual’s PHI or record in a Designated Record Set, Business Associate will, within ten businessdays, forward this request to Covered Entity. Any amendment of, or decision not to amend, the PHI or record as requested by an Individual and compliance with the requirements applicable to an Individual’s right to request an amendment of PHI will be the sole responsibility of Covered Entity. 11. Accounting of Disclosures. A.Business Associate will document any disclosures of PHI made by it to account for such

disclosures as required by 45 CFR §164.528(a). Business Associate also will make available information related to such disclosures as would be required for Covered Entity to respond to arequest for an accounting of disclosures in accordance with 45 CFR §164.528. At a minimum,Business Associate will furnish Covered Entity the following with respect to any covered disclosures by Business Associate: (i) the date of disclosure of PHI; (ii) the name of the entity or person who received PHI, and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosurewhich includes the basis for such disclosure. B.Business Associate will furnish to Covered Entity information collected in accordancewith this Section 10, within ten business days after written request by Covered Entity, to permitCovered Entity to make an accounting of disclosures as required by 45 CFR §164.528, or in theevent that Covered Entity elects to provide an Individual with a list of its business associates,Business Associate will provide an accounting of its disclosures of PHI upon request of theIndividual, if and to the extent that such accounting is required under the HITECH Act or underHHS regulations adopted in connection with the HITECH Act.C. In the event an Individual delivers the initial request for an accounting directly toBusiness Associate, Business Associate will within ten business days forward such request toCovered Entity. 12. Availability of Books and Records. Business Associate will make available its internal practices,books, agreements, records, and policies and procedures relating to the use and disclosure of PHI, uponrequest, to the Secretary of HHS for purposes of determining Covered Entity’s and Business Associate’scompliance with HIPAA, and this BAA. 13. Responsibilities of Covered Entity. With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity agrees to: A.Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, to the extent that such limitation may affect BusinessAssociate’s use or disclosure of PHI. B. Notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes mayaffect Business Associate’s use or disclosure of PHI. C. Notify Business Associate of any restriction to the use or disclosure of PHI that CoveredEntity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI. D. Except for data aggregation or management and administrative activities of BusinessAssociate, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity. 14. Data Ownership. Business Associate’s data stewardship does not confer data ownership rights on Business Associate with respect to any data shared with it under the Agreement, including any and all forms thereof. 15. Term and Termination.

A.Effective Date. This BAA will become effective on the date it is executed by the last Party to sign the BAA. B.Term. This BAA will continue in effect until all obligations of the Parties have beenmet under it. C.Covered Entity’s Termination Rights. Covered Entity may immediately terminate thisBAA, the Agreement, and any other related agreements if Covered Entity determines thatBusiness Associate has breached a material term of this BAA and Business Associate has failed to cure that material breach, to Covered Entity’s reasonable satisfaction, within 30 (thirty) calendar days after written notice from Covered Entity. Covered Entity may report the problem to the Secretary of HHS if termination is not feasible. D. Business Associate’s Termination Rights. If Business Associate determines that Covered Entity has breached a material term of this BAA, then Business Associate will provide Covered Entity with written notice of the existence of the breach and shall provide Covered Entity with 30 (thirty) business days to cure the breach. Covered Entity’s failure to cure the breach within the 30-day period will be grounds for immediate termination of the Agreement and this BAA by Business Associate. Business Associate may report the breach to HHS. Upon termination of the Agreement or this BAA for any reason, all PHI maintained by Business Associate will be returned to Covered Entity or destroyed by Business Associate. Business Associate will not retain any copies of such information. This provision will apply to PHI in the possession of Business Associate’s agents and subcontractors. If return or destruction of the PHI is not feasible, in Business Associate’s reasonable judgment, Business Associate will furnish Covered Entity with notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return, or destruction of the PHI is infeasible, Business Associate will extend the protections of this BAA to such information for as long as Business Associate retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. The Parties understand that this Section 14.D. will survive any termination of this BAA. E. Return on Termination. At termination of the Agreement, to the extent feasible, Business Associate shall return or destroy all PHI that Business Associate still maintains in any form and retain no copies of the PHI. If the return or destruction of such PHI is not feasible, Business Associate shall extend the protections of this BAA to the remaining information and limit further uses and disclosures of the PHI to those purposes that make the return or destruction of the PHI infeasible. 16.Effect of BAA. A.This BAA is a part of and subject to the terms of the Agreement, except that to theextent any terms of this BAA conflict with any term of the Agreement, the terms of this BAA will govern. B. Except as expressly stated in this BAA or as provided by law, this BAA will not create any rights in favor of any third party. 17. Regulatory References. A reference in this BAA to a section in HIPAA means the section as ineffect or as amended at the time.

18.Mitigation. Business Associate shall promptly mitigate, to the extent practicable, anyharmful effect that is known to Business Associate of a use or disclosure of PHI by BusinessAssociate in violation of this BAA, the Privacy Rule, the Security Rule, or other applicable federal orstate law.19.Remuneration in Exchange for PHI. Except as permitted by the HITECH Act or regulationsissued by the Director of HHS in accordance with the HITECH Act, and as of the effective date ofsuch regulations, Business Associate shall not directly or indirectly receive remuneration inexchange for any PHI unless Covered Entity notifies Business Associate that it obtained a validauthorization from the individual specifying that the individual’s PHI may be exchanged forremuneration by the entity receiving such individual’s PHI.20.Marketing. Unless otherwise permitted in the Agreement, Business Associate must obtainor confirm that Covered Entity has obtained an authorization for any use or disclosure of PHI formarketing, unless the marketing communication is made without any form of remuneration (i) todescribe medical services or products provided by Covered Entity or Business Associate; (ii) fortreatment of the Individual; or (iii) for case management or care coordination for the Individual orto direct or recommend alternative treatments, therapies, providers or settings.21.Personnel Controls.A.Employee Training. All workforce members who assist in the performance of functionsor activities on behalf of the Covered Entity, and who access or disclose Covered Entity PHImust complete information privacy and security training, at least annually, at BusinessAssociate's expense. Each workforce member who receives information privacy and securitytraining must sign a certification, indicating the member’s name and the date on which thetraining was completed. These certifications must be retained for a period of six (6) yearsfollowing termination of this BAA.B.Confidentiality Statement. Business Associate shall ensure that all personnel withaccess to PHI are subject to confidentiality obligations and that they are advised on theconfidential nature of PHI.22.Judicial or Administrative Proceedings. Business Associate will notify the CoveredEntity if it is named as a defendant in a criminal proceeding for a violation of HIPAA or othersecurity or privacy law. The Covered Entity may terminate this BAA if Business Associate is foundguilty of a criminal violation of HIPAA. The Covered Entity may terminate this BAA if a finding orstipulation that the Business Associate has violated any standard or requirement of HIPAA, or othersecurity or privacy laws is made in any administrative or civil proceeding in which the BusinessAssociate is a Party or has been joined. Covered Entity will consider the nature and seriousness ofthe violation in deciding whether or not to terminate the BAA.23.Assistance in Litigation or Administrative Proceedings. Business Associate shall makeitself and any subcontractors, employees or agents assisting Business Associate in the performanceof its obligations under this BAA, available to the Covered Entity at no cost to the Covered Entity totestify as witnesses, or otherwise, in the event of litigation or administrative proceedings beingcommenced against the Covered Entity, its directors, officers or employees based upon claimedviolation of HIPAA, or the HIPAA regulations, which involves inactions or actions by the BusinessAssociate, except where Business Associate or its subcontractor, employee or agent is a namedadverse Party.

24. Conflict. In case of a conflict between any applicable privacy or security rules, laws, regulations or standards the most stringent shall apply. The most stringent means that safeguard which provides the highest level of protection to PHI from unauthorized disclosure. Further, Business Associate must comply within a reasonable period of time with changes to these standards that occur after the effective date of this BAA. 25.Interpretation.The terms and conditions in these Provisions shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA regulations and applicablefederal, state and local laws. The Parties agree that any ambiguity in the terms and conditions of this BAA shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the HIPAA regulations. 26. No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 27. No Waiver of Obligations. No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion. 28. Amendment. The Parties acknowledge that the HITECH Act requires the Secretary to promulgate additional regulations and interpretative guidance that is not available at the time of executing this BAA. In the event Covered Entity determines in good faith that any such regulation or guidance adopted or amended after the execution of this BAA is required by law to be implemented and made a part hereof, this BAA shall be renegotiated in good faith so as to amend the applicable provision(s) in a manner that would eliminate any such substantial risk. 29. Notices. All notices, requests and demands or other communications to be given under this BAAto a Party will be made via either first class mail, registered or certified or express courier, or electronicmail to the Party’s address given below: A.If to Covered Entity, to: Attn: Tim Swanson/Department of Community Response Address: 1000 I St. Suite 120, Sacramento, CA 95814 Email: [email protected] If to Business Associate, to: Attn: Heather Dion/Housing for Health California Address: 17701 Cowan Suite 200, Irvine, CA 92614 Email: [email protected] 30. Amendments and Waiver. This BAA may not be modified, nor will any provision be waived or

amended, except in writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedyas to subsequent events. 31.HITECH Act Compliance. The Parties acknowledge that the HITECH Act includes significantchanges to the Privacy Rule and the Security Rule. The privacy subtitle of the HITECH Act sets forthprovisions that significantly change the requirements for business associates and the agreementsbetween business associates and covered entities under HIPAA and these changes may be furtherclarified in forthcoming regulations and guidance. Each Party agrees to comply with the applicableprovisions of the HITECH Act and any HHS regulations issued with respect to the HITECH Act. The Partiesalso agree to negotiate in good faith to modify this BAA as reasonably necessary to comply with theHITECH Act and its regulations as they become effective but, in the event that the Parties are unable toreach agreement on such a modification, either Party will have the right to terminate this BAA upon 30-days’ prior written notice to the other Party.[The remainder of this page intentionally left blank; signatures on the following page]

IN WITNESS WHEREOF, the Parties identified below have executed this Business Associate Agreement. BUSINESS ASSOCIATE:HOUSING FORHEALTHORANGECOUNTY, DBAHOUSING FOR HEALTH CALIFORNIABY: Name:Title:DATE SIGNED____________________________ COVERED ENTITY: CITY OF SACRAMENTOA MUNICIPAL CORPORATIONBY: NAME:TITLE:DATE SIGNED____________________________ APPROVED AS TO FORM:By: ________________________________Senior Deputy City AttorneyDATE SIGNED ____________________________By: ________________________________

RESOLUTION NO. 2026-XXXX

Adopted by the Sacramento City Council
March 10, 2026

DESIGNATING THE CITY OF SACRAMENTO AS A HYBRID ENTITY UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

BACKGROUND

A. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of health care coverage, standardize health care transactions, and implement requirements surrounding health-information privacy and security.

B. In general, HIPAA addresses protected health information (PHI) that is maintained or transmitted by a covered entity. Covered entities are:

1. Health plans,

2. Health care clearinghouses, and

3. Health-care providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations.

C. The City of Sacramento (“City”) is a covered entity under HIPAA because it conducts certain types of transactions related to health care. However, the majority of City functions do not involve those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity that performs both covered and non- covered functions may designate itself as a hybrid entity under HIPAA.

D. A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to the non-health-care components of the organization. The entity must designate, as part of its covered functions, any component that would meet the definition of a covered entity if it were a separate legal entity. All covered health-care components must comply with HIPAA and the covered entity retains oversight, compliance, and enforcement obligations. See 45 CFR 164.103 and 45 CFR 164.105.

The entity may have non-health-care components impacted by the Privacy Rule because the health-care components are limited in how they can share PHI with non- health-care components.

E. To be a hybrid entity, the covered entity must identify its components that perform covered functions and designate those components as health care components. A covered entity that does not make this designation is subject in its entirety to HIPAA.

F. The City first designated itself as a hybrid entity for HIPAA purposes in 2017 through City Council Resolution No. 2017-0482.

G. The Sacramento Fire Department (SFD) performs HIPAA-covered functions through its prehospital emergency medical services to the public. SFD’s covered functions include creation, receipt, and disclosure of protected health information (PHI) within the meaning of HIPAA, the disclosure of which is subject to HIPAA’s Privacy Rule and exceptions thereto (see 45 CFR 164.501, 164.508, and 164.512(i)).

H. In 2017 the City has previously designated its covered health care components that perform covered functions, including “business associate” type services to components that perform covered functions.

I. Designating the Department of Community Response (DCR) as a covered health care component will enable it to provide services under the California Advancing and Innovating Medi-Cal (CalAIM) program, which involves the management and transmittal of PHI.

J. The City now seeks to update its list of designated covered health care components.

BASED ON THE FACTS SET FORTH IN THE BACKGROUND, THE CITY COUNCIL RESOLVES AS FOLLOWS:

Section 1: The City redesignates itself as a hybrid entity under HIPAA. This determination is made after an analysis of the varied departments and functions within the City. As a hybrid entity, the City conducts activities that are both covered and non-covered.

Section 2: As a hybrid entity, the applicable HIPAA compliance obligations only apply to the City’s designated covered health care components. The designated covered health care components include:

a. Any City component that would meet the definition of a covered entity if it were a separate legal entity;

b. City components, only to the extent that they perform covered functions; and

c. City components that provide “business-associate” type services to components that perform covered functions.

Section 3: The designated covered health care components are listed in Exhibit A.

Section 4: The Director of the Human Resources Department, or their designee, shall serve as the Privacy Officer for City for purposes of HIPAA compliance.

Section 5: The Privacy Officer shall retain, review, and amend Exhibit A as directed by the City Council, pursuant to this Resolution.

Section 6: Resolution No. 2024-0276 is hereby rescinded.

EXHIBIT A

I. Designated Covered Health Care Components. The following functions have been identified as covered components and must comply with HIPAA privacy rules and standards:

• City Attorney’s Office, to the extent it provides business-associate services to parts of the City performing covered functions.

• City Auditor’s Office, to the extent it performs covered functions and/or provides business-associate services to parts of the City performing covered functions.

• City Clerk’s Office, to the extent it provides business-associate services to parts of the City performing covered functions.

• City Manager’s Office, to the extent it performs covered functions.

• Finance Department, to the extent it performs covered functions and/or provides business-associate services to parts of the City performing covered functions.

• Fire Department, to the extent it performs covered functions and/or provides business- associate services to parts of the City performing covered functions.

• Human Resources Department, to the extent it performs covered functions.

• Information Technology Department, to the extent it provides business-associate services to parts of the City performing covered functions.

• Office of Public Safety Accountability, to the extent it performs covered functions.

• Youth, Parks, and Community Enrichment Department (formerly the Parks and Recreation Department), to the extent it performs covered functions and/or provides business-associate services to parts of the City performing covered functions.

• Department of Community Response, to the extent it performs covered functions.

II. Non-covered Components include:

• City Council
• City Treasurer’s Office
• Councilmembers’ Offices
• Community Development Department
• Convention & Cultural Services Department

• Department of Utilities
• Mayor’s Office
• Police Department
• Public Works Department
RESOLUTION NO. 2026-XXXX

Adopted by the Sacramento City Council
March 10, 2026
Authorizing contracts to allow DCR’s participation in the California Advancing and Innovating Medi-Cal (CalAIM) program

BACKGROUND

A. The California Advancing and Innovating Medi-Cal (CalAIM) program (CalAIM) is a multi-year initiative from the State of California’s Department of Health Care Services (DHCS) designed to improve the Medi-Cal program with expanded benefits and a broadened delivery system that makes it more accessible and equitable. People experiencing homelessness are one of CalAIM’s populations of focus; heavy users of emergency rooms are another.

B. CalAIM enables Medi-Cal Managed Care Plans (MCPs) to couple clinical care with a range of non-medical services, which will be reimbursed by Medi-Cal. These non-medical services, known as Community Supports, are designed to help Medi- Cal members meet critical social needs, including housing-related needs.

C. In January 2025, DHCS opened an application period for its Providing Access and Transforming Health (PATH) initiative to build up the capacity and infrastructure of on-the-ground entities to successfully participate in the Medi-Cal delivery system.

In May 2025, DCR applied for PATH Capacity and Infrastructure Transition, Expansion and Development (CITED) funding to develop and implement a CalAIM program focused on providing Community Supports.

D. In November 2025, DCR was notified that though its application was not approved for the originally applied for PATH CITED funding, DHCS was awarding DCR a related funding opportunity, CITED Intergovernmental Transfer (IGT) funding, in the amount of $336,142, which was accepted by the City (Resolution No. 2026- 0007).

E. DCR plans to utilize a “hub organization,” which is contracted with local MCPs, for billing and administrative services. Because DCR is a small department with limited FTEs, using a hub-model approach for the CalAIM administrative functions will allow staff to intensely focus their efforts on building and quickly expanding service provision. DCR recommends the City Council approve a one-year contract with hub organization Housing for Health California (HHCA).

F. HHCA’s responsibilities will include CalAIM billing and claim services, as well as training and compliance for staff with MCP guidelines and policies under Community Support provisions. In addition to the proposed agreement, DCR will also enter into a Business Associate Agreement with HHCA to ensure that the organization will appropriately safeguard Protected Health Information (PHI) that is created, maintained, or transmitted on behalf of the City in compliance with applicable provisions of HIPAA and the HITECH Act.

G. As part of the CalAIM reimbursement for Community Support provision, HHCA will be entitled to 10% of the reimbursable amount, with the remainder going to DCR.

With the City facing continued budget constraints, the CalAIM Community Support Program will help DCR create a self-sustaining funding source while continuing to support the City’s unhoused community.

H. DCR’s Community Supports program will standardize and enhance access to several CalAIM services, including Housing Transition Navigation Services, Housing Deposits, Housing Tenancy and Sustaining Services, Day Habilitation Programs and Transitional Rent. Dedicated DCR staff will oversee the provision of these services across the City’s shelter locations as well as within its street outreach program.

BASED ON THE FACTS SET FORTH IN THE BACKGROUND, THE CITY COUNCIL RESOLVES AS FOLLOWS:

SECTION 1.

The City Manager or designee is authorized to execute a contract with Housing for Health California (HHCA) for CalAIM billing and administrative services for DCR’s participation in the California Advancing and Innovating Medi-Cal (CalAIM) program and a related Business Associate Agreement with HHCA as the services include transmitting Protected Health Information.

SECTION 2.

The City Manager or designee is authorized to adjust the revenue and expenditure budgets (Operating Grants, Fund 2702) in the Homeless Housing Initiative (I23001000) multi-year operating project (MYOP) to support homeless-services programs to reflect actual CalAIM reimbursements received.