Loading...
HR Business Associate AgreementBUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (this "Agreement") is entered into this _Lb_ day of 0C,r0 p&9, , 2016, by and between CITY OF SAN RAFAEL, CALIFORNIA located at 1400 Fifth Avenue, Suite 210, San Rafael, CA 94901 (hereafter "Covered Entity") and AMERICAN FIDELITY ADMINISTRATIVE SERVICES, LLC, an Oklahoma limited liability company located at 9000 Cameron Parkway, Oklahoma City, OK 73114 (hereafter "Business Associate"). WHEREAS, Business Associate may have access to, create or receive Protected Health Information, as hereinafter defined, on behalf of the Covered Entity in connection with services to be provided by Business Associate to Covered Entity from time to time; and WHEREAS, Covered Entity wants to satisfy the applicable requirements of the Privacy Rule, Security Rule and Standard Transactions Rule, as those terms are hereinafter defined, by obtaining satisfactory assurances from Business Associate concerning Business Associate's use, disclosure, requests for, and safeguarding of Protected Health Information, and Business Associate wants to provide such assurances, as more particularly set forth in this Agreement, in order to continue to provide the services; and WHEREAS, Business Associate agrees to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act") (Division A, Title XIII and Division B, Title IV of Public Law 111-5) and implementing regulations (Title 45, Parts 160, 162 and 164 of the Code of Federal Regulations) dealing with the confidentiality, security and standardized transmission of health or health-related information, as applicable to Business Associate; NOW THEREFORE, for and in consideration of the foregoing premises, which are incorporated into and made a part of this Agreement, the parties agree as follows: 1. EFFECTIVE DATE. This Agreement shall be effective as of the day and year first written above with respect to the HIPAA Rules and as of the applicable effective dates for such provisions related to the HITECH Act. 2. DEFINITIONS Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules. Specific definitions: M3449 q - 3- P)Lv a) Breach. "Breach" means the acquisition, access, use, or disclosure, or possibility of acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted by the Privacy Rule. b) Designated Record Set. "Designated Record Set" shall have the same meaning as set forth in 45 CFR § 164.501 and refers to an item, collection, or storing of information that contains protected health information that is used, in whole or in part, to make decisions about individuals, their treatment or billing for services rendered, including medical records and billing records, enrollment, payment, claims adjudication and case or medical management record systems. c) Electronic Health Record. "Electronic Health Record" shall have the same meaning as set forth in section 13400(5) of Public Law 111-5 and any implementing regulations. d) HHS. "HHS" means the U.S. Department of Health and Human Services. e) HIPAA Rules. "HIPAA Rules" means the Privacy Rule, Security Rule and Standard Transactions Rule, collectively. f) HITECH Act. "HITECH Act" shall mean the Health Information Technology for Economic and Clinical Health Act included in the American Recovery and Reinvestment Act of 2009, Public Law 111-5. g) Limited Data Set. "Limited Data Set" shall have the same meaning as set forth in 45 CFR § 164.514(e)(2). h) Privacy Rule. "Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E, as they exist now or as they may be amended. i) Protected Health Information or PHI. "Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" in 45 CFR § 160.103, but for purposes of this Agreement shall be limited to such information created or received by Business Associate from or on behalf of Covered Entity. j) Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.103. In general, "Required by Law" means a mandate contained in law that compels a person to make a use or disclosure of Protected Health Information and that is enforceable in a court of law. k) Secretary. "Secretary" means the Secretary of the U.S. Department of Health and Human Services or his designee. 1) Security Incident. "Security Incident" means the attempted or successful unauthorized access, acquisition, use, disclosure, modification, or destruction of Protected Health Information (whether electronic or non -electronic) or interference with system operations of an information system involving Protected Health Information. m) Security Rule. "Security Rule" means the Security Standards set forth at 45 CFR Parts 160 and 164, as they exist now or as they may be amended. n) Standard Transactions Rule. "Standard Transactions Rule" means the Standards for Electronic Transactions set forth at 45 CFR, Parts 160 and 162, as they exist now or as they may be amended. M3449 2 o) Unsecured Protected Health Information. "Unsecured Protected Health Information" means Protected Health Information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance issued under section 13402(h)(2) of Public Law 111-5 on the HHS Web site. 3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE a) Business Associate agrees not to use or disclose Protected Health Information other than as permitted by this Agreement. b) Business Associate agrees to use appropriate safeguards to prevent any use or disclosure of Protected Health Information for any purpose other than as permitted by this Agreement. c) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information agrees to the same restrictions and conditions applicable, as set forth in this Agreement, to Business Associate, with respect to Protected Health Information and agrees to implement reasonable and appropriate administrative, technical and physical safeguards to protect the confidentiality and security of Protected Health Information. d) Business Associate agrees to make its internal practices (including policies and procedures), books, records, and services relating to the use and disclosure of Protected Health Information and the safeguards established with respect to such information available: 1. to Covered Entity within thirty (30) business days of the date Business Associate receives a request from Covered Entity; and 2. to the Secretary in the time and manner as directed by the Secretary. Notwithstanding the above, no attorney-client, account -client, or other legal privilege shall be deemed waived by Covered Entity or Business Associate by virtue of this provision. e) Business Associate acknowledges that the Privacy Rule requires Covered Entity to provide individuals with a number of privacy rights, including the right to inspect and copy Protected Health Information within the possession or control of Covered Entity and its business associates, the right to amend such Protected Health Information, and the right to obtain an accounting of disclosures of Protected Health Information to third parties for certain purposes. To assist Covered Entity in complying with these requirements, Business Associate agrees to the following: 1. Within ten (10) days of a request by Covered Entity, Business Associate shall, as directed by Covered Entity, either (a) provide a copy of such Protected Health Information as is specified by Covered Entity to Covered Entity or to an individual specified by Covered Entity or (b) M3449 make such Protected Health Information available for inspection and copying by an individual specified by Covered Entity. To the extent that Business Associate uses or maintains an Electronic Health Record with respect to Protected Health Information, Business Associate shall comply with the requirement of this Section to provide a copy of Protected Health Information upon request by providing an electronic copy of such information to Covered Entity, the individual or a third party designated by the individual, as directed by Covered Entity. Business Associate shall maintain a record of any access to Protected Health Information provided under this Section in such form as may be specified by Covered Entity and shall provide a copy of such record to Covered Entity promptly upon request. If any individual requests access to Protected Health Information directly from Business Associate, Business Associate shall notify the individual that the request will be forwarded to Covered Entity and shall promptly forward such request to Covered Entity. 2. Within a reasonable time after a request by Covered Entity, Business Associate agrees to amend or correct Protected Health Information as directed by Covered Entity. 3. Business Associate agrees to record each disclosure made to a third party of Protected Health Information as would be required by Covered Entity to respond to a request by an individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528, with the exception of disclosures made for any of the following purposes: i. treatment, payment, or Covered Entity's health care operations; ii. in response to a request from the individual who is the subject of the disclosed Protected Health Information or that individual's personal representative; iii. to persons involved in that individual's health care or payment for health care; iv. for national security or intelligence purposes; v. to law enforcement officials or correctional institutions regarding inmates; or vi. that are part of a Limited Data Set. At a minimum, Business Associate shall track the following information regarding each disclosure: i. Date of the disclosure; ii. Name of the third party to whom Protected Health Information was disclosed and if known, the address of the third party; iii. A brief description of the disclosed information; and iv. A brief description of the purpose and basis for disclosure. M3449 4 Business Associate shall maintain a record of such information for no less than six (6) years from the date of disclosure and shall provide such information to Covered Entity within thirty (30) days of a request by Covered Entity or, if directed to do so by Covered Entity, shall respond to requests for an accounting of disclosures on behalf of Covered Entity in a manner and timeframe that will allow Covered Entity to comply with the Privacy Rule. It is not anticipated that Business Associate will use or maintain Electronic Health Records on behalf of Covered Entity. However, to the extent that Business Associate does use or maintain any Electronic Health Records on behalf of Covered Entity, Business Associate shall maintain such records of its disclosures of Protected Health Information to third parties with respect to such Electronic Health Records as necessary for Covered Entity to comply with section 13405 of Public Law 111-5 and any implementing regulations. Business Associate shall provide such records of disclosure to Covered Entity upon request or, if directed to do so by Covered Entity, shall respond to requests for an accounting of disclosures on behalf of Covered Entity in a manner and timeframe that will allow Covered Entity to comply with applicable law. f) Business Associate agrees to implement administrative, physical and technical safeguards and security policies and procedures and documentation standards to protect the confidentiality, integrity and availability of Protected Health Information in compliance with 45 CFR §§ 164.308, 164.310, 164.312 and 164.316 in the same manner as such sections apply to Covered Entity. g) Business Associate agrees to report any Security Incident to the Human Resources Department of Covered Entity (the "Compliance Contact"). Business Associate shall make such report promptly in writing but in no case more than thirty (3 0) business days after Business Associate learns of a Security Incident. Such report shall include the following: 1. A description of what happened, including the date of the Security Incident and the date of discovery of the Security Incident; 2. A description of the types of Protected Health Information that were involved in the Security Incident (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code or other types of information were involved) and whether any such information was Unsecured Protected Health Information; 3. Identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, disclosed, modified or destroyed during such Security Incident; M3449 5 4. Business Associate's assessment of whether the Security Incident constitutes a Breach, including Business Associate's reasons for concluding that the Security Incident is, or is not, a Breach. This assessment should address, at minimum, information as to the likelihood of reidentification of the information, the person(s) who acquired the information, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated; 5. Such other information as Covered Entity may request. h) Business Associate agrees to cooperate fully with Covered Entity in investigating any Security Incident and implementing such measures to mitigate any harmful or potentially harmful effects of such Security Incident, as deemed appropriate by Covered Entity in its sole and absolute discretion, including, but not limited to, notifying affected individuals, appropriate authorities and media of the Security Incident, regardless of whether the Security Incident constitutes a Breach and regardless of whether notification is Required by Law, and providing affected individuals with services to protect themselves against identity theft. i) Until such time as the Secretary issues guidance on what constitutes "minimum necessary" for purposes of the Privacy Rule and such guidance becomes effective, Business Associate agrees to limit the use, disclosure or request for Protected Health Information, to the extent practicable, to the Limited Data Set or, if needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such use, disclosure or request in accordance with 45 CFR § 164.502(b). On and after the effective date of guidance first issued by the Secretary on what constitutes "minimum necessary," Business Associate shall limit the use, disclosure or request for Protected Health Information to the minimum necessary in accordance with such guidance. In the case of the disclosure of Protected Health Information by Business Associate, Business Associate shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure, consistent with performance of the services for which Business Associate has been retained by Covered Entity and any directives or guidelines Covered Entity may specify. j) Business Associate agrees that it shall not directly or indirectly receive remuneration in exchange for any Protected Health Information; provided, however, that this provision shall not prohibit Business Associate from (a) accepting remuneration from Covered Entity in consideration for the services performed by Business Associate for Covered Entity or (b) charging individuals a reasonable, cost -based fee approved by Covered Entity for providing a Copy of Protected Health Information pursuant to Section 3(e)(1) of this Agreement. k) If and to the extent that Business Associate conducts any transaction subject the Standard Transactions Rule for or on behalf of Covered Entity, Business Associate shall comply, and shall require any agent or subcontractor conducting such transaction to comply, with each applicable requirement of the Standard Transactions Rule in the same manner as such requirement applies to Covered M3449 6 Entity. Business Associate shall not enter into, or permit its agents or subcontractors to enter into, any agreement in connection with the conduct of any transaction for or on behalf of Covered Entity that: 1. changes any definition, data condition, or use of a data element or segment as described in the Standard Transactions Rule (45 CFR § 162.915(a)); 2. adds any data elements or segments to the maximum defined data set as described in the Standard Transactions Rule (45 CFR § 162.915(b)); 3. uses any code or data elements that are either marked "not used" in the Standard Transactions Rule's implementation specifications or are not in the Standard Transaction Rule's implementation specifications (45 CFR § 162.915 (c)); and 4. changes the meaning or intent of any of the Standard Transactions Rule's implementation specifications (45 CFR § 162.915(d)). 1) To the extent required by law, Business Associate shall defend, indemnify and hold harmless Covered Entity from and against any penalties, attorneys' fees, costs, expenses, losses, claims, damages or liabilities (or actions in respect thereof) to which Covered Entity may become subject insofar as such penalties, attorneys' fees, costs, expenses, losses, claims, damages or liabilities (or actions in respect thereof) arise out of or are based upon any Security Incident, breach of this Agreement or any unauthorized use or disclosure of Protected Health Information by Business Associate and/or agents or subcontractors acting or accessing PHI on behalf of Business Associate. m) Business Associate agrees to execute an appropriate Business Associate Agreement with any agent, subcontractor, or other such party accessing Protected Health Information on behalf of Business Associate. 4. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE a) Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as necessary to perform any written agreement for services between Covered Entity and Business Associate, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity. b) Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to the extent necessary for Business Associate's proper management and administration, or to carry out Business Associate's legal responsibilities if: 1. The disclosure is Required by Law; or 2. Business Associate obtains reasonable assurances, evidenced by written contract, from any person or organization to which Business Associate M3449 7 shall disclose such Protected Health Information that such person or organization shall: i. hold such Protected Health Information in confidence and use or further disclose it only for the purpose for which Business Associate disclosed it to the person or organization or as Required by Law; and ii. notify Business Associate, who shall in turn promptly notify Covered Entity's Human Resources Department, of any instance which the person or organization becomes aware of in which the confidentiality of such Protected Health Information was breached. c) Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide data aggregation services to Covered Entity as permitted by 45 CFR § 164.504(e)(2)(i)(B). 5. OBLIGATIONS OF COVERED ENTITY a) Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity. b) Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity's notice of privacy practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. c) Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose Protected Health Information to the extent that such changes may affect Business Associate's use or disclosure of Protected Health Information. d) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information requested by an individual to which Covered Entity has agreed in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information. 6. TERM AND TERMINATION a) Term. This Agreement shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is not feasible or permitted by law to return or destroy Protected Health Information, protections are extended to such information in accordance with the termination provisions in this Section. M3449 b) Termination for Cause. Upon Covered Entity's knowledge of a material breach of this Agreement by Business Associate, Covered Entity shall either: 1. Provide an opportunity for Business Associate to cure the breach and terminate this Agreement and any service agreement between the parties if Business Associate does not cure the breach within such reasonable time period specified by Covered Entity (not less than thirty (30) days) after Covered Entity notifies Business Associate in writing of the breach; or 2. Immediately terminate this Agreement and any service agreement between the parties if Business Associate has breached a material term of this Agreement and cure is not possible; or 3. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary. Covered Entity's remedies under this Section shall be cumulative and the exercise of any remedy shall not preclude the exercise of any other. Before exercising any of these options, Covered Entity shall provide reasonable written notice to Business Associate describing the violation and the action it intends to take. c) Effect of Termination. 1. Except as provided in paragraph 2 herein below, upon termination of this Agreement for any reason, upon direction of Covered Entity, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall also apply to Protected Health Information that is in the possession of agents or subcontractors of Business Associate. Business Associate shall retain no copies of Protected Health Information, unless Required by Law. 2. In the event Business Associate reasonably determines that returning or destroying Protected Health Information is not feasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction not feasible and shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information for so long as Business Associate maintains such Protected Health Information. 7. MISCELLANEOUS a) Regulatory References. All references to the HIPAA Rules codified in 45 CFR shall mean the referenced sections as in effect or as amended by the HITECH Act and as may be further amended by law or regulation. b) Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with M3449 9 the requirements of the Privacy Rule, the Security Rule, the Standard Transactions Rule, the Health Insurance Portability and Accountability Act of 1996, and any other applicable law. c) HITECH Act Compliance. The parties acknowledge that the HITECH Act includes several provisions impacting the health care industry, including significant changes to the HIPAA Rules. The Privacy Subtitle of the HITECII Act sects forth provisions that significantly change the requirements for business associates and the agreements between business associates and covered entities under the HIPAA Rules and many of these changes will be clarified in forthcoming regulations. Each party agrees to comply with the applicable provisions of the HITECH Act and any implementing regulations issued thereunder and agree to take such action to modify this Amendment as reasonably necessary to comply with the HITECH Act and its implementing regulations, guidance, and interpretations as they become effective. d) Audit. Covered Entity may, at any time upon reasonable prior notice, examine the use, disclosure and maintenance of Protected Health Information by Business Associate and Business Associate's employees, officers, directors, agents, auditors, attorneys and independent contractors, including the safeguards employed to protect the confidentiality of Protected Health Information. Business Associate shall cooperate fully in any such examination and shall require Business Associate's employees, officers, directors, agents, auditors, attorneys and independent contractors to cooperate fully. e) Ownership of Information. As between Covered Entity and Business Associate, Covered Entity shall retain all right, title and interest in and to all Protected Health Information. Subject to the terms and conditions of this Agreement, Covered Entity grants Business Associate a limited, non-exclusive and non- transferable license to use Protected Health Information as necessary to perform the services specified in the written agreement(s) for services between Covered Entity and Business Associate. f) Expenses. Business Associate's compliance with this Agreement, including without limitation, providing access to Protected Health Information; accounting for disclosures of Protected Health Information; correction or amendment of Protected Health Information; cooperation with the implementation of mitigating measures deemed appropriate by Covered Entity following a Security Incident; the return or destruction of Protected Health Information; and cooperation with any examination of the use, disclosure or maintenance of Protected Health Information by Business Associate, shall be at Business Associate's sole expense. g) Irreparable Harm. Business Associate acknowledges and agrees that any use, disclosure or maintenance of any Protected Health Information in a manner inconsistent with this Agreement may give rise to irreparable injury to Covered Entity for which damages would not be an adequate remedy. Accordingly, in addition to any other legal remedies which may be available at law or in equity, Covered Entity shall be entitled to equitable or injunctive relief against the M3449 10 unauthorized use or disclosure of Protected Health Information or failure to maintain the security of Protected Health Information as required by this Agreement. h) Severability. To the greatest extent possible, each provision under this Agreement shall be interpreted in such a manner as to be valid under applicable law, but if any provision of this Agreement is found to be invalid, it shall be to that extent deemed omitted, and the balance of the Agreement shall remain enforceable. i) Survival. The rights and obligations of the parties under Section 3 (1) and Section 6(c) ("Effect of Termination") of this Agreement shall survive the termination of this Agreement. j) Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy Rule, the Security Rule, the Standard Transactions Rule, the Health Insurance Portability and Accountability Act of 1996, the HITECH Act and any other applicable law. k) No Tliird Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything confer, upon any person other than the Covered Entity and Business Associate, and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 1) No Agency Relationship. Nothing express or implied in this Agreement is intended to establish, nor shall anything establish, an agency relationship between the Covered Entity and Business Associate, and their respective successors or assigns. m) Entire Agreement. This Agreement constitutes the entire agreement between the parties relating to the use and disclosure of Protected Health Information. There are no understandings or agreements relating to the use and disclosure of Protected Health Information which are not fully expressed in this Agreement and no change, waiver or discharge of obligations arising under this Agreement shall be valid unless executed in writing by the party to whom such change, waiver or discharge is sought to be enforced. [SIGNATURE PAGE FOLLOWS] M3449 AGREED: BUSINESS ASSOCIATE: AMERICAN FIDELITY ADMINISTRATIVE SERVICES, LLC Address: P.O. Box 25523 Oklahoma City, OK 73114 ... _.... .... _. Name: Mary Nash Title: Chief Operations Officer Date: COVERED ENTITY: CITY OF SAN RAFAEL, CALIFORNIA Address: 1400 Fifth Avenue, Suite 210 San Rafael, CA 94901 Nam : r... G Title: i� kA4 NAnb Date: j - f�_ Reproved as to. form ATTEST: 'nef . X-e',e.'" . ESTHER C. BEIRNE, City Clerk M3449 12 CONTRACT ROUTING FORM INSTRUCTIONS: Use this cover sheet to circulate all contracts for review and approval in the order shown below. TO BE COMPLETED BY INITIATING DEPARTMENT PROJECT MANAGER: Contracting Department: Human Resources Project Manager: Stacey Peterson Extension: 3069 Contractor Name: American Fidelity Administrative Services, LLC Contractor's Contact: Kent Borgman, Transition Consulstant Contacts Email: Kent.Borgman@americanfidelity.com (877-302-5073) ❑ FPPC: Check if Contractor/Consultant must file Form 700 Step RESPONSIBLE DESCRIPTION COMPLETED REVIEWER DEPARTMENT DATE Check/Initial 1 Project Manager a. Email PINS Introductory Notice to Contractor N/A ❑ 9/15/2016 b. Email contract (in Word) & attachments to City Atty c/o Laraine.Gittens@cityofsanrafael.org 2 City Attorney a. Review, revise, and comment on draft agreement 9/19/2016 and return to Project Manager Click here to ls,'ETD b. Confirm insurance requirements, create Job on cnt.cr u date. PINS, send PINS insurance notice to contractor ❑ N/A 3 Project Manager Forward three (3) originals of final agreement to N/A -CM ❑ contractor for their signature- SIGNS FIRST 4 Project Manager When necessary, * contractor -signed agreement ® N/A agendized for Council approval *PSA > $20,000; or Purchase > $35,000; or Or ❑ Public Works Contract > $125,000 Date of Council approval C'icic here to enter a date PRINT CONTINUE ROUTING PROCESS WITH HARD COPY 5 Project Manager Forward signed original agreements to City Attorney with printed copy of this routing form 6 City Attorney Review and approve hard copy of signed 10/11/16 ETD agreement 7 City Attorney Review and approve insurance in PINS , and bonds N/A (for Public Works Contracts) 8 City Manager / Mayor Agreement executed by Council authorized official I, 9 City Clerk Attest signatures, retains original agreement and forwards copies to Project Manager /&