Outsourced Internal Audit Services

TARRANT COUNTY

HOSPITAL DISTRICT d/b/a

JPS HEALTH NETWORK

REQUEST FOR QUALIFICATIONS FOR PROFESSIONAL SERVICES #20261382539 Outsourced Internal Audit Services

The Tarrant County Hospital District d/b/a JPS Health Network (the "District") is seeking proposals for the provision of Outsourced Internal Audit Services.

The District will reject any proposal that fails to comply in all respects with the instructions set forth herein for responding to this Solicitation. NO EXCEPTIONS WILL BE MADE, even if you are a current or prior vendor for the District. The contract awarded, if any, under and pursuant to this Solicitation shall supersede any previous contract, bid, or GPO agreement for the products or services described herein.

Release Date: 05-12-2026

Response Deadline: 06-02-2026, 2:00 p.m. CST

OVERVIEW

INTRODUCTION AND OVERVIEW

The District desires to award a contract or contracts based upon vendor proposals ("Solicitation Response(s)") to this Solicitation ("Solicitation"). The District is soliciting vendor proposals from vendors capable of supplying the District with certain Professional and Consulting Services pursuant to the Texas Government Code 2254 - namely, Outsourced Internal Audit Services (the "Service(s)"), as set forth and specified herein (See Section II below, BUSINESS REQUIREMENTS, attached hereto and incorporated herein for all purposes). All Solicitation Responses must be delivered to the District by the date and time, and in the manner specified in Section I.B hereof to be considered an Solicitation Response by the District. It is the sole responsibility of the vendor submitting a Solicitation Response ("Respondent") to ensure that its Solicitation Response is delivered to the proper location on time and in the manner set forth herein.

A Solicitation Response does not commit the District to accept such Solicitation Response or to award a contract based on any Solicitation Response ("Contract Award") merely because a Solicitation Response may propose the lowest price for the Services. The District expressly reserves the right to base any Contract Award hereunder upon its evaluation of all relevant factors regarding the vendor, including, but not limited to, Service pricing and terms, management experience and expertise, industry reputation and profile, performance history, support services, location and accessibility, and any other information relevant to its evaluation. Qualifications and omissions will be taken into account when evaluating vendor solicitation responses. A Solicitation Response that does not meet the minimum requirements set forth in Section II below, BUSINESS REQUIREMENTS, will be disqualified.

This Solicitation is not an order and does not commit the District to pay for any costs incurred by the prospective vendor in the preparation or submission of the Solicitation or in the procurement of the Service. Service quantity estimates used herein may or may not reflect actual quantities needed or used by the District in the future, and do not commit the District to order specific Service quantities. Any Solicitation Response accompanied by terms and conditions that conflict with this Solicitation may be rejected by the District.

The District reserves the right to reject any or all Solicitation Responses and to issue a Contract Award or not to issue a Contract Award based solely on the Solicitation Responses received by the District in response to this Solicitation. However, prior to making any award hereunder, the District also reserves the right to engage in additional discussions with one or more of the vendors responding to this Solicitation.

Any prospective Respondent may request an explanation or interpretation of any portion of this Solicitation by complying with the request procedure described in Section I.C.2 below. The responses, if any, of the District to such requests are subject to and will be in the form of amendment to the Solicitation and will comply with the provisions of Section I.C.2 below. The District may elect not to respond to any or all such requests received from prospective Respondents.

SMALL OR HISTORICALLY UNDERUTILIZED BUSINESS PARTICIPATION

The District maintains a policy of encouraging and engaging in business transactions with vendors who HUB are small or historically underutilized businesses. The District establishes a 25% good faith target goal. The District also encourages its vendors to utilize subcontractors and vendors who qualify and are certified under applicable law as HUBs. HUB Respondents are also strongly encouraged to subcontract to other HUBs to expand HUB participation beyond Respondent's own self-performance. HUB Respondents should identify and list HUB subcontractors and other relevant information under the appropriate Solicitation Response section(s) and on the Good Faith Form (Exhibit F). Prior to the Contract Award, a Respondent's good faith efforts to utilize HUB subcontractors and vendors in its business transactions shall be part of the criteria under which the vendor proposals will be considered. Each Respondent will be required to show in its Solicitation Response its efforts to utilize HUB subcontractors and vendors in its business transactions.

VENDOR PORTAL

Prior to the District's consideration of a Respondent's Solicitation Response each Respondent is required to register as a vendor in the District's online vendor portal, B2Gnow, located on the District's Website at: .

The District will monitor contract compliance via B2GNow. The prime vendor and any subcontractors awarded contracts as a result of this Solicitation are required to use the secure web-based system to submit project information including, but not limited to, monthly progress payment reports and other information related to HUB participation. The District may require additional information related to the contract to be provided electronically through the system at any time before, during, or after contract award. Noncompliance may result in exclusion of a vendor from future contract opportunities with the District.

REPORTING

This contract is subject to compliance tracking, and the prime contractor and any subcontractors are required to provide any noted and/or requested contract compliance-related data electronically in the Vendor Portal, also known as B2GNow. The prime contractor and all subcontractors are responsible for responding by the due date and to check the B2GNow Portal on a regular basis to manage contact information and contract records. The prime contractor is responsible for ensuring all subcontractors have completed all requested items and that their contact information is accurate and up-to-date. The JPS Health Network and its designated personnel may require additional information related to the contract to be provided electronically through the system at any time before, during, or after contract award.

Information related to contractor access of the system will be provided to a designated point of contact with each contractor upon award of the contract. B2GNow is web-based and can be accessed at the following Internet address: .

COMPLIANCE WITH TEXAS GOVERNMENT CODE SECTION 2252.908

Please note that Texas Government Code Section 2252.908 does not require any action until after a vendor has been awarded and a contract is ready for the District's Board of Managers approval. Form 1295s require the District's contract tracking number, which does not exist until after a vendor has been awarded.

Texas Government Code Section 2252.908 ("Section 2252.908") states that a governmental entity or state agency may not enter into certain contracts with a business entity unless the business entity submits Form 1295, a disclosure of interested parties, to the governmental entity or state agency at the time the business entity submits the signed contract to the governmental entity or state agency. Section 2252.908 applies to all contracts entered into from and after January 1, 2016 between business entities and Texas governmental entities and state agencies which meet either one of the following criteria:

1. the contract requires a vote of the governing body of the Texas governmental entity, or

2. the contract has a contractual value of at least $1 Million.

The Texas Ethics Commission has adopted a Certificate of Interested Parties form ("Form 1295") and has made it available on the TEC website.

In 2017 Section 2252.908 was amended to provide that the requirements of Section 2252.908 do not apply to the following contracts entered into or amended after January 1, 2018:

1. a contract with a publicly traded business entity, including a wholly owned subsidiary of the business entity;

2. a contract with an electric utility, as that term is defined by Section 31.002, Texas Utilities Code; or

3. a contract with a gas utility, as that term is defined by Section 121.001, Texas Utilities Code.

In the event a Contract Award is issued pursuant to this Solicitation, the Respondent receiving the Contract Award shall be required to comply with the provisions of Section 2252.908, Texas Government Code, and the Chapter 46 Rules of the TEC, prior to entry into a contract with the District. The TEC has posted a video tutorial to its website for business entity filings of Form 1295. The TEC video provides step-by-step tutorials for creating login accounts for the business entity for completing and filing Form 1295. The TEC video tutorials can be viewed on its website at:

The TEC's FAQs are posted on its website at:

COMPLIANCE WITH TEXAS GOVERNMENT CODE 2271 (Boycott of Israel Prohibited)

In 2017 Texas Government Code Section et seq. was enacted to provide that a Texas governmental entity is prohibited from entering into a contract with a company unless the contract contains a written verification by the company that (i) the company does not boycott Israel, and (ii) the company will not boycott Israel during the term of the contract. The requirement was modified in 2019 to apply only to contracts with a value of $100,000 or more that are made with a company (not including sole proprietorships) with 10 or more full-time employees. The term "boycott Israel" is defined in Section of the Texas Government Code and means refusing to deal with, terminating business activities with, or otherwise taking any action that is intended to penalize, inflict harm on, or limit commercial relationships specifically with Israel, or with a person or entity doing business in Israel or in an Israel-controlled territory, but does not include an action made for ordinary business purposes. Any awarded contract must comply with the verification requirements in Texas Government Code Section , and a Respondent's failure or refusal to comply will result in the withdrawal of the Contract Award. Respondents should ensure they and their affiliates do not appear on the Texas Comptroller's .

COMPLIANCE WITH TEXAS GOVERNMENT CODE SECTIONS 2252.151 et seq. (Scrutinized Business Operations in Sudan, Iran, or with Designated Foreign Terrorist Organizations Prohibited)

In 2017 Texas Government Code Chapter 2252 was amended by adding Sections et seq. to provide that a Texas governmental entity is prohibited from entering into a contract with a company that engages in certain scrutinized business operations in Sudan, Iran, or with foreign terrorist organizations. A Texas government entity may not enter into a contract with a "scrutinized company" as defined in Section of the Texas Government Code. Respondents should ensure that they and their affiliates do not appear on the Texas Comptroller's . The District is from entering into a contract with a company on such a list (including a company with any affiliate on the list).

COMPLIANCE WITH TEXAS GOVERNMENT CODE 2274 (Discrimination Against Firearm Entities or Firearm Trade Associations Prohibited)

In 2021, Texas Government Code Chapter was enacted to provide that a Texas governmental entity is prohibited from entering into a contract with a company unless the contract contains a written verification by the company that (i) the company does not have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association, and (ii) the company will not discriminate against a firearm entity or firearm trade association during the term of the contract. The requirement applies only to contracts with a value of $100,000 or more that are made with a company (not including sole proprietorships) with 10 or more full-time employees. The requirement does not apply to sole source contracts or competitive solicitations-related contracts where no respondent can provide the verification required. (See Sec. ). The term "discriminate against a firearm entity or firearm trade association" is defined in Texas Government Code Section and means, with respect to the entity or association, to: (i) refuse to engage in the trade of any goods or services with the entity or association based solely on its status as a firearm entity or firearm trade association; (ii) refrain from continuing an existing business relationship with the entity or association based solely on its status as a firearm entity or firearm trade association; or (iii) terminate an existing business relationship with the entity or association based solely on its status as a firearm entity or firearm trade association; the term does not include: (i) the established policies of a merchant, retail seller, or platform that restrict or prohibit the listing or selling of ammunition, firearms, or firearm accessories; and (ii) a company's refusal to engage in the trade of any goods or services, decision to refrain from continuing an existing business relationship, or decision to terminate an existing business relationship: (aa) to comply with federal, state, or local law, policy, or regulations or a directive by a regulatory agency; or (bb) for any traditional business reason that is specific to the customer or potential customer and not based solely on an entity's or association's status as a firearm entity or firearm trade association. Any awarded contract must comply with the verification requirements in Texas Government Code Section , and a Respondent's failure or refusal to comply will result in the withdrawal of the Contract Award.

COMPLIANCE WITH TEXAS GOVERNMENT CODE 2276 (Boycott of Certain Energy Companies Prohibited)

In 2021, Texas Government Code Chapter was enacted to provide that a Texas governmental entity is prohibited from entering into a contract with a company unless the contract contains a written verification by the company that (i) the company does not boycott energy companies, and (ii) the company will not boycott energy companies during the term of the contract. The requirement applies only to contracts with a value of $100,000 or more that are made with a company (not including sole proprietorships) with 10 or more full-time employees. The term "boycott energy company" is defined in Section of the Texas Government Code and means, without an ordinary business purpose, refusing to deal with, terminating business activities with, or otherwise taking any action that is intended to penalize, inflict economic harm on, or limit commercial relations with a company because the company: (A) engages in the exploration, production, utilization, transportation, sale, or manufacturing of fossil fuel-based energy and does not commit or pledge to meet environmental standards beyond applicable federal and state law; or (B) does business with a company described by subsection (A). Any awarded contract must comply with the verification requirements in Texas Government Code Section , and a Respondent's failure or refusal to comply will result in the withdrawal of the Contract Award.

TEXAS PUBLIC INFORMATION ACT

Each Respondent acknowledges that the District is a governmental body operating under and subject to the provisions of the Texas Public Information Act ("TPIA") (Chapter 552 of the Texas Government Code) and thereby acknowledges that certain information collected, assembled, or maintained in connection with the transaction of official business by a governmental body is considered public information potentially subject to disclosure pursuant to a valid TPIA request. Respondent is responsible for challenging any requests for information it considers confidential under the TPIA. The requirements of Subchapter J, Chapter 552 of the Texas Government Code apply to this bid, and the contractor or vendor agrees that that the contract can be terminated if the contractor or vendor knowingly or intentionally fails to comply with a requirement of that subchapter. Respondents should consult the Attorney General's website () for information concerning the application of the provisions of the TPIA to proposals and proprietary vendor information.

SOLICITATION RESPONSE REQUIREMENTS, CONDITIONS AND RELATED INFORMATION

Preparation of Solicitation Response.

Each Respondent should carefully examine and familiarize itself with this Solicitation and all exhibits, drawings, specifications, and instructions regarding the Services included in this Solicitation (collectively, the "Solicitation Documents"). Each Respondent, by submitting a Solicitation Proposal, represents that Respondent has read and understands this Solicitation and the drawings, exhibits attached to this Solicitation.

Each Solicitation Response shall be fully completed, shall contain all the information required from the Respondent by this Solicitation, including the Vendor Certification Form attached hereto as Exhibit D ("Required Information"), and shall be signed and executed, on the Signature Form attached hereto as Exhibit B by an officer or other authorized representative of the Respondent. Each page of a Solicitation Response shall contain the company name of the Respondent. A Respondent's failure to provide any of the Required Information in its Solicitation Response, or the failure of the Solicitation Response to contain the signature of Respondent's officer or other duly authorized representative, may result in the District's disqualification of such Solicitation Response. The Required Information shall include detailed information regarding the Respondent's historical efforts (for the last year) to utilize HUB subcontractors and vendors in its prior business transactions and shall include such detailed information in its Solicitation Response.

Each Respondent shall be responsible for and shall bear all costs for the preparation and presentation of its Solicitation Response. Unless otherwise designated by Respondent and agreed by the District, the Solicitation Response and all drawings, materials, supporting documentation, manuals, etc. submitted with any Solicitation Response ("Submitted Materials") will, immediately upon submission, become the property of the District. After the date upon which the final vendor is selected (See Section I.C.1 below) Respondents may request the return of the Submitted Materials. However, all costs associated with returning the Submitted Materials to a Respondent shall be born and paid in advance by the Respondent.

The District does not guarantee the confidentiality of any Submitted Materials. Each Respondent, by submitting a Solicitation Response, acknowledges and agrees that any Submitted Materials will be distributed or made available to appropriate District personnel and consultants involved in this Solicitation process, and further understands that the Submitted Materials may be subject to disclosure pursuant to the TPIA. Information considered proprietary by a Respondent should be clearly marked "Proprietary" when submitted with a Solicitation Response.

The District reserves the right to modify and/or supplement this Solicitation by amendment issued by the District prior to the date and time of the Response Deadline (defined herein). Any such amendments will be posted online prior to the Response Deadline at the same District internet site where this Solicitation is kept available for solicitation of Solicitation Responses. It is the responsibility of each Respondent to check that internet site frequently to determine if any amendments have been issued.

The District reserves the right to withdraw this Solicitation, at its sole discretion, from any or all prospective vendors and Respondents at any time, before or after the Response Deadline. The withdrawal, if ever, of this Solicitation shall be effective upon the District's issuance of written notice posted online at the same District internet site where this Solicitation is kept available for solicitation of Solicitation Responses, which notice may also be sent by the District to the prospective Respondents in any manner deemed reasonable by the District.

Form of Contract.

Any Respondent awarded a contract with the District for the purchase and sale of the products and/or services pursuant to this Solicitation shall be required to execute an agreement between the Respondent and the District which shall in all material respects contain the terms and conditions set forth in Exhibit C (Contract Terms), which is attached hereto and incorporated herein for all purposes. The District will not agree to change the Contract Terms except under unusual circumstances approved in the sole discretion of the District and its legal counsel. The District will entertain changes to the Contract Terms to the limited extent required to conform the unique terms of the Solicitation Response to the Contract Terms (e.g., unique payment provisions, terms and conditions). The District reserves the right to approve or reject any proposed changes to the Contract Terms submitted by Respondents.

IF ANY RESPONDENT PROPOSES CHANGES TO THE CONTRACT TERMS THE RESPONDENT MUST DO SO BY PROVIDING A REDLINE IN RESPONSE TO EXHIBIT C, THE VENDOR'S PROPOSED REVISIONS SHOWING ALL PROPOSED EXCEPTIONS, ADDITIONS, DELETIONS AND/OR REVISIONS TO THE REQUIRED CONTRACT TERMS. A RESPONDENT'S ATTEMPT TO PROVIDE ITS PROPOSED EXCEPTIONS, ADDITIONS, DELETIONS AND/OR REVISIONS IN ANY MANNER OTHER THAN AS INSTRUCTED MAY RESULT IN THE DISTRICT'S REJECTION OF THE RESPONSE WITHOUT FURTHER EXAMINATION.

Respondents may not request additional changes to the Contract Terms after the Solicitation Response has been submitted to the District, nor will the District agree to negotiate any requested changes to the Contract Terms which are not included with the Solicitation Response in the manner and form set forth above in this section I.B.2 and in Exhibit C.

Submission of Solicitation Responses.

All Solicitation Responses shall be submitted to the District as follows:

All Solicitation Responses must be electronically submitted via file upload at this website: . Please ensure this RFQP# 20261382539 is entered in the "Bidding Opportunity Num" field on the Response Form, as well as in the file name(s) of each uploaded file. The proposal (except for any redline of the Contract Terms) must be submitted in a format that preserves graphic appearance, such as portable document format (PDF) or other digital image format that is platform-independent and easily readable without purchased software. If you submit a redline in response to Exhibit C, you must provide an editable, unlocked/unsecured version of the redline with your Solicitation Response (preferably in track changes).

An attempted award will be deemed invalid if the Respondent, upon award of a contract (if ever), is not registered with JPS Vendor Portal () or is not in compliance with the District's requirements for vendor credentialing.

Respondents must submit the Solicitation Response as follows: the file name(s) of each file making up the Solicitation Response must begin with (i) the RFQP# followed by (ii) the Respondent's name. Also, the cover page of the Solicitation Response must state the following: (i) the name and address of the Respondent, (ii) the Response Deadline, and (iii) the Solicitation number. Please put the RFQP# in the "Bidding Opportunity Num" field on the Response Form.

Unless otherwise expressly provided in this Solicitation or in any amendment to this Solicitation, no Respondent shall modify or cancel the Solicitation Response or any part thereof for thirty (30) days after the Response Deadline. Respondents may withdraw Solicitation Proposals at any time before the Solicitation Proposals are opened by the District, but may not resubmit them. No Solicitation Proposal may be withdrawn or modified after the Solicitation Proposal deadline.

Solicitation Proposals will not be considered if they show any omissions, alterations of required forms, additions or conditions not requested or irregularities of any kind. However, the District reserves the right to waive any irregularities and to make the award in the best interest of the District.

The Respondent acknowledges the right of the District to reject any or all Solicitation Responses and to waive any informality or irregularity in any Solicitation Response received. In addition, the District reserves the right to reject any Solicitation Response if the Respondent failed to submit the data, information or documents required by this Solicitation, or if the Solicitation Proposal is in any way incomplete or irregular.

Failure to follow the instructions regarding the submission of Solicitation Responses may result in the District's disqualification of such Solicitation Responses.

Solicitation Responses are due on or before 06-02-2026, 2:00 p.m. CST ("Response Deadline"). The Response Deadline may be extended by the District upon amendment to this Solicitation issued prior to the then-existing Response Deadline. Solicitation Responses are not scheduled for public opening. No email, telephone, telephonic, or FAX Solicitation Responses will be accepted. The District will not be responsible for missing, lost, or late deliveries. Solicitation Proposals delivered after the Response Deadline will not be accepted or considered under any circumstances.

Each Solicitation Response shall contain the completed form entitled, "Vendor Certification Form" set forth on Exhibit D which is attached hereto and incorporated herein for all purposes.

Each Solicitation Response shall contain the completed form entitled "Conflict of Interest Questionnaire" set forth on Exhibit E which is attached hereto and incorporated herein for all purposes and shall return the Conflict of Interest Questionnaire with its Solicitation Response.

SOLICITATION SCHEDULE AND RELATED INFORMATION

Estimated Schedule

Pre-Proposal Conference. No Pre-Proposal Conference will be conducted.

Milestone Dates. Milestone Dates are estimated for planning purposes only and are subject to change.

District Solicitation Contact

Respondents may, in the manner prescribed herein, present requests ("Submission Questions") for an explanation, clarification or interpretation of the BUSINESS REQUIREMENTS in this Solicitation and/or other requirements for submission of Solicitation Responses to the Solicitation Contact identified below during the proposal submission period. All Submission Questions must be submitted in a Questions Submission Form (attached to the Bidding Opportunity) as an editable Excel document. All Submission Questions must be electronically submitted via file upload at this website: , and must reference the appropriate pages and sections number of this Solicitation that are the subject of such Submission Questions. The file name of the Questions Submission Form must begin with (i) the RFP# followed by (ii) the Respondent's name. The final date and time to submit Submission Questions is 05-22-2026, 2:00 p.m. Central Time. NO PHONE CALLS PLEASE. Confirmation of the delivery of Submission Questions to the District is the sole responsibility of the Respondent. The District may, in its sole discretion, elect not to answer or respond to any or all Submission Questions it receives, and the failure of refusal of the District to answer or respond to any Submission Question will not affect, in any way, this Solicitation. Submission Questions may be informally addressed during the Pre-Proposal Conference; provided, however, that no answer or response to any Submission Question by any representative of the District shall be effective unless and until it is issued by the District in writing in the form of one or more addenda to the Solicitation, and has been posted to the District's Solicitation website link prior to the Response Deadline. It is the responsibility of each Respondent to check the website for all addenda to the Solicitation up to the Response Deadline. Prospective vendors are advised that no District employee other than the Solicitation Contact is empowered to make binding statements regarding this Solicitation, and no statements, clarifications, or corrections regarding this Solicitation are valid or binding on the District except those issued in writing by the Solicitation Contact as addenda to the Solicitation.

Contact between Respondents and the District, other than in the manner described and set forth in this Section I.C.2, during the Solicitation Response submission period or evaluation period is prohibited. Any attempt by a Respondent to engage in prohibited contact with the District or the Solicitation Contact may result in disqualification of its Solicitation Response.

The Solicitation Contact is:

Eureka Harris, Sourcing & Contracts Specialist

Supply Chain Department

JPS Health Network

JPS Purchasing Office

1500 S. Main Street

Fort Worth, TX 76104

Email:

District's Solicitation website link:

Solicitation Response submission website link:

BUSINESS REQUIREMENTS

INTRODUCTION

To meet the District's demand for professional services, the District utilizes a proposal called an RFQP (Request for Qualifications). Professional services are those services identified by the Texas Government Code 2254. These services are not necessarily evaluated on the "best price," but rather evaluated for the quality and level of service each professional provides. In this RFQP #20261382539, the District is requesting proposals from qualified vendors to provide Outsourced Internal Audit Services.

BACKGROUND

The Tarrant County Hospital District, known as ("District"), is a tax-supported organization serving the healthcare needs of families across Tarrant County. JPS provides adult inpatient care at John Peter Smith Hospital, a facility licensed for 582 beds and located in Fort Worth, Texas. JPS has served as a Level I Trauma Center for Tarrant County for over a decade and is currently the largest training institution in Fort Worth.

The health network offers comprehensive services including primary care, specialty care, and pharmacy at more than 25 community locations. JPS is dedicated to providing a full continuum of behavioral health services, including inpatient services at Trinity Springs Pavilion, emergency behavioral health services at our Psychiatric Emergency Center, outpatient services at our JPS clinics, and mental health services for children and adolescents through programs like .

JPS is governed by an eleven (11) member Board of Managers, whose members are appointed by the Tarrant County Commissioners Court.

PROJECT SCOPE

The decision to engage in an outsourced arrangement is grounded in enhancing subject matter expertise and expanding capabilities to address risks related to various healthcare regulations. Partners should possess robust experience in healthcare, both non-clinical and clinical, executing audits and special projects efficiently on an as-needed basis. The scope of work encompasses:

Financial, Operational, Compliance, Specialized Healthcare, and EMR Audits: These areas reflect current risk priorities, including financial controls, regulatory compliance, vendor oversight, contract compliance, environment of care and safeguarding patient data.

DOJ and HHS OIG Compliance Considerations: Activities will prioritize compliance with the latest DOJ and OIG guidance, particularly in fraud detection, financial oversight, and healthcare provider adherence to federal standards.

Texas Regulatory Compliance: Special attention will be paid to Texas regulations, with an emphasis on local mandates that impact healthcare provider operations, facility requirements, and clinical care standards.

MINIMUM REQUIREMENTS

To ensure effective and compliant outsourced Internal Audit services, the following minimum specifications are required. These criteria establish a standard of quality, expertise, and performance essential for our healthcare facility's audit needs. All interested firms must meet these minimum requirements to be considered.

1. Firm Qualifications and Experience

Minimum of five years of demonstrated experience in providing outsourced Internal Audit services, specifically within the healthcare sector.

Proven expertise in hospital operations, regulatory compliance, and healthcare-specific risk management.

Documented experience with audit programs that comply with the Health Insurance Portability and Accountability Act (HIPAA), Centers for Medicare & Medicaid Services (CMS) regulations, and other relevant healthcare laws and standards.

At least two verifiable references from healthcare organizations of similar size and complexity.

2. Personnel Qualifications

Assignment of a dedicated audit team led by a Certified Internal Auditor (CIA) or Certified Public Accountant (CPA) with a minimum of 10 years in healthcare internal auditing.

Team members must possess certifications relevant to healthcare compliance and risk management, such as CHC (Certified in Healthcare Compliance) or CISA (Certified Information Systems Auditor).

The proposed team must include at least two individuals with experience in medical coding and billing audits with an overall capacity to audit both Hospital-based and Professional Fee claims. Preferred certifications include CPC, CCS, CCS-P, CIC, COC, RHIT.

All team members must complete annual training in healthcare regulations, fraud prevention, and data privacy laws.

3. Audit Methodology and Tools

Comprehensive audit methodology that aligns with The Institute of Internal Auditors' (IIA) standards and is adaptable to healthcare facility environments.

Proficiency in using advanced audit software and tools capable of analyzing large data sets, ensuring audit accuracy, and protecting patient and organizational data.

Ability to provide data-driven insights and recommendations based on trends, risks, and performance metrics specific to healthcare settings.

4. Compliance with Data Privacy and Security Standards

Demonstrated adherence to the latest data privacy and security protocols, including HIPAA and HITECH standards.

Possession of cybersecurity safeguards, with evidence of completed SOC 2, Type II audits, or similar certifications.

Commitment to safeguarding all patient and organizational information, with policies in place for data storage, access control, and breach response.

5. Reporting and Communication Requirements

Capability to provide clear, actionable reports in alignment with hospital executive team standards, including monthly, quarterly, and annual summaries of audit findings, risk assessments, and recommendations.

Ability to communicate findings, concerns, and action plans promptly and professionally to hospital leadership, including presentations to executive and board committees as requested.

Ongoing access to the audit team for real-time queries or consultative support on emerging audit and compliance matters.

6. Performance Metrics and Accountability

Willingness to establish and report on defined Key Performance Indicators (KPIs) agreed upon by both parties, focusing on audit effectiveness, timeliness, and follow-through.

Commitment to quarterly performance reviews to assess service quality and continuous improvement efforts.

Provision of a dedicated point of contact to address any service issues, with a documented escalation process.

7. Insurance and Liability Coverage

Minimum $5 million professional liability insurance coverage, with evidence of general liability and cybersecurity insurance.

Ability to provide proof of insurance upon request and agree to maintain active coverage throughout the contract term.

These minimum requirements are intended to secure qualified and capable firms for outsourced Internal Audit services without restricting competition. Each criterion reflects a functional need that is critical to ensuring compliance, patient safety, and financial integrity in a hospital healthcare environment.

REQUIRED INFORMATION

A Sample Audit Report.

Provide a detailed overview of your internal audit and compliance practice, including capabilities, methodologies, and relevant experience in the healthcare sector. Summarize notable methodologies or successful outcomes from similar engagements.

Specify the number of dedicated resources in your U.S.-based healthcare internal audit, information technology audit, and compliance practices.

Break down the number of partners, directors, managers, and staff dedicated to your internal audit, IT audit, and compliance practices within the Dallas/Fort Worth area.

Describe your expertise and experience in conducting both operational/non-clinical and clinical reviews, particularly for healthcare facilities.

Outline your experience in providing internal audit and compliance services to healthcare clients. Include any specialized knowledge or strategies that enhance risk management, compliance, or operational efficiency in healthcare.

Provide a representative list of healthcare clients for whom your firm performs full outsourcing or substantial co-sourcing of internal audit and compliance functions. Focus on engagements of similar scale or complexity.

Detail your experience with electronic medical record (EMR) systems, particularly Epic, in supporting revenue cycle and compliance controls. Indicate if Epic-specific experience is available, though it is not mandatory.

Specify the typical experience level of your internal audit and compliance staff, noting any backgrounds in public accounting, industry-based internal audit, or compliance roles.

Describe healthcare-related engagements or audit deliverables that showcase unique skills, insights, or achievements. Highlight how these differentiators add value to healthcare clients.

List any additional services, knowledge-sharing programs, or client support resources your firm provides to support client risk management, regulatory guidance, or industry trend awareness.

CONTRACT TERM

The proposed term of the contract is three (3) years with two (2) additional one-year renewal options. The District may exercise the renewal options by providing vendor with written notice (email notice will be acceptable) of renewal no less than thirty (30) days prior to the expiration of the then-current term. The contract will be subject to cancellation by the District for any reason, at any time, and without penalty of any kind upon furnishing thirty (30) days' advance written notification to vendor. At the end of the term, the District reserves the right to extend the contract for up to 180 days to provide an opportunity to bring a new contract into place with another vendor.

SELECTION AND EVALUATION PROCESS

Selection Process The Solicitation Contact shall designate an evaluation committee ("Evaluation Committee") which will be composed of employees from the District. The District reserves the right to add, delete or substitute members of the Evaluation Committee as it deems necessary. The Evaluation Committee will narrow the field of submitted Solicitation responses to those which best meet the requirements of this Solicitation, and which best meet the complete needs of the District. Each such Solicitation Response will then be evaluated according to the criteria set forth herein.

Evaluation Criteria Specific to This Solicitation The Evaluation Committee will conduct a comprehensive, fair, and impartial evaluation of all proposals received in response to this Solicitation. The evaluation of Solicitation Responses will involve scoring each Solicitation Response in the areas listed and set forth below in Section G (Evaluation Factors). The District's evaluation of the Solicitation Responses will be based upon each Respondent's response to the evaluation factors stated in this Solicitation. Any Respondent's failure to provide complete and full responses to the requested information may lead to disqualification of such Solicitation Response.

EVALUATION FACTORS

In determining how to award a contract or contracts in conjunction with the Solicitation, the District may consider the following:

The reputation of the Respondent and of the Respondent's services.

The extent to which the Respondent's services meet the District's needs.

Qualifications as it relates to Respondent's services sought.

Historically Underutilized or Small Business Participation - the utilization of historically underutilized or small businesses.

SOLICITATION RESPONSE CONTENT

The overall Solicitation Response should not exceed 25 pages total, excluding exhibits. The District's security system will recognize most common filename extensions, including: .xlsx (Excel), .docx (Word), Adobe PDF, and image files including .jpg, .tiff, and .gif. Any message containing an unknown or prohibited file extension will be quarantined (e.g., .numbers, representative of Apple Numbers application).

Executive Summary

Provide a synopsis of the highlights of the proposal and overall benefits of the proposal to the District. This synopsis should not exceed two pages in length and should be easily understood.

Company Background

How the Proposed Solution Meets the District's Needs

[Provide specification sheets for each product bid. Include service and warranty information.]

Pricing

[Use the spreadsheet in Exhibit A to list line item pricing for all [products/services] you can provide. Add lines as needed for additional [products/services] not already included.]

References

Provide a minimum of three references. [Can include specific types of references needed, if applicable, e.g., other Texas customers, other hospital systems, etc.] Include name, telephone number, and email address. The District will contact the references provided to determine Respondent's performance record for products/services similar to that described in this request.

Historically Underutilized or Small Business Participation

Provide a discussion on how the Respondent intends to meet the District's goal of 25% HUB participation for the scope/specifications of this Solicitation. Discuss any HUB management partners the Respondent plans to team with to provide the scope/specifications. (Maximum 1 page)

The District strongly encourages the utilization of historically underutilized or small businesses.

A. Submit certificate if Respondent is a certified HUB (do not submit an expired certificate).

B. Communication Outreach - Attach the written notification of the subcontracting opportunity and list of three agencies and /or organizations notified regarding the interest in HUB participation in this contract; and

C. Plan of Action - List the subcontractors selected for participation, their certification, and approximate dollar value of the work to be subcontracted and the expected percentage of the total contract amount.

Required Forms

a. Exhibit B: Signature Form

b. Exhibit C: Contract Terms (include an editable, unlocked/unsecured redline in track changes if proposing changes to Exhibit C, Contract Terms)

c. Exhibit D: Vendor Certification Form

d. Exhibit E: Conflict of Interest Questionnaire

e. Exhibit F: Good Faith Form

EVALUATION CRITERIA SCORE SHEET

Exhibit A

Price Sheet

NOT USED

Exhibit B

Signature Form

Respondent shall signify Respondent's acceptance of and compliance with the requirements, terms, and conditions of this Solicitation by signing in the signature space set forth below.

Respondent warrants that Respondent has examined and is familiar with this Solicitation and its terms and conditions. Respondent warrants that Respondent does not engage in scrutinized business operations in Sudan, Iran or with foreign terrorist organizations, does not engage in any prohibited boycott, and that Respondent does not appear (nor does any affiliate appear) on any .

Respondent warrants that it has the necessary experience, knowledge, abilities, skills, and resources to satisfactorily finance and complete the products and services in its Solicitation Response.

Respondent certifies that the individual signing this Solicitation Response is authorized to sign such documents on behalf of the Respondent entity and to bind Respondent and is authorized to bind the Respondent in this Solicitation Response.

RESPONDENT AGREES TO DEFEND, INDEMNIFY, AND HOLD HARMLESS THE DISTRICT AND ALL OF ITS OFFICERS, AGENTS AND EMPLOYEES FROM AND AGAINST ALL CLAIMS, ACTIONS, SUITS, DEMANDS, PROCEEDINGS, COSTS, DAMAGES, AND LIABILITIES, ARISING OUT OF CONNECTED WITH, OR RESULTING FROM ANY ACTS OF OMISSIONS OF RESPONDENT OR ANY AGENT, EMPLOYEE, SUBCONTRACTOR, OR SUPPLIER OF RESPONDENT IN THE EXECUTION OR PERFORMANCE OF ANY AGREEMENTS OR OTHER CONTRACTUAL ARRANGEMENTS WHICH MAY RESULT FROM THE SUBMISSION OF THE SOLICITATION RESPONSE AND/OR THE AWARD OF A CONTRACT THEREON BY THE DISTRICT.

Exhibit C

Contract Terms

RFQP #20261382539 Outsourced Internal Audit Services

PROFESSIONAL SERVICES AGREEMENT

This Professional Services Agreement (the "Agreement") is made and entered into effective ("Effective Date"), by and between , a ("Contractor"), and Tarrant County Hospital District d/b/a JPS Health Network, a unit of local government and more specifically a county hospital district, created and operating under Chapter 281 of the Texas Health and Safety Code ("District"). The District and Contractor may be referred to individually as a "Party" to this Agreement and they may be referred to collectively as the "Parties" to this Agreement.

RECITALS

Whereas, the District, in furtherance of its statutory obligations to provide health care services to the indigent and needy residents of Tarrant County, Texas, owns and operates a fully accredited, integrated health delivery system that includes several hundred licensed in-patient beds at three facilities, as well as an extensive network of community-based facilities located throughout and serving the residents of Tarrant County, Texas;

Whereas, the District has requested proposals to provide the services described on Schedule 1 (Scope of Services), which is attached hereto and incorporated herein for all purposes ("Services");

Whereas, Contractor has presented a proposal to provide the Services to the District;

WHEREAS, this Agreement is awarded to the Contractor pursuant to the District's Request for Proposal ("RFP") #20261382539 for ________________all of whose material terms and conditions, including without limitation the RFP Project Scope and Minimum Requirements and Contractor's response thereto are incorporated herein; provided, however, that in the event of conflict between the terms of the RFP, Contractor's Response, and this Agreement, the terms of this Agreement shall prevail;

Whereas, Contractor has developed and maintains the expertise and resources necessary to perform and complete the Services;

Whereas, Contractor is a operated under the laws of the State of , is qualified to do business in the State of Texas, and is qualified and capable of performing and completing the Services; and,

Whereas, Contractor desires to provide the Services as so required by the District, and the District desires to contract with Contractor for the Services;

Now, Therefore, for and in consideration of the mutual covenants and conditions hereinafter contained, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged by the Parties, the District and Contractor hereby agree as follows:

Services to be Performed; Applicable Standards. Contractor shall perform and complete the Services in a diligent, professional and workmanlike manner using industry best practices applicable to the performance of the Services. Furthermore, Contractor shall use only qualified personnel to perform and complete the Services. Contractor will supply at its own expense, necessary computers, software, supplies and other materials required to perform and deliver the Services to the District.

Fees for Services Performed. The District shall pay to Contractor fees for the Services performed and the reimbursable expenses incurred by Contractor under this Agreement as set forth in Schedule 2 (Fees and Expenses), which is attached hereto and incorporated by reference herein. Except to the extent expressly included in reimbursable Expenses on Schedule 2, the District will not be required to reimburse Contractor for any salaries, consulting fees, commissions, general overhead at Contractor's place or places of business, office rental expense, utility expenses or expenses related to computers, software, supplies and other materials required to perform and deliver the Services or used by Contractor in the performance and delivery of the Services.

Term and Termination.

(a) Term.

(b) Termination for Cause. Either Party may terminate this Agreement for cause upon the occurrence of an Event of Default (as defined below) by delivery of written notice of termination to the other Party while such Event of Default continues to exist, whereupon all obligations of the District under this Agreement shall terminate, other than the payment by the District for all amounts due under this Agreement through the effective date of termination.

(c) Event of Default; Notice of Material Breach. Either Party shall be in material default under this Agreement upon the occurrence of any one or more of the following which continues to exist fifteen (15) days after a Notice of Material Breach (defined below) is given to the defaulting Party (each occurrence being a "Event of Default"): (i) a failure or refusal by a Party to timely make any payment that is required to be paid by such Party under this Agreement; (ii) a failure by a Party to perform or observe any other obligation under this Agreement; (iii) any warranty or representation of a Party in this Agreement is false or misleading in any material respect; (iv) the commencement of any insolvency, bankruptcy or similar proceedings by or against such Party (including any assignment by such Party for the benefit of creditors or the appointment of a receiver for the assets of such Party). A "Notice of Material Breach" means written notice that includes: (i) a description sufficient to identify the Event of Default to the defaulting Party; and, (ii) if not obvious from the nature of the Event of Default, the notifying Party's specific recommendations of the actions to be (or if appropriate, not to be) taken by the defaulting Party in order for it to cure the Event of Default.

(d) Remedies for Default. Upon the occurrence of an Event of Default, the non-defaulting Party may, in addition to any and all other remedies available under law, elect to: (1) terminate this Agreement in accordance and upon compliance with the termination provisions in Section 3 of this Agreement, and/or (2) commence collection actions (including court actions) for all sums due under this Agreement, and/or (3) seek such other remedies for such Event of Default as are available at law or in equity. All rights and remedies available to a Party hereunder, by law or equity, shall be cumulative and there shall be no obligation for such Party to exercise a particular remedy.

(e) Early Termination. The District shall have the right to terminate this Agreement without cause in its sole discretion at any time prior to such completion of the Services by giving Contractor at least thirty (30) days' prior written notice of such termination (hereinafter referred to as "Early Termination"). In the event of Early Termination, the District will pay all fees due to Contractor under Section 2 hereof for all Services performed by Contractor in accordance with the requirements of this Agreement up to and including the date of termination. The District also shall reimburse Contractor for all expenses incurred by Contractor in the performance of Services hereunder and which are or would be due to Contractor under Section 2 hereof if Early Termination had not occurred. Contractor acknowledges and agrees that in the event of such Early Termination, Contractor will not perform any unnecessary part of the Services nor will it incur any unreasonable expenses after receiving notice of Early Termination, but Contractor will perform only those Services and incur only those expenses reasonably necessary to fulfill its obligations under Section 1 hereof and this Section 3. Nothing set forth in this Section 3 shall limit the District's other rights or remedies.

Confidentiality and HIPAA.

(a) The District may disclose to Contractor in confidence or otherwise make available to Contractor certain material which is not generally known to the public ("District Confidential Information"), including, but not limited to, information pertaining to: research; pricing; procurement; distribution; personnel; compensation; financial statements or projections; business plans; contracts; systems development and implementation; scientific and mathematics techniques; infrastructure and technical configuration; security policies; methodologies and implementations; intellectual property; trade secrets; inventions; marketing plans; existing and potential clients, customers, patients, suppliers, vendors and other business relationships; and other information provided, delivered or made available by the District or otherwise accessible to Contractor. District Confidential Information shall not include any protected health information ("PHI") as that term is defined at 45 CFR 160.103, which information is subject to [the Parties' BAA as well as] state and federal laws and regulations.

(b) Contractor agrees to hold in confidence all District Confidential Information and to use such information only for the purpose of performing and completing the Services for the District. Furthermore, Contractor will protect the District Confidential Information received under this Agreement in the same manner and to the same extent to which it protects its own valuable proprietary information, but in all events using at least a reasonable standard of care. Contractor may not make any copies of the District Confidential Information except in the course and scope of performing and completing the Services and all District Confidential Information (including but not limited to all copies thereof) shall be promptly returned by Contractor to the District upon the termination or expiration of this Agreement, or sooner if demanded by the District.

(c) Subject to the requirements of the limitations stated in Section 12 (Texas Public Information Act) below, the District agrees to keep Contractor's proprietary information, including all information relating to the Services, confidential and not to use such proprietary information except as contemplated under this Agreement.

(d) The confidentiality obligations in this Agreement shall not apply to information: (1) in a receiving party's possession prior to disclosure under this Agreement unless disclosed to receiving party by the disclosing party under a prior agreement with the disclosing party for confidentiality or non-disclosure ("Prior NDA"), (2) which is or becomes publicly known through no fault on the part of receiving party, (3) received from a third party not under an obligation to the owner of such information not to disclose it, (4) independently developed by receiving party without the benefit of the information disclosed under either a Prior NDA or this Agreement (as to which receiving party has the burden of proof), (5) required to be disclosed by government regulation, statute, or judicial order, provided that prior to such disclosure and if reasonably possible, receiving party will inform the disclosing party of such requirements and permit the disclosing party to seek a protective order or other relief regarding such information, or (6) disclosed without confidentiality restrictions to any third party by or with the express permission of the disclosing party.

[CHOOSE ONE:

(e) The Parties acknowledge the existence of applicable legal requirements pursuant to the federal Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (collectively "HIPAA"). Attached to and incorporated in this Agreement as Schedule 3 is the District's standard Business Associate Agreement ("BAA"). Contractor acknowledges that for all purposes under the BAA and this Agreement, the District is a "Covered Entity" and Contractor is a "Business Associate". Furthermore, Contractor agrees to comply with and satisfy all of the terms and conditions of the BAA applicable to a Business Associate. Any violation of or failure to satisfy the terms and conditions of the BAA shall be a breach of this Agreement.

OR:

(e) The parties do not anticipate that Contractor will (i) create, maintain, transmit or receive protected health information for, on behalf of, or from the District in connection with this Agreement or (ii) otherwise be considered a Business Associate of the District, as that term is defined by federal regulation. Should the situation change, Contractor agrees that it will negotiate in good faith an amendment to this Agreement, including a business associate agreement, if appropriate, in each case if and to the extent required by the provisions of the Health Insurance Portability and Accountability Act, the Health Information Technology for Economic and Clinical Health Act of 2009, and/or the regulations promulgated thereunder.

END OF CHOICES]

(f) This Section 4 titled "Confidentiality and HIPAA" [and the BAA ]shall survive the termination or expiration of the Agreement.

Indemnity.

(a) CONTRACTOR SHALL INDEMNIFY AND HOLD HARMLESS THE DISTRICT, DISTRICT'S MANAGERS, OFFICERS, AGENTS, EMPLOYEES, STAFF, REPRESENTATIVES, AND DIRECTORS (COLLECTIVELY, THE "DISTRICT INDEMNITEES") FROM ALL LOSSES (DEFINED BELOW) AND SHALL DEFEND THE DISTRICT AND DISTRICT INDEMNITEES AGAINST ALL CLAIMS AND CAUSES OF ACTION OF THIRD PARTIES ARISING OUT OF OR RELATED TO ANY OF THE FOLLOWING, EXCEPT TO THE EXTENT CAUSED BY THE GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF THE DISTRICT OR DISTRICT INDEMNITEE: (i) A VIOLATION OF ANY FEDERAL, STATE, LOCAL OR FOREIGN LAW, RULE, REGULATION OR ORDER APPLICABLE TO CONTRACTOR AND/OR ITS AGENTS, EMPLOYEES OR REPRESENTATIVES; (ii) ANY VIOLATION OR BREACH BY CONTRACTOR OF ITS REPRESENTATIONS AND WARRANTIES TO THE DISTRICT IN THIS AGREEMENT; OR, THE FACT THAT ANY OF SUCH REPRESENTATIONS AND WARRANTIES CEASES TO BE TRUE AT ANY TIME PRIOR TO TERMINATION OR EXPIRATION OF THIS AGREEMENT; (iii) THE FAILURE OF CONTRACTOR TO OBTAIN, OR CAUSE TO BE OBTAINED, ANY REQUIRED LICENSES, PERMITS OR CONSENTS FOR THE DISTRICT TO RECEIVE AND USE THE SERVICES OR ANY COMPONENT THEREOF, TO THE FULL EXTENT PROVIDED IN THIS AGREEMENT, EXCLUDING ANY REQUIRED CONSENT THAT IS NOT OBTAINED DUE TO THE DISTRICT'S FAILURE TO PAY FOR SAME; AND (iv) PERSONAL INJURIES, DEATH OR DAMAGE TO TANGIBLE PERSONAL OR REAL PROPERTY TO THE EXTENT CAUSED BY NEGLIGENT OR INTENTIONAL ACTS OR OMISSIONS OF CONTRACTOR OR ANY CONTRACTOR AGENT, EMPLOYEE OR REPRESENTATIVE. FOR PURPOSES OF THIS SECTION, THE TERM "LOSSES" MEANS ALL ASSESSMENTS, LOSSES, DAMAGES, COSTS, EXPENSES, LIABILITIES, JUDGMENTS, AWARDS, FINES, SANCTIONS, PENALTIES, CHARGES, AND AMOUNTS RESULTING FROM, OR AGREED TO BE PAID IN SETTLEMENT OF, ANY THIRD PARTY CLAIM OR ALLEGATION INCLUDING, BUT NOT LIMITED TO, REASONABLE ATTORNEY AND OTHER LEGAL FEES AND COSTS AND EXPENSES OF INVESTIGATING OR DEFENDING AGAINST SUCH CLAIM OR ALLEGATION.

(b) CONTRACTOR AGREES TO, AND SHALL, INDEMNIFY AND HOLD THE DISTRICT HARMLESS AGAINST ANY CLAIMS, CAUSES OF ACTION, DAMAGES, AND EXPENSES TO THE EXTENT THE SAME ARISE OUT OF OR ARE ASSERTED AGAINST THE DISTRICT ALLEGING THAT ANY SERVICES PROVIDED HEREUNDER INFRINGES ANY UNITED STATES PATENT, TRADEMARK, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT OF A THIRD-PARTY, PROVIDED THAT (1) THE DISTRICT GIVES CONTRACTOR WRITTEN NOTICE WITHIN TWENTY-ONE (21) DAYS AFTER THE DISTRICT'S ACTUAL KNOWLEDGE OF THE EXISTENCE THEREOF, OF ANY SUCH CLAIMS, DAMAGES, OR EXPENSES, AND/OR (2) THE DISTRICT AGREES TO COOPERATE REASONABLY WITH CONTRACTOR AS REASONABLY NECESSARY TO DEFEND, SETTLE, REIMBURSE, OR AVOID ANY SUCH CLAIMS, DAMAGES AND EXPENSES.

(c) Upon timely receipt of the District's written notice, Contractor will assume the defense of any claims against the District. The District agrees to cooperate with Contractor in the defense or settlement of all such claims.

(d) Contractor shall not be bound by the terms of any compromise or settlement agreement negotiated or concluded by the District without the prior written consent of Contractor.

Exclusion and Ethics.

(a) Contractor agrees that it will immediately report in writing to the District in the event, if ever, Contractor, including any of its officers, directors, employees, contractors or agents, becomes a target of any criminal investigation or any investigation that could result in debarment or exclusion Contractor or such other person from federally or state funded healthcare programs.

(b) Contractor warrants and represents to the District that Contractor has never been:

convicted of a criminal offense;

listed by a federal agency as debarred, excluded or otherwise ineligible for federal plan participation;

sanctioned by any federal or state law enforcement, regulatory or licensing agency; or,

excluded from any state or federal healthcare program.

(c) Contractor further warrants and represents to the District that neither Contractor, nor any of Contractor's officers, directors, members, partners, shareholders (excluding shareholders, members and limited partners that own less than 5% of the combined voting power of Contractor), employees, contractors or agents:

is currently under criminal investigation or any investigation that could result in debarment or exclusion from federally or state funded healthcare programs; or

has ever been:

(i) convicted of a criminal offense that is a felony or a misdemeanor of moral turpitude;

(ii) listed by a federal agency as debarred, excluded or otherwise ineligible for Federal plan participation;

(iii) sanctioned by any federal or state law enforcement, regulatory or licensing agency; or,

(iv) excluded from any state or federal healthcare program.

(d) In the event that any of the foregoing representations in this Section 6(b) or (c) ceases to be true, Contractor will immediately report same in writing to the District.

(e) Upon receipt of any report required by Contractor hereunder or in the event of a failure to report by Contractor, the District may without penalty terminate this Agreement and other than the payment of any amounts due and owing through the date of termination, the District shall have no further obligations or liabilities hereunder.

Availability of Records. To the extent required by 42 U.S.C. 1395x(v)(1)(I), until the expiration of four (4) years after the furnishing of any services provided under this Agreement, Contractor shall make available, upon written request by the Secretary of the U.S. Department of Health and Human Services (the "Secretary") or by the U.S. Comptroller General (the "Comptroller General"), or by their respective duly authorized representatives, this Agreement, and all books, documents and records of Contractor that are necessary to certify the nature and extent of the costs of such services. If Contractor carries out the duties of this Agreement through a permitted subcontract worth $10,000 or more over a 12-month period with a related organization, to the extent required by 42 U.S.C. 1395x(v)(1)(I), such subcontract also shall contain a clause to the effect that until the expiration of four years after the furnishing of such services pursuant to such subcontract, the related organization shall make available, upon written request by the Secretary, or upon request by the Comptroller General, or any of their duly authorized representatives, the subcontract, and books, documents and records of such organization that are necessary to verify the nature and extent of such costs.

Work Product and Inventions. All materials and/or other information developed, generated or produced, in whole or part, by Contractor (including the employees, independent contractors or agents of Contractor) in performing and completing the Services including, but not limited to, all documentation, flow charts, diagrams, specifications, descriptions, definitions, reports, and data (collectively, the "Work Product") and any invention, product, computer program or specification, whether patentable or unpatentable, made, conceived or first actually or constructively reduced to practice, in whole or part, by Contractor (including the employees, independent contractors or agents of Contractor) in performing and completing Services (individually, an "Invention" and collectively, the "Inventions"), shall be the District's sole and exclusive property. Contractor shall perform all acts that may be deemed reasonably necessary or desirable by the District to evidence that the Work Product and Inventions are 'works made for hire' and/or to more fully transfer ownership to the District of the Work Product and Inventions.

Contractual Relationship Only. Neither Party is the legal representative or agent of the other, nor shall either Party have the right or authority to assume, create, or incur any liability or any obligation of any kind, expressed or implied, against, or in the name of or on behalf of the other Party. No agency, partnership, joint venture, or employment is created as a result of this Agreement. Furthermore, the District shall not be responsible for paying or withholding any taxes, fees or other amounts, with respect to the amounts paid to Contractor or for paying any compensation or benefits to or providing insurance for any of Contractor's employees or contractors. Contractor agrees to defend, indemnify and hold harmless the District, and its managers, directors, officers, employees, agents, and representatives, against any and all losses, liabilities, claims, allegations, demands, causes of action, judgments, awards and costs (including but not limited to legal fees and expenses) (collectively "Claims") arising out of or related to the employment or contract relationship of any of Contractor's employees and independent contractors including but not limited to Claims for salary/wages, vacation pay, sick leave, retirement benefits, social security, worker's compensation, health or disability benefits, unemployment insurance benefits, or employee compensation or benefits of any kind.

Annual Budget. The Parties acknowledge and agree that the District is a governmental entity that is subject to an annual budgetary process and restrictions on spending in conformity with that process, its approved budget and applicable law. The Parties further agree that, notwithstanding anything to the contrary in this Agreement, if for any reason funds are not expressly and specifically allocated for this Agreement in the District's formally and finally approved budget in any fiscal year subsequent to that in which funds for this Agreement were first allocated, the District may immediately and without penalty terminate this Agreement; provided, however, that in no event shall such a termination be effective earlier than the last date for which funds have already been so allocated under an existing formally and finally approved budget. Should the Agreement terminate under the provisions of this section titled "Annual Budget", the District will provide Contractor with written notice as soon as is reasonably possible of the pending termination under this section, the effective date of which shall be at the end of the District's fiscal year in which funds had previously been allocated unless the District states a later effective date of termination and, other than the payment of any amounts due and owing through the date of termination, the District shall have no further obligations or liabilities hereunder.

Tax Exemption. The District is a tax-exempt organization pursuant to Ch. 151 of the Texas Sales, Excise, and Use Tax Code and Section 501(c)(3) of the Internal Revenue Code, and is not responsible for payment of any amounts accountable or equal to any federal, state or local sales, use, excise, personal property, or other taxes levied on any transaction or article provided for by this Agreement. The District will provide evidence of its tax-exempt status to Contractor upon request.

Texas Public Information Act. The District advises Contractor that the District is a governmental body under Chapter 552 of the Texas Government Code and that certain information that is collected, assembled, or maintained in connection with the transaction of official business by a governmental body is considered public information potentially subject to disclosure pursuant to a valid Texas Public Information Act ("TPIA") request. Contractor's trade secrets, certain financial information, and proprietary information may be subject to an exception to disclosure under Chapter 552 of the Texas Government Code, Subchapter C. If a TPIA request is made on the District to disclose Contractor information that may be subject to an exception from disclosure, District will (i) promptly notify Contractor of such request for disclosure, and (ii) decline to release such information and file a written request with the Texas Attorney General's office seeking a determination as to whether such information may be withheld.

Chapters 2271, 2252, 2274, and 2276 Texas Government Code Verification.

Boycott of Israel Prohibited. In compliance with Section et seq. of the Texas Government Code, Contractor verifies that neither it nor any of its affiliates currently boycott Israel and neither it nor any of its affiliates will boycott Israel during the term of this Agreement. "Boycott Israel" is defined in Section of the Texas Government Code.

Scrutinized Business Operations Prohibited. In compliance with Section et seq. of the Texas Government Code, Contractor warrants and represents that: (1) neither Contractor nor any of its affiliates engages in scrutinized business operations in Sudan; (2) neither Contractor nor any of its affiliates engages in scrutinized business operations in Iran; and (3) neither Contractor nor any of its affiliates engages in scrutinized business operations with designated foreign terrorist organizations. "Scrutinized business operations in Sudan" is defined in Section of the Texas Government Code. "Scrutinized business operations in Iran" is defined in Section of the Texas Government Code. "Scrutinized business operations with designated foreign terrorist organizations" is defined in Section of the Texas Government Code. Contractor further represents and warrants that neither Contractor nor any of its affiliates appears on any of the Texas Comptroller's .

Discrimination Against Firearm Entities or Firearm Trade Associations Prohibited. In compliance with Section of the Texas Government Code, Contractor verifies that neither it nor any of its affiliates have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association; and neither it nor any of its affiliates will discriminate during the term of the Agreement against a firearm entity or firearm trade association. "Discriminate against a firearm entity or firearm trade association" is defined in Section .

Boycott of Certain Energy Companies Prohibited. In compliance with Section of the Texas Government Code, Contractor verifies that neither it nor any of its affiliates currently boycott energy companies and neither it nor any of its affiliates will boycott energy companies during the term of this Agreement. "Boycott energy company" is defined in Section of the Texas Government Code.

Applicable Law and Venue. The Parties agree that this Agreement is subject to, and agree to comply with, applicable local, State of Texas, and federal statutes, rules and regulations. THIS AGREEMENT BETWEEN THE PARTIES SHALL BE GOVERNED BY AND INTERPRETED IN ACCORDANCE WITH THE LAWS OF THE STATE OF TEXAS, USA, WITHOUT REFERENCE TO ITS LAWS RELATING TO CONFLICTS OF LAW. Any legal action arising out of or relating to the Agreement shall be brought only in the state or federal courts located in Tarrant County, Texas, and the Parties irrevocably consent to the jurisdiction and venue of such courts.

Prohibition on Use of Name and Logo. Contractor agrees that it will not, without the prior written consent of the District, use the names, logos, symbols, trademarks or service marks of the District, including but not limited to those associated with JPS Health Network, for any purposes or uses (expressly including but not limited to for Contractor's advertising, promotion or other marketing) other than those reasonably related to performing and completing the Services. This section titled "Prohibition on Use of Name and Logo" shall survive the termination or expiration of this Agreement.

Liability Insurance Coverage. Contractor shall purchase and maintain at all times such insurance at Contractor's sole cost, which will protect Contractor from all claims, including but not limited to those claims set forth below, which may arise out of Contractor's activities including the Services, whether such activities are by Contractor's employees (including Workers), agents, or contractors.

Workers Compensation with statutory limits of liability and Employer's Liability limits in amounts sufficient to cover Contractor's obligations under this Agreement;

Comprehensive General Liability (including but not limited to bodily injury and death, broad-form property damage, products, completed operations, contractual, and premises liability) with combined single limits of not less than one million dollars ($1,000,000.00) for each occurrence and three million dollars ($3,000,000.00) in the annual aggregate; and

Automobile Liability covering use of owned automobiles, hired automobiles and non-owned automobiles with a minimum one million dollars ($1,000,000.00) combined single limit per occurrence for bodily injury and property damage.

All insurance shall be issued by insurance companies authorized to engage in business in the State of Texas, and have a rating of no less than A- in the most current edition of the A.M. Best Insurance Report or the equivalent in Moody's and/or S&P (or comparable rating from a recognized insurance rating agency).

Specific Requirements. All liability policies shall be specifically endorsed to include the District as an additional insured to the extent indemnified pursuant to this Agreement. Contractor's policies shall be primary and non-contributing over the District's policies (if any), and shall provide for severability of interests, and thirty (30) days' notice of cancellation. Any deductibles or self-insured retentions will be Contractor's responsibility. The policies must be endorsed to waive subrogation with respect to the District, its affiliates, and their respective employees. The policies must provide 30 days' notice prior to any material modification, cancellation or non-renewal of the policies.

Certificates and Notices. Two (2) Certificates of Insurance shall be provided to the District as evidence of compliance with this requirement and any necessary policy endorsements, prior to the provision of Services under this Agreement. Contractor shall provide thirty (30) days' prior written notice to the District of any material modification, nonrenewal, or cancellation of any insurance coverage.

Contractor recognizes and agrees that the District is a political subdivision of the Sovereign State of Texas and is therefore subject to the Tort Claims Act.

Assignment Prohibited. Contractor may not, without the prior written consent of the District, assign its rights, duties or obligations under this Agreement to any person or entity, in whole or in part, and any attempt to do so shall be void and deemed a material breach of this Agreement.

Non-Waiver. No waiver of any provision hereof or of any right or remedy hereunder shall be effective unless in writing and signed by the Party against whom such waiver is sought to be enforced. No delay in exercising, no course in dealing with respect to, or no partial exercise of any right or remedy hereunder shall constitute a waiver of any other right or remedy, or future exercise thereof. No failure or refusal of any approval referenced in this Agreement shall excuse or relieve the performance or other responsibilities of the other Party.

Severability. Without limiting this section of the Agreement, if any provision of this Agreement, or the application thereof to any person or circumstance, is held to be illegal, invalid or unenforceable for any reason, and the basis of the bargain among the Parties is not thereby destroyed, such illegality, invalidity or unenforceability shall not affect any other provision of this Agreement that can be given effect in the absence of the illegal, invalid or unenforceable provision or application. To this end, all provisions of this Agreement are declared to be severable.

Termination Right. In the event of a change-in-control (defined below), the District may without penalty terminate this Agreement and other than the payment of any amounts due and owing through the date of termination, the District shall have no further obligations or liabilities hereunder. A "change-in-control" means that (a) there occurs a reorganization, merger, consolidation or other corporate transaction involving Contractor (a "Corporate Transaction"), in each case with respect to which the owners of Contractor immediately prior to such Corporate Transaction do not, immediately after the Corporate Transaction, own more than 50% of the combined voting power of Contractor or any other entity resulting from such Corporate Transaction; or, (b) all or substantially all of the assets of Contractor are sold, liquidated or distributed.

Notices. All notices, requests, demands and other communications required or permitted hereunder shall be in writing and shall be deemed to have been duly given (a) when received by the Party to whom directed; (b) when sent by fax transmission to the following fax numbers or by email to the following emails; or (c) when deposited in the United States mail when sent by certified or registered mail, return receipt requested, postage prepaid to the following addresses (or at such other addresses or fax numbers as shall be given in writing by either Party to the other):

If to the District: Tarrant County Hospital District

Attn: President and CEO

1500 S. Main St.

Fort Worth, TX 76104

Telephone: (817) 927-1234

Fax: (817) 924-1207

If to Contractor:

Telephone:

Fax:

Email:

Entire Agreement; Amendment. This Agreement (i) represents the entire understanding and agreement of the Parties hereto with respect to the matters contained herein, and (ii) may be amended, modified or waived only by a separate writing executed by the Parties expressly so amending, modifying or waiving this Agreement.

Binding Agreement. This Agreement binds and inures to the benefit of the Parties, and their respective successors and permitted assigns.

Headings and Captions. The subject headings of the sections, paragraphs, and subparagraphs of this Agreement are included herein solely for the purposes of convenience and reference, and shall not be deemed to explain, modify, limit, amplify, or aid in the meaning, construction, or interpretation of any of the provisions of this Agreement.

Definition of Person. For purposes of this Agreement, "Person" means any natural person, corporation, limited liability company, association, partnership, joint venture, proprietorship, governmental agency, trust, estate or other entity or corporation, whether acting in an individual, fiduciary or other capacity.

Taxes. The fees payable by the District to Contractor hereunder are inclusive of any sales, use, gross receipts or value added, withholding, ad valorem or other taxes based on or measured by Contractor's cost in acquiring equipment, materials, supplies or services used by Contractor in performing and completing the Services, plus all interest, penalties and other amounts levied thereon by a governmental agency for late payment or otherwise. Further, each Party shall bear sole responsibility for any real or personal property taxes on any property it owns or leases, for franchise or similar taxes on its business, for employment taxes on its employees, for intangible taxes on property it owns or licenses, and for taxes on its net income.

Compliance with Laws. In providing the Services required by this Agreement, Contractor shall observe and comply with all applicable federal, state, and local statutes, ordinances, rules, and regulations, including, without limitation, workers' compensation laws, minimum and maximum salary and wage statutes and regulations, and non-discrimination laws and regulations. Contractor shall be responsible for ensuring its compliance with any laws and regulations applicable to its business, including maintaining any necessary licenses and permits.

Use of Words. Whenever necessary in this Agreement and where the context requires, the gender of words shall include the masculine, feminine, and/or neuter, and the number of all words shall include the singular and the plural.

Counterparts. This Agreement may be executed in multiple counterparts, each of which shall, for all purposes, be deemed an original, and all of which shall, for all purposes constitute one and the same instrument.

Further Assurances and Cooperation. During the term of this Agreement, each Party shall exercise commercially reasonable efforts to cooperate with the other Party in the performance by the other Party of its respective duties and obligations under this Agreement. Neither Party shall unreasonably withhold or delay any consent, approval or request by the other Party required under this Agreement. Further, the Parties shall deal and negotiate with each other in good faith in the execution and implementation of their respective duties and obligations under this Agreement.

Construction. This Agreement shall be construed as if drafted jointly by the Parties and no presumption or burden of proof shall arise favoring or disfavoring any Party by virtue of the authorship of any of the provisions of this Agreement.

No Third Party Beneficiary Status. The terms and provisions of this Agreement are intended solely for the benefit of each Party hereto and their respective successors or permitted assigns, and it is not the intention of the Parties to confer third party beneficiary rights upon any other Person.

Liability. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER OR TO ANY THIRD PARTY FOR ANY INCIDENTAL, INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THIS AGREEMENT OR IN CONNECTION WITH THE USE OF THE SERVICES.

Electronic Signatures; Facsimile and Scanned Copies; Duplicate Originals; Counterparts; Admissibility of Copies. Each Party agrees that: (i) any electronic signature (if any), whether digital or encrypted, to this Agreement made by any Party is intended to authenticate this Agreement and shall have the same force and effect as an original manual signature; and (ii) any signature to this Agreement by any Party transmitted by facsimile or by electronic mail shall be valid and effective to bind that Party so signing with the same force and effect as an original manual signature. Delivery of a copy of this Agreement or any other document contemplated hereby bearing an original or electronic signature by facsimile or electronic transmission, will have the same effect as physical delivery of the paper document bearing an original or electronic signature. This Agreement may be executed in multiple duplicate originals and all such duplicate originals shall be deemed to constitute one and the same instrument. This Agreement may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall be deemed to constitute a single instrument. The Parties warrant and represent that a true and correct copy of the original of this Agreement shall be admissible in a court of law in lieu of the original Agreement for all purposes of enforcement hereof.

IN WITNESS WHEREOF, the Parties hereto have executed this Agreement, in duplicate originals with one original being delivered to each Party, to be effective on the Effective Date.

Professional Services Agreement 090123.docx

Schedule 1

Scope of Services

Schedule 2

Fees and Expenses

1. Caps on Fees and Expenses. Contractor has agreed that the:

(a) total Fees (defined below) payable by the District for the Services will not exceed and 00/100 Dollars ($) ("Cap on Total Fees"); and,

(b) total Expenses payable or reimbursable by the District will not exceed an amount equal to to the District at any point in time and in no event will exceed an amount equal to ("Cap on Total Expenses").

2. Monthly Invoices - Fees. Contractor will invoice the District monthly for the amount of time actually expended during the applicable monthly period by its personnel providing the Services (that has not been previously invoiced) based on Contractor's standard hourly rates as reflected on Schedule "2-A" attached to the Agreement and incorporated herein for all purposes ("Fees"); provided that in no event will Contractor invoice the District for any Fees in excess of the Cap on Total Fees.

3. Monthly Invoices - Expenses. In addition to the Fees, Contractor will invoice the District monthly for the Reimbursable Expenses (defined below and collectively referred to as the "Expenses") incurred during the applicable monthly period in performing the Services; provided that in no event will Contractor invoice the District for any Expenses in excess of the Cap on Total Expenses.

The "Reimbursable Expenses" means those reasonable and necessary out-of-pocket expenses for travel, hotel rooms, and meals, actually incurred by Contractor to perform and complete the Services, which, without the prior approval of the District, shall exceed neither (i) the set percentage of the total Fees billed to the District (up to the Cap on Total Expenses), nor (ii) the applicable per diem lodging rates and per diem meals and incidental expense rates established by the General Services Administration ("GSA") for Tarrant County, Texas. Current GSA per diem lodging rates and per diem meals and incidental expense rates can be found at https://www.gsa.gov/travel/plan-book/per-diem-rates/per-diem-rates-lookup.

4. Monthly Invoices - Payment Deadlines. Amounts invoiced as set forth herein are payable by the District within thirty (30) business days of receipt; provided, however, that once the District has been invoiced and has paid and /100 Dollars ($) for Fees, no additional Fees are payable by the District regardless of when invoiced until twenty (20) business days of completion of the Services, as evidenced by Contractor's delivery to the District of the final Report. The District shall pay Contractor interest on all overdue payments at the statutory interest rate set forth in Texas Government Code Sec. . As required by Texas Government Code Sec. 2251.043, the District shall reimburse Contractor for its reasonable attorney fees if Contractor is the prevailing party in a formal administrative or judicial action against the District to collect an invoice payment or interest that is due.

Schedule 2-A

Contractor's Standard Rates and Profiles

Schedule 3

Business Associate Agreement

Acknowledgment of HIPAA Obligations and Other Regulations Implementing HIPAA. The parties acknowledge that federal regulations set forth in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH") relating to the confidentiality, integrity, and accessibility of protected health information (whether created, maintained, accessed, stored or transmitted electronically or otherwise) require covered entities to comply with the privacy and security standards adopted by the U.S. Department of Health and Human Services as they may be amended from time-to-time, 45 C.F.R. part 160 and part 164, subparts A and E ("Privacy Rule") and 45 C.F.R. part 160, part 162, and part 164, subparts A and C ("Security Rule"). The Privacy Rule and Security Rule are sometimes collectively referred to herein as the "Privacy and Security Standards". The Privacy and Security Standards require Covered Entity to ensure that Business Associates who create, receive, maintain, access, store, or transmit Protected Health Information in the course of providing services on behalf of Covered Entity comply with certain obligations regarding the confidentiality, integrity, and availability of Protected Health Information.

Definitions.

"Business Associate" shall generally have the same meaning as the term "business associate" at 45 C.F.R. 160.103, and in reference to the party to this Agreement, shall mean Contractor.

"Covered Entity" shall generally have the same meaning as the term "covered entity" at 45 C.F.R. 160.103, and in reference to the party to this Agreement, shall mean Tarrant County Hospital District d/b/a JPS Health Network.

"HIPAA Rules" shall mean the rules at 45 C.F.R. Part 160, Part 162, and Part 164.

"Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee.

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Individual, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Purposes for which Protected Health Information, including Electronic Protected Health Information, May be Used or Disclosed. Business Associate may use, access, and disclose Protected Health Information ("PHI") for the purposes of providing services to Covered Entity ("Services") as set forth in the underlying agreement to which this BAA is attached ("Agreement").

Business Associate Obligations. Business Associate agrees to comply with applicable federal and state confidentiality and security laws, including, but not limited to the Privacy and Security Standards, and including without limitation:

Knowledge of HIPAA and Texas Patient Privacy Laws. Business Associate agrees to review and understand Texas Health and Safety Code Ch. 181 and HIPAA as it applies to Business Associate, and to comply with the applicable requirements of Texas Health and Safety Code Ch. 181, HIPAA, and HITECH (including without limitation 45 C.F.R. 164.308, 164.310, 164.312, and 164.316), as well as any applicable amendments. Business Associate agrees to not use or disclose PHI other than as permitted or required by the BAA or as Required by Law.

Training. Business Associate agrees to provide training to its employees regarding the state and federal law concerning protected health information as necessary and appropriate for the employees to carry out the employees' duties for Business Associate as required by Texas Health and Safety Code Ch. 181.

Use and Disclosure of .

Business Associate may only use or disclose as necessary to perform the Services on behalf of Covered Entity, and shall not use or disclose PHI in a manner that would violate Texas Health and Safety Code Ch. 181 or HIPAA if so used or disclosed by Covered Entity.

Business Associate may use and disclose as Required by Law.

Business Associate agrees to make uses and disclosure and requests for PHI consistent with Covered Entity's Minimum Necessary policies and procedures, i.e., only PHI that is the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except that Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out its legal responsibilities and its responsibilities under this BAA. However, the Business Associate shall in such case:

provide training to members of its workforce regarding the confidentiality requirements in the Privacy and Security Standards and this BAA;

obtain reasonable assurances from the person or entity to whom the PHI is disclosed that: (a) the PHI will remain confidential and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person or entity and (b) the person or entity will notify Business Associate of any instances of which it is aware in which confidentiality of the PHI has been breached; and

agree to notify the designated Privacy Officer of Covered Entity of any instances of which it is aware in which the is used or disclosed for a purpose that is not otherwise provided for in this BAA or for a purpose not expressly permitted by the Privacy and Security Standards.

Disclosure to Third Parties. If Business Associate discloses received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, to agents, including a subcontractor, Business Associate shall require the agent or subcontractor to agree to the same restrictions and conditions that apply to the Business Associate under this BAA. Business Associate shall ensure that any agent, including a subcontractor, to which the Business Associate provides PHI, agrees to implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of the PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity. The Business Associate shall be fully liable to Covered Entity for any acts, failures or omissions of the agent or subcontractor in providing the services as if they were the Business Associate's own acts, failures or omissions, to the extent permitted by law. The Business Associate further expressly warrants that its agents will be specifically advised of, and will comply in all respects with, the terms of this BAA. Furthermore, in accordance with Section 13404 of HITECH, Business Associate shall comply with 45 C.F.R. 164.504(e)(1)(ii).

No Offshore PHI. Without the prior written approval of Covered Entity, Business Associate shall neither (i) create, receive, maintain, or transmit Covered Entity's PHI outside the geographic boundaries of the United States, nor (ii) provide, transmit, or allow access to Covered Entity's PHI to any person or entity located outside the geographic boundaries of the United States, including employees, agents or other representatives of that person or entity.

Data Aggregation. In the event that the Business Associate works for more than one Covered Entity, Business Associate is permitted to use and disclose , but only in order to analyze data for permitted health care operations, and only to the extent that such use is permitted under the Privacy and Security Standards.

De-Identified Information. Use and disclosure of de-identified health information is permitted, but only if (i) the precise use is disclosed to Covered Entity and permitted by Covered Entity in its sole discretion and (ii) the de-identification complies with 45 C.F.R. 164.502(d), and any such de-identified health information meets the standard and implementation specifications for de-identification under 45 C.F.R. 164.514(a) and (b), or such regulations as they may be amended from time to time.

Notice of Privacy Practices. Business Associate agrees that it will abide by the limitations of any Notice of Privacy Practices ("HIPAA Notice") published by Covered Entity of which it has knowledge. Covered Entity shall provide to Business Associate such HIPAA Notice when it is adopted. Any use or disclosure permitted by this BAA may be amended by such HIPAA Notice. The amended HIPAA Notice shall not affect permitted uses and disclosures on which Business Associate relied prior to such notice.

Withdrawal of Consent or Authorization. If the use or disclosure of in this BAA is based upon an Individual's specific consent or authorization for the use of his or her , and the Individual revokes such consent or authorization in writing, or the effective date of such authorization has expired, or the consent or authorization is found to be defective in any manner that renders it invalid, the Business Associate agrees, if it has notice of such revocation or invalidity, to cease the use and disclosure of any such Individual's except to the extent it has relied on such use or disclosure, or where an exception under the Privacy and Security Standards expressly applies.

Use or Disclosure that Would Violate HIPAA. Business Associate is prohibited from further use or disclosure of in a manner that would violate the requirements of the Privacy and Security Standards if the were used or disclosed by Covered Entity, except to the extent permitted in Section D.3(d) above.

Safeguards. Business Associate is required to implement and maintain administrative, physical, and technical safeguards with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA, in accordance with Subpart C of 45 C.F.R. Part 164, that reasonably and appropriately protects the confidentiality, integrity, and availability of and ensure that such is not received, used, accessed, stored, transmitted, or disclosed other than as provided by this BAA or as Required by Law.

Securing . Business Associate shall secure any and all Electronic Protected Health Information ("EPHI") covered by this BAA in accordance with the guidance issued by the Secretary entitled "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals," as amended and updated from time to time. In addition, with respect to covered by this BAA, Business Associate shall comply with any guidance issued by the Secretary under the authority of HITECH Section 13401(c). Business Associate shall use best efforts to avoid the creation or storage of paper .

Records Management. Upon termination of this BAA or the Agreement for any reason, Business Associate agrees to return or destroy all received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that Business Associate maintains in any form and shall comply with federal and state laws as they may be amended from time-to-time governing the maintenance or retention of . If the return or destruction of is not feasible, Business Associate shall inform Covered Entity of the reason thereof, and Business Associate agrees to extend the protections of this BAA to such PHI and limit further uses and disclosures of the PHI to those purposes that make the return or destruction of the information infeasible for so long as Business Associate retains the PHI.

Individual Rights Regarding Designated Record Sets. If Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate agrees as follows:

Correction of . Business Associate agrees that it will amend maintained by Business Associate as requested by Covered Entity pursuant to 45 C.F.R. 164.526.

Individual Right to Copy or Inspection. Business Associate agrees that if it maintains a Designated Record Set for Covered Entity that is not maintained by Covered Entity, it will permit an Individual to inspect or copy about the Individual in that set as directed by Covered Entity under conditions and limitations required under 45 C.F.R. 164.524 as it may be amended from time-to-time. Covered Entity is required to act on such requests as soon as possible but not later than 30 days following receipt of the request. Under Texas law, Business Associate must act within 15 days of receiving applicable fees for copies or, if no fees are charged or there is a medical emergency, within 15 days of receipt of the request. Business Associate agrees to make reasonable efforts to assist Covered Entity in meeting this deadline, to the extent the requested information is maintained by Business Associate and not Covered Entity.

The information shall be provided in the form or format requested, if it is readily producible in such form or format; or in summary, if the Individual has agreed in advance to accept the information in summary form. A reasonable, cost-based fee for copying health information may be charged.

Individual Right to Amendment. Business Associate agrees that it will accommodate an Individual's right to have access to and amend about the Individual in a Designated Record Set in accordance with the Privacy and Security Standards set forth at 45 C.F.R. 164.526 as it may be amended from time-to-time.

Accounting of Disclosures. Business Associate agrees to maintain documentation of and make available to the Individual and/or Covered Entity from whom the originated, as Covered Entity requests, information required for an accounting of disclosures of with respect to the Individual, in accordance with 45 C.F.R. 164.528 as it may be amended from time-to-time. Such accounting is limited to disclosures that were made in the six (6) years prior to the request (not including any disclosures prior to the compliance date of the Privacy and Security Standards).

Covered Entity is required to act on such requests as soon as possible but not later than 60 days following receipt of the request. Business Associate agrees to use its best efforts to assist Covered Entity in meeting this deadline.

Such accounting must be provided without cost to the Individual or Covered Entity if it is the first accounting requested by an Individual within any 12-month period; however, a reasonable, cost-based fee may be charged for subsequent accountings if the Individual is informed in advance of the fee and is afforded an opportunity to withdraw or modify the request.

Business Associate's obligations under this Section shall continue for as long as Business Associate maintains PHI.

Policies and Procedures. Business Associate shall implement and maintain reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of Part 164 of Title 45, Code of Federal Regulations, including, but not limited to, the provision of a process for complaints regarding Business Associate's obligations under this BAA, HITECH, and HIPAA and imposition of sanctions against workforce members who fail to comply with the requirements of this BAA, HITECH, and HIPAA.

Security Incident. Business Associate agrees to immediately report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured Protected Health Information ("Unsecured PHI") as required at 45 C.F.R. 164.410, and any Security Incident of which the Business Associate becomes aware.

Notification in Case of Breach.

The parties acknowledge and agree that the express statutory language of HITECH including, but not limited to, the breach notification requirements under Section 13402 of HITECH (the "Breach Notification Rule") is directly applicable to Business Associate and is hereby incorporated into this BAA.

Business Associate shall, following the discovery of any Breach of Unsecured :

initially notify Covered Entity without unreasonable delay and in no case later than three (3) calendar days after discovery of a Breach;

subject to Section 18(f) below, notify each Individual whose Unsecured has been, or is reasonably believed to have been accessed, acquired, or disclosed as a result of such Breach; and

notify Covered Entity of such Breach in accordance with 45 C.F.R. 164.410. Such notice shall include:

the identification of each Individual whose Unsecured has been, or is reasonably believed to have been accessed, acquired, or disclosed as a result of such Breach;

a brief description of what happened, including the date of Breach and date of discovery;

a description of the types of Unsecured PHI involved in the Breach (i.e., whether the full name, social security number, etc. was disclosed);

the steps the Individual should take to protect themselves from potential harm resulting from the Breach;

a brief description of what the Business Associate involved is doing to investigate the Breach, to mitigate losses, and to protect against further Breaches; and

contact procedures for Covered Entity or Individuals to ask questions or learn additional information, which shall include a toll free number, an email address, Web site, or postal address.

All notifications under this Section 18 shall be made without unreasonable delay and:

if to an Individual pursuant to Section 18(b)(ii), no later than sixty (60) calendar days following the discovery of such Breach by the Business Associate, as defined by 45 C.F.R. 164.410;

if to Covered Entity pursuant to Section 18(b)(iii), no later than forty-five (45) calendar days following the discovery of such Breach by the Business Associate, as defined by 45 C.F.R. 164.410.

All notifications under subsection (b)(ii) of this Section 18 shall comply with all applicable provisions under 45 C.F.R. 164.404.

Business Associate shall implement a reasonable system for discovery of Breaches of Unsecured . Business Associate shall notify Covered Entity of any and all Breaches of Unsecured . A Breach shall be treated as discovered by Business Associate on the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate. Business Associate is deemed to have knowledge of a Breach if the Breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the Breach), who is an employee, officer or other agent of the Business Associate.

In the event Business Associate discovers a Breach of Unsecured , Covered Entity shall decide how and when the notification to Individuals and media shall be provided and shall approve the content of such notifications. At the request of Covered Entity and in Covered Entity's sole discretion, Business Associate shall provide the notification to Individuals and/or the media as directed by Covered Entity, and/or reimburse Covered Entity for the cost of notifying Individuals and/or the media.

Subcontractors. In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions and conditions that apply to the Business Associate with respect to such information.

To the extent the Business Associate is to carry out one or more of Covered Entity's obligations under 45 C.F.R. Part 162 or Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements therein that apply to the Covered Entity in the performance of such obligations.

Internal Practices, Books, and Records. The Business Associate shall make available its internal practices, policies, procedures, books, and records relating to the use and disclosure of received from Covered Entity, created or received by the Business Associate on behalf of Covered Entity, to the Secretary for the purpose of determining Covered Entity's compliance with HIPAA, or any other health oversight agency, or to Covered Entity. Records requested that are not protected by an applicable legal privilege will be made available in the time and manner specified by Covered Entity or the Secretary.

Indemnification. To the extent permitted by law, Business Associate agrees to indemnify and hold harmless Covered Entity from and against all claims, demands, liabilities, judgments or causes of action of any nature for any relief, elements of recovery or damages recognized by law (including, without limitation, attorney's fees, defense costs, and equitable relief ), for any damage or loss incurred by Covered Entity arising out of, resulting from, or attributable to any acts or omissions or other conduct of Business Associate in connection with the performance of Business Associate's duties under this BAA. This indemnity shall apply even if Covered Entity is alleged to be solely or jointly negligent or otherwise solely or jointly at fault; provided, however, that a trier of fact finds Covered Entity not to be solely or jointly negligent or otherwise solely or jointly at fault. This indemnity shall not be construed to limit Covered Entity's rights, if any, to common law indemnity.

Covered Entity shall have the option, at its sole discretion, to employ attorneys selected by it to defend any such action, the costs and expenses of which shall be the responsibility of the Business Associate. Covered Entity shall provide the Business Associate with timely notice of the existence of such proceedings and such information, documents and other cooperation as reasonably necessary to assist the Business Associate in establishing a defense to such action.

These indemnities shall survive termination of this BAA and the Agreement, and Covered Entity reserves the right, at its option and expense, to participate in the defense of any suit or proceeding through counsel of its own choosing.

Insurance. As long as Business Associate receives, transmits, creates, or maintains PHI, Business Associate will maintain cyber insurance with coverage for HIPAA breaches including breach management and Individual notification expenses in the minimum amount of fifteen million dollars ($15,0000,00) per occurrence and thirty million dollars ($30,0000,00) in the annual aggregate. Upon the execution of the Agreement and upon Covered Entity's request any time thereafter (no more than annually), Business Associate will furnish a then-current certified certificate(s) of insurance. Such policy (or policies) shall (i) be endorsed to include Covered Entity as an additional insured to the extent indemnified pursuant to this BAA, (ii) provide for severability of interests, and (iii) provide Business Associate with at least thirty (30) days' notice of cancellation. Business Associate shall provide thirty (30) days' prior written notice to Covered Entity of any nonrenewal or cancellation of any insurance coverage.

Mitigation. If Business Associate violates this BAA or the HIPAA Rules, Business Associate agrees to mitigate any damage caused by such violation. Additionally, Business Associate agrees to mitigate, to the extent practicable, any other damages of which it is aware resulting from a violation of this BAA or the HIPAA Rules.

Rights of Proprietary Information. Covered Entity retains any and all rights to the proprietary information, confidential information, and it releases to Business Associate.

Termination for Breach. Without limiting the termination provisions herein, if Business Associate breaches any provision of this BAA, Covered Entity may, at its option, access and audit the records of Business Associate related to its use and disclosure of , require Business Associate to submit to monitoring and reporting, and such other conditions as Covered Entity may determine is necessary to ensure compliance with this BAA; or Covered Entity may terminate this BAA and the Agreement on a date specified by Covered Entity.

Survival of Key Provisions. The provisions of this BAA and the respective rights and obligations of the Business Associate under Section D.13. of this BAA shall survive the termination of this BAA and the Agreement.

Amendments. Covered Entity and Business Associate agree to enter into good faith negotiations to amend this BAA to come into compliance with changes in state and federal laws and regulations relating to the privacy, security and confidentiality of . Covered Entity may terminate this BAA upon thirty (30) days written notice in the event that Business Associate does not promptly enter into an amendment that Covered Entity, in its sole discretion, deems necessary to ensure that Covered Entity will be able to comply with such laws and regulations.

Regulatory References. A citation in this BAA to the Code of Federal Regulations (C.F.R.) shall mean the cited section as that section may be amended from time to time.

Obligations of Covered Entity. To the extent applicable, Covered Entity shall:

provide Business Associate a copy of its HIPAA Notice produced by Covered Entity in accordance with 45 C.F.R. 164.520 as well as any changes to such HIPAA Notice;

provide Business Associate with any changes in, or revocation of, authorizations by Individuals relating to the use and/or disclosure of PHI, if such changes affect Business Associate's permitted or required uses and/or disclosures;

notify Business Associate of any restriction to the use and/or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. 164.522;

notify Business Associate of any amendment to PHI to which Covered Entity has agreed that affects a Designated Record Set maintained by Business Associate; and

if Business Associate maintains a Designated Record Set, provide Business Associate with a copy of its policies and procedures related to an Individual's right to: access PHI; request an amendment to PHI; request confidential communications of PHI; or request an accounting of disclosures of PHI.

Revised July 7, 2021

Exhibit D

Vendor Certification Form

RFQP #20261382539 Outsourced Internal Audit Services

INCLUDE THE FOLLOWING:

Copy of certificate(s) (State of Texas, North Central Texas Regional Certification Agency (NCTRCA), Historically Underutilized Businesses (HUB), or any agency confirming your business as being a historically underutilized or small business enterprise.

signature: ________________________________________ Title: ______________

Print Name: __________________________________________ Date: ____________

Exhibit E

Conflict of Interest Questionnaire

Chapter 176 to the Texas Local Government Code ("Chapter 176") contains provisions mandating the public disclosure of certain information concerning persons doing business or seeking to do business with the District ("Disclosure Information"). The Disclosure Information relates to affiliations, and business and financial relationships such persons may have with members of the District's governing body, its officers and certain other high-level District employees. Each Respondent is charged with the responsibility of becoming familiar with the requirements of Chapter 176 and for complying with the applicable provisions thereof.

Each Respondent shall complete the Conflict of Interest Questionnaire set forth below and shall return the completed Conflict of Interest Questionnaire with its Response. A complete copy of Chapter 176 of the Local Government Code may be found at: . For easy reference, below are some of the sections cited on this form.

Local Government Code 176.001(1-a): "Business relationship" means a connection between two or more parties based on commercial activity of one of the parties. The term does not include a connection based on: (A) a transaction that is subject to rate or fee regulation by a federal, state, or local governmental entity or an agency of a federal, state, or local governmental entity; (B) a transaction conducted at a price and subject to terms available to the public; or (C) a purchase or lease of goods or services from a person that is chartered by a state or federal agency and that is subject to regular examination by, and reporting to, that agency.

Local Government Code 176.003(a)(2)(A) and (B): (a) A local government officer shall file a conflicts disclosure statement with respect to a vendor if: . . . . . (2) the vendor: (A) has an employment or other business relationship with the local government officer or a family member of the officer that results in the officer or family member receiving taxable income, other than investment income, that exceeds $2,500 during the 12-month period preceding the date that the officer becomes aware that (i) a contract between the local governmental entity and vendor has been executed; or (ii) the local governmental entity is considering entering into a contract with the vendor; or (B) has given to the local government officer or a family member of the officer one or more gifts that have an aggregate value of more than $100 in the 12-month period preceding the date the officer becomes aware that: (i) a contract between the local governmental entity and vendor has been executed; or (ii) the local governmental entity is considering entering into a contract with the vendor.

Local Government Code 176.006(a) and (a-1)

(a) A vendor shall file a completed conflict of interest questionnaire if the vendor has a business relationship with a local governmental entity and: (1) has an employment or other business relationship with a local government officer of that local governmental entity, or a family member of the officer, described by Section 176.003(a)(2)(A); (2) has given a local government officer of that local governmental entity, or a family member of the officer, one or more gifts with the aggregate value specified by Section 176.003(a)(2)(B), excluding any gift described by Section 176.003(a-1); or (3) has a family relationship with a local government officer of that local governmental entity.

(a-1) The completed conflict of interest questionnaire must be filed with the appropriate records administrator not later than the seventh business day after the later of: (1) the date that the vendor: (A) begins discussions or negotiations to enter into a contract with the local governmental entity; or (B) submits to the local governmental entity an application, response to a request for proposals or bids, correspondence, or another writing related to a potential contract with the local governmental entity; or (2) the date the vendor becomes aware: (A) of an employment or other business relationship with a local government officer, or a family member of the officer, described by Subsection (a); (B) that the vendor has given one or more gifts described by Subsection (a); or (C) of a family relationship with a local government officer.

RFQP #20261382539 Outsourced Internal Audit Services

Exhibit F

Good Faith Form

Respondents: Please complete the following questions as applicable to your organization:

[rest of page left intentionally blank, continue below]

Exhibit F

Good Faith Form

Are you a historically underutilized or small business ?

If yes, please attach your updated certification form (Stop Here)

If no, please continue to #2 below

List all participating historically underutilized or small business agencies/organizations contacted regarding subcontracting and/or partnership opportunities for this contract. (Insert additional rows as needed.)

If no HUB participation is listed above, have you checked the JPS Vendor portal at ? The vendor portal is a directory of historically underutilized or small businesses Ex: Support services to participate under the contract

If you searched the vendor portal, list HUB company name(s) and contact information below

If you are not a HUB and do not have a HUB subcontractor, please provide a statement regarding steps that your company has taken to demonstrate your commitment to HUBs: (insert additional rows as needed)

Please provide an explanation as to how you plan to identify HUB participation on this contract: (insert additional rows as needed)

Did you complete, sign and submit all required forms?

If not, your Proposal will be disqualified!

*Please ensure this RFQP #20261382539 is included in the "Bidding Opportunity Num" field of the RFP Response Form, as well as in the file name(s) of each uploaded file.*