MEDI-CAL POINT OF SERVICE (POS) NETWORK/INTERNET AGREEMENT This agreement is required for all providers and non-providers (provider representatives) who intend to use the Medi-Cal POS Network or Medi-Cal Web site applications at www.medi-cal.ca.gov. I. (a). The following is required only for enrolled Medi-Cal providers: The Department of Health Care Services (DHCS) will permit the use of the California POS Network and Medi-Cal Web site by the following Medi-Cal provider subject to the terms and conditions of this agreement. Provider Name: Provider Number/NPI: Owner Number: _______________________________ (If applicable) Tax ID: ________________________ (b). The following is required only if intending to use a device and/or software that is not obtained through Medi-Cal: Vendor/Developer Company Name: _________________________________________ CMC Submitter Number (if applicable): ___ ___ ___ Contact Person: _________________________________ Phone Number: (___ ___ ___) ___ ___ ___ ___ ___ ___ ___ (c). The following is required only for non-provider users [provider representatives] of the POS Network/Medi-Cal Web site: DHCS will permit the use of the Medi-Cal POS Network and/or Medi-Cal Web site by the authorized provider representative _____________________________________ (Representative) subject to the terms of this agreement. When applicable, please attach to this agreement a list of all provider numbers/NPIs and corresponding Tax Identification Numbers (TINs) for which the non-provider user is also the authorized representative. (d). Provider/Representative is requesting to delete access and usage of the POS Network and/or Medi-Cal Web site to the following provider representative _____________________________________ (Representative) subject to the terms of this agreement. When applicable, please attach to this agreement a list of all provider numbers/NPIs and corresponding TINs for deletion. II. Provider/Representative agrees to limit the usage of the POS Network and Medi-Cal Web site to the following Medi-Cal eligibility and claims-related transactions: A. Verification of Medi-Cal eligibility B. Share of Cost (Spend Down) clearance C. Medi-Service reservations D. Submission of Pharmacy claims (may only be performed by providers enrolled to submit claims on the Pharmacy/Medical Supplies Claim Form) E. Submission of ANSI ASC X12N 837 professional claims (may only be performed by providers enrolled to submit claims on the Medi-Cal Medical Services claim form) F. Submission of electronic Treatment Authorization Requests (i.e. eTAR and Pharmacy NCPDP) G. Submission of other transactions as may be subsequently permitted by DHCS and as documented in one or more of the user manuals in the Publications area of the Medi-Cal Web site H. Browsing of Medi-Cal Web site Provider/Representative acknowledges that failure to limit the usage of the POS Network and/or Medi-Cal Web site to the transactions described above may, at a minimum, result in DHCS revoking the privilege to use the POS Network and/or Medi-Cal Web site. Provider/Representative acknowledges abuse of transactions available on the Medi-Cal Web site may result in DHCS revoking provider access to Medi-Cal Web site. 1 – point PROPubs 04/10 1 of 3 American LegalNet, Inc. www.FormsWorkFlow.com III. The Provider/Representative agrees that the following constitutes the only authorized methods of accessing the POS Network: A. Medi-Cal-provided toll-free (800) line or 916-prefix phone line as documented in the POS Device User Guide B. Provider- or Representative-provided leased phone lines IV. Any computer accessing the Medi-Cal Web site is required to abide by all applicable State and Federal laws enacted today or in the future. V. The Provider/Representative agrees to the following security requirements. All computers that access Medi-Cal data must meet the following requirements, in addition to any State and Federal required administrative, technical, physical, and organizational safeguards: A. Antivirus software. All workstations, laptops and other systems that access the Medi-Cal Web site or process and/or store Medi-Cal Protected Health Information (PHI) must install and actively use comprehensive anti-virus software solution with automatic updates scheduled at least daily. B. Patch Management. All workstations, laptops and other systems that access the Medi-Cal Web site or process and/or store Medi-Cal PHI must have critical security patches applied, with system reboot if necessary. There must be a documented patch management process, which determines installation timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable patches must be installed within 30 days of vendor release. C. System Timeout. The systems that access the Medi-Cal Web site or process and/or store Medi-Cal PHI must provide an automatic timeout, requiring re-authentication of the user session. It is recommended that the automatic timeout be after no more than 20 minutes of inactivity. D. User Name and Password Controls. Systems that access the Medi-Cal Web site or process and/or store Medi-Cal PHI should be accessed using a unique user name. The user name must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the password. Passwords are not to be shared. Passwords must be: (1) At least eight characters, (2) A non-dictionary word, (3) Not be stored in readable format on the computer, (4) Be changed every 90 days, preferably 60 days, (5) Be changed if revealed or compromised, and (6) Be composed of characters from at least three of the following four groups from the standard keyboard: • Upper case letters (A-Z) • Lower case letters (a-z) • Arabic numerals (0-9) • Non-alphanumeric characters (punctuation symbols) E. Workstation/Laptop encryption. All workstations and laptops that access the Medi-Cal Web site or process and/or store Medi-Cal PHI are recommended to be encrypted using a FIPS 140-2 certified algorithm, which is 128-bit or higher, such as Advanced Encryption Standard (AES); full disk encryption is recommended. VI. The Provider/Representative agrees to pay the following fees associated with the use of the POS Network: A. For eligibility transactions, including Share of Cost clearance and Medi-Service reservations submitted through Medi-Cal-provided phone lines, there will be no transaction fee. B. For Provider and/or Representative submission of pharmacy claims transactions through Medi-Cal-provided phone lines, there will be a fee of $ .10 per approved claim transaction. An approved claim transaction is defined as a service, medical supply, durable medical equipment or drug supply that is determined to be payable through the claims adjudication process of the POS Network. This fee will be withheld from your regular Medi-Cal claims payment. C. Any claim and/or eligibility transaction submitted on the Medi-Cal Web site will not have a transaction fee. D. If the POS device is not being used over a reasonable amount of time, the Provider/Representative agrees to return the device. If the device is not returned in a timely manner, the Provider/Representative agrees to have the $700 cost of the device deducted from future reimbursement. 1 – point PROPubs 04/10 2 of 3 American LegalNet, Inc. www.FormsWorkFlow.com VII. Provider/Representative agrees, in order for the Provider/Representative’s system to be activated for submission of actual Medi-Cal eligibility or claims-related transactions, to perform testing as required by DHCS and as documented in the POS Network Interface Specifications document or Medi-Cal Web site documents. Provider/Representative acknowledges that multiple tests may be required to activate the full functionality of the device/software/application and that all testing must be successfully concluded before the device/software/application will be activated. VIII. Provider/Representative agrees to report all malfunctions of the POS Network or Medi-Cal Web site to Medi-Cal Fiscal Intermediary at the phone number and/or address listed below. IX. Provider/Representative acknowledges that neither DHCS nor its agent is responsible for errors or problems, including problems of incompatibility, caused by hardware or software not provided by DHCS. X. Provider or Non-Provider (Authorized Representative) Signature: I, the undersigned, am authorized and do attest and agree to all of the terms and conditions of this agreement. ___________________________________ Printed Name of Signee ________________________________________ Authorized Signature ___________________________________ Title ________________________________________ Date Address ___________________________________ ___________________________________ ___________________________________ Please mail this completed form to: CMC Submitter Number (if applicable): ___ ___ ___ Medi-Cal Fiscal Intermediary (HP Enterprise Services) Attn: POS/Internet Help Desk 3215 Prospect Park Drive Rancho Cordova, CA 95670-6017 1-800-541-5555 or (916) 636-1200 1 – point PROPubs 04/10 3 of 3 American LegalNet, Inc. www.FormsWorkFlow.com