Resolution Agreement with CVS Pharmacy, Inc.

January 15, 2009 RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement (Agreement) are: (1) the United States Department of Health and Human Services' (HHS) Office for Civil Rights (OCR); and (2)(i) CVS Pharmacy, Inc., a Rhode Island corporation, (CVS Pharmacy) on behalf of its retail pharmacy store entities in the United States that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider," as defined in 45 C.F.R. § 160.103; (ii) Revco Discount Drug Centers, Inc., a Michigan corporation; American Drug Stores Delaware, L.L.C., a Delaware limited liability company; Montana CVS Pharmacy, L.L.C., a Montana limited liability company; CVS RS Arizona, L.L.C., an Arizona limited liability company; and CVS NV Holding Company, L.L.C., a Nevada limited liability company, on behalf of each of their affiliated retail pharmacy store entities in the United States that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider," as defined in 45 C.F.R. § 160.103; and, (iii) to the extent not already included in (i) or (ii), all entities owned or controlled by CVS Pharmacy or of which CVS Pharmacy is a member and/or operating agent, and/or any other entity listed or referred to in (2)(i) or (ii) of this paragraph, including, but not limited to, the entities listed in Exhibit 1 (which is current as of January 9, 2009), that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider," as defined in 45 C.F.R. § 160.103 (collectively "CVS Entities," and individually "CVS Entity"). The descriptions of the CVS Entities are only for purposes of this Agreement and the associated Corrective Action Plan of this same date (CAP) and have no impact regarding whether any CVS Entity or any CVS Entities constitute an "affiliated covered entity," as defined in 45 C.F.R. § 160.105(b). The term "CVS Entities" shall also refer to any retail pharmacy legal entity that any CVS Entity may originate, acquire, or over which it may obtain control or of which it may become a member and/or operating agent at any time after the Effective Date of this Agreement for so long as this Agreement and the associated CAP are in force, provided that the entity meets the definition of a "covered entity" under 45 C.F.R. § 160.103, and further provided, that any such entities acquired or over which a CVS Entity obtained or obtains control on or after October 1, 2008, will not be subject to the terms of the Agreement and the CAP until the six-month anniversary of the date of their origination, acquisition or coming under control of a CVS Entity. As set forth in paragraph 6 below, each CVS Entity has designated the same individual to act as its "Compliance Representative" for purposes of compliance with this Agreement and with the CAP of this same date, which is attached as Exhibit 2 hereto and whose terms are incorporated by reference herein. All CVS Entities shall satisfy their obligations under this Agreement and under the CAP directly or, when they so designate, through the actions of the Compliance Representative. Attached hereto as Exhibit 1 and incorporated by reference herein is a list that contains: (1) the name and store number for each retail pharmacy store which any CVS Entity owned and/or operated as of January 9. 2009; (2) the address of each such store; and (3) the date on which each such store was opened or acquired by a CVS Entity. US ACT1VE-100910937.9 January 15, 2009 2. Factual Background and Covered Conduct. OCR enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the "Privacy Rule"). OCR has authority to conduct reviews of covered entities to determine if those entities are complying with the Privacy Rule. (45 C.F.R. § 160.308.) Entities that are covered by the Privacy Rule must cooperate with OCR's compliance reviews. (45 C.F.R. § § 160.308 and 160.310(a) and (b).) The CVS Entities that are Parties to this Agreement are required to comply with the Privacy Rule. On September 27, 2007, OCR opened a review of the CVS Entities' compliance with the Privacy Rule, pursuant to 45 C.F.R. § 160.308, based on media reports that protected health information (PHI) maintained by several retail pharmacy chains, including CVS Pharmacy, was being disposed of in dumpsters that were potentially accessible to persons who were not authorized members of the entities' workforces. The CVS Entities have asserted that there is no independent substantiation for the media reports. At the same time that OCR commenced its compliance review, the Federal Trade Commission (FTC) opened an investigation of the CVS Entities in response to the media reports, pursuant to Section 5 of the FTC Act, 15 U.S.C. § 43, et seq. OCR and the FTC have conducted a collaborative review. OCR's review indicates that the following conduct occurred ("Covered Conduct"): (a) On several occasions between July 2006 and May 2007, some CVS retail pharmacies disposed of non-electronic PHI in open dumpsters potentially accessible to persons who were not authorized members of the CVS Entities' workforces; (b) The policies and procedures establishing physical and administrative safeguards that the CVS Entities adopted and implemented from April 2003 until November 2006 for their disposal of PHI were not adequately designed to appropriately and reasonably safeguard PHI; (c) The CVS Entities did not maintain a sanctions policy for members of their workforces who failed to comply with the policies and procedures referenced in subparagraph (b) above; (d) From April 2003 through November 2006, while the CVS Entities provided and documented their provision of training, the training and/or documentation of the provision of necessary and appropriate training for the members of their workforces regarding the disposal of PHI was not sufficient to ensure that appropriate workforce members knew how to dispose of non-electronic PHI consistent with the Privacy Rule. 3. No Admission. Execution of this Agreement does not constitute an admission of liability by any CVS Entity, and the CVS Entities expressly deny any violation of HIPAA or the Privacy Rule, and further deny any wrongdoing. 4. No Concession. Execution of this Agreement is not a concession by OCR that the CVS Entities are in compliance with the Privacy Rule and are thus not liable for the imposition of civil money penalties (CMPs) by OCR pursuant to the Privacy Rule. January 15, 2009 5. Intention to Effect Resolution. This Agreement is intended to resolve OCR Compliance Review No. 07-73376 regarding possible violations by the CVS Entities of the Privacy Rule related to the Covered Conduct. As consideration for avoiding the uncertainty, burden and expense of further investigation and formal proceedings, the Parties agree to resolve the issues raised in the compliance review according to the Terms and Conditions below. At the same time, the CVS Entities and the FTC are entering into an agreed order, resolving by consent the issues raised in the FTC's investigation. The proposed consent agreement will be presented to the Commission for its preliminary, and, after a public comment period, final approval. II. Terms and Conditions 6. Compliance Representative. Each CVS Entity shall designate an individual to serve as that CVS Entity's Compliance Representative under this Agreement and under the CAP. The CVS Entities hereby agree to appoint the same individual to serve as the Compliance Representative for each of them. The Compliance Representative shall be an individual who is knowledgeable about the Privacy Rule and about the disposal policies and practices of the CVS Entities with respect to non-electronic PHI. The Compliance Representative shall be responsible for assuring each CVS Entity's compliance with this Agreement and the CAP and for arranging for the provision of such assistance as the CVS Entities may require to comply with the Agreement and the CAP, including, but not limited to, arranging for and/or providing policies, procedures, training, and internal monitoring services. The CVS Entities, either individually or through CVS Pharmacy in its capacity as their designee, shall provide OCR on the Effective Date with a written designation of a particular individual as the Compliance Representative, which designation shall be substantially in the form of Exhibit 3 hereto. If at any time while this Agreement and the CAP are in effect, the person designated as the Compliance Representative in Exhibit 3 shall no longer serve in that capacity, the CVS Entities shall choose a new Compliance Representative within ten (10) business days of the conclusion of the former Compliance Representative's service and shall submit the name of the successor Compliance Representative to OCR within three (3) business days of choosing the successor Compliance Representative. Notification to OCR of the appointment of a successor Compliance Representative shall be made using a written designation, substantially in the form of Exhibit 3 hereto. 7. Payment. The CVS Entities agree to pay HHS the aggregate amount of $2,250,000 (the Resolution Amount). The CVS Entities hereby confirm that they have directed the Compliance Representative to pay the Resolution Amount either by: (1) certified check made payable to "United States Department of Health and Human Services" or (2) by electronic funds transfer, pursuant to written instructions to be provided by OCR. The Compliance Representative shall pay the Resolution Amount to OCR within three (3) business days of the Compliance Representative's execution of this Agreement. 8. Corrective Action Plan. The CVS Entities hereby warrant that they have directed the Compliance Representative, on their behalf, to execute the CAP and to agree that the CVS Entities will comply with the CAP in all respects. If an action or omission by any CVS Entity or January 15,2009 by the Compliance Representative constitutes a material breach of this Agreement and/or of the CAP and is not cured as provided in Section VIII.C of the CAP, then such action or omission shall also constitute a material breach of the Agreement and/or the CAP by each of the CVS Entities. In the event of an uncured material breach of this Agreement and/or of the CAP, the CVS Entities will be deemed to have forfeited the benefits of the Release provided for in section 9 of this Agreement. 9. Release by HHS. In consideration of and conditioned upon the performance by the CVS Entities of all of their obligations under this Agreement and under the CAP, OCR releases the CVS Entities from any actions arising out of or related to the Covered Conduct identified in paragraph 2 of this Agreement. OCR does not, however, release the CVS Entities from, nor waive any rights, obligations, or causes of action other than those specifically referred to in this paragraph. This release does not extend to actions that may be brought under section 1177 of the Social Security Act, 42 USC § 1320d-6. 10. Agreement by Released Parties. The CVS Entities hereby waive any right to contest the validity of the obligation to pay, or to contest the amount of, the Resolution Amount or to contest any other obligations agreed to under this Agreement. The CVS Entities also hereby waive all procedural rights available to them regarding the Resolution Amount, pursuant to Section 1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160 Subpart E, and pursuant to the HHS Claims Collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal. 11. Binding on Successors. This Agreement is binding on each of the CVS Entities as well as their respective successors, heirs, transferees, and assigns. 12. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement and the CAP. 13. No Additional Releases. This Agreement is intended to be for the benefit of the Parties only and by this instrument the Parties do not release any claims any of them may have against any other person or entity. 14. Effect of Agreement. This Agreement, including the CAP, constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement must be set forth in writing and signed by all Parties to become effective. 15. Execution of Agreement and Effective Date. The Agreement and the CAP shall become effective (i.e., final and binding) upon the date of signing of this Agreement and the CAP by the last signatory (Effective Date). 16. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7a(c)(l), a CMP must be imposed within six (6) years from the date of the occurrence of the violation. To ensure that this six-year period does not expire during the term of this Agreement, the CVS Entities hereby stipulate that the time between the Effective Date of this Agreement (as set forth in January 15,2009 paragraph 15) and the date that the Agreement may be terminated by reason of an uncured material breach committed by any CVS Entity, plus one year thereafter, will not be included in calculating the six-year statute of limitations applicable to the violations which are the subject of this Agreement. The CVS Entities waive, and will, therefore, be barred from pleading, any statute of limitations, laches, or similar defenses in any administrative proceeding relating to the Covered Conduct identified in paragraph 2 of this Agreement that may be filed by HHS within the time period set forth above, except to the extent that such defenses would have been available had an administrative action been filed on or before the Effective Date of this Agreement. 17. Disclosure. There are no restrictions on the publication of the Agreement. This Agreement and information related to this Agreement may be made public by any Party. In addition, OCR may be required to disclose this Agreement and related material to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. § 552, et seq. (FOIA) and its implementing regulations, 45 C.F.R. Part 5; provided, however, that OCR will use its best efforts to prevent the disclosure of information, documents, CD-ROMs, photographs, tables, booklets, and any other item produced by any CVS Entity to OCR as part of OCR's compliance review, to the extent that such items constitute trade secrets and/or confidential commercial or financial information that is exempt from turnover in response to a FOIA request under 45 C.F.R. § 5.65, or any other applicable exemption under FOIA and its implementing regulations. In addition, OCR shall provide the CVS Entities with prompt notice of any FOIA request which OCR receives pertaining to this compliance review, the Agreement, or the CAP. 18. Headings. The headings used in this Agreement are for the convenience of the Parties only and have no legal force or effect. 19. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. 20. Authorizations. The individual signing this Agreement and CAP on behalf of all of the CVS Entities which are Parties to this Agreement and the CAP represents and warrants that: (a) s/he is the Compliance Representative provided for under section 6 of this Agreement; (b) s/he is duly authorized by each CVS Entity to execute this Agreement and the CAP; and (c) the CVS Entities have agreed to be bound by the terms of this Agreement and the CAP. The individual signing this Agreement on behalf of HHS represents and warrants that s/he is signing this Agreement in his/her official capacity and that s/he is authorized to execute this Agreement by the Secretary of HHS or his designee. January 15, 2009 For the CVS Entities Date V Diane Nobles Chief Compliance Officer - CVS Compliance Representative For the Department of Health and Human Services Date 1 -1L - O °\ Valerie Morgan-Alstom Regional Manager, Region V Office for Civil Rights January 15,2008 EXHIBIT 1 CVS ENTITIES/RETAIL STORES January 15,2009 EXHIBIT 2 CORRECTIVE ACTION PLAN I. Preamble The Parties to this Corrective Action Plan (CAP) are: (1) the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR); and (2) (i) CVS Pharmacy, Inc., a Rhode Island Corporation, (CVS Pharmacy) on behalf of its affiliated retail pharmacy store entities in the United States that meet the definition of a "covered entity," under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider," as defined in 45 C.F.R. § 160.103; (ii) Revco Discount Drug Centers, Inc., a Michigan corporation; American Drug Stores Delaware, L.L.C., a Delaware limited liability company; Montana CVS Pharmacy, L.L.C., a Montana limited liability company; CVS RS Arizona, L.L.C., an Arizona limited liability company; and CVS NV Holding Company, L.L.C., a Nevada limited liability company, on behalf of each of their affiliated retail pharmacy store entities in the United States that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider." as defined in 45 C.F.R. § 160.103); and (iii) to the extent not already included in (i) or (ii), all entities owned or controlled by CVS Pharmacy or of which CVS Pharmacy is a member and/or operating agent, and/or any other entity listed or referred to in (2)(i) or (ii) of this paragraph, including, but not limited to, the entities listed in Exhibit 1 (which is current as of January 9, 2009), that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, as a retail pharmacy "health care provider," as defined in 45 C.F.R. § 160.103 (collectively "CVS Entities," and individually "CVS Entity"). The descriptions of the CVS Entities are only for purposes of this CAP and the associated Agreement and have no impact regarding whether any CVS Entity and/or any CVS Entities are an "affiliated covered entity" as defined in 45 C.F.R. § 160.105(b). The term "CVS Entity(ies)" shall also refer to any retail pharmacy legal entity that any CVS Entity may originate, acquire, or over which it may obtain control or of which it may become a member and/or operating agent after the Effective Date of this CAP and the Resolution Agreement of this same date (Agreement) for so long as this CAP is in effect, provided that the entity meets the definition of a "covered entity" in 45 C.F.R. § 160.103 and, further provided, that any such entities originated, acquired or over which a CVS Entity shall have obtained control on or after October 1, 2008, will not be subject to the terms of the CAP until the six- month anniversary of the date of such entity's origination or acquisition by a CVS Entity or the six-month anniversary of such entity coming under the control of a CVS Entity. As set forth in section II. A. of this CAP, each CVS Entity has designated the same individual to act as its "Compliance Representative" for purposes of the CVS Entity's compliance with this CAP and the Agreement. All CVS Entities shall satisfy their obligations under this CAP, either directly or through the actions of the Compliance Representative. If an action or omission by the Compliance Representative constitutes a material breach of this CAP (or of the Agreement) and is not cured as provided in Section VIII.C of this CAP, then such action or omission shall also constitute a material breach of the Agreement and/or the CAP by each of the CVS Entities. The CVS Entities enter into this CAP as consideration for the release from HHS that is set forth in paragraph 9 of the Agreement. January 15,2009 For purposes of this CAP, references to "Compliance Representative" shall mean the Compliance Representative designated by each CVS Entity pursuant to paragraph 6 of the Agreement. The Compliance Representative may enlist the assistance of others, as appropriate, in fulfilling her obligations under this CAP. This CAP (along with the Agreement) is being entered into by the Parties to resolve a collaborative review conducted by OCR and the FTC. At the same time, the CVS Entities and the FTC are entering into an agreed order, resolving by consent the issues raised in the FTC's investigation. The proposed consent agreement is between the FTC's staff and CVS Caremark Corporation. It will be presented to the Commission for its preliminary, and, after a public comment period, final approval. II. Compliance Representative and Submissions A. Compliance Representative as Contact Person The Compliance Representative designated by each CVS Entity pursuant to paragraph 6 of the Agreement shall also serve as the Compliance Representative for purposes of this CAP and perform the duties regarding implementation of the CAP as set out in the CAP and in paragraph 6 of the Agreement. The Compliance Representative, designated immediately below, shall also serve as the contact person on behalf of each CVS Entity regarding the implementation of this CAP and for receipt and submission of notices and reports: Diane Nobles Chief Compliance Officer - CVS Compliance Representative 2211 Sanders Road Northbrook, IL 60062 Tel. # 847-559-4714 Fax# 847-559-4953 e-mail: diane.nobles@caremark.com Any notices and/or reports provided by OCR to the Compliance Representative shall also be provided to counsel for the CVS Entities: Gina M. Cavalier, Esq. Partner Reed Smith LLP 1301 K Street, NW Suite 1100-East Tower Washington, DC 20005 gcavalier@reedsmith.com (202) 414-9288 (202) 414-9299 (fax) January 15, 2009 OCR has identified the following individual as its authorized representative and contact person with whom the CVS Entities, through the Compliance Representative, are to report information regarding their implementation of this CAP: Valerie Morgan-Alston Regional Manager Office for Civil Rights U.S. Department of Health and Human Services 233 N. Michigan Avenue, Suite 240 Chicago, IL 60601 Valerie.Alston@hhs.gov 312-886-2359 (Voice Phone) 312-886-1807 (Fax) OCR agrees to notify the Compliance Representative of any changes in the identity of its contact person or the other information provided above. Any changes in the identity of the contact person on behalf of the CVS Entities shall only be made through the provisions set out in Section 6 of the Agreement for the appointment of a successor Compliance Representative. B. Proof of Submissions Unless otherwise specified, all notices and reports required by this CAP may be made by any means, including certified mail, overnight mail, or hand delivery, provided that there is proof that such notification was received. For purposes of this requirement, internal facsimile confirmation sheets do not constitute proof of receipt. III. Term of CAP The period of compliance (Compliance Period) obligations assumed by the CVS Entities under this CAP shall begin on the Effective Date of this CAP and shall end three (3) years from the date of the Assessor's approved appointment, as provided for in section V.E.2 below. After the expiration of the Compliance Period, the Compliance Representative shall still be obligated to do the following: (a) submit the Periodic Report for the final Reporting Period, as set forth in section VLB below; (b) submit the response to the final Assessor Report, as set forth in section V.E.2.C below; and (c) comply with the document retention requirement set forth in section VII below. The Effective Date for this CAP shall be calculated in accordance with paragraph 15 of the Agreement. IV. Time In computing any period of time prescribed or allowed by this CAP, the day of the act, event, or default from which the designated period of time begins to run shall not be included. The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a legal holiday, in which event the period runs until the end of the next business day. 10 January 15, 2009 V. Corrective Action Obligations The CVS Entities agree to the following: A. Policies and Procedures 1. The CVS Entities, directly or through the Compliance Representative, shall develop, maintain, and revise, as necessary, uniform, written policies and procedures ("Privacy Policies and Procedures") that: (a) address the Covered Conduct specified in paragraph 2 of the Agreement; and (b) are consistent with the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the "Privacy Rule"). The CVS Entities' Privacy Policies and Procedures shall include, but not necessarily be limited to, the minimum content set forth in section V.C below. 2. The Compliance Representative shall submit the CVS Entities' uniform Privacy Policies and Procedures, consistent with subparagraph 1 above, to OCR within ninety (90) days of the commencement of the Compliance Period for review and approval. OCR may provide any comments or recommended changes to the Compliance Representative. Upon receiving any recommended changes to such Privacy Policies and Procedures from OCR, the CVS Entities, directly or through the Compliance Representative, shall have sixty (60) days in which to revise their Privacy Policies and Procedures accordingly and then have the Compliance Representative submit the revised Privacy Policies and Procedures to OCR for review and approval, which shall not be unreasonably withheld. 3. The CVS Entities shall fully implement their Privacy Policies and Procedures within sixty (60) days of their receipt of OCR's approval. B. Distribution and Updating of Privacy Policies and Procedures 1. The CVS Entities shall either directly, or through the Compliance Representative, distribute the approved Privacy Policies and Procedures identified in section V.A. of this CAP and any subsequent revisions thereto, to members of their workforces who have access to PHI, including the disposal of PHI, within thirty (30) days of OCR's issuance of its written approval of the Privacy Policies and Procedures or of any revisions thereto. The CVS Entities shall also distribute such documents, either directly or through the Compliance Representative, to new members of the workforce who have access to PHI, including the disposal of PHI, of each CVS Entity within ten (10) business days of the commencement of each such workforce member's engagement by a CVS Entity. 2. Following the distribution of such Privacy Policies and Procedures or revisions thereto, the CVS Entities shall require each member of their workforce who receives the Policies and Procedures to submit a written or electronic compliance certification stating that the particular workforce member has received, read, understood, and agreed to abide by the Privacy Policies and Procedures. Such written or electronic certification must be received by the appropriate CVS Entity within ten (10) business days of any workforce member's receipt of the Privacy Policies and Procedures and if such certification is not received that workforce member shall not be permitted to perform any services for any CVS Entity that involve PHI until and unless such certification is received. 11 January 15,2009 3. So long as this CAP is in effect, the CVS Entities, directly or through the Compliance Representative, shall assess the Privacy Policies and Procedures required by this CAP, at least annually (and more frequently, if appropriate), and shall update and revise such Privacy Policy and Procedures as necessary. C. Minimum Content of the Privacy Policies and Procedures The Privacy Policies and Procedures to be adopted by the CVS Entities shall, at minimum, provide for: 1. Administrative and physical safeguards for the disposal of all non-electronic PHI that appropriately and reasonably ensure that such PHI may not be used or disclosed in violation of the Privacy Rule. The administrative and physical safeguards for disposal shall be applicable to the final disposal of such PHI. Final disposal requires shredding, destroying or otherwise making such PHI unreadable or indecipherable. 2. Application of appropriate sanctions (which may include re-training or other instructive corrective action) against members of the CVS Entities' workforces, who have access to PHI, including the disposal of PHI, including supervisors and managers, who fail to comply with the safeguards policies and procedures provided for in subparagraph (1) above. 3. Training, as required by the Privacy Rule, for members of the CVS Entities' workforces who have access to PHI, including disposal of PHI, regarding how to implement and comply with the safeguards policies and procedures provided for in subparagraph (1) above. At a minimum, training shall include that which is necessary and appropriate for each member of the workforce of a CVS Entity, who has access to PHI, including the disposal of PHI, to carry out that workforce member's function within the CVS Entity pertaining to the safeguarding and/or disposal of non-electronic PHI. 4. Training, as required by the Privacy Rule, to appropriately and reasonably ensure that all appropriate members of the CVS Entities' workforces who have access to PHI, including disposal of PHI, know how to implement and comply with the sanctions policies and procedures provided for in subparagraph (2) above. At a minimum, training shall be that which is necessary and appropriate for each such member of the workforce who is in a position to implement or enforce the sanctions policy (e.g., any workforce member who has a duty to impose sanctions, or has a duty to report another workforce member whose actions may be cause for the imposition of sanctions). D. Training 1. The CVS Entities shall provide training to workforce members, who have access to PHI, including the disposal of PHI, as required by the Privacy Rule. The actual written and electronic evidence of training shall be made available for inspection by either OCR or the Assessor, the appointment of whom is provided for in Section V.E.2 below, during normal business hours, should either seek to inspect the documentary evidence that training was completed. So long as the CAP is in force, each CVS Entity shall also provide such training to new members of its workforce, who have access to PHI, including the disposal of PHI, within thirty (30) days of the new workforce members beginning their service. Each such CVS Entity 12 January 15,2009 must also maintain written or electronic evidence of such training as described in the two previous sentences. 2. Each individual member of a CVS Entity's workforce who is required to attend training shall certify, in writing or in electronic form, that the individual has received the required training, with such certification being submitted by the workforce member or supervisor to the relevant CVS Entity no later than ten (10) business days after the training has been conducted. The training certification shall specify the date training was completed. All course materials shall be retained by the CVS Entity or the Compliance Representative in compliance with section VII. 3. Each CVS Entity, directly or through the Compliance Representative, shall review the training materials annually and shall update the training materials to reflect any changes in policies or procedures being followed by the CVS Entity, federal law, OCR guidance, and/or any material compliance issue(s) discovered during audits or reviews. 4. Each CVS Entity shall prohibit any member of its workforce from using, disclosing, or disposing of PHI, if that workforce member has not completed the requisite training required by subparagraph (1) above. E. Monitoring 1. Internal Monitoring. The CVS Entities, through the Compliance Representative, shall submit to OCR within ninety (90) days of the Effective Date of this CAP, a written description of their plan to monitor internally their compliance with the Privacy Policies and Procedures required by this CAP (Internal Monitoring Plan). OCR may submit comments and recommendations, if any, for modifications to the Compliance Representative within 30 days of OCR's receipt of the Internal Monitoring Plan. In the event that OCR does submit comments and recommendations, the CVS Entities, either directly or through the Compliance Representative, shall make the changes reasonably requested by OCR and, having done so, place the Internal Monitoring Plan into effect. While this CAP is in effect, the CVS Entities may wish, or be required by changes in the law, technology, or otherwise, to update, revise or prepare a new Internal Monitoring Plan. The CVS Entities, directly or through the Compliance Representative, shall be permitted to do so; provided, that the CVS Entities, through the Compliance Representative, first submit any updated, revised, or new Internal Monitoring Plan to the Assessor, the appointment of whom is provided for in section V.E.2 below, and obtain the Assessor's approval before the CVS Entities implement the revised version of the Internal Monitoring Plan; and, further provided, that the CVS Entities, through the Compliance Representative, also submit any updated, revised, or new Internal Monitoring Plan to OCR for its 30-day review and comment, and obtain OCR's approval, before the CVS Entities implement the revised Internal Monitoring Plan. Whenever the existing Internal Monitoring Plan is updated or revised and the updated or revised version has been approved by both the Assessor and OCR and has then gone into effect, the updated or revised Internal Monitoring Plan shall be deemed to have superseded the prior Internal Monitoring Plan. 13 January 15,2009 2. Assessments. (a) Selection and Engagement. The CVS Entities shall engage a qualified, objective, independent third-party assessor (the Assessor) which may be the same entity or individual whom the CVS Entities, which are parties to the FTC Order, engage as an assessor pursuant to Section III of the FTC Order. The Compliance Representative shall inform OCR in writing, within thirty (30) days of the Effective Date, of the name of an individual or entity that the CVS Entities designate to serve as the Assessor. The Assessor may not currently be employed by or affiliated with CVS Pharmacy or any other CVS Entity and shall not have been employed by or affiliated with any CVS Entity for at least five years prior to the Effective Date. The Compliance Representative shall also simultaneously submit to OCR the proposed Assessor's curriculum vitae or a statement of its expertise in the area of monitoring compliance with federal and/or state statutes and regulations, including privacy statutes and regulations. Any individual or entity designated by the Compliance Representative to serve as the Assessor must certify in writing at the time of his, her or its designation, and must provide reasonable written documentation to the effect that he, she or it has the requisite expertise and experience regarding the implementation of the Privacy Rule and has the necessary resources and is otherwise able to perform the assessments and reviews described herein in a professionally independent fashion, taking into account any other business relationships or other engagements that the individual or entity may have. OCR shall be permitted to interview an individual who is designated by the CVS Entities to serve as the Assessor or representatives of an entity which is designated. OCR shall either approve or disapprove of the designation in writing and OCR's approval shall not be unreasonably withheld. If OCR does not approve the designation, OCR shall explain the basis of its disapproval in writing, and the process described above shall be repeated by the CVS Entities, through the Compliance Representative, until OCR has approved a designated Assessor. Upon receiving OCR's approval, the CVS Entities, directly or through the Compliance Representative, shall enter into a written contract with the Assessor for the performance of the assessments and reviews described herein. (b) Assessor's Duties. The Assessor's duties shall be to conduct assessments of compliance by the CVS Entities with the Corrective Action Obligations set forth in Sections V.A through V.E. 1 above and prepare the Assessment Reports described below. Within ninety (90) days of being approved for service by OCR, the Assessor shall submit to OCR and the Compliance Representative a written plan, describing with adequate detail, the Assessor's plan for fulfilling the duties set forth in this subsection (Assessor's Plan). Within thirty (30) days of its receipt of the Assessor's Plan, OCR may submit comments and recommended changes to the Assessor's Plan. The Assessor, in his, her, or its discretion, shall make such changes to the Plan as OCR may reasonably have requested. The Assessor shall review the Plan at least annually and shall provide OCR and the Compliance Representative with a copy of any revisions to the Plan within ten (10) business days of the Assessor's making such revisions. OCR shall have a reasonable opportunity to comment and make recommendations regarding any revisions or modifications at any time while the CAP is in effect. The Assessor, in his, her, or its discretion, shall make such changes to the revisions as OCR may reasonably request. 14 January 15,2009 (c) Assessor Reports. The Assessor shall prepare written reports (the Assessor Reports) based on the work that the Assessor performs as described in subparagraph (b) above. The Assessor shall provide such written reports to OCR and the Compliance Representative. The first such report shall be due sixty (60) days after the one-year anniversary of OCR's issuance of its approval of the appointment of the Assessor, as provided in subsection (a) above. The Assessor shall also submit reports within sixty (60) days of the second and third anniversaries of the date of the Assessor's appointment. The Assessor Reports to be submitted after the one-year and three-year anniversaries of the Assessor's appointment may be the same written report that the Assessor submits to the FTC pursuant to Section III of the FTC Order, provided that such Reports include an adequate description of the Assessor's work under the CAP during the previous year. Within sixty (60) days of her receipt of each Assessor Report, the Compliance Representative shall submit to OCR and the Assessor a written response to the report. OCR may, but is not required to, comment on any of the reports submitted by the Assessor and/or any response from the Compliance Representative. The Assessor shall immediately report to the Compliance Representative, the affected CVS Entity(ies), and to OCR on any significant violation of the CAP and/or of the Privacy Policies and Procedures which the Assessor identifies during the course of the performance of his, her or its duties. The Compliance Representative and the affected CVS Entity shall prepare a written response, including, when appropriate, a plan(s) of correction, and provide such response to OCR and the Assessor, within ten (10) business days of the issuance of the Assessor's report of the significant violation. (d) Retention of Records. The Assessor, the Compliance Representative, and each of the CVS Entities shall retain and make available to OCR, upon OCR's request, all work papers, supporting documentation, correspondence, and draft reports (including those exchanged between the Assessor and the Compliance Representative or any CVS Entity) related to the Assessor's reviews. 3. Assessor Removal/Termination. The CVS Entities may not terminate the Assessor except for cause and may only do so with OCR's consent, which shall not be unreasonably withheld. In the event that the CVS Entities seek to terminate the Assessor, the Compliance Representative shall provide a written statement to OCR setting out in detail the basis for the request and OCR shall take those steps it deems appropriate in reviewing and deciding whether adequate cause actually exists for the termination of the Assessor. If OCR agrees that the current Assessor should be terminated, OCR will so inform the Compliance Representative in writing and the CVS Entities will be authorized to terminate the services of the current Assessor. If such termination does occur, the CVS Entities must engage a replacement Assessor in accordance with section V.E.2 of this CAP within ninety (90) days of the termination of the previous Assessor. If OCR concludes that cause does not exist for the removal of the original Assessor, it shall so inform the Compliance Representative in writing and the original Assessor shall remain in place and be authorized to function in all respects as if the CVS Entities had never sought to remove the Assessor. 15 January 15,2009 In the event that OCR determines that the Assessor does not possess the expertise, independence, competence, or objectivity required by this CAP, or has failed to carry out the duties and responsibilities set forth in this CAP for the Assessor, OCR may, at its sole discretion, require the CVS Entities to terminate the original Assessor and to engage a replacement Assessor. Prior to requiring such action, OCR shall provide a written explanation to the Compliance Representative explaining the rationale for OCR's decision. In such event, the CVS Entities must engage a replacement Assessor in accordance with section V.E.2 of this CAP within ninety (90) days of the termination of the previous Assessor. In the event that the Assessor resigns while the CAP is in effect, the CVS Entities, through the Compliance Representative, shall nominate a replacement Assessor, using the same process as described herein for appointing a replacement Assessor who is removed for cause at the instigation of either the CVS Entities or OCR. 4. Validation Review. In the event OCR, in its discretion, determines or has reason to believe that: (a) one or more Assessor Reports fail to conform to the requirements of this CAP; or (b) one or more Assessor Reports are factually inaccurate or otherwise improper or incomplete, OCR may, in its sole discretion, conduct its own review to determine whether the Assessor Report(s) in question complied with the requirements of this CAP and/or are factually inaccurate, incorrect or otherwise improper ("Validation Review"). 5. OCR's Authority Is Not Superseded. The use of internal monitoring by the CVS Entities and the CVS Entities' contracting for the services of the Assessor does not affect or limit, in any way, OCR's authority to investigate complaints against any CVS Entity or conduct additional compliance reviews of any CVS Entity under any applicable statute or regulation that OCR administers. F. Internal Reporting 1. Procedure for Internal Reporting. The CVS Entities shall require all members of their workforces who have access to PHI, including disposal of PHI, to report to the Compliance Representative at the earliest possible time any violation of the Privacy Policies and Procedures of which they become aware. The procedure for such reporting shall be set out in the Internal Reporting Procedure which the Compliance Representative shall submit to OCR for its comment and approval within ninety (90) days of the Effective Date of this CAP. The review and approval process of the Internal Reporting Procedure shall be identical to that of the Internal Monitoring Plan, as set out in section V.E.I. While the CAP is in effect, the CVS Entities, directly or through the Compliance Representative, may determine from time to time to revise or amend the Internal Reporting Procedure; provided that such revisions or amendments may only take effect after the Compliance Representative has presented them to OCR for a 30-day review and made any changes that OCR may request. Pursuant to the Internal Reporting Procedure, whenever a CVS Entity or the Compliance Representative learns that a member of the workforce of a CVS Entity who has access to PHI, including the disposal of PHI, may have violated a relevant portion of the Privacy Policies and 16 January 15,2009 Procedures, the Compliance Representative, with the full cooperation of the CVS Entity, shall promptly investigate the allegations raised and shall document each such investigation in writing. Written documents should include, but not necessarily be limited to, notes of all interviews of the affected CVS Entity's employees and any other pertinent members of the CVS Entity's workforce and maintenance of any relevant documents, including e-mails. An investigation shall be triggered whenever any CVS Entity or the Compliance Representative receives a complaint of a specific violation of a relevant portion of the Privacy Policies and Procedures. An investigation by the Compliance Representative shall also be triggered whenever there are news reports of alleged specific violations of the relevant portions of the Privacy Polices and Procedures or complaints of an alleged specific violation of these provisions raised by any government agency; complaints raised by a consumer organization, such as the Better Business Bureau, regarding the disposal of PHI; or findings from the CVS Entities' internal monitoring process that indicate a violation of the relevant provisions of the Privacy Policies and Procedures may have occurred. If a CVS Entity determines that a member of its workforce who has access to PHI, including the disposal of PHI, has failed to comply with the relevant portion(s) of the Privacy Policies and Procedures or if the Compliance Representative determines that one or more of the members of the workforce of a particular CVS Entity has violated the relevant provisions of the Privacy Policies and Procedures, the Compliance Representative shall notify both the Assessor and OCR in writing of the finding within thirty (30) business days. Such violation findings shall be known as "Reportable Events." The written report to OCR and the Assessor shall include the following information: a. A complete description of the Reportable Event, including the relevant facts, the persons involved, the date, time and place on which the events occurred, and the provision(s) of the implicated requirement; and b. A description of the actions taken by the affected CVS Entity and/or the Compliance Representative to mitigate any harm and any further steps that they plan to take to address the problems that gave rise to the violation(s) and prevent them from recurring. VI. Implementation Report and Periodic Reports A. Implementation Report. Within 150 days after the receipt of OCR's approval of the Privacy Policies and Procedures and the other documents for which approval is required under this CAP, the Compliance Representative shall submit a written report to OCR and the Assessor summarizing the status of the implementation of the CAP by the CVS Entities. This report, known as the "Implementation Report," shall include: 1. An attestation signed by the Compliance Representative attesting that to the best of his or her knowledge: (a) the portions of the Privacy Policies and Procedures that are required by this CAP are being implemented by each CVS Entity; (b) the Privacy Policies and Procedures have been distributed to each member of the workforce of each CVS Entity as required by this CAP; and (c) all of the compliance certifications required by section V.B.2 of this CAP have been obtained by the CVS Entities, directly or through the Compliance Representative; 2. A copy of all training materials used for the training required by this CAP and a written description of the training, including a summary of the topics covered, the length of the 17 January 15,2009 session(s), and a schedule of when the training session(s) were held and/or the days during which on-line training was provided; 3. An attestation signed by the Compliance Representative, attesting that to the best of his or her knowledge members of the workforce of each CVS Entity, who have access to PHI, including the disposal of PHI, have completed the initial training required by this CAP and have executed the training certifications required by section V.D.2; 4. An attestation signed by the Compliance Representative, listing all locations of the retail pharmacies of any CVS Entity (including mailing addresses), the corresponding CVS Entity for each location, the corresponding telephone numbers and fax numbers for each pharmacy location, and attesting that to the best of his or her knowledge each such location has complied with all of the obligations required of CVS Entities under this CAP, as of the date of the attestation; and 5. An attestation signed by the Compliance Representative, attesting that he or she has reviewed the Implementation Report, has made all reasonable inquiries regarding the thoroughness and accuracy of its contents, and based on such inquiries, believes, to the best of his or her knowledge, that all of the information contained in the Implementation Report is accurate and truthful. B. Periodic Reports. The one-year period beginning on the commencement of the Compliance Period to the first anniversary of the commencement of the Compliance Period and the subsequent one-year periods during which this CAP is in effect shall be referred to as "the Reporting Periods." The CVS Entities, through the Compliance Representative, shall submit to OCR a Periodic Report for each Reporting Period no later than ninety (90) days after the end of each corresponding Reporting Period, including the final Reporting Period which concludes with the expiration date of the CAP. The Periodic Report shall include: 1. A schedule, topic outline, and copies of the training materials for the training programs regarding the relevant portions of the Privacy Policies and Procedures that were conducted during the Reporting Period that is the subject of the report; 2. An attestation signed by the Compliance Representative, attesting that to the best of his or her knowledge each CVS Entity has obtained and is maintaining written or electronic certifications from all persons that required training pursuant to this CAP during the Reporting Period that they did, in fact, receive the requisite training pursuant to the requirements set forth in this CAP; 3. A summary/description of all engagements between CVS Pharmacy and/or any other CVS Entity, on the one hand, and the Assessor, on the other hand, including, but not limited, to, any outside financial audits, compliance program engagements, or reimbursement consulting, if different from what the Compliance Representative submitted to OCR as part of the Implementation Report; 4. A summary of Reportable Events (as defined in section V.F.I of this CAP) identified during the Reporting Period, a thorough description of the facts regarding any such 18 January 15, 2009 Reportable Event, if the Compliance Representative has not previously reported the event, and the status of any corrective and preventative action relating to each such Reportable Event; and 5. An attestation signed by the Compliance Representative, attesting that he or she has reviewed the Periodic Report, has made all reasonable inquiries regarding the thoroughness and accuracy of its contents and, based upon such review and inquiry, believes, to the best of his or her knowledge, that all of the information contained in the Periodic Report is accurate and truthful. VII. Document Retention Each CVS Entity and the Compliance Representative shall maintain for inspection and copying all documents and records relating to compliance with this CAP for six (6) years following the creation of the particular document. The term "document" shall be broadly construed to include, but not be limited to, letters, memoranda, brochures, bulletins, e-mails, CD- ROMs, tapes, evidence of possible or alleged improper disclosure, affidavits, court pleadings, and the like. VIII. Requests for Extensions and Breach Provisions Each CVS Entity is required to comply with all of their respective CAP obligations. A. Timely Written Requests for Extensions The CVS Entities, through the Compliance Representative, in advance of any due date set forth in this CAP, may submit a timely written request for an extension of time to perform any act or file any notification or report required by this CAP. A "timely written request" is defined as a request in writing received by OCR at least ten (10) business days prior to the date by which any act is due to be performed or any notification or report is due to be filed and must contain a description of the facts giving rise to the request. OCR will consider such a request and make a reasonable determination as to whether to grant it, generally providing no more than one 30-day extension of time for a particular deadline without a showing of exigent circumstances. B. Notice of Material Breach and Intent to Impose CMP An uncured material breach of this CAP by any CVS Entity, directly or through the acts or omissions of the Compliance Representative, constitutes a breach of the Agreement. Upon a finding by OCR that any CVS Entity has materially breached this CAP, OCR will, pursuant to 45 C.F.R. Part 160, notify the Compliance Representative and the Assessor of the existence of the material breach ("Notice of Material Breach") and will indicate which CVS Entity(ies) allegedly committed a material breach. C. Response The CVS Entity(ies) shall have 35 days from the date of receipt of OCR's Notice of Material Breach, directly and through the Compliance Representative, to demonstrate to OCR's satisfaction, that: 19 January 15, 2009 1. The CVS Entity(ies) identified in the Notice are in compliance with the obligations of the CAP cited by OCR as being the basis for OCR's declaration of a material breach; 2. The alleged material breach has been cured; or 3. The alleged material breach cannot be cured within the 35-day period, but: (i) the CVS Entity(ies), directly and/or through the Compliance Representative, has/have begun to take the action(s) necessary to cure the breach; (ii) the CVS Entity(ies), with the Compliance Representative's assistance, as appropriate, is/are pursuing an appropriate cure with due diligence; and (iii) the CVS Entity(ies) has/have provided OCR with a written explanation as to why the CVS Entity(ies) cannot cure the breach within 35 days and has/have provided OCR with a reasonable timetable during which the CVS Entity(ies) will be able to cure the breach. D. Imposition of CMP If at the conclusion of the 35-day cure period or other time frame described in section VIII.C.3 above, the CVS Entity(ies), with the assistance of the Compliance Representative, fail to meet the requirements of section VIII.C as determined by OCR, OCR may proceed with the imposition of a CMP against the CVS Entities pursuant to 45 C.F.R. Part 160, for the Covered Conduct set forth in paragraph 2 of the Agreement and any other conduct that constitutes a violation of the Privacy Rule, including, but not necessarily limited to, the conduct giving rise to the material breach. OCR will notify the Compliance Representative and CVS Entity(ies) involved in the breach of: OCR's intent to impose a CMP for: (a) the Covered Conduct set forth in paragraph 2 of the Agreement; and (b) the post-Effective Date conduct constituting the material breach, if the conduct constitutes a violation of the Privacy Rule. OCR and the CVS Entities will retain all of the rights and obligations specified under 45 C.F.R. Part 160, Subparts C through E, with respect to the imposition of a CMP under this paragraph. For the CVS Entities Date Diane Nobles Chief Compliance Officer - CVS Compliance Representative For the Department of Health and Human Services Va\. JH0^ -*4W DateH(,-Q<\ Valerie Morgan-Alston Regional Manager, Region V Office for Civil Rights 20