HomeMy WebLinkAboutAmendment I to 19-287 MetaSource LLC 21-471 (2).pdf- 1 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
FIRST AMENDMENT TO AGREEMENT
THIS FIRST AMENDMENT TO AGREEMENT (“First Amendment”) is made and entered into
this day of , 2021, by and between COUNTY OF FRESNO, a political
subdivision of the State of California (“COUNTY”), and MetaSource, LLC., a Delaware limited liability
company, whose address is 1235 North Grove Street, Anaheim, CA 92806 (“CONTRACTOR”).
WITNESSETH:
WHEREAS, COUNTY and CONTRACTOR entered into Agreement No. A-19-287
(“Agreement”) effective June 4, 2019, pursuant to which CONTRACTOR agreed to provide scanning
and digitizing services to digitize COUNTY's inventory of physical records; and
WHEREAS, COUNTY and CONTRACTOR now desire to amend the Agreement to increase
the total compensation amount in order to purchase additional document digitization products and
services to meet the needs of additional County departments, and add language regarding the Health
Insurance Accountability and Portability Act.
NOW, THEREFORE, for good and valuable consideration, the receipt and adequacy of which
is hereby acknowledged, COUNTY and CONTRACTOR agree as follows:
1. Section 1 – “OBLIGATIONS OF THE CONTRACTOR” of the Agreement, shall be
amended to add the following Subsection E – “Data Security”:
“E. Data Security – CONTRACTOR shall comply with all obligations in the attached Exhibit
C – Data Security, which is incorporated by this reference.”
2. Exhibit “B” to this Agreement shall be deleted in its entirety, and replaced with the
attached Exhibit B – “Task Pricing”, which is incorporated by this reference.
3. The Agreement shall be amended to include the attached Exhibit C – “Data Security”.
4. Section 5 – “COMPENSATION/INVOICING” of the Agreement, is deleted in its entirety,
and replaced with the following:
"COUNTY agrees to pay CONTRACTOR and CONTRACTOR agrees to receive compensation
Agreement No. 21-471
16th November
- 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
as described in Exhibit B for services engaged from time-to-time under the Agreement.
CONTRACTOR shall submit monthly invoices in triplicate to the County of Fresno Department of
Internal Services Business Office, 333 W. Pontiac Way, Clovis, CA 93612.
In no event shall compensation paid for services performed under this Agreement for all
services engaged exceed $3,000,000 during the potential extended term of this Agreement. It is
understood that all expenses incidental to CONTRACTOR'S performance of services under this
Agreement shall be borne by CONTRACTOR.”
5. Section 10 – “INSURANCE”, Subsection C – “Professional Liability” of the Agreement,
is deleted in its entirety, and replaced with the following:
“C Professional Liability – If CONTRACTOR employs licensed professional staff, (e.g.,
Ph.D., R.N., L.C.S.W., M.F.C.C.) in providing services, Professional Liability Insurance with limits of
not less than One Million Dollars ($1,000,000.00) per occurrence, Three Million Dollars
($3,000,000.00) annual aggregate. CONTRACTOR agrees that it shall maintain, at its sole expense, in
full force and effect for a period of three (3) years following the termination of this Agreement, one or
more policies of professional liability insurance with limits of coverage as specified herein.”
6. Section 10 – “INSURANCE” of the Agreement, shall be amended to add the following
Subsection E – “Cyber Liability”:
“E. Cyber Liability – Cyber Liability Insurance, with limits not less than $2,000,000 per
occurrence or claim, $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the
duties and obligations as is undertaken by CONTRACTOR in this Agreement and shall include, but not
be limited to, claims involving infringement of intellectual property, including but not limited to
infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft,
damage to or destruction of electronic information, release of private information, alteration of
electronic information, extortion and network security. The policy shall provide coverage for breach
response costs as well as regulatory fines and penalties as well as credit monitoring expenses with
limits sufficient to respond to these obligations.”
- 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
7. Section 10 – “INSURANCE” of the Agreement, shall be amended to add the following
Subsection F – “Technology Professional Liability”:
“F. Technology Professional Liability – Technology professional liability (errors and
omissions), including cyber liability Insurance, with limits not less than $2,000,000 per occurrence or
claim, $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and
obligations as is undertaken by CONTRACTOR in this Agreement and shall include, but not be limited
to, claims involving infringement of intellectual property, including but not limited to infringement of
copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or
destruction of electronic information, release of private information, alteration of electronic information,
extortion and network security. The policy shall provide coverage for breach response costs as well as
regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to
these obligations.
Definition of Cyber Risks: “Cyber Risks” include but are not limited to (i) Security Breaches,
which may include Disclosure of Personal Information to an Unauthorized Third Party; (ii) breach of
any of the Contractor’s obligations under Section 1 of this Agreement; (iii) infringement of intellectual
property, including but not limited to infringement of copyright, trademark, and trade dress; (iv)
invasion of privacy, including release of private information; (v) information theft; (vi) damage to or
destruction or alteration of electronic information; (vii) extortion related to the Contractor’s obligations
under this Agreement regarding electronic information, including Personal Information; (viii) network
security; (ix) data breach response costs, including Security Breach response costs; (x) regulatory
fines and penalties related to the Contractor’s obligations under this Agreement regarding electronic
information, including Personal Information; and (xi) credit monitoring expenses.”
8. Section 12 – “NOTICES” of the Agreement, starting on page 10, line 19, and ending on
page 10, line 21, with the number "92807”, shall be amended to state the following:
COUNTY CONTRACTOR
COUNTY OF FRESNO MetaSource LLC
- 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Director of Internal Services/CIO Hal Radjai
333 W. Pontiac Way 1235 North Grove Street
Clovis, CA 93612 Anaheim, CA 92806
9. Section 16 – “CONFIDENTIALITY” shall be added to the Agreement as follows:
“16. CONFIDENTIALITY
All services performed by CONTRACTOR under this Agreement shall be in strict conformity
with all applicable Federal, State of California, and/or local laws and regulations relating to
confidentiality.”
10. Section 17 – “HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT”
shall be added to the Agreement as follows:
“17. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
A. The parties to this Agreement shall be in strict conformance with all applicable
Federal and State of California laws and regulations, including, but not limited to, Sections 5328,
10850, and 14100.2 et seq. of the Welfare and Institutions Code, Sections 2.1 and 431.300 et seq. of
Title 42, Code of Federal Regulations (CFR), Section 56 et seq. of the Civil Code, and the Health
Insurance Portability and Accountability Act (HIPAA), including, but not limited to, Section 1320(D) et
seq. of Title 42, United States Code (USC) and its implementing regulations, including, but not limited
to Title 45, CFR, Sections 142, 160, 162, and 164, The Health Information Technology for Economic
and Clinical Health Act (HITECH), regarding the confidentiality and security of patient information, and
the Genetic Information Nondiscrimination Act (GINA) of 2008 regarding the confidentiality of genetic
information, in each case to the extent applicable to the respective party in relation to this Agreement.
Terms used in this Section 17 not otherwise defined in this Agreement shall have the same meaning
as those terms under 45 CFR 160 and 164.
Except as otherwise provided in this Agreement, CONTRACTOR, as a Business
Associate of COUNTY, may use or disclose Protected Health Information (PHI) as permitted or
required to perform functions, activities or services for or on behalf of COUNTY, as specified in this
Agreement, including in the Services Agreement, and any Service Orders between the parties. The
- 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
uses and disclosures of PHI may not be more expansive than those applicable to COUNTY, as the
“Covered Entity” under the HIPAA Privacy Rule (45 CFR 164.500 et seq), except for proper
management and administration or to carry out legal responsibilities of the Business Associate and to
provide data aggregation services relating to the healthcare operations of the COUNTY.
B. CONTRACTOR, including its subcontractors and employees, shall use
appropriate safeguards, and comply with Subpart C of 45 CFR 164, to protect electronic PHI from
unauthorized access, use, or disclosure. This pertains to the electronic PHI of any and all persons
receiving services pursuant to a COUNTY funded program. This requirement applies to electronic PHI.
CONTRACTOR shall not use such identifying information or genetic information for any purpose other
than carrying out CONTRACTOR’s obligations, or as otherwise permitted, under this Agreement,
including the Services Agreement and any Service Orders.
C. CONTRACTOR, including its subcontractors and employees, shall not disclose
any PHI to any person or entity, except as otherwise specifically permitted by this Agreement,
including the Services Agreement, or any Service Orders, authorized by Subpart E of 45 CFR Part 164
or other law, required by the Secretary, or authorized by the client/patient in writing. In using or
disclosing PHI that is permitted by this Agreement or authorized by law, CONTRACTOR shall make
reasonable efforts to limit PHI to the minimum necessary to accomplish intended purpose of use,
disclosure, or request.
D. For purposes of the above sections, individually identifying health information
shall have the meaning set forth in 45 CFR Part 160.
E. For purposes of the above sections, genetic information shall have the meaning
set forth in GINA, and includes genetic tests of family members of an individual or individual,
manifestation of disease or disorder of family members of an individual, or any request for or receipt
of, genetic services by individual or family members. Family member means a dependent or any
person who is first, second, third, or fourth degree relative.
F. CONTRACTOR shall provide access, at the request of COUNTY, and without
undue delay, to PHI in a designated record set (as defined in 45 CFR Section 164.501), to an
individual or to COUNTY in order to meet the requirements of 45 CFR Section164.524 regarding
- 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
access by individuals to their PHI. With respect to individual requests received directly by
CONTRACTOR, CONTRACTOR will promptly forward the request to the COUNTY so that the
COUNTY may satisfy its obligations under 45 CFR 164.524.
CONTRACTOR shall make any amendment(s) to PHI in a designated record set
at the request of COUNTY, and without undue delay, in accordance with 45 CFR Section 164.526. If
CONTRACTOR receives a request for amendment directly from an individual, CONTRACTOR will
promptly forward the request to the COUNTY so that the COUNTY may satisfy its obligations under 45
CFR 164.526.
CONTRACTOR shall provide to COUNTY or to an individual, in a time and
manner designated by COUNTY, information collected in accordance with 45 CFR Section 164.528, to
permit COUNTY to respond to a request by the individual for an accounting of disclosures of PHI in
accordance with 45 CFR Section 164.
G. CONTRACTOR shall report to COUNTY, in writing, any knowledge or
reasonable belief that there has been unauthorized access, viewing, use, disclosure, security incident,
or Breach of unsecured PHI not permitted by this Agreement of which it becomes aware, without
undue delay and in no case later than five (5) business days of discovery. Such notification shall be
made to COUNTY’s Information Security Officer (whose contact information is set forth below). The
notification shall include, to the extent possible, a description of the breach.
To the extent caused by CONTRACTOR, CONTRACTOR shall take prompt
corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure
required by applicable Federal and State Laws and regulations. CONTRACTOR shall investigate such
breach and assist COUNTY with providing all notifications required by law and regulation, and shall
provide a written report of the investigation and reporting required to COUNTY’s Information Security
Officer. This written investigation and description of any reporting necessary shall be postmarked
within the thirty (30) working days of the discovery of the breach to the addresses below:
County of Fresno
Internal Services Department
- 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Information Security Officer
(559) 600-5800
333 W. Pontiac Way
Clovis, CA 93612
H. CONTRACTOR shall maintain its internal practices, books, and records relating
to the use and disclosure of PHI received from COUNTY, or created or received by the
CONTRACTOR on behalf of COUNTY, in compliance with HIPAA’s Privacy Rule, including, but not
limited to the requirements set forth in Title 45, CFR, Sections 160 and 164. CONTRACTOR shall
make its internal practices, books, and records relating to the use and disclosure of PHI received from
COUNTY, or created or received by the CONTRACTOR on behalf of COUNTY, available to the United
States Department of Health and Human Services (Secretary) as required under HIPAA for purposes
of determining compliance with HIPAA.
CONTRACTOR shall cooperate with the compliance and investigation reviews
conducted by the Secretary. PHI access to the Secretary must be provided during the
CONTRACTOR’s normal business hours or as may be otherwise required by law. Upon the
Secretary’s compliance or investigation review, if PHI is unavailable to CONTRACTOR and in
possession of a Subcontractor, it must certify efforts to obtain the information to the Secretary.
I. Safeguards
CONTRACTOR shall implement administrative, physical, and technical
safeguards as required by the HIPAA Security Rule, Subpart C of 45 CFR 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI, that it
creates, receives, maintains or transmits on behalf of COUNTY and to prevent unauthorized access,
viewing, use, disclosure, or breach of PHI other than as provided for by this Agreement.
CONTRACTOR shall conduct an accurate and thorough assessment of the potential risks and
vulnerabilities to the confidential, integrity and availability of electronic PHI. CONTRACTOR shall
develop and maintain a written information privacy and security program that includes administrative,
technical and physical safeguards appropriate to the size and complexity of CONTRACTOR’s
- 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
operations and the nature and scope of its activities. Upon COUNTY’s request, CONTRACTOR shall
provide COUNTY with information concerning such safeguards.
CONTRACTOR shall implement strong access controls and other security
safeguards and precautions in order to restrict logical and physical access to confidential, personal
(e.g., PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include
the following administrative and technical password controls for all systems used to process or store
confidential, personal, or sensitive data:
1. Passwords must not be:
a. Shared or written down where they are accessible or
recognizable by anyone else; such as taped to computer screens, stored under keyboards, or visible in
a work area;
b. A dictionary word; or
c. Stored in clear text
2. Passwords must be:
a. Eight (8) characters or more in length;
b. Changed every ninety (90) days;
c. Changed immediately if revealed or compromised; and
d. Composed of characters from at least three of the following four
groups from the standard keyboard:
1. Upper case letters (A-Z);
2. Lowercase letters (a-z);
3. Arabic numerals (0 through 9); and
4. Non-alphanumeric characters (punctuation symbols).
CONTRACTOR shall implement the following security controls on each
workstation or portable computing device (e.g., laptop computer) containing confidential,
personal, or sensitive data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
- 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
3. Patch management process including installation of all operating
system/software vendor security patches.
CONTRACTOR shall utilize a commercial encryption solution that has received
FIPS 140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
electronic media (including, but not limited to, compact disks and thumb drives) and on portable
computing devices (including, but not limited to, laptop and notebook computers).
CONTRACTOR shall not transmit confidential, personal, or sensitive data via e-
mail or other internet transport protocol unless the data is encrypted by a solution that has been
validated by the National Institute of Standards and Technology (NIST) as conforming to the Advanced
Encryption Standard (AES) Algorithm. CONTRACTOR must apply appropriate sanctions against its
employees who fail to comply with these safeguards. CONTRACTOR must adopt procedures for
terminating access to PHI when employment of employee ends.
J. Mitigation of Harmful Effects
CONTRACTOR shall mitigate, to the extent practicable, any harmful effect that
is suspected or known to CONTRACTOR of an unauthorized access, viewing, use, disclosure, or
breach of PHI by CONTRACTOR or its subcontractors in violation of the requirements of these
provisions. CONTRACTOR must document suspected or known harmful effects and the outcome.
K. Contractor’s Subcontractors
CONTRACTOR shall ensure that any of its contractors, including
subcontractors, if applicable, to whom CONTRACTOR provides PHI received from or created or
received by CONTRACTOR on behalf of COUNTY, agree to the same restrictions, safeguards, and
conditions that apply to CONTRACTOR with respect to such PHI and to incorporate, when applicable,
the relevant provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
L. Employee Training and Discipline
CONTRACTOR shall train and use reasonable measures to ensure compliance
with the requirements of these provisions by employees who assist in the performance of functions or
activities on behalf of COUNTY under this Agreement, and use or disclose PHI and discipline such
- 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
employees who intentionally violate any provisions of these provisions, including termination of
employment.
M. Termination for Cause
Upon COUNTY’s knowledge of a material breach of these provisions by
CONTRACTOR, COUNTY shall either:
1. Provide written notice to CONTRACTOR and an opportunity for
CONTRACTOR to cure the breach or end the violation within 30 days’ from the date of notice and
terminate this Agreement if CONTRACTOR does not cure the breach or end the violation within such
30 day time period or longer time specified by COUNTY; or
2. Immediately terminate this Agreement upon written notice to
CONTRACTOR if CONTRACTOR has breached a material term of these provisions and cure is not
possible.
3. If neither cure nor termination is feasible, and such breach results in the
unauthorized use, disclosure, alteration or destruction of PHI, the COUNTY Privacy Officer shall report
the violation to the Secretary of the U.S. Department of Health and Human Services.
N. Judicial or Administrative Proceedings
COUNTY may terminate this Agreement in accordance with the terms and
conditions of this Agreement as written hereinabove, if: (1) CONTRACTOR is found guilty in a criminal
proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or (2) a finding or
stipulation that the CONTRACTOR has violated a privacy or security standard or requirement of the
HITECH Act, HIPAA; or other security or privacy laws applicable to CONTRACTOR in an
administrative or civil proceeding in which the CONTRACTOR is a party.
O. Effect of Termination
Upon termination or expiration of this Agreement for any reason,
CONTRACTOR shall promptly return or destroy all PHI received from COUNTY (or created or
received by CONTRACTOR on behalf of COUNTY) that CONTRACTOR still maintains in any form,
and shall retain no copies of such PHI. If return or destruction of PHI is not feasible or is needed for
CONTRACTOR’s business or administrative purposes or for compliance with law, it shall continue to
- 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
extend the protections of these provisions to such information, and limit further use of such PHI to
those purposes that make the return or destruction of such PHI infeasible. This provision shall apply to
PHI that is in the possession of subcontractors or agents, if applicable, of CONTRACTOR. If
CONTRACTOR destroys the PHI data, a certification of date and time of destruction shall be provided
to the COUNTY by CONTRACTOR.
P. Disclaimer
COUNTY makes no warranty or representation that compliance by
CONTRACTOR with these provisions, the HITECH Act, HIPAA, or the HIPAA regulations will be
adequate or satisfactory for CONTRACTOR’s own purposes, or that any information in
CONTRACTOR’s possession or control, or transmitted or received by CONTRACTOR, is or will be
secure from unauthorized access, viewing, use, disclosure, or breach. CONTRACTOR is solely
responsible for all decisions made by CONTRACTOR regarding the safeguarding of PHI.
Q. Amendment
The parties acknowledge that Federal and State laws relating to electronic data
security and privacy are rapidly evolving, and that amendment of these provisions may be required to
provide for procedures to ensure compliance with such developments. The parties specifically agree to
take such action as is necessary to amend this Agreement in order to implement the standards and
requirements of HIPAA, the HIPAA regulations, the HITECH Act, and other applicable laws relating to
the security or privacy of PHI. COUNTY may terminate this Agreement upon thirty (30) days written
notice in the event that CONTRACTOR does not enter into an amendment providing assurances
regarding the safeguarding of PHI that COUNTY, in its sole discretion, deems sufficient to satisfy the
standards and requirements of HIPAA, the HIPAA regulations, and the HITECH Act.
R. No Third-Party Beneficiaries
Nothing express or implied in the terms and conditions of these provisions is
intended to confer, nor shall anything herein confer, upon any person other than COUNTY or
CONTRACTOR and their respective successors or assignees, any rights, remedies, obligations, or
liabilities whatsoever.
S. Interpretation
- 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
The terms and conditions in these provisions shall be interpreted as broadly as
necessary to implement and comply with HIPAA, the HIPAA regulations and applicable State laws.
The parties agree that any ambiguity in the terms and conditions of these provisions shall be resolved
in favor of a meaning that complies and is consistent with HIPAA and the HIPAA regulations.
T. Regulatory References
A reference in the terms and conditions of these provisions to a section in the
HIPAA regulations means the section as in effect or as amended.
U. Survival
The respective rights and obligations of CONTRACTOR as stated in this Section
shall survive the termination or expiration of this Agreement.
V. No Waiver of Obligations
No change, waiver or discharge of any liability or obligation hereunder on any
one or more occasions shall be deemed a waiver of performance of any continuing or other obligation,
or shall prohibit enforcement of any obligation on any other occasion.”
COUNTY and CONTRACTOR agree that this First Amendment is sufficient to amend the
Agreement and, that upon execution of this First Amendment, the Agreement and this First
Amendment together shall be considered the Agreement.
The Agreement, as hereby amended, is ratified and continued. All provisions, terms,
covenants, conditions, and promises contained in the Agreement and not amended herein shall
remain in full force and effect.
II
DocuSign Envelope ID : 31ACC85A-1 F7F-4557-8010-8289DF06EAAB
1
2
EXECUTED AND EFFECTIVE as of the date first above set forth.
3 CONTRACTOR
MetaSource, LLC
4 OocuSlgned by:
5 lt-::'=ie'!'l!7!mlm!ffim-:---:-~---:::---:--:-------
6
7
8
67 West 13490 South, Suite 300
9 Draper , Utah 84020
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
FOR ACCOUNTING USE ONLY:
Fund : Various
Subclass: Various
Org : Various
Account: Various
Steve Brandau, Chairman of the Board of
Supervisors of the County of Fresno
ATTEST:
Bernice E. Seidel
Clerk of the Board of Supervisors
County of Fresno, State of California
-13 -
- 14 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit B
Shown in Landscape Format for Readibility and Attached
Exhibit B – Task Pricing
Standard Processing
Costs Tasks
Task Description Cost Factor Cost Cost
(27% increase
effective 06/04/22)
Cost
(7.1% increase
effective
06/04/23)
Contractor’s Comments
Small format scanning 8.5” x 11” Per Image $0.0279 $0.0354 $0.0379 Services originally engaged under
Agreement No. 19-287 of June 18, 2019.
Small format scanning 11” x 14” Per Image $0.0279 $0.0354 $0.0379 Services originally engaged under
Agreement No. 19-287 of June 18, 2019.
Small format scanning Miscellaneous other items including
fragile, confidential, and/or pocket
folders.
Per Image $0.0279 $0.0354 $0.0379 Services originally engaged under
Agreement No. 19-287 of June 18, 2019.
Content destruction No Charge No Charge No Charge
Document storage in excess of 90
days (not to exceed 180 days)
$0.28 per box
per month
$0.36 per box per
month
$0.38 per box per
month
Records Imaging
Services—Offsite
Cost of offsite standard imaging
services for documents. Digital files
delivered to the Participating Entity
shall be compatible with its CMS,
DMS, or other digital storage
repository, and include an associated
index of metadata for import and
retrieval purposes
Per image $0.025 $0.032 $0.034 This fee will apply to any project beyond the
current SOW. The price includes scanning at
300 dpi, auto-population of multiple fields
with County-provided metadata, single pass
OCR, and 60 days of storage.
Document preparation Prepare documents for scanning and
digitizing by removing staples and
other bindings, and by inspecting and
repairing pages as needed. Insertion
of targets
Per hour $29.50 $37.47 $40.13 This fee will apply to any project beyond the
current SOW. Upon completion of proof of
concept (POC), Contractor will establish a
“not to exceed” rate per
Pickup of Boxes Pallets picked up Per load $500.00 $635.00 $680.09 This fee will apply to any project beyond the
current SOW. Up to 4 pallets = 160 boxes
Indexing Associated index values up to 15
characters
Field $0.15 $0.19 $0.20 This will apply For any project beyond the
current SOW.
Pre-pickup
preparation
Cost to perform pre-production
preparation and packing of
documents for imaging for transfer to
the vendor's work site (includes
indexing the files being packed).
Per hour $37.50 $47.63 $51.01 This fee applies if Contractor is required to
remove boxes from shelves, palletize and
shrink wrap boxes.
Store and maintain
records during
production phase
Cost to store and maintain files in a
climate-controlled, secure storage
space with fire and burglar alarm
protections until the Participating
Entity has reviewed the imaged and
digitized documents for quality
control purposes.
Per box per
month
Included Included Included Up to 60 days post image upload
Box and records
Destruction post Scan
Paper shred and recycled Per box Waived Waived Waived No charge if the County requests the service
Image QC 100% Quality Check for all paper to
image conversion
Per image $0.0387 $0.0491 $0.0526 Paper to Image QC process: beyond Image
QC, this process compares original physical
paper to image.
Large format scanning 300dpi in color Per drawing $1.42 $1.80 $1.93
Large format scanning
– fragile or poor
condition
300dpi in color Per drawing $2.89 $3.67 $3.93 Additional special handling fees may apply
Special handling Cost of imaging fragile documents or
other categories of documents that
require special processing.
Per hour $29.50 $37.47 $40.13 Specific to document processing, these
charges apply to all pre-prep services that
are beyond the scope of standard document
preparation, i.e., removing files from
shelves, file handling, re-placing files onto
shelves, older fragile drawings etc.
Microfilm Cost to Digitize 16MM microfilm. Per image $0.0095 $0.01207 $0.01292
Microfiche Cost to Digitize Microfiche. Per fiche $4.05 $5.14 $5.51
Manifest Fee Cost of Data capture/indexing. Per File $0.55 $0.70 $0.75 Description Manual capture of missing
Manifest data. Additionally, said Manifest
Fee is being added to invoicing pertinent to
original contract 19-287 services to address
County omitted Manifest as agreed under
contract 19-287.
Note: These rates are based on standard projects. After the County submits a supplemental request to perform work beyond initial contract scope, and upon the
completion of requirements gathering by MetaSource, MetaSource shall submit a “Preliminary Budgeting Pricing” relative to such supplemental request to the
County, MetaSource reserves the right to adjust pricing (decrease or increase) per the specific scope, based on mutual written agreement from the County
executed by the parties at the time of engagement to perform the supplemental service. The “Preliminary Budgetary Pricing” is based upon the current
agreement with the County. Pricing will be confirmed following the “Proof of Concept” (POC). Should documents vary from initial the sampling, MetaSource will
advise the County of any variance in preparation time required (additional fees may apply).
Exhibit
-1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
A. Definitions.
Capitalized terms used in this Exhibit have the meanings set forth in this section A.
means employees who have access to
Personal Information.
means: (i) any and all Authorized Employees; and (ii) any
and all of subcontractors, representatives, agents, outsourcers, and
consultants, and providers of professional services to CONTRACTOR, who have access to
Personal Information and are bound by law or in writing by confidentiality obligations
sufficient to protect Personal Information in accordance with the terms of this Exhibit .
means Director of Internal Services-Chief Information Officer
or his or her designee.
or any derivative of that word means to disclose, release, transfer,
disseminate, or otherwise provide access to or communicate all or any part of any Personal
Information orally, in writing, or by electronic or any other means to any person.
means any natural person, corporation, partnership, limited liability
company, firm, or association.
means any and all information, including any data,
provided, or to which access is provided, to CONTRACTOR by or upon the authorization of
COUNTY, under this Agreement, including but not limited to vital records, that: (i) identifies,
describes, or relates to, or is associated with, or is capable of being used to identify,
describe, or relate to, or associate with, a person (including, without limitation, names,
physical descriptions, signatures, addresses, telephone numbers, e-mail addresses,
education, financial matters, employment history, and other unique identifiers, as well as
statements made by or attributable to the person); (ii) is used or is capable of being used to
authenticate a person (including, without limitation, employee identification numbers,
government-issued identification numbers, passwords or personal identification numbers
(PINs), financial account numbers, credit report information, answers to security questions,
and other personal identifiers); or is personal information within the meaning of California
-2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
Civil Code section 1798.3, subdivision (a), or 1798.80, subdivision (e). Personal Information
does not include publicly available information that is lawfully made available to the general
public from federal, state, or local government records.
means a complaint received by COUNTY relating
to
Breach. Such complaint shall have sufficient detail to enable CONTRACTOR to promptly
investigate and take remedial action under this Exhibit .
Security means physical, technical, administrative or organizational
security procedures and practices put in place by CONTRACTOR (or any Authorized
Persons) that relate to the protection of the security, confidentiality, value, or integrity of
Personal Information. Security Safeguards shall satisfy the minimal requirements set forth in
subsection C.(5) of this Exhibit .
means (i) any act or omission that compromises either the
security, confidentiality, value, or integrity of any Personal Information or the Security
Safeguards, or (ii) any unauthorized Use, Disclosure, or modification of, or any loss or
destruction of, or any corruption of or damage to, any Personal Information.
or any derivative thereof means to receive, acquire, collect, apply, manipulate,
employ, process, transmit, disseminate, access, store, disclose, or dispose of Personal
Information.
B. Standard of Care.
(1) CONTRACTOR acknowledges that, in the course of its engagement by COUNTY
under this Agreement, CONTRACTOR, or any Authorized Persons, may Use Personal
Information only as permitted in this Agreement.
(2) CONTRACTOR acknowledges that Personal Information is deemed to be
confidential information of, or owned by, COUNTY (or persons from whom COUNTY
receives or has received Personal Information) and is not confidential information of, or
owned or by, CONTRACTOR, or any Authorized Persons. CONTRACTOR further
acknowledges that all right, title, and interest in or to the Personal Information remains in
-3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
COUNTY (or persons from whom COUNTY receives or has received Personal Information)
regardless of of that Personal
Information.
(3) CONTRACTOR agrees and covenants in favor of COUNTY that CONTRACTOR
shall: (i) keep and maintain all Personal Information in strict confidence, using such degree
of care under this Subsection B as is reasonable and appropriate to avoid a Security
Breach; (ii) Use Personal Information exclusively for the purposes for which the Personal
Information is made accessible to CONTRACTOR pursuant to the terms of this Exhibit ;
(iii) not Use, Disclose, sell, rent, license, or otherwise make available Personal Information
for own purposes or for the benefit of anyone other than COUNTY,
without express prior written consent, which the COUNTY may give or withhold
in its sole and absolute discretion; and (iv) not, directly or indirectly, Disclose Personal
Information to any person other than Authorized Persons
pursuant to this Agreement, without the express prior written
consent.
Notwithstanding the foregoing paragraph, in any case in which CONTRACTOR
believes it, or any Authorized Person, is required to disclose Personal Information to
government regulatory authorities, or pursuant to a legal proceeding, or otherwise as may
be required by applicable law, Contractor shall (a) immediately notify COUNTY of the
specific demand for, and legal authority for the disclosure, including providing County with a
copy of any notice, discovery demand, subpoena, or order, as applicable, received by
CONTRACTOR, or any Authorized Person, from any government regulatory authorities, or
in relation to any legal proceeding, and (b) promptly notify COUNTY before such Personal
Information is offered by CONTRACTOR for such disclosure so that COUNTY may have
sufficient time to obtain a court order or take any other action COUNTY may deem
necessary to protect the Personal Information from such disclosure, and CONTRACTOR
shall cooperate with COUNTY to minimize the scope of such disclosure of such Personal
Information.
-4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
CONTRACTOR shall remain liable to COUNTY for the actions and omissions of any
Unauthorized Third Party concerning its Use of such Personal Information as if they were
own actions and omissions.
C. Information Security.
(1) CONTRACTOR covenants, represents and warrants to COUNTY that
Use of Personal Information under this Agreement does and shall at all times
comply with all applicable federal, state, and local, privacy and data protection laws, as well
as all other applicable regulations and directives, including but not limited to California Civil
Code, Division 3, Part 4, Title 1.81 (beginning with section 1798.80), and the Song-Beverly
Credit Card Act of 1971 (California Civil Code, Division 3, Part 4, Title 1.3, beginning with
section 1747). If CONTRACTOR Uses credit, debit or other payment cardholder information,
CONTRACTOR shall at all times remain in compliance with the Payment Card Industry Data
ning aware at all times of
changes to the PCI DSS and promptly implementing and maintaining all procedures and
practices as may be necessary to remain in compliance with the PCI DSS, in each case, at
sole cost and expense.
(2) CONTRACTOR covenants, represents and warrants to COUNTY that, as of the
Effective Date, CONTRACTOR has not received notice of any violation of any privacy or
data protection laws, as well as any other applicable regulations or directives, and is not the
subject of any pending legal action or investigation by, any government regulatory authority
regarding same.
(3) Without limiting obligations under subsection C.(1) of this
Exhibit ,Security Safeguards shall be no less
rigorous than accepted industry practices and, at a minimum, include the following: (i)
limiting Use of Personal Information strictly to and Authorized Persons
technical and administrative personnel who are necessary for the , or
pursuant to this Agreement; (ii)
ensuring that all of connectivity to County computing systems will only be
-5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
through security gateways and firewalls, and only through security procedures
approved upon the express prior written consent of the Director; (iii) to the extent that they
contain or provide access to Personal Information, (a) securing business facilities, data
centers, paper files, servers, back-up systems and computing equipment, operating
systems, and software applications, including, but not limited to, all mobile devices and other
equipment, operating systems, and software applications with information storage capability;
(b) employing adequate controls and data security measures, both internally and externally,
to protect (1) the Personal Information from potential loss or misappropriation, or
unauthorized Use, and (2) the operations from disruption and abuse; (c) having
and maintaining network, device application, database and platform security; (d) maintaining
authentication and access controls within media, computing equipment, operating systems,
and software applications; and (e) installing and maintaining in all mobile, wireless, or
handheld devices a secure internet connection, having continuously updated anti-virus
software protection and a remote wipe feature always enabled, all of which is subject to
express prior written consent of the Director; (iv) encrypting all Personal Information at
advance encryption standards of Advanced Encryption Standards (AES) of 128 bit or higher
(a) stored on any mobile devices, including but not limited to hard disks, portable storage
devices, or remote installation, or (b) transmitted over public or wireless networks (the
encrypted Personal Information must be subject to password or pass phrase, and be stored
on a secure server and transferred by means of a Virtual Private Network (VPN) connection,
or another type of secure connection, all of which is subject to express prior written consent
of the Director); (v) strictly segregating Personal Information from all other information of
CONTRACTOR, including any Authorized Person, or anyone with whom CONTRACTOR or
any Authorized Person deals so that Personal Information is not commingled with any other
types of information; (vi) having a patch management process including installation of all
operating system/software vendor security patches; (vii) maintaining appropriate personnel
security and integrity procedures and practices, including, but not limited to, conducting
Exhibit
-6
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
background checks of Authorized Employees consistent with applicable law; and (viii)
providing appropriate privacy and information security training to Authorized Employees.
(4 CONTRACTOR,
CONTRACTOR shall cause such Authorized Employees to abide strictly by
obligations under this Exhibit . CONTRACTOR further agrees that it shall
maintain a disciplinary process to address any unauthorized Use of Personal Information by
any Authorized Employees.
(5) CONTRACTOR shall, in a secure manner, backup daily, or more frequently if it is
practice to do so more frequently, Personal Information received from
COUNTY, and the COUNTY shall have immediate, real time access, at all times, to such
backups via a secure, remote access connection provided by CONTRACTOR, through the
Internet.
(6) CONTRACTOR shall provide COUNTY with the name and contact information for
one alternate Authorized Employee for each Authorized Employee during such work shift)
who shall serve as primary security contact with CONTRACTOR and shall be
available to assist COUNTY twenty-four (24) hours per day, seven (7) days per week as a
contact in resolving
with a Security Breach or a Privacy Practices Complaint.
D. Security Breach Procedures.
(1) Immediately upon awareness or reasonable belief of a Security
Breach, CONTRACTOR shall (a) notify the Director of the Security Breach, such notice to
be given first by telephone at the following telephone number, followed promptly by email at
the following email address: (559) 600-6200 / ematthews@fresnocountyca.gov (which
telephone number and email address COUNTY may update by providing notice to
CONTRACTOR), and (b) preserve all relevant evidence (and cause any affected Authorized
Person to preserve all relevant evidence) relating to the Security Breach. The notification
shall include, to the extent reasonably possible, the identification of each type and the extent
Exhibit
-7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
of Personal Information that has been, or is reasonably believed to have been, breached,
including but not limited to, compromised, or subjected to unauthorized Use, Disclosure, or
modification, or any loss or destruction, corruption, or damage.
(2) Immediately following notification to COUNTY of a Security
Breach, as provided pursuant to subsection D.(1) of this Exhibit , the Parties shall
coordinate with each other to investigate the Security Breach. CONTRACTOR agrees to
fully cooperate with COUNTY, including, without limitation: (i) assisting COUNTY in
conducting any investigation; (ii) providing COUNTY with physical access to the facilities and
operations affected; (iii) facilitating interviews with Authorized Persons and any of
other employees knowledgeable of the matter; and (iv) making available
all relevant records, logs, files, data reporting and other materials required to comply with
applicable law, regulation, industry standards, or as otherwise reasonably required by
COUNTY. To that end, CONTRACTOR shall, with respect to a Security Breach, be solely
responsible, at its cost, for all notifications required by law and regulation, or deemed
reasonably necessary by COUNTY, and CONTRACTOR shall provide a written report of the
investigation and reporting required to the Director within thirty (30) days after the
discovery of the Security Breach.
(3) County shall promptly notify CONTRACTOR of knowledge, or
reasonable belief, of any Privacy Practices Complaint, and upon receipt of
notification thereof, CONTRACTOR shall promptly address such Privacy Practices
Complaint, including taking any corrective action under this Exhibit , all at
sole expense, in accordance with applicable privacy rights, laws,
regulations and standards. In the event CONTRACTOR discovers a Security Breach,
CONTRACTOR shall treat the Privacy Practices Complaint as a Security Breach. Within
twenty-four (24) hours of receipt of notification of such Privacy Practices
Complaint, CONTRACTOR shall notify COUNTY whether the matter is a Security Breach, or
otherwise has been corrected and the manner of correction, or determined not to require
corrective action and the reason therefor.
-8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
(4) CONTRACTOR shall take prompt corrective action to respond to and remedy any
Security Breach and take mitigating actions, including but not limiting to, preventing any
reoccurrence of the Security Breach and correcting any deficiency in Security Safeguards as
a result of such incident, all at sole expense, in accordance with
applicable privacy rights, laws, regulations and standards. CONTRACTOR shall reimburse
COUNTY for all reasonable costs incurred by COUNTY in responding to, and mitigating
damages caused by, any Security Breach, including all costs of COUNTY incurred relation to
any litigation or other action described subsection D.(5) of this Exhibit .
(5) CONTRACTOR agrees to cooperate, at its sole expense, with COUNTY in any
litigation or other action to protect rights relating to Personal Information,
including the rights of persons from whom COUNTY receives Personal Information.
E. Oversight of Security Compliance.
(1) CONTRACTOR shall have and maintain a written information security policy that
specifies Security Safeguards appropriate to the size and complexity of
operations and the nature and scope of its activities.
(2) Upon written request, to confirm compliance with
this Exhibit , as well as any applicable laws, regulations and industry standards,
CONTRACTOR grants COUNTY or, upon election, a third party on
behalf, permission to perform an assessment, audit, examination or review of all controls in
physical and technical environment in relation to all Personal Information
that is Used by CONTRACTOR pursuant to this Agreement. CONTRACTOR shall fully
cooperate with such assessment, audit or examination, as applicable, by providing
COUNTY or the third party on behalf, access to all Authorized Employees and
other knowledgeable personnel, physical premises, documentation, infrastructure and
application software that is Used by CONTRACTOR for Personal Information pursuant to
this Agreement. In addition, CONTRACTOR shall provide COUNTY with the results of any
audit by or on behalf of CONTRACTOR that assesses the effectiveness of
information security program as relevant to the security and confidentiality of Personal
Exhibit
-9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Information Used by CONTRACTOR or Authorized Persons during the course of
this Agreement under this Exhibit .
(3) CONTRACTOR shall ensure that all Authorized Persons who Use Personal
Information agree to the same restrictions and conditions in this Exhibit . that apply to
CONTRACTOR with respect to such Personal Information by incorporating the relevant
provisions of these provisions into a valid and binding written agreement between
CONTRACTOR and such Authorized Persons, or amending any written agreements to
provide same.
F. Return or Destruction of Personal Information.
Upon the termination of this Agreement, CONTRACTOR shall, and shall instruct all
Authorized Persons to, promptly return to COUNTY all Personal Information, whether in
written, electronic or other form or media, in its possession or the possession of such
Authorized Persons, in a machine readable form used by COUNTY at the time of such
return, or upon the express prior written consent of the Recorder and the Director, securely
destroy all such Personal Information, and certify in writing to the COUNTY that such
Personal Information have been returned to COUNTY or disposed of securely, as
applicable. If CONTRACTOR is authorized to dispose of any such Personal Information, as
provided in this Exhibit , such certification shall state the date, time, and manner
(including standard) of disposal and by whom, specifying the title of the individual.
CONTRACTOR shall comply with all reasonable directions provided by the Recorder and
the Director with respect to the return or disposal of Personal Information and copies
thereof. If return or disposal of such Personal Information or copies of Personal Information
is not feasible, CONTRACTOR shall notify COUNTY according, specifying the reason, and
continue to extend the protections of this Exhibit to all such Personal Information and
copies of Personal Information. CONTRACTOR shall not retain any copy of any Personal
Information after returning or disposing of Personal Information as required by this section
F.obligations under this section F survive the termination of this
Agreement
-10
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Exhibit
and apply to all Personal Information that CONTRACTOR retains if return or disposal is not
feasible and to all Personal Information that CONTRACTOR may later discover.
G. Equitable Relief.
CONTRACTOR acknowledges that any breach of its covenants or obligations set
forth in this Exhibit may cause COUNTY irreparable harm for which monetary damages
would not be adequate compensation and agrees that, in the event of such breach or
threatened breach, COUNTY is entitled to seek equitable relief, including a restraining order,
injunctive relief, specific performance and any other relief that may be available from any
court, in addition to any other remedy to which COUNTY may be entitled at law or in equity.
Such remedies shall not be deemed to be exclusive but shall be in addition to all other
remedies available to COUNTY at law or in equity or under this Agreement.
H. Indemnification.
CONTRACTOR shall defend, indemnify and hold harmless COUNTY, its officers,
employees, and agents, (each, a COUNTY ) from and against any and all
infringement of intellectual property including, but not limited to infringement of copyright,
trademark, and trade dress, invasion of privacy, information theft, and extortion,
unauthorized Use, Disclosure, or modification of, or any loss or destruction of, or any
corruption of or damage to, Personal Information, Security Breach response and remedy
costs, credit monitoring expenses, forfeitures, losses, damages, liabilities, deficiencies,
actions, judgments, interest, awards, fines and penalties (including regulatory fines and
penalties), costs or expenses and costs, the cost
of enforcing any right to indemnification or defense under this Exhibit and the cost of
pursuing any insurance providers, arising out of or resulting from any third party claim or
action against any COUNTY Indemnitee in relation to , its officers,
employees, or agents, or any Authorized Employee or Authorized Person s, performance
or failure to perform under this Exhibit or arising out of or resulting from
failure to comply with any of its obligations under this section H. The provisions of this
section H do not apply to the acts or omissions of COUNTY. The provisions of this section H
Exhibit
-11
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
are cumulative to any other obligation of CONTRACTOR to, defend, indemnify, or hold
harmless any COUNTY Indemnity under this Agreement. The provisions of this section H
shall survive the termination of this Agreement.
I. Survival.
The respective rights and obligations of CONTRACTOR and COUNTY as stated
in this Exhibit shall survive the termination of this Agreement.
J. No Third Party Beneficiary.
Nothing express or implied in the provisions of in this Exhibit is intended to
confer, nor shall anything herein confer, upon any person other than COUNTY or
CONTRACTOR and their respective successors or assignees, any rights, remedies,
obligations or liabilities whatsoever.
L. No County Warranty.
COUNTY does not make any warranty or representation whether any Personal
Information in Use
by CONTRACTOR (or any Authorized Person), pursuant to the terms of this Agreement is or
will be secure from unauthorized Use, or a Security Breach or Privacy Practices Complaint.