HomeMy WebLinkAboutAgreement A-22-393 with George Hills Co..pdf Agreement No. 22-393
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated September 6th, 2022 and is between
3 George Hills Company, Inc., a California Corporation ("Contractor"), and the County of Fresno,
4 a political subdivision of the State of California ("County").
5 Recitals
6 A. The County is in need of a third-party administrator to assist the Risk Management
7 Division of the County's Department of Human Resources in the duties and responsibilities of
8 administering the County's self-insured third-party liability claims, medical malpractice claims,
9 first-party property claims, and subrogation services.
10 B. The Contractor is a third-party claims administrator experienced in administering public
11 entity claims, to include self-insured third-party liability claims, medical malpractice claims, first-
12 party property claims, and subrogation services.
13 C. The parties to this Agreement intend that all records received or prepared by the
14 Contractor in connection with the Contractor's performance under this Agreement will be
15 presumed to be exempt from public disclosure under Government Code section 6254,
16
subdivision (b). The parties to this Agreement also intend that the Contractor, in order to
17
perform services under this Agreement, will need to communicate with attorneys of the County
18
and in those communications will be serving as a representative of the County, as an
19
20 intermediate representative for communication between the County and an attorney of the
21 County, or both, and for that reason the Contractor will be engaged in communications that are
22 protected by the attorney-client privilege.
23 D. County and Contractor have previously executed Contract No. P-21-366 related to the
24 services which are the subject of this Agreement, the parties intend to terminate and replace
25 Contract No. P-21-366 with this Agreement.
26 The parties therefore agree as follows:
27
28
1
1 Article 1
2 Termination of Prior Agreement
3 1.1 Contract No. P-21-366 between the parties is hereby terminated as of the moment
4 when this Agreement becomes effective.
5 1.2 All services by Contractor that were initiated under Contract No. P-21-366 but not yet
6 completed will be compensated in accordance with Contract No. P-21-366 for all services
7 provided until the termination of Contract No. P-21-366. Services that were initiated but not yet
8 completed as of the termination of Contract No. P-21-366 will then be completed and
9 compensated under this Agreement, and are subject to all provisions of this Agreement as
10 though they were initiated under this Agreement.
11 1.3 Nothing in this Agreement is a waiver or compromise of any default or breach of
12 Contract No P-21-366 by the Contractor existing as of the moment when this Agreement
13 becomes effective whether or not known to the County
14 Article 2
15 Contractor's Services
16 2.1 Scope of Services. The Contractor shall perform all of the services provided in
17 Exhibit A to this Agreement, titled "Scope of Services."
18 2.2 Key Persons. The Contractor shall perform all services under this Agreement
19 through the following key persons: Tom Baber, Assistant Vice President of Claims
20 Administration; Randy Lingenfelter, Claims Supervisor; Dan Lamb, Senior Claims Examiner;
21 Cameron Dewey, General Adjustor; and Teresa Collier, Property Claims Adjustor. The
22 Contractor may not replace any key persons, or provide services through any other person on a
23 permanent basis, without the prior, express, written approval of the County's Director of Human
24 Resources or their designee ("HR Director"). In the case of death, illness or incapacity, or
25 departure of any key person, the Contractor shall provide a replacement of at least equal
26 professional ability and experience as the key person replaced.
27 2.3 Ownership of Records. All records received or prepared by the Contractor in
28 connection with the Contractor's performance of services under this Agreement are property of
2
1 the County and the County shall have the right to possess those records during the term of this
2 agreement. Upon the termination of this Agreement, any records in the Contractor's possession
3 shall be returned to the County.
4 2.4 Representation. The Contractor represents that it is qualified, ready, willing, and
5 able to perform all of the services provided in this Agreement.
6 2.5 Compliance with Laws. The Contractor shall, at its own cost, comply with all
7 applicable federal, state, and local laws and regulations in the performance of its obligations
8 under this Agreement, including but not limited to workers compensation, labor, and
9 confidentiality laws and regulations.
10 2.6 Confidentiality and Data Security. Contractor shall comply with all provisions of
11 Exhibit E to this Agreement, titled "Confidentiality and Data Security."
12 2.7 Heath Insurance Portability and Accountability Act (HIPAA). Contractor shall
13 comply with all provisions of Exhibit F to this Agreement, titled "Health Insurance Portability and
14 Accountability Act (HIPAA)."
15 Article 3
16 County's Responsibilities
17 3.1 The County shall do all of the following:
18 (A) Cooperate with Contractor as reasonably necessary for Contractor to perform its
19 services.
20 (B) Provide direction to Contractor as requested regarding Contractor's execution of
21 its obligations under this Agreement .
22 (C) Serve as the Responsible Reporting Entity for all applicable general liability
23 claims assigned to Contractor in accordance with the provisions of the Medicare, Medi-
24 Cal, and SCHIP Extension Act of 2007 (MMSEA).
25 (D) By April 30 of each year during the term of this Agreement, report to Contractor
26 any changes to the County's insurance coverage or policy language, including limits,
27 retentions or deductibles, and coverage changes.
28
3
1 3.2 The County hereby identifies its Risk Manager as the officer to whom Contractor
2 shall submit billing documents and loss run reports. The contact information for the County's
3 Risk Manager is 2220 Tulare Street, 161h Floor, Fresno CA, 93721, 559-600-1850.
4
5 Article 4
6 Compensation, Invoices, and Payments
7 4.1 The County agrees to pay, and the Contractor agrees to receive, compensation for
8 the performance of its services under this Agreement as described in Exhibit B to this
9 Agreement, titled "Compensation."
10 4.2 Maximum Compensation. The maximum compensation payable to the Contractor
11 under this Agreement is One Hundred and Seventy-Five Thousand Dollars and No Cents
12 ($175,000.00)for each one-year period, beginning September 6 of one year and ending on
13 September 5 of the following year, that this Agreement is in effect. The maximum compensation
14 payable to the Contractor for the initial term of this Agreement, September 6, 2022, through
15 September 5, 2024, is Three Hundred and Fifty Thousand Dollars and No Cents ($350,000.00).
16 If this Agreement is extended for one additional one-year period, September 6, 2024, through
17 September 5, 2025, then the total maximum compensation payable to the Contractor is Five
18 Hundred Twenty-Five Thousand Dollars and No Cents ($525,000.00). If this Agreement is
19 extended for a second one-year period, September 6, 2025, through September 5, 2026, then
20 the total maximum compensation payable to the Contractor is Seven Hundred Thousand Dollars
21 and No Cents ($700,000.00). The Contractor acknowledges that the County is a local
22 government entity, and does so with notice that the County's powers are limited by the
23 California Constitution and by State law, and with notice that the Contractor may receive
24 compensation under this Agreement only for services performed according to the terms of this
25 Agreement and while this Agreement is in effect, and subject to the maximum amount payable
26 under this section. The Contractor further acknowledges that County employees have no
27 authority to pay the Contractor except as expressly provided in this Agreement.
28
4
1 4.3 Invoices. The Contractor shall submit monthly invoices to County of Fresno
2 Department of Human Resources-ATTN: Risk Management, 2220 Tulare Street, 1611 Floor,
3 Fresno, CA 93721 and HRRiskManagement@fresnocountyca.gov. The Contractor shall submit
4 each invoice within 60 days after the month in which the Contractor performs services and in
5 any case within 60 days after the end of the term or termination of this Agreement.
6 4.4 Payment. The County shall pay each correctly completed and timely submitted
7 invoice within 45 days after receipt. The County shall remit any payment to the Contractor's
8 address specified in the invoice.
9 4.5 Incidental Expenses. The Contractor is solely responsible for all of its costs and
10 expenses that are not specified as payable by the County under this Agreement.
11 Article 5
12 Term of Agreement
13 5.1 Term. This Agreement is effective on September 6, 2022, and terminates on
14 September 5, 2024, at 11:59 p.m., except as provided in section 5.2, "Extension," or Article 7,
15 "Termination and Suspension," below.
16 5.2 Extension. The term of this Agreement may be extended for no more than two, one-
17 year periods only upon written approval of both parties at least 30 days before the first day of
18 the next one-year extension period. The Director of Human Resources or his or her designee is
19 authorized to sign the written approval on behalf of the County based on the Contractor's
20 satisfactory performance. The extension of this Agreement by the County is not a waiver or
21 compromise of any default or breach of this Agreement by the Contractor existing at the time of
22 the extension whether or not known to the County.
23 Article 6
24 Notices
25 6.1 Contact Information. The persons and their addresses having authority to give and
26 receive notices provided for or permitted under this Agreement include the following:
27
For the County:
28 Director of Human Resources
County of Fresno
5
1 2220 Tulare Street, 16th Floor
Fresno, CA 93721
2
For the Contractor:
3 John Chaquica, CEO
George Hills Company INC.
4 P.O. Box 278
Rancho Cordova, CA 95741
5
6.2 Change of Contact Information. Either party may change the information in section
6
6.1 by giving notice as provided in section 6.3.
7
6.3 Method of Delivery. Each notice between the County and the Contractor provided
8
for or permitted under this Agreement must be in writing, state that it is a notice provided under
9
this Agreement, and be delivered either by personal service, by first-class United States mail, or
10
by an overnight commercial courier service.
11
(A) A notice delivered by personal service is effective upon service to the recipient.
12
(B) A notice delivered by first-class United States mail is effective three County
13
business days after deposit in the United States mail, postage prepaid, addressed to the
14
recipient.
15
(C)A notice delivered by an overnight commercial courier service is effective one
16
County business day after deposit with the overnight commercial courier service,
17
delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
18
the recipient.
19
6.4 Claims Presentation. For all claims arising from or related to this Agreement,
20
nothing in this Agreement establishes, waives, or modifies any claims presentation
21
requirements or procedures provided by law, including the Government Claims Act (Division 3.6
22
of Title 1 of the Government Code, beginning with section 810).
23
Article 7
24
Termination and Suspension
25
7.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
26
contingent on the approval of funds by the appropriating government agency. If sufficient funds
27
are not allocated, then the County, upon at least 30 days' advance written notice to the
28
Contractor, may:
6
1 (A) Modify the services provided by the Contractor under this Agreement; or
2 (B) Terminate this Agreement.
3 7.2 Termination for Breach.
4 (A) Upon determining that a breach (as defined in paragraph (C) below) has
5 occurred, the County may give written notice of the breach to the Contractor. The written
6 notice may suspend performance under this Agreement, and must provide at least 30
7 days for the Contractor to cure the breach.
8 (B) If the Contractor fails to cure the breach to the County's satisfaction within the
9 time stated in the written notice, the County may terminate this Agreement immediately.
10 (C) For purposes of this section, a breach occurs when, in the determination of the
11 County, the Contractor has:
12 (1) Obtained or used funds illegally or improperly;
13 (2) Failed to comply with any part of this Agreement;
14 (3) Submitted a substantially incorrect or incomplete report to the County; or
15 (4) Improperly performed any of its obligations under this Agreement.
16 7.3 Termination without Cause. In circumstances other than those set forth above, the
17 County may terminate this Agreement by giving at least 30 days advance written notice to the
18 Contractor.
19 7.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
20 under this Article 7 is without penalty to or further obligation of the County.
21 7.5 County's Rights upon Termination. Upon termination for breach under this Article
22 7, the County may demand repayment by the Contractor of any monies disbursed to the
23 Contractor under this Agreement that, in the County's sole judgment, were not expended in
24 compliance with this Agreement. The Contractor shall promptly refund all such monies upon
25 demand. This section survives the termination of this Agreement.
26
27
28
7
1 Article 8
2 Independent Contractor
3 8.1 Status. In performing under this Agreement, the Contractor, including its officers,
4 agents, employees, and volunteers, is at all times acting and performing as an independent
5 contractor, in an independent capacity, and not as an officer, agent, servant, employee,joint
6 venturer, partner, or associate of the County.
7 8.2 Verifying Performance. The County has no right to control, supervise, or direct the
8 manner or method of the Contractor's performance under this Agreement, but the County may
9 verify that the Contractor is performing according to the terms of this Agreement.
10 8.3 Benefits. Because of its status as an independent contractor, the Contractor has no
11 right to employment rights or benefits available to County employees. The Contractor is solely
12 responsible for providing to its own employees all employee benefits required by law. The
13 Contractor shall save the County harmless from all matters relating to the payment of
14 Contractor's employees, including compliance with Social Security withholding and all related
15 regulations.
16 8.4 Services to Others. The parties acknowledge that, during the term of this
17 Agreement, the Contractor may provide services to others unrelated to the County.
18 Article 9
19 Indemnity and Defense
20 9.1 Indemnity. The Contractor shall indemnify and hold harmless and defend the
21 County (including its officers, agents, employees, and volunteers) against all claims, demands,
22 injuries, damages, costs, expenses (including attorney fees and costs), fines, penalties, and
23 liabilities of any kind to the County, the Contractor, or any third party that arise from or relate to
24 the performance or failure to perform by the Contractor (or any of its officers, agents,
25 subcontractors, or employees) under this Agreement. The County may conduct or participate in
26 its own defense without affecting the Contractor's obligation to indemnify and hold harmless or
27 defend the County.
28 9.2 Survival. This Article 9 survives the termination of this Agreement.
8
1 Article 10
2 Insurance
3 10.1 The Contractor shall comply with all the insurance requirements in Exhibit D to this
4 Agreement.
5 Article 11
6 Inspections, Audits, and Public Records
7 11.1 Inspection of Documents. The Contractor shall make available to the County, and
8 the County may examine at any time during business hours and as often as the County deems
9 necessary, all of the Contractor's records and data with respect to the matters covered by this
10 Agreement, excluding attorney-client privileged communications between the Contractor and
11 the Contractor's own attorney. The Contractor shall, upon request by the County, permit the
12 County to audit and inspect all of such records and data to ensure the Contractor's compliance
13 with the terms of this Agreement.
14 11.2 State Audit Requirements. If the compensation to be paid by the County under this
15 Agreement exceeds $10,000, the Contractor is subject to the examination and audit of the
16 California State Auditor, as provided in Government Code section 8546.7, for a period of three
17 years after final payment under this Agreement. This section survives the termination of this
18 Agreement.
19 11.3 Public Records. The County is not limited in any manner with respect to its public
20 disclosure of this Agreement or any record or data that the Contractor may provide to the
21 County. The County's public disclosure of this Agreement or any record or data that the
22 Contractor may provide to the County may include but is not limited to the following:
23 (A) The County may voluntarily, or upon request by any member of the public or
24 governmental agency, disclose this Agreement to the public or such governmental
25 agency.
26 (B) The County may voluntarily, or upon request by any member of the public or
27 governmental agency, disclose to the public or such governmental agency any record or
28
9
1 data that the Contractor may provide to the County, unless such disclosure is prohibited
2 by court order.
3 (C)This Agreement, and any record or data that the Contractor may provide to the
4 County, is subject to public disclosure under the Ralph M. Brown Act (California
5 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
6 (D)This Agreement, and any record or data that the Contractor may provide to the
7 County, is subject to public disclosure as a public record under the California Public
8 Records Act (California Government Code, Title 1, Division 7, Chapter 3.5, beginning
9 with section 6250) ("CPRA").
10 (E) This Agreement, and any record or data that the Contractor may provide to the
11 County, is subject to public disclosure as information concerning the conduct of the
12 people's business of the State of California under California Constitution, Article 1,
13 section 3, subdivision (b).
14 (F) Any marking of confidentiality or restricted access upon or otherwise made with
15 respect to any record or data that the Contractor may provide to the County shall be
16 disregarded and have no effect on the County's right or duty to disclose to the public or
17 governmental agency any such record or data.
18 11.4 Public Records Act Requests. If the County receives a written or oral request
19 under the CPRA to publicly disclose any record that is in the Contractor's possession or control,
20 and which the County has a right, under any provision of this Agreement or applicable law, to
21 possess or control, then the County may demand, in writing, that the Contractor deliver to the
22 County, for purposes of public disclosure, the requested records that may be in the possession
23 or control of the Contractor. Within five business days after the County's demand, the
24 Contractor shall (a) deliver to the County all of the requested records that are in the Contractor's
25 possession or control, together with a written statement that the Contractor, after conducting a
26 diligent search, has produced all requested records that are in the Contractor's possession or
27 control, or (b) provide to the County a written statement that the Contractor, after conducting a
28 diligent search, does not possess or control any of the requested records. The Contractor shall
10
1 cooperate with the County with respect to any County demand for such records. If the
2 Contractor wishes to assert that any specific record or data is exempt from disclosure under the
3 CPRA or other applicable law, it must deliver the record or data to the County and assert the
4 exemption by citation to specific legal authority within the written statement that it provides to
5 the County under this section. The Contractor's assertion of any exemption from disclosure is
6 not binding on the County, but the County will give at least 10 days' advance written notice to
7 the Contractor before disclosing any record subject to the Contractor's assertion of exemption
8 from disclosure. The Contractor shall indemnify the County for any court-ordered award of costs
9 or attorney's fees under the CPRA that results from the Contractor's delay, claim of exemption,
10 failure to produce any such records, or failure to cooperate with the County with respect to any
11 County demand for any such records.
12 Article 12
13 Disclosure of Self-Dealing Transactions
14 12.1 Applicability. This Article 12 applies if the Contractor is operating as a corporation,
15 or changes its status to operate as a corporation.
16 12.2 Duty to Disclose. If any member of the Contractor's board of directors is party to a
17 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
18 "Self-Dealing Transaction Disclosure Form" (Exhibit C to this Agreement) and submitting it to
19 the County before commencing the transaction or immediately after.
20 12.3 Definition. "Self-dealing transaction" means a transaction to which the Contractor is
21 a party and in which one or more of its directors, as an individual, has a material financial
22 interest.
23 Article 13
24 General Terms
25 13.1 Modification. Except as provided in Article 7, "Termination and Suspension," this
26 Agreement may not be modified, and no waiver is effective, except by written agreement signed
27 by both parties. The Contractor acknowledges that County employees have no authority to
28 modify this Agreement except as expressly provided in this Agreement.
11
1 13.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
2 under this Agreement without the prior written consent of the other party, provided that the
3 Contractor may, with the prior written approval of the County's Risk Manager, retain vendors to
4 provide the services identified in sections 1.3 and 2.1 of Exhibit A.
5 13.3 Governing Law. The laws of the State of California govern all matters arising from
6 or related to this Agreement.
7 13.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
8 County, California. Contractor consents to California jurisdiction for actions arising from or
9 related to this Agreement, and, subject to the Government Claims Act, all such actions must be
10 brought and maintained in Fresno County.
11 13.5 Construction. The final form of this Agreement is the result of the parties' combined
12 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
13 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
14 against either party.
15 13.6 Days. Unless otherwise specified, "days" means calendar days.
16 13.7 Headings. The headings and section titles in this Agreement are for convenience
17 only and are not part of this Agreement.
18 13.8 Severability. If anything in this Agreement is found by a court of competent
19 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
20 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
21 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
22 intent.
23 13.9 Nondiscrimination. During the performance of this Agreement, the Contractor shall
24 not unlawfully discriminate against any employee or applicant for employment, or recipient of
25 services, because of race, religious creed, color, national origin, ancestry, physical disability,
26 mental disability, medical condition, genetic information, marital status, sex, gender, gender
27 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
28 all applicable State of California and federal statutes and regulation.
12
1 13.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
2 of the Contractor under this Agreement on any one or more occasions is not a waiver of
3 performance of any continuing or other obligation of the Contractor and does not prohibit
4 enforcement by the County of any obligation on any other occasion.
5 13.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
6 between the Contractor and the County with respect to the subject matter of this Agreement,
7 and it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
8 publications, and understandings of any nature unless those things are expressly included in
9 this Agreement. If there is any inconsistency between the terms of this Agreement without its
10 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
11 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
12 exhibits.
13 13.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
14 create any rights or obligations for any person or entity except for the parties.
15 13.13 Authorized Signature. The Contractor represents and warrants to the County that:
16 (A) The Contractor is duly authorized and empowered to sign and perform its
17 obligations under this Agreement.
18 (B) The individual signing this Agreement on behalf of the Contractor is duly
19 authorized to do so and his or her signature on this Agreement legally binds the
20 Contractor to the terms of this Agreement.
21 13.14 Electronic Signatures. The parties agree that this Agreement may be executed by
22 electronic signature as provided in this section.
23 (A) An "electronic signature" means any symbol or process intended by an individual
24 signing this Agreement to represent their signature, including but not limited to (1) a
25 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
26 electronically scanned and transmitted (for example by PDF document) version of an
27 original handwritten signature.
28
13
1 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
2 equivalent to a valid original handwritten signature of the person signing this Agreement
3 for all purposes, including but not limited to evidentiary proof in any administrative or
4 judicial proceeding, and (2) has the same force and effect as the valid original
5 handwritten signature of that person.
6 (C)The provisions of this section satisfy the requirements of Civil Code section
7 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
8 Part 2, Title 2.5, beginning with section 1633.1).
9 (D) Each party using a digital signature represents that it has undertaken and
10 satisfied the requirements of Government Code section 16.5, subdivision (a),
11 paragraphs (1) through (5), and agrees that each other party may rely upon that
12 representation.
13 (E) This Agreement is not conditioned upon the parties conducting the transactions
14 under it by electronic means and either party may sign this Agreement with an original
15 handwritten signature.
16 13.15 Counterparts. This Agreement may be signed in counterparts, each of which is an
17 original, and all of which together constitute this Agreement.
18 [SIGNATURE PAGE FOLLOWS]
19
20
21
22
23
24
25
26
27
28
14
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
George Hills Company, INC COUNTY OF FRESNO
3
4
5 JoWE. Chaquica CEO Brian Pacheco, Chairman of the Board of
Supervisors of the County of Fresno
6 P.O. Box 278
Rancho Cordova, CA 95741 Attest:
7 Bernice Seidel
Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By:
10 Deputy
11 For accounting use only:
12 Org No.: 89250100
Account No.: 7100
13 Fund No.: 1060
Subclass No.: 10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
15
Exhibit A
1 Scope of Services
2 Contractor shall provide all of the following services:
3 1.0 CLAIMS MANAGEMENT SERVICES
4 1.1 The County's Risk Manager or their designee ("Risk Manger") may from time to
5 time assign claims for damages to the Contractor to handle as provided in this Agreement.
6 When such an assignment is made, the Contractor shall do all of the following, subject to
7 Section 1.2 of this Exhibit A:
8 1.1.1 Assign a claims adjustor as the person primarily responsible for managing
9 the claim. Within five business day(s) of receiving an assignment of a claim from the
10 Risk Manager, the Contractor shall notify the Risk Manager of the name and contact
11 information of the claims adjustor assigned to the claim.
12 1.1.2 Assess and evaluate the nature and extent of each claim in regard to
13 potential liability to the County, and establish claims reserve amounts for indemnity (the
14 liability associated with the claim itself) and legal expense (the estimated cost to defend
15 the claim) and communicate those claim reserve amounts to the County in writing within
16 14 business days of receiving the claim.
17 1.1.3 Investigate the allegations of the claim to determine whether the County
18 has exposure to liability, and if so, the extent of that liability. Such investigation shall
19 include receiving and examining all reports of accidents or incidents that are or may be
20 subject of claims. In addition, Contractor's investigation of the allegations of the claim
21 may include, but not necessarily be limited to: on site investigation, the taking of
22 photographs, conducting interviews with witnesses to the incident(s) underlying the claim
23 for damages, a determination of losses to individuals and/or entities (including the
24 County) injured in the incident.
25 1.1.4 Ensure timely claims handling, including contact and follow-up with
26 claimants regarding claim issues and processing.
27
28
A-1
Exhibit A
1 1.1.5 Send to the claimant, with copy to the Risk Manager, a notice of
2 insufficiency or notice of late claim, respectively, if Contractor determines such notice is
3 consistent with applicable law. Upon determination by the County whether to accept or
4 deny leave to present a late claim, and written communication of that determination to
5 Contractor by the Risk Manager, the Contractor will send a notice of acceptance or
6 denial of leave to present a late claim.
7 1.1.6 Within thirty (30) days of assignment, or sooner if practicable, provide
8 County with a report pursuant to claims handling instructions provided to Contractor by
9 the Risk Manager, showing names of claimants, type of claim, date of loss, comments
10 on liability, damage reserve recommendations, and settlement recommendations.
11 Contractor will report any pertinent information or important change in status received
12 subsequent to the initial thirty (30) day report and at least every ninety (90) days, or
13 more often as warranted, until the claim closes, unless an extended diary is appropriate,
14 in which case the Contractor shall prepare an extended diary.
15 1.1.7 Make a recommendation to the County's Risk Manager regarding
16 whether legal counsel should be engaged at the claim stage, before litigation is filed.
17 The County retains sole discretion to determine whether to assign legal counsel to any
18 claim.
19 1.1.8 Report claims to the County's excess insurer, with copy to the Risk
20 Manager, in compliance with excess insurer's reporting requirements and coordinate
21 with the excess insurer on a claim's progress in accordance with the excess insurer's
22 reporting requirements.
23 1.1.9 For claims assigned to Contractor, perform periodic reviews, as
24 requested by the Risk Manager, of County's files and claims as well as statutory
25 requirements to ensure compliance with Government Claims Act filing requirements and
26 excess reporting requirements.
27
28
A-2
Exhibit A
1 1.1.10 Maintain, in County's claims system, records on all assigned excess
2 reportable claims and notify Risk Manager when County's Self-Insured Retention is 75%
3 exhausted.
4 1.1.11 Receive settlement contracts and releases prepared by legal counsel
5 retained by the County upon settlement of claims, and forward for processing by the
6 Risk Manager in accordance with County settlement authority guidelines.
7 1.2 An assignment of claim to Contractor obligates the Contractor to take those
8 actions specified in Section 1.1, but does not delegate authority to the Contractor to resolve
9 claim on behalf of the County. The Risk Manager may at any time recall a claim previously
10 assigned to the Contractor.
11 1.3 In the Contractor's management of a claim for damages, the Risk Manager may
12 give prior written approval for the Contractor to retain appraisers, translators, and independent
13 adjusters, as well as vendors to provide services such as copy services and surveillance, in
14 relation to that claim. The Contractor shall not retain vendors under this Agreement without the
15 prior written approval of the Risk Manager. In any request for such prior written approval, the
16 Contractor shall provide to the Risk Manager in writing a budget for the services, state whether
17 the vendor will provide services on multiple claims, and state whether and to what extent the
18 Contractor has used competitive selection procedures to select the vendor.
19 1.4 Upon notification by the Risk Manager that litigation has been filed against
20 County on a claim assigned to the Contractor, Contractor shall do all of the following:
21 1.4.1 Upon assignment by County of defense counsel, Contractor shall work
22 cooperatively with County and defense counsel assigned by County.
23 1.4.2 Obtain a Litigation Plan and Budget from defense counsel.
24 1.4.3 Review legal bills for compliance with Litigation Plan and Budget; review,
25 evaluate, and adjust defense counsel invoices for legal services.
26 1.4.4 Cooperate with and assist defense counsel assigned to defend against
27 the litigation during pre-trial and trial stages.
28
A-3
Exhibit A
1 1.4.5 Assist in preparing discovery responses as requested by defense
2 counsel.
3 1.4.6 At the request of the Risk Manager, attend mandatory settlement
4 conferences with defense counsel.
5 1.4.7 Review case evaluations, correspondence, and status reports forwarded
6 to Contractor by defense counsel. Regularly, but in any case at least quarterly, discuss,
7 review, and direct investigation, discovery, and case strategy with defense counsel and
8 the County.
9
10 2.0 SPECIAL INVESTIGATIVE SERVICES
11 2.1. Upon request of the Risk Manager, the Contractor shall investigate incidents
12 which may, in the judgment of the Risk Manager, become the subject of a claim for damages.
13 Such investigation may include the following services: on site investigation, the taking of
14 photographs, conducting interviews with witnesses to the incident, a determination of losses to
15 individuals and/or entities (including the County) injured in the incident, and other such
16 investigative services as may be requested by the Risk Manager (collectively, "Special
17 Investigative Services"), to determine the County's potential liability. If prior written authorization
18 is provided by the Risk Manager , Contractor may contract with one or more third party
19 investigators, in order to complete reasonable and necessary investigations.
20 2.2 If County, or an investigator hired by the County, conducts any investigation, and
21 upon the request of the Risk Manager, or their designee, Contractor shall review and analyze
22 for liability and/or damage issues and for possible additional follow-up investigation.
23 2.3. Maintain service on a 24-hour, seven days per week basis, to receive reports of
24 any incidents which may, in the judgment of the Risk Manager or their designee, become the
25 subject of a claim for damages and provide immediate Special Investigative Services at the
26 request of the County's Risk Manager or their designee to the extent necessary to provide a
27 complete investigation.
28
A-4
Exhibit A
1
2 3.0 ATTENDANCE AND PARTICIPATION IN MEETINGS WITH COUNTY EMPLOYEES
3 3.1 Claims Review Committee Meetings. The Risk Manager and the County
4 Counsel convene monthly Claims Review Committee (CRC) meetings to review claims for
5 damages that have been filed with the County. For each claim assigned to the Contractor, the
6 Contractor shall ensure that the claims adjustor Contractor assigned to the Claim is in
7 attendance at each CRC meeting at which the claim is to be discussed, is prepared to and does
8 discuss the claim and any information they have collected about the claim, and provides a
9 recommendation regarding action that should be taken on the claim. The Risk Manager may
10 schedule CRC meetings to occur in person, by videoconference, or teleconference. Contractor
11 agrees to ensure that the assigned claims adjustor appears in person at up to and including four
12 (4) CRC meetings per calendar year if requested by County's Risk Manager or their designee,
13 with all other appearances to be by videoconference or teleconference, as requested by the
14 Risk Manager.
15
16 4.0 TRAINING OF COUNTY EMPLOYEES
17 4.1. Upon request of the Risk Manager, Contractor will provide training up to 20 hours
18 per year to County staff on topics pertaining to general liability, automobile liability, personal
19 injury (including law enforcement and jails), employment practices liability, first party property
20 claims, and other related exposures faced by the County.
21 Upon request by the Risk Manager, Contractor shall also provide access to online
22 certification courses contained in the George Hills Claims University, which include the Public
23 Entity Claims Professional- Risk Management (PECP-RM), and the full Public Entity Claims
24 Professional (PECP) course. The PECP-RM course is a primer designed for staff that are new
25 to liability claims and covers the basics of public entity tort claims, basic immunities, and
26 information of the most common types of claims encountered by public agencies. The full PECP
27
28
A-5
Exhibit A
1 course is a much more comprehensive designed for staff that handle or manage public entity
2 claims.
3
4 5.0 SUBROGATION
5 5.1 Third Party Subrogation/Indemnity Service- as requested by the Risk Manager
6 on claims assigned to Contractor. In any claim in which the County is alleged to be liable or
7 case in which County is a named defendant , Contractor will identify additional parties to that
8 dispute which may also bear responsibility or liability for the damages claimed by the claimant(s)
9 or plaintiff(s). Where additional individuals or entities are identified, Contractor will perform the
10 following services:
11 5.1.1. On a monthly basis, identify persons, business, or entities who may be
12 liable for the County's losses on the matter assigned to Contractor, to be reported to the
13 Risk Manager.
14 5.1.2 Pursuant to approval by the Risk Manager, prepare a claim for filing by
15 the County with each identified person or entity.
16 5.1.3 As applicable, provide recommendation to tender defense to or seek
17 recovery from any identified person or entity.
18 5.1.4 Make a recommendation to the Risk Manager whether the County should
19 initiate litigation to recover on the claim.
20 5.1.5 Manage litigation related to such claims or cases made to of filed against
21 the other individual entity, as specified in Section 1.4.
22 5.1.6 All costs and expenses of litigation filed pursuant to this section, including
23 attorney fees for outside counsel where necessary and approved, will be paid by the
24 County as outlined in Section I of this Exhibit A.
25 5.2 First Party Subrogation Services- as requested by the Risk Manager. In the
26 event that County identifies damages it has sustained with a value of$1,000 or greater and
27
28
A-6
Exhibit A
1 for which any individual or entity is believed to be liable or responsible, at the request of the
2 Risk Manager, the Contractor shall provide the following services:
3 5.2.1 With prior written approval of the Risk Manager, act as a representative of
4 County for the investigation, adjustment, processing, supervision, and evaluation of an
5 ultimate recovery of potential money from damage claims against parties for whom it is
6 alleged to be legally responsible.
7 5.2.2 If the County determines to initiate litigation on a subrogation claim that is
8 being handled by the Contractor, the Risk Manager will recall the claim to the County's
9 control so that County may pursue recovery in a manner to be determined by the
10 County's attorney to be in the best interest of the County.
11 5.2.3 If the County recalls the claim, County will pay Contractor for time and
12 expense incurred by Contractor, including Contractor's subrogation claim adjuster,
13 subrogation division staff, or both, up to the time when the claim is recalled by the
14 County.
15 5.2.4 Contractor reserves the right to cease working on any first-party
16 subrogation claim for which information has not been made available to Contractor
17 within 120 days after Contractor has submitted the information and documentation to the
18 County, at such time, the first-party subrogation claim will be closed.
19 5.3 As requested by the Risk Manager, Contractor shall consult with the Risk
20 Manager on subrogation claims or matters not already assigned to the Contractor for handling
21 under this Agreement. Such consultation may include review of situations, reports, documents
22 or information for which the County is uncertain if recovery is possible prior to a claim being
23 assigned to Contractor.
24
25
26
27
28
A-7
Exhibit B
1 Compensation
2 The Contractor will be compensated for performance of its services under this
3 Agreement as provided in this Exhibit B. The Contractor is not entitled to any compensation
4 except as expressly provided in Article 4 of this Agreement and this Exhibit B.
5 The following compensation, fees and expenses, shall be paid in consideration for the
6 services provided by Contractor pursuant to this Agreement:
7 A. Annual Fixed Fee. For the administration of up to 80 liability claims, up to 10 First Party
8 Property claims, pursuant to Sections 1, 3 of Exhibit A, and those subrogation services
9 described in 5.1 and 5.3 of Exhibit A, CLIENT shall pay Contractor a fixed fee of
10 $135,000 for each one-year term of this contract. This fixed fee shall be paid in equal
11 monthly installments for which Contractor will submit monthly invoices as provided in
12 section 4.3 of this Agreement. For purposes of this paragraph A, a claim related to a
13 single occurrence includes up to five total claimants, and each additional claimant
14 related to the same incident shall be counted as a separate additional claim.
15 B. 5% Escalator: The Annual Fixed Fee and hourly rates shall be increased as provided in
16 this paragraph as of September 6, 2023, in accordance with the change in the Consumer
17 Price Index (CPI-U)for all Urban Consumers for the Fresno region using the most recently
18
published month annual percentage change, but in any event such increase shall not be
19
more than 5% or less than 3%. The procedure to apply the increase is as follows: The
20
Risk Manager shall calculate the increase as provided in this paragraph and, no later than
21
22 September 13, 2023, shall provide written notice to the Contractor of the increase,
23 including the calculation.
24 C. Time and Expense Fees. County shall pay the Contractor the following fees for
25 services described in Exhibit A, which shall be in addition to the annual fixed fee:
26 1. Special Investigative Services
27 Supervisor $117/hour
28 Adjuster $94/hour
B-1
Exhibit B
1 2. First Party Property Claims
2 All First Party Property claims with over$100,000 incurred losses will be evaluated
3 on a case-by-case basis by County and Contractor. Upon mutual agreement of
4 County and Contractor, time and expense fees for the administration of agreed upon
5 claims will be:
6 Supervisor $117/hour
7 Adjuster $94/hour
8 3. Training
9 Training Provided by George Hills Staff
10 . 20 hours of in-person/virtual training per year Included, as part of
11 Annual Fixed Fee.
12 • Additional training $125/hour
13 George Hills Claims University Courses per Attendee
14 . Risk Management (PECP-RM) Included, as part of
15 Annual Fixed Fee.
16 . Public Entity Claims Professional (PECP) One enrollment
17 included, additional
18 enrollments at
19 $795/enrollment
20 4. First-Party Subrogation
21 County will pay a Subrogation Fee in the amount of 30% of the gross amount
22 recovered for each first-party subrogation claim recovery obtained by Contractor
23 without litigation and recall, as provided in Exhibit A to this Agreement. The minimum
24 amount to be paid to Contractor will be $250 per first-party subrogation claim upon
25 recovery. However, Contractor has the authority to reject the handling of any first-
26 party subrogation claim for any reason, relieving the County of any subrogation fee
27 for a rejected first party-subrogation claim.
28
B-2
Exhibit B
1 Due to the nature of first-party subrogation services, in that compensation is
2 contingent upon recovery, if this Agreement is terminated prior to recovery or other
3 closure of any claim, the County shall pay Contractor for all expenses and time
4 spent, to date, on each first-party subrogation claim that is open and recovery in
5 process at the time of termination. Payment shall be based on the current hourly rate
6 of Contractor of$95.00 per hour. Contractor shall submit monthly accounting of time
7 spent on each subrogation matter, and will submit final invoice within five business
8 days of termination.
9
10 D. Allocated Expenses. Allocated Expenses are costs separate from the annual fixed fee
11 of$135,000 and shall be preapproved by County. County shall reimburse Contractor for
12 only those Allocated Expenses incurred by Contractor that were preapproved in writing
13 by the Risk Manager.
14 Allocated Expenses May Include:
15 1. Reasonable and necessary Centers for Medicare and Medicaid Services
16 Reporting costs and fees (ExamWorks).
17 2. Reasonable and necessary costs of legal transcripts of testimony taken at
18 coroner inquests, or criminal or civil proceedings.
19 3. Reasonable and necessary costs for copies of any public or medical
20 records.
21 4. Reasonable and necessary costs of appraisal fees when an appraisal is
22 necessary for the Contractor to provide services under this Agreement.
23 5. Reasonable and necessary costs of indexing claimants.
24 6. Reasonable and necessary costs for Medicare Set-Aside analysis and
25 submission or Medicare Conditional Lien negotiation.
26 7. Any reasonable and necessary similar cost, fee, or expense that is not
27 otherwise included in the Contractor's annual fixed fee, but necessary as
28 determined by the Risk Manager for the Contractor to provide services
B-3
Exhibit B
1 under this Agreement, that is reasonably chargeable to the investigation,
2 negotiation, settlement, or defense of a claim or to the protection or
3 perfection of subrogation rights, including reasonable travel related
4 expenses.
5 8. Mileage- Adjuster: Mileage for an adjuster's reasonable and necessary
6 travel to provide services under this Agreement is paid at the IRS rate.
7 9. Adjuster travel expenses: Contractor may separately charge for
8 reasonable and necessary travel expenses in connection with
9 attendance, if requested by the Risk Manager, at mediations, settlement
10 conferences, trials. Actual expenses will be submitted with receipts on a
11 monthly basis. Mileage is paid at the IRS rate.
12 E. TIME AND EXPENSE AND FEES AND ALLOCATED EXPENSES. In no event shall Time
13 and Expense Fees and Allocated Expenses exceed $40,000 during each one-year term of this
14 contract.
15
16
17
18
19
20
21
22
23
24
25
26
27
28
B-4
Exhibit C
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
C-1
Exhibit C
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
C-2
Exhibit D
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the Contractor or any third
parties, Contractor, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence and an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
Coverage must include products, completed operations, property damage, bodily injury,
personal injury, and advertising injury. The Contractor shall obtain an endorsement to
this policy naming the County of Fresno, its officers, agents, employees, and volunteers,
individually and collectively, as additional insureds, but only insofar as the operations
under this Agreement are concerned. Such coverage for additional insureds will apply as
primary insurance and any other insurance, or self-insurance, maintained by the County
is excess only and not contributing with insurance provided under the Contractor's
policy.
(B) Automobile Liability. Automobile liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages.
Coverage must include any auto used in connection with this Agreement.
(C)Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(D) Employer's Liability. Employer's liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for disease.
(E) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1) the retroactive date must
be prior to the date on which services began under this Agreement; (2) the Contractor
shall maintain the policy and provide to the County annual evidence of insurance for not
less than five years after completion of services under this Agreement; and (3) if the
policy is canceled or not renewed, and not replaced with another claims-made policy
with a retroactive date prior to the date on which services begin under this Agreement,
then the Contractor shall purchase extended reporting coverage on its claims-made
policy for a minimum of five years after completion of services under this Agreement.
(F) Cyber Liability. Cyber liability insurance with limits of not less than One Million Dollars
($1,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data) that is in the care, custody, or control of the Contractor.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) breach of any of the Contractor's obligations under Exhibit E
of this Agreement; (iv) system failure; (v) data recovery; (vi) failure to timely disclose
D-1
Exhibit D
data breach or Security Breach; (vii) failure to comply with privacy policy; (viii) payment
card liabilities and costs; (ix) infringement of intellectual property, including but not
limited to infringement of copyright, trademark, and trade dress; (x) invasion of privacy,
including release of private information; (xi) information theft; (xii) damage to or
destruction or alteration of electronic information; (xiii) cyber extortion; (xiv) extortion
related to the Contractor's obligations under this Agreement regarding electronic
information, including Personal Information; (xv)fraudulent instruction; (xvi) funds
transfer fraud; (xvii) telephone fraud; (xviii) network security; (xix) data breach response
costs, including Security Breach response costs; (xx) regulatory fines and penalties
related to the Contractor's obligations under this Agreement regarding electronic
information, including Personal Information; and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the Contractor signs this Agreement,
and at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the Contractor shall deliver, or cause its
broker or producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th
Floor, Fresno, California 93721, or HRRiskManagement@fresnocountyca.gov, and by
mail or email to the person identified to receive notices under this Agreement,
certificates of insurance and endorsements for all of the coverages required under this
Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; (2) the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
Contractor has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
Contractor's policy.
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
(v) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
D-2
Exhibit D
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the Contractor.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the Contractor shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the Contractor shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the Contractor shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the Contractor or its insurer to timely provide a written notice required by
this paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the Contractor has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the Contractor shall deliver, or cause its broker or producer
to deliver, to the County's Risk Manager certificates of insurance and endorsements for
all of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The Contractor waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The Contractor is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the Contractor's waiver of subrogation under this paragraph is effective
whether or not the Contractor obtains such an endorsement.
(F) County's Remedy for Contractor's Failure to Maintain. If the Contractor fails to keep
in effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the Contractor. The County may offset such
charges against any amounts owed by the County to the Contractor under this
Agreement.
(G)Subcontractors. The Contractor shall require and verify that all subcontractors used by
the Contractor to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the Contractor to provide services under this Agreement using subcontractors.
D-3
Exhibit E
Confidentiality and Data Security
1. Definitions
13.16 Capitalized terms used in this Exhibit E have the meanings set forth in this section 1.
a. "Authorized Employees" means the Contractor's employees who have access to
Personal Information or Privileged Information.
b. "Authorized Persons" means: (i) any and all Authorized Employees; and (ii) any and all
of the Contractor's subcontractors, representatives, agents, outsourcers, and
consultants, and providers of professional services to the Contractor, who have access
to Personal Information and are bound by law or in writing by confidentiality obligations
sufficient to protect Personal Information in accordance with the terms of this Exhibit E.
c. "Director" means the County's Director Internal Services/Chief Information officer or
their designee.
d. "Disclose" or any derivative of that word means to disclose, release, transfer,
disseminate, or otherwise provide access to or communicate all or any part of any
Personal Information orally, in writing, or by electronic or any other means to any person.
e. "Person" means any natural person, corporation, partnership, limited liability company,
firm, or association.
f. "Personal Information" means any and all information, including any data, provided, or
to which access is provided, to the Contractor by or upon the authorization of the
County, under this Agreement, including but not limited to vital records, that: (i) identifies,
describes, or relates to, or is associated with, or is capable of being used to identify,
describe, or relate to, or associate with, a person (including, without limitation, names,
physical descriptions, signatures, addresses, telephone numbers, e-mail addresses,
education, financial matters, employment history, and other unique identifiers, as well as
statements made by or attributable to the person); (ii) is used or is capable of being used
to authenticate a person (including, without limitation, employee identification numbers,
government-issued identification numbers, passwords or personal identification numbers
(PINs), financial account numbers, credit report information, answers to security
questions, and other personal identifiers); or (iii) is personal information within the
meaning of California Civil Code section 1798.3, subdivision (a), or 1798.80, subdivision
(e). Personal Information does not include publicly available information that is lawfully
made available to the general public from federal, state, or local government records.
g. "Privacy Practices Complaint" means a complaint received by the County relating to
the Contractor's (or any Authorized Person's) privacy practices, or alleging a Security
Breach. Such complaint shall have sufficient detail to enable the Contractor to promptly
investigate and take remedial action under this Exhibit E.
h. "Privileged Information" means any and all information, including any data, provided,
or to which access is provided, to the Contractor by or upon the authorization of the
County or any attorney of the County, under this agreement, including but not limited to
any or all of the following: (i) records pertaining to pending litigation to which the County
E-1
Exhibit E
is party, or to claims made pursuant to the Government Claims Act (Gov. Code, Tit. 1,
Div. 3.6, beginning with section 810), until the pending litigation or claim has been finally
adjudicated or otherwise settled, which are exempt from disclosure under Government
Code section 6254, subdivision (b); (ii) any information that is subject to the attorney-
client privilege, which includes but is not limited to a "confidential communication
between client and lawyer," as that term is defined in Evidence Code section 952, where
the County is the client and any attorney of the County is the lawyer, and the Contractor
may be serving as a representative of the County, as an intermediate representative for
communication between the County and any attorney of the County, or both; or (iii) both
(i) and (ii).
For purposes of a "confidential communication between client and lawyer" under this
Agreement, the Contractor is presumed to be present to further the interest of the
County in its consultation with an attorney of the County, reasonably necessary for the
transmission of the information or the accomplishment of the purpose for which the
attorney of the County is consulted, or both.
The Contractor acknowledges that the attorney-client privilege protecting Privileged
Information belongs to the County and may only be waived by the County's Board of
Supervisors, and may not be waived by any other County official. The Contractor has no
right or authority to waive the attorney-client privilege that belongs to the County.
i. "Security Safeguards" means physical, technical, administrative or organizational
security procedures and practices put in place by the Contractor (or any Authorized
Persons) that relate to the protection of the security, confidentiality, value, or integrity of
Personal Information. Security Safeguards shall satisfy the minimal requirements set
forth in section 3(C) of this Exhibit E.
j. "Security Breach" means (i) any act or omission that compromises either the security,
confidentiality, value, or integrity of any Personal Information or the Security Safeguards,
or (ii) any unauthorized Use, Disclosure, or modification of, or any loss or destruction of,
or any corruption of or damage to, any Personal Information.
k. "Use" or any derivative of that word means to receive, acquire, collect, apply,
manipulate, employ, process, transmit, disseminate, access, store, disclose, or dispose
of Personal Information.
2. Standard of Care
a. The Contractor acknowledges that, in the course of its engagement by the County under
this Agreement, the Contractor, or any Authorized Persons, may Use Personal
Information and Privileged Information only as permitted in this Agreement.
b. The Contractor acknowledges that Personal Information and Privileged Information is
deemed to be confidential information of, or owned by, the County (or persons from
whom the County receives or has received Personal Information) and is not confidential
information of, or owned or by, the Contractor, or any Authorized Persons. The
Contractor further acknowledges that all right, title, and interest in or to the Personal
Information or the Privileged Information remains in the County (or persons from whom
the County receives or has received Personal Information or Privileged Information)
E-2
Exhibit E
regardless of the Contractor's, or any Authorized Person's, Use of that Personal
Information or that Privileged Information.
c. The Contractor agrees and covenants in favor of the Country that the Contractor shall:
i. keep and maintain all Personal Information and all Privileged Information in strict
confidence, using such degree of care under this section 2 as is reasonable and
appropriate to avoid a Security Breach;
ii. Use Personal Information exclusively for the purposes for which the Personal
Information is made accessible to the Contractor pursuant to the terms of this
Exhibit E;
iii. Use Privileged Information exclusively for the purposes for which the Privileged
Information is made accessible to the Contractor pursuant to the terms of this
Exhibit E;
iv. not Use, Disclose, sell, rent, license, or otherwise make available Personal
Information or Privileged Information for the Contractor's own purposes or for the
benefit of anyone other than the County, without the County's express prior
written consent, which the County may give or withhold in its sole and absolute
discretion;
V. not, directly or indirectly, Disclose Personal Information to any person (an
"Unauthorized Third Party") other than Authorized Persons pursuant to this
Agreement, without the express prior written consent the Director; and
vi. not, directly or indirectly, Disclose Privileged Information to any person (an
"Unauthorized Third Party") other than Authorized Persons pursuant to this
Agreement, without the express prior written consent of the County's Board of
Supervisors.
d. Notwithstanding the foregoing paragraph, in any case in which the Contractor believes it,
or any Authorized Person, is required to disclose Personal Information or Privileged
Information to government regulatory authorities, or pursuant to a legal proceeding, or
otherwise as may be required by applicable law, Contractor shall (i) immediately notify
the County of the specific demand for, and legal authority for the disclosure, including
providing County with a copy of any notice, discovery demand, subpoena, or order, as
applicable, received by the Contractor, or any Authorized Person, from any government
regulatory authorities, or in relation to any legal proceeding, and (ii) promptly notify the
County before such Personal Information is offered by the Contractor for such disclosure
so that the County may have sufficient time to obtain a court order or take any other
action the County may deem necessary to protect the Personal Information or the
Privileged Information from such disclosure, and the Contractor shall cooperate with the
County to minimize the scope of such disclosure of such Personal Information or
Privileged Information.
e. The Contractor shall remain liable to the County for the actions and omissions of any
Unauthorized Third Party concerning its Use of such Personal Information or Privileged
Information as if they were the Contractor's own actions and omissions.
E-3
Exhibit E
3. Information Security
a. The Contractor covenants, represents and warrants to the County that the Contractor's
Use of Personal Information and Privileged Information under this Agreement does and
will at all times comply with all applicable federal, state, and local, privacy and data
protection laws, as well as all other applicable regulations and directives, including but
not limited to California Civil Code, Division 3, Part 4, Title 1.81 (beginning with section
1798.80), and the Song-Beverly Credit Card Act of 1971 (California Civil Code, Division
3, Part 4, Title 1.3, beginning with section 1747). If the Contractor Uses credit, debit or
other payment cardholder information, the Contractor shall at all times remain in
compliance with the Payment Card Industry Data Security Standard ("PCI DSS")
requirements, including remaining aware at all times of changes to the PCI DSS and
promptly implementing and maintaining all procedures and practices as may be
necessary to remain in compliance with the PCI DSS, in each case, at the Contractor's
sole cost and expense.
b. The Contractor covenants, represents and warrants to the County that, as of the
effective date of this Agreement, the Contractor has not received notice of any violation
of any privacy or data protection laws, as well as any other applicable regulations or
directives, and is not the subject of any pending legal action or investigation by, any
government regulatory authority regarding same.
c. Without limiting the Contractor's obligations under section 3(A) of this Exhibit E, the
Contractor's (or Authorized Person's) Security Safeguards shall be no less rigorous than
accepted industry practices and, at a minimum, include the following:
i. limiting Use of Personal Information and Privileged Information strictly to the
Contractor's and Authorized Persons' personnel, including technical and
administrative personnel, who are necessary for the Contractor's or Authorized
Persons' Use of the Personal Information or Privileged pursuant to this
Agreement;
ii. ensuring that all of the Contractor's connectivity to County computing systems
will only be through the County's security gateways and firewalls, and only
through security procedures approved upon the express prior written consent of
the Director;
iii. to the extent that they contain or provide access to Personal Information or
Privileged Information, (a) securing business facilities, data centers, paper files,
servers, back-up systems and computing equipment, operating systems, and
software applications, including, but not limited to, all mobile devices and other
equipment, operating systems, and software applications with information
storage capability; (b) employing adequate controls and data security measures,
both internally and externally, to protect (1) the Personal Information and the
Privileged Information from potential loss or misappropriation, or unauthorized
Use, and (2) the County's operations from disruption and abuse; (c) having and
maintaining network, device application, database and platform security; (d)
maintaining authentication and access controls within media, computing
equipment, operating systems, and software applications; and (e) installing and
maintaining in all mobile, wireless, or handheld devices a secure internet
E-4
Exhibit E
connection, having continuously updated anti-virus software protection and a
remote wipe feature always enabled, all of which is subject to express prior
written consent of the Director;
iv. encrypting all Personal Information at advance encryption standards of Advanced
Encryption Standards (AES) of 128 bit or higher when Personal Information is (a)
stored on any mobile devices, including but not limited to hard disks, portable
storage devices, or remote installation, or (b) transmitted over public or wireless
networks (the encrypted Personal Information must be subject to password or
pass phrase, and be stored on a secure server and transferred by means of a
Virtual Private Network (VPN) connection, or another type of secure connection,
all of which is subject to express prior written consent of the Director);
V. strictly segregating Personal Information and Privileged Information from all other
information of the Contractor, including any Authorized Person, or anyone with
whom the Contractor or any Authorized Person deals so that Personal
Information and Privileged Information is not commingled with any other types of
information;
vi. having a patch management process including installation of all operating system
and software vendor security patches;
vii. maintaining appropriate personnel security and integrity procedures and
practices, including, but not limited to, conducting background checks of
Authorized Employees consistent with applicable law; and
viii. providing appropriate privacy and information security training to Authorized
Employees.
d. During the term of each Authorized Employee's employment by the Contractor, the
Contractor shall cause such Authorized Employees to abide strictly by the Contractor's
obligations under this Exhibit E. The Contractor shall maintain a disciplinary process to
address any unauthorized Use of Personal Information or Privileged Information by any
Authorized Employee.
e. The Contractor shall, in a secure manner, backup daily, or more frequently if it is the
Contractor's practice to do so more frequently, Personal Information and Privileged
Information received from the County, and the County shall have immediate, real time
access, at all times, to such backups via a secure, remote access connection provided
by the Contractor, through the Internet.
f. The Contractor shall provide the County with the name and contact information for each
Authorized Employee (including such Authorized Employee's work shift, and at least one
alternate Authorized Employee for each Authorized Employee during such work shift)
who shall serve as the County's primary security contact with the Contractor and shall be
available to assist the County twenty-four (24) hours per day, seven (7) days per week
as a contact in resolving the Contractor's and any Authorized Persons' obligations
associated with a Security Breach or a Privacy Practices Complaint.
g. The Contractor shall not knowingly include or authorize any Trojan Horse, back door,
time bomb, drop dead device, worm, virus, or other code of any kind that may disable,
E-5
Exhibit E
erase, display any unauthorized message within, or otherwise impair any County
computing system, with or without the intent to cause harm.
4. Security Breach Procedures
a. Immediately upon the Contractor's awareness or reasonable belief of a Security Breach,
the Contractor shall (i) notify the Director of the Security Breach, such notice to be given
first by telephone at the following telephone number, followed promptly by email at the
following email address: (559) 600-6200 / incidents@fresnocountyca.gov (which
telephone number and email address the County may update by providing notice to the
Contractor), and (ii) preserve all relevant evidence (and cause any affected Authorized
Person to preserve all relevant evidence) relating to the Security Breach. The notification
shall include, to the extent reasonably possible, the identification of each type and the
extent of Personal Information, Privileged Information, or both, that has been, or is
reasonably believed to have been, breached, including but not limited to, compromised,
or subjected to unauthorized Use, Disclosure, or modification, or any loss or destruction,
corruption, or damage.
b. Immediately following the Contractor's notification to the County of a Security Breach, as
provided pursuant to section 4(A) of this Exhibit E, the Parties shall coordinate with each
other to investigate the Security Breach. The Contractor agrees to fully cooperate with
the County, including, without limitation:
i. assisting the County in conducting any investigation;
ii. providing the County with physical access to the facilities and operations
affected;
iii. facilitating interviews with Authorized Persons and any of the Contractor's other
employees knowledgeable of the matter; and
iv. making available all relevant records, logs, files, data reporting and other
materials required to comply with applicable law, regulation, industry standards,
or as otherwise reasonably required by the County.
To that end, the Contractor shall, with respect to a Security Breach, be solely
responsible, at its cost, for all notifications required by law and regulation, or deemed
reasonably necessary by the County, and the Contractor shall provide a written report of
the investigation and reporting required to the Director within 30 days after the
Contractor's discovery of the Security Breach.
c. County shall promptly notify the Contractor of the Director's knowledge, or reasonable
belief, of any Privacy Practices Complaint, and upon the Contractor's receipt of that
notification, the Contractor shall promptly address such Privacy Practices Complaint,
including taking any corrective action under this Exhibit E, all at the Contractor's sole
expense, in accordance with applicable privacy rights, laws, regulations and standards.
In the event the Contractor discovers a Security Breach, the Contractor shall treat the
Privacy Practices Complaint as a Security Breach. Within 24 hours of the Contractor's
E-6
Exhibit E
receipt of notification of such Privacy Practices Complaint, the Contractor shall notify the
County whether the matter is a Security Breach, or otherwise has been corrected and
the manner of correction, or determined not to require corrective action and the reason
for that determination.
d. The Contractor shall take prompt corrective action to respond to and remedy any
Security Breach and take mitigating actions, including but not limiting to, preventing any
reoccurrence of the Security Breach and correcting any deficiency in Security
Safeguards as a result of such incident, all at the Contractor's sole expense, in
accordance with applicable privacy rights, laws, regulations and standards. The
Contractor shall reimburse the County for all reasonable costs incurred by the County in
responding to, and mitigating damages caused by, any Security Breach, including all
costs of the County incurred relation to any litigation or other action described section
4(E) of this Exhibit E.
e. The Contractor agrees to cooperate, at its sole expense, with the County in any litigation
or other action to protect the County's rights relating to Personal Information, Privileged
Information, or both, including the rights of persons from whom the County receives
Personal Information.
5. Oversight of Security Compliance
a. The Contractor shall have and maintain a written information security policy that
specifies Security Safeguards appropriate to the size and complexity of the Contractor's
operations and the nature and scope of its activities.
b. Upon the County's written request, to confirm the Contractor's compliance with this
Exhibit E, as well as any applicable laws, regulations and industry standards, the
Contractor grants the County or, upon the County's election, a third party on the
County's behalf, permission to perform an assessment, audit, examination or review of
all controls in the Contractor's physical and technical environment in relation to all
Personal Information and Privileged Information that is Used by the Contractor pursuant
to this Agreement. The Contractor shall fully cooperate with such assessment, audit or
examination, as applicable, by providing the County or the third party on the County's
behalf, access to all Authorized Employees and other knowledgeable personnel,
physical premises, documentation, infrastructure and application software that is Used
by the Contractor for Personal Information, Privileged Information, or both, pursuant to
this Agreement. In addition, the Contractor shall provide the County with the results of
any audit by or on behalf of the Contractor that assesses the effectiveness of the
Contractor's information security program as relevant to the security and confidentiality
of Personal Information Used by the Contractor or Authorized Persons during the course
of this Agreement under this Exhibit E.
c. The Contractor shall ensure that all Authorized Persons who Use Personal Information,
Privileged Information, or both, agree to the same restrictions and conditions in this
Exhibit E. that apply to the Contractor with respect to such Personal Information and
Privileged Information by incorporating the relevant provisions of this Exhibit E into a
valid and binding written agreement between the Contractor and such Authorized
Persons, or amending any written agreements to provide same.
E-7
Exhibit E
6. Return or Destruction of Personal Information. Upon the termination of this
Agreement, the Contractor shall, and shall instruct all Authorized Persons to, promptly return to
the County all Personal Information and all Privileged Information, whether in written, electronic
or other form or media, in its possession or the possession of such Authorized Persons, in a
machine readable form used by the County at the time of such return, or upon the express prior
written consent of the Director, securely destroy all such Personal Information and all Privileged
Information, and certify in writing to the County that such Personal Information and Privileged
Information have been returned to the County or disposed of securely, as applicable. If the
Contractor is authorized to dispose of any such Personal Information or Privileged Information,
as provided in this Exhibit E, such certification shall state the date, time, and manner (including
standard) of disposal and by whom, specifying the title of the individual. The Contractor shall
comply with all reasonable directions provided by the Director with respect to the return or
disposal of Personal Information and Privileged Information and copies of Personal Information
and Privileged Information. If return or disposal of such Personal Information or Privileged
Information, or copies of Personal Information or Privileged Information, is not feasible, the
Contractor shall notify the County according, specifying the reason, and continue to extend the
protections of this Exhibit E to all such Personal Information and Privileged Information, and
copies of Personal Information and Privileged Information. The Contractor shall not retain any
copy of any Personal Information or any Privileged Information after returning or disposing of
Personal Information and Privileged Information as required by this section 6. The Contractor's
obligations under this section 6 survive the termination of this Agreement and apply to all
Personal Information and Privileged Information that the Contractor retains if return or disposal
is not feasible and to all Personal Information and Privileged Information that the Contractor
may later discover in its possession or control.
7. Equitable Relief. The Contractor acknowledges that any breach of its covenants or
obligations set forth in this Exhibit E may cause the County irreparable harm for which monetary
damages would not be adequate compensation and agrees that, in the event of such breach or
threatened breach, the County is entitled to seek equitable relief, including a restraining order,
injunctive relief, specific performance and any other relief that may be available from any court,
in addition to any other remedy to which the County may be entitled at law or in equity. Such
remedies shall not be deemed to be exclusive but shall be in addition to all other remedies
available to the County at law or in equity or under this Agreement.
8. Indemnity. The Contractor shall defend, indemnify and hold harmless the County, its
officers, employees, and agents, (each, a "County Indemnitee") from and against any and all
infringement of intellectual property including, but not limited to infringement of copyright,
trademark, and trade dress, invasion of privacy, information theft, and extortion, unauthorized
Use, Disclosure, or modification of, or any loss or destruction of, or any corruption of or damage
to, Personal Information or Privileged Information, Security Breach response and remedy costs,
credit monitoring expenses, forfeitures, losses, damages, liabilities, deficiencies, actions,
judgments, interest, awards, fines and penalties (including regulatory fines and penalties), costs
or expenses of whatever kind, including attorneys' fees and costs, the cost of enforcing any right
to indemnification or defense under this Exhibit E and the cost of pursuing any insurance
providers, arising out of or resulting from any third party claim or action against any County
Indemnitee in relation to the Contractor's, its officers, employees, or agents, or any Authorized
Employee's or Authorized Person's, performance or failure to perform under this Exhibit E or
E-8
Exhibit E
arising out of or resulting from the Contractor's failure to comply with any of its obligations under
this section 8. The provisions of this section 8 do not apply to the acts or omissions of the
County. The provisions of this section 8 are cumulative to any other obligation of the Contractor
to, defend, indemnify, or hold harmless any County Indemnitee under this Agreement. The
provisions of this section 8 shall survive the termination of this Agreement.
9. Survival. The respective rights and obligations of the Contractor and the County as
stated in this Exhibit E shall survive the termination of this Agreement.
10. No Third Party Beneficiary. Nothing express or implied in the provisions of in this
Exhibit E is intended to confer, nor shall anything in this Exhibit E confer, upon any person other
than the County or the Contractor and their respective successors or assignees, any rights,
remedies, obligations or liabilities whatsoever.
11. No County Warranty. The County does not make any warranty or representation
whether any Personal Information or Privileged Information in the Contractor's (or any
Authorized Person's) possession or control, or Use by the Contractor (or any Authorized
Person), pursuant to the terms of this Agreement is or will be secure from unauthorized Use, or
a Security Breach or Privacy Practices Complaint.
E-9
Exhibit F
Health Insurance Portability and Accountability Act
1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as
these terms are defined by 45 CFR 160.103. In connection with providing services under the
Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health
Information ("PHI")from or on behalf of the County. The parties enter into this Business Associate
Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to govern the
use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security,
Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
The parties to this Agreement shall be in strict conformance with all
applicable federal and State of California laws and regulations, including, but not limited to
California Welfare and Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42
CFR 431; California Civil Code section 56 et seq.; the Health Insurance Portability and
Accountability Act of 1996, as amended ("HIPAK), including, but not limited to, 45 CFR Parts160,
45 CFR 162, and 45 CFR 164; the Health Information Technology for Economic and Clinical
Health Act ("HITECH") regarding the confidentiality and security of patient information, including,
but not limited to 42 USC 17901 et seq.; and the Genetic Information Nondiscrimination Act
("GINX) of 2008 regarding the confidentiality of genetic information.
Except as otherwise provided in this Agreement, the Contractor, as a business associate
of the County, may use or disclose Protected Health Information ("PHI") to perform functions,
activities or services for or on behalf of the County, as specified in this Agreement, provided that
such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of PHI may not
be more expansive than those applicable to the County, as the "Covered Entity" under the
HIPAA Rules, except as authorized for management, administrative or legal responsibilities of
the Contractor.
2. The Contractor, including its subcontractors and employees, shall protect from
unauthorized access, use, or disclosure of names and other identifying information, including
genetic information, concerning persons receiving services pursuant to this Agreement, except
where permitted in order to carry out data aggregation purposes for health care operations [45
CFR§§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all
persons receiving services pursuant to a County-funded program. This requirement applies to
electronic PHI. The Contractor shall not use such identifying information or genetic information for
any purpose other than carrying out the Contractor's obligations under this Agreement.
3. The Contractor, including its subcontractors and employees, shall not disclose any
such identifying information or genetic information to any person or entity, except as otherwise
specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law,
required by the Secretary of the United States Department of Health and Human Services
("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is
permitted by this Agreement or authorized by law, the Contractor shall make reasonable efforts to
limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request.
4. For purposes of the above sections, identifying information shall include, but not be
limited to, name, identifying number, symbol, or other identifying particular assigned to the
individual, such as fingerprint or voiceprint, or photograph.
F-1
Exhibit F
5. For purposes of the above sections, genetic information shall include genetic tests
of family members of an individual or individual(s), manifestation of disease or disorder of family
members of an individual, or any request for or receipt of genetic services by individual or family
members. Family member means a dependent or any person who is first, second, third, or fourth
degree relative.
6. The Contractor shall provide access, at the request of the County, and in the time
and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR §
164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR§ 164.524
regarding access by individuals to their PHI. With respect to individual requests, access shall be
provided within thirty (30) days from request. Access may be extended if the Contractor cannot
provide access and provides the individual with the reasons for the delay and the date when
access may be granted. PHI shall be provided in the form and format requested by the individual
or the County.
The Contractor shall make any amendment(s) to PHI in a designated record set at the
request of the County or individual, and in the time and manner designated by the County in
accordance with 45 CFR § 164.526.
The Contractor shall provide to the County or to an individual, in a time and manner
designated by the County, information collected in accordance with 45 CFR § 164.528, to permit
the County to respond to a request by the individual for an accounting of disclosures of PHI in
accordance with 45 CFR § 164.528.
7. The Contractor shall report to the County, in writing, any knowledge or
reasonable belief that there has been unauthorized access, viewing, use, disclosure, security
incident, or breach of unsecured PHI not permitted by this Agreement of which the Contractor
becomes aware, immediately and without reasonable delay and in no case later than two (2)
business days of discovery. Immediate notification shall be made to the County's Information
Security Officer and Privacy Officer and the County's Department of Public Health ("DPH")
HIPAA Representative, within two (2) business days of discovery. The notification shall include,
to the extent possible, the identification of each individual whose unsecured PHI has been, or is
reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
Contractor shall take prompt corrective action to cure any deficiencies and any action pertaining
to such unauthorized disclosure required by applicable federal and State laws and regulations.
The Contractor shall investigate such breach and is responsible for all notifications required by
law and regulation or deemed necessary by the County and shall provide a written report of the
investigation and reporting required to the County's Information Security Officer and Privacy
Officer and the County's DPH HIPAA Representative.
This written investigation and description of any reporting necessary shall be
postmarked within the thirty (30) working days of the discovery of the breach to the addresses
below:
County of Fresno County of Fresno County of Fresno
Department of Public Health Department of Public Health Department of Internal
HIPAA Representative Privacy Officer Services
(559) 600-6439 (559) 600-6405 Information Security Officer
P.O. Box 11867 P.O. Box 11867 (559) 600-5800
Fresno, California 93775 Fresno, California 93775 2048 North Fine Street
F-2
Exhibit F
Fresno, California 93727
8. The Contractor shall make its internal practices, books, and records relating to
the use and disclosure of PHI received from the County, or created or received by the
Contractor on behalf of the County, in compliance with Parts the HIPAA Rules. The Contractor
shall make its internal practices, books, and records relating to the use and disclosure of PHI
received from the County, or created or received by the Contractor on behalf of the County,
available to the Secretary upon demand.
The Contractor shall cooperate with the compliance and investigation reviews conducted
by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal
business hours; however, upon exigent circumstances access at any time must be granted.
Upon the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor
and in possession of a subcontractor of the Contractor, the Contractor must certify to the
Secretary its efforts to obtain the information from the subcontractor.
9. Safeguards
The Contractor shall implement administrative, physical, and technical safeguards as
required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
this Agreement. The Contractor shall conduct an accurate and thorough assessment of the
potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI.
The Contractor shall develop and maintain a written information privacy and security program
that includes administrative, technical and physical safeguards appropriate to the size and
complexity of the Contractor's operations and the nature and scope of its activities. Upon the
County's request, the Contractor shall provide the County with information concerning such
safeguards.
The Contractor shall implement strong access controls and other security safeguards
and precautions in order to restrict logical and physical access to confidential, personal (e.g.,
PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include
the following administrative and technical password controls for all systems used to process or
store confidential, personal, or sensitive data:
A. Passwords must not be:
(1) Shared or written down where they are accessible or recognizable by anyone
else; such as taped to computer screens, stored under keyboards, or visible
in a work area;
(2) A dictionary word; or
(3) Stored in clear text
B. Passwords must be:
(1) Eight (8) characters or more in length;
(2) Changed every ninety (90) days;
(3) Changed immediately if revealed or compromised; and
(4) Composed of characters from at least three (3) of the following four (4)
groups from the standard keyboard:
a) Upper case letters (A-Z);
F-3
Exhibit F
b) Lowercase letters (a-z);
c) Arabic numerals (0 through 9); and
d) Non-alphanumeric characters (punctuation symbols).
The Contractor shall implement the following security controls on each workstation or
portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
3. Patch management process including installation of all operating system/software
vendor security patches.
The Contractor shall utilize a commercial encryption solution that has received FIPS
140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
electronic media (including, but not limited to, compact disks and thumb drives) and on portable
computing devices (including, but not limited to, laptop and notebook computers).
The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or
other internet transport protocol unless the data is encrypted by a solution that has been
validated by the National Institute of Standards and Technology (NIST) as conforming to the
Advanced Encryption Standard (AES) Algorithm. The Contractor must apply appropriate
sanctions against its employees who fail to comply with these safeguards. The Contractor must
adopt procedures for terminating access to PHI when employment of employee ends.
10. Mitigation of Harmful Effects
The Contractor shall mitigate, to the extent practicable, any harmful effect that is
suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or
breach of PHI by the Contractor or its subcontractors in violation of the requirements of these
provisions. The Contractor must document suspected or known harmful effects and the
outcome.
11. The Contractor's Subcontractors
The Contractor shall ensure that any of its contractors, including subcontractors, if
applicable, to whom the Contractor provides PHI received from or created or received by the
Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions
that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the
relevant provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
Nothing in this section 11 or this Exhibit F authorizes the Contractor to perform services
under this Agreement using subcontractors.
12. Employee Training and Discipline
The Contractor shall train and use reasonable measures to ensure compliance with the
requirements of these provisions by employees who assist in the performance of functions or
activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
such employees who intentionally violate any provisions of these provisions, which may include
termination of employment.
13. Termination for Cause
Upon the County's knowledge of a material breach of these provisions by the Contractor,
the County will either:
F-4
Exhibit F
A. Provide an opportunity for the Contractor to cure the breach or end the
violation, and the County may terminate this Agreement if the Contractor does not cure the
breach or end the violation within the time specified by the County; or
B. Immediately terminate this Agreement if the Contractor has breached a
material term of this Exhibit F and cure is not possible, as determined by the County.
C. If neither cure nor termination is feasible, the County's Privacy Officer will
report the violation to the Secretary of the U.S. Department of Health and Human Services.
14. Judicial or Administrative Proceedings
The County may terminate this Agreement if: (1) the Contractor is found guilty in a
criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or
(2) there is a finding or stipulation in an administrative or civil proceeding in which the Contractor
is a party that the Contractor has violated a privacy or security standard or requirement of the
HITECH Act, HIPAA or other security or privacy laws.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, the Contractor shall
return or destroy all PHI received from the County (or created or received by the Contractor on
behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of
such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend
the protections of these provisions to such information, and limit further use of such PHI to those
purposes that make the return or destruction of such PHI infeasible. This provision applies to
PHI that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the
Contractor destroys the PHI data, a certification of date and time of destruction shall be
provided to the County by the Contractor.
16. Compliance with Other Laws
13.17 To the extent that other state and/or federal laws provide additional, stricter
and/or more protective privacy and/or security protections to PHI or other confidential
information covered under this BAA, the Contractor agrees to comply with the more protective of
the privacy and security standards set forth in the applicable state or federal laws to the extent
such standards provide a greater degree of protection and security than HIPAA Rules or are
otherwise more favorable to the individual.
17. Disclaimer
The County makes no warranty or representation that compliance by the Contractor with
these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
Contractor's own purposes or that any information in the Contractor's possession or control, or
transmitted or received by the Contractor, is or will be secure from unauthorized access,
viewing, use, disclosure, or breach. The Contractor is solely responsible for all decisions made
by the Contractor regarding the safeguarding of PHI.
18. Amendment
The parties acknowledge that Federal and State laws relating to electronic data security
and privacy are rapidly evolving and that amendment of this Exhibit F may be required to
provide for procedures to ensure compliance with such developments. The parties specifically
agree to take such action as is necessary to amend this agreement in order to implement the
standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws
relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty
F-5
Exhibit F
(30) days written notice in the event that the Contractor does not enter into an amendment
providing assurances regarding the safeguarding of PHI that the County in its sole discretion,
deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the
HITECH Act.
19. No Third-Party Beneficiaries
Nothing expressed or implied in the provisions of this Exhibit F is intended to confer, and
nothing in this Exhibit F does confer, upon any person other than the County or the Contractor
and their respective successors or assignees, any rights, remedies, obligations or liabilities
whatsoever.
20. Interpretation
The provisions of this Exhibit F shall be interpreted as broadly as necessary to
implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that
any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a
meaning that complies and is consistent with the HIPAA Rules.
21. Regulatory References
A reference in the terms and conditions of these provisions to a section in the HIPAA
Rules means the section as in effect or as amended.
22. Survival
The respective rights and obligations of the Contractor as stated in this Exhibit F survive
the termination or expiration of this Agreement.
23. No Waiver of Obligation
Change, waiver or discharge by the County of any liability or obligation of the Contractor
under this Exhibit F on any one or more occasions is not a waiver of performance of any
continuing or other obligation of the Contractor and does not prohibit enforcement by the County
of any obligation on any other occasion.
F-6