HomeMy WebLinkAboutAgreement A-23-085 with FirstWatch Solutions Inc..pdf Agreement No. 23-085
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated February 28, 2023 and is between
3 FirstWatch Solutions, Inc., a California corporation ("Contractor"), and the County of Fresno, a
4 political subdivision of the State of California ("County").
5 Recitals
6 A. The County's Department of Public Health, Emergency Medical Services (EMS) requires
7 software that can monitor and report on response compliance of all ambulance and fire
8 agencies, as well as to allow real-time systems to surveil evolving hazardous events.
9 B. The Contractor is a provider of data monitoring and bio-surveillance software and related
10 services to organizations and agencies in the fields of public health and public safety.
11 C. The County authorized a sole source acquisition to procure products and services with
12 the Contractor.
13 D. The County and the Contractor desire to execute this Agreement for software licenses,
14 maintenance, support, and related services.
15 The parties therefore agree as follows:
16 Article 1
17 Contractor's Services
18 1.1 Scope of Services. The Contractor shall perform all of the services provided in
19 Exhibit A to this Agreement, titled "Scope of Services."
20 1.2 Representation. The Contractor represents that it is qualified, ready, willing, and
21 able to perform all of the services provided in this Agreement.
22 1.3 Compliance with Laws. The Contractor shall, at its own cost, comply with all
23 applicable federal, state, and local laws and regulations in the performance of its obligations
24 under this Agreement, including but not limited to workers compensation, labor, and
25 confidentiality laws and regulations.
26
27
28
1
1 Article 2
2 County's Responsibilities
3 2.1 The County will cooperate with Contractor as reasonably necessary, upon
4 Contractor's request, for Contractor to perform its obligations under this Agreement.
5 2.2 The County shall compensate the Contractor as provided in Article 3.
6 Article 3
7 Compensation, Invoices, and Payments
8 3.1 The County agrees to pay, and the Contractor agrees to receive, compensation for
9 the performance of its services under this Agreement as described in Exhibit B to this
10 Agreement, titled "Compensation."
11 3.2 Maximum Compensation. The maximum compensation payable to the Contractor
12 under this Agreement is $346,000.00 for the initial term of the Agreement. If this Agreement is
13 extended to Year 4, in no event shall compensation for the potential four-year term exceed
14 $399,000.00. If this Agreement is extended to Year 5, in no event shall compensation for the
15 total potential five-year term exceed $454,000.00. The Contractor acknowledges that the
16 County is a local government entity, and does so with notice that the County's powers are
17 limited by the California Constitution and by State law, and with notice that the Contractor may
18 receive compensation under this Agreement only for services performed according to the terms
19 of this Agreement and while this Agreement is in effect, and subject to the maximum amount
20 payable under this section. The Contractor further acknowledges that County employees have
21 no authority to pay the Contractor except as expressly provided in this Agreement.
22 3.3 Invoices. The Contractor shall submit invoices to the County of Fresno Department
23 of Public Health — Emergency Services Division, PO Box 11867, Fresno, CA 93755,
24 DPHBOAP@fresnocountyca.gov. The Contractor shall submit each invoice within 60 days after
25 the month in which the Contractor performs services and in any case within 60 days after the
26 end of the term or termination of this Agreement.
27
28
2
1 3.4 Payment. The County shall pay each correctly completed and timely submitted
2 invoice within 45 days after receipt. The County shall remit any payment to the Contractor's
3 address specified in the invoice.
4 3.5 Incidental Expenses. The Contractor is solely responsible for all of its costs and
5 expenses that are not specified as payable by the County under this Agreement.
6 Article 4
7 Term of Agreement
8 4.1 Term. This Agreement is effective on March 1, 2023 and terminates on February 28,
9 2026, except as provided in section 4.2, "Extension," or Article 6, "Termination and Suspension,"
10 below.
11 4.2 Extension. The term of this Agreement may be extended for no more than two, one-
12 year periods only upon written approval of both parties at least 30 days before the first day of
13 the next one-year extension period. The Director of Public Health or the Director of Internal
14 Service/Chief Information Officer, or their respective designees, are authorized to sign the
15 written approval on behalf of the County based on the Contractor's satisfactory performance.
16 The extension of this Agreement by the County is not a waiver or compromise of any default or
17 breach of this Agreement by the Contractor existing at the time of the extension whether or not
18 known to the County.
19 4.3 If within 90 days after Acceptance, as defined in Exhibit A, for any reason, the
20 County is not satisfied with the Software, the County may elect to return the Software and
21 receive a full refund of all Software license fees paid to the Contractor.
22 Article 5
23 Notices
24 5.1 Contact Information. The persons and their addresses having authority to give and
25 receive notices provided for or permitted under this Agreement include the following:
26
For the County:
27 Director of Internal Services/Chief Information Officer
County of Fresno
28 333 W. Pontiac Way
Clovis, CA 93612
3
1 Email: ISDContracts(a)fresnocountyca.gov
2 For the Contractor:
President
3 FirstWatch Solutions, Inc.
1930 Palomar Point Way, Suite 101
4 Carlsbad, CA 92008
Phone: (760) 943-9123
5 Fax: (760) 942-8329
Email• atch.net
6
5.2 Change of Contact Information. Either party may change the information in section
7
5.1 by giving notice as provided in section 5.3.
8
5.3 Method of Delivery. Each notice between the County and the Contractor provided
9
for or permitted under this Agreement must be in writing, state that it is a notice provided under
10
this Agreement, and be delivered either by personal service, by first-class United States mail, by
11
an overnight commercial courier service, by telephonic facsimile transmission, or by Portable
12
Document Format (PDF) document attached to an email.
13
(A) A notice delivered by personal service is effective upon service to the recipient.
14
(B) A notice delivered by first-class United States mail is effective three County
15
business days after deposit in the United States mail, postage prepaid, addressed to the
16
recipient.
17
(C)A notice delivered by an overnight commercial courier service is effective one
18
County business day after deposit with the overnight commercial courier service,
19
delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
20
the recipient.
21
(D)A notice delivered by telephonic facsimile transmission or by PDF document
22
attached to an email is effective when transmission to the recipient is completed (but, if
23
such transmission is completed outside of County business hours, then such delivery is
24
deemed to be effective at the next beginning of a County business day), provided that
25
the sender maintains a machine record of the completed transmission.
26
5.4 Claims Presentation. For all claims arising from or related to this Agreement,
27
nothing in this Agreement establishes, waives, or modifies any claims presentation
28
4
1 requirements or procedures provided by law, including the Government Claims Act (Division 3.6
2 of Title 1 of the Government Code, beginning with section 810).
3 Article 6
4 Termination and Suspension
5 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
6 contingent on the approval of funds by the appropriating government agency. If sufficient funds
7 are not allocated, then the County, upon at least 30 days' advance written notice to the
8 Contractor, may:
9 (A) Modify the services provided by the Contractor under this Agreement; or
10 (B) Terminate this Agreement.
11 6.2 Termination for Breach.
12 (A) Upon determining that a breach (as defined in paragraph (C) below) has
13 occurred, the County may give written notice of the breach to the Contractor. The written
14 notice may suspend performance under this Agreement, and must provide at least 30
15 days for the Contractor to cure the breach.
16 (B) If the Contractor fails to cure the breach to the County's satisfaction within the
17 time stated in the written notice, the County may terminate this Agreement immediately.
18 (C) For purposes of this section, a breach occurs when, in the determination of the
19 County, the Contractor has:
20 (1) Obtained or used funds illegally or improperly;
21 (2) Failed to comply with any part of this Agreement;
22 (3) Submitted a substantially incorrect or incomplete report to the County; or
23 (4) Improperly performed any of its obligations under this Agreement.
24 6.3 Termination without Cause. In circumstances other than those set forth above, the
25 County may terminate this Agreement by giving at least 30 days advance written notice to the
26 Contractor.
27 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
28 under this Article 6 is without penalty to or further obligation of the County.
5
1 6.5 County's Rights upon Termination. Upon termination for breach under this Article
2 6, the County may demand repayment by the Contractor of any monies disbursed to the
3 Contractor under this Agreement that, in the County's sole judgment, were not expended in
4 compliance with this Agreement. The Contractor shall promptly refund all such monies upon
5 demand. This section survives the termination of this Agreement.
6 Article 7
7 Independent Contractor
8 7.1 Status. In performing under this Agreement, the Contractor, including its officers,
9 agents, employees, and volunteers, is at all times acting and performing as an independent
10 contractor, in an independent capacity, and not as an officer, agent, servant, employee, joint
11 venturer, partner, or associate of the County.
12 7.2 Verifying Performance. The County has no right to control, supervise, or direct the
13 manner or method of the Contractor's performance under this Agreement, but the County may
14 verify that the Contractor is performing according to the terms of this Agreement.
15 7.3 Benefits. Because of its status as an independent contractor, the Contractor has no
16 right to employment rights or benefits available to County employees. The Contractor is solely
17 responsible for providing to its own employees all employee benefits required by law. The
18 Contractor shall save the County harmless from all matters relating to the payment of
19 Contractor's employees, including compliance with Social Security withholding and all related
20 regulations.
21 7.4 Services to Others. The parties acknowledge that, during the term of this
22 Agreement, the Contractor may provide services to others unrelated to the County.
23 Article 8
24 Indemnity and Defense
25 8.1 Indemnity. The Contractor shall indemnify and hold harmless and defend the
26 County (including its officers, agents, employees, and volunteers) against all claims, demands,
27 injuries, damages, costs, expenses (including attorney fees and costs), fines, penalties, and
28 liabilities of any kind to the County, the Contractor, or any third party that arise from or relate to
6
1 the performance or failure to perform by the Contractor (or any of its officers, agents,
2 subcontractors, or employees) under this Agreement. The County may conduct or participate in
3 its own defense without affecting the Contractor's obligation to indemnify and hold harmless or
4 defend the County.
5 8.2 Survival. This Article 8 survives the termination of this Agreement.
6 Article 9
7 Limited Warranties, Exclusions, and Limitation of Liability
8 9.1 The Contractor warrants that during the Acceptance testing period, which takes
9 place within thirty (30) calendar days from base system installation, and while the County is
10 receiving covered Maintenance Services per Exhibit A of this Agreement, the Software will
11 perform in conformance with the Contractor's Acceptance Test Plan ("ATP"), defined in Exhibit
12 A as the Contractor's plan for testing the system against predefined acceptance criteria
13 provided that the Software has been used as specified under this Agreement. If the Software
14 does not perform for reasons inherent in the Software (and not, for example, third part
15 hardware, software, equipment, or system configuration), the Contractor shall use its best
16 efforts to correct any material nonconformance within 10 business days after receipt of written
17 notice of such nonconformance and the County's provision of any data, output, or other
18 documentation or description of the nonconformance.
19 9.2 The limited software warranty applies only to Software used in accordance with the
20 Agreement and does not apply if the Software media or Software code has been subject to
21 accident, misuse, or modification by a party other than the Contractor or as authorized by the
22 Contractor.
23 9.3 The Contractor does not warrant that the functions contained in the Software will
24 meet the County's specific needs, industry requirements, be error-free, or operate without
25 interruption. The remedies in this Article 9 are the sole and exclusive remedies provided by the
26 Contractor relating to the Software.
27 9.4 THESE LIMITED WARRANTIES ARE IN LIEU OF, AND THE COUNTY HEREBY
28 WAIVES, ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT
7
1 LIMITATION, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
2 PURPOSE.
3 Article 10
4 Insurance
5 10.1 The Contractor shall comply with all the insurance requirements in Exhibit D to this
6 Agreement.
7 Article 11
8 Confidentiality and Ownership of Data
9 11.1 Confidentiality. The County and the Contractor may have access to information that
10 the other considers to be confidential, private, or a trade secret, only if necessary in furtherance
11 of this Agreement. This information may include, but is not limited to, patient or other data, the
12 Software, technical know-how, technical specifications, software code, manners of conducting
13 business and operations, strategic business plans, systems, results of testing, financial
14 information, and third-party information ("Information").
15 11.2 Each party shall use the other's Information only to perform its obligations under, and
16 for the purposes of, the Agreement. Neither party shall use the Information of the other for the
17 benefit or interest of a third party. Each party shall maintain the confidentiality of all Information
18 in the same manner in which it protects its own information of like kind, but in no event shall
19 either party take less than reasonable precautions to prevent the unauthorized disclosure or use
20 of the Information.
21 11.3 Upon termination of the Agreement, or upon a party's request, each party shall return
22 to the other all Information of the other in its possession. All provisions of the Agreement relating
23 to confidentiality, ownership, and limitations of liability shall survive the termination of the
24 Agreement.
25 11.4 Ownership of Data. The parties acknowledge and agree that all the County's data
26 ("Data"), is and shall remain the exclusive property of the County. The Contractor acknowledges
27 that in performing its obligations under the Agreement it may have access to the County's
28
8
1 networks and Data. The Contractor shall use and access such Data only as necessary for the
2 purpose of providing the services and supporting the Software as agreed, and subject to 11.3.
3 Article 12
4 Health Insurance Portability and Accountability Act
5 12.1 HIPAA. See Exhibit E to this Agreement, titled, "Health Insurance Portability and
6 Accountability Act (HIPAA)".
7 Article 13
8 Inspections, Audits, and Public Records
9 13.1 Inspection of Documents. Upon reasonable notice, the Contractor shall make
10 available to the County, and the County, at its own expense, may examine at any time during
11 business hours and as often as the County deems necessary, all of the Contractor's records
12 and data with respect to the matters covered by this Agreement, excluding attorney-client
13 privileged communications. The Contractor shall, upon request by the County, permit the
14 County to audit and inspect all of such records and data to ensure the Contractor's compliance
15 with the terms of this Agreement.
16 13.2 State Audit Requirements. If the compensation to be paid by the County under this
17 Agreement exceeds $10,000, the Contractor is subject to the examination and audit of the
18 California State Auditor, as provided in Government Code section 8546.7, for a period of three
19 years after final payment under this Agreement. This section survives the termination of this
20 Agreement.
21 13.3 Public Records. The County is not limited in any manner with respect to its public
22 disclosure of this Agreement or any record or data that the Contractor may provide to the
23 County. The County's public disclosure of this Agreement or any record or data that the
24 Contractor may provide to the County may include but is not limited to the following:
25 (A) The County may voluntarily, or upon request by any member of the public or
26 governmental agency, disclose this Agreement to the public or such governmental
27 agency.
28
9
1 (B) The County may voluntarily, or upon request by any member of the public or
2 governmental agency, disclose to the public or such governmental agency any record or
3 data that the Contractor may provide to the County, unless such disclosure is prohibited
4 by court order.
5 (C)This Agreement, and any record or data that the Contractor may provide to the
6 County, is subject to public disclosure under the Ralph M. Brown Act (California
7 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
8 (D)This Agreement, and any record or data that the Contractor may provide to the
9 County, is subject to public disclosure as a public record under the California Public
10 Records Act (California Government Code, Title 1, Division 7, Chapter 3.5, beginning
11 with section 6250) ("CPRA").
12 (E) This Agreement, and any record or data that the Contractor may provide to the
13 County, is subject to public disclosure as information concerning the conduct of the
14 people's business of the State of California under California Constitution, Article 1,
15 section 3, subdivision (b).
16 (F) Any marking of confidentiality or restricted access upon or otherwise made with
17 respect to any record or data that the Contractor may provide to the County shall be
18 disregarded and have no effect on the County's right or duty to disclose to the public or
19 governmental agency any such record or data.
20 13.4 Public Records Act Requests. If the County receives a written or oral request
21 under the CPRA to publicly disclose any record that is in the Contractor's possession or control,
22 and which the County has a right, under any provision of this Agreement or applicable law, to
23 possess or control, then the County may demand, in writing, that the Contractor deliver to the
24 County, for purposes of public disclosure, the requested records that may be in the possession
25 or control of the Contractor. Within five business days after the County's demand, the
26 Contractor shall (a) deliver to the County all of the requested records that are in the Contractor's
27 possession or control, together with a written statement that the Contractor, after conducting a
28 diligent search, has produced all requested records that are in the Contractor's possession or
10
1 control, or (b) provide to the County a written statement that the Contractor, after conducting a
2 diligent search, does not possess or control any of the requested records. The Contractor shall
3 cooperate with the County with respect to any County demand for such records. If the
4 Contractor wishes to assert that any specific record or data is exempt from disclosure under the
5 CPRA or other applicable law, it must deliver the record or data to the County and assert the
6 exemption by citation to specific legal authority within the written statement that it provides to
7 the County under this section. The Contractor's assertion of any exemption from disclosure is
8 not binding on the County, but the County will give at least 10 days' advance written notice to
9 the Contractor before disclosing any record subject to the Contractor's assertion of exemption
10 from disclosure. The Contractor shall indemnify the County for any court-ordered award of costs
11 or attorney's fees under the CPRA that results from the Contractor's delay, claim of exemption,
12 failure to produce any such records, or failure to cooperate with the County with respect to any
13 County demand for any such records.
14 Article 14
15 Disclosure of Self-Dealing Transactions
16 14.1 Applicability. This Article 14 applies if the Contractor is operating as a corporation,
17 or changes its status to operate as a corporation.
18 14.2 Duty to Disclose. If any member of the Contractor's board of directors is party to a
19 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
20 "Self-Dealing Transaction Disclosure Form" (Exhibit C to this Agreement) and submitting it to
21 the County before commencing the transaction or immediately after.
22 14.3 Definition. "Self-dealing transaction" means a transaction to which the Contractor is
23 a party and in which one or more of its directors, as an individual, has a material financial
24 interest.
25 Article 15
26 General Terms
27 15.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
28 Agreement may not be modified, and no waiver is effective, except by written agreement signed
11
1 by both parties. The Contractor acknowledges that County employees have no authority to
2 modify this Agreement except as expressly provided in this Agreement.
3 15.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
4 under this Agreement without the prior written consent of the other party.
5 15.3 Governing Law. The laws of the State of California govern all matters arising from
6 or related to this Agreement.
7 15.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
8 County, California. Contractor consents to California jurisdiction for actions arising from or
9 related to this Agreement, and, subject to the Government Claims Act, all such actions must be
10 brought and maintained in Fresno County.
11 15.5 Construction. The final form of this Agreement is the result of the parties' combined
12 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
13 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
14 against either party.
15 15.6 Days. Unless otherwise specified, "days" means calendar days.
16 15.7 Headings. The headings and section titles in this Agreement are for convenience
17 only and are not part of this Agreement.
18 15.8 Severability. If anything in this Agreement is found by a court of competent
19 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
20 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
21 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
22 intent.
23 15.9 Nondiscrimination. During the performance of this Agreement, the Contractor shall
24 not unlawfully discriminate against any employee or applicant for employment, or recipient of
25 services, because of race, religious creed, color, national origin, ancestry, physical disability,
26 mental disability, medical condition, genetic information, marital status, sex, gender, gender
27 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
28 all applicable State of California and federal statutes and regulation.
12
1 15.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
2 of the Contractor under this Agreement on any one or more occasions is not a waiver of
3 performance of any continuing or other obligation of the Contractor and does not prohibit
4 enforcement by the County of any obligation on any other occasion.
5 15.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
6 between the Contractor and the County with respect to the subject matter of this Agreement,
7 and it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
8 publications, and understandings of any nature unless those things are expressly included in
9 this Agreement. If there is any inconsistency between the terms of this Agreement without its
10 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
11 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
12 exhibits.
13 15.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
14 create any rights or obligations for any person or entity except for the parties.
15 15.13 Authorized Signature. The Contractor represents and warrants to the County that:
16 (A) The Contractor is duly authorized and empowered to sign and perform its
17 obligations under this Agreement.
18 (B) The individual signing this Agreement on behalf of the Contractor is duly
19 authorized to do so and his or her signature on this Agreement legally binds the
20 Contractor to the terms of this Agreement.
21 15.14 Electronic Signatures. The parties agree that this Agreement may be executed by
22 electronic signature as provided in this section.
23 (A) An "electronic signature" means any symbol or process intended by an individual
24 signing this Agreement to represent their signature, including but not limited to (1) a
25 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
26 electronically scanned and transmitted (for example by PDF document) version of an
27 original handwritten signature.
28
13
1 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
2 equivalent to a valid original handwritten signature of the person signing this Agreement
3 for all purposes, including but not limited to evidentiary proof in any administrative or
4 judicial proceeding, and (2) has the same force and effect as the valid original
5 handwritten signature of that person.
6 (C)The provisions of this section satisfy the requirements of Civil Code section
7 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
8 Part 2, Title 2.5, beginning with section 1633.1).
9 (D) Each party using a digital signature represents that it has undertaken and
10 satisfied the requirements of Government Code section 16.5, subdivision (a),
11 paragraphs (1) through (5), and agrees that each other party may rely upon that
12 representation.
13 (E) This Agreement is not conditioned upon the parties conducting the transactions
14 under it by electronic means and either party may sign this Agreement with an original
15 handwritten signature.
16 15.15 Counterparts. This Agreement may be signed in counterparts, each of which is an
17 original, and all of which together constitute this Agreement.
18 [SIGNATURE PAGE FOLLOWS]
19
20
21
22
23
24
25
26
27
28
14
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
FIRSTWATCH SOLUTIONS, INC. COUNTY OF FRESNO
3
4
Todd Stow(Jan 25.2023 15:05 PST)
5 Todd Stout, President S QNint ro, Chairman of the Board of
S�p�ris 'rs o he County of Fresno
6 1930 Palomar Point Way, Suite 101
Carlsbad, CA 92008 Attest:
7 Bernice E. Seidel
Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By: A-
10 &eu ty
11 For accounting use only:
12 Org No.: 56201695
Account No.: 7295
13 Fund No.: 0001
Subclass No.: 10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
15
Exhibit A
1 Scope of Services
2 A.1. Grant of License.
3 The Contractor grants the County a license to load and execute the Software on a
4 computer located at the Site identified in this Exhibit A for use by its employees and staff in
5 connection with its syndromic surveillance system. The County may make backup and archival
6 copies of the Software.
7 A.2. License Term; Maintenance Services. The term of the Software license is
8 perpetual. However, the County shall be entitled to Software updates, upgrades,
9 enhancements, new versions, bug fixes, other improvements to the Software and access to the
10 FirstWatch Subscriber Site, and to technical assistance relating to the Software, for the term(s)
11 described in this Exhibit A and with payment pursuant to the terms of the Agreement as related
12 to the Software Maintenance portion of the agreement. The term of Software Maintenance and
13 Support commences upon the date of Software Acceptance.
14 In the event that the FirstWatch system or the County's local FirstWatch system needs
15 to be taken off-line for support, upgrades, or maintenance, reasonable efforts shall be made to
16 notify the County of the downtime in advance. The Contractor shall make every effort to provide
17 the County with 24 hours advanced notice.
18 A.3. Contractor Intellectual Property Rights. The license is nontransferable and
19 non-assignable without the prior, written permission of the Contractor. The County may not
20 modify, enhance, or create derivative works, decompile, disassemble, or reverse engineer the
21 Software, or make copies other than as authorized in Section A.1. of this Exhibit A. All rights not
22 licensed are reserved to the Contractor and no rights may be implied. The Contractor retains all
23 intellectual property rights in the Software, and the County agrees to implement software
24 protection measures designed to prevent unauthorized use and copying of the Software.
25 A.4. Delivery, Installation, and Testing. The County is responsible for acquiring all
26 hardware, equipment, and other software; for preparing the site (including physical and
27 electrical requirements); for properly configuring the computing environment on which the
28 Software will reside, and for installing the Software in accordance with this Exhibit A and any
A-1
Exhibit A
1 other requirements provided by the Contractor in writing. The County shall test the Software
2 within 10 days after the Contractor has enabled the County's access to the Software.
3 A.S. Acceptance. The Software is Accepted upon the earlier of when (1) the County
4 determines that the Software performs in accordance with the criteria set forth in the
5 Acceptance Test Plan ("ATP"), set forth in section A.B. of this Exhibit A, or (2) the Software has
6 been installed for 30 days and the County has not advised the Contractor that the Software fails
7 to materially conform to the ATP. If the Software does not so perform for reasons inherent in the
8 Software (and not, for example, third party hardware, software, equipment, or system
9 configuration), the Contractor shall promptly replace the Software with materially-conforming
10 Software. The County shall test the revised Software and, the County may either (1) accept the
11 Software as conforming, ( (2) reject the Software. If the County rejects the Software, it shall
12 delete the Software from its computing system, shall certify in writing such deletion, and the
13 Contractor shall refund all fees paid by the County. The County shall have 30 days after initial
14 delivery to finally accept or reject the replaced Software. The foregoing is the sole remedy
15 available in the event of nonconforming Software.
16 A.6. Project Services.
17 Single license of FirstWatch Thin-Client (Remote Data Gathering) Software installed on
18 the County's dedicated FirstWatch PC/Server
19 o All data integration with Client's Data Source/System integrated via:
20 ■ Connectivity to a data source via ODBC or similar means;
21 ■ or Text or XIVIL file output for each incident from a County-provided
22 process (one or more files for each incident)that provides files on the
23 dedicated FirstWatch PC/Server;
24 ■ or County-provided web services interface allowing the Contractor to
25 securely access, query and receive necessary data via a non-dedicated
26 internet connection. The County-provided web services interface shall
27 include the ability to encrypt and decrypt data and options to query live
28 and historical data.
A-2
Exhibit A
1 o Data Shuttle, remote connectivity and other software and processes on the
2 County's dedicated FirstWatch PC which work together to reliably and securely
3 transmit data to the FirstWatch Data Center, and allow for remote support, using
4 County-provided, always-on Internet connectivity.
5 o Linking of data sources requires, at a minimum, a unique key that exists within
6 each data source in a useable format.
7 . Modify centrally located FirstWatch server-based processes, software and database as
8 necessary to receive the County's data, import into the Contractor's database, and
9 monitor for statistically-significant increases in volume or geographic clusters of calls
10 which meet user-defined criteria.
11 . Provide County-specific user login(s) and password(s) to allow simultaneous users on
12 the Contractor's subscriber Internet site.
13 . Provide the ability for the County to define all system included and County-purchased
14 "trigger sets" for monitoring by the Contractor.
15 . Provide the ability for the County to define alert recipients for each trigger, via a
16 combination of email, text messaging, fax, or compatible paging system.
17 . Provide a default "All Events" trigger with monitoring and alerts to demonstrate complete
18 functionality of system.
19 A. 7. Technical Specifications.
20 A. 7.1. The Contractor's Hardware Requirements.
21 Minimum Preferred
22 (only if using existing equipment) (required/minimum if new equipment)
23 Dedicated PC or Virtual Machine used Dedicated Server or Virtual Machine used
24 exclusively for the Contractor's purpose exclusively for the Contractor's purposes
25 Core i3 (Dual core or better) Core i5 (Quad core or better)
26 4GB RAM or better 8GB RAM or better
27 256 GB Disc (Partition as appropriate) 50OGB Disc (Partition as appropriate.)
28 1 GB Ethernet Card 1 GB Ethernet Card
A-3
Exhibit A
1 Minimum Preferred
2 (only if using existing equipment) (required/minimum if new equipment)
3 Any recent generation Graphic card Any recent generation Graphic card
4 Keyboard/Mouse/Monitor/KVM/Virtual Keyboard/Mouse/Monitor/KVM/Virtual
5 Machine Access Machine Access
6
7 A.7.2. The Contractor's Software Requirements.
8 Minimum Preferred
9 Microsoft Windows Server 2012 or Windows Microsoft Windows Server 2019 (64bit)
10 10 Professional including all the latest including all the latest updates
11 updates and patches loaded
12 If the database to be monitored is MS SQL If the database to be monitored is MS SQL
13 Server, SQL Server Management Studio Server, SQL Server Management Studio
14 needs to be installed. needs to be installed.
15 NOTE: For general installations, we do not NOTE: For general installations, we do not
16 need an instance of MS SQL Server installed need an instance of MS SQL Server
17 on the server just management studio Database Engine installed on the server—
18 tools. just management studio tools.
19 ODBC driver or other licensed and approved ODBC driver or other licensed and approved
20 connectivity to underlying database connectivity to underlying database
21 Virus Protection Software of the County's Virus Protection Software of the County's
22 choosing choosing
23 WinZip or compatible software - Not WinZip or compatible software - Not
24 Required if functionality included in Windows Required if functionality included in Windows
25 OS OS
26 Microsoft .NET Framework Version 4.0. Microsoft .NET Framework Version 4.6.1
27 (installed with local FirstWatch Thin Client (installed with local FirstWatch Thin Client
28 Software) Software)
A-4
Exhibit A
1 Minimum Preferred
2 Automated Time synchronization software or Automated Time synchronization software or
3 process of the County's choosing. MS process of the County's choosing. MS
4 Windows OS feature is fine. Windows OS feature is fine.
5
6 A.7.3. Connectivity, Firewall, & Environment
7 • Always-on, high speed broadband Internet connectivity under customer specified
8 and controlled security settings; Recommend static IP address with hardware
9 firewall.
10 . Read-only Network access to database(s) being monitored (ODBC connection)
11 . Outbound only access for HTTPS (port 443) with access to *.firstwatch.net. IP
12 Addresses for outbound whitelisting: 66.185.165.130/28, 66.185.165.131,
13 66.185.165.132, 66.185.165.144/29, 66.185.165.194/28, 66.185.165.195,
14 216.145.126.192/27, 38.70.192.112/28, 38.142.170.144/29, 38.104.122.120/29,
15 38.96.10.224/28.
16 For agencies using the Contractor's provided Cisco WebEx Remote Access Agent
17 service for installation and support, it may be necessary to create an exception list
18 for WebEx sites on the firewall or proxy to properly use WebEx services. In most
19 cases, the IP Range that can be used to add an exception for the firewall or proxy is
20 64.68.96.0 - 64.68.127.255 and ports 80, 443 and 1280.
21 . Local (not domain) server administrator account with access to specifications above.
22 . To maximize system availability the Contractor recommends remote-client hardware
23 be located with other critical systems and when possible include UPS, back-up
24 generator, monitored data circuits) and HVAC controlled secure environment.
25 A.7.4. Support. At a minimum, allow the Contractor access to the dedicated machine
26 via WebEx Remote Access client services (or authorized substitute, including VPN). WebEx
27 Remote Access client software provided with the Contractor under maintenance and service
28 agreement. If VPN or other connection requires additional hardware or software on client or
A-5
Exhibit A
1 support side, it will be the responsibility of the customer to supply it. The Contractor understands
2 that some agencies require attended remote access sessions and are fine with this approach
3 when required.
4 A.7.5. Disclaimer. Although the Contractor requires a dedicated machine for our
5 applications, some clients have requested running the FirstWatch applications on a server that
6 is shared with other applications. The Contractor has successfully deployed in a combination of
7 these configurations and are willing to attempt an install in this environment if the County
8 understands that there is risk involved. The risk is that if another process or application on the
9 same machine renders the machine unresponsive, it could potentially stop the processing of the
10 FirstWatch applications. Conversely, the FirstWatch applications may affect the other
11 applications. Therefore, if the County decides to move forward in this manner and results in
12 ongoing issues with the FirstWatch applications, the Contractor respectfully requests that its
13 system be transferred to a dedicated machine for the purpose of running the FirstWatch
14 applications. The Contractor's staff shall assist the County with reconfiguring the FirstWatch
15 system on a new machine.
16 A.B. Acceptance Test Plan. The Contractor's Acceptance Test Plan (ATP) is
17 designed to confirm with the County that the Contractor's data integration has been completed.
18 It is also the tool by which the County will be guided through the verification process of
19 FirstWatch Base System Acceptance. Some features and functions may vary depending on
20 data system and type. Each commonly used functionality of the product is provided an expected
21 result for each "test" executed. These tests assume that the data made available to the County
22 contains the information necessary to provide the functionality to test. An example would be if
23 the underlying data available to the Contractor does NOT contain patient destination for an
24 ambulance call, then the Contractor cannot make it available for the user to view or test.
25 Pass=Y
No. Test Expected Result Comment
26 Fail=N
Navigate to the FirstWatch
27 1 Subscriber Site FirstWatch Subscriber Site displays Yes/No
28
A-6
Exhibit A
1 Pass=Y
No. Test Expected Result Comment
2 Fail=N
Enter a Username and Successfully log into Status Page
3 2 Password provided to you showing a quick-view of one or more Yes No
4 by FirstWatch. triggers
Launch your All Calls New window opens showing the Event
5 3 Yes/No
Trigger List summary page
6 Click a hyperlink field from
Page displays a drill-down of data
7 4 one of the events in the Yes No
related to incident/event selected.
line listing.
Separate windows displays criteria for
9 Click the View Alert Config
which this trigger will alert,or"This
5 link from the top right of the Yes No
1 trigger is currently not configured for
page.
any alerts."
11 Page will reload every 1 minute. Prior
12 to reloading a green"Reloading"bar
13 Set Refresh Rate to 1 will appear near the top left section of
6 Yes/No
minute. the page. Reset Refresh Rate to 20
14 minutes after page reloads so reloads
15 to not interfere with ATP.
Click the Graphs link from The Graphlt Summary page will
16 7 Yes/No
the top of the page display
17 Check the Hide Min/Max
Shaded area(if present)along Actual
18 8 Events box above the Yes No
Events line will disappear.
19 Actual Events Graph.
Check the Hide Hourly
20 Green bars along bottom axis will
9 Events box above the Yes No
disappear
21 Actual Events Graph.
Click on the filter icon and select a
22 Click the Maps link from
sub-category in the Group By
the top of the page. The
23 dropdown. Click an incident on the
10 Map link is only present for Yes No
24 map and click the Incident Detail
data sets that include geo-
hyperlink to launch the incident
25 data
drilldown.
26 Click the Layers icon and
A multi-colored list of the Top 10
11 click the Top 10 Problems Yes No
27 Problems will appear
category
28
A-7
Exhibit A
1 Pass=Y
No. Test Expected Result Comment
2 Fail=N
Click the Destination link
3 from the top of the page.
Page displays a line listing of events
4 12 (Only present for data sets Yes No
separated by transport destination.
5 which include patient
transport destination data)
6 Click the Analysis Tool link Page displays interactive tool for
13 Yes/No
7 from the top of the page. retrospective analysis.
Specify a Start Date/Time
$ and Stop Data/Time of the
After calculations are complete,trigger
9 last 7 to 10 days. (Default
14 will display line listing of all events for Yes No
10 date range will include the
date/time range selected.
last 7 days).Click Event
11
List link.
12 Graphit summary for date/time range
15 Click Graphit link Yes No
13 selected will display
Page displays MapShot of all activity
14 16 Click Maps link Yes No
for date/time range selected.
15 Click the Go-Back to real-
17 Page returns to Event list view. Yes No
16 time link.
Press the Log Out button User will be logged out and redirected
17 18 on the top right corner of to FirstWatch Subscriber site.
18 this trigger.
19 Acceptance: Test Plan Passed Successfully, Test Plan Conditionally Accepted or Test Plan Did
Not Pass
20
Notes:
21
If Conditional or Rejected, please specify the reason(s) in detail
22 Name:
23 Title:
24 Agency:
25 Signature:
26 Date:
27 When completed, please email this form to ad min(aMrstwatch.net
28
A-8
Exhibit B
1 Compensation
2 The Contractor will be compensated for performance of its services under this
3 Agreement as provided in this Exhibit B. The Contractor is not entitled to any compensation
4 except as expressly provided in this Exhibit B.
5 B.1. Pricing —Year 1 Fees
6 Pricing for Year 1 of this Agreement are listed in the table below. The County shall not
7 be charged any fees for"Data Source 2 (DS2)" integration or licenses due to the Contractor
8 having an existing data source with American Ambulance Visalia to integrate with their
9 computer-aided dispatch (CAD).
10 Description Qty Unit Price Item Total
11 FirstWatch System (FW) w/Primary Data Source 1 (DS1)— Fresno County CAD —
CentralS uare Enterprise TriTech CAD Fresno Fire CAD Credit -$39,082.00
12 (DS1) System License— CAD 1 $54,598.00 $15,516.00minus above credit
13 DS1 Annual Support & Maintenance 1 $12,011.56 $12,011.56
14 Installation / Configuration 1 $2,500.00 $2,500.00
DS1 Data Source Integration 1 $7,500.00 $7,500.00
15 DS1 Training /Trigger Consultation 1 $5,500.00 $5,500.00
DS1 Project Management 1 $5,500.00 $5,500.00
16 Sub-total $48,527.56
17 Data Source 2 (DS2) —American Ambulance Visalia (existing)
Description I Qty Unit Price Item Total
18 (DS2) System License— CAD 1 $43,679.00 $0.00
DS2 Annual Support & Maintenance 1 $9.609.38 $0.00
19 Sub-total $0.00
20 Triggers & Report Development
Description Qty I Unit Price Item Total
21 Standard FirstWatch Triggers (included with new 20 $0.00 $0.00
system)
22 Standard FirstWatch Triggers 20 $400.00 $8,000.00
Standard FirstWatch Triggers Annual Support & 20 $200.00 $4,000.00
23 Maintenance
24 Customized FirstWatch Reports Development 10 $225.00 $2,250.00
hours
25 Customized FirstWatch Reports Annual Support 10 $49.50 $495.00
& Maintenance
26 Sub-total $14,745.00
Interactive Data Visualization (IDV) Module
27 Description Qty Unit Price Item Total
28 Included IDV Module (included with new system 1 $0.00 $0.00
—to be added to any single Trigger)
Sub-total $0.00
B-1
Exhibit B
1 Description Qty Unit Price Item Total
2 Online Compliance Utilit OCU Module
Description Qt Unit Price Item Total
3 Online Compliance Utility OCU Module 1 $37,500.00 $37,500.00
4 OCU Annual Support & Maintenance 1 $8,250.00 $8,250.00
Additional OCU Add-on Authority/ Contractor 14 $5,625.00 $78,750.00
5 Additional OCU Add-on Authority/ Contractor 14 $1,237.50 $17,325.00
Annual Support & Maintenance
6 Additional monitored OCU Data Source (does not 1 $9,375.00 $9,375.00
include Standard Data Source Fees
7 Additional monitored OCU Data Source Annual
Support & Maintenance 1 $2,062.50 $2,062.50
8 OCU —Trainin / Consulting 1 $5,025.00 $5,025.00
9 Sub-total $158,287.50
Grand Total $221,560.06
10
11 B.2. Fee Changes
12 The Contractor may increase Annual Maintenance and Support fees for Years 2 through
13 5 of this Agreement, upon 365 days' advance written notice to the County; however, should
14 County not agree to the fee increase the County may terminate the Agreement upon 30 days'
15 advance written notice to Contractor. , Contractor shall not increase such fees more than once
16 in any one-year period, and provided further that each increase shall not exceed the previous
17 fees by the lesser of three percent (3%) per year or the cumulative percentage increase in the
18 Consumer Price Index, All Urban Consumers for the U.S., during the previous year.
19 B.3. Additional Fees
20 B.3.1. Additional Triggers
21 The County shall have 20 triggers included with its FirstWatch system at no cost to the
22 County. Additional triggers outside of the 20 included triggers shall be priced at $400.00 per
23 trigger plus an annual fee of$200.00 per trigger for maintenance and support.
24 B.3.2. Additional IDVs
25 The County shall have one IDV included with its FirstWatch system at no cost to the
26 County. Additional IDV modules shall be priced at $2,500.00 per IDV plus an annual fee of
27 $550.00 per IDV for maintenance and support.
28 B.3.3. Travel
B-2
Exhibit B
1 The Contractor may provide Software-related services such as on-site installation,
2 training, customization, integration, support, and maintenance services, based upon the
3 County's written request and approval for such services by amending this Agreement. The
4 County shall pay all travel-related expenses (e.g., ground transportation, accommodations,
5 food) incurred by the Contractor for the requested services, based upon the U.S. General
6 Services Administration's per diem rates for travel, meals, and incidentals.
7 B.3.4. Additional Costs
8 The County is responsible for payment of all sales and/or use taxes arising out of its use
9 of the Software. If the County plans to switch the vendor for either CAD listed above (or any
10 other data system in which the parties mutually agree to integrate with) from the existing data
11 interface feeding into the Contractor, in addition to the Data Source Interface fee of$7,500.00,
12 additional work and fees shall be required to convert specialized system enhancement modules
13 such as FirstPass, OCU, Complex Triggers, and Customized Reports, all of which can be priced
14 upon request (in advance). In addition, the Contractor recommends that the County provide a
15 minimum of 90 days' advance notice for the Contractor to provide a quote for work required and
16 allow the Contractor sufficient lead time to plan conversion work prior to the new system
17 cutover.
18 B.3.5. Additional Products, Services, and Fees
19 Additional products and services shall only be provided and/or performed to the
20 Contractor upon the County's written request by amending this Agreement. Pricing shall be
21 negotiated at the time of the request and shall be agreed upon by both parties in writing. In no
22 event shall the total compensation paid to the Contractor for Additional Services and Additional
23 Fees (as discussed above in B.3) for the potential five-year term of this Agreement exceed
24 $158,671.04.
25 B.4. Payment Schedule.
26 B.4.1. New System Standard Purchase
27 The County shall make payments to the Contractor according to the Contractor's "New
28 System Standard Purchase" payment schedule, which is the traditional software license
B-3
Exhibit B
1 payment program that includes all Year 1 project fees with a typical project payment breakdown
2 based upon the following project milestones:
3 • 50% of all Year 1 project and maintenance fees payable at software license
4 execution
5 . 40% of all Year 1 project and maintenance fees payable at system installation and
6 Go Live of the Base FirstWatch system (typically DS1 and All Calls Trigger for DS1)
7 • 10% (remaining balance of all Year 1 project and maintenance fees) payable at
8 Acceptance of Base System functionality
9 o Note: all project license fees plus Year 1 maintenance and support fees are
10 included in the above pricing and payment schedule. Maintenance and
11 support shall not commence until the Project/Module has gone live.
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
B-4
Exhibit C
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
C-1
Exhibit C
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
C-2
Exhibit D
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the Contractor or any third
parties, Contractor, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence and an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
Coverage must include products, completed operations, property damage, bodily injury,
personal injury, and advertising injury. The Contractor shall obtain an endorsement to
this policy naming the County of Fresno, its officers, agents, employees, and volunteers,
individually and collectively, as additional insureds, but only insofar as the operations
under this Agreement are concerned. Such coverage for additional insureds will apply as
primary insurance and any other insurance, or self-insurance, maintained by the County
is excess only and not contributing with insurance provided under the Contractor's
policy.
(B) Automobile Liability. Automobile liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages.
Coverage must include any auto used in connection with this Agreement.
(C)Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(D) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1)the retroactive date must
be prior to the date on which services began under this Agreement; (2) the Contractor
shall maintain the policy and provide to the County annual evidence of insurance for not
less than five years after completion of services under this Agreement; and (3) if the
policy is canceled or not renewed, and not replaced with another claims-made policy
with a retroactive date prior to the date on which services begin under this Agreement,
then the Contractor shall purchase extended reporting coverage on its claims-made
policy for a minimum of five years after completion of services under this Agreement.
(E) Molestation Liability. Sexual abuse / molestation liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence, with an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
(F) Technology Professional Liability (Errors and Omissions). Technology professional
liability (errors and omissions) insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence and in the aggregate. Coverage must encompass all of the
Contractor's obligations under this Agreement, including but not limited to claims
involving Cyber Risks.
(G)Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
D-1
Exhibit D
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data) that is in the care, custody, or control of the Contractor.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) breach of any of the Contractor's obligations under this
Agreement; (iv) system failure; (v) data recovery; (vi)failure to timely disclose data
breach or Security Breach; (vii) failure to comply with privacy policy; (viii) payment card
liabilities and costs; (ix) infringement of intellectual property, including but not limited to
infringement of copyright, trademark, and trade dress; (x) invasion of privacy, including
release of private information; (xi) information theft; (xii) damage to or destruction or
alteration of electronic information; (xiii) cyber extortion; (xiv) extortion related to the
Contractor's obligations under this Agreement regarding electronic information, including
Personal Information; (xv) fraudulent instruction; (xvi) funds transfer fraud; (xvii)
telephone fraud; (xviii) network security; (xix) data breach response costs, including
Security Breach response costs; (xx) regulatory fines and penalties related to the
Contractor's obligations under this Agreement regarding electronic information, including
Personal Information; and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the Contractor signs this Agreement,
and at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the Contractor shall deliver, or cause its
broker or producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th
Floor, Fresno, California 93721, or HRRiskManagement@fresnocountyca.gov, and by
mail or email to the person identified to receive notices under this Agreement,
certificates of insurance and endorsements for all of the coverages required under this
Agreement.
(i) Each insurance certificate must state that: (1)the insurance coverage has been
obtained and is in full force; (2) the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
Contractor has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
Contractor's policy.
D-2
Exhibit D
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
(v) The technology professional liability insurance certificate must also state that
coverage encompasses all of the Contractor's obligations under this Agreement,
including but not limited to claims involving Cyber Risks, as that term is defined in
this Agreement.
(vi) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the Contractor.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the Contractor shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the Contractor shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the Contractor shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the Contractor or its insurer to timely provide a written notice required by
this paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the Contractor has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the Contractor shall deliver, or cause its broker or producer
to deliver, to the County's Risk Manager certificates of insurance and endorsements for
all of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The Contractor waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The Contractor is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the Contractor's waiver of subrogation under this paragraph is effective
whether or not the Contractor obtains such an endorsement.
D-3
Exhibit D
(F) County's Remedy for Contractor's Failure to Maintain. If the Contractor fails to keep
in effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the Contractor. The County may offset such
charges against any amounts owed by the County to the Contractor under this
Agreement.
(G)Subcontractors. The Contractor shall require and verify that all subcontractors used by
the Contractor to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the Contractor to provide services under this Agreement using subcontractors.
D-4
Exhibit E
Health Insurance Portability and Accountability Act (HIPAA)
1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as
these terms are defined by 45 CFR 160.103. In connection with providing services under the
Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health
Information ("PHI")from or on behalf of the County. The parties enter into this Business Associate
Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to govern the
use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security,
Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
The parties to this Agreement shall be in strict conformance with all
applicable federal and State of California laws and regulations, including, but not limited to
California Welfare and Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42
CFR 431; California Civil Code section 56 et seq.; the Health Insurance Portability and
Accountability Act of 1996, as amended ("HIPAA"), including, but not limited to, 45 CFR Parts160,
45 CFR 162, and 45 CFR 164; the Health Information Technology for Economic and Clinical
Health Act ("HITECH") regarding the confidentiality and security of patient information, including,
but not limited to 42 USC 17901 et seq.; and the Genetic Information Nondiscrimination Act
("GINA") of 2008 regarding the confidentiality of genetic information.
Except as otherwise provided in this Agreement, the Contractor, as a business associate
of the County, may use or disclose Protected Health Information ("PHI") to perform functions,
activities or services for or on behalf of the County, as specified in this Agreement, provided that
such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of PHI may not
be more expansive than those applicable to the County, as the "Covered Entity" under the
HIPAA Rules, except as authorized for management, administrative or legal responsibilities of
the Contractor.
2. The Contractor, including its subcontractors and employees, shall protect from
unauthorized access, use, or disclosure of names and other identifying information, including
genetic information, concerning persons receiving services pursuant to this Agreement, except
where permitted in order to carry out data aggregation purposes for health care operations [45
CFR §§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all
persons receiving services pursuant to a County-funded program. This requirement applies to
electronic PHI. The Contractor shall not use such identifying information or genetic information for
any purpose other than carrying out the Contractor's obligations under this Agreement.
3. The Contractor, including its subcontractors and employees, shall not disclose any
such identifying information or genetic information to any person or entity, except as otherwise
specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law,
required by the Secretary of the United States Department of Health and Human Services
("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is
permitted by this Agreement or authorized by law, the Contractor shall make reasonable efforts to
limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request.
4. For purposes of the above sections, identifying information shall include, but not be
limited to, name, identifying number, symbol, or other identifying particular assigned to the
individual, such as fingerprint or voiceprint, or photograph.
5. For purposes of the above sections, genetic information shall include genetic tests
of family members of an individual or individual(s), manifestation of disease or disorder of family
E-1
Exhibit E
members of an individual, or any request for or receipt of genetic services by individual or family
members. Family member means a dependent or any person who is first, second, third, or fourth
degree relative.
6. The Contractor shall provide access, at the request of the County, and in the time
and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR§
164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR§ 164.524
regarding access by individuals to their PHI. With respect to individual requests, access shall be
provided within thirty (30) days from request. Access may be extended if the Contractor cannot
provide access and provides the individual with the reasons for the delay and the date when
access may be granted. PHI shall be provided in the form and format requested by the individual
or the County.
The Contractor shall make any amendment(s) to PHI in a designated record set at the
request of the County or individual, and in the time and manner designated by the County in
accordance with 45 CFR § 164.526.
The Contractor shall provide to the County or to an individual, in a time and manner
designated by the County, information collected in accordance with 45 CFR § 164.528, to permit
the County to respond to a request by the individual for an accounting of disclosures of PHI in
accordance with 45 CFR § 164.528.
7. The Contractor shall report to the County, in writing, any knowledge or
reasonable belief that there has been unauthorized access, viewing, use, disclosure, security
incident, or breach of unsecured PHI not permitted by this Agreement of which the Contractor
becomes aware, immediately and without reasonable delay and in no case later than two (2)
business days of discovery. Immediate notification shall be made to the County's Information
Security Officer and Privacy Officer and the County's Department of Public Health ("DPH")
HIPAA Representative, within two (2) business days of discovery. The notification shall include,
to the extent possible, the identification of each individual whose unsecured PHI has been, or is
reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
Contractor shall take prompt corrective action to cure any deficiencies and any action pertaining
to such unauthorized disclosure required by applicable federal and State laws and regulations.
The Contractor shall investigate such breach and is responsible for all notifications required by
law and regulation or deemed necessary by the County and shall provide a written report of the
investigation and reporting required to the County's Information Security Officer and Privacy
Officer and the County's DPH HIPAA Representative.
This written investigation and description of any reporting necessary shall be
postmarked within the thirty (30) working days of the discovery of the breach to the addresses
below:
County of Fresno County of Fresno County of Fresno
Department of Public Health Department of Public Health Department of Internal
HIPAA Representative Privacy Officer Services
(559) 600-6439 (559) 600-6405 Information Security Officer
P.O. Box 11867 P.O. Box 11867 (559) 600-5800
Fresno, California 93775 Fresno, California 93775 333 W. Pontiac Way
Clovis, CA 93612
8. The Contractor shall make its internal practices, books, and records relating to
E-2
Exhibit E
the use and disclosure of PHI received from the County, or created or received by the
Contractor on behalf of the County, in compliance with Parts the HIPAA Rules. The Contractor
shall make its internal practices, books, and records relating to the use and disclosure of PHI
received from the County, or created or received by the Contractor on behalf of the County,
available to the Secretary upon demand.
The Contractor shall cooperate with the compliance and investigation reviews conducted
by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal
business hours; however, upon exigent circumstances access at any time must be granted.
Upon the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor
and in possession of a subcontractor of the Contractor, the Contractor must certify to the
Secretary its efforts to obtain the information from the subcontractor.
9. Safeguards
The Contractor shall implement administrative, physical, and technical safeguards as
required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
this Agreement. The Contractor shall conduct an accurate and thorough assessment of the
potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI.
The Contractor shall develop and maintain a written information privacy and security program
that includes administrative, technical and physical safeguards appropriate to the size and
complexity of the Contractor's operations and the nature and scope of its activities. Upon the
County's request, the Contractor shall provide the County with information concerning such
safeguards.
The Contractor shall implement strong access controls and other security safeguards
and precautions in order to restrict logical and physical access to confidential, personal (e.g.,
PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include
the following administrative and technical password controls for all systems used to process or
store confidential, personal, or sensitive data:
A. Passwords must not be:
(1) Shared or written down where they are accessible or recognizable by anyone
else; such as taped to computer screens, stored under keyboards, or visible
in a work area;
(2) A dictionary word; or
(3) Stored in clear text
B. Passwords must be:
(1) Eight (8) characters or more in length;
(2) Changed every ninety (90) days;
(3) Changed immediately if revealed or compromised; and
(4) Composed of characters from at least three (3) of the following four (4)
groups from the standard keyboard:
a) Upper case letters (A-Z);
b) Lowercase letters (a-z);
c) Arabic numerals (0 through 9); and
E-3
Exhibit E
d) Non-alphanumeric characters (punctuation symbols).
The Contractor shall implement the following security controls on each workstation or
portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
3. Patch management process including installation of all operating system/software
vendor security patches.
The Contractor shall utilize a commercial encryption solution that has received FIPS
140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
electronic media (including, but not limited to, compact disks and thumb drives) and on portable
computing devices (including, but not limited to, laptop and notebook computers).
The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or
other internet transport protocol unless the data is encrypted by a solution that has been
validated by the National Institute of Standards and Technology (NIST) as conforming to the
Advanced Encryption Standard (AES) Algorithm. The Contractor must apply appropriate
sanctions against its employees who fail to comply with these safeguards. The Contractor must
adopt procedures for terminating access to PHI when employment of employee ends.
10. Mitigation of Harmful Effects
The Contractor shall mitigate, to the extent practicable, any harmful effect that is
suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or
breach of PHI by the Contractor or its subcontractors in violation of the requirements of these
provisions. The Contractor must document suspected or known harmful effects and the
outcome.
11. The Contractor's Subcontractors
The Contractor shall ensure that any of its contractors, including subcontractors, if
applicable, to whom the Contractor provides PHI received from or created or received by the
Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions
that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the
relevant provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
Nothing in this section 11 or this Exhibit E authorizes the Contractor to perform services
under this Agreement using subcontractors.
12. Employee Training and Discipline
The Contractor shall train and use reasonable measures to ensure compliance with the
requirements of these provisions by employees who assist in the performance of functions or
activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
such employees who intentionally violate any provisions of these provisions, which may include
termination of employment.
13. Termination for Cause
Upon the County's knowledge of a material breach of these provisions by the
Contractor, the County will either:
A. Provide an opportunity for the Contractor to cure the breach or end the
violation, and the County may terminate this Agreement if the Contractor does not cure the
E-4
Exhibit E
breach or end the violation within the time specified by the County; or
B. Immediately terminate this Agreement if the Contractor has breached a
material term of this Exhibit E and cure is not possible, as determined by the County.
C. If neither cure nor termination is feasible, the County's Privacy Officer will
report the violation to the Secretary of the U.S. Department of Health and Human Services.
14. Judicial or Administrative Proceedings
The County may terminate this Agreement if: (1) the Contractor is found guilty in
a criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act;
or (2) there is a finding or stipulation in an administrative or civil proceeding in which the
Contractor is a party that the Contractor has violated a privacy or security standard or
requirement of the HITECH Act, HIPAA or other security or privacy laws.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, the Contractor shall
return or destroy all PHI received from the County (or created or received by the Contractor on
behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of
such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend
the protections of these provisions to such information, and limit further use of such PHI to those
purposes that make the return or destruction of such PHI infeasible. This provision applies to
PHI that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the
Contractor destroys the PHI data, a certification of date and time of destruction shall be
provided to the County by the Contractor.
16. Compliance with Other Laws
To the extent that other state and/or federal laws provide additional, stricter and/or more
protective privacy and/or security protections to PHI or other confidential information covered
under this BAA, the Contractor agrees to comply with the more protective of the privacy and
security standards set forth in the applicable state or federal laws to the extent such standards
provide a greater degree of protection and security than HIPAA Rules or are otherwise more
favorable to the individual.
17. Disclaimer
The County makes no warranty or representation that compliance by the Contractor with
these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
Contractor's own purposes or that any information in the Contractor's possession or control, or
transmitted or received by the Contractor, is or will be secure from unauthorized access,
viewing, use, disclosure, or breach. The Contractor is solely responsible for all decisions made
by the Contractor regarding the safeguarding of PHI.
18. Amendment
The parties acknowledge that Federal and State laws relating to electronic data security
and privacy are rapidly evolving and that amendment of this Exhibit E may be required to
provide for procedures to ensure compliance with such developments. The parties specifically
agree to take such action as is necessary to amend this agreement in order to implement the
standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws
relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty
(30) days written notice in the event that the Contractor does not enter into an amendment
providing assurances regarding the safeguarding of PHI that the County in its sole discretion,
deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the
E-5
Exhibit E
HITECH Act.
19. No Third-Party Beneficiaries
Nothing expressed or implied in the provisions of this Exhibit E is intended to confer, and
nothing in this Exhibit E does confer, upon any person other than the County or the Contractor
and their respective successors or assignees, any rights, remedies, obligations or liabilities
whatsoever.
20. Interpretation
The provisions of this Exhibit E shall be interpreted as broadly as necessary to
implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that
any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a
meaning that complies and is consistent with the HIPAA Rules.
21. Regulatory References
A reference in the terms and conditions of these provisions to a section in the HIPAA
Rules means the section as in effect or as amended.
22. Survival
The respective rights and obligations of the Contractor as stated in this Exhibit E survive
the termination or expiration of this Agreement.
23. No Waiver of Obligation
Change, waiver or discharge by the County of any liability or obligation of the Contractor
under this Exhibit E on any one or more occasions is not a waiver of performance of any
continuing or other obligation of the Contractor and does not prohibit enforcement by the County
of any obligation on any other occasion.
E-6