HomeMy WebLinkAboutAgreement A-24-265 with West Hills Community College District.pdf Agreement No. 24-265
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated June 4, 2024 and is between
3 West Hills Community College District, a California Community College District ("College"), and
4 the County of Fresno, a political subdivision of the State of California ("County").
5 Recitals
6 A. College has approved various educational training programs that require facilities to
7 provide clinical and field experience for required learning experiences for its students.
8 B. County, through its Department of Behavioral Health (DBH), maintains and operates
9 facilities suitable for furnishing such clinical and field experience.
10 C. Those students participating in the following College departments/programs are subject
11 to this Agreement:
12 a. Psychiatric Technician Program
13 b. Nursing Program
14 D. It is to the mutual benefit of the parties hereto that personnel and students of College
15 use such facilities of County for their clinical and field experience.
16 E. The parties therefore agree as follows:
17 Article 1
18 College's Services
19 1.1 Scope of Services. The College shall perform all of the services provided in Exhibit
20 A to this Agreement, titled "Scope of Services."
21 1.2 Representation. The College represents that it is qualified, ready, willing, and able
22 to perform all of the services provided in this Agreement.
23 1.3 Compliance with Laws. The College shall, at its own cost, comply with all
24 applicable federal, state, and local laws and regulations in the performance of its obligations
25 under this Agreement, including but not limited to workers compensation, labor, and
26 confidentiality laws and regulations.
27
28
1
1 Article 2
2 County's Responsibilities
3 2.1 County shall permit each student who is designated by College, pursuant to Exhibit A
4 of this Agreement, to receive clinical and field experience at appropriate County facilities at an
5 agreed (between County and College) number of hours, and shall furnish and permit students
6 and/or instructors free access to appropriate County facilities for such clinical and field
7 experience, subject to the terms and conditions of this Agreement.
8 2.2 County shall furnish the appropriate facilities, on a rotational basis, in such a manner
9 that there will be no conflict in the use thereof between College's students and those from other
10 educational institutions, if any.
11 2.3 County shall, subject to budgetary and operational concerns, maintain clinical and
12 field facilities used for the learning experience in a manner that shall at all times conform to the
13 requirements of College's departments/programs listed in the "Recitals" section of this
14 Agreement.
15 2.4 County shall provide to students and instructors taking part in the clinical and field
16 experience (subject to space limitations) the following facilities:
17 (A) A conference type room or office space suitably furnished for College's
18 instructors and faculty to conduct clinical and/or field classes;
19 (B) A storage area for instructional materials and supplies;
20 (C) Shelf space for books and other space for the use of College's students and
21 instructors; and
22 (D) Restroom facilities and appropriate space for changing and storage of uniforms.
23 2.5 County shall provide emergency health care (on a fee for service basis) for any
24 student and/or instructor who becomes sick or injured by conditions arising out of or in the
25 course of any student's and/or instructor's participation in the clinical and field experience at
26 County facilities. The recipient of emergency health care shall be responsible for the payment of
27 all emergency health care services provided.
28
2
1 2.6 County shall provide staff adequate in number and quality to provide safe and
2 continuous health care to patients involved in clinical and field learning programs.
3 2.7 County shall permit and encourage members of its resident staff and/or attending
4 medical staff to participate in the instructional phase of College's clinical and field experience
5 programs.
6 2.8 County shall permit its various program directors and other designated personnel to
7 attend meetings of College's faculty, or any committee thereof, to coordinate the clinical and
8 field experience programs provided for under this Agreement, and to designate lines of authority
9 and communication for coordination of relations between College instructors and County
10 personnel.
11 2.9 County shall provide an introductory orientation for College instructors and faculty
12 staff, which shall provide an overview of County facilities, field and experience programs, and
13 the terms and conditions of student placement at County's facilities.
14 2.10 County shall notify College's instructors, in advance, of any change in its Director (or
15 designee) appointments.
16 2.11 County shall reserve the absolute right to review, authorize, and at its sole discretion,
17 deny access or admission by any student, instructor and/or College representative into County
18 facilities.
19 2.12 County shall provide input into the evaluation conducted by College, of students'
20 skills and progress.
21 2.13 County shall agree to allow access to existing dining room space for students' break
22 and meal periods. College's students shall purchase food in the regular system or bring food
23 with them; no special arrangements for food will be made.
24 Article 3
25 Compensation, Invoices, and Payments
26 3.1 The clinical and field education programs conducted pursuant to the terms and
27 conditions of this Agreement shall be performed without the payment of any monetary
28
3
1 consideration by College or County, one to the other, or by or to any student participating in said
2 clinical training programs.
3 Article 4
4 Term of Agreement
5 4.1 Term. This Agreement is effective on July 1, 2024, and terminates on June 30, 2027
6 except as provided in section 4.2, "Extension," or Article 6, "Termination and Suspension,"
7 below.
8 4.2 Extension. The term of this Agreement may be extended for no more than two (2),
9 one-year periods only upon written approval of both parties at least thirty (30) days before the
10 first day of the next one-year extension period. The County's DBH Director or designee is
11 authorized to sign the written approval on behalf of the County based on the College's
12 satisfactory performance. The extension of this Agreement by the County is not a waiver or
13 compromise of any default or breach of this Agreement by the College existing at the time of the
14 extension whether or not known to the County.
15 Article 5
16 Notices
17 5.1 Contact Information. The persons and their addresses having authority to give and
18 receive notices provided for or permitted under this Agreement include the following:
19
For the County:
20 Director, Department of Behavioral Health
County of Fresno
21 1925 E. Dakota Avenue
Fresno, CA 93726
22 DBHStaffDevelopment@fresnocountyca.gov
23 For the College:
Director of Health Careers
24 Coalinga College
300 Cherry Lane
25 Coalinga, CA 93210
26 5.2 Change of Contact Information. Either party may change the information in section
27 5.1 by giving notice as provided in section 5.3.
28
4
1 5.3 Method of Delivery. Each notice between the County and the College provided for
2 or permitted under this Agreement must be in writing, state that it is a notice provided under this
3 Agreement, and be delivered either by personal service, by first-class United States mail, by an
4 overnight commercial courier service, or by Portable Document Format (PDF) document
5 attached to an email.
6 (A) A notice delivered by personal service is effective upon service to the recipient.
7 (B) A notice delivered by first-class United States mail is effective three (3) County
8 business days after deposit in the United States mail, postage prepaid, addressed to the
9 recipient.
10 (C)A notice delivered by an overnight commercial courier service is effective one (1)
11 County business day after deposit with the overnight commercial courier service,
12 delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
13 the recipient.
14 (D)A notice delivered by PDF document attached to an email is effective when
15 transmission to the recipient is completed (but, if such transmission is completed outside
16 of County business hours, then such delivery is deemed to be effective at the next
17 beginning of a County business day), provided that the sender maintains a machine
18 record of the completed transmission.
19 5.4 Claims Presentation. For all claims arising from or related to this Agreement,
20 nothing in this Agreement establishes, waives, or modifies any claims presentation
21 requirements or procedures provided by law, including the Government Claims Act (Division 3.6
22 of Title 1 of the Government Code, beginning with section 810).
23 Article 6
24 Termination and Suspension
25 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
26 contingent on the approval of funds by the appropriating government agency. If sufficient funds
27 are not allocated, then the County, upon at least thirty (30) days' advance written notice to the
28 College, may:
5
1 (A) Modify the services provided by the College under this Agreement; or
2 (B) Terminate this Agreement.
3 6.2 Termination for Breach.
4 (A) Upon determining that a breach (as defined in paragraph (C) below) has
5 occurred, the County may give written notice of the breach to the College. The written
6 notice may suspend performance under this Agreement and must provide at least thirty
7 (30) days for the College to cure the breach.
8 (B) If the College fails to cure the breach to the County's satisfaction within the time
9 stated in the written notice, the County may terminate this Agreement immediately.
10 (C) For purposes of this section, a breach occurs when, in the determination of the
11 County, the College has:
12 (1) Obtained or used funds illegally or improperly;
13 (2) Failed to comply with any part of this Agreement;
14 (3) Submitted a substantially incorrect or incomplete report to the County; or
15 (4) Improperly performed any of its obligations under this Agreement.
16 6.3 Termination without Cause. In circumstances other than those set forth above, the
17 County may terminate this Agreement by giving at least thirty (30) days advance written notice
18 to the College.
19 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
20 under this Article 6 is without penalty to or further obligation of the County.
21 6.5 County's Rights upon Termination. Upon termination for breach under this Article
22 6, the County may demand repayment by the College of any monies disbursed to the College
23 under this Agreement that, in the County's sole judgment, were not expended in compliance
24 with this Agreement. The College shall promptly refund all such monies upon demand. This
25 section survives the termination of this Agreement.
26
27
28
6
1 Article 7
2 Independent Contractor
3 7.1 Status. In performing under this Agreement, the College, including its officers,
4 agents, employees, students, and volunteers, is at all times acting and performing as an
5 independent contractor, in an independent capacity, and not as an officer, agent, servant,
6 employee, joint venturer, partner, or associate of the County.
7 7.2 Verifying Performance. The County has no right to control, supervise, or direct the
8 manner or method of the College's performance under this Agreement, but the County may
9 verify that the College is performing according to the terms of this Agreement.
10 7.3 Benefits. Because of its status as an independent contractor, the College has no
11 right to employment rights or benefits available to County employees. The College is solely
12 responsible for providing to its own employees, including students, all employee benefits
13 required by law. The College shall save the County harmless from all matters relating to the
14 payment of College's employees, including compliance with Social Security withholding and all
15 related regulations.
16 7.4 Services to Others. The parties acknowledge that, during the term of this
17 Agreement, the College may provide services to others unrelated to the County.
18 Article 8
19 Indemnity and Defense
20 8.1 Indemnity. The College shall indemnify and hold harmless and defend the County
21 (including its officers, agents, employees, students, and volunteers) against all claims,
22 demands, injuries, damages, costs, expenses (including attorney fees and costs), fines,
23 penalties, and liabilities of any kind to the County, the College, or any third party that arise from
24 or relate to the performance or failure to perform by the College (or any of its officers, agents,
25 subcontractors, or employees) under this Agreement. The County may conduct or participate in
26 its own defense without affecting the College's obligation to indemnify and hold harmless or
27 defend the County.
28 8.2 Survival. This Article 8 survives the termination of this Agreement.
7
1 Article 9
2 Insurance
3 9.1 The College shall comply with all the insurance requirements in Exhibit B to this
4 Agreement.
5 Article 10
6 Inspections, Audits, and Public Records
7 10.1 Inspection of Documents. The College shall make available to the County, and the
8 County may examine at any time during business hours and as often as the County deems
9 necessary, all of the College's records and data with respect to the matters covered by this
10 Agreement, excluding attorney-client privileged communications. The College shall, upon
11 request by the County, permit the County to audit and inspect all such records and data to
12 ensure the College's compliance with the terms of this Agreement.
13 10.2 Public Records. The County is not limited in any manner with respect to its public
14 disclosure of this Agreement or any record or data that the College may provide to the County.
15 The County's public disclosure of this Agreement or any record or data that the College may
16 provide to the County may include but is not limited to the following:
17 (A) The County may voluntarily, or upon request by any member of the public or
18 governmental agency, disclose this Agreement to the public or such governmental
19 agency.
20 (B) The County may voluntarily, or upon request by any member of the public or
21 governmental agency, disclose to the public or such governmental agency any record or
22 data that the College may provide to the County, unless such disclosure is prohibited by
23 court order.
24 (C)This Agreement, and any record or data that the College may provide to the
25 County, is subject to public disclosure under the Ralph M. Brown Act (California
26 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
27 (D)This Agreement, and any record or data that the College may provide to the
28 County, is subject to public disclosure as a public record under the California Public
8
1 Records Act (California Government Code, Title 1, Division 7, Chapter 3.5, beginning
2 with section 6250) ("CPRA").
3 (E) This Agreement, and any record or data that the College may provide to the
4 County, is subject to public disclosure as information concerning the conduct of the
5 people's business of the State of California under California Constitution, Article 1,
6 section 3, subdivision (b).
7 (F) Any marking of confidentiality or restricted access upon or otherwise made with
8 respect to any record or data that the College may provide to the County shall be
9 disregarded and have no effect on the County's right or duty to disclose to the public or
10 governmental agency any such record or data.
11 10.3 Public Records Act Requests. If the County receives a written or oral request
12 under the CPRA to publicly disclose any record that is in the College's possession or control,
13 and which the County has a right, under any provision of this Agreement or applicable law, to
14 possess or control, then the County may demand, in writing, that the College deliver to the
15 County, for purposes of public disclosure, the requested records that may be in the possession
16 or control of the College. Within five (5) business days after the County's demand, the College
17 shall (a) deliver to the County all of the requested records that are in the College's possession
18 or control, together with a written statement that the College, after conducting a diligent search,
19 has produced all requested records that are in the College's possession or control, or (b)
20 provide to the County a written statement that the College, after conducting a diligent search,
21 does not possess or control any of the requested records. The College shall cooperate with the
22 County with respect to any County demand for such records. If the College wishes to assert that
23 any specific record or data is exempt from disclosure under the CPRA or other applicable law, it
24 must deliver the record or data to the County and assert the exemption by citation to specific
25 legal authority within the written statement that it provides to the County under this section. The
26 College's assertion of any exemption from disclosure is not binding on the County, but the
27 County will give at least ten (10) days' advance written notice to the College before disclosing
28 any record subject to the College's assertion of exemption from disclosure. The College shall
9
1 indemnify the County for any court-ordered award of costs or attorney's fees under the CPRA
2 that results from the College's delay, claim of exemption, failure to produce any such records, or
3 failure to cooperate with the County with respect to any County demand for any such records.
4 Article 11
5 Federal and State Laws
6 11.1 Health Insurance Portability and Accountability Act. County and College each
7 consider and represent themselves as covered entities as defined by the U.S. Health Insurance
8 Portability and Accountability Act of 1996, Public Law 104-191(HIPAA) and agree to use and
9 disclose Protected Health Information (PHI) as required by law.
10 County and College acknowledge that the exchange of PHI between them is only for
11 treatment, payment, and health care operations.
12 County and College intend to protect the privacy and provide for the security of PHI
13 pursuant to the Agreement in compliance with HIPAA, the Health Information Technology for
14 Economic and Clinical Health Act, Public Law 111-005 (HITECH), and regulations promulgated
15 thereunder by the U.S. Department of Health and Human Services (HIPAA Regulations) and
16 other applicable laws.
17 As part of the HIPAA Regulations, the Privacy Rule and the Security Rule require
18 College to enter into an agreement containing specific requirements prior to the disclosure of
19 PHI, as set forth in, but not limited to, Title 45, Sections 164.314(a), 164.502(e) and 164.504(e)
20 of the Code of Federal Regulations. The parties agree to the requirements in Exhibit I to this
21 Agreement.
22 Article 12
23 Data Security
24 12.1 Data Security Requirements. College shall comply with data security requirements
25 in Exhibit C to this Agreement.
26
27
28
10
1 Article 13
2 Disclosure of Self-Dealing Transactions
3 13.1 Applicability. This Article 13 applies if the College is operating as a corporation, or
4 changes its status to operate as a corporation.
5 13.2 Duty to Disclose. If any member of the College's board of directors is party to a self-
6 dealing transaction, he or she shall disclose the transaction by completing and signing a "Self-
7 Dealing Transaction Disclosure Form" (Exhibit D to this Agreement) and submitting it to the
8 County before commencing the transaction or immediately after.
9 13.3 Definition. "Self-dealing transaction" means a transaction to which the College is a
10 party and in which one or more of its directors, as an individual, has a material financial interest.
11 Article 14
12 Disclosure of Ownership and/or Control Interest Information
13 14.1 Applicability. This provision is only applicable if College is disclosing entities, fiscal
14 agents, or managed care entities, as defined in Code of Federal Regulations (C.F.R.), Title 42
15 §§ 455.101, 455.104 and 455.106(a)(1),(2).
16 14.2 Duty to Disclose. College must disclose the following information as requested in
17 the Provider Disclosure Statement, Disclosure of Ownership and Control Interest Statement,
18 Exhibit E:
19 (A) Disclosure of five percent (5%) or More Ownership Interest:
20 (1) In the case of corporate entities with an ownership or control interest in the
21 disclosing entity, the primary business address as well as every business location
22 and P.O. Box address must be disclosed. In the case of an individual, the date of
23 birth and Social Security number must be disclosed.
24 (2) In the case of a corporation with ownership or control interest in the
25 disclosing entity or in any subcontractor in which the disclosing entity has a five
26 percent (5%) or more interest, the corporation tax identification number must be
27 disclosed.
28
11
1 (3) For individuals or corporations with ownership or control interest in any
2 subcontractor in which the disclosing entity has a five percent (5%) or more interest,
3 the disclosure of familial relationship is required.
4 (4) For individuals with five percent (5%) or more direct or indirect ownership
5 interest of a disclosing entity, the individual shall provide evidence of completion of a
6 criminal background check, including fingerprinting, if required by law, prior to
7 execution of Contract. (42 C.F.R. § 455.434)
8 (B) Disclosures Related to Business Transactions:
9 (1) The ownership of any subcontractor with whom College has had business
10 transactions totaling more than $25,000 during the twelve (12) month period ending
11 on the date of the request.
12 (2) Any significant business transactions between College and any wholly owned
13 supplier, or between College and any subcontractor, during the five (5) year period
14 ending on the date of the request. (42 C.F.R. § 455.105(b).)
15 (C) Disclosures Related to Persons Convicted of Crimes:
16 (1) The identity of any person who has an ownership or control interest in the
17 provider or is an agent or managing employee of the provider who has been
18 convicted of a criminal offense related to that person's involvement in any program
19 under the Medicare, Medicaid, or the Title XXI services program since the inception
20 of those programs. (42 C.F.R. § 455.106.)
21 (2) County shall terminate the enrollment of College if any person with five
22 percent (5%) or greater direct or indirect ownership interest in the disclosing entity
23 has been convicted of a criminal offense related to the person's involvement with
24 Medicare, Medicaid, or Title XXI program in the last ten (10) years.
25 14.3 College must provide disclosure upon execution of Contract, extension for renewal,
26 and within thirty-five (35) days after any change in College ownership or upon request of
27 County. County may refuse to enter into an agreement or terminate an existing agreement with
28 College if College fails to disclose ownership and control interest information, information
12
1 related to business transactions and information on persons convicted of crimes, or if College
2 did not fully and accurately make the disclosure as required.
3 14.4 College must provide the County with written disclosure of any prohibited affiliations
4 under 42 C.F.R. § 438.610. College must not employ or subcontract with providers or have
5 other relationships with providers Excluded from participation in Federal Health Care Programs,
6 including Medi-Cal/Medicaid or procurement activities, as set forth in 42 C.F.R. §438.610.
7 14.5 Reporting. Submissions shall be scanned pdf copies and are to be sent via email to
8 DBHStaffDevelopment@fresnocountyca.gov. County may deny enrollment or terminate this
9 Agreement where any person with five percent (5%) or greater direct or indirect ownership
10 interest in College has been convicted of a criminal offense related to that person's involvement
11 with the Medicare, Medicaid, or Title XXI program in the last ten (10) years. County may
12 terminate this Agreement where any person with five percent (5%) or greater direct or indirect
13 ownership interest in the College did not submit timely and accurate information and cooperate
14 with any screening method required in CFR, Title 42, Section 455.416.
15 Article 15
16 Disclosure of Criminal History and Civil Actions
17 15.1 Applicability. College is required to disclose if any of the following conditions apply
18 to them, their owners, officers, corporate managers, or partners (hereinafter collectively referred
19 to as "College"):
20 (A) Within the three (3) year period preceding the Agreement award, they have been
21 convicted of, or had a civil judgment tendered against them for:
22 (1) Fraud or criminal offense in connection with obtaining, attempting to obtain,
23 or performing a public (federal, state, or local) transaction or contract under a public
24 transaction;
25 (2) Violation of a federal or state antitrust statute;
26 (3) Embezzlement, theft, forgery, bribery, falsification, or destruction of records;
27 or
28 (4) False statements or receipt of stolen property.
13
1 (B) Within a three (3) year period preceding their Agreement award, they have had a
2 public transaction (federal, state, or local) terminated for cause or default.
3 15.2 Duty to Disclose. Disclosure of the above information will not automatically
4 eliminate College from further business consideration. The information will be considered as
5 part of the determination of whether to continue and/or renew this Agreement and any additional
6 information or explanation that College elects to submit with the disclosed information will be
7 considered. If it is later determined that the College failed to disclose required information, any
8 contract awarded to such College may be immediately voided and terminated for material failure
9 to comply with the terms and conditions of the award.
10 College must sign a "Certification Regarding Debarment, Suspension, and Other
11 Responsible Matters — Primary Covered Transactions" in the form set forth in Exhibit F attached
12 hereto and by this reference incorporated herein. Additionally, College must immediately advise
13 the County in writing if, during the term of the Agreement: (1) College becomes suspended,
14 debarred, excluded or ineligible for participation in Federal or State funded programs or from
15 receiving federal funds as listed in the excluded parties list system (http://www.epls.gov); or (2)
16 any of the above listed conditions become applicable to College. College shall indemnify,
17 defend, and hold County harmless for any loss or damage resulting from a conviction,
18 debarment, exclusion, ineligibility, or other matter listed in the signed Certification Regarding
19 Debarment, Suspension, and Other Responsibility Matters.
20 Article 16
21 General Terms
22 16.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
23 Agreement may not be modified, and no waiver is effective, except by written agreement signed
24 by both parties. The College acknowledges that County employees have no authority to modify
25 this Agreement except as expressly provided in this Agreement.
26 (A) Notwithstanding the above, non-material changes to services, staffing, and
27 responsibilities of the College, as needed, to accommodate changes in the laws relating
28 to service requirements and specialty mental health treatment, may be made with the
14
1 signed written approval of County's DBH Director, or designee, and College through an
2 amendment approved by County's County Counsel and the County's Auditor-
3 Controller/Treasurer-Tax Collector's Office. Said modifications shall not result in any
4 change to the maximum compensation amount payable to College, as stated herein.
5 (B) Other College educational training programs that require facilities to provide
6 clinical and field experience programs may be added to this Agreement upon written
7 consent of the County DBH Director, or designee, and the College.
8 16.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
9 under this Agreement without the prior written consent of the other party.
10 16.3 Governing Law. The laws of the State of California govern all matters arising from
11 or related to this Agreement.
12 16.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
13 County, California. College consents to California jurisdiction for actions arising from or related
14 to this Agreement, and, subject to the Government Claims Act, all such actions must be brought
15 and maintained in Fresno County.
16 16.5 Construction. The final form of this Agreement is the result of the parties' combined
17 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
18 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
19 against either party.
20 16.6 Days. Unless otherwise specified, "days" means calendar days.
21 16.7 Headings. The headings and section titles in this Agreement are for convenience
22 only and are not part of this Agreement.
23 16.8 Severability. If anything in this Agreement is found by a court of competent
24 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
25 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
26 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
27 intent.
28
15
1 16.9 Nondiscrimination. During the performance of this Agreement, the College shall not
2 unlawfully discriminate against any employee or applicant for employment, or recipient of
3 services, because of race, religious creed, color, national origin, ancestry, physical disability,
4 mental disability, medical condition, genetic information, marital status, sex, gender, gender
5 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
6 all applicable State of California and federal statutes and regulation.
7 16.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
8 of the College under this Agreement on any one or more occasions is not a waiver of
9 performance of any continuing or other obligation of the College and does not prohibit
10 enforcement by the County of any obligation on any other occasion.
11 16.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
12 between the College and the County with respect to the subject matter of this Agreement, and it
13 supersedes all previous negotiations, proposals, commitments, writings, advertisements,
14 publications, and understandings of any nature unless those things are expressly included in
15 this Agreement. If there is any inconsistency between the terms of this Agreement without its
16 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
17 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
18 exhibits.
19 16.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
20 create any rights or obligations for any person or entity except for the parties.
21 16.13 Authorized Signature. The College represents and warrants to the County that:
22 (A) The College is duly authorized and empowered to sign and perform its
23 obligations under this Agreement.
24 (B) The individual signing this Agreement on behalf of the College is duly authorized
25 to do so and his or her signature on this Agreement legally binds the College to the
26 terms of this Agreement.
27 16.14 Electronic Signatures. The parties agree that this Agreement may be executed by
28 electronic signature as provided in this section.
16
1 (A) An "electronic signature" means any symbol or process intended by an individual
2 signing this Agreement to represent their signature, including but not limited to (1) a
3 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
4 electronically scanned and transmitted (for example by PDF document) version of an
5 original handwritten signature.
6 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
7 equivalent to a valid original handwritten signature of the person signing this Agreement
8 for all purposes, including but not limited to evidentiary proof in any administrative or
9 judicial proceeding, and (2) has the same force and effect as the valid original
10 handwritten signature of that person.
11 (C)The provisions of this section satisfy the requirements of Civil Code section
12 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
13 Part 2, Title 2.5, beginning with section 1633.1).
14 (D) Each party using a digital signature represents that it has undertaken and
15 satisfied the requirements of Government Code section 16.5, subdivision (a),
16 paragraphs (1) through (5), and agrees that each other party may rely upon that
17 representation.
18 (E) This Agreement is not conditioned upon the parties conducting the transactions
19 under it by electronic means and either party may sign this Agreement with an original
20 handwritten signature.
21 16.15 Counterparts. This Agreement may be signed in counterparts, each of which is an
22 original, and all of which together constitute this Agreement.
23 [SIGNATURE PAGE FOLLOWS]
24
25
26
27
28
17
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
West Hills Community College District County of Fresno
3
4 ..
5 Vice Chancellor of Business and Fiscal Nathan Magsig, Chairman of the Board of
Services Supervisors of the County of Fresno
6
275 Phelps Ave Attest:
7 Coalinga, CA 93210 Bernice E. Seidel
Phone No: 559-934-2160 Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By:
10 Deputy
11 For accounting use only:
12 Org No.: 56302003
Account No.: 7295
13 Fund No.: 0001
Subclass No.: 10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
18
Exhibit A
1 Scope of Services
2 I. Responsibilities of College
3 a. County's DBH Director, or designee, shall have sole authority as to how
4 many placements for internships shall be made available to College
5 during each term of this Agreement. College agrees that each
6 participating student and/or instructor from College shall be in compliance
7 with County's health clearance requirements. Prior to the first clinical
8 rotation of each student and/or instructor at County's facilities, College
9 must provide County proof that each student and/or instructor assigned to
10 County meets County's health clearance requirements, including, but not
11 limited to:
12 i. Hepatitis B Vaccination Series - Since the work may lead to a
13 reasonably anticipated skin, eye, mucous membrane, or
14 parenteral contact with blood or other potentially infectious
15 materials, each student and/or instructor must have received
16 Hepatitis B vaccination series prior to commencing placement at
17 County; or
18 ii. Hepatitis B Vaccine Declination Form - In lieu of student and/or
19 instructor certifying to County that the student has been
20 vaccinated for Hepatitis B, County will accept from each student
21 and/or instructor a form declining the Hepatitis B vaccination.
22 The declination form shall comply with the requirements of 29
23 Code of Federal Regulations, section 1910.1030, as set forth by
24 this reference incorporated herein. Student and/or instructor may
25 use County's Hepatitis B Vaccine Declination Form, identified as
26 Exhibit G, attached hereto and by this reference incorporated
27 herein, to meet the above requirements; and
28
A-1
Exhibit A
1 iii. Providing proof of a negative skin test for tuberculosis (TB)
2 within the past twelve (12) months. For positive TB skin test
3 within the past twelve (12) months, an initial assessment and
4 yearly assessment for signs and symptoms of disease will be
5 required; and
6 iv. Providing Measles, Mumps, and Rubella (MMR) vaccination
7 status or serological evidence of immunity to rubella or rubeola;
8 and
9 V. Providing proof of fulfillment of OSHA Blood-borne Pathogen
10 Standards (mandated training and post-exposure follow-up); and
11 vi. Providing any other health clearance requirements as may be
12 mandated during the term of this Agreement by County due to
13 licensing regulations and/or requirements.
14 b. County and College mutually recognize that the health clearance
15 requirements identified above may be different and/or may change, as
16 determined by County, depending upon classification of student and/or
17 instructor and the type of work performed in addition to potential patient
18 exposure.
19 c. College recognizes that the clinical and field education programs
20 conducted pursuant to the terms and conditions of this Agreement are
21 educational programs of College and not of County, and that students
22 participating in College's programs shall at all times be under the
23 exclusive jurisdiction of College.
24 d. College shall designate students enrolled in the various educational
25 training programs of College to be assigned for clinical and field
26 experience at County facilities, in such numbers to be mutually agreed
27 upon by both County and College.
28
A-2
Exhibit A
1 e. College shall establish a rotational plan for the learning experience
2 available at County facilities and shall schedule the students in conformity
3 with the calendar of College's academic year and with the curriculum of
4 the educational programs of College; provided, however, that the specific
5 County patient care areas to be utilized by College shall be selected
6 subsequently by mutual agreement between County's DBH Director, or
7 designee, and College's chairpersons or duly authorized representatives
8 of the various departments/programs listed in the "Recitals" section. Other
9 College programs may be added to this Agreement upon the written
10 consent of the County DBH Director, or designee, and the College.
11 f. College shall supervise all instruction of the clinical and field experience
12 given at County facilities to assigned students and shall provide the
13 necessary instructors for educational training programs provided for
14 under this Agreement.
15 g. College shall keep all attendance and academic records of students
16 participating in the clinical and field experience programs provided for
17 under this Agreement.
18 h. College shall require students to act professionally and appropriately
19 while at County facilities.
20 i. College shall require every student to conform to all applicable County
21 policies, procedures, regulations, and all requirements and restrictions
22 specified jointly by representatives of College and County.
23 j. College shall require its instructors to notify County's DBH Director, or
24 designee, as appropriate in advance of student placement regarding:
25 i. Locations, dates, times and the number of hours or changes
26 thereof, regarding student availability for clinical or field
27 assignment; and
28
A-3
Exhibit A
1 ii. Any change in the placement of students in clinical and field
2 assignments.
3 k. College shall, in consultation and coordination with County's DBH
4 Director, or designee, arrange for periodic conferences between
5 appropriate representatives of College and County to evaluate the clinical
6 and field experience programs provided under this Agreement.
7 I. College shall provide and be responsible for the use and control of its
8 educational supplies, materials and equipment used for instruction during
9 the clinical and field experience programs.
10 m. College shall distribute to each student a statement, which explains the
11 hazards of drug abuse in their profession.
12 n. College shall provide for an introductory orientation of students assigned
13 to County facilities, which shall provide an overview of the clinical and
14 field assignment(s) and the terms and conditions of student placement at
15 County facilities.
16 o. College agrees that special reports, projects, thesis, and/or publications
17 based upon studies and research arising out of the cooperative education
18 experience permitted by this Agreement, shall be reviewed and approved
19 prior to release through the committee responsible for planning the
20 course and then with County's DBH Director, or designee, as appropriate,
21 for approval by means of such procedures as County shall designate.
22 Approval of reports by College's planning committee and County's DBH
23 shall not be unreasonably withheld.
24 p. College agrees to complete an evaluation of each student at least once
25 during a specific program period.
26 q. College shall allow County program managers and other designated
27 personnel to attend meetings of College's faculty, or any committee
28 thereof, to coordinate the clinical and field experience programs provided
A-4
Exhibit A
1 under this Agreement and to designate lines of authority and
2 communication for coordination of relations between County personnel
3 and College instructors.
4 r. College's employees, agents and students shall abide by the provisions
5 of State of California law relating to confidentiality of medical records,
6 further described in Article Eleven (11) of this Agreement, and any person
7 knowingly and intentionally violating the provisions of State of California
8 law may be guilty of a misdemeanor.
9 s. College's employees, agents and students shall be issued County
10 identification badges, which must be worn only at County facilities while
11 participating in the clinical and field experience programs, pursuant to the
12 terms and conditions of this Agreement.
13 t. College will ensure each participating student referred for program
14 participation has adequate transportation and proof of auto insurance as
15 participating students will not be permitted to operate County vehicles to
16 perform activities related to this Agreement. College will provide proof of
17 Worker's Compensation coverage for its employees for injury during
18 clinical and field experience.
19 u. College acknowledges that select students shall be required to have
20 fingerprinting performed prior to entry to certain facilities.
21 v. College acknowledges that services performed in certain County
22 detention facilities shall be performed in accordance to Exhibit H, "No
23 Hostage Facility," attached hereto and incorporated herein by this
24 reference.
25 w. College's students shall purchase food or bring food with them; no special
26 arrangement for food will be made.
27
28
A-5
Exhibit B
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the College or any third parties,
College, at its sole expense, shall maintain in full force and effect the following insurance
policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence and an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
Coverage must include products, completed operations, property damage, bodily injury,
personal injury, and advertising injury. The College shall obtain an endorsement to this
policy naming the County of Fresno, its officers, agents, employees, and volunteers,
individually and collectively, as additional insureds, but only insofar as the operations
under this Agreement are concerned. Such coverage for additional insureds will apply as
primary insurance and any other insurance, or self-insurance, maintained by the County
is excess only and not contributing with insurance provided under the College's policy.
(B) Automobile Liability. Automobile liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages.
Coverage must include any auto used in connection with this Agreement.
(C)Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(D) Employer's Liability. Employer's liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for disease.
(E) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1)the retroactive date must
be prior to the date on which services began under this Agreement; (2)the College shall
maintain the policy and provide to the County annual evidence of insurance for not less
than five years after completion of services under this Agreement; and (3) if the policy is
canceled or not renewed, and not replaced with another claims-made policy with a
retroactive date prior to the date on which services begin under this Agreement, then the
College shall purchase extended reporting coverage on its claims-made policy for a
minimum of five years after completion of services under this Agreement.
(F) Molestation Liability. Sexual abuse/ molestation liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence, with an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
(G)Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data) that is in the care, custody, or control of the College.
B-1
Exhibit B
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) breach of any of the College's obligations under [Article 12,
Exhibit C] of this Agreement; (iv) system failure; (v) data recovery; (vi) failure to timely
disclose data breach or Security Breach; (vii) failure to comply with privacy policy; (viii)
payment card liabilities and costs; (ix) infringement of intellectual property, including but
not limited to infringement of copyright, trademark, and trade dress; (x) invasion of
privacy, including release of private information; (xi) information theft; (xii) damage to or
destruction or alteration of electronic information; (xiii) cyber extortion; (xiv) extortion
related to the College's obligations under this Agreement regarding electronic
information, including Personal Information; (xv) fraudulent instruction; (xvi) funds
transfer fraud; (xvii) telephone fraud; (xviii) network security; (xix) data breach response
costs, including Security Breach response costs; (xx) regulatory fines and penalties
related to the College's obligations under this Agreement regarding electronic
information, including Personal Information; and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the College signs this Agreement, and at
any time during the term of this Agreement as requested by the County's Risk Manager
or the County Administrative Office, the College shall deliver, or cause its broker or
producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th Floor,
Fresno, California 93721, or HRRiskManagement@fresnocountyca.gov, and by mail or
email to the person identified to receive notices under this Agreement, certificates of
insurance and endorsements for all of the coverages required under this Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; (2) the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
College has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
College's policy.
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
B-2
Exhibit B
(v) The technology professional liability insurance certificate must also state that
coverage encompasses all of the College's obligations under this Agreement,
including but not limited to claims involving Cyber Risks, as that term is defined in
this Agreement.
(vi) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the College.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the College shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the College shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the College shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the College or its insurer to timely provide a written notice required by this
paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the College has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the College shall deliver, or cause its broker or producer to
deliver, to the County's Risk Manager certificates of insurance and endorsements for all
of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The College waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The College is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the College's waiver of subrogation under this paragraph is effective whether
or not the College obtains such an endorsement.
(F) County's Remedy for College's Failure to Maintain. If the College fails to keep in
effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the College. The County may offset such
charges against any amounts owed by the County to the College under this Agreement.
B-3
Exhibit B
(G)Subcontractors. The College shall require and verify that all subcontractors used by
the College to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the College to provide services under this Agreement using subcontractors.
B-4
EXHIBIT C
Data Security Requirements
1. Definitions
18.19 Capitalized terms used in this Exhibit C have the meanings set forth in this section
a. "Authorized Employees" means the Contractor(s)'s employees who have access to
Personal Information.
b. "Authorized Persons" means: (i) any and all Authorized Employees; and (ii) any and all
of the Contractor(s)'s subcontractors, representatives, agents, outsourcers, and
consultants, and providers of professional services to Contractor(s), who have access to
Personal Information and are bound by law or in writing by confidentiality obligations
sufficient to protect Personal Information in accordance with the terms of this Exhibit C.
c. "Director" means the County's Director of the Department of Behavioral Health or his or
her designee.
d. "Disclose" or any derivative of that word means to disclose, release, transfer,
disseminate, or otherwise provide access to or communicate all or any part of any
Personal Information orally, in writing, or by electronic or any other means to any person.
e. "Person" means any natural person, corporation, partnership, limited liability company,
firm, or association.
f. "Personal Information" means any and all information, including any data, provided, or
to which access is provided, to Contractor(s) by or upon the authorization of the County,
under this Agreement, including but not limited to vital records, that: (i) identifies,
describes, or relates to, or is associated with, or is capable of being used to identify,
describe, or relate to, or associate with, a person (including, without limitation, names,
physical descriptions, signatures, addresses, telephone numbers, e-mail addresses,
education, financial matters, employment history, and other unique identifiers, as well as
statements made by or attributable to the person); (ii) is used or is capable of being used
to authenticate a person (including, without limitation, employee identification numbers,
government-issued identification numbers, passwords or personal identification numbers
(PINs), financial account numbers, credit report information, answers to security
questions, and other personal identifiers); or (iii) is personal information within the
meaning of California Civil Code section 1798.3, subdivision (a), or 1798.80, subdivision
E. Personal Information does not include publicly available information that is lawfully
made available to the general public from federal, state, or local government records.
g. "Privacy Practices Complaint" means a complaint received by the County relating to
the Contractor(s)'s (or any Authorized Person's) privacy practices, or alleging a Security
Breach. Such complaint shall have sufficient detail to enable Contractor(s) to promptly
investigate and take remedial action under this Exhibit C.
h. "Security Safeguards" means physical, technical, administrative or organizational
security procedures and practices put in place by Contractor(s) (or any Authorized
Persons) that relate to the protection of the security, confidentiality, value, or integrity of
Personal Information. Security Safeguards shall satisfy the minimal requirements set
forth in section 3(C) of this Exhibit C.
C-1
EXHIBIT C
Data Security Requirements
i. "Security Breach" means (i) any act or omission that compromises either the security,
confidentiality, value, or integrity of any Personal Information or the Security Safeguards,
or (ii) any unauthorized Use, Disclosure, or modification of, or any loss or destruction of,
or any corruption of or damage to, any Personal Information.
j. "Use" or any derivative of that word means to receive, acquire, collect, apply,
manipulate, employ, process, transmit, disseminate, access, store, disclose, or dispose
of Personal Information.
3. Standard of Care
a. Contractor(s) acknowledges that, in the course of its engagement by the County under
this Agreement, Contractor(s), or any Authorized Persons, may Use Personal
Information only as permitted in this Agreement.
b. Contractor(s) acknowledges that Personal Information is deemed to be confidential
information of, or owned by, the County (or persons from whom the County receives or
has received Personal Information) and is not confidential information of, or owned or by,
Contractor(s), or any Authorized Persons. Contractor(s)further acknowledges that all
right, title, and interest in or to the Personal Information remains in the County (or
persons from whom the County receives or has received Personal Information)
regardless of Contractor(s)'s, or any Authorized Person's, Use of that Personal
Information.
c. Contractor(s) agrees and covenants in favor of the Country that Contractor(s) shall:
i. Keep and maintain all Personal Information in strict confidence, using such
degree of care under this section 2 as is reasonable and appropriate to avoid a
Security Breach;
ii. Use Personal Information exclusively for the purposes for which the Personal
Information is made accessible to Contractor(s) pursuant to the terms of this
Exhibit I;
iii. Not Use, Disclose, sell, rent, license, or otherwise make available Personal
Information for Contractor(s)'s own purposes or for the benefit of anyone other
than the County, without the County's express prior written consent, which the
County may give or withhold in its sole and absolute discretion; and
iv. Not, directly or indirectly, Disclose Personal Information to any person (an
"Unauthorized Third Party") other than Authorized Persons pursuant to this
Agreement, without the Director's express prior written consent.
d. Notwithstanding the foregoing paragraph, in any case in which Contractor(s) believes it,
or any Authorized Person, is required to disclose Personal Information to government
regulatory authorities, or pursuant to a legal proceeding, or otherwise as may be
required by applicable law, Contractor(s) shall (i) immediately notify the County of the
specific demand for, and legal authority for the disclosure, including providing County
with a copy of any notice, discovery demand, subpoena, or order, as applicable,
C-2
EXHIBIT C
Data Security Requirements
received by Contractor(s), or any Authorized Person, from any government regulatory
authorities, or in relation to any legal proceeding, and (ii) promptly notify the County
before such Personal Information is offered by Contractor(s) for such disclosure so that
the County may have sufficient time to obtain a court order or take any other action the
County may deem necessary to protect the Personal Information from such disclosure,
and Contractor(s) shall cooperate with the County to minimize the scope of such
disclosure of such Personal Information.
e. Contractor(s) shall remain liable to the County for the actions and omissions of any
Unauthorized Third Party concerning its Use of such Personal Information as if they
were Contractor(s)'s own actions and omissions.
4. Information Security
a. Contractor(s) covenants, represents and warrants to the County that Contractor(s)'s Use
of Personal Information under this Agreement does and will at all times comply with all
applicable federal, state, and local, privacy and data protection laws, as well as all other
applicable regulations and directives, including but not limited to California Civil Code,
Division 3, Part 4, Title 1.81 (beginning with section 1798.80), and the Song-Beverly
Credit Card Act of 1971 (California Civil Code, Division 3, Part 4, Title 1.3, beginning with
section 1747). If Contractor(s) uses credit, debit or other payment cardholder information,
Contractor(s) shall at all times remain in compliance with the Payment Card Industry
Data Security Standard ("PCI DSS") requirements, including remaining aware at all times
of changes to the PCI DSS and promptly implementing and maintaining all procedures
and practices as may be necessary to remain in compliance with the PCI DSS, in each
case, at Contractor(s)'s sole cost and expense.
b. Contractor(s) covenants, represents and warrants to the County that, as of the effective
date of this Agreement, Contractor(s) has not received notice of any violation of any
privacy or data protection laws, as well as any other applicable regulations or directives,
and is not the subject of any pending legal action or investigation by, any government
regulatory authority regarding same.
c. Without limiting Contractor(s)'s obligations under section 3(A) of this Exhibit C,
Contractor(s)'s (or Authorized Person's) Security Safeguards shall be no less rigorous
than accepted industry practices and, at a minimum, include the following:
i. Limiting Use of Personal Information strictly to Contractor(s)'s and Authorized
Persons' technical and administrative personnel who are necessary for
Contractor(s)'s, or Authorized Persons', Use of the Personal Information pursuant
to this Agreement;
ii. Ensuring that all of Contractor(s)'s connectivity to County computing systems will
only be through the County's security gateways and firewalls, and only through
security procedures approved upon the express prior written consent of the
Director;
iii. To the extent that they contain or provide access to Personal Information, (a)
securing business facilities, data centers, paper files, servers, back-up systems
C-3
EXHIBIT C
Data Security Requirements
and computing equipment, operating systems, and software applications,
including, but not limited to, all mobile devices and other equipment, operating
systems, and software applications with information storage capability; (b)
employing adequate controls and data security measures, both internally and
externally, to protect (1) the Personal Information from potential loss or
misappropriation, or unauthorized Use, and (2) the County's operations from
disruption and abuse; (c) having and maintaining network, device application,
database and platform security; (d) maintaining authentication and access
controls within media, computing equipment, operating systems, and software
applications; and (e) installing and maintaining in all mobile, wireless, or
handheld devices a secure internet connection, having continuously updated
anti-virus software protection and a remote wipe feature always enabled, all of
which is subject to express prior written consent of the Director;
iv. Encrypting all Personal Information at advance encryption standards of
Advanced Encryption Standards (AES) of 128 bit or higher (a) stored on any
mobile devices, including but not limited to hard disks, portable storage devices,
or remote installation, or (b) transmitted over public or wireless networks (the
encrypted Personal Information must be subject to password or pass phrase, and
be stored on a secure server and transferred by means of a Virtual Private
Network (VPN) connection, or another type of secure connection, all of which is
subject to express prior written consent of the Director);
V. Strictly segregating Personal Information from all other information of
Contractor(s), including any Authorized Person, or anyone with whom
Contractor(s) or any Authorized Person deals so that Personal Information is not
commingled with any other types of information;
vi. Having a patch management process including installation of all operating
system and software vendor security patches;
vii. Maintaining appropriate personnel security and integrity procedures and
practices, including, but not limited to, conducting background checks of
Authorized Employees consistent with applicable law; and
viii. Providing appropriate privacy and information security training to Authorized
Employees.
d. During the term of each Authorized Employee's employment by Contractor(s),
Contractor(s) shall cause such Authorized Employees to abide strictly by the
Contractor(s)'s obligations under this Exhibit C. Contractor(s) shall maintain a disciplinary
process to address any unauthorized Use of Personal Information by any Authorized
Employees.
e. Contractor(s) shall, in a secure manner, backup daily, or more frequently if it is
Contractor(s)'s practice to do so more frequently, Personal Information received from the
County, and the County shall have immediate, real time access, at all times, to such
C-4
EXHIBIT C
Data Security Requirements
backups via a secure, remote access connection provided by Contractor(s), through the
Internet.
f. Contractor(s) shall provide the County with the name and contact information for each
Authorized Employee (including such Authorized Employee's work shift, and at least one
alternate Authorized Employee for each Authorized Employee during such work shift)
who shall serve as the County's primary security contact with Contractor(s) and shall be
available to assist the County twenty-four (24) hours per day, seven (7) days per week
as a contact in resolving Contractor(s)'s and any Authorized Persons' obligations
associated with a Security Breach or a Privacy Practices Complaint.
g. Contractor(s) shall not knowingly include or authorize any Trojan Horse, back door, time
bomb, drop dead device, worm, virus, or other code of any kind that may disable, erase,
display any unauthorized message within, or otherwise impair any County computing
system, with or without the intent to cause harm.
5. Security Breach Procedures
a. Immediately upon Contractor(s)'s awareness or reasonable belief of a Security Breach,
Contractor(s) shall (i) notify the Director of the Security Breach, such notice to be given
first by telephone at the following telephone number, followed promptly by email at the
following email address: (559) 600-5900 / incidents(a-_)fresnocountyca.gov (which
telephone number and email address the County may update by providing notice to the
Contractor(s)), and (ii) preserve all relevant evidence (and cause any affected Authorized
Person to preserve all relevant evidence) relating to the Security Breach. The notification
shall include, to the extent reasonably possible, the identification of each type and the
extent of Personal Information that has been, or is reasonably believed to have been,
breached, including but not limited to, compromised, or subjected to unauthorized Use,
Disclosure, or modification, or any loss or destruction, corruption, or damage.
b. Immediately following Contractor(s)'s notification to the County of a Security Breach, as
provided pursuant to section 4(A) of this Exhibit C, the Parties shall coordinate with each
other to investigate the Security Breach. Contractor(s) agrees to fully cooperate with the
County, including, without limitation:
i. assisting the County in conducting any investigation;
ii. providing the County with physical access to the facilities and operations affected;
iii. facilitating interviews with Authorized Persons and any of Contractor(s)'s other
employees knowledgeable of the matter; and
iv. making available all relevant records, logs, files, data reporting and other
materials required to comply with applicable law, regulation, industry standards,
or as otherwise reasonably required by the County.
To that end, Contractor(s) shall, with respect to a Security Breach, be solely responsible,
at its cost, for all notifications required by law and regulation, or deemed reasonably
C-5
EXHIBIT C
Data Security Requirements
necessary by the County, and Contractor(s) shall provide a written report of the
investigation and reporting required to the Director within 30 days after Contractor(s)'s
discovery of the Security Breach.
c. County shall promptly notify Contractor(s) of the Director's knowledge, or reasonable
belief, of any Privacy Practices Complaint, and upon Contractor(s)'s receipt of that
notification, Contractor(s) shall promptly address such Privacy Practices Complaint,
including taking any corrective action under this Exhibit C, all at Contractor(s)'s sole
expense, in accordance with applicable privacy rights, laws, regulations and standards.
In the event Contractor(s) discovers a Security Breach, Contractor(s) shall treat the
Privacy Practices Complaint as a Security Breach. Within 24 hours of Contractor(s)'s
receipt of notification of such Privacy Practices Complaint, Contractor(s) shall notify the
County whether the matter is a Security Breach, or otherwise has been corrected and the
manner of correction, or determined not to require corrective action and the reason for
that determination.
d. Contractor(s) shall take prompt corrective action to respond to and remedy any Security
Breach and take mitigating actions, including but not limiting to, preventing any
reoccurrence of the Security Breach and correcting any deficiency in Security
Safeguards as a result of such incident, all at Contractor(s)'s sole expense, in
accordance with applicable privacy rights, laws, regulations and standards. Contractor(s)
shall reimburse the County for all reasonable costs incurred by the County in responding
to, and mitigating damages caused by, any Security Breach, including all costs of the
County incurred relation to any litigation or other action described section 4(E) of this
Exhibit C.
e. Contractor(s) agrees to cooperate, at its sole expense, with the County in any litigation or
other action to protect the County's rights relating to Personal Information, including the
rights of persons from whom the County receives Personal Information.
6. Oversight of Security Compliance
a. Contractor(s) shall have and maintain a written information security policy that specifies
Security Safeguards appropriate to the size and complexity of Contractor(s)'s operations
and the nature and scope of its activities.
b. Upon the County's written request, to confirm Contractor(s)'s compliance with this
Exhibit I, as well as any applicable laws, regulations and industry standards,
Contractor(s) grants the County or, upon the County's election, a third party on the
County's behalf, permission to perform an assessment, audit, examination or review of
all controls in Contractor(s)'s physical and technical environment in relation to all
Personal Information that is Used by Contractor(s) pursuant to this Agreement.
Contractor(s) shall fully cooperate with such assessment, audit or examination, as
applicable, by providing the County or the third party on the County's behalf, access to
all Authorized Employees and other knowledgeable personnel, physical premises,
documentation, infrastructure and application software that is Used by Contractor(s) for
C-6
EXHIBIT C
Data Security Requirements
Personal Information pursuant to this Agreement. In addition, Contractor(s) shall provide
the County with the results of any audit by or on behalf of Contractor(s) that assesses
the effectiveness of Contractor(s)'s information security program as relevant to the
security and confidentiality of Personal Information Used by Contractor(s) or Authorized
Persons during the course of this Agreement under this Exhibit C.
c. Contractor(s) shall ensure that all Authorized Persons who Use Personal Information
agree to the same restrictions and conditions in this Exhibit C. that apply to
Contractor(s) with respect to such Personal Information by incorporating the relevant
provisions of these provisions into a valid and binding written agreement between
Contractor(s) and such Authorized Persons, or amending any written agreements to
provide same.
7. Return or Destruction of Personal Information. Upon the termination of this Agreement,
Contractor(s) shall, and shall instruct all Authorized Persons to, promptly return to the County all
Personal Information, whether in written, electronic or other form or media, in its possession or
the possession of such Authorized Persons, in a machine readable form used by the County at
the time of such return, or upon the express prior written consent of the Director, securely
destroy all such Personal Information, and certify in writing to the County that such Personal
Information have been returned to the County or disposed of securely, as applicable. If
Contractor(s) is authorized to dispose of any such Personal Information, as provided in this
Exhibit C, such certification shall state the date, time, and manner (including standard) of
disposal and by whom, specifying the title of the individual. Contractor(s) shall comply with all
reasonable directions provided by the Director with respect to the return or disposal of Personal
Information and copies of Personal Information. If return or disposal of such Personal
Information or copies of Personal Information is not feasible, Contractor(s) shall notify the
County according, specifying the reason, and continue to extend the protections of this Exhibit C
to all such Personal Information and copies of Personal Information. Contractor(s) shall not
retain any copy of any Personal Information after returning or disposing of Personal Information
as required by this section 6. Contractor(s)'s obligations under this section 6 survive the
termination of this Agreement and apply to all Personal Information that Contractor(s) retains if
return or disposal is not feasible and to all Personal Information that Contractor(s) may later
discover.
8. Equitable Relief. Contractor(s) acknowledges that any breach of its covenants or obligations
set forth in this Exhibit C may cause the County irreparable harm for which monetary damages
would not be adequate compensation and agrees that, in the event of such breach or
threatened breach, the County is entitled to seek equitable relief, including a restraining order,
injunctive relief, specific performance and any other relief that may be available from any court,
in addition to any other remedy to which the County may be entitled at law or in equity. Such
remedies shall not be deemed to be exclusive but shall be in addition to all other remedies
available to the County at law or in equity or under this Agreement.
9. Indemnity. Contractor(s) shall defend, indemnify and hold harmless the County, its officers,
employees, and agents, (each, a "County Indemnitee") from and against any and all
infringement of intellectual property including, but not limited to infringement of copyright,
trademark, and trade dress, invasion of privacy, information theft, and extortion, unauthorized
Use, Disclosure, or modification of, or any loss or destruction of, or any corruption of or damage
C-7
EXHIBIT C
Data Security Requirements
to, Personal Information, Security Breach response and remedy costs, credit monitoring
expenses, forfeitures, losses, damages, liabilities, deficiencies, actions, judgments, interest,
awards, fines and penalties (including regulatory fines and penalties), costs or expenses of
whatever kind, including attorneys' fees and costs, the cost of enforcing any right to
indemnification or defense under this Exhibit C and the cost of pursuing any insurance
providers, arising out of or resulting from any third party claim or action against any County
Indemnitee in relation to Contractor(s)'s, its officers, employees, or agents, or any Authorized
Employee's or Authorized Person's, performance or failure to perform under this Exhibit C or
arising out of or resulting from Contractor(s)'s failure to comply with any of its obligations under
this section 8. The provisions of this section 8 do not apply to the acts or omissions of the
County. The provisions of this section 8 are cumulative to any other obligation of Contractor(s)
to, defend, indemnify, or hold harmless any County Indemnitee under this Agreement. The
provisions of this section 8 shall survive the termination of this Agreement.
10. Survival. The respective rights and obligations of Contractor(s) and the County as stated in
this Exhibit C shall survive the termination of this Agreement.
11. No Third Party Beneficiary. Nothing express or implied in the provisions of in this Exhibit
C is intended to confer, nor shall anything in this Exhibit C confer, upon any person other than
the County or Contractor(s) and their respective successors or assignees, any rights, remedies,
obligations or liabilities whatsoever.
12. No County Warranty. The County does not make any warranty or representation whether
any Personal Information in Contractor(s)'s (or any Authorized Person's) possession or control,
or Use by Contractor(s) (or any Authorized Person), pursuant to the terms of this Agreement is
or will be secure from unauthorized Use, or a Security Breach or Privacy Practices Complaint.
C-8
Exhibit D
Page 1 of 2
SELF-DEALING TRANSACTION DISCLOSURE FORM
In order to conduct business with the County of Fresno (hereinafter referred to as "County"),
members of a contractor's board of directors (hereinafter referred to as "County Contractor"),
must disclose any self-dealing transactions that they are a party to while providing goods,
performing services, or both for the County. A self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest"
The definition above will be utilized for purposes of completing this disclosure form.
INSTRUCTIONS
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to
the County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the
transaction; and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
(5) Form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
Exhibit D
Page 2 of 2
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of Corporations
Code 5233 (a)
5 Authorized Signature
Signature Date:
Exhibit E
Page 1 of 3
DISCLOSURE OF OWNERSHIP AND CONTROL INTEREST STATEMENT
I. Identifying Information
Name of entity D/B/A
Address(number,street) City State ZIP code
CILIA number Taxpayer ID number(EIN) Telephone number
( )
II. Answer the following questions by checking "Yes" or "No." If any of the questions are answered "Yes," list names and
addresses of individuals or corporations under"Remarks"on page 2. Identify each item number to be continued.
YES NO
A. Are there any individuals or organizations having a direct or indirect ownership or control interest
of five percent or more in the institution, organizations, or agency that have been convicted of a criminal
offense related to the involvement of such persons or organizations in any of the programs established
by Titles XVII I, XIX, or XX? ......................................................................................................................... o 0
B. Are there any directors, officers, agents, or managing employees of the institution, agency, or
organization who have ever been convicted of a criminal offense related to their involvement in such
programs established by Titles XVIII, XIX, or XX?...................................................................................... o 0
C. Are there any individuals currently employed by the institution, agency, or organization in a managerial,
accounting, auditing, or similar capacity who were employed by the institution's, organization's, or
agency's fiscal intermediary or carrier within the previous 12 months? (Title XVIII providers only)........... o 0
III. A. List names, addresses for individuals, or the EIN for organizations having direct or indirect ownership or a controlling
interest in the entity. (See instructions for definition of ownership and controlling interest.) List any additional names
and addresses under "Remarks" on page 2. If more than one individual is reported and any of these persons are
related to each other, this must be reported under"Remarks."
NAME ADDRESS EIN
B. Type of entity: o Sole proprietorship o Partnership o Corporation
o Unincorporated Associations o Other(specify)
C. If the disclosing entity is a corporation, list names, addresses of the directors, and EINs for corporations
under"Remarks."
D. Are any owners of the disclosing entity also owners of other Medicare/Medicaid facilities?
(Example: sole proprietor, partnership, or members of Board of Directors) If yes, list names, addresses
of individuals, and provider numbers........................................................................................................... o 0
NAME ADDRESS PROVIDER NUMBER
Exhibit E
Page 2 of 3
YES NO
IV. A. Has there been a change in ownership or control within the last year?....................................................... D D
If yes, give date.
B. Do you anticipate any change of ownership or control within the year?....................................................... D D
If yes, when?
C. Do you anticipate filing for bankruptcy within the year?................................................................................ D D
If yes, when?
V. Is the facility operated by a management company or leased in whole or part by another organization?.......... D D
If yes, give date of change in operations.
VI. Has there been a change in Administrator, Director of Nursing, or Medical Director within the last year?......... D D
VII. A. Is this facility chain affiliated? ...................................................................................................................... D D
If yes, list name, address of corporation, and EIN.
Name EIN
Address(number,name) City State ZIP code
B. If the answer to question VII.A. is NO, was the facility ever affiliated with a chain?
(If yes, list name, address of corporation, and EIN.)
Name EIN
Address(number,name) City State ZIP code
Whoever knowingly and willfully makes or causes to be made a false statement or representation of this statement, may be
prosecuted under applicable federal or state laws. In addition, knowingly and willfully failing to fully and accurately disclose the
information requested may result in denial of a request to participate or where the entity already participates, a termination of
its agreement or contract with the agency, as appropriate.
Name of authorized representative(typed) Title
Signature Date
Remarks
Exhibit E
Page 3 of 3
INSTRUCTIONS FOR COMPLETING DISCLOSURE OF CONTROL AND INTEREST STATEMENT
Please answer all questions as of the current date.If the yes block for any item is checked,list requested additional information under
the Remarks Section on page 2,referencing the item number to be continued. If additional space is needed use an attached sheet.
DETAILED INSTRUCTIONS
These instructions are designed to clarify certain questions on the form.Instructions are listed in question order for easy reference.No
instructions have been given for questions considered self-explanatory.
IT IS ESSENTIAL THAT ALL APPLICABLE QUESTIONS BE ANSWERED ACCURATELY AND THAT ALL INFORMATION
BE CURRENT.
Item I-Under"Identifying Information"specify in what capacity the entity is doing business as(DBA)(e.g.name of trade or
corporation).
Item II- Self-explanatory
Item III-List the names of all individuals and organizations having direct or indirect ownership interests,or controlling interest
separately or in combination amounting to an ownership interest of 5 percent or more in the disclosing entity.
Direct ownership interest-is defined as the possession of stock,equity in capital or any interest in the profits of the disclosing entity.
A disclosing entity is defined as a Medicare provider or supplier,or other entity that furnishes services or arranges for furnishing
services under Medicaid or the Maternal and Child Health program,or health related services under the social services program.
Indirect ownership interest-is defined as ownership interest in an entity that has direct or hospital-based home health agencies,are not
indirect ownership interest in the disclosing entity.The amount of indirect ownership in the disclosing entity that is held by any other
entity is determined by multiplying the percentage of ownership interest at each level.An indirect ownership interest must beds in the
facility now and the previous be reported if it equates to an ownership interest of 5 percent or more in the disclosing entity.Example:
if A owns 10 percent of the stock in a corporation that owns 80 percent of the stock of the disclosing entity,A's interest equates to an 8
percent indirect ownership and must be reported.
Controlling interest-is defined as the operational direction or management of disclosing entity which may be maintained by any or all
of the following devices:the ability or authority,expressed or reserved,to amend or change the corporate identity(i.e.,j oint venture
agreement,unincorporated business status)of the disclosing entity;the ability or authority to nominate or name members of the Board
of Directors or Trustees of the disclosing entity;the ability or authority,expressed or reserved,to amend or change the by-laws,
constitution,or other operating or management direction of the disclosing entity;the right to control any or all of the assets or other
property of the disclosing entity upon the sale or dissolution of that entity;the ability or authority,expressed or reserved,to control the
sale of any or all of the assets,to encumber such assets by way of mortgage or other indebtedness,to dissolve the entity or to arrange
for the sale or transfer of the disclosing entity to new ownership or control.
Item IV-VII-(Changes in Provider Status)For Items IV-VII,if the yes box is checked,list additional information requested under
Remarks. Clearly identify which item is being continued.
Change in provider status-is defined as any change in management control.Examples of such changes would include;a change in
Medical or Nursing Director,a new Administrator,contracting the operation of the facility to a management corporation,a change in
the composition of the owning partnership which under applicable State law is not considered a change in ownership,or the hiring or
dismissing of any employees with 5 percent or more financial interest in the facility or in an owning corporation,or any change of
ownership.
Item IV-(A&B)If there has been a change in ownership within the last year or if you anticipate a change,indicate the date in the
appropriate space.
Item V-If the answer is yes,list name of the management firm and employer identification number(EIN),or the name of the leasing
organization.A management company is defined as any organization that operates and manages a business on behalf of the owner of
that business,with the owner retaining ultimate legal responsibility for operation of the facility.
Item VI-If the answer is yes,identify which has changed(Administrator,Medical Director,or Director of Nursing)and the date the
change was made.Be sure to include name of the new Administrator,Director of Nursing or Medical Director,as appropriate.
Item VII-A chain affiliate is any free-standing health care facility that is either owned,controlled,or operated under lease or contract
by an organization consisting of two or more free-standing health care facilities organized within or across State lines which is under
the ownership or through any other device,control and direction of a common party. Chain affiliates include such facilities whether
public,private,charitable or proprietary.They also include subsidiary organizations and holding corporations. Provider-based
facilities,such as hospital-based home health agencies,are not considered to be chain affiliates.
Exhibit F
1 of 2
CERTIFICATION REGARDING DEBARMENT, SUSPENSION, AND OTHER
RESPONSIBILITY MATTERS--PRIMARY COVERED TRANSACTIONS
INSTRUCTIONS FOR CERTIFICATION
1. By signing and submitting this proposal, the prospective primary participant is
providing the certification set out below.
2. The inability of a person to provide the certification required below will not
necessarily result in denial of participation in this covered transaction. The prospective
participant shall submit an explanation of why it cannot provide the certification set out
below. The certification or explanation will be considered in connection with the
department or agency's determination whether to enter into this transaction. However,
failure of the prospective primary participant to furnish a certification or an explanation
shall disqualify such person from participation in this transaction.
3. The certification in this clause is a material representation of fact upon which
reliance was placed when the department or agency determined to enter into this
transaction. If it is later determined that the prospective primary participant knowingly
rendered an erroneous certification, in addition to other remedies available to the
Federal Government, the department or agency may terminate this transaction for
cause or default.
4. The prospective primary participant shall provide immediate written notice to
the department or agency to which this proposal is submitted if at any time the
prospective primary participant learns that its certification was erroneous when
submitted or has become erroneous by reason of changed circumstances.
5. The terms covered transaction, debarred, suspended, ineligible, participant,
person, primary covered transaction, principal, proposal, and voluntarily excluded, as
used in this clause, have the meanings set out in the Definitions and Coverage
sections of the rules implementing Executive Order 12549. You may contact the
department or agency to which this proposal is being submitted for assistance in
obtaining a copy of those regulations.
6. Nothing contained in the foregoing shall be construed to require establishment
of a system of records in order to render in good faith the certification required by this
clause. The knowledge and information of a participant is not required to exceed that
which is normally possessed by a prudent person in the ordinary course of business
dealings.
Exhibit F
2 of 2
CERTIFICATION
(1) The prospective primary participant certifies to the best of its knowledge
and belief, that it, its owners, officers, corporate managers and partners:
(a) Are not presently debarred, suspended, proposed for debarment,
declared ineligible, or voluntarily excluded by any Federal
department or agency;
(b) Have not within a three-year period preceding this proposal been
convicted of or had a civil judgment rendered against them for
commission of fraud or a criminal offense in connection with
obtaining, attempting to obtain, or performing a public (Federal,
State or local) transaction or contract under a public transaction;
violation of Federal or State antitrust statutes or commission of
embezzlement, theft, forgery, bribery, falsification or destruction
of records, making false statements, or receiving stolen property;
(c) Have not within a three-year period preceding this
application/proposal had one or more public transactions
(Federal, State or local) terminated for cause or default.
(2) Where the prospective primary participant is unable to certify to any of
the statements in this certification, such prospective participant shall
attach an explanation to this proposal.
Signature: Date:
(Printed Name & Title) (Name of Agency or
Company)
Exhibit G
HEPATITIS B VACCINE DECLINATION
I understand that due to my occupational exposure to blood or other potentially
infectious materials, I may be at risk of acquiring Hepatitis B virus (HBV)
infection. I have been given the opportunity to be vaccinated with Hepatitis B
vaccine, at the expense of the sponsoring COLLEGE department/program;
however, I decline Hepatitis B vaccination at this time. I understand that by
declining this vaccine, I continue to be at risk of acquiring Hepatitis B, a serious
disease.
Print Name Job Title Department
Signature Date
***If I continue to have occupational exposure to blood and other potentially
infectious material, I understand that I have the option to receive the Hepatitis B
vaccination series at a later date, at the expense of the sponsoring COLLEGE
department/program.
Exhibit H
NO HOSTAGE FACILITY
SECURITY: COUNTY's Juvenile Justice Campus, Fresno County South Annex Jail,
Fresno County North Annex Jail, Fresno County Main Jail and Fresno County
Satellite Jail are no hostage facilities operated by the County's Sheriff and Probation
Departments.
The security of each Detention Facility is paramount and takes precedence over all
processes. Before the start of any work, College and any subcontractors shall review
with a representative of the Sheriff's Department, Probation Department and County
Coordinator, the proposed process and how his work will interface with the respective
Detention Facility's operations. The Detention Facility's operations shall take
precedence. College shall perform his work in accordance with the procedures
established by the Sheriff's and Probation Departments. Should any revisions to any
procedures become necessary, such revisions shall be reviewed and approved by
Sheriff's Department or Probation Department and the County Coordinator before
execution of such revisions. Exit facilities, distress warning devices and similar
devices and equipment shall remain operable at all times in accordance with
regulations of the State Fire Marshall.
College shall plan and execute his work in such a manner so as to prevent a breach
of the Detention Facilities' Security or allowing an inmate to escape. This
maintenance of security shall remain in effect for the duration of the project.
College shall be responsible for preventing the introduction of any material or
equipment into the facility that could be deemed contraband. Such contraband shall
include, but not be limited to, tools, equipment, supplies, construction waste, and
construction materials.
Only tools, supplies and equipment necessary to complete a given task shall be
taken into an inmate occupied space. Such tools, supplies, and materials shall be
inventoried in and out of the secured area by College. Any discrepancy shall be
called to the attention of the Sheriff's Department or Probation Department
representative immediately.
The Sheriff's Department or Probation Department may want to limit the number of
individuals in any one area at one time. Only individuals with proper identification as
issued by the Sheriff's Department shall be allowed into the work area within the
Detention Facilities. The appropriate identification will be issued on an as needed
basis.
The Detention Facilities have no "Off Hours". College shall confer with the Sheriff's
Department's representative and County DBH Coordinator on a case by case basis
for all work to be performed outside normal hours.
Exhibit H
Any violations of security procedures which result in extraordinary man hour
expenditures by County, such as for unscheduled searches to retrieve contraband
or man hour costs expended to report and/or recapture an escapee, will be the
responsibility of the College.
Exhibit I
Health Insurance Portability and Accountability Act (HIPAA)
Business Associate Agreement
1. The County is a "Covered Entity," and the College is a "Business Associate," as
these terms are defined by 45 CFR 160.103. In connection with providing services under the
Agreement, the parties anticipate that the College will create and/or receive Protected Health
Information ("PHI") from or on behalf of the County. The parties enter into this Business
Associate Agreement (BAA) to comply with the Business Associate requirements of HIPAA, to
govern the use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the
Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
The parties to this Agreement shall be in strict conformance with all applicable federal
and State of California laws and regulations, including, but not limited to California Welfare and
Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431; California
Civil Code section 56 et seq.; the Health Insurance Portability and Accountability Act of 1996, as
amended ("HIPAA"), including, but not limited to, 45 CFR Parts160, 45 CFR 162, and 45 CFR
164; the Health Information Technology for Economic and Clinical Health Act ("HITECH")
regarding the confidentiality and security of patient information, including, but not limited to 42
USC 17901 et seq.; and the Genetic Information Nondiscrimination Act ("GINA") of 2008
regarding the confidentiality of genetic information.
Except as otherwise provided in this Agreement, the College, as a business associate of
the County, may use or disclose Protected Health Information ("PHI") to perform functions,
activities or services for or on behalf of the County, as specified in this Agreement, provided that
such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of PHI may not
be more expansive than those applicable to the County, as the "Covered Entity" under the
HIPAA Rules, except as authorized for management, administrative or legal responsibilities of
the College.
2. The College, including its subcontractors, students, and employees, shall protect
from unauthorized access, use, or disclosure of names and other identifying information,
including genetic information, concerning persons receiving services pursuant to this
1-1
Exhibit I
Agreement, except where permitted in order to carry out data aggregation purposes for health
care operations [45 CFR §§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This
pertains to any and all persons receiving services pursuant to a County-funded program. This
requirement applies to electronic PHI. The College shall not use such identifying information or
genetic information for any purpose other than carrying out the College's obligations under this
Agreement.
3. The College, including its subcontractors, students, and employees, shall not
disclose any such identifying information or genetic information to any person or entity, except
as otherwise specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part
164 or other law, required by the Secretary of the United States Department of Health and
Human Services ("Secretary"), or authorized by the client/patient in writing. In using or
disclosing PHI that is permitted by this Agreement or authorized by law, the College shall make
reasonable efforts to limit PHI to the minimum necessary to accomplish intended purpose of
use, disclosure or request.
4. For purposes of the above sections, identifying information shall include, but not
be limited to, name, identifying number, symbol, or other identifying particular assigned to the
individual, such as fingerprint or voiceprint, or photograph.
5. For purposes of the above sections, genetic information shall include genetic
tests of family members of an individual or individual(s), manifestation of disease or disorder of
family members of an individual, or any request for or receipt of genetic services by individual or
family members. Family member means a dependent or any person who is first, second, third,
or fourth degree relative.
6. The College shall provide access, at the request of the County, and in the time
and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR
§ 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR §
164.524 regarding access by individuals to their PHI. With respect to individual requests,
access shall be provided within thirty (30) days from request. Access may be extended if the
College cannot provide access and provides the individual with the reasons for the delay and
I-2
Exhibit I
the date when access may be granted. PHI shall be provided in the form and format requested
by the individual or the County.
The College shall make any amendment(s) to PHI in a designated record set at the
request of the County or individual, and in the time and manner designated by the County in
accordance with 45 CFR § 164.526.
The College shall provide to the County or to an individual, in a time and manner
designated by the County, information collected in accordance with 45 CFR § 164.528, to permit
the County to respond to a request by the individual for an accounting of disclosures of PHI in
accordance with 45 CFR § 164.528.
7. The College shall report to the County, in writing, any knowledge or reasonable
belief that there has been unauthorized access, viewing, use, disclosure, security incident, or
breach of unsecured PHI not permitted by this Agreement of which the College becomes aware,
immediately and without reasonable delay and in no case later than two (2) business days of
discovery. Immediate notification shall be made to the County's Information Security Officer
and Privacy Officer and the County's Department of Public Health ("DPH") HIPAA
Representative, within two (2) business days of discovery. The notification shall include, to the
extent possible, the identification of each individual whose unsecured PHI has been, or is
reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
College shall take prompt corrective action to cure any deficiencies and any action pertaining to
such unauthorized disclosure required by applicable federal and State laws and regulations.
The College shall investigate such breach and is responsible for all notifications required by law
and regulation or deemed necessary by the County and shall provide a written report of the
investigation and reporting required to the County's Information Security Officer and Privacy
Officer and the County's DPH HIPAA Representative.
This written investigation and description of any reporting necessary shall be
postmarked within the thirty (30) working days of the discovery of the breach to the addresses
below:
I-3
Exhibit I
County of Fresno County of Fresno County of Fresno
Department of Public Health Department of Public Health Department of Internal
HIPAA Representative Privacy Officer Services
(559) 600-6439 (559) 600-6405 Information Security Officer
P.O. Box 11867 P.O. Box 11867 (559) 600-5800
Fresno, California 93775 Fresno, California 93775 2048 North Fine Street
Fresno, California 93727
8. The College shall make its internal practices, books, and records relating to the
use and disclosure of PHI received from the county, or created or received by the College on
behalf of the County, in compliance with Parts the HIPAA Rules. The College shall make its
internal practices, books, and records relating to the use and disclosure of PHI received from
the County, or created or received by the College on behalf of the County, available to the
Secretary upon demand.
The College shall cooperate with the compliance and investigation reviews conducted by
the Secretary. PHI access to the Secretary must be provided during the College's normal
business hours; however, upon exigent circumstances access at any time must be granted.
Upon the Secretary's compliance or investigation review, if PHI is unavailable to the College
and in possession of a subcontractor of the College, the College must certify to the Secretary its
efforts to obtain the information from the subcontractor.
9. Safeguards
The College shall implement administrative, physical, and technical safeguards as
required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
this Agreement. The College shall conduct an accurate and thorough assessment of the
potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI.
The College shall develop and maintain a written information privacy and security program that
includes administrative, technical and physical safeguards appropriate to the size and
complexity of the College's operations and the nature and scope of its activities. Upon the
County's request, the College shall provide the County with information concerning such
I-4
Exhibit I
safeguards.
The College shall implement strong access controls and other security safeguards and
precautions in order to restrict logical and physical access to confidential, personal (e.g., PHI) or
sensitive data to authorized users only. Said safeguards and precautions shall include the
following administrative and technical password controls for all systems used to process or store
confidential, personal, or sensitive data:
A. Passwords must not be:
(1) Shared or written down where they are accessible or recognizable by anyone
else; such as taped to computer screens, stored under keyboards, or visible
in a work area;
(2) A dictionary word; or
(3) Stored in clear text
B. Passwords must be:
(1) Eight (8) characters or more in length;
(2) Changed every ninety (90) days;
(3) Changed immediately if revealed or compromised; and
(4) Composed of characters from at least three (3) of the following four (4)
groups from the standard keyboard:
a) Upper case letters (A-Z);
b) Lowercase letters (a-z);
c) Arabic numerals (0 through 9); and
d) Non-alphanumeric characters (punctuation symbols).
The College shall implement the following security controls on each workstation or
portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
3. Patch management process including installation of all operating system/software
I-5
Exhibit I
vendor security patches.
The College shall utilize a commercial encryption solution that has received FIPS 140-2
validation to encrypt all confidential, personal, or sensitive data stored on portable electronic
media (including, but not limited to, compact disks and thumb drives) and on portable computing
devices (including, but not limited to, laptop and notebook computers).
The College shall not transmit confidential, personal, or sensitive data via e-mail or other
internet transport protocol unless the data is encrypted by a solution that has been validated by
the National Institute of Standards and Technology (NIST) as conforming to the Advanced
Encryption Standard (AES) Algorithm. The College must apply appropriate sanctions against its
students or employees who fail to comply with these safeguards. The College must adopt
procedures for terminating access to PHI when employment of employee ends.
10. Mitigation of Harmful Effects
The College shall mitigate, to the extent practicable, any harmful effect that is suspected
or known to the College of an unauthorized access, viewing, use, disclosure, or breach of PHI
by the College or its subcontractors in violation of the requirements of these provisions. The
College must document suspected or known harmful effects and the outcome.
11. The College's Subcontractors
The College shall ensure that any of its contractors, including subcontractors, if
applicable, to whom the College provides PHI received from or created or received by the
College on behalf of the County, agree to the same restrictions, safeguards, and conditions that
apply to the College with respect to such PHI and to incorporate, when applicable, the relevant
provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
Nothing in this section 11 or this exhibit authorizes the College to perform services under
this Agreement using subcontractors.
12. Employee Training and Discipline
The College shall train and use reasonable measures to ensure compliance with the
requirements of these provisions by employees who assist in the performance of functions or
I-6
Exhibit I
activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
such employees who intentionally violate any provisions of these provisions, which may include
termination of employment.
13. Termination for Cause
Upon the County's knowledge of a material breach of these provisions by the College,
the County will either:
A. Provide an opportunity for the College to cure the breach or end the
violation, and the County may terminate this Agreement if the College does not cure the breach
or end the violation within the time specified by the County; or
B. Immediately terminate this Agreement if the College has breached a
material term of this exhibit and cure is not possible, as determined by the County.
C. If neither cure nor termination is feasible, the County's Privacy Officer will
report the violation to the Secretary of the U.S. Department of Health and Human Services.
14. Judicial or Administrative Proceedings
The County may terminate this Agreement if: (1) the College is found guilty in a criminal
proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or (2)there
is a finding or stipulation in an administrative or civil proceeding in which the College is a party
that the College has violated a privacy or security standard or requirement of the HITECH Act,
HIPAA or other security or privacy laws.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, the College shall return
or destroy all PHI received from the County (or created or received by the College on behalf of
the County) that the College still maintains in any form, and shall retain no copies of such PHI.
If return or destruction of PHI is not feasible, the College shall continue to extend the protections
of these provisions to such information, and limit further use of such PHI to those purposes that
make the return or destruction of such PHI infeasible. This provision applies to PHI that is in the
possession of subcontractors or agents, if applicable, of the College. If the College destroys the
PHI data, a certification of date and time of destruction shall be provided to the County by the
I-7
Exhibit I
College.
16. Compliance with Other Laws
To the extent that other state and/or federal laws provide additional, stricter and/or more
protective privacy and/or security protections to PHI or other confidential information covered
under this BAA, the College agrees to comply with the more protective of the privacy and
security standards set forth in the applicable state or federal laws to the extent such standards
provide a greater degree of protection and security than HIPAA Rules or are otherwise more
favorable to the individual.
17. Disclaimer
The County makes no warranty or representation that compliance by the College with
these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
College's own purposes or that any information in the College's possession or control, or
transmitted or received by the College, is or will be secure from unauthorized access, viewing,
use, disclosure, or breach. The College is solely responsible for all decisions made by the
College regarding the safeguarding of PHI.
18. Amendment
The parties acknowledge that Federal and State laws relating to electronic data security
and privacy are rapidly evolving and that amendment of this exhibit may be required to provide
for procedures to ensure compliance with such developments. The parties specifically agree to
take such action as is necessary to amend this agreement in order to implement the standards
and requirements of the HIPAA Rules, the HITECH Act and other applicable laws relating to the
security or privacy of PHI. The County may terminate this Agreement upon thirty (30) days
written notice in the event that the College does not enter into an amendment providing
assurances regarding the safeguarding of PHI that the County in its sole discretion, deems
sufficient to satisfy the standards and requirements of the HIPAA Rules, and the HITECH Act.
19. No Third-Party Beneficiaries
Nothing expressed or implied in the provisions of this exhibit is intended to confer, and
nothing in this exhibit does confer, upon any person other than the County or the College and
I-S
Exhibit I
their respective successors or assignees, any rights, remedies, obligations or liabilities
whatsoever.
20. Interpretation
The provisions of this exhibit shall be interpreted as broadly as necessary to implement
and comply with the HIPAA Rules, and applicable State laws. The parties agree that any
ambiguity in the terms and conditions of these provisions shall be resolved in favor of a meaning
that complies and is consistent with the HIPAA Rules.
21. Regulatory References
A reference in the terms and conditions of these provisions to a section in the HIPAA
Rules means the section as in effect or as amended.
22. Survival
The respective rights and obligations of the College as stated in this exhibit survive the
termination or expiration of this Agreement.
23. No Waiver of Obligation
Change, waiver or discharge by the County of any liability or obligation of the College
under this exhibit on any one or more occasions is not a waiver of performance of any
continuing or other obligation of the College and does not prohibit enforcement by the County of
any obligation on any other occasion.
I-9