HomeMy WebLinkAboutHealth Career Connection-Health Care Management Student Internship Program_A-24-329.pdf cotj County of Fresno Hall of Records,Room 301
2281 Tulare Street
Fresno,California
Board of Supervisors 93721-2198
O 1856 0 Telephone:(559)600-3529
FRES Minute Order Toll Free: 1-800-742-1011
www.fresnocountyea.gov
June 18, 2024
Present: 5- Supervisor Steve Brandau,Chairman Nathan Magsig,Vice Chairman Buddy Mendes,
Supervisor Brian Pacheco,and Supervisor Sal Quintero
Agenda No. 67. Public Health File ID:24-0405
Re: Approve and authorize the Chairman to execute an Agreement with Health Career Connection,for a
health care management student internship program, effective July 1,2024,not to exceed five
consecutive years,which includes a three-year base contract and two optional one-year extensions
($0)
APPROVED AS RECOMMENDED
Ayes: 5- Brandau, Magsig, Mendes, Pacheco,and Quintero
Agreement No.24-329
County of Fresno Page 71
co
Board Agenda Item 67
01
1856 O
DATE: June 18, 2024
TO: Board of Supervisors
SUBMITTED BY: David Luchini, RN, PHN, Director, Department of Public Health
Susan L. Holt, Director, Department of Behavioral Health
SUBJECT: Agreement with Health Career Connection
RECOMMENDED ACTION(S):
Approve and authorize the Chairman to execute an Agreement with Health Career Connection,for
a health care management student internship program, effective July 1, 2024, not to exceed five
consecutive years,which includes a three-year base contract and two optional one-year extensions
($0).
Approval of the recommended action will continue to permit Health Career Connection (HCC)junior and
senior year college students to acquire practical knowledge in health care management through a 10-week
internship program with the Departments of Public Health and Behavioral Health. Participation will be
completed without monetary compensation between either party. Staff from both Departments will provide
preceptorship and supervision of the interns. This item is countywide.
ALTERNATIVE ACTION(S):
Should your Board not approve the recommended action, the Departments of Behavioral Health and Public
Health would be unable to offer HCC students an internship placement in health care management.
FISCAL IMPACT:
There is no increase in Net County Cost associated with the recommended action or monetary
compensation associated with the recommended agreement. If approved, HCC will ensure the interns
obtain general, automobile, and professional liability insurance, as necessary. Public Health and Behavioral
Health Department supervisory staff will provide supervision of the interns. Sufficient appropriations for
supervision will be included in the Department of Public Health Org 5620 and Department of Behavioral
Health Org 5620 FY 2024-25 Recommended Budgets and will be included in future budget requests.
DISCUSSION:
HCC is a national non-profit organization that recruits, screens, and funds internship placements for college
students within health care organizations. Over the past 15 years, HCC has placed interns with the
Department of Public Health and beginning in 2023 with the Department of Behavioral Health, making it
possible for students to field-train in health-care management. Interns assist Department programs in
providing health education, support and planning of educational meetings, events, and trainings. In addition,
interns will assist in developing, collecting and analyzing survey data.
On June 18, 2019, your Board approved Agreement No. 19-291 with HCC for a health care management
County of Fresno page 1 File Number.24-0405
File Number.24-0405
student internship program for five consecutive years, which included a three-year base contract and two
optional one-year extensions. This Agreement expires on June 30, 2024. Under the current agreement, the
Departments of Public Health and Behavioral Health have placed three interns each for a total of six.
The new recommended agreement with HCC will continue to provide internship placement opportunities for
college students with the Departments of Public Health and Behavioral Health with no compensation. The
recommended agreement deviates from County standard language, as it contains a reduced commercial
general liability coverage as the departments and Human Resources- Risk deem the services under this
agreement to be low risk. The agreement does not include automobile liability insurance due to interns not
being permitted to operate County or personal vehicles and includes cyber liability coverage as interns will
have access to County systems. The Departments have determined that acceptance of the non-standard
terms are advantageous to the County, as the agreement will provide the interns experience in health care
management activities and be exposed to future health care career opportunities with Fresno County.
REFERENCE MATERIAL:
BAI#27, August 10, 2021
BAI #31, August 4, 2020
BAI #51, June 18, 2019
ATTACHMENTS INCLUDED AND/OR ON FILE:
On file with Clerk-Agreement with HCC
CAO ANALYST:
Ronald Alexander
County of Fresno page 2 File Number:24-0405
Agreement No. 24-329
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated June 18, 2024 and is between
3 Health Career Connection, a California Nonprofit Corporation ("Contractor"), and the County of
4 Fresno, a political subdivision of the State of California ("County").
5 Recitals
6 A. The Contractor has developed ten (10) week college healthcare management internship
7 programs, hereinafter referred to as the "Internship Programs", that seeks partnerships with
8 other organizations to provide health care management experience for interns.
9 B. The County, through its Department of Public Health (DPH) and Department of
10 Behavioral Health (DBH), maintains and operates facilities suitable for furnishing such health
11 care management internship experience and has experienced staff who can provide
12 preceptorship and close supervision of such interns.
13 C. For the mutual benefit of both parties, the Contractor's personnel and interns may
14 actively utilize the County's facilities for the Internship Programs.
15 The parties therefore agree as follows:
16 Article 1
17 Contractor's Services
18 1.1 Scope of Services. The Contractor shall perform all of the services provided in
19 Exhibit A to this Agreement, titled "Contractor's Services and County's Responsibilities."
20 1.2 Representation. The Contractor represents that it is qualified, ready, willing, and able
21 to perform all of the services provided in this Agreement.
22 1.3 Compliance with Laws. The Contractor shall, at its own cost, comply with all
23 applicable federal, state, and local laws and regulations in the performance of its obligations
24 under this Agreement, including but not limited to workers compensation, labor, and
25 confidentiality laws and regulations.
26
27
28
1
I Article 2
2 County's Responsibilities
3 2.1 The County shall perform all of the responsibilities provided in Exhibit A to this
4 Agreement, titled "Contractor's Services and County's Responsibilities."
5 Article 3
6 Compensation, Invoices, and Payments
7 3.1 Contractor's Internship Program conducted pursuant to the terms and conditions of
8 this Agreement shall be performed without the payment of any monetary consideration between
9 the Contractor and County, from one party to the other.
10 3.2 Incidental Expenses. The Contractor is solely responsible for all of its costs and
11 expenses that are not specified as payable by the County under this Agreement.
12 Article 4
13 Term of Agreement
14 4.1 Term. This Agreement is effective on July 1, 2024 and terminates on June 30, 2027,
15 except as provided in section 4.2, "Extension," or Article 6, "Termination and Suspension,"
16 below.
17 4.2 Extension. The term of this Agreement may be extended for no more than two, one-
18 year periods only upon written approval of both parties at least 30 days before the first day of
19 the next one-year extension period. The County's DPH Director or his or her designee is
20 authorized to sign the written approval on behalf of the County based on the Contractor's
21 satisfactory performance. The extension of this Agreement by the County is not a waiver or
22 compromise of any default or breach of this Agreement by the Contractor existing at the time of
23 the extension whether or not known to the County.
24 Article 5
25 Notices
26 5.1 Contact Information. The persons and their addresses having authority to give and
27 receive notices provided for or permitted under this Agreement include the following:
28
2
1 For the County:
Director, Department of Public Health
2 County of Fresno
P.O. Box 11867
3 Fresno, CA 93775
DPHContracts@fresnocountyca.gov
4
5 For the Contractor:
Jeffrey Oxendine, Chief Executive Officer/President
6 Health Career Connection
300 Frank H. Ogawa Plaza, Suite 243
7 Oakland, CA 94612
8 5.2 Change of Contact Information. Either party may change the information in section
9 5.1 by giving notice as provided in section 5.3.
10 5.3 Method of Delivery. Each notice between the County and the Contractor provided for
11 or permitted under this Agreement must be in writing, state that it is a notice provided under this
12 Agreement, and be delivered either by personal service, by first-class United States mail, by an
13 overnight commercial courier service, by telephonic facsimile transmission, or by Portable
14 Document Format (PDF) document attached to an email.
15 (A) A notice delivered by personal service is effective upon service to the recipient.
16 (B) A notice delivered by first-class United States mail is effective three County
17 business days after deposit in the United States mail, postage prepaid, addressed to the
18 recipient.
19 (C)A notice delivered by an overnight commercial courier service is effective one
20 County business day after deposit with the overnight commercial courier service,
21 delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
22 the recipient.
23 (D)A notice delivered by telephonic facsimile transmission or by PDF document
24 attached to an email is effective when transmission to the recipient is completed (but, if
25 such transmission is completed outside of County business hours, then such delivery is
26 deemed to be effective at the next beginning of a County business day), provided that
27 the sender maintains a machine record of the completed transmission.
28
3
1 5.4 Claims Presentation. For all claims arising from or related to this Agreement, nothing
2 in this Agreement establishes, waives, or modifies any claims presentation requirements or
3 procedures provided by law, including the Government Claims Act (Division 3.6 of Title 1 of the
4 Government Code, beginning with section 810).
5 Article 6
6 Termination and Suspension
7 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
8 contingent on the approval of funds by the appropriating government agency. If sufficient funds
9 are not allocated, then the County, upon at least 30 days' advance written notice to the
10 Contractor, may:
11 (A) Modify the services provided by the Contractor under this Agreement; or
12 (B) Terminate this Agreement.
13 6.2 Termination for Breach.
14 (A) Upon determining that a breach (as defined in paragraph (C) below) has
15 occurred, the County may give written notice of the breach to the Contractor. The written
16 notice may suspend performance under this Agreement, and must provide at least 30
17 days for the Contractor to cure the breach.
18 (B) If the Contractor fails to cure the breach to the County's satisfaction within the
19 time stated in the written notice, the County may terminate this Agreement immediately.
20 (C) For purposes of this section, a breach occurs when, in the determination of the
21 County, the Contractor has:
22 (1) Obtained or used funds illegally or improperly;
23 (2) Failed to comply with any part of this Agreement;
24 (3) Submitted a substantially incorrect or incomplete report to the County; or
25 (4) Improperly performed any of its obligations under this Agreement.
26 6.3 Termination without Cause. In circumstances other than those set forth above, the
27 County may terminate this Agreement by giving at least 30 days advance written notice to the
28 Contractor.
4
1 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
2 under this Article 6 is without penalty to or further obligation of the County.
3 6.5 County's Rights upon Termination. Upon termination for breach under this Article
4 6, the County may demand repayment by the Contractor of any monies disbursed to the
5 Contractor under this Agreement that, in the County's sole judgment, were not expended in
6 compliance with this Agreement. The Contractor shall promptly refund all such monies upon
7 demand. This section survives the termination of this Agreement.
8 Article 7
9 Confidentiality
10 7.1 Confidentiality. All services performed by the Contractor under this Agreement shall
11 be in strict conformance with all applicable Federal, State of California and/or local laws and
12 regulations relating to confidentiality. In addition, Contractor agrees to abide by the terms and
13 conditions of the Business Associate Agreement attached hereto as Exhibit B.
14 Article 8
15 Independent Contractor
16 8.1 Status. In performing under this Agreement, the Contractor, including its officers,
17 agents, employees, interns, and volunteers is at all times acting and performing as an
18 independent contractor, in an independent capacity, and not as an officer, agent, servant,
19 employee,joint venturer, partner, or associate of the County.
20 8.2 Verifying Performance. The County will provide preceptorship and oversight of
21 Contractor intern's activities performed under this Agreement, verifying that the Contractor is
22 performing according to the terms of this Agreement.
23 8.3 Benefits. Because of its status as an independent contractor, the Contractor has no
24 right to employment rights or benefits available to County employees. The Contractor is solely
25 responsible for providing to its own employees and interns all employee benefits required by
26 law. The Contractor shall save the County harmless from all matters relating to the payment of
27 Contractor's employees, including compliance with Social Security withholding and all related
28
5
1 regulations. As between County and Contractor, should the interns be deemed employees, by
2 any governmental or regulatory body, the interns shall be the employees of Contractor.
3 8.4 Services to Others. The parties acknowledge that, during the term of this
4 Agreement, the Contractor may provide services to others unrelated to the County.
5 Article 9
6 Indemnity and Defense
7 9.1 Indemnity. The Contractor shall indemnify and hold harmless and defend the County
8 (including its officers, agents, employees, and volunteers) against all claims, demands, injuries,
9 damages, costs, expenses (including attorney fees and costs), fines, penalties, and liabilities of
10 any kind to the County, the Contractor, or any third party that arise from or relate to the
11 performance or failure to perform by the Contractor (or any of its officers, agents,
12 subcontractors, interns, or employees) under this Agreement. The County may conduct or
13 participate in its own defense without affecting the Contractor's obligation to indemnify and hold
14 harmless or defend the County.
15 The County and Contractor shall give timely notice to the other of any claim, demand,
16 lien or suit coming to its knowledge which in any way might affect the other party and each party
17 shall have the right to participate in the defense of the same to the extent of its interest. The
18 County and Contractor recognize that the significant mutual benefits of this Agreement depend
19 upon close cooperation and good faith handling of the matters subject to such indemnification
20 provisions.
21 9.2 Employment Relationship. As between the County and the Contractor, should the
22 interns be deemed employees by any governmental or regulatory body, the intern shall be the
23 employee of the Contractor for Worker's Compensation purposes only but, notwithstanding the
24 foregoing, interns shall be deemed members of the County's workforce for purposes of the
25 Health Insurance Portability and Accountability Act (HIPAA).
26 9.3 In consideration of the benefits the Contractor derives from the Agreement and
27 subject to the provisions herein, the Contractor shall not consider the interns to be employees
28 of, or claim the interns are employees of, the County for the purposes of determining liability for
6
1 any and all costs and expenses, including attorney fees and court costs, damages, liabilities,
2 claims, and losses occurring or resulting to the Contractor or to any person, firm or corporation
3 who may be injured or damaged by any act or failure to act, of any intern or person participating
4 in or connected with the programs that are the subject of this Agreement.
5 9.4 In consideration of the benefits the County derives from this Agreement and subject to
6 the provisions herein, County shall not consider the interns to be employees of, or claim the
7 interns are employees of, the Contractor for the purposes of determining liability for any and all
8 costs and expenses, including attorney fees and court costs, damages, liabilities, claims and
9 losses occurring or resulting to the County or to any person, firm or corporation who may be
10 injured or damaged by any act or failure to act, of any intern or person participating in or
11 connected with the programs that are the subject of this Agreement. All interns placed with
12 County facilities and departments must sign the Agreement and Release of Liability attached
13 hereto as Exhibit C.
14 9.5 Survival. This Article 9 survives the termination of this Agreement.
15 Article 10
16 No Employment Guarantees
17 10.1 The Contractor and County acknowledge and agree that although County may
18 employ any intern at some future date, neither Contractor nor County has made any statement,
19 representation or offer to any intern guaranteeing intern employment with County based upon
20 the intern's participation in, or completion of, one of the Internship Programs. The Internship
21 Programs are not a recruiting mechanism for County and the Internship Programs are not
22 intended to screen potential applicants for future employment opportunities with the County.
23 After the internship period has expired, County may consider qualified interns for future
24 employment opportunities.
25 Article 11
26 Insurance
27 11.1 The Contractor shall comply with all the insurance requirements in Exhibit D to this
28 Agreement.
7
1 Article 12
2 Inspections, Audits, and Public Records
3 12.1 Inspection of Documents. The Contractor shall make available to the County, and
4 the County may examine at any time during business hours and as often as the County deems
5 necessary, all of the Contractor's records and data with respect to the matters covered by this
6 Agreement, excluding attorney-client privileged communications. The Contractor shall, upon
7 request by the County, permit the County to audit and inspect all of such records and data to
8 ensure the Contractor's compliance with the terms of this Agreement.
9 12.2 State Audit Requirements. If the compensation to be paid by the County under this
10 Agreement exceeds $10,000, the Contractor is subject to the examination and audit of the
11 California State Auditor, as provided in Government Code section 8546.7, for a period of three
12 years after final payment under this Agreement. This section survives the termination of this
13 Agreement. Additional Federal audit requirements may apply if any portion of the compensation
14 to be paid by the County under this Agreement is also provided by Federal funding.
15 12.3 Public Records. The County is not limited in any manner with respect to its public
16 disclosure of this Agreement or any record or data that the Contractor may provide to the
17 County. The County's public disclosure of this Agreement or any record or data that the
18 Contractor may provide to the County may include but is not limited to the following:
19 (A) The County may voluntarily, or upon request by any member of the public or
20 governmental agency, disclose this Agreement to the public or such governmental
21 agency.
22 (B) The County may voluntarily, or upon request by any member of the public or
23 governmental agency, disclose to the public or such governmental agency any record or
24 data that the Contractor may provide to the County, unless such disclosure is prohibited
25 by court order.
26 (C)This Agreement, and any record or data that the Contractor may provide to the
27 County, is subject to public disclosure under the Ralph M. Brown Act (California
28 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
8
1 (D)This Agreement, and any record or data that the Contractor may provide to the
2 County, is subject to public disclosure as a public record under the California Public
3 Records Act (California Government Code, Title 1, Division 7, Chapter 3.5, beginning
4 with section 6250) ("CPRA").
5 (E) This Agreement, and any record or data that the Contractor may provide to the
6 County, is subject to public disclosure as information concerning the conduct of the
7 people's business of the State of California under California Constitution, Article 1,
8 section 3, subdivision (b).
9 (F) Any marking of confidentiality or restricted access upon or otherwise made with
10 respect to any record or data that the Contractor may provide to the County shall be
11 disregarded and have no effect on the County's right or duty to disclose to the public or
12 governmental agency any such record or data.
13 12.4 Public Records Act Requests. If the County receives a written or oral request under
14 the CPRA to publicly disclose any record that is in the Contractor's possession or control, and
15 which the County has a right, under any provision of this Agreement or applicable law, to
16 possess or control, then the County may demand, in writing, that the Contractor deliver to the
17 County, for purposes of public disclosure, the requested records that may be in the possession
18 or control of the Contractor. Within five business days after the County's demand, the
19 Contractor shall (a) deliver to the County all of the requested records that are in the Contractor's
20 possession or control, together with a written statement that the Contractor, after conducting a
21 diligent search, has produced all requested records that are in the Contractor's possession or
22 control, or(b) provide to the County a written statement that the Contractor, after conducting a
23 diligent search, does not possess or control any of the requested records. The Contractor shall
24 cooperate with the County with respect to any County demand for such records. If the
25 Contractor wishes to assert that any specific record or data is exempt from disclosure under the
26 CPRA or other applicable law, it must deliver the record or data to the County and assert the
27 exemption by citation to specific legal authority within the written statement that it provides to
28 the County under this section. The Contractor's assertion of any exemption from disclosure is
9
1 not binding on the County, but the County will give at least 10 days' advance written notice to
2 the Contractor before disclosing any record subject to the Contractor's assertion of exemption
3 from disclosure. The Contractor shall indemnify the County for any court-ordered award of costs
4 or attorney's fees under the CPRA that results from the Contractor's delay, claim of exemption,
5 failure to produce any such records, or failure to cooperate with the County with respect to any
6 County demand for any such records.
7 Article 13
8 Data Security
9 13.1 For the purpose of preventing the potential loss, misappropriation or inadvertent
10 access, viewing, use or disclosure of County data including sensitive or personal client
11 information: abuse of County resources; and/or disruption to County operations, individuals
12 and/or agencies that enter into a contractual relationship with the County for the purpose of
13 providing services under this Agreement must employ adequate data security measures to
14 protect the confidential information provided to Contractor by the County, including but not
15 limited to the following:
16 (A) Contractor may not connect to County networks via personally owned mobile,
17 wireless or handheld devices, unless the following conditions are met:
18 (1) Contractor has received authorization by County for telecommuting purposes.
19 (2) Current virus protection software is in place.
20 (3) Mobile device has the remote wipe feature enabled.
21 (4) A secure connection is used.
22 (B) Contractor may not bring Contractor-owned computers or computer peripherals
23 into the County for use without prior authorization from the County's Chief Information
24 Officer, and/or designee(s), including but not limited to mobile storage devices. If data is
25 approved to be transferred, data must be stored on a secure server approved by the
26 County and transferred by means of a Virtual Private Network (VPN) connection, or
27 another type of secure connection. Said data must be encrypted.
28
10
1 (C)Contractor or anyone having an employment relationship with the County, may
2 not use County computers or computer peripherals on non-County premises without
3 prior authorization from the County's Chief Information Office, and/or designee(s).
4 (D)Contractor may not store County's private, confidential or sensitive data on any
5 hard-disk drive, portable storage device, or remote storage installation unless encrypted.
6 (E) Contractor shall be responsible to employ strict controls to ensure the integrity
7 and security of County's confidential information and to prevent unauthorized access,
8 viewing, use or disclosure of data maintained in computer files, program documentation,
9 data processing systems, data files and data processing equipment which stores or
10 processes County data internally and externally.
11 (F) Confidential client information transmitted to one party by the other by means of
12 electronic transmissions must be encrypted according to Advanced Encryption
13 Standards (AES) of 128 BIT or higher. Additionally, a password or pass phrase must be
14 utilized.
15 (G)Contractor is responsible to immediately notify County of any violations,
16 breaches or potential breaches of security related to County's confidential information,
17 data maintained in computer files, program documentation, data processing systems,
18 data files, and data processing equipment which stores or processes County data
19 internally or externally.
20 (H)County shall provide oversight to Contractor's response to All Incidents arising
21 from a possible breach of security related to County's confidential client information
22 provided to Contractor. Contractor will be responsible to issue any notification to affected
23 individuals as required by law or as deemed necessary by County in its sole discretion.
24 Contractor will be responsible for all costs incurred as a result of providing the required
25 notification. As used herein, "All Incidents" refers only to those incidents which are within
26 Contractor's control (e.g. incidents involving its employees and/or subcontractor).
27
28
11
1 Article 14
2 Disclosure of Self-Dealing Transactions
3 14.1 Applicability. This Article 14 applies if the Contractor is operating as a corporation, or
4 changes its status to operate as a corporation.
5 14.2 Duty to Disclose. If any member of the Contractor's board of directors is party to a
6 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
7 "Self-Dealing Transaction Disclosure Form" (Exhibit E to this Agreement) and submitting it to the
8 County before commencing the transaction or immediately after.
9 14.3 Definition. "Self-dealing transaction" means a transaction to which the Contractor is a
10 party and in which one or more of its directors, as an individual, has a material financial interest.
11 Article 15
12 General Terms
13 15.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
14 Agreement may not be modified, and no waiver is effective, except by written agreement signed
15 by both parties. The Contractor acknowledges that County employees have no authority to
16 modify this Agreement except as expressly provided in this Agreement.
17 15.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
18 under this Agreement without the prior written consent of the other party.
19 15.3 Governing Law. The laws of the State of California govern all matters arising from or
20 related to this Agreement.
21 15.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno County,
22 California. Contractor consents to California jurisdiction for actions arising from or related to this
23 Agreement, and, subject to the Government Claims Act, all such actions must be brought and
24 maintained in Fresno County.
25 15.5 Construction. The final form of this Agreement is the result of the parties' combined
26 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
27 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
28 against either party.
12
1 15.6 Days. Unless otherwise specified, "days" means calendar days.
2 15.7 Headings. The headings and section titles in this Agreement are for convenience
3 only and are not part of this Agreement.
4 15.8 Severability. If anything in this Agreement is found by a court of competent
5 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
6 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
7 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
8 intent.
9 15.9 Nondiscrimination. During the performance of this Agreement, the Contractor shall
10 not unlawfully discriminate against any employee or applicant for employment, or recipient of
11 services, because of race, religious creed, color, national origin, ancestry, physical disability,
12 mental disability, medical condition, genetic information, marital status, sex, gender, gender
13 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
14 all applicable State of California and federal statutes and regulation.
15 15.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
16 of the Contractor under this Agreement on any one or more occasions is not a waiver of
17 performance of any continuing or other obligation of the Contractor and does not prohibit
18 enforcement by the County of any obligation on any other occasion.
19 15.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
20 between the Contractor and the County with respect to the subject matter of this Agreement,
21 and it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
22 publications, and understandings of any nature unless those things are expressly included in
23 this Agreement. If there is any inconsistency between the terms of this Agreement without its
24 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
25 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
26 exhibits.
27 15.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
28 create any rights or obligations for any person or entity except for the parties.
13
1 15.13 Authorized Signature. The Contractor represents and warrants to the County that:
2 (A) The Contractor is duly authorized and empowered to sign and perform its
3 obligations under this Agreement.
4 (B) The individual signing this Agreement on behalf of the Contractor is duly
5 authorized to do so and his or her signature on this Agreement legally binds the
6 Contractor to the terms of this Agreement.
7 15.14 Electronic Signatures. The parties agree that this Agreement may be executed by
8 electronic signature as provided in this section.
9 (A) An "electronic signature" means any symbol or process intended by an individual
10 signing this Agreement to represent their signature, including but not limited to (1) a
11 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
12 electronically scanned and transmitted (for example by PDF document) version of an
13 original handwritten signature.
14 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
15 equivalent to a valid original handwritten signature of the person signing this Agreement
16 for all purposes, including but not limited to evidentiary proof in any administrative or
17 judicial proceeding, and (2) has the same force and effect as the valid original
18 handwritten signature of that person.
19 (C)The provisions of this section satisfy the requirements of Civil Code section
20 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
21 Part 2, Title 2.5, beginning with section 1633.1).
22 (D) Each party using a digital signature represents that it has undertaken and
23 satisfied the requirements of Government Code section 16.5, subdivision (a),
24 paragraphs (1) through (5), and agrees that each other party may rely upon that
25 representation.
26 (E) This Agreement is not conditioned upon the parties conducting the transactions
27 under it by electronic means and either party may sign this Agreement with an original
28 handwritten signature.
14
1 15.15 Counterparts. This Agreement may be signed in counterparts, each of which is an
2 original, and all of which together constitute this Agreement.
3 [SIGNATURE PAGE FOLLOWS]
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
15
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
HEALTH CAREER CONNECTION COUNTY OF FRESNO
3
4
5 Jeff Oxendine, Chief Executive Nathan Magsig,
Officer/President Chairman of the Board of Supervisors of the
6 County of Fresno
300 Frank H. Ogawa Plaza, #243
7 Oakland, CA 94612 Attest:
Bernice E. Seidel
8 Clerk of the Board of Supervisors
County of Fresno, State of California
9
10 By
Deputy
11
For accounting use only:
12
Org No.: 56201500, 56304756
13 Account No.: 7295
Fund No.: 0001
14 Subclass No.: 10000
15
16
17
18
19
20
21
22
23
24
25
26
27
28
16
Exhibit A
1 Contractor's Services and County's Responsibilities
2
3 1. Contractor Services:
4 The Contractor shall provide services including, but not limited to:
5 A. Identify an individual within its organization who shall serve as the Coordinator
6 for each Intern. The Coordinator will be responsible for overseeing the placement of the Intern
7 with the County and shall be the principal Contractor contact for each Intern's preceptor. The
8 Contractor may also from time to time promulgate policies and procedures governing Interns
9 and the Internship Program as a whole, and the County agrees to comply with all such policies
10 and procedures for which it is made aware and shall not ask Intern to breach any such policies
11 and procedures.
12 B. The Contractor may schedule up to four (4) hours per week of educations and/or
13 social activities for the Intern during the County's normal business hours, and the Contractor or
14 Intern will inform the County at the beginning of the placement, or from time to time as
15 applicable, of the schedule for such activities. The County will not ask Interns to be available
16 during these time periods including the time required to travel to and from such activities.
17 C. Recognize that the Internship Program conducted pursuant to the terms and
18 conditions of this Agreement is not considered an educational program of the County. Interns
19 participating in Contractor's Internship Program shall work under the close partnership
20 developed between the Contractor and the County.
21 D. Recruit interns to interview with the County for a possible internship assignment
22 at County facilities, in such numbers to be mutually agreed upon by both the County and the
23 Contractor.
24 E. Keep all attendance and academic records of interns participating in the
25 Internship program provided for under this Agreement.
26 F. Ensure interns act professionally and appropriately while at County facilities.
27
28
A-1
Exhibit A
1 G. Require every intern to conform to all applicable County policies, procedures,
2 regulations, and all requirements and restrictions specified jointly by representatives of the
3 Contractor and the County.
4 H. Notify the County's DPH Director, or designee, in advance of intern placement
5 regarding:
6 1) Locations, dates, times and the number of hours or changes thereof,
7 regarding intern availability or the Internship Program.
8 2) Any change in the placement of interns in Internship Program
9 assignments.
10 3) Intern placement shall be for ten (10 consecutive weeks at forty(40)
11 hours per week.
12 I. In consultation and coordination with the County's DPH Director, or designee,
13 arrange for periodic conferences a necessary between appropriate representatives of the
14 Contractor and the County to evaluate the Internship Program provided under this Agreement.
15 J. Shall provide for an introductory orientation of interns assigned to County
16 facilities, which shall provide an overview of the Internship program assignment(s) and the
17 terms and conditions of Intern placement County facilities.
18 K. Shall agree that any special reports, projects, thesis, and/or publications based
19 upon studies and research arising out of the cooperative health care management education
20 experience permitted by this Agreement, shall be reviewed and approved prior to release by the
21 County's DPH Director, or designee, as appropriate.
22 L. Contractor's employees, agents, and Interns placed by the Contractor shall abide
23' by the provisions of State of California Law relating to medical records, further described in
24 Article 7.
25 M. Contractors' employees, agents, and Interns placed by the Contractor shall be
26 issued County identification badges which must be worn only at County facilities while
27 participating in the Internship Program, pursuant to the terms and conditions of the Agreement.
28
A-2
Exhibit A
1 N. Contractor agrees to provide County with a copy of the executed agreement
2 between the intern and the Contractor, for any Contractor Intern placed at County.
3 O. Contractor's interns will not be permitted to operate County vehicles or their
4 personal vehicles during the course of doing business with the County under this agreement.
5 2. County Responsibilities:
6 A. Contractor's Internship Programs are intended as a professional educational
7 experience for the Interns. Interns are not employees of Contractor or County. It is anticipated
8 and expected that interns will be assigned projects and assignments that are vocational in
9 nature. The County has broad discretion to assign any intern a variety of tasks and work
10 commensurate with intern's educational background and experience. Interns are not however,
11 to be utilized as replacement or temporary employees and intern's placement is not intended to
12 displace any of County's existing personnel.
13 It is the intention of Contractor and County that interns have broad exposure to County's
14 health care management practices and that the internship experience will provide interns with
15 practical on-the-job experience in areas of health care management that complement the
16 intern's educational experience. Providing intern with exposure to strategic planning, budgeting,
17 personnel management, and other management functions of County that reinforce subject
18 areas included in intern's academic program is strongly encouraged.
19 County understands that interns are students seeking an educational work experience
20 and mentoring by health care professionals and agrees to exercise reasonable efforts to involve
21 Interns in activities that will provide them with learning opportunities and a range of professional
22 experiences.
23 B. Contractor's interns placed at the County shall be considered only an intern or
24 trainee, not an employee of Contractor or County. County is not obliged to, and will not pay
25 Intern any form of employee compensation or provide Intern any employee benefits.
26 C. County's DPH Director, or designee, shall have sole authority to determine how
27 many placements for internships shall be made available to Contractor during each term of this
28 Agreement. In addition, County shall permit each intern who is designated by Contractor to
A-3
Exhibit A
1 receive health care management internship experience at appropriate County facilities at an
2 agreed (between County and Contractor) number of hours and shall furnish and permit interns
3 free access to appropriate County facilities for such health care management internship
4 experience, subject to the terms and conditions of this Agreement.
5 D. County shall identify an individual who shall serve as a Preceptor for each intern.
6 The Preceptor shall be responsible for assigning all tasks and shall make reasonable efforts to
7 obtain feedback concerning the Intern's experiences, training and performance. The Preceptor
8 shall provide the intern with not less than two (2) reviews of the intern's work, one (1) review
9 being provided not later than the sixth (6th) week of the placement and another review being
10 provided not earlier than the ninth (9th)week of the placement. The reviews shall be utilized for
11 the purpose of providing the intern with feedback concerning the intern's professional training
12 experience in health care management. The review shall not be structured or presented as a
13 performance evaluation similar to those used for County's employees.
14 E. County shall, subject to budgetary and operational concerns, maintain facilities
15 used for the learning experience in a manner that shall at all times conform to the requirements
16 of Contractor's Internship Program.
17 F. All interns shall be subject to the policies and procedures of the County generally
18 applicable to business visitors and invitees and to other educational trainees at County's
19 facilities. County shall make reasonable efforts to inform interns of these policies and
20 procedures.
21 G. County shall reserve the absolute right to review, authorize, and in its sole
22 discretion, deny access or admission by any intern and/or Contractor representatives in County
23 facilities.
24 H. County shall provide input into the evaluation conducted by Contractor, of intern's
25 skills and progress.
26 I. County shall agree to allow interns to use existing dining room/break area space
27 in the departments where they are placed. Contractor's interns shall purchase food in the
28 regular system or bring food with them; no special arrangements for food will be made.
A-4
Exhibit A
1 J. County shall not be responsible for providing transportation or auto liability
2 coverage for participating interns as they will not be permitted to operate County vehicles or
3 their personal vehicles to perform activities related to this Agreement.
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
A-5
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as
2 these terms are defined by 45 CFR 160.103. In connection with providing services under the
3 Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health
4 Information ("PHI")from or on behalf of the County. The parties enter into this Business Associate
5 Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to govern the
6 use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security,
7 Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
8 The parties to this Agreement shall be in strict conformance with all applicable federal and
9 State of California laws and regulations, including, but not limited to California Welfare and
10 Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431; California
11 Civil Code section 56 et seq.; the Health Insurance Portability and Accountability Act of 1996, as
12 amended ("HIPAX), including, but not limited to, 45 CFR Parts160, 45 CFR 162, and 45 CFR 164;
13 the Health Information Technology for Economic and Clinical Health Act("HITECH") regarding the
14 confidentiality and security of patient information, including, but not limited to 42 USC 17901 et
15 seq.; and the Genetic Information Nondiscrimination Act ("GINA")of 2008 regarding the
16 confidentiality of genetic information.
17 Except as otherwise provided in this Agreement, the Contractor, as a business associate
18 of the County, may use or disclose Protected Health Information ("PHI") to perform functions,
19 activities or services for or on behalf of the County, as specified in this Agreement, provided that
20 such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of PHI may not
21 be more expansive than those applicable to the County, as the "Covered Entity" under the
22 HIPAA Rules, except as authorized for management, administrative or legal responsibilities of
23 the Contractor.
24 2. The Contractor, including its subcontractors and employees, shall protect from
25 unauthorized access, use, or disclosure of names and other identifying information, including
26 genetic information, concerning persons receiving services pursuant to this Agreement, except
27 where permitted in order to carry out data aggregation purposes for health care operations [45
28
B-1
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 CFR§§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all
2 persons receiving services pursuant to a County-funded program. This requirement applies to
3 electronic PHI. The Contractor shall not use such identifying information or genetic information for
4 any purpose other than carrying out the Contractor's obligations under this Agreement.
5 3. The Contractor, including its subcontractors and employees, shall not disclose any
6 such identifying information or genetic information to any person or entity, except as otherwise
7 specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law,
8 required by the Secretary of the United States Department of Health and Human Services
9 ("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is
10 permitted by this Agreement or authorized by law, the Contractor shall make reasonable efforts to
11 limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request.
12 4. For purposes of the above sections, identifying information shall include, but not be
13 limited to, name, identifying number, symbol, or other identifying particular assigned to the
14 individual, such as fingerprint or voiceprint, or photograph.
15 5. For purposes of the above sections, genetic information shall include genetic tests
16 of family members of an individual or individual(s), manifestation of disease or disorder of family
17 members of an individual, or any request for or receipt of genetic services by individual or family
18 members. Family member means a dependent or any person who is first, second, third, or fourth
19 degree relative.
20 6. The Contractor shall provide access, at the request of the County, and in the time
21 and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR §
22 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR§ 164.524
23 regarding access by individuals to their PHI. With respect to individual requests, access shall be
24 provided within thirty (30) days from request. Access may be extended if the Contractor cannot
25 provide access and provides the individual with the reasons for the delay and the date when
26 access may be granted. PHI shall be provided in the form and format requested by the individual
27 or the County.
28
B-2
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 The Contractor shall make any amendment(s) to PHI in a designated record set at the
2 request of the County or individual, and in the time and manner designated by the County in
3 accordance with 45 CFR § 164.526.
4 The Contractor shall provide to the County or to an individual, in a time and manner
5 designated by the County, information collected in accordance with 45 CFR § 164.528, to permit
6 the County to respond to a request by the individual for an accounting of disclosures of PHI in
7 accordance with 45 CFR § 164.528.
8 7. The Contractor shall report to the County, in writing, any knowledge or
9 reasonable belief that there has been unauthorized access, viewing, use, disclosure, security
10 incident, or breach of unsecured PHI not permitted by this Agreement of which the Contractor
11 becomes aware, immediately and without reasonable delay and in no case later than two (2)
12 business days of discovery. Immediate notification shall be made to the County's Information
13 Security Officer and Privacy Officer and the County's Department of Public Health ("DPH")
14 HIPAA Representative, within two (2) business days of discovery. The notification shall include,
15 to the extent possible, the identification of each individual whose unsecured PHI has been, or is
16 reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
17 Contractor shall take prompt corrective action to cure any deficiencies and any action pertaining
18 to such unauthorized disclosure required by applicable federal and State laws and regulations.
19 The Contractor shall investigate such breach and is responsible for all notifications required by
20 law and regulation or deemed necessary by the County and shall provide a written report of the
21 investigation and reporting required to the County's Information Security Officer and Privacy
22 Officer and the County's DPH HIPAA Representative.
23 This written investigation and description of any reporting necessary shall be
24 postmarked within the thirty (30) working days of the discovery of the breach to the addresses
25 below:
26
27
28
B-3
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 County of Fresno County of Fresno County of Fresno
Department of Public Health Department of Public Health Department of Internal
2 HIPAA Representative Privacy Officer Services
3 (559) 600-6439 (559) 600-6405 Information Security Officer
P.O. Box 11867 P.O. Box 11867 (559) 600-5800
4 Fresno, California 93775 Fresno, California 93775 333 W. Pontiac Way
Clovis, California 93612
5 8. The Contractor shall make its internal practices, books, and records relating to
6 the use and disclosure of PHI received from the County, or created or received by the
7 Contractor on behalf of the County, in compliance with HIPAA's Privacy Rule, including, but not
8 limited to the requirements set forth in Title 45, CFR, Sections 160 and 164. The Contractor
g shall make its internal practices, books, and records relating to the use and disclosure of PHI
10 received from the County, or created or received by the Contractor on behalf of the County,
11 available to the Secretary upon demand.
12 The Contractor shall cooperate with the compliance and investigation reviews conducted
13 by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal
14 business hours; however, upon exigent circumstances access at any time must be granted.
15 Upon the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor
16 and in possession of a subcontractor of the Contractor, the Contractor must certify to the
17 Secretary its efforts to obtain the information from the subcontractor.
18 9. Safeguards
19 The Contractor shall implement administrative, physical, and technical safeguards as
20 required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
21 appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
22 PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
23 unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
24 this Agreement. The Contractor shall conduct an accurate and thorough assessment of the
25 potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI.
26 The Contractor shall develop and maintain a written information privacy and security program
27 that includes administrative, technical and physical safeguards appropriate to the size and
28
B-4
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 complexity of the Contractor's operations and the nature and scope of its activities. Upon the
2 County's request, the Contractor shall provide the County with information concerning such
3 safeguards.
4 The Contractor shall implement strong access controls and other security safeguards
5 and precautions in order to restrict logical and physical access to confidential, personal (e.g.,
6 PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include
7 the following administrative and technical password controls for all systems used to process or
8 store confidential, personal, or sensitive data:
9 A. Passwords must not be:
10 (1) Shared or written down where they are accessible or recognizable by anyone
11 else; such as taped to computer screens, stored under keyboards, or visible
12 in a work area;
13 (2) A dictionary word; or
14 (3) Stored in clear text
15 B. Passwords must be:
16 (1) Eight (8) characters or more in length;
17 (2) Changed every ninety (90) days;
18 (3) Changed immediately if revealed or compromised; and
19 (4) Composed of characters from at least three (3) of the following four(4)
20 groups from the standard keyboard:
21 a) Upper case letters (A-Z);
22 b) Lowercase letters (a-z);
23 c) Arabic numerals (0 through 9); and
24 d) Non-alphanumeric characters (punctuation symbols).
25 The Contractor shall implement the following security controls on each workstation or
26 portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
27 data:
28 B-5
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 1. Network-based firewall and/or personal firewall;
2 2. Continuously updated anti-virus software; and
3 3. Patch management process including installation of all operating system/software
4 vendor security patches.
5 The Contractor shall utilize a commercial encryption solution that has received FIPS
6 140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
7 electronic media (including, but not limited to, compact disks and thumb drives) and on portable
8 computing devices (including, but not limited to, laptop and notebook computers).
9 The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or
10 other internet transport protocol unless the data is encrypted by a solution that has been
11 validated by the National Institute of Standards and Technology (NIST) as conforming to the
12 Advanced Encryption Standard (AES) Algorithm. The Contractor must apply appropriate
13 sanctions against its employees who fail to comply with these safeguards. The Contractor must
14 adopt procedures for terminating access to PHI when employment of employee ends.
15 10. Mitigation of Harmful Effects
16 The Contractor shall mitigate, to the extent practicable, any harmful effect that is
17 suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or
18 breach of PHI by the Contractor or its subcontractors in violation of the requirements of these
19 provisions. The Contractor must document suspected or known harmful effects and the
20 outcome.
21 11. The Contractor's Subcontractors
22 The Contractor shall ensure that any of its contractors, including subcontractors, if
23 applicable, to whom the Contractor provides PHI received from or created or received by the
24 Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions
25 that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the
26 relevant provisions of these provisions into each subcontract or sub-award to such agents or
27 subcontractors.
28 B-6
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 Nothing in this section 11 or this Exhibit B authorizes the Contractor to perform services
2 under this Agreement using subcontractors.
3 12. Employee Training and Discipline
4 The Contractor shall train and use reasonable measures to ensure compliance with the
5 requirements of these provisions by employees who assist in the performance of functions or
6 activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
7 such employees who intentionally violate any provisions of these provisions, which may include
8 termination of employment.
9 13. Termination for Cause
10 Upon the County's knowledge of a material breach of these provisions by the Contractor,
11 the County will either:
12 A. Provide an opportunity for the Contractor to cure the breach or end the
13 violation, and the County may terminate this Agreement if the Contractor does not cure the
14 breach or end the violation within the time specified by the County; or
15 B. Immediately terminate this Agreement if the Contractor has breached a
16 material term of this Exhibit B and cure is not possible, as determined by the County.
17 C. If neither cure nor termination is feasible, the County's Privacy Officer will
18 report the violation to the Secretary of the U.S. Department of Health and Human Services.
19 14. Judicial or Administrative Proceedings
20 The County may terminate this Agreement if: (1) the Contractor is found guilty in a
21 criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or
22 (2) there is a finding or stipulation in an administrative or civil proceeding in which the Contractor
23 is a party that the Contractor has violated a privacy or security standard or requirement of the
24 HITECH Act, HIPAA or other security or privacy laws.
25 15. Effect of Termination
26 Upon termination or expiratiop of this Agreement for any reason, the Contractor shall
27 return or destroy all PHI received from the County (or created or received by the Contractor on
28
B-7
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of
2 such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend
3 the protections of these provisions to such information, and limit further use of such PHI to those
4 purposes that make the return or destruction of such PHI infeasible. This provision applies to
5 PHI that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the
6 Contractor destroys the PHI data, a certification of date and time of destruction shall be
7 provided to the County by the Contractor.
8 16. Compliance with Other Laws
9 To the extent that other state and/or federal laws provide additional, stricter and/or more
10 protective privacy and/or security protections to PHI or other confidential information covered
11 under this BAA, the Contractor agrees to comply with the more protective of the privacy and
12 security standards set forth in the applicable state or federal laws to the extent such standards
13 provide a greater degree of protection and security than HIPAA Rules or are otherwise more
14 favorable to the individual.
15 17. Disclaimer
16 The County makes no warranty or representation that compliance by the Contractor with
17 these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
18 Contractor's own purposes or that any information in the Contractor's possession or control, or
19 transmitted or received by the Contractor, is or will be secure from unauthorized access,
20 viewing, use, disclosure, or breach. The Contractor is solely responsible for all decisions made
21 by the Contractor regarding the safeguarding of PHI.
22 18. Amendment
23 The parties acknowledge that Federal and State laws relating to electronic data security
24 and privacy are rapidly evolving and that amendment of this Exhibit B may be required to
25 provide for procedures to ensure compliance with such developments. The parties specifically
26 agree to take such action as is necessary to amend this agreement in order to implement the
27 standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws
28
B-8
Exhibit B
Health Insurance Portability and Accountability Act (HIPAA)
1 relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty
2 (30) days written notice in the event that the Contractor does not enter into an amendment
3 providing assurances regarding the safeguarding of PHI that the County in its sole discretion,
4 deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the
5 HITECH Act.
6 19. No Third-Party Beneficiaries
7 Nothing expressed or implied in the provisions of this Exhibit B is intended to confer, and
8 nothing in this Exhibit B does confer, upon any person other than the County or the Contractor
9 and their respective successors or assignees, any rights, remedies, obligations or liabilities
10 whatsoever.
11 20. Interpretation
12 The provisions of this Exhibit B shall be interpreted as broadly as necessary to
13 implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that
14 any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a
15 meaning that complies and is consistent with the HIPAA Rules.
16 21. Regulatory References
17 A reference in the terms and conditions of these provisions to a section in the HIPAA
18 Rules means the section as in effect or as amended.
19 22. Survival
20 The respective rights and obligations of the Contractor as stated in this Exhibit B survive
21 the termination or expiration of this Agreement.
22 23. No Waiver of Obligation
23 Change, waiver or discharge by the County of any liability or obligation of the Contractor
24 under this Exhibit F on any one or more occasions is not a waiver of performance of any
25 continuing or other obligation of the Contractor and does not prohibit enforcement by the County
26 of any obligation on any other occasion.
27
28 B-9
Exhibit C
1
2
3
County of Fresno
4
DEPARTMENT OF PUBLIC HEALTH
David Luchini, Direct,:r
5 71iC Dr. Rais Vohra, Interim Health Officer
6 DEPARTMENT OF BEHAVIORAL HEALTH
Susan L. Holt, Director/Public Guardian
7
8
AGREEMENT AND RELEASE OF LUBILITY
9 In consideration for being permitted to serve student internship on the land,facilities owned'occupied by County
10 of Fresno("County-)located at various County locations and to engage in student uttern administrative duties,
and related activities(hereinafter collectively referred to as-Intern Activities".I;
11
12 PREgTED NANIE OF STUDEXT L1-TERN("RELEASER")
13 SIGNATURE OF STUDENT IVTER..X("RELEASER!) DATE
14
Hereby agree as follows:
15 INITLkL EACH OF THE FOLLON UNG
16 1. To RELEASE AND DISCHARGE the COUNTY from any and all liability,claims,demands,or
causes of action tht may hereafter have for injuries and damages arising out of my participation un Intem
17 activities including but not limited to losses CAUSED BY THE'NEGLIGENCE OF THE COU\TY.
18 2. Not to sue or make claim against the COUN7Y for damages or other losses sustained as a result of
my participation in Intern Activities.
19 3. To DMENDUY AND HOLD THE COU,\7Y HARMLESS from all claims,judgements and
costs,including attorneys'fees incurred in connection with any action brought as a result of my participation in
20 Intent activities.
21 4. I have been advised and recognize that my Lntern Activities are riot covered by any personal
accident or general liability insurance policy issued to the COUNTY.
22 i. Recognize that this Aereennent and Release of Liability is a contract pursuant to which I have
released any and all claims against die released Parties resulting from nny participation in Intern Activities
23 including an)-claans caused by negligence of the COU\TY.
24
25
26 Promotion,preservation and protection of the community's health
27 122!Fulton Street,Fresno,CA 93721 i P.O.Box 11867,Fresno,CA 93721
(559)60-0-32.00 1 FAX(559)600-7687
The County of Fresno is an Equal Employment Opportunity Employer
28 www.fresnocountvca.aov I yn+ .fcdph.am
C-1
Exhibit D
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the Contractor or any third
parties, Contractor, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than One Million Dollars ($1,000,000) per occurrence and an annual aggregate of
Three Million Dollars ($3,000,000). This policy must be issued on a per occurrence
basis. Coverage must include products, completed operations, property damage, bodily
injury, personal injury, and advertising injury. The Contractor shall obtain an
endorsement to this policy naming the County of Fresno, its officers, agents, employees,
and volunteers, individually and collectively, as additional insureds, but only insofar as
the operations under this Agreement are concerned. Such coverage for additional
insureds will apply as primary insurance and any other insurance, or self-insurance,
maintained by the County is excess only and not contributing with insurance provided
under the Contractor's policy.
The Contractor shall ensure that each intern who participates in the County's Internship
Program procures and maintains in force during the term of this agreement or internship,
at the interns sole cost and expense, General Liability Insurance. The policy of General
Liability Insurance shall have coverage for sexual harassment and abuse, property
damage, bodily injury, and personal injury within the stated limits. If the contractor will
require interns to provide their own insurance, instead of the Contractor providing it on
the intern's behalf, the interns will also have to name the County as an additional insured
and their insurance will be primary.
(B) Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits for interns participating in the Internship
Program.
(C) Employer's Liability. Employer's liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for disease.
(D)Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data)that is in the care, custody, or control of the Contractor.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) breach of any of the Contractor's obligations under Exhibit F
of this Agreement; (iv) system failure; (v) data recovery; (vi)failure to timely disclose
data breach or Security Breach; (vii)failure to comply with privacy policy; (viii) payment
card liabilities and costs; (ix) infringement of intellectual property, including but not
limited to infringement of copyright, trademark, and trade dress; (x) invasion of privacy,
D-1
Exhibit D
including release of private information; (xi) information theft; (xii) damage to or
destruction or alteration of electronic information; (xiii) cyber extortion; (xiv) extortion
related to the Contractor's obligations under this Agreement regarding electronic
information, including Personal Information; (xv)fraudulent instruction; (xvi) funds
transfer fraud; (xvii) telephone fraud; (xviii) network security; (xix) data breach response
costs, including Security Breach response costs; (xx) regulatory fines and penalties
related to the Contractor's obligations under this Agreement regarding electronic
information, including Personal Information; and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the Contractor signs this Agreement,
and at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the Contractor shall deliver, or cause its
broker or producer to deliver, to the County of Fresno, Department of Public Health, P.O.
Box 11867, Fresno, CA 93775, Attention: Contracts Section —6th Floor, or email,
DPHContracts@fresnocountyca.gov, certificates of insurance and endorsements for all
of the coverages required under this Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; (2)the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
Contractor has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
Contractor's policy.
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
(v) The technology professional liability insurance certificate must also state that
coverage encompasses all of the Contractor's obligations under this Agreement,
including but not limited to claims involving Cyber Risks, as that term is defined in
this Agreement.
(vi) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
D-2
Exhibit D
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the Contractor.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the Contractor shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the Contractor shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the Contractor shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the Contractor or its insurer to timely provide a written notice required by
this paragraph is a breach of this Agreement.
(D)County's Entitlement to Greater Coverage. If the Contractor has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the Contractor shall deliver, or cause its broker or producer
to deliver, to the County's Risk Manager certificates of insurance and endorsements for
all of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The Contractor waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The Contractor is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the Contractor's waiver of subrogation under this paragraph is effective
whether or not the Contractor obtains such an endorsement.
(F) County's Remedy for Contractor's Failure to Maintain. If the Contractor fails to keep
in effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the Contractor. The County may offset such
charges against any amounts owed by the County to the Contractor under this
Agreement.
(G)Subcontractors. The Contractor shall require and verify that all subcontractors used by
the Contractor to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the Contractor to provide services under this Agreement using subcontractors
D-3
Exhibit E
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(H) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(1) Enter the board member's company/agency name and address.
(J) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(K) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
E-1
Exhibit E
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
E-1
Exhibit F
Data Security
1. Definitions
Capitalized terms used in this Exhibit F have the meanings set forth in this section 1.
(A) "Authorized Employees" means the Contractor's employees who have access to Personal
Information.
(B) "Authorized Persons" means: (i) any and all Authorized Employees; and (ii) any and all of the
Contractor's subcontractors, representatives, agents, outsourcers, and consultants, and
providers of professional services to the Contractor, who have access to Personal Information
and are bound by law or in writing by confidentiality obligations sufficient to protect Personal
Information in accordance with the terms of this Exhibit F.
(C)"Director" means the County's Director of the Department of Public Health or his or her
designee.
(D)"Disclose" or any derivative of that word means to disclose, release, transfer, disseminate, or
otherwise provide access to or communicate all or any part of any Personal Information orally,
in writing, or by electronic or any other means to any person.
(E) "Person" means any natural person, corporation, partnership, limited liability company, firm, or
association.
(F) "Personal Information" means any and all information, including any data, provided, or to
which access is provided, to the Contractor by or upon the authorization of the County, under
this Agreement, including but not limited to vital records, that: (i) identifies, describes, or relates
to, or is associated with, or is capable of being used to identify, describe, or relate to, or
associate with, a person (including, without limitation, names, physical descriptions, signatures,
addresses, telephone numbers, e-mail addresses, education, financial matters, employment
history, and other unique identifiers, as well as statements made by or attributable to the
person); (ii) is used or is capable of being used to authenticate a person (including, without
limitation, employee identification numbers, government-issued identification numbers,
passwords or personal identification numbers (PINs), financial account numbers, credit report
information, answers to security questions, and other personal identifiers); or (iii) is personal
information within the meaning of California Civil Code section 1798.3, subdivision (a), or
1798.80, subdivision (e). Personal Information does not include publicly available information
that is lawfully made available to the general public from federal, state, or local government
records.
(G)"Privacy Practices Complaint" means a complaint received by the County relating to the
Contractor's (or any Authorized Person's) privacy practices or alleging a Security Breach. Such
complaint shall have sufficient detail to enable the Contractor to promptly investigate and take
remedial action under this Exhibit F.
(H) "Security Safeguards" means physical, technical, administrative or organizational security
procedures and practices put in place by the Contractor(or any Authorized Persons) that relate
to the protection of the security, confidentiality, value, or integrity of Personal Information.
Security Safeguards shall satisfy the minimal requirements set forth in section 3(C) of this
Exhibit F.
F-2
Exhibit F
Data Security
(1) "Security Breach" means (i) any act or omission that compromises either the security,
confidentiality, value, or integrity of any Personal Information or the Security Safeguards, or(ii)
any unauthorized Use, Disclosure, or modification of, or any loss or destruction of, or any
corruption of or damage to, any Personal Information.
(J) "Use" or any derivative of that word means to receive, acquire, collect, apply, manipulate,
employ, process, transmit, disseminate, access, store, disclose, or dispose of Personal
Information.
2. Standard of Care
(A) The Contractor acknowledges that, in the course of its engagement by the County under this
Agreement, the Contractor, or any Authorized Persons, may Use Personal Information only as
permitted in this Agreement.
(B) The Contractor acknowledges that Personal Information is deemed to be confidential
information of, or owned by, the County (or persons from whom the County receives or has
received Personal Information) and is not confidential information of, or owned or by, the
Contractor, or any Authorized Persons. The Contractor further acknowledges that all right, title,
and interest in or to the Personal Information remains in the County (or persons from whom the
County receives or has received Personal Information) regardless of the Contractor's, or any
Authorized Person's, Use of that Personal Information.
(C)The Contractor agrees and covenants in favor of the Country that the Contractor shall:
(i) keep and maintain all Personal Information in strict confidence, using such degree of
care under this section 2 as is reasonable and appropriate to avoid a Security Breach;
(ii) Use Personal Information exclusively for the purposes for which the Personal
Information is made accessible to the Contractor pursuant to the terms of this Exhibit F;
(iii) not Use, Disclose, sell, rent, license, or otherwise make available Personal Information
for the Contractor's own purposes or for the benefit of anyone other than the County,
without the County's express prior written consent, which the County may give or
withhold in its sole and absolute discretion; and
(iv) not, directly or indirectly, Disclose Personal Information to any person (an
"Unauthorized Third Party") other than Authorized Persons pursuant to this Agreement,
without the Director's express prior written consent.
(D) Notwithstanding the foregoing paragraph, in any case in which the Contractor believes it, or
any Authorized Person, is required to disclose Personal Information to government regulatory
authorities, or pursuant to a legal proceeding, or otherwise as may be required by applicable
law, Contractor shall (i) immediately notify the County of the specific demand for, and legal
authority for the disclosure, including providing County with a copy of any notice, discovery
demand, subpoena, or order, as applicable, received by the Contractor, or any Authorized
Person, from any government regulatory authorities, or in relation to any legal proceeding, and
(ii) promptly notify the County before such Personal Information is offered by the Contractor for
such disclosure so that the County may have sufficient time to obtain a court order or take any
other action the County may deem necessary to protect the Personal Information from such
F-3
Exhibit F
Data Security
disclosure, and the Contractor shall cooperate with the County to minimize the scope of such
disclosure of such Personal Information.
(E) The Contractor shall remain liable to the County for the actions and omissions of any
Unauthorized Third Party concerning its Use of such Personal Information as if they were the
Contractor's own actions and omissions.
3. Information Security
(A) The Contractor covenants, represents and warrants to the County that the Contractor's Use of
Personal Information under this Agreement does and will at all times comply with all applicable
federal, state, and local, privacy and data protection laws, as well as all other applicable
regulations and directives, including but not limited to California Civil Code, Division 3, Part 4,
Title 1.81 (beginning with section 1798.80), and the Song-Beverly Credit Card Act of 1971
(California Civil Code, Division 3, Part 4, Title 1.3, beginning with section 1747). If the
Contractor Uses credit, debit or other payment cardholder information, the Contractor shall at
all times remain in compliance with the Payment Card Industry Data Security Standard ("PCI
DSS") requirements, including remaining aware at all times of changes to the PCI DSS and
promptly implementing and maintaining all procedures and practices as may be necessary to
remain in compliance with the PCI DSS, in each case, at the Contractor's sole cost and
expense.
(B) The Contractor covenants, represents and warrants to the County that, as of the effective date
of this Agreement, the Contractor has not received notice of any violation of any privacy or data
protection laws, as well as any other applicable regulations or directives, and is not the subject
of any pending legal action or investigation by, any government regulatory authority regarding
same.
(C)Without limiting the Contractor's obligations under section 3(A) of this Exhibit F, the
Contractor's (or Authorized Person's) Security Safeguards shall be no less rigorous than
accepted industry practices and, at a minimum, include the following:
(i) limiting Use of Personal Information strictly to the Contractor's and Authorized Persons'
technical and administrative personnel who are necessary for the Contractor's, or
Authorized Persons', Use of the Personal Information pursuant to this Agreement;
(ii) ensuring that all of the Contractor's connectivity to County computing systems will only
be through the County's security gateways and firewalls, and only through security
procedures approved upon the express prior written consent of the Director;
(iii) to the extent that they contain or provide access to Personal Information, (a) securing
business facilities, data centers, paper files, servers, back-up systems and computing
equipment, operating systems, and software applications, including, but not limited to,
all mobile devices and other equipment, operating systems, and software applications
with information storage capability; (b) employing adequate controls and data security
measures, both internally and externally, to protect (1) the Personal Information from
potential loss or misappropriation, or unauthorized Use, and (2) the County's operations
from disruption and abuse; (c) having and maintaining network, device application,
database and platform security; (d) maintaining authentication and access controls
F-4
Exhibit F
Data Security
within media, computing equipment, operating systems, and software applications; and
(e) installing and maintaining in all mobile, wireless, or handheld devices a secure
internet connection, having continuously updated anti-virus software protection and a
remote wipe feature always enabled, all of which is subject to express prior written
consent of the Director;
(iv) encrypting all Personal Information at advance encryption standards of Advanced
Encryption Standards (AES) of 128 bit or higher (a) stored on any mobile devices,
including but not limited to hard disks, portable storage devices, or remote installation,
or(b) transmitted over public or wireless networks (the encrypted Personal Information
must be subject to password or pass phrase, and be stored on a secure server and
transferred by means of a Virtual Private Network (VPN) connection, or another type of
secure connection, all of which is subject to express prior written consent of the
Director);
(v) strictly segregating Personal Information from all other information of the Contractor,
including any Authorized Person, or anyone with whom the Contractor or any
Authorized Person deals so that Personal Information is not commingled with any other
types of information;
(vi) having a patch management process including installation of all operating system and
software vendor security patches;
(vii) maintaining appropriate personnel security and integrity procedures and practices,
including, but not limited to, conducting background checks of Authorized Employees
consistent with applicable law; and
(viii) providing appropriate privacy and information security training to Authorized
Employees.
(D) During the term of each Authorized Employee's employment by the Contractor, the Contractor
shall cause such Authorized Employees to abide strictly by the Contractor's obligations under
this Exhibit F. The Contractor shall maintain a disciplinary process to address any unauthorized
Use of Personal Information by any Authorized Employees.
(E) The Contractor shall, in a secure manner, backup daily, or more frequently if it is the
Contractor's practice to do so more frequently, Personal Information received from the County,
and the County shall have immediate, real time access, at all times, to such backups via a
secure, remote access connection provided by the Contractor, through the Internet.
(F) The Contractor shall provide the County with the name and contact information for each
Authorized Employee (including such Authorized Employee's work shift, and at least one
alternate Authorized Employee for each Authorized Employee during such work shift) who shall
serve as the County's primary security contact with the Contractor and shall be available to
assist the County twenty-four (24) hours per day, seven (7) days per week as a contact in
resolving the Contractor's and any Authorized Persons' obligations associated with a Security
Breach or a Privacy Practices Complaint.
(G)The Contractor shall not knowingly include or authorize any Trojan Horse, back door, time
bomb, drop dead device, worm, virus, or other code of any kind that may disable, erase,
F-5
Exhibit F
Data Security
display any unauthorized message within, or otherwise impair any County computing system,
with or without the intent to cause harm.
4. Security Breach Procedures
(A) Immediately upon the Contractor's awareness or reasonable belief of a Security Breach, the
Contractor shall (i) notify the Director of the Security Breach, such notice to be given first by
telephone at the following telephone number, followed promptly by email at the following email
address: (559) 600-8900/ incidents@fresnocountyca.gov (which telephone number and email
address the County may update by providing notice to the Contractor), and (ii) preserve all
relevant evidence (and cause any affected Authorized Person to preserve all relevant
evidence) relating to the Security Breach. The notification shall include, to the extent
reasonably possible, the identification of each type and the extent of Personal Information that
has been, or is reasonably believed to have been, breached, including but not limited to,
compromised, or subjected to unauthorized Use, Disclosure, or modification, or any loss or
destruction, corruption, or damage.
(B) Immediately following the Contractor's notification to the County of a Security Breach, as
provided pursuant to section 4(A) of this Exhibit F, the Parties shall coordinate with each other
to investigate the Security Breach. The Contractor agrees to fully cooperate with the County,
including, without limitation:
(i) assisting the County in conducting any investigation;
(ii) providing the County with physical access to the facilities and operations affected;
(iii) facilitating interviews with Authorized Persons and any of the Contractor's other
employees knowledgeable of the matter; and
(iv) making available all relevant records, logs, files, data reporting and other materials
required to comply with applicable law, regulation, industry standards, or as otherwise
reasonably required by the County.
To that end, the Contractor shall, with respect to a Security Breach, be solely responsible, at its
cost, for all notifications required by law and regulation, or deemed reasonably necessary by
the County, and the Contractor shall provide a written report of the investigation and reporting
required to the Director within 30 days after the Contractor's discovery of the Security Breach.
(C)County shall promptly notify the Contractor of the Director's knowledge, or reasonable belief, of
any Privacy Practices Complaint, and upon the Contractor's receipt of that notification, the
Contractor shall promptly address such Privacy Practices Complaint, including taking any
corrective action under this Exhibit F, all at the Contractor's sole expense, in accordance with
applicable privacy rights, laws, regulations and standards. In the event the Contractor
discovers a Security Breach, the Contractor shall treat the Privacy Practices Complaint as a
Security Breach. Within 24 hours of the Contractor's receipt of notification of such Privacy
Practices Complaint, the Contractor shall notify the County whether the matter is a Security
Breach, or otherwise has been corrected and the manner of correction, or determined not to
require corrective action and the reason for that determination.
F-6
Exhibit F
Data Security
(D)The Contractor shall take prompt corrective action to respond to and remedy any Security
Breach and take mitigating actions, including but not limiting to, preventing any reoccurrence of
the Security Breach and correcting any deficiency in Security Safeguards as a result of such
incident, all at the Contractor's sole expense, in accordance with applicable privacy rights,
laws, regulations and standards. The Contractor shall reimburse the County for all reasonable
costs incurred by the County in responding to, and mitigating damages caused by, any Security
Breach, including all costs of the County incurred relation to any litigation or other action
described section 4(E) of this Exhibit F.
(E) The Contractor agrees to cooperate, at its sole expense, with the County in any litigation or
other action to protect the County's rights relating to Personal Information, including the rights
of persons from whom the County receives Personal Information.
5. Oversight of Security Compliance
(A) The Contractor shall have and maintain a written information security policy that specifies
Security Safeguards appropriate to the size and complexity of the Contractor's operations and
the nature and scope of its activities.
(B) Upon the County's written request, to confirm the Contractor's compliance with this Exhibit F,
as well as any applicable laws, regulations and industry standards, the Contractor grants the
County or, upon the County's election, a third parry on the County's behalf, permission to
perform an assessment, audit, examination or review of all controls in the Contractor's physical
and technical environment in relation to all Personal Information that is Used by the Contractor
pursuant to this Agreement. The Contractor shall fully cooperate with such assessment, audit
or examination, as applicable, by providing the County or the third party on the County's behalf,
access to all Authorized Employees and other knowledgeable personnel, physical premises,
documentation, infrastructure and application software that is Used by the Contractor for
Personal Information pursuant to this Agreement. In addition, the Contractor shall provide the
County with the results of any audit by or on behalf of the Contractor that assesses the
effectiveness of the Contractor's information security program as relevant to the security and
confidentiality of Personal Information Used by the Contractor or Authorized Persons during the
course of this Agreement under this Exhibit F.
(C)The Contractor shall ensure that all Authorized Persons who Use Personal Information agree
to the same restrictions and conditions in this Exhibit F. that apply to the Contractor with
respect to such Personal Information by incorporating the relevant provisions of these
provisions into a valid and binding written agreement between the Contractor and such
Authorized Persons, or amending any written agreements to provide same.
6. Return or Destruction of Personal Information. Upon the termination of this Agreement, the
Contractor shall, and shall instruct all Authorized Persons to, promptly return to the County all
Personal Information, whether in written, electronic or other form or media, in its possession or the
possession of such Authorized Persons, in a machine readable form used by the County at the time of
such return, or upon the express prior written consent of the Director, securely destroy all such
Personal Information, and certify in writing to the County that such Personal Information have been
returned to the County or disposed of securely, as applicable. If the Contractor is authorized to
dispose of any such Personal Information, as provided in this Exhibit F, such certification shall state
F-7
Exhibit F
Data Security
the date, time, and manner (including standard) of disposal and by whom, specifying the title of the
individual. The Contractor shall comply with all reasonable directions provided by the Director with
respect to the return or disposal of Personal Information and copies of Personal Information. If return
or disposal of such Personal Information or copies of Personal Information is not feasible, the
Contractor shall notify the County according, specifying the reason, and continue to extend the
protections of this Exhibit F to all such Personal Information and copies of Personal Information. The
Contractor shall not retain any copy of any Personal Information after returning or disposing of
Personal Information as required by this section 6. The Contractor's obligations under this section 6
survive the termination of this Agreement and apply to all Personal Information that the Contractor
retains if return or disposal is not feasible and to all Personal Information that the Contractor may later
discover.
7. Equitable Relief. The Contractor acknowledges that any breach of its covenants or obligations set
forth in this Exhibit F may cause the County irreparable harm for which monetary damages would not
be adequate compensation and agrees that, in the event of such breach or threatened breach, the
County is entitled to seek equitable relief, including a restraining order, injunctive relief, specific
performance and any other relief that may be available from any court, in addition to any other remedy
to which the County may be entitled at law or in equity. Such remedies shall not be deemed to be
exclusive but shall be in addition to all other remedies available to the County at law or in equity or
under this Agreement.
8. Indemnity. The Contractor shall defend, indemnify and hold harmless the County, its officers,
employees, and agents, (each, a "County Indemnitee") from and against any and all infringement of
intellectual property including, but not limited to infringement of copyright, trademark, and trade dress,
invasion of privacy, information theft, and extortion, unauthorized Use, Disclosure, or modification of,
or any loss or destruction of, or any corruption of or damage to, Personal Information, Security Breach
response and remedy costs, credit monitoring expenses, forfeitures, losses, damages, liabilities,
deficiencies, actions, judgments, interest, awards, fines and penalties (including regulatory fines and
penalties), costs or expenses of whatever kind, including attorneys' fees and costs, the cost of
enforcing any right to indemnification or defense under this Exhibit F and the cost of pursuing any
insurance providers, arising out of or resulting from any third party claim or action against any County
Indemnitee in relation to the Contractor's, its officers, employees, or agents, or any Authorized
Employee's or Authorized Person's, performance or failure to perform under this Exhibit F or arising
out of or resulting from the Contractor's failure to comply with any of its obligations under this section
8. The provisions of this section 8 do not apply to the acts or omissions of the County. The provisions
of this section 8 are cumulative to any other obligation of the Contractor to, defend, indemnify, or hold
harmless any County Indemnitee under this Agreement. The provisions of this section 8 shall survive
the termination of this Agreement.
9. Survival. The respective rights and obligations of the Contractor and the County as stated in this
Exhibit F shall survive the termination of this Agreement.
10. No Third Party Beneficiary. Nothing express or implied in the provisions of in this Exhibit F is
intended to confer, nor shall anything in this Exhibit F confer, upon any person other than the County
or the Contractor and their respective successors or assignees, any rights, remedies, obligations or
liabilities whatsoever.
F-8
Exhibit F
Data Security
11. No County Warranty. The County does not make any warranty or representation whether any
Personal Information in the Contractor's (or any Authorized Person's) possession or control, or Use by
the Contractor (or any Authorized Person), pursuant to the terms of this Agreement is or will be secure
from unauthorized Use, or a Security Breach or Privacy Practices Complaint.
F-9