HomeMy WebLinkAboutAgreement A-24-442 with National University.pdf Agreement No. 24-442
1 SERVICE AGREEMENT
2 This Practicum Site Agreement ("Agreement") is dated August 20, 2024 and is
3 between National University, a California non-profit, public benefit corporation ("University"), and
4 the County of Fresno, a political subdivision of the State of California ("County").
5 Recitals
6 A. University is an independent institution of higher education accredited by the Western
7 Association of Schools and Colleges Senior College and University Commission ("WSCUC"),
8 and University is authorized to offer, among other academic programs, a Master of Arts in
9 Counseling Psychology program (the "Program"). University requires facilities to provide clinical
10 and field experience for required learning experiences for its students.
11 B. County, through its Department of Behavioral Health (DBH), maintains and operates
12 facilities suitable for furnishing such clinical and field experience.
13 C. It is to the mutual benefit of the parties that personnel and students of the University use
14 such facilities of the County for their clinical and field experience.
15 The parties therefore agree as follows:
16 Article 1
17 University's Responsibilities
18 1.1 Scope of Services. The University shall perform all of the services provided in
19 Exhibit A to this Agreement, titled "Scope of Services."
20 1.2 Representation. The University represents that it is qualified, ready, willing, and
21 able to enter into this Agreement.
22 1.3 Compliance with Laws. The University shall, at its own cost, comply with all
23 applicable federal, state, and local laws and regulations in the performance of its obligations
24 under this Agreement, including but not limited to workers compensation, and confidentiality
25 laws and regulations.
26
27
28
1
1 Article 2
2 County's Responsibilities
3 2.1 The County shall permit each student who is designated by University, pursuant to
4 Exhibit A of this Agreement, to receive clinical and field experience at appropriate County
5 facilities at an agreed number of hours, as mutually determined by University and County, and
6 shall furnish and permit students and/or instructors free access to appropriate County facilities
7 for such clinical and field experience, subject to the terms and conditions of this Agreement.
8 2.2 County shall furnish the appropriate facilities, on a rotational basis, in such a manner
9 that there will be no conflict in the use thereof between University's students and those from
10 other educational institutions, if any.
11 2.3 County shall, subject to budgetary and operational concerns, maintain clinical and
12 field facilities used for the learning experience in a manner that shall at all times conform to the
13 requirements of University's clinical programs listed in the Recitals section of this Agreement.
14 2.4 County shall provide staff adequate in number and quality to provide safe and
15 continuous health care to patients involved in clinical and field learning programs.
16 2.5 County shall permit and encourage members of its resident staff and/or attending
17 medical staff to participate in the instructional phase of University's clinical and field experience
18 programs.
19 2.6 County shall permit its various program directors and other designated personnel to
20 attend meetings of University's faculty, or any committee thereof, to coordinate the clinical and
21 field experience programs provided for under this Agreement, and to designate lines of authority
22 and communication for coordination of relations between University instructors and County
23 personnel.
24 2.7 County shall provide an introductory orientation for University instructors and faculty
25 staff which shall provide an overview of County facilities, field and experience programs, and the
26 terms and conditions of student placement at County's facilities.
27 2.8 County shall notify University's instructors, in advance, of any change in its DBH
28 Director, or designee appointments.
2
1 2.9 County shall, within the limits of its resources, provide whatever equipment, supplies,
2 and assistance necessary of the care of County patients in the course of University's student
3 learning experience and consistent with County's plan of care.
4 2.10 County shall reserve the absolute right to review, authorize, and at its sole discretion,
5 deny access or admission by any student, instructor, and/or University representative into
6 County facilities.
7 2.11 County shall provide input into the evaluation conducted by University, of students'
8 skills and progress.
9 Article 3
10 Compensation, Invoices, and Payments
11 3.1 The clinical and field education programs conducted pursuant to the terms and
12 conditions of this Agreement shall be performed without the payment of any monetary
13 consideration by University or County, one to the other, or by or to any student participating in
14 said clinical training programs.
15 Article 4
16 Term of Agreement
17 4.1 Term. This Agreement is effective on August 20, 2024 and terminates on August 19,
18 2027 except as provided in section 4.2, "Extension," or Article 6, "Termination and Suspension,"
19 below.
20 4.2 Extension. The term of this Agreement may be extended for no more than two, one-
21 year periods only upon written approval of both parties at least 30 days before the first day of
22 the next one-year extension period. The Director of the Department of Behavioral Health or his
23 or her designee is authorized to sign the written approval on behalf of the County based on the
24 University's satisfactory performance. The extension of this Agreement by the County is not a
25 waiver or compromise of any default or breach of this Agreement by the University existing at
26 the time of the extension whether or not known to the County.
27
28
3
1 Article 5
2 Notices
3 5.1 Contact Information. The persons and their addresses having authority to give and
4 receive notices provided for or permitted under this Agreement include the following:
5
For the County:
6 Director, Department of Behavioral Health
County of Fresno
7 1925 E. Dakota Ave.
Fresno, CA 93726
8 DBHStaffDevelopment@fresnocountyca.gov
9 For the University:
Attn: Karen Whitney
10 EVP for Student Success Services & CFO
9388 Lightwave Ave.,
11 San Diego, CA 92123
With copy to:
12 MACtraining@nu.edu and legal@nu.edu
13
14 5.2 Change of Contact Information. Either party may change the information in section
15 5.1 by giving notice as provided in section 5.3.
16 5.3 Method of Delivery. Each notice between the County and the University provided
17 for or permitted under this Agreement must be in writing, state that it is a notice provided under
18 this Agreement, and be delivered either by personal service, by first-class United States mail, by
19 an overnight commercial courier service, by telephonic facsimile transmission, or by Portable
20 Document Format (PDF) document attached to an email.
21 (A) A notice delivered by personal service is effective upon service to the recipient.
22 (B) A notice delivered by first-class United States mail is effective three County
23 business days after deposit in the United States mail, postage prepaid, addressed to the
24 recipient.
25 (C)A notice delivered by an overnight commercial courier service is effective one
26 County business day after deposit with the overnight commercial courier service,
27 delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
28 the recipient.
4
1 (D)A notice delivered by telephonic facsimile transmission or by PDF document
2 attached to an email is effective when transmission to the recipient is completed (but, if
3 such transmission is completed outside of County business hours, then such delivery is
4 deemed to be effective at the next beginning of a County business day), provided that
5 the sender maintains a machine record of the completed transmission.
6 5.4 Claims Presentation. For all claims arising from or related to this Agreement,
7 nothing in this Agreement establishes, waives, or modifies any claims presentation
8 requirements or procedures provided by law, including the Government Claims Act (Division 3.6
9 of Title 1 of the Government Code, beginning with section 810).
10 Article 6
11 Termination and Suspension
12 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
13 contingent on the approval of funds by the appropriating government agency. If sufficient funds
14 are not allocated, then the County, upon at least 30 days' advance written notice to the
15 University, may:
16 (A) Modify the services provided by the University under this Agreement; or
17 (B) Terminate this Agreement.
18 6.2 Termination for Breach.
19 (A) Upon determining that a breach (as defined in paragraph (C) below) has
20 occurred, the County may give written notice of the breach to the University. The written
21 notice may suspend performance under this Agreement, and must provide at least 30
22 days for the University to cure the breach.
23 (B) If the University fails to cure the breach to the County's satisfaction within the
24 time stated in the written notice, the County may terminate this Agreement immediately.
25 (C) For purposes of this section, a breach occurs when, in the determination of the
26 County, the University has:
27 (1) Obtained or used funds illegally or improperly;
28 (2) Failed to comply with any part of this Agreement;
5
1 (3) Submitted a substantially incorrect or incomplete report to the County; or
2 (4) Improperly performed any of its obligations under this Agreement.
3 6.3 Termination without Cause. In circumstances other than those set forth above,
4 either party may terminate this Agreement by giving at least 30 days advance written notice to
5 the other party.
6 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
7 under this Article 6 is without penalty to or further obligation of the County.
8 6.5 County's Rights upon Termination. Upon termination for breach under this Article
9 6, the County may demand repayment by the University of any monies disbursed to the
10 University under this Agreement that, in the County's sole judgment, were not expended in
11 compliance with this Agreement. The University shall promptly refund all such monies upon
12 demand. This section survives the termination of this Agreement.
13 Article 7
14 Independent Contractor
15 7.1 Status. In performing under this Agreement, the University, including its officers,
16 agents, employees, students, and volunteers, are not an officer, agent, servant, employee, joint
17 venturer, partner, or associate of the County.
18 7.2 Verifying Performance. The County has no right to control, supervise, or direct the
19 manner or method of the University's performance under this Agreement, but the County may
20 verify that the University is performing according to the terms of this Agreement.
21 7.3 Benefits. The University, including its officers, agents, students, and volunteers have
22 no right to employment rights or benefits available to County employees. The University is solely
23 responsible for providing to its own employees all employee benefits required by law. The
24 University shall save the County harmless from all matters relating to the payment of
25 University's employees, including compliance with Social Security withholding and all related
26 regulations.
27 7.4 Services to Others. The parties acknowledge that, during the term of this
28 Agreement, the University may provide services to others unrelated to the County.
6
1 Article 8
2 Indemnity and Defense
3 8.1 Indemnity. The University shall indemnify and hold harmless and defend the County
4 (including its officers, agents, employees, and volunteers) against all claims, demands, injuries,
5 damages, costs, expenses (including attorney fees and costs), fines, penalties, and liabilities of
6 any kind to the County, the University, or any third party that arise from or relate to the
7 performance or failure to perform by the University (or any of its officers, agents, subcontractors,
8 or employees) under this Agreement. The County may conduct or participate in its own defense
9 without affecting the University's obligation to indemnify and hold harmless or defend the
10 County.
11 8.2 Survival. This Article 8 survives the termination of this Agreement.
12 Article 9
13 Insurance
14 9.1 The University shall comply with all the insurance requirements in Exhibit C to this
15 Agreement.
16 9.2 Interns shall be covered under the University's Workers Compensation insurance.
17 Interns shall be deemed members of the County's workforce for the purposes of the Health
18 Insurance Portability and Accountability Act (HIPAA).
19 Article 10
20 Federal and State Laws
21 10.1 Health Insurance Portability and Accountability Act. County and Contractor(s)
22 each consider and represent themselves as covered entities as defined by the U.S. Health
23 Insurance Portability and Accountability Act of 1996, Public Law 104-191(HIPAA) and agree to
24 use and disclose Protected Health Information (PHI) as required by law.
25 County and Contractor(s) acknowledge that the exchange of PHI between them is only
26 for treatment, payment, and health care operations.
27 County and Contractor(s) intend to protect the privacy and provide for the security of PHI
28 pursuant to the Agreement in compliance with HIPAA, the Health Information Technology for
7
1 Economic and Clinical Health Act, Public Law 111-005 (HITECH), and regulations promulgated
2 thereunder by the U.S. Department of Health and Human Services (HIPAA Regulations) and
3 other applicable laws.
4 As part of the HIPAA Regulations, the Privacy Rule and the Security Rule require
5 Contractor(s) to enter into a agreement containing specific requirements prior to the disclosure
6 of PHI, as set forth in, but not limited to, Title 45, Sections 164.314(a), 164.502(e) and
7 164.504(e) of the Code of Federal Regulations. The parties agree to the requirements in Exhibit
8 D to this Agreement.
9 10.2 Physical Accessibility. In accordance with the accessibility requirements of section
10 508 of the Rehabilitation Act and the Americans with Disabilities Act of 1973, Contractor(s) must
11 provide physical access, reasonable accommodations, and accessible equipment for Medi-Cal
12 beneficiaries with physical or mental disabilities.
13 10.3 FERPA. No agent, employee, or representative of County shall have access to or
14 have the right to review any Practicum Student records. In addition to the confidentiality of client
15 information, County shall cooperate in good faith with University to assure that the confidentiality
16 of Practicum Student information is maintained consistent with the requirements of the Family
17 Educational Rights and Privacy Act of 1994 ("FERPA") and other applicable laws and statutes.
18 Article 11
19 Data Security
20 11.1 Data Security Requirements. Contractor(s) shall comply with data security
21 requirements in Exhibit E to this Agreement.
22 Article 12
23 Inspections, Audits, and Public Records
24 12.1 Public Records. The County is not limited in any manner with respect to its public
25 disclosure of this Agreement or any record or data that the University may provide to the
26 County. The County's public disclosure of this Agreement or any record or data that the
27 University may provide to the County may include but is not limited to the following:
28
8
1 (A) The County may voluntarily, or upon request by any member of the public or
2 governmental agency, disclose this Agreement to the public or such governmental
3 agency.
4 (B) The County may voluntarily, or upon request by any member of the public or
5 governmental agency, disclose to the public or such governmental agency any record or
6 data that the University may provide to the County, unless such disclosure is prohibited
7 by applicable law or court order.
8 (C) This Agreement, and any record or data that the University may provide to the
9 County, is subject to public disclosure under the Ralph M. Brown Act (California
10 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
11 (D) This Agreement, and any record or data that the University may provide to the
12 County, to the extent legally permissible, is subject to public disclosure as a public
13 record under the California Public Records Act (California Government Code, Title 1,
14 Division 7, Chapter 3.5, beginning with section 6250) ("CPRA").
15 (E) This Agreement, and any record or data that the University may provide to the
16 County, to the extent legally permissible, is subject to public disclosure as information
17 concerning the conduct of the people's business of the State of California under
18 California Constitution, Article 1, section 3, subdivision (b).
19 (F) Any marking of confidentiality or restricted access upon or otherwise made with
20 respect to any record or data that the University may provide to the County shall be
21 disregarded and have no effect on the County's right or duty to disclose to the public or
22 governmental agency any such record or data.
23 12.2 Public Records Act Requests. If the County receives a written or oral request
24 under the CPRA to publicly disclose any record that is in the University's possession or control,
25 and which the County has a right, under any provision of this Agreement or applicable law, to
26 possess or control, then the County may demand, in writing, that the University deliver to the
27 County, for purposes of public disclosure, the requested records that may be in the possession
28 or control of the University. Within five business days after the County's demand, the University
9
1 shall (a) deliver to the County all of the requested records that are in the University's possession
2 or control, together with a written statement that the University, after conducting a diligent
3 search, has produced all requested records that are in the University's possession or control, or
4 (b) provide to the County a written statement that the University, after conducting a diligent
5 search, does not possess or control any of the requested records. The University shall
6 cooperate with the County with respect to any County demand for such records. If the University
7 wishes to assert that any specific record or data is exempt from disclosure under the CPRA or
8 other applicable law, it must deliver the record or data to the County and assert the exemption
9 by citation to specific legal authority within the written statement that it provides to the County
10 under this section. The University's assertion of any exemption from disclosure is not binding on
11 the County, but the County will give at least 10 days' advance written notice to the University
12 before disclosing any record subject to the University's assertion of exemption from disclosure.
13 The University shall indemnify the County for any court-ordered award of costs or attorney's
14 fees under the CPRA that results from the University's delay, claim of exemption, failure to
15 produce any such records, or failure to cooperate with the County with respect to any County
16 demand for any such records.
17 Article 13
18 Disclosure of Self-Dealing Transactions
19 13.1 Applicability. This Article 11 applies if the University is operating as a corporation,
20 or changes its status to operate as a corporation.
21 13.2 Duty to Disclose. If any member of the University's board of directors is party to a
22 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
23 "Self-Dealing Transaction Disclosure Form" (Exhibit B to this Agreement) and submitting it to the
24 County before commencing the transaction or immediately after.
25 13.3 Definition. "Self-dealing transaction" means a transaction to which the University is
26 a party and in which one or more of its directors, as an individual, has a material financial
27 interest.
28
10
1 Article 14
2 General Terms
3 14.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
4 Agreement may not be modified, and no waiver is effective, except by written agreement signed
5 by both parties. The University acknowledges that County employees have no authority to
6 modify this Agreement except as expressly provided in this Agreement.
7 14.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
8 under this Agreement without the prior written consent of the other party.
9 14.3 Governing Law. The laws of the State of California govern all matters arising from
10 or related to this Agreement.
11 14.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
12 County, California. University consents to California jurisdiction for actions arising from or
13 related to this Agreement, and, subject to the Government Claims Act, all such actions must be
14 brought and maintained in Fresno County.
15 14.5 Construction. The final form of this Agreement is the result of the parties' combined
16 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
17 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
18 against either party.
19 14.6 Days. Unless otherwise specified, "days" means calendar days.
20 14.7 Headings. The headings and section titles in this Agreement are for convenience
21 only and are not part of this Agreement.
22 14.8 Severability. If anything in this Agreement is found by a court of competent
23 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
24 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
25 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
26 intent.
27 14.9 Nondiscrimination. During the performance of this Agreement, the University shall
28 not unlawfully discriminate against any employee or applicant for employment, or recipient of
11
1 services, because of race, religious creed, color, national origin, ancestry, physical disability,
2 mental disability, medical condition, genetic information, marital status, sex, gender, gender
3 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
4 all applicable State of California and federal statutes and regulation.
5 14.10 Title IX. University strictly adheres to Title IX of the Education Amendments of 1972,
6 the federal Campus Sexual Violence Elimination Act; United States Department of Education
7 regulations and directives; and the University's sexual harassment policy and procedures
8 (collectively, "Regulations"). The Regulations prohibit unequal treatment on the basis of
9 sex/gender as well as sexual harassment, misconduct and violence. The County agrees to
10 support the University's investigations and reporting to the extent possible, should an
11 investigation be necessary.
12 14.11 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
13 of the University under this Agreement on any one or more occasions is not a waiver of
14 performance of any continuing or other obligation of the University and does not prohibit
15 enforcement by the County of any obligation on any other occasion.
16 14.12 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
17 between the University and the County with respect to the subject matter of this Agreement, and
18 it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
19 publications, and understandings of any nature unless those things are expressly included in
20 this Agreement. If there is any inconsistency between the terms of this Agreement without its
21 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
22 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
23 exhibits.
24 14.13 No Third-Party Beneficiaries. This Agreement does not and is not intended to
25 create any rights or obligations for any person or entity except for the parties.
26 14.14 Authorized Signature. The University represents and warrants to the County that:
27 (A) The University is duly authorized and empowered to sign and perform its
28 obligations under this Agreement.
12
1 (B) The individual signing this Agreement on behalf of the University is duly
2 authorized to do so and his or her signature on this Agreement legally binds the
3 University to the terms of this Agreement.
4 14.15 Electronic Signatures. The parties agree that this Agreement may be executed by
5 electronic signature as provided in this section.
6 (A) An "electronic signature" means any symbol or process intended by an individual
7 signing this Agreement to represent their signature, including but not limited to (1) a
8 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
9 electronically scanned and transmitted (for example by PDF document) version of an
10 original handwritten signature.
11 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
12 equivalent to a valid original handwritten signature of the person signing this Agreement
13 for all purposes, including but not limited to evidentiary proof in any administrative or
14 judicial proceeding, and (2) has the same force and effect as the valid original
15 handwritten signature of that person.
16 (C) The provisions of this section satisfy the requirements of Civil Code section
17 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
18 Part 2, Title 2.5, beginning with section 1633.1).
19 (D) Each party using a digital signature represents that it has undertaken and
20 satisfied the requirements of Government Code section 16.5, subdivision (a),
21 paragraphs (1) through (5), and agrees that each other party may rely upon that
22 representation.
23 (E) This Agreement is not conditioned upon the parties conducting the transactions
24 under it by electronic means and either party may sign this Agreement with an original
25 handwritten signature.
26 14.16 Counterparts. This Agreement may be signed in counterparts, each of which is an
27 original, and all of which together constitute this Agreement.
28 [SIGNATURE PAGE FOLLOWS]
13
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
National University County of Fresno
3
4 %wrt e �d2
5 Timothy Plord, MA, LMFT Nathan Magsig, Chairman of the Board of
Associate Dean of Professional Training and Supervisors of the County of Fresno
6 Academic Operations
Attest:
7 Bernice E. Seidel
Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By: �i -
10 beputy
11 For accounting use only:
12 Org No.: 56304756
Account No.: 7295
13 Fund No.: 0001
Subclass No.: 10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
14
Exhibit A
1 University's Responsibilities
2 A.1 County's DBH Director, or designee, shall have sole authority as to how many
3 placements for internships shall be made available to University during each term of this
4 Agreement.
5 A.2 University recognizes that the clinical and field education programs conducted
6 pursuant to the terms and conditions of this Agreement are educational programs of University
7 and not of County, and that students participating in University's programs shall at all times be
8 under the exclusive jurisdiction of University.
9 A.3 University shall designate students enrolled in the various educational training
10 programs of University to be assigned for clinical and field experience at County facilities, in
11 such numbers to be mutually agreed upon by both County and University.
12 A.4 University shall establish a plan for the learning experience available at County
13 facilities and shall schedule the students in conformity with the calendar of University's
14 academic year and with the curriculum of the educational programs of University; provided,
15 however, that the specific County patient care areas to be utilized by University shall be
16 selected subsequently by the mutual agreement between County's DBH Director, or designee,
17 and University's chairperson(s) or duly authorized representative(s) of the various
18 departments/programs listed in the Recitals section herein above.
19 A.5 University shall supervise all instruction of the clinical and field experience given at
20 County facilities to assigned students and shall provide the necessary instructors for educational
21 training programs provided for under this Agreement.
22 A.6 University shall keep all attendance and academic records of students participating
23 in the clinical and field experience programs provided for under this Agreement.
24 A.7 University shall ensure students act professionally and appropriately while at County
25 facilities.
26 A.8 University shall require every student to confirm to all applicable County policies,
27 procedures, regulations, and all requirements and restrictions specified jointly by
28 representatives of University and County.
A-1
Exhibit A
1 A.9 University shall require its instructors to notify County's DBH Director or designee, as
2 appropriate in advance of student placement regarding:
3 (A) Locations, dates, times, and the number of hours or changes thereof, regarding
4 student availability for clinical or field assignment; and
5 (B) Any change in the placement of students in clinical and field assignments.
6 A.10 University shall, in consultation and coordination with County's DBH Director, or
7 designee, arrange for periodic conferences between appropriate representatives of University
8 and County to evaluate the clinical and field experience programs provided under this
9 Agreement.
10 A.11 University shall provide and be responsible for the use and control of its educational
11 supplies, materials, and equipment used for instruction during the clinical and field experience
12 programs.
13 A.12 University agrees that special reports, projects, theses, and/or publications based
14 upon studies and research arising out of the cooperative education experience permitted by this
15 Agreement, shall be reviewed and approved prior to release through the committee responsible
16 for planning the course and then with County's DBH Director, or designee, as appropriate, for
17 approval by means of such procedures as County shall designate. Approval of reports by
18 University's planning committee and County's DBH shall not be unreasonably withheld.
19 A.13 University agrees to complete an evaluation of each student at least once during a
20 specific program period.
21 A.14 University shall allow County program managers and other designated personnel to
22 attend meetings of University's faculty, or any committee thereof, to coordinate the clinical and
23 field experience programs provided under this Agreement and to designate lines of authority
24 and community for coordination of relations between County personnel and University
25 instructors.
26 A.15 University's employees, agents, and students shall abide by the provisions of State
27 of California law relating to confidentiality of medical records, further described in Exhibit D of
28
A-2
Exhibit A
1 this Agreement, and any person knowingly and intentionally violating the provisions of State of
2 California law may be guilty of a misdemeanor.
3 A.16 University's employees, agents, and students shall be issued County identification
4 badges which must be worn only at County facilities while participating in the clinical and field
5 experience programs, pursuant to the terms and conditions of this Agreement.
6 A.17 University will ensure each participating student referred for program is aware of the
7 need for adequate transportation. Students will not be permitted to operate County vehicles to
8 perform activities related to this Agreement.
9 A.18 University's students shall purchase food or bring food with them; no special
10 arrangements for food will be made.
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
A-3
Exhibit B
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
B-1
Exhibit B
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
B-2
Exhibit C
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the University or any third
parties, University, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence and an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
Coverage must include products, completed operations, property damage, bodily injury,
personal injury, and advertising injury. The University shall obtain an endorsement to this
policy naming the County of Fresno, its officers, agents, employees, and volunteers,
individually and collectively, as additional insureds, but only insofar as the operations
under this Agreement are concerned. Such coverage for additional insureds will apply as
primary insurance and any other insurance, or self-insurance, maintained by the County
is excess only and not contributing with insurance provided under the University's policy.
(B) Automobile Liability. Automobile liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages.
Coverage must include any auto used in connection with this Agreement.
(C)Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(D) Employer's Liability. Employer's liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for disease.
(E) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1) the retroactive date must
be prior to the date on which services began under this Agreement; (2) the University
shall maintain the policy and provide to the County annual evidence of insurance for not
less than five years after completion of services under this Agreement; and (3) if the
policy is canceled or not renewed, and not replaced with another claims-made policy
with a retroactive date prior to the date on which services begin under this Agreement,
then the University shall purchase extended reporting coverage on its claims-made
policy for a minimum of five years after completion of services under this Agreement.
a. University shall ensure that each student who participates in County's "covered
functions" (as defined by HIPAA regulations at 45 C.F.R. §164.501) procures and
maintains in force during the term of this Agreement, at the student's sole cost
and expense, Professional Liability Insurance in amounts reasonably necessary
to protect the student against liability arising form any and all negligent acts or
incidents caused by the student. Coverage under such professional liability
insurance shall not be less than One Million Dollars ($1,000,000) per occurrence,
Three Million Dollars ($3,000,000) annual aggregate. This policy shall include
Limited General Liability coverage for sexual harassment and abuse, standards
C-1
Exhibit C
of care, property damage, bodily injury, and personal injury within the stated
limits.
(F) Molestation Liability. Sexual abuse/ molestation liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence, with an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
(G)Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data) that is in the care, custody, or control of the Contractor.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) breach of any of the Contractor's obligations under [identify
the Article, section, or exhibit containing data security obligations] of this Agreement; (iv)
system failure; (v) data recovery; (vi) failure to timely disclose data breach or Security
Breach; (vii)failure to comply with privacy policy; (viii) payment card liabilities and costs;
(ix) infringement of intellectual property, including but not limited to infringement of
copyright, trademark, and trade dress; (x) invasion of privacy, including release of
private information; (xi) information theft; (xii) damage to or destruction or alteration of
electronic information; (xiii) cyber extortion; (xiv) extortion related to the Contractor's
obligations under this Agreement regarding electronic information, including Personal
Information; (xv) fraudulent instruction; (xvi) funds transfer fraud; (xvii) telephone fraud;
(xviii) network security; (xix) data breach response costs, including Security Breach
response costs; (xx) regulatory fines and penalties related to the Contractor's obligations
under this Agreement regarding electronic information, including Personal Information;
and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the University signs this Agreement, and
at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the University shall deliver, or cause its
broker or producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th
Floor, Fresno, California 93721, or HRRiskManagement@fresnocountyca.gov, and by
mail or email to the person identified to receive notices under this Agreement,
certificates of insurance and endorsements for all of the coverages required under this
Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; (2) the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
University has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
C-2
Exhibit C
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
University's policy.
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VII.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the University shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the University shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the University shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the University or its insurer to timely provide a written notice required by
this paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the University has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the University shall deliver, or cause its broker or producer to
deliver, to the County's Risk Manager certificates of insurance and endorsements for all
of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The University waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The University is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the University's waiver of subrogation under this paragraph is effective
whether or not the University obtains such an endorsement.
(F) County's Remedy for University's Failure to Maintain. If the University fails to keep in
effect at all times any insurance coverage required under this Agreement, the County
C-3
Exhibit C
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the University. The County may offset such
charges against any amounts owed by the County to the University under this
Agreement.
(G)Subcontractors. The University shall require and verify that all subcontractors used by
the University to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the University to provide services under this Agreement using subcontractors.
C-4
Exhibit D
Health Insurance Portability and Accountability Act (HIPAA)
1. The County is a "Covered Entity," and the University is a "Business
Associate," as these terms are defined by 45 CFR 160.103. In connection with providing services
under the Agreement, the parties anticipate that the University will create and/or receive Protected
Health Information ("PHI")from or on behalf of the County. The parties enter into this Business
Associate Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to
govern the use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the
Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
The parties to this Agreement shall be in strict conformance with all applicable
federal and State of California laws and regulations, including, but not limited to California Welfare
and Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431;
California Civil Code section 56 et seq.; the Health Insurance Portability and Accountability Act of
1996, as amended ("HIPAA"), including, but not limited to, 45 CFR Parts160, 45 CFR 162, and 45
CFR 164; the Health Information Technology for Economic and Clinical Health Act ("HITECH")
regarding the confidentiality and security of patient information, including, but not limited to 42 USC
17901 et seq.; and the Genetic Information Nondiscrimination Act ("GINA") of 2008 regarding the
confidentiality of genetic information.
Except as otherwise provided in this Agreement, the University, as a business
associate of the County, may use or disclose Protected Health Information ("PHI") to perform
functions, activities or services for or on behalf of the County, as specified in this Agreement,
provided that such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of
PHI may not be more expansive than those applicable to the County, as the "Covered Entity"
under the HIPAA Rules, except as authorized for management, administrative or legal
responsibilities of the University.
2. The University, including its subcontractors, students, and employees, shall
protect from unauthorized access, use, or disclosure of names and other identifying information,
including genetic information, concerning persons receiving services pursuant to this Agreement,
except where permitted in order to carry out data aggregation purposes for health care operations
D-1
Exhibit D
[45 CFR §§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all
persons receiving services pursuant to a County-funded program. This requirement applies to
electronic PHI. The University shall not use such identifying information or genetic information for
any purpose other than carrying out the University's obligations under this Agreement.
3. The University, including its subcontractors, students, and employees, shall
not disclose any such identifying information or genetic information to any person or entity, except
as otherwise specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164
or other law, required by the Secretary of the United States Department of Health and Human
Services ("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that
is permitted by this Agreement or authorized by law, the University shall make reasonable efforts to
limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request.
4. For purposes of the above sections, identifying information shall include, but
not be limited to, name, identifying number, symbol, or other identifying particular assigned to the
individual, such as fingerprint or voiceprint, or photograph.
5. For purposes of the above sections, genetic information shall include
genetic tests of family members of an individual or individual(s), manifestation of disease or
disorder of family members of an individual, or any request for or receipt of genetic services by
individual or family members. Family member means a dependent or any person who is first,
second, third, or fourth degree relative.
6. The University shall provide access, at the request of the County, and in the
time and manner designated by the County, to PHI in a designated record set (as defined in 45
CFR§ 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR §
164.524 regarding access by individuals to their PHI. With respect to individual requests, access
shall be provided within thirty (30)days from request. Access may be extended if the University
cannot provide access and provides the individual with the reasons for the delay and the date
when access may be granted. PHI shall be provided in the form and format requested by the
individual or the County.
The University shall make any amendment(s) to PHI in a designated record set
D-2
Exhibit D
at the request of the County or individual, and in the time and manner designated by the County
in accordance with 45 CFR § 164.526.
The University shall provide to the County or to an individual, in a time and
manner designated by the County, information collected in accordance with 45 CFR § 164.528,
to permit the County to respond to a request by the individual for an accounting of disclosures of
PHI in accordance with 45 CFR § 164.528.
7. The University shall report to the County, in writing, any knowledge or reasonable
belief that there has been unauthorized access, viewing, use, disclosure, security incident, or
breach of unsecured PHI not permitted by this Agreement of which the University becomes
aware, immediately and without reasonable delay and in no case later than two (2) business
days of discovery. Immediate notification shall be made to the County's Information Security
Officer and Privacy Officer and the County's Department of Public Health ("DPH") HIPAA
Representative, within two (2) business days of discovery. The notification shall include, to the
extent possible, the identification of each individual whose unsecured PHI has been, or is
reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
University shall take prompt corrective action to cure any deficiencies and any action pertaining
to such unauthorized disclosure required by applicable federal and State laws and regulations.
The University shall investigate such breach and is responsible for all notifications required by
law and regulation or deemed necessary by the County and shall provide a written report of the
investigation and reporting required to the County's Information Security Officer and Privacy
Officer and the County's DPH HIPAA Representative.
This written investigation and description of any reporting necessary shall be
postmarked within the thirty (30) working days of the discovery of the breach to the addresses
below:
County of Fresno County of Fresno County of Fresno
Dept. of Behavioral Health Dept. of Public Health Dept. of Internal Services
HIPAA Representative Privacy Officer Information Security Officer
(559) 600-6798 (559) 600-6405 (559) 600-5800
1925 E. Dakota Ave P.O. Box 11867 2048 North Fine Street
Fresno, California 93726 Fresno, California 93775 Fresno, California 93727
8. The University shall make its internal practices, books, and records relating to the
D-3
Exhibit D
use and disclosure of PHI if any received from the county, or created or received by the
University on behalf of the County, in compliance with Parts the HIPAA Rules. The University
shall make its internal practices, books, and records relating to the use and disclosure of PHI
received from the County, or created or received by the University on behalf of the County,
available to the Secretary upon demand.
The University shall cooperate with the compliance and investigation reviews
conducted by the Secretary. PHI access to the Secretary must be provided during the
University's normal business hours; however, upon exigent circumstances access at any time
must be granted. Upon the Secretary's compliance or investigation review, if PHI is unavailable
to the University and in possession of a subcontractor of the University, the University must
certify to the Secretary its efforts to obtain the information from the subcontractor.
9. Safeguards
The University shall implement administrative, physical, and technical safeguards
as required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
this Agreement. The University shall conduct an accurate and thorough assessment of the
potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI.
The University shall develop and maintain a written information privacy and security program
that includes administrative, technical and physical safeguards appropriate to the size and
complexity of the University's operations and the nature and scope of its activities. Upon the
County's request, the University shall provide the County with information concerning such
safeguards.
The University shall implement strong access controls and other security
safeguards and precautions in order to restrict logical and physical access to confidential,
personal (e.g., PHI) or sensitive data to authorized users only. Said safeguards and
precautions shall include the following administrative and technical password controls for all
D-4
Exhibit D
systems used to process or store confidential, personal, or sensitive data:
A. Passwords must not be:
(1) Shared or written down where they are accessible or recognizable by anyone
else; such as taped to computer screens, stored under keyboards, or visible
in a work area;
(2) A dictionary word; or
(3) Stored in clear text
B. Passwords must be:
(1) Eight (8) characters or more in length;
(2) Changed every ninety (90) days;
(3) Changed immediately if revealed or compromised; and
(4) Composed of characters from at least three (3) of the following four (4)
groups from the standard keyboard:
a) Upper case letters (A-Z);
b) Lowercase letters (a-z);
c) Arabic numerals (0 through 9); and
d) Non-alphanumeric characters (punctuation symbols).
The University shall implement the following security controls on each
workstation or portable computing device (e.g., laptop computer) containing confidential,
personal, or sensitive data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
3. Patch management process including installation of all operating system/software
vendor security patches.
The University shall utilize a commercial encryption solution that has received
FIPS 140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
electronic media (including, but not limited to, compact disks and thumb drives) and on portable
computing devices (including, but not limited to, laptop and notebook computers).
D-5
Exhibit D
The University shall not transmit confidential, personal, or sensitive data via e-
mail or other internet transport protocol unless the data is encrypted by a solution that has been
validated by the National Institute of Standards and Technology (NIST) as conforming to the
Advanced Encryption Standard (AES)Algorithm. The University must apply appropriate
sanctions against its employees who fail to comply with these safeguards. The University must
adopt procedures for terminating access to PHI when employment of employee ends.
10. Mitigation of Harmful Effects
The University shall mitigate, to the extent practicable, any harmful effect that is
suspected or known to the University of an unauthorized access, viewing, use, disclosure, or
breach of PHI by the University or its subcontractors in violation of the requirements of these
provisions. The University must document suspected or known harmful effects and the
outcome.
11. The University's Subcontractors
The University shall ensure that any of its contractors, including subcontractors, if
applicable, to whom the Contractor provides PHI received from or created or received by the
University on behalf of the County, agree to the same restrictions, safeguards, and conditions
that apply to the University with respect to such PHI and to incorporate, when applicable, the
relevant provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
Nothing in this section 11 or this BAA authorizes the University to perform
services under this Agreement using subcontractors.
12. Employee Training and Discipline
The University shall train and use reasonable measures to ensure compliance
with the requirements of these provisions by employees who assist in the performance of
functions or activities on behalf of the County under this Agreement and use or disclose PHI,
and discipline such employees who intentionally violate any provisions of these provisions,
which may include termination of employment.
13. Termination for Cause
D-6
Exhibit D
Upon the County's knowledge of a material breach of these provisions by the
University, the County will either:
A. Provide an opportunity for the University to cure the breach or end the
violation, and the County may terminate this Agreement if the University does not cure the
breach or end the violation within the time specified by the County; or
B. Immediately terminate this Agreement if the University has breached a
material term of this BAA and cure is not possible, as determined by the County.
C. If neither cure nor termination is feasible, the County's Privacy Officer will
report the violation to the Secretary of the U.S. Department of Health and Human Services.
14. Judicial or Administrative Proceedings
The County may terminate this Agreement if: (1) the University is found guilty in
a criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act;
or (2) there is a finding or stipulation in an administrative or civil proceeding in which the
University is a party that the University has violated a privacy or security standard or
requirement of the HITECH Act, HIPAA or other security or privacy laws.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, the University
shall return or destroy all PHI received from the County (or created or received by the University
on behalf of the County) that the University still maintains in any form, and shall retain no copies
of such PHI. If return or destruction of PHI is not feasible, the University shall continue to
extend the protections of these provisions to such information, and limit further use of such PHI
to those purposes that make the return or destruction of such PHI infeasible. This provision
applies to PHI that is in the possession of subcontractors or agents, if applicable, of the
University. If the University destroys the PHI data, a certification of date and time of destruction
shall be provided to the County by the University.
16. Compliance with Other Laws
To the extent that other state and/or federal laws provide additional, stricter
and/or more protective privacy and/or security protections to PHI or other confidential
D-7
Exhibit D
information covered under this BAA, the University agrees to comply with the more protective of
the privacy and security standards set forth in the applicable state or federal laws to the extent
such standards provide a greater degree of protection and security than HIPAA Rules or are
otherwise more favorable to the individual.
17. Disclaimer
The County makes no warranty or representation that compliance by the
University with these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or
satisfactory for the University's own purposes or that any information in the University's
possession or control, or transmitted or received by the University, is or will be secure from
unauthorized access, viewing, use, disclosure, or breach. The University is solely responsible
for all decisions made by the University regarding the safeguarding of PHI.
18. Amendment
The parties acknowledge that Federal and State laws relating to electronic data
security and privacy are rapidly evolving and that amendment of this BAA may be required to
provide for procedures to ensure compliance with such developments. The parties specifically
agree to take such action as is necessary to amend this agreement in order to implement the
standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws
relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty
(30) days written notice in the event that the University does not enter into an amendment
providing assurances regarding the safeguarding of PHI that the County in its sole discretion,
deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the
HITECH Act.
19. No Third-Party Beneficiaries
Nothing expressed or implied in the provisions of this BAA is intended to confer,
and nothing in this BAA does confer, upon any person other than the County or the University
and their respective successors or assignees, any rights, remedies, obligations or liabilities
whatsoever.
20. Interpretation
D-8
Exhibit D
The provisions of this BAA shall be interpreted as broadly as necessary to
implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that
any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a
meaning that complies and is consistent with the HIPAA Rules.
21. Regulatory References
A reference in the terms and conditions of these provisions to a section in the
HIPAA Rules means the section as in effect or as amended.
22. Survival
The respective rights and obligations of the University as stated in this BAA
survive the termination or expiration of this Agreement.
23. No Waiver of Obligation
Change, waiver or discharge by the County of any liability or obligation of the
University under this BAA on any one or more occasions is not a waiver of performance of any
continuing or other obligation of the University and does not prohibit enforcement by the County
of any obligation on any other occasion.
D-9
Exhibit E
Data Security
For the purpose of preventing the potential loss, misappropriation or inadvertent access,
viewing, use or disclose of County data including sensitive or personal client information; abuse
of County resource; and/or disruption to County operations, individuals and/or agencies that
enter into a contractual relationship with the County for the purpose of providing services under
this Agreement must employ adequate data security measures to protect the confidential
information provided to University by the County, including but not limited to the following:
A. University-Owned Mobile, Wireless, or Handheld Devices
University may not connect to County networks via personally-owned mobile,
wireless, or handheld devices, unless the following conditions are met:
a. University has received authorization by County for telecommuting
purposes;
b. Current virus protection software is in place;
c. Mobile device has the remote wipe feature enabled; and
d. A secure connection is used.
B. University-owned Computer or Computer Peripherals
University may not bring University-owned computer or computer peripherals into
the County for use without prior authorization from the County's Chief Information
Officer, and/or designee(s), including but not limited to mobile storage devices. If
data is approved to be transferred, data must be stored on a secure server
approved by the County and transferred by means of a Virtual Private Network
(VPN) connection, or another type or secure connection. Said data must be
encrypted.
C. County-owned Computer Equipment
University, including its students, subcontractors, and employees, may not use
County computer or computer peripherals on non-County premises without prior
authorization from the County's Chief Information Officer, and/or designee(s).
E-1
Exhibit E
D. University may not store County's private, confidential, or sensitive data on any
hard-disk drive, portable storage device, or remote storage installation unless
encrypted.
E. University shall be responsible to employ strict controls to ensure the integrity
and security of County's confidential information and to prevent unauthorized
access, viewing, use or disclosure of data maintained in computer files, program
documentation, data processing systems, data files, and data processing
equipment which stores or processes County data internally and externally.
F. Confidential client information transmitted to one party by the other means of
electronic transmissions must be encrypted according to Advanced Encryption
Standards (AES) of 128 BIT or higher. Additionally, a password or pass phrase
must be utilized.
G. University is responsible to immediately notify County of any violations,
breaches, or potential breaches of security related to County's confidential
information, data maintained in computer files, program documentation, data
processing systems, data files, and data processing equipment which stores or
processing County data internally or externally.
H. County shall provide oversight to University's response to all incidents arising
from a possible breach of security related to County's confidential client
information provided to University. University will be responsible to issue any
notification to affected individuals as required by law or as deemed necessary by
County in its sole discretion. University will be responsible for all costs incurred
as a result of providing the required notification.
E-2