Loading...
HomeMy WebLinkAboutP-24-713 The Maddy Institute.pdf AGREEMENT NUMBER P-24-713 12/20/2024 ® The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership The Kenneth L. Maddy Institute—County Agreement for Experiential Education The Kenneth L. Maddy Institute at California State University, Fresno is committed to service in the community, and applied learning experiences for students. This is accomplished through field education, service-learning, internships, research, and other activities that integrate our students' academic study with practical experience. THIS AGREEMENT, made and entered into this 3rd day of December of 2024 is between The Kenneth L. Maddy Institute at California State University,Fresno,hereinafter called the"The Maddy Institute" and the County of Fresno, a political subdivision of the State of California, hereinafter called the "County." In consideration of the mutual promises set forth below, The Maddy Institute and County ("parties") agree as follows: I. County's Responsibilities A. Approve the placement of each student (also referred to herein as "intern") with the County before a student begins their assignment. During the term of this Agreement, The Maddy Institute and the County may agree to place one or more students with the County as student interns for one academic semester or quarter per student. The students shall be concurrently enrolled at California State University, Fresno. B. Identify the student's supervisor, who would: • meet with the student regularly to facilitate the student's learning experience, • provide support, • review progress on assigned tasks, • verify working hours, • give feedback and • be responsible for the safety and supervision of student while on site at the student's assigned County location. C. Provide the student an orientation that includes: • a site tour, • an introduction to staff relevant to the student's experiential learning activities, • a description of the characteristics of and risks associated with the County's operations, services and/or clients, • a discussion concerning safety policies and emergency procedures; and • information detailing where students check-in and how they log their time. D. Provide the student with a written description of the student's tasks and responsibilities. E. Subject to the limits of County resources,provide to the student the necessary equipment, supplies, and assistance, for the care of County's clients and customers, in the course of The Maddy Institute's interns' learning experience, and consistent with County's purpose. Notwithstanding anything else in this Agreement, the County has no obligation to provide free parking to any students or other persons connected with The Maddy Institute. County shall agree to allow access to existing dining room space for interns' break and meal periods. The Maddy Institute's interns `*5TA7fG4 � A C 3N, ii. The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726 Phone(559)278-1133 Fax(559)278-1167 yf RSF�y t4 - s www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 ® The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership shall be responsible for their own meals; no special arrangements for food will be made. The County shall reserve the absolute right to review, authorize, and in its sole discretion, deny access or admission by any student, or The Maddy Institute representative, into County facilities. F. Inform the student if there is a need for a background check, fingerprinting and/or a health screening test(such as a tuberculosis test); and if yes, obtain the student's fingerprints, background check and/or health screening test results; and maintain the confidentiality of any results as required by federal and state law. G. Evaluate the student if requested by The Maddy Institute and contact The Maddy Institute if the student fails to perform assigned tasks or engages in misconduct. H. Provide emergency first aid for any student who becomes sick or injured by conditions arising out of or in the course of said student's participation in the learning experience at the County, and provide prompt notification(within 24 hours) to The Maddy Institute. I. The County will notify The Maddy Institute contact listed in the specific student's Learning Plan Agreement as soon as possible of any unusual and/or uncontrolled health&safety hazards and/or incidents of violence that occur at the County during the term of the student's Learning Plan Agreement. The Maddy Institute facilitates the Learning Plan Agreement. J. The County reserves the right to dismiss a student for just cause, which may include dismissal of the student for noncompliance with the County's policies, procedures, or directions, or dismissal of a student for business necessity. The County shall provide notification of the termination as soon as practicably possible to The Maddy Institute contact listed in the specific student's Learning Agreement. II. The Maddy Institute's Responsibilities The Maddy Institute will ensure each student will: A. Participate in mandatory orientation with The Maddy Institute. B. Participate in all training required by the County. C. Exhibit professional, ethical, and appropriate behavior when at the County. D. Complete all assigned tasks and responsibilities in a timely and efficient manner. E. Abide by the County's rules and standards of conduct; and F. Maintain the confidentiality of the County's proprietary information, records,and information concerning its clients and customers. G. Abide by the provisions of State of California law relating to confidentiality of medical records, further described in Exhibit A of this Agreement, and any person knowingly and intentionally violating the provisions of State of California law may be guilty of a misdemeanor. H. Conform to all applicable County policies,procedures,regulations, and all requirements and restrictions specified jointly by representatives of The Maddy Institute and County. III. Number of Interns The County agrees to fund up to six (6) Maddy Institute student interns per semester to be placed exclusively in the County Administrative Office and/or the Board of Supervisors departments. �`*STA7fG� `�STAT�L ; The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726r�oY = Phone(559)278-1133 Fax(559)278-1167 �yf RSF��y t4 - S www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 ® The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership IV. Administration of Intern Program A. Recruitment and Placement: The Maddy Institute will recruit student interns and forward them to the County for their consideration for placement. B. Scholarship Amount: The scholarship stipend amount paid per semester for local students is the then current minimum hourly wage multiplied by 150 hours. C. Pam: The Maddy Institute will invoice the County for the current intern stipend amount for each intern placed. The County will pay the invoice no later than one (1) month before the expected end date of the internship, and Maddy Institute will pay each intern their respective stipends upon completion of their internship. D. Unpaid Amounts: Should the County send funds that are not paid out to a student(i.e. if the intern does not complete their internship and becomes ineligible for the stipend), Maddy Institute will either reimburse the County for said amount if requested to do so in writing within one (1) month of the completion of the academic semester or quarter or retain the payment for an intern serving in a future semester. V. Termination A. Non-Allocation of Funds - The terms of this Agreement, and the services to be provided thereunder, are contingent on the approval of funds by the appropriating government agency. Should sufficient funds not be allocated, the services provided may be modified, or this Agreement terminated at any time by giving The Maddy Institute (30) days advance written notice. B. Breach of Contract—The Maddy Institute or the County may immediately suspend or terminate this Agreement in whole or in part, where in the determination of the County that there is: i. A failure to comply with any term of this Agreement; ii. A substantially incorrect or incomplete report submitted to County. C. Without Cause -Under circumstances other than those set forth above, this Agreement may be terminated by The Maddy Institute or the County, upon the giving of three (3) months advance written notice of an intention to terminate. VI . Other Provisions A. Term: This Agreement will become effective as of the date last written below and continue for a period of 3 years and two 1 year optional renewals unless terminated pursuant to Section V. If the County terminates this Agreement, it will permit any student working at the County at the time of termination to complete his or her work,unless the student is dismissed pursuant to Section I.J. At the 5-year termination date this Agreement can be renewed once it has been reviewed,updated as applicable, and executed by the appropriate parties. B. The County and The Maddy Institute will meet upon request, or as necessary, to resolve any potential conflicts and to facilitate a mutually beneficial experience for all involved. C. The students participating in a learning activity at the County are not officers,employees,or agents of The Maddy Institute or the County. However, students shall be considered County volunteers and shall be included under the County's Workers Compensation program. The Maddy Institute (or any of its officers, agents, subcontractors, students, volunteers, interns, or employees), shall have absolutely no right to employment rights and benefits available to County employees. In The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726 Phone(559)278-1133 Fax(559)278-1167 �yf RSF��y t4 - s" - www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 ® The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership consideration of the benefits The Maddy Institute derives from this Agreement and subject to the provisions herein, The Maddy Institute shall not consider the interns to be employees of, or claim the interns are employees of, the County for the purposes of determining liability for any and all costs and expenses, including attorney fees and court costs, damages, liabilities, claims and losses occurring or resulting to The Maddy Institute or to any person, firm or corporation who may be injured or damaged by any act or failure to act,of any intern or person participating in or connected with the programs that are the subject of this Agreement. It is acknowledged that during the term of this Agreement, The Maddy Institute may be providing services to others unrelated to County or to this Agreement. D. Nothing contained in this Agreement confers on either parry the right to use the other parry's name without prior written permission, or constitutes an endorsement of any commercial product or service by either party. E. There shall be no monetary obligation on The Maddy Institute or the County, one to the other. All activities, resources and services provided by both parties shall be at no cost to the other. Any expenses incurred by either party in the performance, delivery, or execution of the terms of this Agreement shall be sole responsibility of the encumbering party. F. Neither the County nor the intern is bound by this agreement to offer or accept an intem's permanent employment with the County. The Maddy Institute placements are not intended to displace current full/part-time permanent employees of the County. G. The Maddy Institute shall at any time during business hours, and as often as County may deem necessary, make available to County for examination all of its records and data with respect to the matters covered by this Agreement. The Maddy Institute shall, upon request by County, permit County to audit and inspect all such records and data necessary to ensure The Maddy Institute compliance with the terms of this Agreement. H. Any matters of this Agreement may be modified from time to time by the written consent of all the parties without, in any way, affecting the remainder. I. Neither party shall assign, transfer, or subcontract this Agreement nor their rights or duties under this Agreement without the written consent of the other parry. J. The Maddy Institute agrees to indemnify, save,hold harmless, and at County's request, defend the County, its officers, agents and employees from any and all costs and expenses, including attorney fees and court costs, damages, liabilities, claims and losses occurring or resulting to County in connection with the performance,or failure to perform,by The Maddy Institute,its officers,agents, instructors, faculty, employees, students, and volunteers, under this Agreement and from any and all costs and expenses, including attorney fees and court costs, damages, liabilities, claims and losses occurring or resulting to any person, firm or corporation who may be injured or damaged by the performance, or failure to perform, of The Maddy Institute, its officers, agents, instructors, faculty, employees, students, and volunteers under this Agreement. The County may conduct or participate in its own defense without affecting The Maddy Institute's obligation to indemnify and hold harmless or defend the County. In addition, The Maddy Institute agrees to indemnify County for Federal, State of California and/or local audit exceptions resulting from noncompliance herein on the part of The Maddy Institute. K. SPECIAL ACCOMODATION: i. The Americans with Disabilities Act of 1990 (ADA) requires that employers with fifteen or more employees to make reasonable accommodations in the workplace for employees The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726 Phone(559)278-1133 Fax(559)278-1167 - www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 ® The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership with disabilities. Accommodation is to be made on a case-by-case basis and may not be required when costs create an undue hardship. ii. The intern is responsible for providing personal accommodation, such as hearing aids, wheelchairs, and personal attendants. In most cases, it is the County's responsibility to provide on-site job accommodation for an employee who has a disability. L. Each Parry shall perform this Agreement in compliance with all applicable laws,regulations,rules, and ordinances and represents that it shall have obtained all licenses and permits required by law to engage in the activities necessary to perform its obligations under this Agreement. M. The Maddy Institute's performance under this Agreement shall be in strict conformance with all applicable Federal, State of California and/or local laws and regulations relating to confidentiality. The Maddy Institute shall submit to County's monitoring of said compliance with all State and Federal statutes and regulations regarding confidentiality. The Maddy Institute shall submit to County's monitoring of said compliance with all State of California and Federal statutes and regulations regarding confidentiality. N. The County and The Maddy Institute agree that neither will discriminate unlawfully against a beneficiary of services in the performance of this Agreement based on gender,race,color,national origin, creed, religion, veteran's status, or disability. The parties agree to follow all applicable federal, state, and local laws and regulations, including but not limited to laws prohibiting discrimination and harassment. O. The parties agree, that for the purposes of venue, performance under this Agreement is to be in Fresno County, California. The rights and obligations of the parties and all interpretation and performance of this Agreement shall be governed in all respects by the laws of the State of California. P. The provisions of this Agreement are severable. The invalidity or unenforceability of any one provision in the Agreement shall not affect the other provisions. Q. Each individual executing this Agreement on behalf of The Maddy Institute represents and warrants that such individual is duly authorized to execute and deliver this Agreement on behalf of The Maddy Institute and that this Agreement is binding upon The Maddy Institute in accordance with its terms. R. Disclosure of Self-Dealing Transactions. If any member of the The Maddy Institute's board of directors is party to a self-dealing transaction,he or she shall disclose the transaction by completing and signing a "Self-Dealing Transaction Disclosure Form" (Exhibit B to this Agreement) and submitting it to the County before commencing the transaction or immediately after. "Self-dealing transaction" means a transaction to which the The Maddy Institute is a party and in which one or more of its directors, as an individual, has a material financial interest. S. Data Security Requirements. The Maddy Institute shall comply with data security requirements in Exhibit C to this Agreement. T. Insurance: The Maddy Institute shall comply with all the insurance requirements in Exhibit D to this Agreement. U. ENTIRE AGREEMENT: This Agreement, including any other documents referred to herein which form a part hereof, embodies the entire agreement and understanding of the Parties. This Agreement supersedes all prior agreements and understandings between the Parties with respect to the subject matter of this `*5TA7fG� SAS ATE le ANIL The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726 Phone(559)278-1133 Fax(559)278-1167 �yf RSF��y t4 - s - www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 The Maddy Institute The San Joaquin Valley—Inspiring Public Leadership Agreement. This Agreement constitutes the entire understanding of the Parties with respect to their relationship and may be modified only by a written agreement signed by each Party. V. This Agreement may not be altered unless both parties agree in writing. The parties agree to follow all applicable federal, state, and local laws and regulations, including but not limited to laws prohibiting discrimination and harassment. Additionally, this Agreement is not legal and binding upon any of the parties concerned until signed by The Maddy Institute and the County. W. Any written notice given under this Agreement shall be sent by registered mail to each of the addresses below: Kenneth L. Maddy Institute The County of Fresno: at California State University, Fresno: Digitally signed by Riley Riley Blackburn Blackburn Date:2024.12.20 16:14:50 By: By: -08,00, Name: Blake Z e Name: Riley Blackburn Title: Executive Director Purchasing Manager Date: November 12, 2024 Date: December 20, 2024 The Maddy Institute,4910 N.Chestnut Ave.,OF43,Fresno,CA 93726 Phone(559)278-1133 Fax(559)278-1167 www.maddyinstitute.org AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A Health Insurance Portability and Accountability Act (HIPAA) 1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as these terms are defined by 45 CFR 160.103. In connection with providing services under the Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health Information ("PHI")from or on behalf of the County. The parties enter into this Business Associate Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to govern the use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164. The parties to this Agreement shall be in strict conformance with all applicable federal and State of California laws and regulations, including, but not limited to California Welfare and Institutions Code sections 5328, 10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431; California Civil Code section 56 et seq.; the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), including, but not limited to, 45 CFR Parts160, 45 CFR 162, and 45 CFR 164; the Health Information Technology for Economic and Clinical Health Act ("HITECH") regarding the confidentiality and security of patient information, including, but not limited to 42 USC 17901 et seq.; and the Genetic Information Nondiscrimination Act ("GINA") of 2008 regarding the confidentiality of genetic information. Except as otherwise provided in this Agreement, the Contractor, as a business associate of the County, may use or disclose Protected Health Information ("PHI") to perform functions, activities or services for or on behalf of the County, as specified in this Agreement, provided that such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of PHI may not be more expansive than those applicable to the County, as the "Covered Entity" under the HIPAA Rules, except as authorized for management, administrative or legal responsibilities of the Contractor. 2. The Contractor, including its subcontractors and employees, shall protect from unauthorized access, use, or disclosure of names and other identifying information, including genetic information, concerning persons receiving services pursuant to this Agreement, except where permitted in order to carry out data aggregation purposes for health care operations [45 CFR§§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all persons receiving services pursuant to a County-funded program. This requirement applies to electronic PHI. The Contractor shall not use such identifying information or genetic information for any purpose other than carrying out the Contractor's obligations under this Agreement. 3. The Contractor, including its subcontractors and employees, shall not disclose any such identifying information or genetic information to any person or entity, except as otherwise specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law, required by the Secretary of the United States Department of Health and Human Services ("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is permitted by this Agreement or authorized by law, the Contractor shall make reasonable efforts to limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request. 4. For purposes of the above sections, identifying information shall include, but not be limited to, name, identifying number, symbol, or other identifying particular assigned to the individual, such as fingerprint or voiceprint, or photograph. 5. For purposes of the above sections, genetic information shall include genetic tests of family members of an individual or individual(s), manifestation of disease or disorder of family members of an individual, or any request for or receipt of genetic services by individual or family A-1 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A members. Family member means a dependent or any person who is first, second, third, or fourth degree relative. 6. The Contractor shall provide access, at the request of the County, and in the time and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR § 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR§ 164.524 regarding access by individuals to their PHI. With respect to individual requests, access shall be provided within thirty (30) days from request. Access may be extended if the Contractor cannot provide access and provides the individual with the reasons for the delay and the date when access may be granted. PHI shall be provided in the form and format requested by the individual or the County. The Contractor shall make any amendment(s) to PHI in a designated record set at the request of the County or individual, and in the time and manner designated by the County in accordance with 45 CFR § 164.526. The Contractor shall provide to the County or to an individual, in a time and manner designated by the County, information collected in accordance with 45 CFR § 164.528, to permit the County to respond to a request by the individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528. 7. The Contractor shall report to the County, in writing, any knowledge or reasonable belief that there has been unauthorized access, viewing, use, disclosure, security incident, or breach of unsecured PHI not permitted by this Agreement of which the Contractor becomes aware, immediately and without reasonable delay and in no case later than two (2) business days of discovery. Immediate notification shall be made to the County's Information Security Officer and Privacy Officer and the County's Department of Public Health ("DPH") HIPAA Representative, within two (2) business days of discovery. The notification shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The Contractor shall take prompt corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure required by applicable federal and State laws and regulations. The Contractor shall investigate such breach and is responsible for all notifications required by law and regulation or deemed necessary by the County and shall provide a written report of the investigation and reporting required to the County's Information Security Officer and Privacy Officer and the County's DPH HIPAA Representative. This written investigation and description of any reporting necessary shall be postmarked within the thirty (30) working days of the discovery of the breach to the addresses below: County of Fresno County of Fresno County of Fresno Department of Public Health Department of Public Health Department of Internal Services HIPAA Representative Privacy Officer Information Security Officer (559) 600-6439 (559) 600-6405 (559) 600-5800 P.O. Box 11867 P.O. Box 11867 2048 North Fine Street Fresno, California 93775 Fresno, California 93775 Fresno, California 93727 8. The Contractor shall make its internal practices, books, and records relating to the use and disclosure of PHI received from the County, or created or received by the Contractor on behalf of the County, in compliance with Parts the HIPAA Rules. The Contractor shall make its internal practices, books, and records relating to the use and disclosure of PHI A-2 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A received from the County, or created or received by the Contractor on behalf of the County, available to the Secretary upon demand. The Contractor shall cooperate with the compliance and investigation reviews conducted by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal business hours; however, upon exigent circumstances access at any time must be granted. Upon the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor and in possession of a subcontractor of the Contractor, the Contractor must certify to the Secretary its efforts to obtain the information from the subcontractor. 9. Safeguards The Contractor shall implement administrative, physical, and technical safeguards as required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by this Agreement. The Contractor shall conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI. The Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Contractor's operations and the nature and scope of its activities. Upon the County's request, the Contractor shall provide the County with information concerning such safeguards. The Contractor shall implement strong access controls and other security safeguards and precautions in order to restrict logical and physical access to confidential, personal (e.g., PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include the following administrative and technical password controls for all systems used to process or store confidential, personal, or sensitive data: A. Passwords must not be: (1) Shared or written down where they are accessible or recognizable by anyone else; such as taped to computer screens, stored under keyboards, or visible in a work area; (2) A dictionary word; or (3) Stored in clear text B. Passwords must be: (1) Eight (8) characters or more in length; (2) Changed every ninety (90) days; (3) Changed immediately if revealed or compromised; and (4) Composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: a) Upper case letters (A-Z); b) Lowercase letters (a-z); c) Arabic numerals (0 through 9); and d) Non-alphanumeric characters (punctuation symbols). The Contractor shall implement the following security controls on each workstation or portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive A-3 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A data: 1. Network-based firewall and/or personal firewall; 2. Continuously updated anti-virus software; and 3. Patch management process including installation of all operating system/software vendor security patches. The Contractor shall utilize a commercial encryption solution that has received FIPS 140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable electronic media (including, but not limited to, compact disks and thumb drives) and on portable computing devices (including, but not limited to, laptop and notebook computers). The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or other internet transport protocol unless the data is encrypted by a solution that has been validated by the National Institute of Standards and Technology (NIST) as conforming to the Advanced Encryption Standard (AES) Algorithm. The Contractor must apply appropriate sanctions against its employees who fail to comply with these safeguards. The Contractor must adopt procedures for terminating access to PHI when employment of employee ends. 10. Mitigation of Harmful Effects The Contractor shall mitigate, to the extent practicable, any harmful effect that is suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or breach of PHI by the Contractor or its subcontractors in violation of the requirements of these provisions. The Contractor must document suspected or known harmful effects and the outcome. 11. The Contractor's Subcontractors The Contractor shall ensure that any of its contractors, including subcontractors, if applicable, to whom the Contractor provides PHI received from or created or received by the Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the relevant provisions of these provisions into each subcontract or sub-award to such agents or subcontractors. Nothing in this section 11 or this Exhibit F authorizes the Contractor to perform services under this Agreement using subcontractors. 12. Employee Training and Discipline The Contractor shall train and use reasonable measures to ensure compliance with the requirements of these provisions by employees who assist in the performance of functions or activities on behalf of the County under this Agreement and use or disclose PHI, and discipline such employees who intentionally violate any provisions of these provisions, which may include termination of employment. 13. Termination for Cause Upon the County's knowledge of a material breach of these provisions by the Contractor, the County will either: A. Provide an opportunity for the Contractor to cure the breach or end the violation, and the County may terminate this Agreement if the Contractor does not cure the breach or end the violation within the time specified by the County; or B. Immediately terminate this Agreement if the Contractor has breached a material term of this Exhibit F and cure is not possible, as determined by the County. A-4 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A C. If neither cure nor termination is feasible, the County's Privacy Officer will report the violation to the Secretary of the U.S. Department of Health and Human Services. 14. Judicial or Administrative Proceedings The County may terminate this Agreement if: (1) the Contractor is found guilty in a criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or (2) there is a finding or stipulation in an administrative or civil proceeding in which the Contractor is a party that the Contractor has violated a privacy or security standard or requirement of the HITECH Act, HIPAA or other security or privacy laws. 15. Effect of Termination Upon termination or expiration of this Agreement for any reason, the Contractor shall return or destroy all PHI received from the County (or created or received by the Contractor on behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend the protections of these provisions to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. This provision applies to PHI that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the Contractor destroys the PHI data, a certification of date and time of destruction shall be provided to the County by the Contractor. 16. Compliance with Other Laws 1.1 To the extent that other state and/or federal laws provide additional, stricter and/or more protective privacy and/or security protections to PHI or other confidential information covered under this BAA, the Contractor agrees to comply with the more protective of the privacy and security standards set forth in the applicable state or federal laws to the extent such standards provide a greater degree of protection and security than HIPAA Rules or are otherwise more favorable to the individual. 17. Disclaimer The County makes no warranty or representation that compliance by the Contractor with these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the Contractor's own purposes or that any information in the Contractor's possession or control, or transmitted or received by the Contractor, is or will be secure from unauthorized access, viewing, use, disclosure, or breach. The Contractor is solely responsible for all decisions made by the Contractor regarding the safeguarding of PHI. 18. Amendment The parties acknowledge that Federal and State laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Exhibit F may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to amend this agreement in order to implement the standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty (30) days written notice in the event that the Contractor does not enter into an amendment providing assurances regarding the safeguarding of PHI that the County in its sole discretion, deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the HITECH Act. 19. No Third-Party Beneficiaries A-5 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit A Nothing expressed or implied in the provisions of this Exhibit F is intended to confer, and nothing in this Exhibit F does confer, upon any person other than the County or the Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever. 20. Interpretation The provisions of this Exhibit F shall be interpreted as broadly as necessary to implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules. 21. Regulatory References A reference in the terms and conditions of these provisions to a section in the HIPAA Rules means the section as in effect or as amended. 22. Survival The respective rights and obligations of the Contractor as stated in this Exhibit F survive the termination or expiration of this Agreement. 23. No Waiver of Obligation Change, waiver or discharge by the County of any liability or obligation of the Contractor under this Exhibit F on any one or more occasions is not a waiver of performance of any continuing or other obligation of the Contractor and does not prohibit enforcement by the County of any obligation on any other occasion. A-6 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit B Self-Dealing Transaction Disclosure Form In order to conduct business with the County of Fresno ("County"), members of a contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions that they are a party to while providing goods, performing services, or both for the County. A self-dealing transaction is defined below: "A self-dealing transaction means a transaction to which the corporation is a party and in which one or more of its directors has a material financial interest." The definition above will be used for purposes of completing this disclosure form. Instructions (1) Enter board member's name, job title (if applicable), and date this disclosure is being made. (2) Enter the board member's company/agency name and address. (3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the County. At a minimum, include a description of the following: a. The name of the agency/company with which the corporation has the transaction; and b. The nature of the material financial interest in the Corporation's transaction that the board member has. (4) Describe in detail why the self-dealing transaction is appropriate based on applicable provisions of the Corporations Code. The form must be signed by the board member that is involved in the self-dealing transaction described in Sections (3) and (4). B-1 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit B (1) Company Board Member Information: Name: Date: Job Title: (2) Company/Agency Name and Address: (3) Disclosure (Please describe the nature of the self-dealing transaction you are a party to) (4) Explain why this self-dealing transaction is consistent with the requirements of Corporations Code § 5233 (a) (5) Authorized Signature Signature: Date: B-2 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit C Data Security For the purpose of preventing the potential loss, misappropriation or inadvertent access, viewing, use or disclose of County data including sensitive or personal client information; abuse of County resource; and/or disruption to County operations, individuals and/or agencies that enter into a contractual relationship with the County for the purpose of providing services under this Agreement must employ adequate data security measures to protect the confidential information provided to University by the County, including but not limited to the following: A. The Maddy Institute-Owned Mobile, Wireless, or Handheld Devices The Maddy Institute may not connect to County networks via personally-owned mobile, wireless, or handheld devices, unless the following conditions are met: a. The Maddy Institute has received authorization by County for telecommuting purposes; b. Current virus protection software is in place; c. Mobile device has the remote wipe feature enabled; and d. A secure connection is used. B. The Maddy Institute -owned Computer or Computer Peripherals The Maddy Institute may not bring The Maddy Institute -owned computer or computer peripherals into the County for use without prior authorization from the County's Chief Information Officer, and/or designee(s), including but not limited to mobile storage devices. If data is approved to be transferred, data must be stored on a secure server approved by the County and transferred by means of a Virtual Private Network (VPN) connection, or another type or secure connection. Said data must be encrypted. C. County-owned Computer Equipment The Maddy Institute, including its students, subcontractors, and employees, may not use County computer or computer peripherals on non-County premises without prior authorization from the County's Chief Information Officer, and/or designee(s). C-1 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit C D. The Maddy Institute may not store County's private, confidential, or sensitive data on any hard-disk drive, portable storage device, or remote storage installation unless encrypted. E. The Maddy Institute shall be responsible to employ strict controls to ensure the integrity and security of County's confidential information and to prevent unauthorized access, viewing, use or disclosure of data maintained in computer files, program documentation, data processing systems, data files, and data processing equipment which stores or processes County data internally and externally. F. Confidential client information transmitted to one party by the other means of electronic transmissions must be encrypted according to Advanced Encryption Standards (AES) of 128 BIT or higher. Additionally, a password or pass phrase must be utilized. G. The Maddy Institute is responsible to immediately notify County of any violations, breaches, or potential breaches of security related to County's confidential information, data maintained in computer files, program documentation, data processing systems, data files, and data processing equipment which stores or processing County data internally or externally. H. County shall provide oversight to The Maddy Institute's response to all incidents arising from a possible breach of security related to County's confidential client information provided to The Maddy Institute. The Maddy Institute will be responsible to issue any notification to affected individuals as required by law or as deemed necessary by County in its sole discretion. The Maddy Institute will be responsible for all costs incurred as a result of providing the required notification. C-2 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit D Insurance Requirements 1. Required Policies Without limiting the County's right to obtain indemnification from The Maddy Institute or any third parties, The Maddy Institute, at its sole expense, shall maintain in full force and effect the following insurance policies throughout the term of this Agreement. (A) Commercial General Liability. Commercial general liability insurance with limits of not less than Two Million Dollars ($2,000,000) per occurrence. This policy must be issued on a per occurrence basis. Coverage must include products, completed operations, property damage, bodily injury, personal injury, and advertising injury. The Maddy Institute shall obtain an endorsement to this policy naming the County of Fresno, its officers, agents, employees, and volunteers, individually and collectively, as additional insureds, but only insofar as the operations under this Agreement are concerned. An automatic or blanket additional insured endorsement as required by written agreement is acceptable. Such coverage for additional insureds will apply as primary insurance and any other insurance, or self-insurance, maintained by the County is excess only and not contributing with insurance provided under The Maddy Institute's policy. (B) Automobile Liability. Automobile liability insurance with limits of not less than One Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages. Coverage must include any auto used in connection with this Agreement. If The Maddy Institute does not own any autos, there must be coverage for Hired and Non-owned Autos. (C) Professional Liability. Professional liability insurance with limits of not less than One Million Dollars ($2,000,000) per occurrence. If this is a claims-made policy, then (1) the retroactive date must be prior to the date on which services began under this Agreement; (2) The Maddy Institute shall maintain the policy and provide to the County annual evidence of insurance for not less than three years after completion of services under this Agreement; and (3) if the policy is canceled or not renewed, and not replaced with another claims-made policy with a retroactive date prior to the date on which services begin under this Agreement, then The Maddy Institute shall purchase extended reporting coverage on its claims-made policy for a minimum of three years after completion of services under this Agreement. 2. Additional Requirements (A) Verification of Coverage. Within 30 days after The Maddy Institute signs this Agreement, and at any time during the term of this Agreement as requested by the County, The Maddy Institute shall deliver, or cause its broker or producer to deliver, to County HR-Employment Services, at 2220 Tulare Street, 14th Floor, Fresno, California 93721, or , and by mail or email to the person identified to receive notices under this Agreement, certificates of insurance and endorsements for all of the coverages required under this Agreement. (B) Acceptability of Insurers. All insurance policies required under this Agreement must be issued by admitted insurers licensed to do business in the State of California and D-1 AGREEMENT NUMBER P-24-713 12/20/2024 Exhibit D possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no less than A-: VII. (C) Notice of Cancellation or Change. For each insurance policy required under this Agreement, The Maddy Institute shall provide to the County, or ensure that the policy requires the insurer to provide to the County, written notice of any cancellation or change in the policy as required in this paragraph. For cancellation of the policy for nonpayment of premium, The Maddy Institute shall, or shall cause the insurer to, provide written notice to the County not less than 10 days in advance of cancellation. For cancellation of the policy for any other reason, and for any other change to the policy, The Maddy Institute shall, or shall cause the insurer to, provide written notice to the County not less than 30 days in advance of cancellation or change. The County in its sole discretion may determine that the failure of The Maddy Institute or its insurer to timely provide a written notice required by this paragraph is a breach of this Agreement. (D) County's Entitlement to Greater Coverage. If The Maddy Institute has or obtains insurance with broader coverage, higher limits, or both, than what is required under this Agreement, then the County requires and is entitled to the broader coverage, higher limits, or both. To that end, The Maddy Institute shall deliver, or cause its broker or producer to deliver, to the County, certificates of insurance and endorsements for all of the coverages that have such broader coverage, higher limits, or both, as required under this Agreement. (E) Waiver of Subrogation. The Maddy Institute waives any right to recover from the County, its officers, agents, employees, and volunteers any amounts paid under any policy required by this Agreement. The Maddy Institute is solely responsible to obtain any policy endorsement that may be necessary to accomplish that waiver, but The Maddy Institute's waiver of subrogation under this paragraph is effective whether or not The Maddy Institute obtains such an endorsement. (F) County's Remedy for The Maddy Institute's Failure to Maintain. If The Maddy Institute fails to keep in effect at all times any insurance coverage required under this Agreement, the County may, in addition to any other remedies it may have, suspend or terminate this Agreement upon the occurrence of that failure. D-2