HomeMy WebLinkAboutAgreement A-24-677 with McCormick Barstow LLP.pdf Agreement No. 24-677
1 AGREEMENT FOR SPECIALIZED LEGAL SERVICES
2
3 THIS AGREEMENT is made and entered into this 17th day of December 2024 by and between
4 the COUNTY OF FRESNO,a political subdivision of the State of California,hereinafter referred to as
5 "COUNTY,"and McCormick Barstow,LLP hereinafter referred to as"ATTORNEY."
6 WITNESSETH:
7 WHEREAS,COUNTY is responsible for the administration and defense of General Liability,
8 Auto Liability,Employment Law and Medical Malpractice claims against COUNTY employee(s).
9 WHEREAS,COUNTY needs and wishes to engage appropriate legal counsel,who is skilled
10 and knowledgeable in defense of General Liability claims or other claims that are covered under the County's
11 General Liability and Medical Malpractice Programs,and to advise and represent COUNTY employee(s)in
12 connection with the matters,as provided herein;and
13 WHEREAS,ATTORNEY states that it is experienced,possesses expertise in such matters,and
14 is willing to perform said services,
15 NOW,THEREFORE,in consideration of the mutual covenants,terms and conditions herein
16 contained,the Parties hereto agree as follows:
17 SECTION 1
18 ENGAGEMENT OF ATTORNEY
19 1.1 COUNTY hereby engages ATTORNEY as an independent contractor,and any associated
20 lawyers,paralegals and support staff(collectively,"Staff'),as ATTORNEY deems necessary,and whom the
21 Director,or his or her designee,of COUNTY's Human Resources Department(the"Director")approves.
22 1.2 Each claim will be handled by the lawyer(s)of ATTORNEY to whom the assignment is made
23 by the Director unless the Director approves the handling by another(or additional)lawyer(s)of ATTORNEY.
24 ATTORNEY's Staff may assist the handling lawyer(s)of ATTORNEY as deemed necessary.
25 1.3 Any additional instructions relative to the handling of a claim which are not specified this
26 Agreement will be included in the letter of engagement for each claim or action assigned to ATTORNEY. Such
27 instructions will be complied with by ATTORNEY as well as any additional client direction in the management
28 of the claim. The parties intend for ATTORNEY's services,including any communications exchanged between
-1-
I COUNTY and ATTORNEY, such as such letter of engagement,to be covered by the attorney-client privilege
2 of confidential communications(California Evidence Code secs 952 and 954)and the attorney work product
3 doctrine of confidentiality(California Code of Civil Procedure,secs.2018.010 through 2018.080).
4 SECTION 2
5 SCOPE OF SERVICES
6 2.1 ATTORNEY shall assist,advise,and represent COUNTY,including its boards,commissions,
7 committees,officers,and employees,in connection with all matters relative to the administration and defense of
8 the claims and actions assigned by the Director,as specified by the Director,and per the terms set forth in this
9 Agreement.
10 2.2 ATTORNEY shall perform such other similar legal services as requested by the Director in
11 connection with the matters related to the administration and defense of the assigned claims and actions.
12 SECTION 3
13 PERFORMANCE BY ATTORNEY
14 3.1 ATTORNEY agrees to avoid unnecessary duplicative efforts by ATTORNEY,including its
15 lawyers and/or Staff of ATTORNEY in the performance of services for COUNTY hereunder.
16 3.2 COUNTY shall not be obligated to compensate ATTORNEY for intra-office conferences
17 between or among lawyers of ATTORNEY,and/or Staff,unless such intra-office conferences promote
18 efficiency in the performance of ATTORNEY'S work on a matter,or a reduction in the cost of compensation
19 paid or reimbursement made for related,actual,reasonable and necessary,out-of-pocket expenses to
20 ATTORNEY,or both.
21 3.3 In the performance of the tasks identified in Section 2 of this Agreement,ATTORNEY shall
22 provide only those services which are necessary to carry out such tasks in an efficient and effective manner.
23 3.4 COUNTY shall have the right to approve the retention of all experts,consultants,investigators,
24 and any other unusual or extraordinary expenditures.
25 SECTION 4
26 COMPENSATION OF ATTORNEY
27 4.1 COUNTY shall be obligated to compensate ATTORNEY pursuant to the terms and conditions
28 of this Agreement and for the performance of those tasks identified in Section 2 of this Agreement,to the
-2-
I reasonable satisfaction of the COUNTY,that take place during the term of this Agreement. It is understood that
2 COUNTY shall not be obligated to compensate ATTORNEY for:
3 (a)any work,services,or functions performed by ATTORNEY that do not arise directly from the
4 performance of tasks identified in Section 2 of this Agreement;and
5 (b)providing COUNTY with documentation,explanations,or justifications concerning the
6 adequacy or accuracy of ATTORNEY's invoices for the performance of services under this Agreement
7 and resolving same to the reasonable satisfaction of COUNTY.
8 4.2 COUNTY agrees to pay,and ATTORNEY agrees to accept as full compensation for
9 performance of tasks under this Agreement ATTORNEY's reasonable fees as described in Exhibit A, Schedule
10 of Rates.
11 4.3 ATTORNEY shall be reimbursed for actual,reasonable,and necessary out-of-pocket expenses,
12 as follows: telephone charges,facsimile charges,computer research charges,filing fees,postage charges,
13 printing and photographic reproduction expenses,and all other directly related expenses. It is understood that
14 ATTORNEY shall not be reimbursed for the costs of ATTORNEY's Staff,including secretarial,clerical,word
15 processing or typist services(including overtime hours worked),that is"normal office operating expenses,"
16 with the exception of those charges and expenses stated above. In addition,ATTORNEY shall not be
17 reimbursed for such normal office operating expenses incurred,regardless of who performs such services or
18 incurs such expenses.
19 4.4 COUNTY will not reimburse ATTORNEY for any travel within the cities of Fresno or Clovis.
20 4.5 Notwithstanding anything else stated to the contrary in this Agreement,in no event shall the
21 maximum amount paid by COUNTY to ATTORNEY as compensation,and as reimbursement of related,actual,
22 reasonable and necessary,out-of-pocket expenses,exceed one million five hundred thousand dollars
23 ($1,500,000.00)annually.
24 SECTION 5
25 PAYMENT AND RECORD-KEEPING
26 5.1 Subject to Section 4 of this Agreement,payment of compensation for the services provided and
27 reimbursement for related,actual,reasonable and necessary,out-of-pocket expenses incurred which are
28 described herein shall be made by COUNTY after submission of an itemized invoice by ATTORNEY to
-3-
I Human Resources Department,Risk Management Division. ATTORNEY shall submit such invoices no later
2 than the twentieth(20th)day of the month following the month services are completed,unless the bill totals less
3 than one hundred dollars($100). The file will not be billed until the total reaches at least one hundred dollars
4 ($100)or the claim is closed. All payments by COUNTY will be made within forty-five(45)days after receipt,
5 verification and approval of ATTORNEY'S invoices by COUNTY'S Human Resources Department,Risk
6 Management Division.
7 5.2 All such invoices shall have sufficient detail as may be required by the COUNTY Auditor-
8 Controller/Treasurer-Tax Collector,including,but not limited to:
9 5.2.1 The plaintiff s name,the date of loss,the COUNTY's claim number and any other identifying
10 information that will indicate the file to which billing is to be assigned.
11 5.2.2 The specific nature of each task performed as services under this Agreement;
12 5.2.3 The name of the ATTORNEY or staff member performing each task;
13 5.2.4 The number of hours worked by each such person for each such task;
14 5.2.5 The hourly rate per each such person performing each such task;
15 5.2.6 The related,actual,reasonable and necessary,out-of-pocket expenses incurred,as provided for
16 in Section 4 of this Agreement;
17 5.2.7 A certification by ATTORNEY that each such invoice is true and accurate as to the information
18 and specification contained therein;
19 5.3 In addition to the requirements of Section 5.2,each invoice shall set forth a summary of hours
20 worked by each ATTORNEY and staff member for the applicable billing period. Each invoice shall set forth
21 the product of such summary of hours worked by each person multiplied by each such person's billing rate,as
22 set forth in Attachment A, Schedule of Rates.
23 5.4 In preparing invoices,if requested by COUNTY's Risk Management,ATTORNEY shall
24 segregate each task performed on a daily basis. If so requested by COUNTY,ATTORNEY shall not combine
25 unrelated tasks as a single entry in lieu of setting forth the hours of work performed by an ATTORNEY or staff
26 member on each specific task.
27 5.5 ATTORNEY shall prepare all invoices in an organized manner that facilitates an efficient
28 review of the services performed and the expenses incurred in order to provide COUNTY with a clear and
-4-
I complete picture of how much time was devoted to specific tasks and projects,and the cost associated
2 therewith.
3 5.6 ATTORNEY shall keep complete records of the services provided,as described in this Section
4 5,together with all related actual,reasonable and necessary,out-of-pocket expenses applicable to the work
5 provided under this Agreement. The County Auditor-Controller/Treasurer-Tax Collector,or his or her duly
6 authorized representatives, shall be given reasonable access to all of these records for the purposes of audit of
7 this Agreement. In addition,ATTORNEY shall be subject to the examination and audit of such records by the
8 State Auditor for a period of three(3)years after final payment under this Agreement,pursuant to Government
9 Code section 8546.7,as applicable.
10 5.7 Attorney shall provide to COUNTY a W-9, 1099 and CA Form 590 as appropriate upon
11 execution of the agreement and annually thereafter.
12 SECTION 6
13 TERM OF AGREEMENT
14 6.1 This Agreement shall be effective and shall commence January 13,2025. This agreement shall
15 continue in full force and effect until January 12,2028. The Term of this Agreement may be extended,as to
16 each Contractor,for no more than two,one-year periods only upon written approval of the Contractor and
17 County at least thirty(30)days before the first day of the next one-year extension period.The County's Director
18 is authorized to sign the written approval on behalf of the County based on the Contractor's satisfactory
19 performance.The extension of this Agreement by the County is not a waiver or compromise of any default or
20 breach of this Agreement by the Contractor existing at the time of the extension whether or not known to the
21 County.
22 6.2 ATTORNEY may terminate this Agreement for material breach after giving COUNTY written
23 notice and 10 days to correct the breach. However,COUNTY's rights under any pending matter which may
24 arise from ATTORNEY's service hereunder shall not be prejudiced due to such termination,as required by the
25 Rules of Professional Conduct of the State Bar of California. Subject to Section 4 of this Agreement,
26 ATTORNEY shall be paid for all services performed to the reasonable satisfaction of the COUNTY,to the date
27 of termination of this Agreement.
28 SECTION 7
-5-
I INDEPENDENT CONTRACTOR
2 7.1 In performance of the work,duties,and obligations assumed by ATTORNEY under this
3 Agreement,it is mutually understood and agreed that ATTORNEY,including any and all of ATTORNEY's
4 officers,agents,and employees,will at all times be acting and performing as an independent contractor,and
5 shall act in an independent capacity and not as an officer,agent,servant,employee,joint venturer,partner,or
6 associate of COUNTY. However,COUNTY shall retain the right to administer this Agreement to verify that
7 ATTORNEY is performing its obligations in accordance with the terms and conditions thereof. ATTORNEY
8 and COUNTY shall comply with all applicable provisions of law and the rules and regulations,if any,of
9 governmental authorities having jurisdiction over the subject matter thereof.
10 7.2 Because of its status as an independent contractor,ATTORNEY,including any and all of
11 ATTORNEY's officers,agents,and employees,shall have absolutely no right to employment rights and benefits
12 available to COUNTY employees. ATTORNEY shall be solely liable and responsible for providing to,or on
13 behalf of,its employees all legally required employee benefits. In addition,ATTORNEY shall be solely
14 responsible and hold COUNTY harmless from all matters related to payment of ATTORNEY's employees,
15 including compliance with social security,withholding,and all other regulations governing such matters. It is
16 acknowledged that during the term of this Agreement,ATTORNEY may be providing services to others
17 unrelated to the COUNTY or to this Agreement.
18 SECTION 8
19 HOLD HARMLESS
20 8.1 Each Contractor shall indemnify and hold harmless and defend the County(including its
21 officers,agents,employees,including further the County's Director and the County's Representative,and
22 volunteers)against all claims,demands,injuries,damages,costs,expenses(including attorney fees and costs),
23 fines,penalties,and liabilities of any kind to the County,the Contractor,any other Contractors,or any third
24 party that arise from or relate to any actual or alleged negligent or wrongful acts,errors or omissions of the
25 Contractor(or any of its officers,agents,subcontractors,employees,or volunteers),including the performance,
26 or failure to perform,by Contractor(or any of its officers,agents,subcontractors,employees,or volunteers),
27 under this Agreement. The County may conduct or participate in its own defense without affecting the
28 Contractor's obligation to indemnify and hold harmless or defend the County.
-6-
1 8.2 This Section 8 survives the termination of this Agreement.
2 SECTION 9
3 INSURANCE
4 Without limiting the COUNTY's right to obtain indemnification from ATTORNEY or any third
5 parties,ATTORNEY,at its sole expense,shall maintain in full force and effect,the following insurance policies
6 or a program of self-insurance.
7 9.1 Professional Liability
8 ATTORNEY shall maintain Professional Liability Insurance with limits of not less than one million dollars
9 ($1,000,000.00)per occurrence and three million dollars($3,000,000.00)annual aggregate. ATTORNEY shall
10 provide COUNTY with written evidence of such coverage. This coverage may be issued on a per claim basis.
11 If so,ATTORNEY agrees that it shall maintain,at its sole expense,so-called"tail coverage"in full force and
12 effect for a period of three(3)years following the termination of this Agreement,which shall be one or more
13 policies of professional liability insurance with limits of coverage as specified herein.
14 9.2 Automobile Liability
15 Comprehensive Automobile Liability Insurance with limits of not less than One Million Dollars
16 ($1,000,000.00)per accident for bodily injury and for property damages. Coverage should include any auto
17 used in connection with this Agreement.
18 9.3 Commercial General Liability
19 ATTORNEY shall maintain Commercial General Liability Insurance with limits of not less than two million
20 dollars($2,000,000.00)per occurrence and an annual aggregate of four million dollars($4,000,000.00). This
21 policy shall be issued on a per-occurrence basis. COUNTY may require specific coverage including completed
22 operations,product liability,contractual liability,explosion-collapse-underground liability,fire legal liability,or
23 any other liability insurance deemed necessary because of the nature of the contract.
24 9.4 Workers' Compensation
25 ATTORNEY shall maintain a policy of Workers' Compensation insurance as may be required by the California
26 Labor Code.
27 9.5 Cyber Liability
28
-7-
I ATTORNEY shall maintain a policy of Cyber liability insurance with limits of not less than
2 Two Million Dollars($2,000,000)per occurrence.Coverage must include claims involving Cyber Risks. The
3 cyber liability policy must be endorsed to cover the full replacement value of damage to,alteration of,loss of,
4 or destruction of intangible property(including but not limited to information or data)that is in the care,
5 custody,or control of the Contractor.
6 Definition of Cyber Risks
7 "Cyber Risks"include but are not limited to(i)Security Breach,which may include Disclosure
8 of Personal Information to an Unauthorized Third Party; (ii)data breach;(iii)breach of any of the Contractor's
9 obligations under Exhibit B of this Agreement; (iv)system failure;(v)data recovery;(vi)failure to timely
10 disclose data breach or Security Breach; (vii)failure to comply with privacy policy;(viii)payment card
11 liabilities and costs;(ix)infringement of intellectual property,including but not limited to infringement of
12 copyright,trademark,and trade dress;(x)invasion of privacy,including release of private information; (xi)
13 information theft;(xii)damage to or destruction or alteration of electronic information;(xiii)cyber extortion;
14 (xiv)extortion related to the Contractor's obligations under this Agreement regarding electronic information,
15 including Personal Information;(xv)fraudulent instruction;(xvi)funds transfer fraud;(xvii)telephone fraud;
16 (xviii)network security;(xix)data breach response costs,including Security Breach response costs;(xx)
17 regulatory fines and penalties related to the Contractor's obligations under this Agreement regarding electronic
18 information,including Personal Information
19 SECTION 10
20 ADDITIONAL INSURANCE TERMS
21 10.1 ATTORNEY shall obtain endorsements to the Commercial General Liability insurance naming
22 the County of Fresno,its officers,agents,and employees,individually and collectively,as additional insured,
23 but only insofar as the operations under this Agreement are concerned. Such coverage for additional insured
24 shall apply as primary insurance and any other insurance,or self-insurance,maintained by County,its officers,
25 agents and employees shall be excess only and not contributing with insurance provided under ATTORNEY's
26 policies herein. This insurance shall not be cancelled or changed without a minimum of thirty(30)days
27 advance written notice given to COUNTY.
28
-8-
1 10.2 ATTORNEY hereby waives its right to recover from COUNTY,its officers,agents,and
2 employees any amounts paid by the policy of worker's compensation insurance required by this Agreement.
3 ATTORNEY is solely responsible to obtain any endorsement to such policy that may be necessary to
4 accomplish such waiver of subrogation,but ATTORNEY's waiver of subrogation under this paragraph is
5 effective whether or not ATTORNEY obtains such an endorsement.
6 10.3 Within thirty(30)days from the date ATTORNEY executes this Agreement,ATTORNEY shall
7 provide certificates of insurance and endorsement as stated above for all of the foregoing policies,as required in
8 Section 9 herein,to COUNTY,Human Resources Department,Risk Management Division,stating that such
9 insurance coverage has been obtained and is in full force and effect;that the County of Fresno,its officers,
10 agents and employees will not be responsible for any premiums on the policies;that for such worker's
11 compensation insurance the ATTORNEY has waived its right to recover from the COUNTY,its officers,gents,
12 and employees any amounts paid under the insurance policy and that waiver does not invalidate the insurance
13 policy;that such Commercial General Liability insurance names the COUNTY,its officers,agents and
14 employees,individually and collectively, as additional insured,but only insofar as the operations under this
15 Agreement are concerned;that such coverage for additional insured shall apply as primary insurance and any
16 other insurance,or self-insurance,maintained by COUNTY,its officers,agents and employees,shall be excess
17 only and not contributing with insurance provided under ATTORNEY's policies herein;and that this insurance
18 shall not be cancelled or changed without a minimum of thirty(30)days advance,written notice given to
19 COUNTY.
20 10.4 In the event ATTORNEY fails to keep in effect at all times insurance coverage as herein provided,
21 the COUNTY may,in addition to other remedies it may have,suspend or terminate this Agreement upon the
22 occurrence of such event.
23 10.5 All policies shall be with admitted insurers licensed to do business in the State of California.
24 Insurance purchased shall be purchased from companies possessing a current A.M.Best,Inc.rating of A,FSC
25 VII or better.
26 SECTION 11
27 AGREEMENT BINDING ON SUCCESSORS
28
-9-
1 11.1 This Agreement shall be binding upon COUNTY and ATTORNEY and their successors,
2 executors,administrators,legal representatives,and assigns with respect to all the covenants and conditions set
3 forth herein.
4 SECTION 12
5 ASSIGNMENT AND SUBCONTRACTING
6 12.1 Neither party hereto shall assign,transfer,or sub-contract neither this Agreement nor its rights
7 nor duties hereunder without the written consent of the other. County Risk Manager,or his or her designee,
8 may give such consent on behalf of the COUNTY,provided however,the assignee,transferee or sub-contractor
9 shall carry
10 insurance of a type and in an amount that is acceptable to COUNTY's Risk Manager,or his or her designee.
11 SECTION 13
12 AMENDMENTS
13 13.1 This Agreement may be amended only in writing signed by the Parties hereto.
14 SECTION 14
15 CONFLICT OF INTEREST
16 14.1 ATTORNEY promises,covenants,and warrants that the performance of their services and
17 representation of COUNTY under this Agreement do not result in a"conflict of interest"as that term is used in
18 the Rules of Professional Conduct of the State Bar of California. In the event a"conflict of interest"occurs,
19 ATTORNEY will request that COUNTY waive such"conflict of interest"on a case-by-case basis. If the
20 COUNTY does not waive the conflict,ATTORNEY must resolve the conflicting issue in the favor of
21 COUNTY.
22 SECTION 15
23 FURTHER ASSURANCES BY ATTORNEYS
24 15.1 ATTORNEY represents that it has read and is familiar with Government Code Section 1090 et
25 seq. and Section 87100 et seq. ATTORNEY promises,covenants,and warrants that the performance of its
26 services under this Agreement shall not result in or cause a violation of Government Code Section 1090 et seq.
27 and Section 87100 et seq.
28 SECTION 16
-10-
I COMPLIANCE WITH LAWS
2 16.1 ATTORNEY shall comply with all federal, state,and local laws and regulations applicable to
3 the performance of its obligations under this Agreement and maintain all licenses as required in the performance
4 of its duties.
5 SECTION 17
6 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
7 17.1 ATTORNEY shall comply with all provisions of Exhibit C of this Agreement,titled"Health
8 Insurance and Accountability Act(HIPAA).
9 SECTION 18
10 GOVERNING LAW
11 18.1 The rights and obligations of the parties and all interpretations and performance of this
12 Agreement shall be governed in all respects by the laws of the State of California.
13 18.2 Venue for any action arising out of or related to this Agreement shall only be in Fresno County,
14 California.
15 SECTION 19
16 DISCLOSURE OF SELF-DEALING TRANSACTIONS
17 19.1 This provision is only applicable if the ATTORNEY is operating as a corporation(a for-profit
18 or non-profit corporation)or if,during the term of the agreement,the ATTORNEY changes its status to operate
19 as a corporation.
20 19.2 Members of the ATTORNEY'S Board of Directors shall disclose any self-dealing transactions
21 that they are a party to while ATTORNEY is providing goods or performing services under this agreement.A
22 self-dealing transaction shall mean a transaction to which the ATTONREY is a party and in which one or more
23 of its directors has a material financial interest. Members of the Board of Directors shall disclose any self-
24 dealing transactions that they are a party to by completing and signing a Self-Dealing Transaction Disclosure
25 Form,attached hereto as Exhibit D and incorporated herein by reference,and submitting it to the COUNTY
26 prior to commencing with the self-dealing transaction or immediately thereafter.
27 SECTION 20
28 NOTICES
-11-
1 20.1 The persons and their addresses having authority to give and receive notices under this
2 Agreement include the following:
3 COUNTY ATTORNEY
4 County of Fresno McCormick Barstow,LLP
5 ATTN: Hollis Magill 7647 N.Fresno Street
6 Director of Human Resources Fresno,CA 93729-8912
7 2220 Tulare Street, 16th Floor
8 Fresno,CA 93721
9 20.2 All notices between the COUNTY and ATTORNEY provided for or permitted under this
10 Agreement must be in writing and delivered either by person service,by first-class United States mail,by an
11 overnight commercial courier service,or by telephonic facsimile transmission. A notice delivered by personal
12 service is effective upon service to the recipient. A notice delivered by first-class United States mail is effective
13 three COUNTY business days after deposit in the United States mail,postage prepaid,addressed to the
14 recipient. A notice delivered by an overnight commercial courier service is effective one COUNTY business
15 day after deposit with the overnight commercial courier service,delivery fees prepaid,with delivery instructions
16 given for next day delivery,addressed to the recipient. A notice delivered by telephonic facsimile is effective
17 when transmission to the recipient is completed(but,if such transmission is completed outside of COUNTY
18 business hours,then such delivery shall be deemed to be effective at the next beginning of a COUNTY business
19 day),provided that the sender maintains a machine record of the completed transmission. For all claims arising
20 out of or related this this Agreement,nothing in this section establishes,waives,or modifies any claims
21 presentation requirements or procedures provided by law,including but not limited to the Government Claims
22 Act(Division 3.6 of Title 1 of the Government Code,beginning with section 810).
23 SECTION 21
24 ELECTRONIC SIGNATURE
25 21.1 The parties agree that this Agreement may be executed by electronic signature as provided in
26 this section.An"electronic signature"means any symbol or process intended by an individual signing this
27 Agreement to represent their signature,including but not limited to(1)a digital signature;(2)a faxed version of
28 an original handwritten signature;or(3)an electronically scanned and transmitted(for example by PDF
-12-
I document)of a handwritten signature.Each electronic signature affixed or attached to this Agreement(1)is
2 deemed equivalent to a valid original handwritten signature of the person signing this Agreement for all
3 purposes,including but not limited to evidentiary proof in any administrative or judicial proceeding,and(2)has
4 the same force and effect as the valid original handwritten signature of that person. The provisions of this
5 section satisfy the requirements of Civil Code section 1633.5,subdivision(b),in the Uniform Electronic
6 Transaction Act(Civil Code,Division 3,Part 2,Title 2.5,beginning with section 1633.1). Each party using a
7 digital signature represents that it has undertaken and satisfied the requirements of Government Code section
8 16.5,subdivision(a),paragraphs(1)through(5),and agrees that each other party may rely upon that
9 representation. This Agreement is not conditioned upon the parties conducting the transactions under it by
10 electronic means and either party may sign this Agreement with an original handwritten signature.
11 SECTION 22
12 ENTIRE AGREEMENT
13 22.1 This Agreement,and any and all documents referred to or otherwise incorporated by reference
14 herein,constitutes the entire Agreement between COUNTY and ATTORNEY with respect to the specialized
15 legal services to be provided herein and supersedes any previous Agreement concerning the subject matter
16 hereof,negotiations,proposals,commitments,writings,or understandings of any nature whatsoever unless
17 expressly included in this Agreement.
18 22.2 If any part of this Agreement is found violative of any law or is found to be otherwise legally
19 defective,ATTORNEY and COUNTY shall use their best efforts to replace that part of this Agreement with
20 legal terms and conditions most readily approximating the original intent of the parties.
21
22
23
24
25
26
27
28
-13-
I IN WITNESS WHEREOF, the Parties hereto have caused this Agreement to be executed as of the day
2 and year first above written.
3 LAP
C Ct r(A;CV-$att�D��
4 ATTORNEY: COUNTY OF FRESNO
R
5 / 1'. r I-L
6 (Authorized Signature) Nathan Magsig,Chairman of the Board of the
7 Board of Supervisors of the County of Fresno
8 Mat+ �• b�l�eF �
Print Name&Title P4 tw-t h e v
9 7L 4 7 W , Frvs h o S+t,t4♦
10 Mailing Address 1[1
11 -FY2Srle0 C ►T c?37.25
City,State,ZIP
12
13 ATTEST:
14 Bernice E.Seidel
15 Clerk of the Board of Supervisors
16 County of Fresno,State of California
17
18 By:
19 Deputy
20
21
22
23 FOR ACCOUNTING USE ONLY:
24 ORG No.: 89250100
25 Account No.: 7100
26 Fund: 1060
27 Subclass: 10000
28 Requisition No.: 8922500146
-14-
I EXHIBIT A
2 Compensation
3
4 County shall compensate Attorney as follows:
5 Other Services
6 David R.McNamara $345/hour
7 Mart B.011er,IV $345/hour
8 Michael F.Ball $345/hour
9 Greg Mason $295/hour
10 Laura Wolfe $345/hour
11 Christina Tillman $450/hour
12 Daniel Wainwright $295/hour
13 Partners $345/hour
14 Senior Associates $275/hour
15 Associates $260/hour
16 Appellate Matters
17 Todd Baxter $400/hour
18 Partners $375/hour
19 Senior Associates $300/hour
20 Associates $285/hour
21 Paralegals
22 Providing Litigation/Appellate Support $160/hour
23
24 Necessary travel time charged at one-half of applicable hourly rate,however no travel within the Cities of
25 Fresno or Clovis shall be charged to or payable by COUNTY.
26
27 Costs and Expenses
28 Travel Expenses for approved Best available rate
-15-
I trips related to attendance of for overnight stays and
2 regular County meetings,office meal diems at County
3 hours and appointments policy and IRS
4
5 Extraordinary postage or Actual Cost
6 overnight delivery when
7 expedited delivery is necessary
8
9 Necessary costs incurred for the Actual Cost
10 following:
11
12 Court filing fees
13 Courtcall expenses
14 Attorney services(includes service of process fees,arbitrators,and mediators)
15 Messenger services
16 Westlaw research outside of our prepaid service fee
17 Fed-ex,On-Trac Overnight,or other one-day delivery services
18 Reasonable travel expenses and parking fees for court appearances,depositions,arbitrations,
19 mediations,and other necessary appointments
20 Any other expenses not listed above that becomes necessary for the successful resolution of a
21 particular litigation matter,as pre-approved in writing by the Department of Human Resources,Risk
22 Management.
23
24 Photocopies/Scans $.25 per page
25 Color Copies $.75 per page
26 Faxes $.50 per page plus L/D charges
27
28
-16-
I EXHIBIT B
2 Confidentiality and Data Security
3 1. Definitions
4 1.1 Capitalized terms used in this Exhibit B have the meanings set forth in this section 1.
5 a. "Authorized Employees"means the Attorney's(hereinafter"Contractor")employees
6 who have access to Personal Information or Privileged Information.
7 b. "Authorized Persons"means: (i)any and all Authorized Employees;and(ii)any and
8 all of the Contractor's subcontractors,representatives,agents,outsourcers,and
9 consultants,and providers of professional services to the Contractor,who have access
10 to Personal Information and are bound by law or in writing by confidentiality
11 obligations sufficient to protect Personal Information in accordance with the terms of
12 this Exhibit B.
13 C. "Director"means the County's Director Internal Services/Chief Information officer or
14 their designee.
15 d. "Disclose"or any derivative of that word means to disclose,release,transfer,
16 disseminate,or otherwise provide access to or communicate all or any part of any
17 Personal Information orally,in writing,or by electronic or any other means to any
18 person.
19 e. "Person"means any natural person,corporation,partnership,limited liability company,
20 firm,or association.
21 £ "Personal Information"means any and all information,including any data,provided,or
22 to which access is provided,to the Contractor by or upon the authorization of the
23 County,under this Agreement,including but not limited to vital records,that: (i)
24 identifies,describes,or relates to,or is associated with,or is capable of being used to
25 identify,describe,or relate to,or associate with,a person(including,without
26 limitation,names,physical descriptions,signatures,addresses,telephone numbers,e-
27 mail addresses,education,financial matters,employment history,and other unique
28 identifiers,as well as statements made by or attributable to the person);(ii)is used or is
-17-
I capable of being used to authenticate a person(including,without limitation,employee
2 identification numbers,government-issued identification numbers,passwords or
3 personal identification numbers(PINs),financial account numbers,credit report
4 information,answers to security questions,and other personal identifiers); or(iii)is
5 personal information within the meaning of California Civil Code section 1798.3,
6 subdivision(a),or 1798.80,subdivision(e).Personal Information does not include
7 publicly available information that is lawfully made available to the general public
8 from federal,state,or local government records.
9 g. "Privacy Practices Complaint"means a complaint received by the County relating to
10 the Contractor's(or any Authorized Person's)privacy practices,or alleging a Security
11 Breach. Such complaint shall have sufficient detail to enable the Contractor to
12 promptly investigate and take remedial action under this Exhibit B.
13 h. "Privileged Information"means any and all information,including any data,provided,
14 or to which access is provided,to the Contractor by or upon the authorization of the
15 County or any attorney of the County,under this agreement,including but not limited
16 to any or all of the following:(i)records pertaining to pending litigation to which the
17 County is party,or to claims made pursuant to the Government Claims Act(Gov.
18 Code,Tit. 1,Div. 3.6,beginning with section 810),until the pending litigation or claim
19 has been finally adjudicated or otherwise settled,which are exempt from disclosure
20 under Government Code section 6254,subdivision(b);(ii)any information that is
21 subject to the attorney-client privilege,which includes but is not limited to a
22 "confidential communication between client and lawyer,"as that term is defined in
23 Evidence Code section 952,where the County is the client and any attorney of the
24 County is the lawyer,and the Contractor may be serving as a representative of the
25 County,as an intermediate representative for communication between the County and
26 any attorney of the County,or both;or(iii)both(i)and(ii).
27
28
-18-
I For purposes of a"confidential communication between client and lawyer"under this
2 Agreement,the Contractor is presumed to be present to further the interest of the
3 County in its consultation with an attorney of the County,reasonably necessary for the
4 transmission of the information or the accomplishment of the purpose for which the
5 attorney of the County is consulted,or both.
6 The Contractor acknowledges that the attorney-client privilege protecting Privileged
7 Information belongs to the County and may only be waived by the County's Board of
8 Supervisors,and may not be waived by any other County official.The Contractor has
9 no right or authority to waive the attorney-client privilege that belongs to the County.
10 i. "Security Safeguards"means physical,technical,administrative or organizational
11 security procedures and practices put in place by the Contractor(or any Authorized
12 Persons)that relate to the protection of the security,confidentiality,value,or integrity
13 of Personal Information. Security Safeguards shall satisfy the minimal requirements set
14 forth in section 3(C)of this Exhibit B.
15 j. "Security Breach"means(i)any act or omission that compromises either the security,
16 confidentiality,value,or integrity of any Personal Information or the Security
17 Safeguards,or(ii)any unauthorized Use,Disclosure,or modification of,or any loss or
18 destruction of,or any corruption of or damage to,any Personal Information.
19 k. "Use"or any derivative of that word means to receive,acquire,collect,apply,
20 manipulate,employ,process,transmit,disseminate,access,store,disclose,or dispose
21 of Personal Information.
22 2. Standard of Care
23 a. The Contractor acknowledges that,in the course of its engagement by the County
24 under this Agreement,the Contractor,or any Authorized Persons,may Use Personal
25 Information and Privileged Information only as permitted in this Agreement.
26 b. The Contractor acknowledges that Personal Information and Privileged Information is
27 deemed to be confidential information of,or owned by,the County(or persons from
28 whom the County receives or has received Personal Information)and is not
-19-
I confidential information of,or owned or by,the Contractor,or any Authorized Persons.
2 The Contractor further acknowledges that all right,title,and interest in or to the
3 Personal Information or the Privileged Information remains in the County(or persons
4 from whom the County receives or has received Personal Information or Privileged
5 Information)regardless of the Contractor's,or any Authorized Person's,Use of that
6 Personal Information or that Privileged Information.
7 C. The Contractor agrees and covenants in favor of the Country that the Contractor shall:
8 i. keep and maintain all Personal Information and all Privileged Information in
9 strict confidence,using such degree of care under this section 2 as is
10 reasonable and appropriate to avoid a Security Breach;
11 ii. Use Personal Information exclusively for the purposes for which the Personal
12 Information is made accessible to the Contractor pursuant to the terms of this
13 Exhibit B;
14 iii. Use Privileged Information exclusively for the purposes for which the
15 Privileged Information is made accessible to the Contractor pursuant to the
16 terms of this Exhibit B;
17 iv. not Use,Disclose,sell,rent,license,or otherwise make available Personal
18 Information or Privileged Information for the Contractor's own purposes or
19 for the benefit of anyone other than the County,without the County's express
20 prior written consent,which the County may give or withhold in its sole and
21 absolute discretion;
22 V. not,directly or indirectly,Disclose Personal Information to any person(an
23 "Unauthorized Third Party")other than Authorized Persons pursuant to this
24 Agreement,without the express prior written consent the Director;and
25 vi. not,directly or indirectly,Disclose Privileged Information to any person(an
26 "Unauthorized Third Party")other than Authorized Persons pursuant to this
27 Agreement,without the express prior written consent of the County's Board
28 of Supervisors.
-20-
I d. Notwithstanding the foregoing paragraph,in any case in which the Contractor believes
2 it,or any Authorized Person,is required to disclose Personal Information or Privileged
3 Information to government regulatory authorities,or pursuant to a legal proceeding,or
4 otherwise as may be required by applicable law,Contractor shall(i)immediately notify
5 the County of the specific demand for,and legal authority for the disclosure,including
6 providing County with a copy of any notice,discovery demand,subpoena,or order,as
7 applicable,received by the Contractor,or any Authorized Person,from any
8 government regulatory authorities,or in relation to any legal proceeding,and(ii)
9 promptly notify the County before such Personal Information is offered by the
10 Contractor for such disclosure so that the County may have sufficient time to obtain a
11 court order or take any other action the County may deem necessary to protect the
12 Personal Information or the Privileged Information from such disclosure,and the
13 Contractor shall cooperate with the County to minimize the scope of such disclosure of
14 such Personal Information or Privileged Information.
15 e. The Contractor shall remain liable to the County for the actions and omissions of any
16 Unauthorized Third Party concerning its Use of such Personal Information or
17 Privileged Information as if they were the Contractor's own actions and omissions.
18 3. Information Security
19 a. The Contractor covenants,represents and warrants to the County that the Contractor's
20 Use of Personal Information and Privileged Information under this Agreement does
21 and will at all times comply with all applicable federal,state,and local,privacy and
22 data protection laws,as well as all other applicable regulations and directives,
23 including but not limited to California Civil Code,Division 3,Part 4,Title 1.81
24 (beginning with section 1798.80),and the Song-Beverly Credit Card Act of 1971
25 (California Civil Code,Division 3,Part 4,Title 1.3,beginning with section 1747). If
26 the Contractor Uses credit,debit or other payment cardholder information,the
27 Contractor shall at all times remain in compliance with the Payment Card Industry
28 Data Security Standard("PCI DSS")requirements,including remaining aware at all
-21-
I times of changes to the PCI DSS and promptly implementing and maintaining all
2 procedures and practices as may be necessary to remain in compliance with the PCI
3 DSS,in each case,at the Contractor's sole cost and expense.
4 b. The Contractor covenants,represents and warrants to the County that,as of the
5 effective date of this Agreement,the Contractor has not received notice of any
6 violation of any privacy or data protection laws,as well as any other applicable
7 regulations or directives,and is not the subject of any pending legal action or
8 investigation by,any government regulatory authority regarding same.
9 C. Without limiting the Contractor's obligations under section 3(A)of this Exhibit B,the
10 Contractor's(or Authorized Person's)Security Safeguards shall be no less rigorous
11 than accepted industry practices and,at a minimum,include the following:
12 i. limiting Use of Personal Information and Privileged Information strictly to the
13 Contractor's and Authorized Persons'personnel,including technical and
14 administrative personnel,who are necessary for the Contractor's or
15 Authorized Persons'Use of the Personal Information or Privileged pursuant to
16 this Agreement;
17 ii. ensuring that all of the Contractor's connectivity to County computing
18 systems will only be through the County's security gateways and firewalls,
19 and only through security procedures approved upon the express prior written
20 consent of the Director;
21 iii. to the extent that they contain or provide access to Personal Information or
22 Privileged Information,(a)securing business facilities,data centers,paper
23 files,servers,back-up systems and computing equipment,operating systems,
24 and software applications,including,but not limited to,all mobile devices and
25 other equipment,operating systems,and software applications with
26 information storage capability;(b)employing adequate controls and data
27 security measures,both internally and externally,to protect(1)the Personal
28 Information and the Privileged Information from potential loss or
-22-
I misappropriation,or unauthorized Use,and(2)the County's operations from
2 disruption and abuse;(c)having and maintaining network,device application,
3 database and platform security;(d)maintaining authentication and access
4 controls within media,computing equipment,operating systems,and software
5 applications;and(e)installing and maintaining in all mobile,wireless,or
6 handheld devices a secure internet connection,having continuously updated
7 anti-virus software protection and a remote wipe feature always enabled,all of
8 which is subject to express prior written consent of the Director;
9 iv. encrypting all Personal Information at advance encryption standards of
10 Advanced Encryption Standards(AES)of 128 bit or higher when Personal
11 Information is(a)stored on any mobile devices,including but not limited to
12 hard disks,portable storage devices,or remote installation,or(b)transmitted
13 over public or wireless networks(the encrypted Personal Information must be
14 subject to password or pass phrase,and be stored on a secure server and
15 transferred by means of a Virtual Private Network(VPN)connection,or
16 another type of secure connection,all of which is subject to express prior
17 written consent of the Director);
18 V. strictly segregating Personal Information and Privileged Information from all
19 other information of the Contractor,including any Authorized Person,or
20 anyone with whom the Contractor or any Authorized Person deals so that
21 Personal Information and Privileged Information is not commingled with any
22 other types of information;
23 vi. having a patch management process including installation of all operating
24 system and software vendor security patches;
25 vii. maintaining appropriate personnel security and integrity procedures and
26 practices,including,but not limited to,conducting background checks of
27 Authorized Employees consistent with applicable law;and
28
-23-
I viii. providing appropriate privacy and information security training to Authorized
2 Employees.
3 d. During the term of each Authorized Employee's employment by the Contractor,the
4 Contractor shall cause such Authorized Employees to abide strictly by the Contractor's
5 obligations under this Exhibit B.The Contractor shall maintain a disciplinary process
6 to address any unauthorized Use of Personal Information or Privileged Information by
7 any Authorized Employee.
8 e. The Contractor shall,in a secure manner,backup daily,or more frequently if it is the
9 Contractor's practice to do so more frequently,Personal Information and Privileged
10 Information received from the County,and the County shall have immediate,real-time
11 access,at all times,to such backups via a secure,remote access connection provided by
12 the Contractor,through the Internet.
13 f. The Contractor shall provide the County with the name and contact information for
14 each Authorized Employee(including such Authorized Employee's work shift,and at
15 least one alternate Authorized Employee for each Authorized Employee during such
16 work shift)who shall serve as the County's primary security contact with the
17 Contractor and shall be available to assist the County twenty-four(24)hours per day,
18 seven(7)days per week as a contact in resolving the Contractor's and any Authorized
19 Persons' obligations associated with a Security Breach or a Privacy Practices
20 Complaint.
21 g. The Contractor shall not knowingly include or authorize any Trojan Horse,back door,
22 time bomb,drop dead device,worm,virus,or other code of any kind that may disable,
23 erase,display any unauthorized message within,or otherwise impair any County
24 computing system,with or without the intent to cause harm.
25 4. Security Breach Procedures
26 a. Immediately upon the Contractor's awareness or reasonable belief of a Security
27 Breach,the Contractor shall(i)notify the Director of the Security Breach,such notice
28 to be given first by telephone at the following telephone number,followed promptly by
-24-
I email at the following email address: (559)600-5900/incidents@fresnocountyca.gov
2 (which telephone number and email address the County may update by providing
3 notice to the Contractor),and(ii)preserve all relevant evidence(and cause any affected
4 Authorized Person to preserve all relevant evidence)relating to the Security Breach.
5 The notification shall include,to the extent reasonably possible,the identification of
6 each type and the extent of Personal Information,Privileged Information,or both,that
7 has been,or is reasonably believed to have been,breached,including but not limited to,
8 compromised,or subjected to unauthorized Use,Disclosure,or modification,or any
9 loss or destruction,corruption,or damage.
10 b. Immediately following the Contractor's notification to the County of a Security
11 Breach,as provided pursuant to section 4(A)of this Exhibit B,the Parties shall
12 coordinate with each other to investigate the Security Breach.The Contractor agrees to
13 fully cooperate with the County,including,without limitation:
14 i. assisting the County in conducting any investigation;
15 ii. providing the County with physical access to the facilities and operations
16 affected;
17 iii. facilitating interviews with Authorized Persons and any of the Contractor's
18 other employees knowledgeable of the matter;and
19 iv. making available all relevant records,logs,files,data reporting and other
20 materials required to comply with applicable law,regulation,industry
21 standards,or as otherwise reasonably required by the County.
22 To that end,the Contractor shall,with respect to a Security Breach,be solely
23 responsible,at its cost,for all notifications required by law and regulation,or deemed
24 reasonably necessary by the County,and the Contractor shall provide a written report
25 of the investigation and reporting required to the Director within 30 days after the
26 Contractor's discovery of the Security Breach.
27 C. County shall promptly notify the Contractor of the Director's knowledge,or reasonable
28 belief,of any Privacy Practices Complaint,and upon the Contractor's receipt of that
-25-
I notification,the Contractor shall promptly address such Privacy Practices Complaint,
2 including taking any corrective action under this Exhibit B,all at the Contractor's sole
3 expense,in accordance with applicable privacy rights,laws,regulations and standards.
4 In the event the Contractor discovers a Security Breach,the Contractor shall treat the
5 Privacy Practices Complaint as a Security Breach.Within 24 hours of the Contractor's
6 receipt of notification of such Privacy Practices Complaint,the Contractor shall notify
7 the County whether the matter is a Security Breach,or otherwise has been corrected
8 and the manner of correction or determined not to require corrective action and the
9 reason for that determination.
10 d. The Contractor shall take prompt corrective action to respond to and remedy any
11 Security Breach and take mitigating actions,including but not limiting to,preventing
12 any reoccurrence of the Security Breach and correcting any deficiency in Security
13 Safeguards as a result of such incident,all at the Contractor's sole expense,in
14 accordance with applicable privacy rights,laws,regulations and standards.The
15 Contractor shall reimburse the County for all reasonable costs incurred by the County
16 in responding to,and mitigating damages caused by,any Security Breach,including all
17 costs of the County incurred relation to any litigation or other action described section
18 4(E)of this Exhibit B.
19 e. The Contractor agrees to cooperate,at its sole expense,with the County in any
20 litigation or other action to protect the County's rights relating to Personal Information,
21 Privileged Information,or both,including the rights of persons from whom the County
22 receives Personal Information.
23 5. Oversight of Security Compliance
24 a. The Contractor shall have and maintain a written information security policy that
25 specifies Security Safeguards appropriate to the size and complexity of the
26 Contractor's operations and the nature and scope of its activities.
27 b. Upon the County's written request,to confirm the Contractor's compliance with this
28 Exhibit B,as well as any applicable laws,regulations and industry standards,the
-26-
I Contractor grants the County or,upon the County's election,a third party on the
2 County's behalf,permission to perform an assessment,audit,examination or review of
3 all controls in the Contractor's physical and technical environment in relation to all
4 Personal Information and Privileged Information that is Used by the Contractor
5 pursuant to this Agreement. The Contractor shall fully cooperate with such assessment,
6 audit or examination,as applicable,by providing the County or the third party on the
7 County's behalf,access to all Authorized Employees and other knowledgeable
8 personnel,physical premises,documentation,infrastructure and application software
9 that is Used by the Contractor for Personal Information,Privileged Information,or
10 both,pursuant to this Agreement.In addition,the Contractor shall provide the County
11 with the results of any audit by or on behalf of the Contractor that assesses the
12 effectiveness of the Contractor's information security program as relevant to the
13 security and confidentiality of Personal Information Used by the Contractor or
14 Authorized Persons during the course of this Agreement under this Exhibit B.
15 C. The Contractor shall ensure that all Authorized Persons who Use Personal Information,
16 Privileged Information,or both,agree to the same restrictions and conditions in this
17 Exhibit B.that apply to the Contractor with respect to such Personal Information and
18 Privileged Information by incorporating the relevant provisions of this Exhibit B into a
19 valid and binding written agreement between the Contractor and such Authorized
20 Persons,or amending any written agreements to provide same.
21 6. Return or Destruction of Personal Information.Upon the termination of this
22 Agreement,the Contractor shall,and shall instruct all Authorized Persons to,promptly
23 return to the County all Personal Information and all Privileged Information,whether
24 in written,electronic or other form or media,in its possession or the possession of such
25 Authorized Persons,in a machine readable form used by the County at the time of such
26 return,or upon the express prior written consent of the Director,securely destroy all
27 such Personal Information and all Privileged Information,and certify in writing to the
28 County that such Personal Information and Privileged Information have been returned
-27-
I to the County or disposed of securely,as applicable.If the Contractor is authorized to
2 dispose of any such Personal Information or Privileged Information,as provided in this
3 Exhibit B,such certification shall state the date,time,and manner(including standard)
4 of disposal and by whom,specifying the title of the individual.The Contractor shall
5 comply with all reasonable directions provided by the Director with respect to the
6 return or disposal of Personal Information and Privileged Information and copies of
7 Personal Information and Privileged Information.If return or disposal of such Personal
8 Information or Privileged Information,or copies of Personal Information or Privileged
9 Information,is not feasible,the Contractor shall notify the County according,
10 specifying the reason,and continue to extend the protections of this Exhibit B to all
11 such Personal Information and Privileged Information,and copies of Personal
12 Information and Privileged Information.The Contractor shall not retain any copy of
13 any Personal Information or any Privileged Information after returning or disposing of
14 Personal Information and Privileged Information as required by this section 6.The
15 Contractor's obligations under this section 6 survive the termination of this Agreement
16 and apply to all Personal Information and Privileged Information that the Contractor
17 retains if return or disposal is not feasible and to all Personal Information and
18 Privileged Information that the Contractor may later discover in its possession or
19 control.
20 7. Equitable Relief. The Contractor acknowledges that any breach of its covenants or obligations
21 set forth in this Exhibit B may cause the County irreparable harm for which monetary damages
22 would not be adequate compensation and agrees that,in the event of such breach or threatened
23 breach,the County is entitled to seek equitable relief,including a restraining order,injunctive
24 relief,specific performance and any other relief that may be available from any court,in
25 addition to any other remedy to which the County may be entitled at law or in equity. Such
26 remedies shall not be deemed to be exclusive but shall be in addition to all other remedies
27 available to the County at law or in equity or under this Agreement.
28
-28-
1 8. Indemnity.The Contractor shall defend,indemnify and hold harmless the County,its officers,
2 employees,and agents,(each,a"County Indemnitee")from and against any and all
3 infringement of intellectual property including,but not limited to infringement of copyright,
4 trademark,and trade dress,invasion of privacy,information theft,and extortion,unauthorized
5 Use,Disclosure,or modification of,or any loss or destruction of,or any corruption of or
6 damage to,Personal Information or Privileged Information, Security Breach response and
7 remedy costs,credit monitoring expenses,forfeitures,losses,damages,liabilities,deficiencies,
8 actions,judgments,interest,awards,fines and penalties(including regulatory fines and
9 penalties),costs or expenses of whatever kind,including attorneys' fees and costs,the cost of
10 enforcing any right to indemnification or defense under this Exhibit B and the cost of pursuing
11 any insurance providers,arising out of or resulting from any third party claim or action against
12 any County Indemnitee in relation to the Contractor's,its officers,employees,or agents,or any
13 Authorized Employee's or Authorized Person's,performance or failure to perform under this
14 Exhibit B or arising out of or resulting from the Contractor's failure to comply with any of its
15 obligations under this section 8.The provisions of this section 8 do not apply to the sole acts or
16 omissions of the County.The provisions of this section 8 are cumulative to any other obligation
17 of the Contractor to,defend,indemnify,or hold harmless any County Indemnitee under this
18 Agreement.The provisions of this section 8 shall survive the termination of this Agreement.
19 9. Survival.The respective rights and obligations of the Contractor and the County as stated in this
20 Exhibit B shall survive the termination of this Agreement.
21 10. No Third-Party Beneficiary.Nothing express or implied in the provisions of in this Exhibit B is
22 intended to confer,nor shall anything in this Exhibit B confer,upon any person other than the
23 County or the Contractor and their respective successors or assignees,any rights,remedies,
24 obligations or liabilities whatsoever.
25 11. No County Warranty. The County does not make any warranty or representation whether any
26 Personal Information or Privileged Information in the Contractor's(or any Authorized Person's)
27 possession or control or Use by the Contractor(or any Authorized Person),pursuant to the terms
28
-29-
I of this Agreement is or will be secure from unauthorized Use,or a Security Breach or Privacy
2 Practices Complaint.
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-30-
I EXHIBIT C
2 Health Insurance Portability and Accountability Act(HIPAA)
3 1. The County is a"Covered Entity,"and the Attorney("Contractor")is a"Business Associate,"as
4 these terms are defined by 45 CFR 160.103.In connection with providing services under the Agreement,the
5 parties anticipate that the Contractor will create and/or receive Protected Health Information("PHI")from or on
6 behalf of the County.The parties enter into this Business Associate Agreement(BAA)to comply with the
7 Business Associate requirements of HIPAA,to govern the use and disclosures of PHI under this Agreement.
8 "HIPAA Rules"shall mean the Privacy, Security,Breach Notification,and Enforcement Rules at 45 CFR Parts
9 160 and 164.
10 The parties to this Agreement shall be in strict conformance with all applicable federal and State of
11 California laws and regulations,including,but not limited to California Welfare and Institutions Code sections
12 5328, 10850,and 14100.2 et seq.;42 CFR 2;42 CFR 431;California Civil Code section 56 et seq.;the Health
13 Insurance Portability and Accountability Act of 1996,as amended("HIPAA"),including,but not limited to,45
14 CFR Parts160,45 CFR 162,and 45 CFR 164;the Health Information Technology for Economic and Clinical
15 Health Act("HITECH")regarding the confidentiality and security of patient information,including,but not
16 limited to 42 USC 17901 et seq.;and the Genetic Information Nondiscrimination Act("GINA")of 2008
17 regarding the confidentiality of genetic information.
18 Except as otherwise provided in this Agreement,the Contractor,as a business associate of the County,
19 may use or disclose Protected Health Information("PHI")to perform functions,activities or services for or on
20 behalf of the County,as specified in this Agreement,provided that such use or disclosure shall not violate
21 HIPAA Rules.The uses and disclosures of PHI may not be more expansive than those applicable to the County,
22 as the"Covered Entity"under the HIPAA Rules,except as authorized for management,administrative or legal
23 responsibilities of the Contractor.
24 2. The Contractor,including its subcontractors and employees,shall protect from unauthorized
25 access,use,or disclosure of names and other identifying information,including genetic information,concerning
26 persons receiving services pursuant to this Agreement,except where permitted in order to carry out data
27 aggregation purposes for health care operations [45 CFR§§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A),and
28 164.504(e)(4)(i)]. This pertains to any and all persons receiving services pursuant to a County-funded program.
-31-
I This requirement applies to electronic PHI. The Contractor shall not use such identifying information or
2 genetic information for any purpose other than carrying out the Contractor's obligations under this Agreement.
3 3. The Contractor,including its subcontractors and employees,shall not disclose any such
4 identifying information or genetic information to any person or entity,except as otherwise specifically
5 permitted by this Agreement,authorized by Subpart E of 45 CFR Part 164 or other law,required by the
6 Secretary of the United States Department of Health and Human Services("Secretary"),or authorized by the
7 client/patient in writing. In using or disclosing PHI that is permitted by this Agreement or authorized by law,
8 the Contractor shall make reasonable efforts to limit PHI to the minimum necessary to accomplish intended
9 purpose of use,disclosure or request.
10 4. For purposes of the above sections,identifying information shall include,but not be limited to,
11 name,identifying number,symbol,or other identifying particular assigned to the individual, such as fingerprint
12 or voiceprint,or photograph.
13 5. For purposes of the above sections,genetic information shall include genetic tests of family
14 members of an individual or individual(s),manifestation of disease or disorder of family members of an
15 individual,or any request for or receipt of genetic services by individual or family members. Family member
16 means a dependent or any person who is first,second,third,or fourth degree relative.
17 6. The Contractor shall provide access,at the request of the County,and in the time and manner
18 designated by the County,to PHI in a designated record set(as defined in 45 CFR§ 164.501),to an individual
19 or to COUNTY in order to meet the requirements of 45 CFR§ 164.524 regarding access by individuals to their
20 PHI. With respect to individual requests,access shall be provided within thirty(30)days from request. Access
21 may be extended if the Contractor cannot provide access and provides the individual with the reasons for the
22 delay and the date when access may be granted. PHI shall be provided in the form and format requested by the
23 individual or the County.
24 The Contractor shall make any amendment(s)to PHI in a designated record set at the request of the
25 County or individual,and in the time and manner designated by the County in accordance with 45 CFR§
26 164.526.
27
28
-32-
I The Contractor shall provide to the County or to an individual,in a time and manner designated by the
2 County,information collected in accordance with 45 CFR§ 164.528,to permit the County to respond to a
3 request by the individual for an accounting of disclosures of PHI in accordance with 45 CFR§ 164.528.
4 7. The Contractor shall report to the County,in writing,any knowledge or reasonable belief that
5 there has been unauthorized access,viewing,use,disclosure,security incident,or breach of unsecured PHI not
6 permitted by this Agreement of which the Contractor becomes aware,immediately and without reasonable
7 delay and in no case later than two(2)business days of discovery. Immediate notification shall be made to the
8 County's Information Security Officer and Privacy Officer and the County's Department of Public Health
9 ("DPH")HIPAA Representative,within two(2)business days of discovery. The notification shall include,to
10 the extent possible,the identification of each individual whose unsecured PHI has been,or is reasonably
11 believed to have been,accessed,acquired,used,disclosed,or breached. The Contractor shall take prompt
12 corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure required by
13 applicable federal and State laws and regulations. The Contractor shall investigate such breach and is
14 responsible for all notifications required by law and regulation or deemed necessary by the County and shall
15 provide a written report of the investigation and reporting required to the County's Information Security Officer
16 and Privacy Officer and the County's DPH HIPAA Representative.
17 This written investigation and description of any reporting necessary shall be postmarked within the
18 thirty(30)working days of the discovery of the breach to the addresses below:
19 County of Fresno County of Fresno County of Fresno
20 Department of Public Health Department of Public Health Department of Internal Services
21 HIPAA Representative Privacy Officer Information Security Officer
22 (559)600-6439 (559)600-6405 (559)600-5800
23 P.O.Box 11867 P.O.Box 11867 2048 North Fine Street
24 Fresno,California 93775 Fresno,California 93775 Fresno,California 93727
25 8. The Contractor shall make its internal practices,books,and records relating to the use and
26 disclosure of PHI received from the County,or created or received by the Contractor on behalf of the County,in
27 compliance with Parts the HIPAA Rules. The Contractor shall make its internal practices,books,and records
28
-33-
I relating to the use and disclosure of PHI received from the County,or created or received by the Contractor on
2 behalf of the County,available to the Secretary upon demand.
3 The Contractor shall cooperate with the compliance and investigation reviews conducted by the Secretary. PHI
4 access to the Secretary must be provided during the Contractor's normal business hours;however,upon exigent
5 circumstances access at any time must be granted. Upon the Secretary's compliance or investigation review,if
6 PHI is unavailable to the Contractor and in possession of a subcontractor of the Contractor,the Contractor must
7 certify to the Secretary its efforts to obtain the information from the subcontractor.
8 9. Safeguards
9 The Contractor shall implement administrative,physical,and technical safeguards as required by the
10 HIPAA Security Rule, Subpart C of 45 CFR Part 164,that reasonably and appropriately protect the
11 confidentiality,integrity,and availability of PHI,including electronic PHI,that it creates,receives,maintains or
12 transmits on behalf of the County and to prevent unauthorized access,viewing,use,disclosure,or breach of PHI
13 other than as provided for by this Agreement. The Contractor shall conduct an accurate and thorough
14 assessment of the potential risks and vulnerabilities to the confidentiality,integrity and availability of electronic
15 PHI. The Contractor shall develop and maintain a written information privacy and security program that
16 includes administrative,technical and physical safeguards appropriate to the size and complexity of the
17 Contractor's operations and the nature and scope of its activities. Upon the County's request,the Contractor
18 shall provide the County with information concerning such safeguards.
19 The Contractor shall implement strong access controls and other security safeguards and precautions in
20 order to restrict logical and physical access to confidential,personal(e.g.,PHI)or sensitive data to authorized
21 users only. Said safeguards and precautions shall include the following administrative and technical password
22 controls for all systems used to process or store confidential,personal,or sensitive data:
23 A. Passwords must not be:
24 (1) Shared or written down where they are accessible or recognizable by anyone else,such
25 as taped to computer screens,stored under keyboards,or visible in a work area;
26 (2) A dictionary word;or
27 (3) Stored in clear text
28
-34-
I B. Passwords must be:
2 (1) Eight(8)characters or more in length;
3 (2) Changed every ninety(90)days;
4 (3) Changed immediately if revealed or compromised;and
5 (4) Composed of characters from at least three(3)of the following four(4)groups from
6 the standard keyboard:
7 a) Upper case letters(A-Z);
8 b) Lowercase letters(a-z);
9 c) Arabic numerals(0 through 9);and
10 d) Non-alphanumeric characters(punctuation symbols).
11 The Contractor shall implement the following security controls on each workstation or portable
12 computing device(e.g.,laptop computer)containing confidential,personal,or sensitive data:
13 1. Network-based firewall and/or personal firewall;
14 2. Continuously updated anti-virus software;and
15 3. Patch management process including installation of all operating system/software vendor
16 security patches.
17 The Contractor shall utilize a commercial encryption solution that has received FIPS 140-2 validation to
18 encrypt all confidential,personal,or sensitive data stored on portable electronic media(including,but not
19 limited to,compact disks and thumb drives)and on portable computing devices(including,but not limited to,
20 laptop and notebook computers).
21 The Contractor shall not transmit confidential,personal,or sensitive data via e-mail or other internet
22 transport protocol unless the data is encrypted by a solution that has been validated by the National Institute of
23 Standards and Technology(MIST)as conforming to the Advanced Encryption Standard(AES)Algorithm. The
24 Contractor must apply appropriate sanctions against its employees who fail to comply with these safeguards.
25 The Contractor must adopt procedures for terminating access to PHI when employment of employee ends.
26 10. Mitigation of Harmful Effects
27 The Contractor shall mitigate,to the extent practicable,any harmful effect that is suspected or known to
28 the Contractor of an unauthorized access,viewing,use,disclosure,or breach of PHI by the Contractor or its
-35-
I subcontractors in violation of the requirements of these provisions. The Contractor must document suspected
2 or known harmful effects and the outcome.
3 11. The Contractor's Subcontractors
4 The Contractor shall ensure that any of its contractors,including subcontractors,if applicable,to whom
5 the Contractor provides PHI received from or created or received by the Contractor on behalf of the County,
6 agree to the same restrictions,safeguards,and conditions.
7 that apply to the Contractor with respect to such PHI and to incorporate,when applicable,the relevant
8 provisions of these provisions into each subcontract or sub-award to such agents or subcontractors.
9 Nothing in this section 11 or this Exhibit G authorizes the Contractor to perform services under this
10 Agreement using subcontractors.
11 12. Employee Training and Discipline
12 The Contractor shall train and use reasonable measures to ensure compliance with the requirements of
13 these provisions by employees who assist in the performance of functions or activities on behalf of the County
14 under this Agreement and use or disclose PHI,and discipline such employees who intentionally violate any
15 provisions of these provisions,which may include termination of employment.
16 13. Termination for Cause
17 Upon the County's knowledge of a material breach of these provisions by the Contractor,the County will
18 either:
19 A. Provide an opportunity for the Contractor to cure the breach or end the violation,and
20 the County may terminate this Agreement if the Contractor does not cure the breach or
21 end the violation within the time specified by the County;or
22 B. Immediately terminate this Agreement if the Contractor has breached a material term
23 of this Exhibit G and cure is not possible,as determined by the County.
24 C. If neither cure nor termination is feasible,the County's Privacy Officer will report the
25 violation to the Secretary of the U.S.Department of Health and Human Services.
26 14. Judicial or Administrative Proceedings
27 The County may terminate this Agreement if: (1)the Contractor is found guilty in a criminal proceeding
28 for a violation of the HIPAA Privacy or Security Laws or the HITECH Act;or(2)there is a finding or
-36-
I stipulation in an administrative or civil proceeding in which the Contractor is a party that the Contractor has
2 violated a privacy or security standard or requirement of the HITECH Act,HIPAA or other security or privacy
3 laws.
4 15. Effect of Termination
5 Upon termination or expiration of this Agreement for any reason,the Contractor shall return or destroy
6 all PHI received from the County(or created or received by the Contractor on behalf of the County)that the
7 Contractor still maintains in any form,and shall retain no copies of such PHI. If return or destruction of PHI is
8 not feasible,the Contractor shall continue to extend the protections of these provisions to such information,and
9 limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. This
10 provision applies to PHI that is in the possession of subcontractors or agents,if applicable,of the Contractor. If
11 the Contractor destroys the PHI data,a certification of date and time of destruction shall be provided to the
12 County by the Contractor.
13 16. Compliance with Other Laws
14 To the extent that other state and/or federal laws provide additional, stricter and/or more protective privacy
15 and/or security protections to PHI or other confidential information covered under this BAA,the Contractor
16 agrees to comply with the more protective of the privacy and security standards set forth in the applicable state
17 or federal laws to the extent such standards provide a greater degree of protection and security than HIPAA
18 Rules or are otherwise more favorable to the individual.
19 17. Disclaimer
20 The County makes no warranty or representation that compliance by the Contractor with these
21 provisions,the HITECH Act,or the HIPAA Rules,will be adequate or satisfactory for the Contractor's own
22 purposes or that any information in the Contractor's possession or control,or transmitted or received by the
23 Contractor,is or will be secure from unauthorized access,viewing,use,disclosure,or breach. The Contractor is
24 solely responsible for all decisions made by the Contractor regarding the safeguarding of PHI.
25 18. Amendment
26 The parties acknowledge that Federal and State laws relating to electronic data security and privacy are
27 rapidly evolving and that amendment of this Exhibit G may be required to provide for procedures to ensure
28 compliance with such developments. The parties specifically agree to take such action as is necessary to amend
-37-
I this agreement in order to implement the standards and requirements of the HIPAA Rules,the HITECH Act and
2 other applicable laws relating to the security or privacy of PHI. The County may terminate this Agreement
3 upon thirty(30)days written notice in the event that the Contractor does not enter into an amendment providing
4 assurances regarding the safeguarding of PHI that the County in its sole discretion,deems sufficient to satisfy
5 the standards and requirements of the HIPAA Rules,and the HITECH Act.
6 19. No Third-Party Beneficiaries
7 Nothing expressed or implied in the provisions of this Exhibit G is intended to confer,and nothing in this
8 Exhibit G does confer,upon any person other than the County or the Contractor and their respective successors
9 or assignees,any rights,remedies,obligations or liabilities whatsoever.
10 20. Interpretation
11 The provisions of this Exhibit G shall be interpreted as broadly as necessary to implement and comply
12 with the HIPAA Rules,and applicable State laws. The parties agree that any ambiguity in the terms and
13 conditions of these provisions shall be resolved in favor of a meaning that complies and is consistent with the
14 HIPAA Rules.
15 21. Regulatory References
16 A reference in the terms and conditions of these provisions to a section in the HIPAA Rules means the
17 section as in effect or as amended.
18 22. Survival
19 The respective rights and obligations of the Contractor as stated in this Exhibit G survive the termination
20 or expiration of this Agreement.
21 23. No Waiver of Obligation
22 Change,waiver or discharge by the County of any liability or obligation of the Contractor
23 under this Exhibit G on any one or more occasions is not a waiver of performance of any continuing or other
24 obligation of the Contractor and does not prohibit enforcement by the County of any obligation on any other
25 occasion.
26
27
28
-38-
I EXHIBIT D
2 Self-Dealing Transaction Disclosure Form
3 In order to conduct business with the County of Fresno("County"),members of Attorney's board of
4 directors("County Contractor"),must disclose any self-dealing transactions that they are a party to while
5 providing goods,performing services,or both for the County.A self-dealing transaction is defined below:
6 "A self-dealing transaction means a transaction to which the corporation is a party and in which one or
7 more of its directors has a material financial interest."
8 The definition above will be used for purposes of completing this disclosure form.
9 Instructions
10 (1) Enter board member's name,job title(if applicable),and date this disclosure is being made.
11 (2) Enter the board member's company/agency name and address.
12 (3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the County.
13 At a minimum,include a description of the following:
14 a. The name of the agency/company with which the corporation has the transaction;and
15 b. The nature of the material financial interest in the Corporation's transaction that the
16 board member has.
17 (4) Describe in detail why the self-dealing transaction is appropriate based on applicable provisions
18 of the Corporations Code.
19 The form must be signed by the board member that is involved in the self-dealing transaction described
20 in Sections(3)and(4).
21
22
23
24
25
26
27
28
-39-
1 (1) Company Board Member Information:
2 Name: Date:
3 Job Title:
4 (2) Company/Agency Name and Address:
5
6
7
8 (3) Disclosure(Please describe the nature of the self-dealing transaction you are a part to)
9
10
11
12 (4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code§5233 a
13
14
15
16 (5) Authorized Signature:
17 Signature: Date:
18
19
20
21
22
23
24
25
26
27
28
-40-