HomeMy WebLinkAboutFully Executed A-25-048.pdf Agreement No. 25-048
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated February 11, 2025 and is between
3 ElanTech, Inc., a Maryland corporation ("Contractor"), and the County of Fresno, a political
4 subdivision of the State of California ("County").
5 Recitals
6 A. The County has a need for renewed licenses, annual maintenance, support, and hosting
7 services, for StatusNet911, a software solution for web-based hospital status reporting
8 communications.
9 B. The County previously entered into Agreement No. 20-059 with Contractor for continued
10 licensing, annual maintenance, support, and hosting for StatusNet911 from February 24, 2020,
11 through February 23, 2025. StatusNet911 allows hospital emergency departments and
12 Emergency Medical Services (EMS) dispatch centers throughout Fresno, Kings, Madera, and
13 Tulare counties to manage distribution of patients in disaster events, send alerts and
14 notifications between hospitals, and maintain daily hospital status information.
15 C. The County and the Contractor now desire to enter into an agreement through a
16 suspension of competition for the continued provision of StatusNet911 licenses, annual
17 maintenance, support, and hosting services.
18 The parties therefore agree as follows:
19 Article 1
20 Contractor's Services
21 1.1 Scope of Services. The Contractor shall perform all of the services provided in
22 Exhibit A to this Agreement, titled "Scope of Services."
23 1.2 Representation. The Contractor represents that it is qualified, ready, willing, and
24 able to perform all of the services provided in this Agreement.
25 1.3 Compliance with Laws. The Contractor shall, at its own cost, comply with all
26 applicable federal, state, and local laws and regulations in the performance of its obligations
27 under this Agreement, including but not limited to workers compensation, labor, and
28 confidentiality laws and regulations.
1
1 1.4 Data Security. The Contractor will follow present practices as outlined in Exhibit E.
2 1.5 HIPAA Compliance. The Contractor will follow present practices as outlined in
3 Exhibit F.
4 1.6 Automobiles. The Contractor will not use automobiles at any time in relation to
5 services provided under this Agreement.
6 Article 2
7 County's Responsibilities
8 2.1 The County shall provide a County representative who will serve as point of contact
9 for the Contractor in fulfillment of its duties under this Agreement ("County Representative").
10 The County Representative will be the Director of Internal Services/Chief Information Officer
11 ("CIO") and/or their designee.
12 2.2 The County shall contact the Contractor to request services as needed, as described
13 in Exhibit A.
14 Article 3
15 Compensation, Invoices, and Payments
16 3.1 The County agrees to pay, and the Contractor agrees to receive, compensation for
17 the performance of its services under this Agreement as described in Exhibit B to this
18 Agreement, titled "Compensation."
19 3.2 Maximum Compensation. The maximum compensation payable to the Contractor
20 is $135,632 for the initial three-year term of this Agreement, the total of which includes a twenty
21 percent buffer for any additional licenses and/or services the County may request from the
22 Contractor on an as-needed basis. In the event this Agreement is extended for its first optional
23 one-year extension ("Year 4"), the total compensation payable to the Contractor under this
24 Agreement will increase by $36,878. In the event this Agreement is extended for its final one-
25 year extension ("Year 5"), the total compensation payable to the Contractor under this
26 Agreement will increase by an additional $38,722. The total maximum compensation payable to
27 the Contractor under this Agreement is $211,232 for the entire possible five-year term as set
28 forth in Exhibit B. In the event the total maximum compensation amount in the Initial Term, Year
2
1 4, and/or Year 5 is not fully expended, the remaining unspent funding amounts shall roll over to
2 each subsequent term's established maximum compensation.
3 The Contractor acknowledges that the County is a local government entity, and does so with
4 notice that the County's powers are limited by the California Constitution and by State law, and
5 with notice that the Contractor may receive compensation under this Agreement only for
6 services performed according to the terms of this Agreement and while this Agreement is in
7 effect, and subject to the maximum amount payable under this section. The Contractor further
8 acknowledges that County employees have no authority to pay the Contractor except as
9 expressly provided in this Agreement.
10 3.3 Invoices. The Contractor shall submit annual invoices referencing the provided
11 agreement number to the County of Fresno, Internal Services Department, Attention: Business
12 Office, 333 W. Pontiac Way, Clovis, CA 93612, isdbusinessoffice(a�-fresnocountyca.go\ . The
13 Contractor shall submit each invoice within 60 days after the month in which the Contractor
14 performs services and in any case within 60 days after the end of the term or termination of this
15 Agreement.
16 3.4 Payment. The County shall pay each correctly completed and timely submitted
17 invoice within 45 days after receipt. The County shall remit any payment to the Contractor's
18 address specified in the invoice.
19 3.5 Incidental Expenses. The Contractor is solely responsible for all of its costs and
20 expenses that are not specified as payable by the County under this Agreement.
21 Article 4
22 Term of Agreement
23 4.1 Term. This Agreement is effective on February 24, 2025, and terminates on
24 February 23, 2028, ("Initial Term"), except as provided in section 4.2, "Extension," or Article 6,
25 "Termination and Suspension," below.
26 4.2 Extension. The term of this Agreement may be extended for no more than two, one-
27 year periods only upon written approval of both parties at least 30 days before the first day of
28 the next one-year extension period. The Director of Internal Services/Chief Information Officer
3
1 or other authorized County staff member acting in the same capacity, or his or her designee is
2 authorized to sign the written approval on behalf of the County based on the Contractor's
3 satisfactory performance. The extension of this Agreement by the County is not a waiver or
4 compromise of any default or breach of this Agreement by the Contractor existing at the time of
5 the extension whether or not known to the County.
6 Article 5
7 Notices
8 5.1 Contact Information. The persons and their addresses having authority to give and
9 receive notices provided for or permitted under this Agreement include the following:
10
For the County:
11 Director of Internal Services/Chief Information Officer
County of Fresno
12 333 W. Pontiac Way
Clovis, CA 93612
13 I3UUU1ILI . ,w„.;snocountyca.aov
14 For the Contractor:
Swati Allen
15 ElanTech, Inc.
6751 Columbia Gateway Drive, Suite 300
16 Columbia, MD 21046
contracts@elantech-inc.com
17
5.2 Change of Contact Information. Either party may change the information in section
18
5.1 by giving notice as provided in section 5.3.
19
5.3 Method of Delivery. Each notice between the County and the Contractor provided
20
for or permitted under this Agreement must be in writing, state that it is a notice provided under
21
this Agreement, and be delivered either by personal service, by first-class United States mail, by
22
an overnight commercial courier service, or by Portable Document Format (PDF) document
23
attached to an email.
24
(A) A notice delivered by personal service is effective upon service to the recipient.
25
(B) A notice delivered by first-class United States mail is effective three County
26
business days after deposit in the United States mail, postage prepaid, addressed to the
27
recipient.
28
4
1 (C)A notice delivered by an overnight commercial courier service is effective one
2 County business day after deposit with the overnight commercial courier service,
3 delivery fees prepaid, with delivery instructions given for next day delivery, addressed to
4 the recipient.
5 (D)A notice delivered by PDF document attached to an email is effective when
6 transmission to the recipient is completed (but, if such transmission is completed outside
7 of County business hours, then such delivery is deemed to be effective at the next
8 beginning of a County business day), provided that the sender maintains a machine
9 record of the completed transmission.
10 5.4 Claims Presentation. For all claims arising from or related to this Agreement,
11 nothing in this Agreement establishes, waives, or modifies any claims presentation
12 requirements or procedures provided by law, including the Government Claims Act (Division 3.6
13 of Title 1 of the Government Code, beginning with section 810).
14 Article 6
15 Termination and Suspension
16 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
17 contingent on the approval of funds by the appropriating government agency. If sufficient funds
18 are not allocated, then the County, upon at least 30 days' advance written notice to the
19 Contractor, may:
20 (A) Modify the services provided by the Contractor under this Agreement; or
21 (B) Terminate this Agreement.
22 6.2 Termination for Breach.
23 (A) Upon determining that a breach (as defined in paragraph (C) below) has
24 occurred, the County may give written notice of the breach to the Contractor. The written
25 notice may suspend performance under this Agreement, and must provide at least 30
26 days for the Contractor to cure the breach.
27 (B) If the Contractor fails to cure the breach to the County's satisfaction within the
28 time stated in the written notice, the County may terminate this Agreement immediately.
5
1 (C) For purposes of this section, a breach occurs when, in the determination of the
2 County, the Contractor has:
3 (1) Obtained or used funds illegally or improperly;
4 (2) Failed to comply with any part of this Agreement;
5 (3) Submitted a substantially incorrect or incomplete report to the County; or
6 (4) Improperly performed any of its obligations under this Agreement.
7 6.3 Termination without Cause. In circumstances other than those set forth above, the
8 County may terminate this Agreement by giving at least 30 days advance written notice to the
9 Contractor.
10 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
11 under this Article 6 is without penalty to or further obligation of the County.
12 6.5 County's Rights upon Termination. Upon termination for breach under this Article
13 6, the County may demand repayment by the Contractor of any monies disbursed to the
14 Contractor under this Agreement that, in the County's sole judgment, were not expended in
15 compliance with this Agreement. The Contractor shall promptly refund all such monies upon
16 demand. This section survives the termination of this Agreement.
17 Article 7
18 Independent Contractor
19 7.1 Status. In performing under this Agreement, the Contractor, including its officers,
20 agents, employees, and volunteers, is at all times acting and performing as an independent
21 contractor, in an independent capacity, and not as an officer, agent, servant, employee, joint
22 venturer, partner, or associate of the County.
23 7.2 Verifying Performance. The County has no right to control, supervise, or direct the
24 manner or method of the Contractor's performance under this Agreement, but the County may
25 verify that the Contractor is performing according to the terms of this Agreement.
26 7.3 Benefits. Because of its status as an independent contractor, the Contractor has no
27 right to employment rights or benefits available to County employees. The Contractor is solely
28 responsible for providing to its own employees all employee benefits required by law. The
6
1 Contractor shall save the County harmless from all matters relating to the payment of the
2 Contractor's employees, including compliance with Social Security withholding and all related
3 regulations.
4 7.4 Services to Others. The parties acknowledge that, during the term of this
5 Agreement, the Contractor may provide services to others unrelated to the County.
6 Article 8
7 Indemnity and Defense
8 8.1 Indemnity. The Contractor shall indemnify and hold harmless and defend the
9 County (including its officers, agents, employees, and volunteers) against all claims, demands,
10 injuries, damages, costs, expenses (including attorney fees and costs), fines, penalties, and
11 liabilities of any kind to the County, the Contractor, or any third party that arise from or relate to
12 the performance or failure to perform by the Contractor (or any of its officers, agents,
13 subcontractors, or employees) under this Agreement. The County may conduct or participate in
14 its own defense without affecting the Contractor's obligation to indemnify and hold harmless or
15 defend the County.
16 8.2 Survival. This Article 8 survives the termination of this Agreement.
17 Article 9
18 Insurance
19 9.1 The Contractor shall comply with all the insurance requirements in Exhibit D to this
20 Agreement.
21 Article 10
22 Inspections, Audits, and Public Records
23 10.1 Inspection of Documents. The Contractor shall make available to the County, and
24 the County may examine at any time during business hours and as often as the County deems
25 necessary, all of the Contractor's records and data with respect to the matters covered by this
26 Agreement, excluding attorney-client privileged communications. The Contractor shall, upon
27 request by the County, permit the County to audit and inspect all of such records and data to
28 ensure the Contractor's compliance with the terms of this Agreement.
7
1 10.2 State Audit Requirements. If the compensation to be paid by the County under this
2 Agreement exceeds $10,000, the Contractor is subject to the examination and audit of the
3 California State Auditor, as provided in Government Code section 8546.7, for a period of three
4 years after final payment under this Agreement. This section survives the termination of this
5 Agreement.
6 10.3 Public Records. The County is not limited in any manner with respect to its public
7 disclosure of this Agreement or any record or data that the Contractor may provide to the
8 County. The County's public disclosure of this Agreement or any record or data that the
9 Contractor may provide to the County may include but is not limited to the following:
10 (A) The County may voluntarily, or upon request by any member of the public or
11 governmental agency, disclose this Agreement to the public or such governmental
12 agency.
13 (B) The County may voluntarily, or upon request by any member of the public or
14 governmental agency, disclose to the public or such governmental agency any record or
15 data that the Contractor may provide to the County, unless such disclosure is prohibited
16 by court order.
17 (C)This Agreement, and any record or data that the Contractor may provide to the
18 County, is subject to public disclosure under the Ralph M. Brown Act (California
19 Government Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
20 (D)This Agreement, and any record or data that the Contractor may provide to the
21 County, is subject to public disclosure as a public record under the California Public
22 Records Act (California Government Code, Title 1, Division 10, Chapter 3, beginning
23 with section 7920.200) ("CPRA").
24 (E) This Agreement, and any record or data that the Contractor may provide to the
25 County, is subject to public disclosure as information concerning the conduct of the
26 people's business of the State of California under California Constitution, Article 1,
27 section 3, subdivision (b).
28
8
1 (F) Any marking of confidentiality or restricted access upon or otherwise made with
2 respect to any record or data that the Contractor may provide to the County shall be
3 disregarded and have no effect on the County's right or duty to disclose to the public or
4 governmental agency any such record or data.
5 10.4 Public Records Act Requests. If the County receives a written or oral request
6 under the CPRA to publicly disclose any record that is in the Contractor's possession or control,
7 and which the County has a right, under any provision of this Agreement or applicable law, to
8 possess or control, then the County may demand, in writing, that the Contractor deliver to the
9 County, for purposes of public disclosure, the requested records that may be in the possession
10 or control of the Contractor. Within five business days after the County's demand, the
11 Contractor shall (a) deliver to the County all of the requested records that are in the Contractor's
12 possession or control, together with a written statement that the Contractor, after conducting a
13 diligent search, has produced all requested records that are in the Contractor's possession or
14 control, or (b) provide to the County a written statement that the Contractor, after conducting a
15 diligent search, does not possess or control any of the requested records. The Contractor shall
16 cooperate with the County with respect to any County demand for such records. If the
17 Contractor wishes to assert that any specific record or data is exempt from disclosure under the
18 CPRA or other applicable law, it must deliver the record or data to the County and assert the
19 exemption by citation to specific legal authority within the written statement that it provides to
20 the County under this section. The Contractor's assertion of any exemption from disclosure is
21 not binding on the County, but the County will give at least 10 days' advance written notice to
22 the Contractor before disclosing any record subject to the Contractor's assertion of exemption
23 from disclosure. The Contractor shall indemnify the County for any court-ordered award of costs
24 or attorney's fees under the CPRA that results from the Contractor's delay, claim of exemption,
25 failure to produce any such records, or failure to cooperate with the County with respect to any
26 County demand for any such records.
27
28
9
1 Article 11
2 Disclosure of Self-Dealing Transactions
3 11.1 Applicability. This Article 11 applies if the Contractor is operating as a corporation,
4 or changes its status to operate as a corporation.
5 11.2 Duty to Disclose. If any member of the Contractor's board of directors is party to a
6 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
7 "Self-Dealing Transaction Disclosure Form" (Exhibit C to this Agreement) and submitting it to
8 the County before commencing the transaction or immediately after.
9 11.3 Definition. "Self-dealing transaction" means a transaction to which the Contractor is
10 a party and in which one or more of its directors, as an individual, has a material financial
11 interest.
12 Article 12
13 General Terms
14 12.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
15 Agreement may not be modified, and no waiver is effective, except by written agreement signed
16 by both parties. The Contractor acknowledges that County employees have no authority to
17 modify this Agreement except as expressly provided in this Agreement.
18 12.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
19 under this Agreement without the prior written consent of the other party.
20 12.3 Governing Law. The laws of the State of California govern all matters arising from
21 or related to this Agreement.
22 12.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
23 County, California. The Contractor consents to California jurisdiction for actions arising from or
24 related to this Agreement, and, subject to the Government Claims Act, all such actions must be
25 brought and maintained in Fresno County.
26 12.5 Construction. The final form of this Agreement is the result of the parties' combined
27 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
28
10
1 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
2 against either party.
3 12.6 Days. Unless otherwise specified, "days" means calendar days.
4 12.7 Headings. The headings and section titles in this Agreement are for convenience
5 only and are not part of this Agreement.
6 12.8 Severability. If anything in this Agreement is found by a court of competent
7 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
8 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
9 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
10 intent.
11 12.9 Nondiscrimination. During the performance of this Agreement, the Contractor shall
12 not unlawfully discriminate against any employee or applicant for employment, or recipient of
13 services, because of race, religious creed, color, national origin, ancestry, physical disability,
14 mental disability, medical condition, genetic information, marital status, sex, gender, gender
15 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
16 all applicable State of California and federal statutes and regulation.
17 12.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
18 of the Contractor under this Agreement on any one or more occasions is not a waiver of
19 performance of any continuing or other obligation of the Contractor and does not prohibit
20 enforcement by the County of any obligation on any other occasion.
21 12.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
22 between the Contractor and the County with respect to the subject matter of this Agreement,
23 and it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
24 publications, and understandings of any nature unless those things are expressly included in
25 this Agreement. If there is any inconsistency between the terms of this Agreement without its
26 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
27 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
28 exhibits.
11
1 12.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
2 create any rights or obligations for any person or entity except for the parties.
3 12.13 Agent for Service of Process. The Contractor represents to County that the
4 Contractor's agent for service of process in California, and that such agent's address for
5 receiving such service of process in California, which information the Contractor shall maintain
6 with the office of the California Secretary of State, is as follows:
7 Northwest Registered Agent, Inc.
8 108NSTSTEN
9 Sacramento, CA, 95816
10 SACRAMENTO
11 The Contractor further represents to the County that if the Contractor changes its agent for
12 service of process in California, or the Contractor's agent for service of process in California
13 changes its address for receiving such service of process in California, which changed
14 information the Contractor shall maintain with the office of the California Secretary of State, the
15 Contractor shall give the County written notice thereof within five (5) calendar days thereof
16 pursuant to Article 5 of this Agreement.
17 12.14 Authorized Signature. The Contractor represents and warrants to the County that:
18 (A) The Contractor is duly authorized and empowered to sign and perform its
19 obligations under this Agreement.
20 (B) The individual signing this Agreement on behalf of the Contractor is duly
21 authorized to do so and his or her signature on this Agreement legally binds the
22 Contractor to the terms of this Agreement.
23 12.15 Electronic Signatures. The parties agree that this Agreement may be executed by
24 electronic signature as provided in this section.
25 (A) An "electronic signature" means any symbol or process intended by an individual
26 signing this Agreement to represent their signature, including but not limited to (1) a
27 digital signature; (2) a faxed version of an original handwritten signature; or (3) an
28
12
1 electronically scanned and transmitted (for example by PDF document) version of an
2 original handwritten signature.
3 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
4 equivalent to a valid original handwritten signature of the person signing this Agreement
5 for all purposes, including but not limited to evidentiary proof in any administrative or
6 judicial proceeding, and (2) has the same force and effect as the valid original
7 handwritten signature of that person.
8 (C)The provisions of this section satisfy the requirements of Civil Code section
9 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3,
10 Part 2, Title 2.5, beginning with section 1633.1).
11 (D) Each party using a digital signature represents that it has undertaken and
12 satisfied the requirements of Government Code section 16.5, subdivision (a),
13 paragraphs (1) through (5), and agrees that each other party may rely upon that
14 representation.
15 (E) This Agreement is not conditioned upon the parties conducting the transactions
16 under it by electronic means and either party may sign this Agreement with an original
17 handwritten signature.
18 12.16 Counterparts. This Agreement may be signed in counterparts, each of which is an
19 original, and all of which together constitute this Agreement.
20 [SIGNATURE PAGE FOLLOWS]
21
22
23
24
25
26
27
28
13
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
ELANTECH, INC. COUNTY OF FRESNO
3
4 �.
5 Swati Allen, President Ernest Buddy Mend Chairman o�the
6751 Columbia Gateway Drive, Suite 300 Board of Supervisors of the County of Fresno
6 Columbia, MD 21046
Attest:
7 Bernice E. Seidel
Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By:
10 Deputy
11 For accounting use only:
12 Org No.: 56201693
Account No.: 7309
13 Fund No.: 0001
Subclass No.:10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
14
Exhibit A
1 Scope of Services
2 A. SOFTWARE LICENSE
3 1. GRANT OF LICENSE
4 The Contractor grants to the County and the County accepts a non-exclusive, non-
5 transferable license to use SN911 WEB, that is subject to the terms and conditions set forth in
6 the Agreement.
7 2. SCOPE OF LICENSE
8 The license granted herein shall consist solely of the non-exclusive, non-transferrable
9 right of the County to operate the System Software in support of the County's Department of
10 Public Health and Authorized Facilities as shown below in this Exhibit A, Section O.
11 3. OWNERSHIP
12 The parties acknowledge and agree that, as between the Contractor and the County,
13 title and full ownership of all rights in and to the System Software, System Documentation, and
14 all other materials provided to the County by the Contractor under the terms of the Agreement
15 shall remain with the Contractor. The parties acknowledge and agree that, as between the
16 Contractor and the County, full ownership of all rights in and to all County data, whether in
17 magnetic or paper form, including without limitation printed output from the System, are the
18 exclusive property of the County.
19 4. POSSESSION, USE, AND UPDATE OF SOFTWARE
20 The County will use the System Software only for its own internal purposes and shall not
21 further sublicense the System Software. The Contractor may, at reasonable times, inspect the
22 County's premises and equipment to verify that the County is observing all of the terms and
23 conditions of this License. The Contractor may create, from time to time, updated versions of
24 the System Software and System Documentation and the Contractor shall make such System
25 Updates available to the County. All System Updates shall be licensed under the terms of the
26 Agreement. The County agrees to follow the prescribed instructions for updating System
27 Software and System Documentation provided to the County by the Contractor. The County
28 must authorize all System Updates in writing.
A-1
Exhibit A
1 5. TRANSFER OF SOFTWARE
2 The County shall not rent, lease, license, distribute, sell, transfer, or assign this License,
3 the System Software, or the System Documentation, or any of the information contained therein
4 other than County data, to any other person or entity, whether on a permanent or temporary
5 basis, and any attempt to do so will constitute a breach of the Agreement. No right or license is
6 granted under the Agreement for the use or other utilization of the licensed programs, directly or
7 indirectly, for the benefit of any other person or entity, except as provided in the Agreement.
8 6. POSSESSION AND USE OF SOURCE CODE
9 Source code and other material that results from custom programming by the Contractor
10 released to the County under this License shall be deemed to be the Contractor software,
11 subject to all of the terms and conditions of the License set forth in the Agreement. The scope of
12 the County's permitted use of the custom source code under this license shall be limited to
13 maintenance and support of the System Software. For purposes of this Section, the term
14 "maintenance and support" means correction of System Software errors and preparation of
15 System Software modifications and enhancements. If the County creates computer code in the
16 process of enhancing the System Software, that specific new code shall be owned by the
17 County, and may be used by County employees, officers, or agents for the County's own
18 internal business operations. However, if the County's enhancement results in the creation of a
19 derivative work from the System Software, the copyright to such derivative work shall be owned
20 by the Contractor and the County's rights to use such derivative work shall be limited to those
21 granted with respect to the System Software in this Exhibit A.
22 B. SERVICES TO BE PROVIDED BY THE CONTRACTOR TO THE COUNTY
23 1. DOCUMENTATION
24 The Contractor shall provide to the County SN911 WEB System Documentation, which
25 shall consist of electronic media files. The electronic media files must be printable using PC
26 software normally available at the County. The Contractor shall provide new System
27 Documentation corresponding to all new Software Upgrades. The County may print additional
28
A-2
Exhibit A
1 copies of all documentation. The County shall only use System Documentation for the purposes
2 identified within the Agreement.
3 C. SYSTEM MAINTENANCE AND SUPPORT BY THE CONTRACTOR
4 System maintenance and support includes System Updates as they are released by the
5 Contractor OR, including updates required as a result of Federal Regulatory Changes. The
6 Contractor will support day-to-day operation of the System as follows:
7 1. SUPPORT HOURS / SCOPE:
8 Provide unlimited technical assistance by phone during normal coverage hours (7:30
9 a.m. to 5:30 p.m. Pacific Standard Time (PST), Monday through Friday, except the Contractor
10 and the County holidays), toll-free telephone assistance to keep the System in, or restored to,
11 normal operating condition. The object of this support will be to answer specific questions
12 related to the System Software and the application thereof. Support provided under the
13 Agreement does not include training of new personnel (after initial staff is trained), operation of
14 hardware, or solving other hardware/software problems unrelated to the System Software
15 2. SUPPORT RESPONSE:
16 During the term of this Agreement, the Contractor will (a) correct any error or
17 malfunctions in the System as supplied by the Contractor, which prevent it from operating in
18 conformance with the Acceptance Test Criteria set forth in the Agreement or (b) provide a
19 commercially reasonable alternative that will conform to the Acceptance Test Criteria set forth in
20 the Agreement. If analysis by the Contractor indicates a reported problem is caused by a
21 reproducible error or malfunction in the then-current release of the System Software as supplied
22 and maintained by the Contractor that significantly impacts effective use of the System by the
23 County, the Contractor will, if the System is inoperable, as reported by the County, provide
24 continuous effort to correct the error or to resolve the problem by providing a circumvention.
25 In such cases, the Contractor will provide the County with corrective information, such as
26 corrective documentation and/or program code. The Contractor will endeavor to respond to the
27 County's service request no later than four (4) business hours from the time a call has been
28 received by the Contractor. In the event that a person with the necessary expertise is not
A-3
Exhibit A
1 available when the call is received, the Contractor will endeavor to respond to the service
2 request no later than within one (1) business day.
3 3. REMOTE VIRTUAL PRIVATE NETWORK (VPN) DIAGNOSTICS
4 a. Diagnostic or corrective actions necessary to restore proper SN911 WEB operation;
5 b. Diagnostic actions which attempt to identify the cause of system problem;
6 c. Correction of data file problems; and
7 d. SN911 WEB modifications
8 The Contractor product specialists will provide diagnostics via VPN on SN911 WEB. The
9 County will provide any required hardware, and equipment necessary at the County site for the
10 Contractor VPN support.
11 4. ERROR CORRECTION PROCESS
12 If, during the term of this Agreement, the County determines that software error(s) exist,
13 the County will first follow the error procedures specified in the System Documentation. If
14 following the error procedures does not correct the software error, the County shall immediately
15 notify the Contractor, setting forth the defects noted with specificity. Upon notification of a
16 reported software error, the Contractor shall have five (5) days to determine if any actual
17 software error(s) exist and, if so, endeavor to correct such software error(s). At the Contractor's
18 request, additional time to solve difficult problems will not be unreasonably withheld. Within
19 fifteen (15) days of correction, the County shall retest the System Software and report any other
20 software error(s).
21 5. TECHNICAL INFORMATION
22 The Contractor will provide technical information to the County as necessary and helpful.
23 Such information may cover areas such as SN911 WEB usage, third party software, and other
24 matters considered relevant to the County by the Contractor. Technical information will be
25 provided at the discretion of the Contractor, but will not be unreasonably withheld.
26 D. ADDITIONAL SYSTEM MAINTENANCE SERVICES BY CONTRACTOR
27 The Contractor may provide additional maintenance services ("Additional Maintenance
28 and Support Services" or "Additional Maintenance Services") at an additional charge. Charges
A-4
Exhibit A
1 will be as identified in Exhibit B of the Agreement; or, if not included in the Agreement, charges
2 will be at current prices in effect at the time goods or services are provided and will be subject to
3 the maximum compensation of the Agreement. Any Additional Maintenance and Support
4 Services requested by the County and determined by the Contractor to be billable by the
5 Contractor must be identified as a chargeable service prior to the service being performed, and
6 must be approved in writing in advance by the County's Contract Administrator. Additional
7 Maintenance Services include, but are not limited to, the following:
8 1. ADDITIONAL TRAINING
9 A specific amount of training is designated in the Agreement. Additional training at a
10 County facility is available upon request by the County at an additional charge under the terms
11 of the Agreement. Requests for additional training will be reviewed by the Contractor, and must
12 be requested in writing in advance by the County's Contract Administrator. Charges will be at
13 rates identified in Exhibit B.
14 2. DATA AND SYSTEM CORRRECTIONS
15 Data and System Corrections include any corrective actions accomplished by the
16 Contractor on-site or via VPN which are necessary due to County errors or unauthorized source
17 code or data access by the County. Unauthorized access to the data is defined as any County
18 editing of data through other than normal system usage as defined in System Documentation.
19 Unauthorized access to source code is defined as any County access whatsoever to System
20 source code. Services provided by the Contractor are not billable when they result from errors
21 caused by SN911 WEB or instruction provided by the Contractor.
22 3. CUSTOMER SITE VISITS
23 Site visits to the County sites, as may be requested in writing by the County and which
24 are within the scope of the project services, are available for reasons including, but not limited
25 to, (1) additional system training on hardware or software usage; (2) resolution of System
26 difficulties not resulting from actions by, or otherwise the responsibility of the Contractor; (3)
27 installation of Software Releases; and (4) assistance in equipment maintenance, movement, or
28 diagnosis. The Contractor will review site visits outside of the scope of project services , which
A-5
Exhibit A
1 the County's Contract Administer must request in writing in advance. Charges will be at rates
2 identified in the Agreement.
3 4. CUSTOM PROGRAMMING
4 Requests for supplemental programming or customization of system features not
5 covered under the Agreement are available to the County. The Contractor will review such
6 requests, which County's Contract Administrator, will be reviewed by the Contractor, and must
7 be requested in writing in advance by County's Contract Administrator. Charges will be at rates
8 identified in Exhibit B and are subject to the maximum compensation of the Agreement.
9 E. CONTRACTOR'S PROJECT COORDINATOR
10 Upon execution of the Agreement, the Contractor shall appoint a Project Coordinator
11 who will act as the primary contact person to interface with the County for, maintenance, and
12 support of SN911 WEB.
13 F. SYSTEM UPDATES AND NEW PRODUCTS
14 1. SYSTEM UPDATES
15 From time to time the Contractor will develop and provide System Updates to the County
16 for the County's licensed Contractor software. System Updates shall be subject to the terms and
17 conditions of the Agreement and shall be deemed licensed System Software hereunder and will
18 be made available to the County at no additional charge to the County. System Updates will be
19 made available to the County at the discretion of the Contractor but will not be unreasonably
20 withheld.
21 2. NEW PRODUCTS
22 The Contractor may from time to time release new software with capabilities
23 substantially different from or greater than the System Software ("New Products") and which
24 therefore do not constitute System Updates. These New Products will be made available to the
25 County at a cost not to exceed the Contractor's then standard rates for customers similarly
26 situated.
27 G. OPERATING SYSTEM UPDATES
28
A-6
Exhibit A
1 The application must run on an operating system (O/S) that is consistently and currently
2 supported by the operating system vendor. Applications under maintenance shall always be
3 within one
4 (1) year of current in regards to the O/S. Outdated or unsupported O/S will not be
5 implemented on the production network. The County will notify the Contractor when a critical
6 security patch is released. The Contractor will have thirty (30) days to ensure application can
7 perform in the updated environment. With approval from the Contractor, the County will apply
8 patches to both the operating system, and non-critical security subsystems as releases are
9 available from operating system vendors. The application shall perform in this environment. The
10 Contractor shall keep its software within 1 year of current in order to operate in this
11 environment. These patches include critical O/S updates and security patches.
12 H. ANTI-VIRUS MANAGEMENT
13 The County will actively run anti-virus management, where appropriate, on all application
14 servers and PCs. The application shall perform adequately while anti-virus management is
15 active.
16 I. ADHERE TO CHANGE CONTROL PROCESS
17 The Contractor must adhere to the County's Change Control Process, which shall be
18 provided to the Contractor in writing. The County employs a procedure to implement updates,
19 upgrades, and version releases to a system that is in production use. This forum allows ISD-IT
20 to inform staff(Help Desk, Network, Server, Database, Security, and Analysts) of upcoming
21 changes to a production system. The Contractor must inform ISD-IT a minimum of one (1)week
22 prior to any planned, non-emergency changes so that the Change Control Process may be
23 followed.
24 J. OTHER
25 Unless otherwise specified, for third-party software, the Contractor shall provide
26 standard documentation in electronic form (via the Internet or File Transfer Protocol (FTP)). The
27 System runs in a Local Area Network and Web environment. As such, the performance of the
28 System is directly related to, among other things: available network bandwidth, and the
A-7
Exhibit A
1 performance of other applications. For this reason, the Contractor makes no guarantees as to
2 System response time.
3 K. SOFTWARE HOSTING SERVICES
4 The Contractor shall select a reputable host for the server on which SN911 WEB is
5 hosted and from which access is to be provided to the County for Authorized Facilities. In the
6 event of a Security Breach, the Contractor will be liable for payment of or reimbursement to the
7 County for all remediation expenses, and any monetary losses up to the maximum Total
8 Agreement not-to-exceed amount. as set forth in Section VI. The Contractor will make every
9 reasonable effort to maintain a 99.9% up-time for the hosted SN911 WEB system. The
10 Contractor reserves the right to establish a monthly maintenance window for the purpose of
11 upgrading, patching, or modifying, or repairing portions of or the entire SN911 WEB
12 environment. The monthly window will be mutually agreed to in writing by the Contractor's
13 Project Coordinator.
14 L. SYSTEM RELIABILITY
15 "Downtime" shall be defined as System non-availability due to System Software error,
16 malfunction, or Deficiency in the Application Software, or due to System Maintenance activity
17 other than in accordance with the scheduling parameters set forth in this Agreement. Examples
18 of Downtime include, without limitation:
19 1. One (1) or more County facilities cannot access the System for reasons within the
20 Contractor's Control; or
21 2. Any functional Component of the System or Interface is not available and is within the
22 Contractor's control.
23 The County requires that there be no unscheduled Downtime for routine maintenance of
24 the Application Software. The County will accept occasional scheduled Downtime for significant
25 non-routine Updates and maintenance to be scheduled by the Contractor only with the County's
26 prior written approval and at County's discretion, exercised in good faith. Such scheduled
27 Downtime for nonroutine maintenance shall not occur more than four (4) times per year and
28 shall not last more than four (4) hours per occurrence. Non-routine maintenance includes such
A-8
Exhibit A
1 tasks as major System Software version Updates. The Contractor shall use its best efforts to
2 keep scheduled Downtime for non-routine maintenance to a minimum and if required, any
3 excess scheduled Downtime will be agreed to in writing in advance by the County.
4 M. PRIVACY REQUIREMENTS
5 The Contractor shall be responsible for the following privacy and security safeguards: 1.
6 To the extent required to carry out the assessment and authorization process and continuous
7 monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality
8 of any County data collected and stored by the Contractor, the Contractor shall afford the
9 County access as necessary at the Contractor's discretion, to the Contractor's facilities,
10 installations, technical capabilities, operations, documentation, records, and databases.
11 2. If new or unanticipated threats or hazards are discovered by either the County or the
12 Contractor, or if existing safeguards have ceased to function, the discoverer shall
13 immediately bring the situation to the attention of the other party.
14 3. The Contractor shall also comply with any additional privacy requirements provided by
15 the County.
16 4. During the term of the Agreement, the County has the right to perform manual or
17 automated audits, scans, reviews, or other inspections of Contractor's IT environment being
18 used to provide or facilitate services for the County. The Contractor shall be responsible for the
19 following privacy and security safeguards:
20 a. Other than for the Contractor's own use and purposes, the Contractor shall not
21 publish or disclose in any manner the details of any safeguards either designed or developed by
22 the Contractor under the Agreement, or otherwise provided by the County.
23 b. To the extent required to carry out a program of inspection to safeguard against
24 threats and hazards to the security, integrity, and confidentiality of the County data, the
25 Contractor shall afford the County access as necessary to the Contractor's facilities,
26 installations, technical capabilities, operations, documentation, records, and databases within 72
27 hours' request by the County. The program of inspection shall include, but is not limited to:
28 Authenticated and unauthenticated operating system/network vulnerability scans, authenticated
A-9
Exhibit A
1 and unauthenticated web application vulnerability scans, and authenticated and unauthenticated
2 database application vulnerability scans. Automated scans may be performed by County
3 personnel, or agents acting on behalf of the County, using County-operated equipment, and
4 County-specified tools.
5 Should the Contractor choose to run its own automated scans or audits, results from
6 these scans may, at the County's discretion, be accepted in lieu of County-performed
7 vulnerability scans. In these cases, scanning tools and their configuration shall be approved by
8 the County. In addition, the results of the Contractor conducted scans shall be provided in full to
9 the County.
10 N. PROTECTION OF INFORMATION
11 The Contractor shall be responsible for properly protecting all information used,
12 gathered, or developed as a result of work under the Agreement. The Contractor shall also
13 protect all the County data, equipment, etc. by treating such information as sensitive. It is
14 anticipated that this information will be gathered, created, and stored within the Primary Work
15 Location. Should the Contractor personnel remove any information from the Primary Work
16 Location, the Contractor shall protect such information to the same extent it would its own
17 proprietary data and/or company trade secrets. The use of any information subject to the
18 Privacy Act will be utilized in full accordance with all rules of conduct applicable to Privacy Act
19 Information.
20 The County will retain unrestricted rights to the County data. The County retains
21 ownership of any user created/loaded data and applications hosted on the Contractor's
22 infrastructure, as well as maintains he right to request full copies of these at any time. Data
23 processed and stored by the various applications within the network infrastructure contains
24 financial data, personally identifiable information (PII), and protected health information (PHI).
25 This data, PII, and PHI shall be protected against unauthorized access, disclosure, modification,
26 theft, or destruction. The Contractor shall ensure that the facilities housing the network
27 infrastructure are physically secure.
28
A-10
Exhibit A
1 The data must be available to the County upon request within one business day or within
2 the timeframe specified otherwise, and shall not be used for any other purpose other than that
3 specified herein. The Contractor shall provide requested data at no additional cost to the
4 County.
5 No data shall be released by the Contractor without the consent of the County in writing.
6 All requests for release must be submitted in writing to the County.
7 O. AUTHORIZED FACILITIES LIST
8 Authorized Facilities
9 Abbreviation Hospital/Emergency Response Address Facility
Dispatch Center Type
10 AH-H Adventist Medical Center— Hanford 115 Mall Drive FULL
Hanford, CA 93230
11 AH-R Adventist Medical Center— Reedley 372 W Cypress Ave FULL
12 Reedle , CA 93654
AH-S Adventist Medical Center—Selma 1141 Rose Ave FULL
13 Selma, CA 93622
CCEMSA Central California EMS Agency 1221 Fulton Street FULL
14 Fresno, CA 93721
CCMC Clovis Community Medical Center 2755 Herndon Ave FULL
15 Fresno, CA 93611
COLNGA Coalinga Regional Medical Center 1191 Phelps Ave FULL
16 Coalinga, CA 93210
COM Fresno EMS Communications Center 4555 E. Hamilton Ave. FULL
17 Fresno, CA 93702
CSCADU Fresno County Crisis Stabilization Center 4411 E. Kings Canyon Rd PARTIAL
18 —Adult Fresno, CA 93702
CSCYTH Fresno County Crisis Stabilization Center 4411 E. Kings Canyon Rd PARTIAL
19 —Youth Fresno, CA 93702
KAISER Kaiser Hospital 7300 N Fresno St FULL
20 Fresno, CA 93720
KPH Kings Public Health 330 Campus Drive FULL
21 Hanford, CA 93230
MPH Madera Public Health 200 W 4t" St FULL
22 Madera, CA 93637
RMC Community Regional Medical Center 2823 Fresno St FULL
23 Fresno, CA 93721
SAMC Saint Agnes Medical Center 1303 E Herndon Ave FULL
24 Fresno, CA 93711
VAH Veteran Administration Hospital 2615 E Clinton Ave FULL
25 Fresno, CA 93705
VCH Valley Children's Hospital 9300 Valley Children's Place FULL
26 Madera, CA 93638
27
28
A-11
Exhibit B
1 Compensation
2 The Contractor will be compensated for performance of its services under this
3 Agreement as provided in this Exhibit B. The Contractor is not entitled to any compensation
4 except as expressly provided in this Exhibit B.
5 The annual license and software fees are fixed for entire first year of this Agreement.
6 The remaining four years are subject to a potential five percent increase or the cumulative
7 percentage increase in the Consumer Price Index per term year. The ISD Director/CIO has the
8 authority to approve one price increase up to a maximum of five percent or the cumulative
9 percentage increase in the Consumer Price Index per term year. Any planned price increase
10 must be approved by the County at least 30 days before the increase goes into effect, not to
11 exceed five percent or the cumulative percentage increase in the Consumer Price Index and
12 remains subject to the total maximum compensation of the Agreement.
13 Additional fees shall only be paid to the Contractor for if any such optional services set
14 forth herein are performed by the Contractor upon the County's written request.
15 ANNUAL LICENSE AND SOFTWARE FEES
16 YEAR TERM DATES COST
17 YEAR 1 02/24/2025-02/23/2026 $31,856.00
18 YEAR 2 02/24/2026-02/23/2027 $31,856.00
19 YEAR 3 02/24/2027-02/23/2028 $31,856.00
20 YEAR 4 (Optional) 02/24/2028-02/23/2029 $31,856.00
21 YEAR 5 (Optional) 02/24/2029-02/23/2030 $31,856.00
22 20% Buffer for Optional Items &Funding for Potential 5% Increases $51,952.00
23 OPTIONAL SERVICES
24 On-Site Training Daily fees + travel & expenses +10% $850 per day
25 Customization Services Alteration requests by Department $125 per hour
26 Additional Fully Facility New Facility with unlimited users $2,500 per year
27 Additional Partial Facility New Facility with no users associated $600 per year
28
B-1
Exhibit C
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
C-1
Exhibit C
(1) Company Board Member Information:
Name: Date:
Job Title:
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
C-2
Exhibit D
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the Contractor or any third
parties, the Contractor, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than Two Million Dollars ($2,000,000) per occurrence and an annual aggregate of
Four Million Dollars ($4,000,000). This policy must be issued on a per occurrence basis.
Coverage must include products, completed operations, property damage, bodily injury,
personal injury, and advertising injury. The Contractor shall obtain an endorsement to
this policy naming the County of Fresno, its officers, agents, employees, and volunteers,
individually and collectively, as additional insureds, but only insofar as the operations
under this Agreement are concerned. Such coverage for additional insureds will apply as
primary insurance and any other insurance, or self-insurance, maintained by the County
is excess only and not contributing with insurance provided under the Contractor's
policy.
(B) Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(C) Employer's Liability. Employer's liability insurance with limits of not less than Five
Hundred Thousand Dollars ($500,000) per occurrence for bodily injury and for disease.
(D) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1)the retroactive date must
be prior to the date on which services began under this Agreement; (2) the Contractor
shall maintain the policy and provide to the County annual evidence of insurance for not
less than five years after completion of services under this Agreement; and (3) if the
policy is canceled or not renewed, and not replaced with another claims-made policy
with a retroactive date prior to the date on which services begin under this Agreement,
then the Contractor shall purchase extended reporting coverage on its claims-made
policy for a minimum of five years after completion of services under this Agreement.
(E) Technology Professional Liability (Errors and Omissions). Technology professional
liability (errors and omissions) insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence and in the aggregate. Coverage must encompass all of the
Contractor's obligations under this Agreement, including but not limited to claims
involving Cyber Risks.
(F) Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must cover the replacement value of damage to, alteration of, loss
of, or destruction of data that is in the care, custody, or control of the Contractor, not to
exceed the coverage limit of the Contractor's Cyber Liability Policy.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
D-1
Exhibit D
Party; (ii) data breach; (iii) breach of any of the Contractor's obligations under [identify
the Article 1, section 1.1-1.3, or Exhibit E containing data security obligations] of this
Agreement; (iv) system failure; (v) data recovery; (vi) failure to timely disclose data
breach or Security Breach; (vii) failure to comply with privacy policy; (viii) payment card
liabilities and costs; (ix) infringement of intellectual property, including but not limited to
infringement of copyright, trademark, and trade dress; (x) invasion of privacy, including
release of private information; (xi) information theft; (xii) damage to or destruction or
alteration of electronic information; (xiii) cyber extortion; (xiv) extortion related to the
Contractor's obligations under this Agreement regarding electronic information, including
Personal Information; (xv)fraudulent instruction; (xvi) funds transfer fraud; (xvii)
telephone fraud; (xviii) network security; (xix) data breach response costs, including
Security Breach response costs; (xx) regulatory fines and penalties related to the
Contractor's obligations under this Agreement regarding electronic information, including
Personal Information; and (xxi) credit monitoring expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the Contractor signs this Agreement,
and at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the Contractor shall deliver, or cause its
broker or producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th
Floor, Fresno, California 93721, or HRRiskManagement fresnocountyca.gov, and by
mail or email to the person identified to receive notices under this Agreement,
certificates of insurance and endorsements for all of the coverages required under this
Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; (2) the County, its officers, agents, employees, and
volunteers are not responsible for any premiums on the policy; and (3) the
Contractor has waived its right to recover from the County, its officers, agents,
employees, and volunteers any amounts paid under any insurance policy
required by this Agreement and that waiver does not invalidate the insurance
policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, that the County of Fresno, its officers, agents, employees, and
volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
Contractor's policy.
(iii) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
(iv) The technology professional liability insurance certificate must also state that
coverage encompasses all of the Contractor's obligations under this Agreement,
D-2
Exhibit D
including but not limited to claims involving Cyber Risks, as that term is defined in
this Agreement.
(v) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the Contractor.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the Contractor shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the Contractor shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the Contractor shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change. The County in its sole discretion may determine that
the failure of the Contractor or its insurer to timely provide a written notice required by
this paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the Contractor has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the Contractor shall deliver, or cause its broker or producer
to deliver, to the County's Risk Manager certificates of insurance and endorsements for
all of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The Contractor waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The Contractor is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the Contractor's waiver of subrogation under this paragraph is effective
whether or not the Contractor obtains such an endorsement.
(F) County's Remedy for Contractor's Failure to Maintain. If the Contractor fails to keep
in effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the Contractor. The County may offset such
charges against any amounts owed by the County to the Contractor under this
Agreement.
(G)Subcontractors. The Contractor shall require and verify that all subcontractors used by
the Contractor to provide services under this Agreement maintain insurance meeting all
D-3
Exhibit D
insurance requirements provided in this Agreement. This paragraph does not authorize
the Contractor to provide services under this Agreement using subcontractors
D-4
Exhibit E
Data Security
A. Definitions.
Capitalized terms used in this Exhibit E have the meanings set forth in this section A.
"Authorized Employees" means the Contractor's employees who have access to
Personal Information.
"Authorized Persons" means: (i) any and all Authorized Employees; and (ii) any and all of
the Contractor's subcontractors, representatives, agents, outsourcers, and consultants, and
providers of professional services to the Contractor, who have access to Personal Information and
are bound by law or in writing by confidentiality obligations sufficient to protect Personal Information
in accordance with the terms of this Exhibit E.
"Director" means the County's Director of Internal Services/Chief Information Officer or his
or her designee.
"Disclose" or any derivative of that word means to disclose, release, transfer, disseminate,
or otherwise provide access to or communicate all or any part of any Personal Information orally, in
writing, or by electronic or any other means to any person.
"Person" means any natural person, corporation, partnership, limited liability company,
firm, or association.
"Personal Information" means any and all information, including any data provided, or to
which access is provided, to the Contractor by or upon the authorization of the County, including
but not limited to vital records, that: (i) identifies, describes, or relates to, or is associated with, or is
capable of being used to identify, describe, or relate to, or associate with, a person (including,
without limitation, names, physical descriptions, signatures, addresses, telephone numbers, e-mail
addresses, education, financial matters, employment history, and other unique identifiers, as well
as statements made by or attributable to the person); (ii) is used or is capable of being used to
authenticate a person (including, without limitation, employee identification numbers, government-
issued identification numbers, passwords or personal identification numbers (PINs), financial
account numbers, credit report information, answers to security questions, and other personal
identifiers); or is personal information within the meaning of California Civil Code section 1798.3,
E-1
Exhibit E
subdivision (a), or 1798.80, subdivision (e). Personal Information does not include publicly
available information that is lawfully made available to the general public from federal, state, or
local government records.
"Privacy Practices Complaint" means a complaint received by the County relating to the
Contractor's (or any Authorized Person's) privacy practices, or alleging a Security Breach. Such
complaint shall have sufficient detail to enable the Contractor to promptly investigate and take
remedial action under this Exhibit E.
"Security Safeguards" means physical, technical, administrative, or organizational
security procedures and practices put in place by the Contractor(or any Authorized Persons)that
relate to the protection of the security, confidentiality, value, or integrity of Personal Information.
Security Safeguards shall satisfy the minimal requirements set forth in subsection C.(5)of this
Exhibit E.
"Security Breach" means (i) any act or omission that compromises either the security,
confidentiality, value, or integrity of any Personal Information or the Security Safeguards, or(ii) any
unauthorized Use, Disclosure, or modification of, or any loss or destruction of, or any corruption of
or damage to, any Personal Information.
"Use" or any derivative thereof means to receive, acquire, collect, apply, manipulate,
employ, process, transmit, disseminate, access, store, disclose, or dispose of Personal
Information.
B. Standard of Care.
(1)The Contractor acknowledges that, in the course of its engagement by the County
under this Agreement, the Contractor, or any Authorized Persons, may Use Personal Information
only as permitted in this Agreement.
(2)The Contractor acknowledges that Personal Information is deemed to be confidential
information of, or owned by, the County(or persons from whom the County receives or has
received Personal Information) and is not confidential information of, or owned or by, the
Contractor, or any Authorized Persons. The Contractor further acknowledges that all right, title, and
interest in or to the Personal Information remains in the County (or persons from whom the County
E-2
Exhibit E
receives or has received Personal Information) regardless of the Contractor's, or any Authorized
Person's, Use of that Personal Information.
(3)The Contractor agrees and covenants in favor of the County that the Contractor shall: (i)
keep and maintain all Personal Information in strict confidence, using such degree of care under
this Subsection B as is reasonable and appropriate to avoid a Security Breach; (ii) Use Personal
Information exclusively for the purposes for which the Personal Information is made accessible to
the Contractor pursuant to the terms of this Exhibit E; (iii) not Use, Disclose, sell, rent, license, or
otherwise make available Personal Information for the Contractor's own purposes or for the benefit
of anyone other than the County, without the County's express prior written consent, which the
County may give or withhold in its sole and absolute discretion; and (iv) not, directly or indirectly,
Disclose Personal Information to any person (an "Unauthorized Third Party") other than Authorized
Persons pursuant to this Agreement, without the Director's express prior written consent.
Notwithstanding the foregoing paragraph, in any case in which the Contractor believes it, or
any Authorized Person, is required to disclose Personal Information to government regulatory
authorities, or pursuant to a legal proceeding, or otherwise as may be required by applicable law,
the Contractor shall (a) immediately notify the County of the specific demand for, and legal
authority for the disclosure, including providing the County with a copy of any notice, discovery
demand, subpoena, or order, as applicable, received by the Contractor, or any Authorized Person,
from any government regulatory authorities, or in relation to any legal proceeding, and (b) promptly
notify the County before such Personal Information is offered by the Contractor for such disclosure
so that the County may have sufficient time to obtain a court order or take any other action the
County may deem necessary to protect the Personal Information from such disclosure, and the
Contractor shall cooperate with the County to minimize the scope of such disclosure of such
Personal Information.
The Contractor shall remain liable to the County for the actions and omissions of any
Unauthorized Third Party concerning its Use of such Personal Information as if they were the
Contractor's own actions and omissions.
C. Information Security.
E-3
Exhibit E
(1)The Contractor covenants, represents and warrants to the County that the Contractor's
Use of Personal Information under this Agreement does and shall at all times comply with all
federal, state, and local, privacy and data protection laws, as well as all other applicable regulations
and directives, including but not limited to California Civil Code, Division 3, Part 4, Title 1.81
(beginning with section 1798.80), and the Song-Beverly Credit Card Act of 1971 (California Civil
Code, Division 3, Part 4, Title 1.3, beginning with section 1747). If the Contractor Uses credit, debit,
or other payment cardholder information, the Contractor shall at all times remain in compliance with
the Payment Card Industry Data Security Standard ("PCI DSS") requirements, including remaining
aware at all times of changes to the PCI DSS and promptly implementing and maintaining all
procedures and practices as may be necessary to remain in compliance with the PCI DSS, in each
case, at the Contractor's sole cost and expense.
(2)The Contractor covenants, represents and warrants to the County that, as of the
Effective Date, the Contractor has not received notice of any violation of any privacy or data
protection laws, as well as any other applicable regulations or directives, and is not the subject of
any pending legal action or investigation by, any government regulatory authority regarding same.
(3)Without limiting the Contractor's obligations under subsection C.(1) of this Exhibit E, the
Contractor's (or Authorized Person's) Security Safeguards shall be no less rigorous than accepted
industry practices and, at a minimum, include the following: (i) limiting Use of Personal Information
strictly to the Contractor's and Authorized Persons' technical and administrative personnel who are
necessary for the Contractor's, or Authorized Persons', Use of the Personal Information pursuant
to this Agreement; (ii) ensuring that all of the Contractor's connectivity to the County computing
systems will only be through the County's security gateways and firewalls, and only through
security procedures approved upon the express prior written consent of the Director; (iii)to the
extent that they contain or provide access to Personal Information, (a) securing the Contractor's
business facilities, data centers, paper files, servers, back-up systems and computing equipment,
operating systems, and software applications, including, but not limited to, all mobile devices and
other equipment, operating systems, and software applications with information storage capability;
(b) employing adequate controls and data security measures with respect to the Contractor
E-4
Exhibit E
Facilities and Equipment), both internally and externally, to protect(1)the Personal Information
from potential loss or misappropriation, or unauthorized Use, and (2)the County's operations from
disruption and abuse; (c) having and maintaining network, device application, database and
platform security; (d) maintaining authentication and access controls within media, computing
equipment, operating systems, and software applications; and (e) installing and maintaining in all
mobile, wireless, or handheld devices a secure internet connection, having continuously updated
anti-virus software protection and a remote wipe feature always enabled, all of which is subject to
express prior written consent of the Director; (iv) encrypting all Personal Information at advance
encryption standards of Advanced Encryption Standards (AES)of 128 bit or higher(a) stored on
any mobile devices, including but not limited to hard disks, portable storage devices, or remote
installation, or(b)transmitted over public or wireless networks (the encrypted Personal Information
must be subject to password or pass phrase, and be stored on a secure server and transferred by
means of a Virtual Private Network (VPN) connection, or another type of secure connection, all of
which is subject to express prior written consent of the Director); (v) strictly segregating Personal
Information from all other information of the Contractor, including any Authorized Person, or
anyone with whom the Contractor or any Authorized Person deals so that Personal Information is
not commingled with any other types of information; (vi) having a patch management process
including installation of all operating system/software vendor security patches; (vii) maintaining
appropriate personnel security and integrity procedures and practices, including, but not limited to,
conducting background checks of Authorized Employees consistent with applicable law; and (viii)
providing appropriate privacy and information security training to Authorized Employees.
(4) During the term of each Authorized Employee's employment by the Contractor, the
Contractor shall cause such Authorized Employees to abide strictly by the Contractor's obligations
under this Exhibit E. The Contractor further agrees that it shall maintain a disciplinary process to
address any unauthorized Use of Personal Information by any Authorized Employees.
(5)The Contractor shall, in a secure manner, backup daily, or more frequently if it is the
Contractor's practice to do so more frequently, Personal Information received from the County, and
the County shall have immediate, real time access, at all times, to such backups via a secure,
E-5
Exhibit E
remote access connection provided by the Contractor, through the Internet.
(6)The Contractor shall provide the County with the name and contact information for each
Authorized Employee (including such Authorized Employee's work shift, and at least one alternate
Authorized Employee for each Authorized Employee during such work shift)who shall serve as the
County's primary security contact with the Contractor and shall be available to assist the County 24
hours per day, seven days per week as a contact in resolving the Contractor's and any Authorized
Persons' obligations associated with a Security Breach or a Privacy Practices Complaint.
D. Security Breach Procedures.
(1) Promptly, and without undue delay, upon the Contractor's confirmation of a Security
Breach, the Contractor shall (a) notify the Director of the Security Breach, such notice to be given
first by telephone at the following telephone number, followed promptly by email at the following
email address: (559) 600-5900/incidents(dfresnocountyca.gov (which telephone number and email
address the County may update by providing notice to the Contractor), and (b) preserve all relevant
evidence (and cause any affected Authorized Person to preserve all relevant evidence) relating to
the Security Breach. The notification shall include, to the extent reasonably possible, the
identification of each type and the extent of Personal Information that has been, or is reasonably
believed to have been, breached, including but not limited to, compromised, or subjected to
unauthorized Use, Disclosure, or modification, or any loss or destruction, corruption, or damage.
(2) Immediately following the Contractor's notification to the County of a Security Breach,
as provided pursuant to subsection D.(1) of this Exhibit E, the Parties shall coordinate with each
other to investigate the Security Breach. The Contractor agrees to fully cooperate with the County,
including, without limitation: (i) assisting the County in conducting any investigation; (ii) providing
the County with physical access to the facilities and operations affected; (iii)facilitating interviews
with Authorized Persons and any of the Contractor's other employees knowledgeable of the
matter; and (iv) making available all relevant records, logs, files, data reporting and other materials
required to comply with applicable law, regulation, industry standards, or as otherwise reasonably
required by the County. To that end, the Contractor shall, with respect to a Security Breach, be
solely responsible, at its cost, for all notifications required by law and regulation, and the Contractor
E-6
Exhibit E
shall provide a written report of the investigation and reporting required to the Director within 30
days after the Contractor's discovery of the Security Breach.
(3)The County shall promptly notify the Contractor of the Director's knowledge, or
reasonable belief, of any Privacy Practices Complaint, and upon the Contractor's receipt of
notification thereof, the Contractor shall promptly address such Privacy Practices Complaint,
including taking any corrective action under this Exhibit E, all at the Contractor's sole expense, in
accordance with applicable privacy rights, laws, regulations and standards. In the event the
Contractor discovers a Security Breach, the Contractor shall treat the Privacy Practices Complaint
as a Security Breach. Within 24 hours of the Contractor's receipt of notification of such Privacy
Practices Complaint, the Contractor shall notify the County whether the matter is a Security
Breach, or otherwise has been corrected and the manner of correction, or determined not to
require corrective action and the reason therefor.
(4)The Contractor shall take prompt corrective action to respond to and remedy any
Security Breach and take reasonable mitigating actions, including but not limiting to, preventing any
reoccurrence of the Security Breach and correcting any deficiency in Security Safeguards as a
result of such incident, all at the Contractor's sole expense, in accordance with applicable privacy
rights, laws, regulations and standards. The Contractor shall reimburse the County for all
reasonable costs incurred by the County in responding to, and mitigating damages caused by, any
Security Breach, including all costs of the County incurred in relation to any litigation or other action
described in subsection D.(4) of this Exhibit E to the extent applicable: (1)the cost of providing
affected individuals with credit monitoring services for a specific period not to exceed 12 months, to
the extent the incident could lead to a compromise of the data subject's credit or credit standing; (2)
call center support for such affected individuals for a specific period not to exceed 30 days; and (3)
the cost of any measures required under applicable laws.
E. Oversight of Security Compliance.
(1)The Contractor shall have and maintain a written information security policy that
specifies Security Safeguards appropriate to the size and complexity of the Contractor's operations
and the nature and scope of its activities.
E-7
Exhibit E
(2) Upon the County's written request, to confirm the Contractor's compliance with this
Exhibit E, as well as any applicable laws, regulations and industry standards, the Contractor grants
the County or, upon the County's election, a third party on the County's behalf, permission to
perform an assessment, audit, examination or review of all controls in the Contractor's physical and
technical environment in relation to all Personal Information that is Used by the Contractor pursuant
to this Agreement. The Contractor shall fully cooperate with such assessment, audit, or
examination, as applicable, by providing the County or the third party on the County's behalf,
access to all Authorized Employees and other knowledgeable personnel, physical premises,
documentation, infrastructure, and application software that is Used by the Contractor for Personal
Information pursuant to this Agreement. In addition, the Contractor shall provide the County with
the results of any audit by or on behalf of the Contractor that assesses the effectiveness of the
Contractor's information security program as relevant to the security and confidentiality of Personal
Information Used by the Contractor or Authorized Persons during the course of this Agreement
under this Exhibit E.
(3)The Contractor shall ensure that all Authorized Persons who Use Personal Information
agree to the same restrictions and conditions in this Exhibit E. that apply to the Contractor with
respect to such Personal Information by incorporating the relevant provisions of these provisions
into a valid and binding written agreement between the Contractor and such Authorized Persons,
or amending any written agreements to provide same.
F. Return or Destruction of Personal Information.
Upon the termination of this Agreement, the Contractor shall, and shall instruct all
Authorized Persons to, promptly return to the County all Personal Information, whether in written,
electronic or other form or media, in its possession or the possession of such Authorized Persons,
in a machine readable form used by the County at the time of such return, or upon the express
prior written consent of the Director, securely destroy all such Personal Information, and certify in
writing to the County that such Personal Information have been returned to the County or disposed
of securely, as applicable. If the Contractor is authorized to dispose of any such Personal
Information, as provided in this Exhibit E, such certification shall state the date, time, and manner
E-8
Exhibit E
(including standard) of disposal and by whom, specifying the title of the individual. The Contractor
shall comply with all reasonable directions provided by the Director with respect to the return or
disposal of Personal Information and copies thereof. If return or disposal of such Personal
Information or copies of Personal Information is not feasible, the Contractor shall notify the County
accordingly, specifying the reason, and continue to extend the protections of this Exhibit E to all
such Personal Information and copies of Personal Information. The Contractor shall not retain any
copy of any Personal Information after returning or disposing of Personal Information as required
by this section F. The Contractor's obligations under this section F survive the termination of this
Agreement and apply to all Personal Information that the Contractor retains if return or disposal is
not feasible and to all Personal Information that the Contractor may later discover.
G. Equitable Relief.
The Contractor acknowledges that any breach of its covenants or obligations set forth in
this Exhibit E may cause the County irreparable harm for which monetary damages would not be
adequate compensation and agrees that, in the event of such breach or threatened breach, the
County is entitled to seek equitable relief, including a restraining order, injunctive relief, specific
performance and any other relief that may be available from any court, in addition to any other
remedy to which the County may be entitled at law or in equity. Such remedies shall not be
deemed to be exclusive but shall be in addition to all other remedies available to the County at law
or in equity or under this Agreement.
H. Indemnification.
The Contractor shall defend, indemnify and hold harmless the County, its officers,
employees, and agents, (each, a "County Indemnitee")from and against any and all infringement
of intellectual property including, but not limited to infringement of copyright, trademark, and trade
dress, invasion of privacy, information theft, and extortion, unauthorized Use, Disclosure, or
modification of, or any loss or destruction of, or any corruption of or damage to, Personal
Information, Security Breach response and remedy costs, credit monitoring expenses, forfeitures,
losses, damages, liabilities, deficiencies, actions,judgments, interest, awards, fines, and penalties
(including regulatory fines and penalties), costs or expenses of whatever kind, including attorney's
E-9
Exhibit E
fees and costs, the cost of enforcing any right to indemnification or defense under the Agreement
and the cost of pursuing any insurance providers, arising out of or resulting from any third party
claim or action against any County Indemnitee in relation to the Contractor's, its officers,
employees, or agents, or any Authorized Employee's or Authorized Person's, performance or
failure to perform under this Exhibit E or arising out of or resulting from the Contractor's failure to
comply with any of its obligations under this section H. The provisions of this section H do not apply
to the acts or omissions of the County. The provisions of this section H are cumulative to any other
obligation of the Contractor to, defend, indemnify, or hold harmless any County Indemnity under
this Agreement. The provisions of this section H shall survive the termination of this Agreement.
I. Survival.
The respective rights and obligations of the Contractor and the County as stated in this
Exhibit E shall survive the termination of this Agreement.
J. No Third-Party Beneficiary.
Nothing express or implied in the provisions of in this Exhibit E is intended to confer, nor
shall anything herein confer, upon any person other than the County or the Contractor and their
respective successors or assignees, any rights, remedies, obligations, or liabilities whatsoever.
L. No County Warranty.
The County does not make any warranty or representation whether any Personal
Information in the Contractor's (or any Authorized Person's) possession or control, or Use by the
Contractor(or any Authorized Person), pursuant to the terms of this Agreement is or will be secure
from unauthorized Use, or a Security Breach or Privacy Practices Complaint.
E-10
Exhibit F
Health Insurance Portability and Accountability Act (HIPAA)
1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as
these terms are defined by 45 CFR 160.103. In connection with providing services under the
Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health
Information ("PHI")from or on behalf of the County. The parties enter into this Business Associate
Agreement (BAA)to comply with the Business Associate requirements of HIPAA, to govern the
use and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security,
Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164. The parties to this
Agreement shall be in strict conformance with all applicable federal and State of California laws
and regulations, including, but not limited to California Welfare and Institutions Code sections 5328,
10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431; California Civil Code section 56 et seq.; the
Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAX), including, but
not limited to, 45 CFR Parts160, 45 CFR 162, and 45 CFR 164; the Health Information Technology
for Economic and Clinical Health Act("HITECH") regarding the confidentiality and security of
patient information, including, but not limited to 42 USC 17901 et seq.; and the Genetic Information
Nondiscrimination Act ("GINA") of 2008 regarding the confidentiality of genetic information.
Except as otherwise provided in this Agreement, the Contractor, as a business
associate of the County, may use or disclose Protected Health Information ("PHI") to perform
functions, activities, or services for or on behalf of the County, as specified in this Agreement,
provided that such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of
PHI may not be more expansive than those applicable to the County, as the "Covered Entity"
under the HIPAA Rules, except as authorized for management, administrative or legal
responsibilities of the Contractor.
2. The Contractor, including its subcontractors and employees, shall protect from
unauthorized access, use, or disclosure of names and other identifying information, including
genetic information, concerning persons receiving services pursuant to this Agreement, except
where permitted in order to carry out data aggregation purposes for health care operations [45
CFR§§ 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all
persons receiving services pursuant to a County-funded program. This requirement applies to
electronic PHI. The Contractor shall not use such identifying information or genetic information for
any purpose other than carrying out the Contractor's obligations under this Agreement.
3. The Contractor, including its subcontractors and employees, shall not disclose any
such identifying information or genetic information to any person or entity, except as otherwise
specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law,
required by the Secretary of the United States Department of Health and Human Services
("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is
permitted by this Agreement or authorized by law, the Contractor shall make reasonable efforts to
limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure, or request.
4. For purposes of the above sections, identifying information shall include, but not be
limited to, name, identifying number, symbol, or other identifying particular assigned to the
individual, such as fingerprint or voiceprint, or photograph.
5. For purposes of the above sections, genetic information shall include genetic tests
of family members of an individual or individual(s), manifestation of disease or disorder of family
members of an individual, or any request for or receipt of genetic services by individual or family
F-1
Exhibit F
members. Family member means a dependent or any person who is first, second, third, or fourth
degree relative.
6. The Contractor shall provide access, at the request of the County, and in the time
and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR§
164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR § 164.524
regarding access by individuals to their PHI. With respect to individual requests, access shall be
provided within thirty (30) days from request. Access may be extended if the Contractor cannot
provide access and provides the individual with the reasons for the delay and the date when
access may be granted. PHI shall be provided in the form and format requested by the individual
or the County.
The Contractor shall make any amendment(s) to PHI in a designated record set
at the request of the County or individual, and in the time and manner designated by the County
in accordance with 45 CFR § 164.526.
The Contractor shall provide to the County or to an individual, in a time and
manner designated by the County, information collected in accordance with 45 CFR § 164.528,
to permit the County to respond to a request by the individual for an accounting of disclosures of
PHI in accordance with 45 CFR § 164.528.
7. The Contractor shall report to the County, in writing, any knowledge or
reasonable belief that there has been unauthorized access, viewing, use, disclosure, security
incident, or breach of unsecured PHI not permitted by this Agreement of which the Contractor
becomes aware, immediately and without reasonable delay and in no case later than two (2)
business days of discovery. Immediate notification shall be made to the County's Information
Security Officer and Privacy Officer and the County's Department of Public Health ("DPH")
HIPAA Representative, within two (2) business days of discovery. The notification shall include,
to the extent possible, the identification of each individual whose unsecured PHI has been, or is
reasonably believed to have been, accessed, acquired, used, disclosed, or breached. The
Contractor shall take prompt corrective action to cure any deficiencies and any action pertaining
to such unauthorized disclosure required by applicable federal and State laws and regulations.
The Contractor shall investigate such breach and is responsible for all notifications required by
law and regulation or deemed necessary by the County and shall provide a written report of the
investigation and reporting required to the County's Information Security Officer and Privacy
Officer and the County's DPH HIPAA Representative.
This written investigation and description of any reporting necessary shall be
postmarked within the thirty (30) working days of the discovery of the breach to the
addresses below:
County of Fresno County of Fresno County of Fresno
Department of Public Health Department of Public Health Department of Internal
HIPAA Representative Privacy Officer Services
(559) 600-6439 (559) 600-6405 Information Security Officer
P.O. Box 11867 P.O. Box 11867 (559) 600-5800
Fresno, California 93775 Fresno, California 93775 2048 North Fine Street
Fresno, California 93727
8. The Contractor shall make its internal practices, books, and records relating to
the use and disclosure of PHI received from the County, or created or received by the
F-2
Exhibit F
Contractor on behalf of the County, in compliance with Parts the HIPAA Rules. The Contractor
shall make its internal practices, books, and records relating to the use and disclosure of PHI
received from the County, or created or received by the Contractor on behalf of the County,
available to the Secretary upon demand.
The Contractor shall cooperate with the compliance and investigation reviews conducted
by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal
business hours; however, upon exigent circumstances access at any time must be granted.
Upon the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor
and in possession of a subcontractor of the Contractor, the Contractor must certify to the
Secretary its efforts to obtain the information from the subcontractor.
9. Safeguards
The Contractor shall implement administrative, physical, and technical safeguards as
required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI, including electronic
PHI, that it creates, receives, maintains or transmits on behalf of the County and to prevent
unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by
this Agreement. The Contractor shall conduct an accurate and thorough assessment of the
potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic
PHI. The Contractor shall develop and maintain a written information privacy and security
program that includes administrative, technical, and physical safeguards appropriate to the size
and complexity of the Contractor's operations and the nature and scope of its activities. Upon
the County's request, the Contractor shall provide the County with information concerning such
safeguards.
The Contractor shall implement strong access controls and other security safeguards
and precautions in order to restrict logical and physical access to confidential, personal (e.g.,
PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include
the following administrative and technical password controls for all systems used to process or
store confidential, personal, or sensitive data:
A. Passwords must not be:
(1) Shared or written down where they are accessible or recognizable by anyone
else; such as taped to computer screens, stored under keyboards, or visible
in a work area;
(2) A dictionary word; or
(3) Stored in clear text
B. Passwords must be:
(1) Eight (8) characters or more in length;
(2) Changed every ninety (90) days;
(3) Changed immediately if revealed or compromised; and
(4) Composed of characters from at least three (3) of the following four (4)
groups from the standard keyboard:
a) Upper case letters (A-Z);
b) Lowercase letters (a-z);
c) Arabic numerals (0 through 9); and
d) Non-alphanumeric characters (punctuation symbols).
F-3
Exhibit F
The Contractor shall implement the following security controls on each workstation or
portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
data:
1. Network-based firewall and/or personal firewall;
2. Continuously updated anti-virus software; and
3. Patch management process including installation of all operating system/software
vendor security patches.
The Contractor shall utilize a commercial encryption solution that has received FIPS
140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable
electronic media (including, but not limited to, compact disks and thumb drives) and on portable
computing devices (including, but not limited to, laptop and notebook computers).
The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or
other internet transport protocol unless the data is encrypted by a solution that has been
validated by the National Institute of Standards and Technology (NIST) as conforming to the
Advanced Encryption Standard (AES) Algorithm. The Contractor must apply appropriate
sanctions against its employees who fail to comply with these safeguards. The Contractor must
adopt procedures for terminating access to PHI when employment of employee ends.
10. Mitigation of Harmful Effects
The Contractor shall mitigate, to the extent practicable, any harmful effect that is
suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or
breach of PHI by the Contractor or its subcontractors in violation of the requirements of these
provisions. The Contractor must document suspected or known harmful effects and the
outcome.
11. The Contractor's Subcontractors
The Contractor shall ensure that any of its contractors, including subcontractors, if
applicable, to whom the Contractor provides PHI received from or created or received by the
Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions
that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the
relevant provisions of these provisions into each subcontract or sub-award to such agents or
subcontractors.
Nothing in this section 11 or this Exhibit F authorizes the Contractor to perform services
under this Agreement using subcontractors.
12. Employee Training and Discipline
The Contractor shall train and use reasonable measures to ensure compliance with the
requirements of these provisions by employees who assist in the performance of functions or
activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
such employees who intentionally violate any provisions of these provisions, which may include
termination of employment.
13. Termination for Cause
Upon the County's knowledge of a material breach of these provisions by the Contractor,
the County will either:
A. Provide an opportunity for the Contractor to cure the breach or end the
violation, and the County may terminate this Agreement if the Contractor does not cure the
breach or end the violation within the time specified by the County; or
F-4
Exhibit F
B. Immediately terminate this Agreement if the Contractor has breached a
material term of this Exhibit F and cure is not possible, as determined by the County.
C. If neither cure nor termination is feasible, the County's Privacy Officer will
report the violation to the Secretary of the U.S. Department of Health and Human Services.
14. Judicial or Administrative Proceedings
The County may terminate this Agreement if: (1) the Contractor is found guilty in a
criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or
(2) there is a finding or stipulation in an administrative or civil proceeding in which the Contractor
is a party that the Contractor has violated a privacy or security standard or requirement of the
HITECH Act, HIPAA or other security or privacy laws.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, the Contractor shall
return or destroy all PHI received from the County (or created or received by the Contractor on
behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of
such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend
the protections of these provisions to such information, and limit further use of such PHI to those
purposes that make the return or destruction of such PHI infeasible. This provision applies to
PHI that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the
Contractor destroys the PHI data, a certification of date and time of destruction shall be
provided to the County by the Contractor.
16. Compliance with Other Laws
To the extent that other state and/or federal laws provide additional, stricter and/or more
protective privacy and/or security protections to PHI or other confidential information covered
under this BAA, the Contractor agrees to comply with the more protective of the privacy and
security standards set forth in the applicable state or federal laws to the extent such standards
provide a greater degree of protection and security than HIPAA Rules or are otherwise more
favorable to the individual.
17. Disclaimer
The County makes no warranty or representation that compliance by the Contractor with
these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
Contractor's own purposes or that any information in the Contractor's possession or control, or
transmitted or received by the Contractor, is or will be secure from unauthorized access,
viewing, use, disclosure, or breach. The Contractor is solely responsible for all decisions made
by the Contractor regarding the safeguarding of PHI.
18. Amendment
The parties acknowledge that Federal and State laws relating to electronic data security
and privacy are rapidly evolving and that amendment of this Exhibit F may be required to
provide for procedures to ensure compliance with such developments. The parties specifically
agree to take such action as is necessary to amend this agreement in order to implement the
standards and requirements of the HIPAA Rules, the HITECH Act and other applicable laws
relating to the security or privacy of PHI. The County may terminate this Agreement upon thirty
(30) days written notice in the event that the Contractor does not enter into an amendment
providing assurances regarding the safeguarding of PHI that the County in its sole discretion,
deems sufficient to satisfy the standards and requirements of the HIPAA Rules, and the
F-5
Exhibit F
HITECH Act.
19. No Third-Party Beneficiaries
Nothing expressed or implied in the provisions of this Exhibit F is intended to confer, and
nothing in this Exhibit F does confer, upon any person other than the County or the Contractor
and their respective successors or assignees, any rights, remedies, obligations, or liabilities
whatsoever.
20. Interpretation
The provisions of this Exhibit F shall be interpreted as broadly as necessary to
implement and comply with the HIPAA Rules, and applicable State laws. The parties agree that
any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a
meaning that complies and is consistent with the HIPAA Rules.
21. Regulatory References
A reference in the terms and conditions of these provisions to a section in the HIPAA
Rules means the section as in effect or as amended.
22. Survival
The respective rights and obligations of the Contractor as stated in this Exhibit F survive
the termination or expiration of this Agreement.
23. No Waiver of Obligation
Change, waiver or discharge by the County of any liability or obligation of the Contractor
under this Exhibit F on any one or more occasions is not a waiver of performance of any
continuing or other obligation of the Contractor and does not prohibit enforcement by the County
of any obligation on any other occasion.
F-6