HomeMy WebLinkAboutAgreement A-25-337.pdf Agreement No. 25-337
1 SERVICE AGREEMENT
2 This Service Agreement ("Agreement") is dated July 8, 2025 and is between
3 USI Insurance Services, LLC, a New York corporation ("Contractor"), and the County of Fresno,
4 a political subdivision of the State of California ("County").
5 Recitals
6 WHEREAS, the County has a need for consulting services to assist the County with:
7 enhancing its employee health insurance and ancillary/voluntary benefit programs, developing
8 communication strategies and materials to boost employee awareness and utilization of health
9 insurance and ancillary/voluntary benefit programs, and complying with laws and regulations
10 applicable to employee health insurance and ancillary/voluntary benefit programs; and
11 WHEREAS, the County requires a broker of record for certain ancillary/voluntary benefits as
12 identified herein who will also administer requests for proposals ("RFP") or request for
13 quotations ("RFQ") for County-sponsored benefits, and ensure that vendors are in compliance
14 with the terms of their agreements; and
15 WHEREAS, the County issued RFP No. 25-054 for employee health and benefits consulting
16 services and Contractor submitted the most responsive bid; and
17 WHEREAS, County and Contractor wish to enter into an agreement where Contractor
18 provides services detailed in Exhibit A of this Agreement.
19 The parties therefore agree as follows:
20 Article 1
21 Contractor's Services
22 1.1 Scope of Services. The Contractor shall perform all of the services provided in
23 Exhibit A to this Agreement, titled "Scope of Services."
24 1.2 Representation. The Contractor represents that it is qualified, ready, willing, and
25 able to perform all of the services provided in this Agreement.
26 1.3 Compliance with Laws. The Contractor shall, at its own cost, comply with all
27 applicable federal, state, and local laws and regulations in the performance of its obligations
28 under this Agreement, including but not limited to workers compensation, labor, and
1
1 confidentiality laws and regulations.
2 1.4 HIPAA. The Contractor will follow present practices as outlined in Exhibit D.
3 1.5 Data Security. The Contractor will follow present practices as outlined in Exhibit E.
4 Article 2
5 County's Responsibilities
6 2.1 The County shall authorize its employee health insurance and ancillary/voluntary
7 benefit program vendors to provide Contractor with current health and benefits plan data and
8 necessary information as required for Contractor to provide the services described in Exhibit A
9 — Scope of Services, below.
10 2.2 The County shall assist Contractor in preparing the scope of services and any other
11 content, at County's discretion, related to health and ancillary/voluntary benefits RFP or RFQ
12 processes. The County shall provide final approval of any RFP or RFQ before release to
13 potential vendors.
14 2.3 The County shall make Contractor broker of record on all assignable
15 ancillary/voluntary benefits currently in place and will direct ancillary/voluntary commissions to
16 Contractor. Contractor shall credit any and all such commissions to County, pursuant to Article
17 3— Compensation, Invoices, and Payments, below.
18 Article 3
19 Compensation, Invoices, and Payments
20 3.1 The County agrees to pay, and the Contractor agrees to receive, compensation for
21 the performance of its services under this Agreement as described in this section.
22 3.2 Maximum Compensation. The maximum compensation payable to the Contractor
23 under this Agreement is
24 (A) For the 12-month period beginning July 12, 2025: $130,000.00
25 (B) For the 12-month period beginning July 12, 2026: $130,000.00
26 (C) For the 17-month and 20-day period beginning July 12, 2027: $191,114.13
27 (D) For the 12-month period beginning January 1, 2029 (if applicable): $140,000.00
28 (E) For the 12-month period beginning January 1, 2030 (if applicable): $150,000.00
2
1 The Contractor acknowledges that the County is a local government entity, and does
2 so with notice that the County's powers are limited by the California Constitution and by State
3 law, and with notice that the Contractor may receive compensation under this Agreement only
4 for services performed according to the terms of this Agreement and while this Agreement is in
5 effect, and subject to the maximum amount payable under this section. The Contractor further
6 acknowledges that County employees have no authority to pay the Contractor except as
7 expressly provided in this Agreement.
8 3.3 Performance Guarantees and Fees at Risk. Contractor agrees to place 10% of its
9 first year's annual compensation at risk if the County is not satisfied with Contractor's services.
10 Satisfaction with Contractor's performance is at the total discretion of the County.
11 3.4 Commissions. Contractor shall, on a quarterly basis, credit the County with all
12 commissions it receives from County's health and benefit plan vendors on all assignable
13 ancillary/voluntary benefits from all employer- and employee-paid benefits.
14 3.5 Invoices. The Contractor shall submit quarterly invoices to the County of Fresno
15 Department of Human Resources, pursuant to Article 5— Notices, below.
16 (A) The Contractor shall submit each invoice within 60 days after the quarter in which
17 the Contractor performs services and in any case within 60 days after the end of the term or
18 termination of this Agreement.
19 (B) Each quarterly invoice shall detail any credit due to the County pursuant to
20 Article 3.3— Performance Guarantees and Fees at Risk and Article 3.4— Commissions,
21 above. Invoices which do not include such applicable credits will not be paid by County.
22 (C)As the services commence on a date other than the first day of a calendar
23 quarter, the initial invoice shall be for the period of July 12, 2025, through and including
24 September 30, 2025. The prorated amount shall be calculated by dividing the full quarterly fee
25 by the total number of days in the quarter and multiplying by the number of days within the
26 period of July 12, 2025, through and including September 30, 2025.
27 (D) Following the initial prorated period, the Contractor shall issue invoices on a
28 quarterly basis, pursuant to Article 3.5(A), above. Each such invoice shall reflect the full
3
1 quarterly fee as set forth in this Agreement.
2 3.6 Payment. The County shall pay each correctly completed and timely submitted
3 invoice within 45 days after receipt. The County shall remit any payment to the Contractor's
4 address specified in the invoice.
5 3.7 Incidental Expenses. The Contractor is solely responsible for all of its costs and
6 expenses that are not specified as payable by the County under this Agreement.
7 Article 4
8 Term of Agreement
9 4.1 Term. This Agreement is effective on July 12, 2025 and terminates on December 31,
10 2028, except as provided in Article 4.2—Extension, or Article 6— Termination and
11 Suspension, below.
12 4.2 Extension. The term of this Agreement may be extended for no more than two, one-
13 year periods only upon written approval of both parties at least 30 days before the first day of
14 the next one-year extension period. The Director of Human Resources or his or her designee is
15 authorized to sign the written approval on behalf of the County based on the Contractor's
16 satisfactory performance. The extension of this Agreement by the County is not a waiver or
17 compromise of any default or breach of this Agreement by the Contractor existing at the time of
18 the extension whether or not known to the County.
19 Article 5
20 Notices
21 5.1 Contact Information. The persons and their addresses having authority to give and
22 receive notices provided for or permitted under this Agreement include the following:
23 For the County: For the Contractor:
24 Director of Human Resources Vice President
County of Fresno USI Insurance Services, LLC
25 2220 Tulare Street, 14th Floor 21250 Hawthorne Blvd., Suite 380
26 Fresno, CA 93721 Torrance, CA 90503
27 Email Address: HRBenefits(a�FresnoCountyCA.gov Email Address: loy.giblin(cDusi.com
Fax: (559)455-4787 Email Address: daniel.duzyk(cDusi.com
28
4
1 5.2 Change of Contact Information. Either party may change the information in Article
2 5.1 — Contact Information, above, by giving notice as provided in Article 5.3— Method of
3 Delivery, below.
4 5.3 Method of Delivery. Each notice between the County and the Contractor provided
5 for or permitted under this Agreement must be in writing, state that it is a notice provided under
6 this Agreement, and be delivered either by personal service, by first-class United States mail, by
7 an overnight commercial courier service, by telephonic facsimile transmission, or by Portable
8 Document Format (PDF) document attached to an email.
9 (A) A notice delivered by personal service is effective upon service to the recipient.
10 (B) A notice delivered by first-class United States mail is effective three County
11 business days after deposit in the United States mail, postage prepaid, addressed to the
12 recipient.
13 (C)A notice delivered by an overnight commercial courier service is effective one
14 County business day after deposit with the overnight commercial courier service, delivery fees
15 prepaid, with delivery instructions given for next day delivery, addressed to the recipient.
16 (D)A notice delivered by telephonic facsimile transmission or by PDF document
17 attached to an email is effective when transmission to the recipient is completed (but, if such
18 transmission is completed outside of County business hours, then such delivery is deemed to
19 be effective at the next beginning of a County business day), provided that the sender maintains
20 a machine record of the completed transmission.
21 5.4 Claims Presentation. For all claims arising from or related to this Agreement,
22 nothing in this Agreement establishes, waives, or modifies any claims presentation
23 requirements or procedures provided by law, including the Government Claims Act (Division 3.6
24 of Title 1 of the Government Code, beginning with section 810).
25 Article 6
26 Termination and Suspension
27 6.1 Termination for Non-Allocation of Funds. The terms of this Agreement are
28 contingent on the approval of funds by the appropriating government agency. If sufficient funds
5
1 are not allocated, then the County, upon at least 30 days' advance written notice to the
2 Contractor, may:
3 (A) Modify the services provided by the Contractor under this Agreement; or
4 (B) Terminate this Agreement.
5 6.2 Termination for Breach.
6 (A) Upon determining that a breach (as defined in paragraph (C) below) has
7 occurred, the County may give written notice of the breach to the Contractor. The written notice
8 may suspend performance under this Agreement, and must provide at least 30 days for the
9 Contractor to cure the breach.
10 (B) If the Contractor fails to cure the breach to the County's satisfaction within the
11 time stated in the written notice, the County may terminate this Agreement immediately.
12 (C) For purposes of this section, a breach occurs when, in the determination of the
13 County, the Contractor has:
14 (1) Obtained or used funds illegally or improperly;
15 (2) Failed to comply with any part of this Agreement;
16 (3) Submitted a substantially incorrect or incomplete report to the County; or
17 (4) Improperly performed any of its obligations under this Agreement.
18 6.3 Termination without Cause. In circumstances other than those set forth above, the
19 County may terminate this Agreement by giving at least 30 days advance written notice to the
20 Contractor.
21 6.4 No Penalty or Further Obligation. Any termination of this Agreement by the County
22 under this Article 6 is without penalty to or further obligation of the County.
23 6.5 County's Rights upon Termination. Upon termination for breach under this Article
24 6, the County may demand repayment by the Contractor of any monies disbursed to the
25 Contractor under this Agreement that, in the County's sole judgment, were not expended in
26 compliance with this Agreement. The Contractor shall promptly refund all such monies upon
27 demand. This section survives the termination of this Agreement.
28
6
1 Article 7
2 Independent Contractor
3 7.1 Status. In performing under this Agreement, the Contractor, including its officers,
4 agents, employees, and volunteers, is at all times acting and performing as an independent
5 contractor, in an independent capacity, and not as an officer, agent, servant, employee, joint
6 venturer, partner, or associate of the County.
7 7.2 Verifying Performance. The County has no right to control, supervise, or direct the
8 manner or method of the Contractor's performance under this Agreement, but the County may
9 verify that the Contractor is performing according to the terms of this Agreement.
10 7.3 Benefits. Because of its status as an independent contractor, the Contractor has no
11 right to employment rights or benefits available to County employees. The Contractor is solely
12 responsible for providing to its own employees all employee benefits required by law. The
13 Contractor shall save the County harmless from all matters relating to the payment of
14 Contractor's employees, including compliance with Social Security withholding and all related
15 regulations.
16 7.4 Services to Others. The parties acknowledge that, during the term of this
17 Agreement, the Contractor may provide services to others unrelated to the County.
18 Article 8
19 Indemnity and Defense
20 8.1 Indemnity. The Contractor shall indemnify and hold harmless and defend the
21 County (including its officers, agents, employees, and volunteers) against all claims, demands,
22 injuries, damages, costs, expenses (including attorney fees and costs), fines, penalties, and
23 liabilities of any kind to the County, the Contractor, or any third party that arise from or relate to
24 the performance or failure to perform by the Contractor (or any of its officers, agents,
25 subcontractors, or employees) under this Agreement. The County may conduct or participate in
26 its own defense without affecting the Contractor's obligation to indemnify and hold harmless or
27 defend the County.
28 8.2 Survival. This Article 8 survives the termination of this Agreement.
7
1 Article 9
2 Insurance
3 9.1 The Contractor shall comply with all the insurance requirements in Exhibit C to this
4 Agreement.
5 Article 10
6 Inspections, Audits, and Public Records
7 10.1 Inspection of Documents. The Contractor shall make available to the County, and
8 the County may examine at any time during business hours and as often as the County deems
9 necessary, all of the Contractor's records and data with respect to the matters covered by this
10 Agreement, excluding attorney-client privileged communications. The Contractor shall, upon
11 request by the County, permit the County to audit and inspect all of such records and data to
12 ensure the Contractor's compliance with the terms of this Agreement.
13 10.2 State Audit Requirements. If the compensation to be paid by the County under this
14 Agreement exceeds $10,000, the Contractor is subject to the examination and audit of the
15 California State Auditor, as provided in Government Code section 8546.7, for a period of three
16 years after final payment under this Agreement. This section survives the termination of this
17 Agreement.
18 10.3 Public Records. The County is not limited in any manner with respect to its public
19 disclosure of this Agreement or any record or data that the Contractor may provide to the
20 County. The County's public disclosure of this Agreement or any record or data that the
21 Contractor may provide to the County may include but is not limited to the following:
22 (A) The County may voluntarily, or upon request by any member of the public or
23 governmental agency, disclose this Agreement to the public or such governmental agency.
24 (B) The County may voluntarily, or upon request by any member of the public or
25 governmental agency, disclose to the public or such governmental agency any record or data
26 that the Contractor may provide to the County, unless such disclosure is prohibited by court
27 order.
28
8
1 (C)This Agreement, and any record or data that the Contractor may provide to the
2 County, is subject to public disclosure under the Ralph M. Brown Act (California Government
3 Code, Title 5, Division 2, Part 1, Chapter 9, beginning with section 54950).
4 (D)This Agreement, and any record or data that the Contractor may provide to the
5 County, is subject to public disclosure as a public record under the California Public Records
6 Act (California Government Code, Title 1, Division 7, Chapter 3.5, beginning with section 6250)
7 ("CPRA").
8 (E) This Agreement, and any record or data that the Contractor may provide to the
9 County, is subject to public disclosure as information concerning the conduct of the people's
10 business of the State of California under California Constitution, Article 1, section 3, subdivision
11 (b).
12 (F) Any marking of confidentiality or restricted access upon or otherwise made with
13 respect to any record or data that the Contractor may provide to the County shall be
14 disregarded and have no effect on the County's right or duty to disclose to the public or
15 governmental agency any such record or data.
16 10.4 Public Records Act Requests. If the County receives a written or oral request
17 under the CPRA to publicly disclose any record that is in the Contractor's possession or control,
18 and which the County has a right, under any provision of this Agreement or applicable law, to
19 possess or control, then the County may demand, in writing, that the Contractor deliver to the
20 County, for purposes of public disclosure, the requested records that may be in the possession
21 or control of the Contractor. Within five business days after the County's demand, the
22 Contractor shall (a) deliver to the County all of the requested records that are in the Contractor's
23 possession or control, together with a written statement that the Contractor, after conducting a
24 diligent search, has produced all requested records that are in the Contractor's possession or
25 control, or (b) provide to the County a written statement that the Contractor, after conducting a
26 diligent search, does not possess or control any of the requested records. The Contractor shall
27 cooperate with the County with respect to any County demand for such records. If the
28 Contractor wishes to assert that any specific record or data is exempt from disclosure under the
9
1 CPRA or other applicable law, it must deliver the record or data to the County and assert the
2 exemption by citation to specific legal authority within the written statement that it provides to
3 the County under this section. The Contractor's assertion of any exemption from disclosure is
4 not binding on the County, but the County will give at least 10 days' advance written notice to
5 the Contractor before disclosing any record subject to the Contractor's assertion of exemption
6 from disclosure. The Contractor shall indemnify the County for any court-ordered award of costs
7 or attorney's fees under the CPRA that results from the Contractor's delay, claim of exemption,
8 failure to produce any such records, or failure to cooperate with the County with respect to any
9 County demand for any such records.
10 Article 11
11 Disclosure of Self-Dealing Transactions
12 11.1 Applicability. This Article 11 applies if the Contractor is operating as a corporation,
13 or changes its status to operate as a corporation.
14 11.2 Duty to Disclose. If any member of the Contractor's board of directors is party to a
15 self-dealing transaction, he or she shall disclose the transaction by completing and signing a
16 "Self-Dealing Transaction Disclosure Form" (Exhibit B to this Agreement) and submitting it to the
17 County before commencing the transaction or immediately after.
18 11.3 Definition. "Self-dealing transaction" means a transaction to which the Contractor is
19 a party and in which one or more of its directors, as an individual, has a material financial
20 interest.
21 Article 12
22 General Terms
23 12.1 Modification. Except as provided in Article 6, "Termination and Suspension," this
24 Agreement may not be modified, and no waiver is effective, except by written agreement signed
25 by both parties. The Contractor acknowledges that County employees have no authority to
26 modify this Agreement except as expressly provided in this Agreement.
27 12.2 Non-Assignment. Neither party may assign its rights or delegate its obligations
28 under this Agreement without the prior written consent of the other party.
10
1 12.3 Governing Law. The laws of the State of California govern all matters arising from
2 or related to this Agreement.
3 12.4 Jurisdiction and Venue. This Agreement is signed and performed in Fresno
4 County, California. Contractor consents to California jurisdiction for actions arising from or
5 related to this Agreement, and, subject to the Government Claims Act, all such actions must be
6 brought and maintained in Fresno County.
7 12.5 Construction. The final form of this Agreement is the result of the parties' combined
8 efforts. If anything in this Agreement is found by a court of competent jurisdiction to be
9 ambiguous, that ambiguity shall not be resolved by construing the terms of this Agreement
10 against either party.
11 12.6 Days. Unless otherwise specified, "days" means calendar days.
12 12.7 Headings. The headings and section titles in this Agreement are for convenience
13 only and are not part of this Agreement.
14 12.8 Severability. If anything in this Agreement is found by a court of competent
15 jurisdiction to be unlawful or otherwise unenforceable, the balance of this Agreement remains in
16 effect, and the parties shall make best efforts to replace the unlawful or unenforceable part of
17 this Agreement with lawful and enforceable terms intended to accomplish the parties' original
18 intent.
19 12.9 Nondiscrimination. During the performance of this Agreement, the Contractor shall
20 not unlawfully discriminate against any employee or applicant for employment, or recipient of
21 services, because of race, religious creed, color, national origin, ancestry, physical disability,
22 mental disability, medical condition, genetic information, marital status, sex, gender, gender
23 identity, gender expression, age, sexual orientation, military status or veteran status pursuant to
24 all applicable State of California and federal statutes and regulation.
25 12.10 No Waiver. Payment, waiver, or discharge by the County of any liability or obligation
26 of the Contractor under this Agreement on any one or more occasions is not a waiver of
27 performance of any continuing or other obligation of the Contractor and does not prohibit
28 enforcement by the County of any obligation on any other occasion.
11
1 12.11 Entire Agreement. This Agreement, including its exhibits, is the entire agreement
2 between the Contractor and the County with respect to the subject matter of this Agreement,
3 and it supersedes all previous negotiations, proposals, commitments, writings, advertisements,
4 publications, and understandings of any nature unless those things are expressly included in
5 this Agreement. If there is any inconsistency between the terms of this Agreement without its
6 exhibits and the terms of the exhibits, then the inconsistency will be resolved by giving
7 precedence first to the terms of this Agreement without its exhibits, and then to the terms of the
8 exhibits.
9 12.12 No Third-Party Beneficiaries. This Agreement does not and is not intended to
10 create any rights or obligations for any person or entity except for the parties.
11 12.13 Authorized Signature. The Contractor represents and warrants to the County that:
12 (A) The Contractor is duly authorized and empowered to sign and perform its
13 obligations under this Agreement.
14 (B) The individual signing this Agreement on behalf of the Contractor is duly
15 authorized to do so and his or her signature on this Agreement legally binds the Contractor to
16 the terms of this Agreement.
17 12.14 Electronic Signatures. The parties agree that this Agreement may be executed by
18 electronic signature as provided in this section.
19 (A) An "electronic signature" means any symbol or process intended by an individual
20 signing this Agreement to represent their signature, including but not limited to (1) a digital
21 signature; (2) a faxed version of an original handwritten signature; or (3) an electronically
22 scanned and transmitted (for example by PDF document) version of an original handwritten
23 signature.
24 (B) Each electronic signature affixed or attached to this Agreement (1) is deemed
25 equivalent to a valid original handwritten signature of the person signing this Agreement for all
26 purposes, including but not limited to evidentiary proof in any administrative or judicial
27 proceeding, and (2) has the same force and effect as the valid original handwritten signature of
28 that person.
12
1 (C)The provisions of this section satisfy the requirements of Civil Code section
2 1633.5, subdivision (b), in the Uniform Electronic Transaction Act (Civil Code, Division 3, Part 2,
3 Title 2.5, beginning with section 1633.1).
4 (D) Each party using a digital signature represents that it has undertaken and
5 satisfied the requirements of Government Code section 16.5, subdivision (a), paragraphs (1)
6 through (5), and agrees that each other party may rely upon that representation.
7 (E) This Agreement is not conditioned upon the parties conducting the transactions
8 under it by electronic means and either party may sign this Agreement with an original
9 handwritten signature.
10 12.15 Counterparts. This Agreement may be signed in counterparts, each of which is an
11 original, and all of which together constitute this Agreement.
12 [SIGNATURE PAGE FOLLOWS]
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
13
1 The parties are signing this Agreement on the date stated in the introductory clause.
2
USI INSURANCE SERVICES, LLC COUNTY OF FRESNO
3
4 -
5 Joy(UJGibllin, VP Employee Benefits Ernest Buddy Mendes, Chairman of the
Board of Supervisors of the County of Fresno
6 21250 Torrance Blvd, Suite 380
Torrance, CA 90503 Attest:
7 Bernice E. Seidel
Clerk of the Board of Supervisors
8 County of Fresno, State of California
9
By:
10 Deputy
11 For accounting use only:
12 Org No.: 89250200
Account No.: 7295
13 Fund No.: 1060
Subclass No.: 10000
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
14
Exhibit A
1 Scope of Services
2 I. APPLICABLE BENEFITS
3 The benefits applicable to this Agreement include, but are not limited to:
4 1. Active Employee Health Insurance, including Health Insurance, Dental Insurance, Vision
5 Insurance, and Pharmacy Benefits.
6 2. Retiree Health Insurance, including Pre-65 Health Insurance, Medicare Advantage,
7 Medicare Supplemental (Part F), and Medicare Prescription Drug Plan.
8 3. Sections 125 & 132 Flexible Spending Accounts
9 4. Section 223 Health Savings Accounts
10 5. Employee Assistance Program
11 6. County Wellness Program
12 7. Basic Life and Accidental Death & Dismemberment Insurance
13 8. Long-term Disability Insurance
14 9. Accident Insurance
15 10. Critical Illness Insurance
16 11. Hospital Confinement Indemnity Insurance
17 12. Term Life Insurance
18 II. BENEFIT DESIGN
19 Contractor shall —
20 1. Provide an initial in-depth review of the design and benefit levels of the County's existing
21 benefits and provide an analysis to County detailing which benefits are proficient and the areas
22 that need enhancement.
23 2. Assist in the development of long-term plans to enhance and/or maintain proficiency of
24 County benefit plans.
25 3. Provide an annual assessment as to whether long-term objectives are being met.
26 4. Recommend wellness and disease management strategy with a focus on measuring the
27 return on investment of such efforts.
28
A-1
Exhibit A
1 III. COMMUNICATIONS
2 Contractor shall —
3 1. Assist in the development of long-term plans for the promotion of new and existing
4 benefits.
5 2. Assist in creation of benefit booklets, presentations, and other materials for Open
6 Enrollment.
7 3. Assist in the development of materials and programs to educate County employees
8 regarding their benefits.
9 4. Assist in creating materials to promote resources available through County-paid benefits,
10 such as the wellness and employee assistance programs, with the goal of increasing their
11 utilization by County employees.
12 5. Assist in the development and analysis of surveys to acquire employee feedback on the
13 performance of benefits and programs.
14 6. Assist in the preparation of materials required for labor negotiations including, but not
15 limited to, cost estimates for new or upgraded benefit programs, rate calculations, and written
16 material such as analyses, summaries, and graphs/spreadsheets.
17 IV. MEETING ATTENDANCE &AVAILABILITY
18 Contractor shall —
19 1. Make member(s) of its staff available during the County's regular business hours, which
20 are 8:00 a.m. to 5:00 p.m., Pacific Time, Monday through Friday, excluding holidays.
21 2. Return phone calls and provide responses to emails or written questions within 24 hours.
22 3. Meet with County staff virtually at least once per month to discuss industry, regulatory
23 and service issues, and at least twice per month July through October, regarding issues related
24 to Open Enrollment.
25 4. Attend virtual Health Benefits Advisory Committee (HBAC) meetings, up to eight (8)
26 times per year.
27 5. Attend, in-person, the County's annual Open Enrollment events for active and retired
28 employees. There are usually three (3) events scheduled on consecutive days in October, but
A-2
Exhibit A
1 consecutive days are not guaranteed.
2 6. Attend, in-person, SJVIA meetings, which are held in Fresno County or Tulare County
3 locations. The SJVIA Board meets up to six (6) times per year.
4 V. COMPLIANCE SUPPORT
5 Contractor shall —
6 1. Provide interpretation and guidance regarding all applicable state and federal laws and
7 regulations impacting County benefit plans, including but not limited to:
8 a. Patient Protection and Affordable Care Act (PPACA)
9 b. Family and Medical Leave Act (FMLA)
10 c. California Family Rights Act (CFRA)
11 d. Consolidated Omnibus Budget Reconciliation Act (COBRA)
12 e. Health Insurance Portability and Accountability Act (HIPAA)
13 f. Uniformed Services Employment Reemployment Rights Act (USERRA)
14 2. Notify the County, as far in advance as possible, of any proposed legislation and/or
15 regulations impacting County benefit plans, educate County staff of the content and impact, and
16 make recommendations to ensure compliance with such legislation and regulations.
17 3. Assist County staff with interpreting governing documents, including but not limited to
18 vendor contracts, plan documents, and policy certificates, and provide recommended actions,
19 where appropriate.
20 4. Review governing documents to ensure compliance with appropriate laws and
21 regulations and to ensure that the County is adhering to industry best practices.
22 5. Make recommendations regarding necessary amendments to the governing documents
23 and assist in preparing such amendments.
24 6. Assist County staff in revising existing administrative policies and procedures and
25 developing and implementing new administrative policies and procedures, to maintain
26 compliance with applicable laws and regulations and to ensure that County staff are functioning
27 as efficiently as possible.
28
A-3
Exhibit A
1 VI. VENDOR PROCUREMENT
2 Contractor shall —
3 1. Develop requests for proposals (RFP) and requests for quotations (RFQ) to procure
4 qualified vendors for the benefits detailed in the Applicable Benefits section of this Scope of
5 Services, above, in compliance with County purchasing requirements (if applicable).
6 2. Identify qualified vendors to whom the RFP/RFQ will be distributed.
7 3. Review and evaluate vendor responses to RFP/RFQ, present a summary of the results
8 to the County, and make finalist recommendations, if applicable.
9 4. Contact vendor references and schedule finalist interviews (if necessary).
10 5. Assist in negotiating service agreements with selected vendors.
11 6. Facilitate the transition to new vendor, if applicable.
12 VII.VENDOR MANAGEMENT
13 Contractor shall —
14 1. Conduct strategy meetings with vendors and County staff to discuss performance,
15 opportunities, and updates, no less than two (2) times per year, per vendor.
16 2. Ensure that vendors are in compliance with the terms of their agreement with the County
17 and monitor performance guarantees, if applicable.
18 3. Upon request of County staff or whenever appropriate, advocate on behalf of the County
19 to resolve problems and disputes with County vendors.
20 4. Analyze rates developed by the San Joaquin Valley Insurance Authority from an
21 independent actuary perspective.
22 5. Monitor insurance companies for financial solvency where applicable.
23 6. Act as broker of record for insurance policies as needed.
24
25
26
27
28
A-4
Exhibit B
Self-Dealing Transaction Disclosure Form
In order to conduct business with the County of Fresno ("County"), members of a
contractor's board of directors ("County Contractor"), must disclose any self-dealing transactions
that they are a party to while providing goods, performing services, or both for the County. A
self-dealing transaction is defined below:
"A self-dealing transaction means a transaction to which the corporation is a party and in
which one or more of its directors has a material financial interest."
The definition above will be used for purposes of completing this disclosure form.
Instructions
(1) Enter board member's name, job title (if applicable), and date this disclosure is being
made.
(2) Enter the board member's company/agency name and address.
(3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the
County. At a minimum, include a description of the following:
a. The name of the agency/company with which the corporation has the transaction;
and
b. The nature of the material financial interest in the Corporation's transaction that
the board member has.
(4) Describe in detail why the self-dealing transaction is appropriate based on applicable
provisions of the Corporations Code.
The form must be signed by the board member that is involved in the self-dealing
transaction described in Sections (3) and (4).
B-1
Exhibit B
(1) Company Board Member Information:
Name: N/A Date:
Job Title: N/A
(2) Company/Agency Name and Address:
(3) Disclosure (Please describe the nature of the self-dealing transaction you are a
party to)
(4) Explain why this self-dealing transaction is consistent with the requirements of
Corporations Code § 5233 (a)
(5) Authorized Signature
Signature: Date:
B-2
Exhibit C
Insurance Requirements
1. Required Policies
Without limiting the County's right to obtain indemnification from the Contractor or any third
parties, Contractor, at its sole expense, shall maintain in full force and effect the following
insurance policies throughout the term of this Agreement.
(A) Commercial General Liability. Commercial general liability insurance with limits of not
less than One Million Dollars ($1,000,000) per occurrence and an annual aggregate of
Two Million Dollars ($2,000,00), supplemented by an Umbrella policy, with limits of
$25,000,000 per occurrence and an annual aggregate of$25,000,000. This policy must
be issued on a per occurrence basis. Coverage must include products, completed
operations, property damage, bodily injury, personal injury, and advertising injury. The
Contractor shall provide an endorsement to this policy to cover the County of Fresno, its
officers, agents, employees, and volunteers, individually and collectively, as additional
insureds, but only insofar as the operations under this Agreement are concerned. Such
coverage for additional insureds will apply as primary insurance and any other
insurance, or self-insurance, maintained by the County is excess only and not
contributing with insurance provided under the Contractor's policy.
(B) Automobile Liability. Automobile liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for property damages.
Coverage must include any auto used in connection with this Agreement.
(C)Workers Compensation. Workers compensation insurance as required by the laws of
the State of California with statutory limits.
(D) Employer's Liability. Employer's liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence for bodily injury and for disease.
(E) Professional Liability. Professional liability insurance with limits of not less than One
Million Dollars ($1,000,000) per occurrence and an annual aggregate of Three Million
Dollars ($3,000,000). If this is a claims-made policy, then (1)the retroactive date must
be prior to the date on which services began under this Agreement; (2)the Contractor
shall maintain the policy and provide to the County annual evidence of insurance for not
less than five years after completion of services under this Agreement; and (3) if the
policy is canceled or not renewed, and not replaced with another claims-made policy
with a retroactive date prior to the date on which services begin under this Agreement,
then the Contractor shall purchase extended reporting coverage on its claims-made
policy for a minimum of five years after completion of services under this Agreement.
(F) Technology Professional Liability (Errors and Omissions). Technology and
professional liability (errors and omissions) insurance, as a combined policy, with limits
of not less than Two Million Dollars ($2,000,000) per occurrence and in the aggregate.
Coverage must encompass all of the Contractor's obligations under this Agreement,
including but not limited to claims involving Cyber Risks.
(G)Cyber Liability. Cyber liability insurance with limits of not less than Two Million Dollars
($2,000,000) per occurrence. Coverage must include claims involving Cyber Risks. The
cyber liability policy must be endorsed to cover the full replacement value of damage to,
C-1
Exhibit C
alteration of, loss of, or destruction of intangible property (including but not limited to
information or data) that is in the care, custody, or control of the Contractor.
Definition of Cyber Risks. "Cyber Risks" include but are not limited to (i) Security
Breach, which may include Disclosure of Personal Information to an Unauthorized Third
Party; (ii) data breach; (iii) system failure; (iv) data recovery; (v)failure to timely disclose
data breach or Security Breach; (vi) failure to comply with privacy policy; (vii) payment
card liabilities and costs; (viii) infringement of copyright, trademark, and trade dress; (ix)
invasion of privacy, including release of private information; (x) damage to or destruction
or alteration of electronic information; (xi) cyber extortion; (xii)fraudulent instruction; (xiii)
funds transfer fraud; (xiv) telephone fraud; (xv) network security; (xvi) data breach
response costs, including Security Breach response costs; (xx) regulatory fines and
penalties related to the Contractor's obligations under this Agreement regarding
electronic information, including Personal Information; and (xvii) credit monitoring
expenses.
2. Additional Requirements
(A) Verification of Coverage. Within 30 days after the Contractor signs this Agreement,
and at any time during the term of this Agreement as requested by the County's Risk
Manager or the County Administrative Office, the Contractor shall deliver, or cause its
broker or producer to deliver, to the County Risk Manager, at 2220 Tulare Street, 16th
Floor, Fresno, California 93721, or HRRiskManagement(cofresnocountyca.gov, and by
mail or email to the person identified to receive notices under this Agreement,
certificates of insurance and endorsements for all of the coverages required under this
Agreement.
(i) Each insurance certificate must state that: (1) the insurance coverage has been
obtained and is in full force; and (2) the Contractor has waived its right to recover
from the County, its officers, agents, employees, and volunteers any amounts
paid under any insurance policy required by this Agreement and that waiver does
not invalidate the insurance policy.
(ii) The commercial general liability insurance certificate must also state, and include
an endorsement, to cover the County of Fresno, its officers, agents, employees,
and volunteers, individually and collectively, are additional insureds insofar as the
operations under this Agreement are concerned. The commercial general liability
insurance certificate must also state that the coverage shall apply as primary
insurance and any other insurance, or self-insurance, maintained by the County
shall be excess only and not contributing with insurance provided under the
Contractor's policy.
(iii) The automobile liability insurance certificate must state that the policy covers any
auto used in connection with this Agreement.
(iv) The professional liability insurance certificate, if it is a claims-made policy, must
also state the retroactive date of the policy, which must be prior to the date on
which services began under this Agreement.
C-2
Exhibit C
(v) The technology professional liability insurance certificate must also state that
coverage encompasses all of the Contractor's obligations under this Agreement,
including but not limited to claims involving Cyber Risks, as that term is defined in
this Agreement.
(vi) The cyber liability insurance certificate must also state that it is endorsed, and
include an endorsement, to cover the full replacement value of damage to,
alteration of, loss of, or destruction of intangible property (including but not limited
to information or data) that is in the care, custody, or control of the Contractor.
(B) Acceptability of Insurers. All insurance policies required under this Agreement must be
issued by admitted insurers licensed to do business in the State of California and
possessing at all times during the term of this Agreement an A.M. Best, Inc. rating of no
less than A: VI I.
(C) Notice of Cancellation or Change. For each insurance policy required under this
Agreement, the Contractor shall provide to the County, or ensure that the policy requires
the insurer to provide to the County, written notice of any cancellation or change in the
policy as required in this paragraph. For cancellation of the policy for nonpayment of
premium, the Contractor shall, or shall cause the insurer to, provide written notice to the
County not less than 10 days in advance of cancellation. For cancellation of the policy
for any other reason, and for any other change to the policy, the Contractor shall, or shall
cause the insurer to, provide written notice to the County not less than 30 days in
advance of cancellation or change to the extent legally permissible. The County in its
sole discretion may determine that the failure of the Contractor or its insurer to timely
provide a written notice required by this paragraph is a breach of this Agreement.
(D) County's Entitlement to Greater Coverage. If the Contractor has or obtains insurance
with broader coverage, higher limits, or both, than what is required under this
Agreement, then the County requires and is entitled to the broader coverage, higher
limits, or both. To that end, the Contractor shall deliver, or cause its broker or producer
to deliver, to the County's Risk Manager certificates of insurance and endorsements for
all of the coverages that have such broader coverage, higher limits, or both, as required
under this Agreement.
(E) Waiver of Subrogation. The Contractor waives any right to recover from the County, its
officers, agents, employees, and volunteers any amounts paid under the policy of
worker's compensation insurance required by this Agreement. The Contractor is solely
responsible to obtain any policy endorsement that may be necessary to accomplish that
waiver, but the Contractor's waiver of subrogation under this paragraph is effective
whether or not the Contractor obtains such an endorsement.
(F) County's Remedy for Contractor's Failure to Maintain. If the Contractor fails to keep
in effect at all times any insurance coverage required under this Agreement, the County
may, in addition to any other remedies it may have, suspend or terminate this
Agreement upon the occurrence of that failure, or purchase such insurance coverage,
and charge the cost of that coverage to the Contractor. The County may offset such
charges against any amounts owed by the County to the Contractor under this
Agreement.
C-3
Exhibit C
(G)Subcontractors. The Contractor shall require and verify that all subcontractors used by
the Contractor to provide services under this Agreement maintain insurance meeting all
insurance requirements provided in this Agreement. This paragraph does not authorize
the Contractor to provide services under this Agreement using subcontractors.
C-4
Exhibit D
1 Health Insurance Portability and Accountability Act (HIPAA)
2 1. The County is a "Covered Entity," and the Contractor is a "Business Associate," as
3 these terms are defined by 45 CFR 160.103. In connection with providing services under the
4 Agreement, the parties anticipate that the Contractor will create and/or receive Protected Health
5 Information ("PHI") from or on behalf of the County. The parties enter into this Business Associate
6 Agreement (BAA) to comply with the Business Associate requirements of HIPAA, to govern the use
7 and disclosures of PHI under this Agreement. "HIPAA Rules" shall mean the Privacy, Security,
8 Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164. The parties to this
9 Agreement shall be in strict conformance with all applicable federal and State of California laws and
10 regulations, including, but not limited to California Welfare and Institutions Code sections 5328,
11 10850, and 14100.2 et seq.; 42 CFR 2; 42 CFR 431; California Civil Code section 56 et seq.; the
12 Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), including, but
13 not limited to, 45 CFR Parts160, 45 CFR 162, and 45 CFR 164; the Health Information Technology
14 for Economic and Clinical Health Act ("HITECH") regarding the confidentiality and security of patient
15 information, including, but not limited to 42 USC 17901 et seq.; and the Genetic Information
16 Nondiscrimination Act ("GINA") of 2008 regarding the confidentiality of genetic information.
17 Except as otherwise provided in this Agreement, the Contractor, as a business
18 associate of the County, may use or disclose Protected Health Information ("PHI") to perform
19 functions, activities or services for or on behalf of the County, as specified in this Agreement,
20 provided that such use or disclosure shall not violate HIPAA Rules. The uses and disclosures of
21 PHI may not be more expansive than those applicable to the County, as the "Covered Entity"
22 under the HIPAA Rules, except as authorized for management, administrative or legal
23 responsibilities of the Contractor.
24 2. The Contractor, including its subcontractors and employees, shall protect from
25 unauthorized access, use, or disclosure of names and other identifying information, including genetic
26 information, concerning persons receiving services pursuant to this Agreement, except where
27 permitted in order to carry out data aggregation purposes for health care operations [45 CFR §§
28 164.504(e)(2)(i), 164.504(e)(2)(ii)(A), and 164.504(e)(4)(i)]. This pertains to any and all persons
D-1
Exhibit D
1 receiving services pursuant to a County-funded program. This requirement applies to electronic PHI.
2 The Contractor shall not use such identifying information or genetic information for any purpose other
3 than carrying out the Contractor's obligations under this Agreement.
4 3. The Contractor, including its subcontractors and employees, shall not disclose any
5 such identifying information or genetic information to any person or entity, except as otherwise
6 specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law,
7 required by the Secretary of the United States Department of Health and Human Services
8 ("Secretary"), or authorized by the client/patient in writing. In using or disclosing PHI that is permitted
9 by this Agreement or authorized by law, the Contractor shall make reasonable efforts to limit PHI to
10 the minimum necessary to accomplish intended purpose of use, disclosure or request.
11 4. For purposes of the above sections, identifying information shall include, but not be
12 limited to, name, identifying number, symbol, or other identifying particular assigned to the individual,
13 such as fingerprint or voiceprint, or photograph.
14 5. For purposes of the above sections, genetic information shall include genetic tests of
15 family members of an individual or individual(s), manifestation of disease or disorder of family
16 members of an individual, or any request for or receipt of genetic services by individual or family
17 members. Family member means a dependent or any person who is first, second, third, or fourth
18 degree relative.
19 6. The Contractor shall provide access, at the request of the County, and in the time
20 and manner designated by the County, to PHI in a designated record set (as defined in 45 CFR §
21 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR § 164.524
22 regarding access by individuals to their PHI. With respect to individual requests, access shall be
23 provided within thirty (30) days from request. Access may be extended if the Contractor cannot
24 provide access and provides the individual with the reasons for the delay and the date when access
25 may be granted. PHI shall be provided in the form and format requested by the individual or the
26 County.
27 The Contractor shall make any amendment(s)to PHI in a designated record set at
28 the request of the County or individual, and in the time and manner designated by the County in
D-2
Exhibit D
1 accordance with 45 CFR § 164.526.
2 The Contractor shall provide to the County or to an individual, in a time and manner
3 designated by the County, information collected in accordance with 45 CFR § 164.528, to permit
4 the County to respond to a request by the individual for an accounting of disclosures of PHI in
5 accordance with 45 CFR § 164.528.
6 7. The Contractor shall report to the County, in writing, any knowledge or reasonable
7 belief that there has been unauthorized access, viewing, use, disclosure, security incident, or
8 breach of unsecured PHI not permitted by this Agreement of which the Contractor becomes aware
9 immediately and without reasonable delay and in no case later than two (2) business days of
10 discovery. Immediate notification shall be made to the County's Information Security Officer and
11 Privacy Officer and the County's Department of Public Health ("DPH") HIPAA Representative,
12 within two (2) business days of discovery. The notification shall include, to the extent possible,
13 the identification of each individual whose unsecured PHI has been, or is reasonably believed to
14 have been, accessed, acquired, used, disclosed, or breached. The Contractor shall take prompt
15 corrective action to cure any deficiencies and any action pertaining to such unauthorized
16 disclosure required by applicable federal and State laws and regulations. The Contractor shall
17 investigate such breach and is responsible for all notifications required by law and regulation or
18 deemed necessary by the County and shall provide a written report of the investigation and
19 reporting required to the County's Information Security Officer and Privacy Officer and the
20 County's DPH HIPAA Representative.
21 This written investigation and description of any reporting necessary shall be postmarked
22 within the thirty (30) working days of the discovery of the breach to the addresses below:
23 County of Fresno County of Fresno County of Fresno
24 Department of Public Health Department of Public Health Department of Information
HIPAA Representative Privacy Officer Technology Services- Chief
25 (559) 600-6439 (559)600-6405 Information Security Officer
26 P.O. Box 11867 P.O. Box 11867 (559) 600-5800
27 Fresno, California 93775 Fresno, California 93775 333 W. Pontiac Way
Fresno, California 93612
28
D-3
Exhibit D
1 8. The Contractor shall make its internal practices, books, and records relating to the
2 use and disclosure of PHI received from the County, or created or received by the Contractor on
3 behalf of the County, in compliance with Parts the HIPAA Rules. The Contractor shall make its
4 internal practices, books, and records relating to the use and disclosure of PHI received from the
5 County, or created or received by the Contractor on behalf of the County, available to the
6 Secretary upon demand.
7 The Contractor shall cooperate with the compliance and investigation reviews conducted
8 by the Secretary. PHI access to the Secretary must be provided during the Contractor's normal
9 business hours; however, upon exigent circumstances access at any time must be granted. Upon
10 the Secretary's compliance or investigation review, if PHI is unavailable to the Contractor and in
11 possession of a subcontractor of the Contractor, the Contractor must certify to the Secretary its
12 efforts to obtain the information from the subcontractor.
13 9. Safeguards
14 The Contractor shall implement administrative, physical, and technical safeguards as
15 required by the HIPAA Security Rule, Subpart C of 45 CFR Part 164, that reasonably and
16 appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI,
17 that it creates, receives, maintains or transmits on behalf of the County and to prevent
18 unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by this
19 Agreement. The Contractor shall conduct an accurate and thorough assessment of the potential
20 risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI. The
21 Contractor shall develop and maintain a written information privacy and security program that
22 includes administrative, technical and physical safeguards appropriate to the size and complexity
23 of the Contractor's operations and the nature and scope of its activities. Upon the County's
24 request, the Contractor shall provide the County with information concerning such safeguards.
25 The Contractor shall implement strong access controls and other security safeguards and
26 precautions in order to restrict logical and physical access to confidential, personal (e.g., PHI) or
27 sensitive data to authorized users only. Said safeguards and precautions shall include the
28 following administrative and technical password controls for all systems used to process or store
D-4
Exhibit D
1 confidential, personal, or sensitive data:
2 A. Passwords must not be:
3 (1) Shared or written down where they are accessible or recognizable by anyone
4 else; such as taped to computer screens, stored under keyboards, or visible in
5 a work area;
6 (2) A dictionary word; or
7 (3) Stored in clear text
8 B. Passwords must be:
9 (1) Eight (8) characters or more in length;
10 (2) Changed every ninety (90) days;
11 (3) Changed immediately if revealed or compromised; and
12 (4) Composed of characters from at least three (3) of the following four (4) groups
13 from the standard keyboard:
14 a) Upper case letters (A-Z);
15 b) Lowercase letters (a-z);
16 c) Arabic numerals (0 through 9); and
17 d) Non-alphanumeric characters (punctuation symbols).
18 The Contractor shall implement the following security controls on each workstation or
19 portable computing device (e.g., laptop computer) containing confidential, personal, or sensitive
20 data:
21 1. Network-based firewall and/or personal firewall;
22 2. Continuously updated anti-virus software; and
23 3. Patch management process including installation of all operating system/software
24 vendor security patches.
25 The Contractor shall utilize a commercial encryption solution that has received FIPS 140-
26 2 validation to encrypt all confidential, personal, or sensitive data stored on portable electronic
27 media (including, but not limited to, compact disks and thumb drives) and on portable computing
28 devices (including, but not limited to, laptop and notebook computers).
D-5
Exhibit D
1 The Contractor shall not transmit confidential, personal, or sensitive data via e-mail or
2 other internet transport protocol unless the data is encrypted by a solution that has been validated
3 by the National Institute of Standards and Technology (NIST) as conforming to the Advanced
4 Encryption Standard (AES) Algorithm. The Contractor must apply appropriate sanctions against
5 its employees who fail to comply with these safeguards. The Contractor must adopt procedures
6 for terminating access to PHI when employment of employee ends.
7 10. Mitigation of Harmful Effects
8 The Contractor shall mitigate, to the extent practicable, any harmful effect that is
9 suspected or known to the Contractor of an unauthorized access, viewing, use, disclosure, or
10 breach of PHI by the Contractor or its subcontractors in violation of the requirements of these
11 provisions. The Contractor must document suspected or known harmful effects and the outcome.
12 11. The Contractor's Subcontractors
13 The Contractor shall ensure that any of its contractors, including subcontractors, if
14 applicable, to whom the Contractor provides PHI received from or created or received by the
15 Contractor on behalf of the County, agree to the same restrictions, safeguards, and conditions
16 that apply to the Contractor with respect to such PHI and to incorporate, when applicable, the
17 relevant provisions of these provisions into each subcontract or sub-award to such agents or
18 subcontractors.
19 Nothing in this section 11 or this Exhibit D authorizes the Contractor to perform services
20 under this Agreement using subcontractors.
21 12. Employee Training and Discipline
22 The Contractor shall train and use reasonable measures to ensure compliance with the
23 requirements of these provisions by employees who assist in the performance of functions or
24 activities on behalf of the County under this Agreement and use or disclose PHI, and discipline
25 such employees who intentionally violate any provisions of these provisions, which may include
26 termination of employment.
27 13. Termination for Cause
28 Upon the County's knowledge of a material breach of these provisions by the Contractor,
D-6
Exhibit D
1 the County will either:
2 A. Provide an opportunity for the Contractor to cure the breach or end the
3 violation, and the County may terminate this Agreement if the Contractor does not cure the breach
4 or end the violation within the time specified by the County; or
5 B. Immediately terminate this Agreement if the Contractor has breached a
6 material term of this Exhibit D and cure is not possible, as determined by the County.
7 C. If neither cure nor termination is feasible, the County's Privacy Officer will
8 report the violation to the Secretary of the U.S. Department of Health and Human Services.
9 14. Judicial or Administrative Proceedings
10 The County may terminate this Agreement if: (1)the Contractor is found guilty in a criminal
11 proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or (2) there
12 is a finding or stipulation in an administrative or civil proceeding in which the Contractor is a party
13 that the Contractor has violated a privacy or security standard or requirement of the HITECH Act,
14 HIPAA or other security or privacy laws.
15 15. Effect of Termination
16 Upon termination or expiration of this Agreement for any reason, the Contractor shall
17 return or destroy all PHI received from the County (or created or received by the Contractor on
18 behalf of the County) that the Contractor still maintains in any form, and shall retain no copies of
19 such PHI. If return or destruction of PHI is not feasible, the Contractor shall continue to extend
20 the protections of these provisions to such information, and limit further use of such PHI to those
21 purposes that make the return or destruction of such PHI infeasible. This provision applies to PHI
22 that is in the possession of subcontractors or agents, if applicable, of the Contractor. If the
23 Contractor destroys the PHI data, a certification of date and time of destruction shall be provided
24 to the County by the Contractor.
25 16. Compliance with Other Laws
26 12.16 To the extent that other state and/or federal laws provide additional, stricter and/or
27 more protective privacy and/or security protections to PHI or other confidential information
28 covered under this BAA, the Contractor agrees to comply with the more protective of the privacy
D-7
Exhibit D
1 and security standards set forth in the applicable state or federal laws to the extent such standards
2 provide a greater degree of protection and security than HIPAA Rules or are otherwise more
3 favorable to the individual.
4 17. Disclaimer
5 The County makes no warranty or representation that compliance by the Contractor with
6 these provisions, the HITECH Act, or the HIPAA Rules, will be adequate or satisfactory for the
7 Contractor's own purposes or that any information in the Contractor's possession or control, or
8 transmitted or received by the Contractor, is or will be secure from unauthorized access, viewing,
9 use, disclosure, or breach. The Contractor is solely responsible for all decisions made by the
10 Contractor regarding the safeguarding of PHI.
11 18. Amendment
12 The parties acknowledge that Federal and State laws relating to electronic data security
13 and privacy are rapidly evolving and that amendment of this Exhibit D may be required to provide
14 for procedures to ensure compliance with such developments. The parties specifically agree to
15 take such action as is necessary to amend this agreement in order to implement the standards
16 and requirements of the HIPAA Rules, the HITECH Act and other applicable laws relating to the
17 security or privacy of PHI. The County may terminate this Agreement upon thirty(30)days written
18 notice in the event that the Contractor does not enter into an amendment providing assurances
19 regarding the safeguarding of PHI that the County in its sole discretion, deems sufficient to satisfy
20 the standards and requirements of the HIPAA Rules, and the HITECH Act.
21 19. No Third-Party Beneficiaries
22 Nothing expressed or implied in the provisions of this Exhibit D is intended to confer, and
23 nothing in this Exhibit D does confer, upon any person other than the County or the Contractor
24 and their respective successors or assignees, any rights, remedies, obligations or liabilities
25 whatsoever.
26 20. Interpretation
27 The provisions of this Exhibit D shall be interpreted as broadly as necessary to implement
28 and comply with the HIPAA Rules, and applicable State laws. The parties agree that any
D-8
Exhibit D
1 ambiguity in the terms and conditions of these provisions shall be resolved in favor of a meaning
2 that complies and is consistent with the HIPAA Rules.
3 21. Regulatory References
4 A reference in the terms and conditions of these provisions to a section in the HIPAA Rules
5 means the section as in effect or as amended.
6 22. Survival
7 The respective rights and obligations of the Contractor as stated in this Exhibit D survive
8 the termination or expiration of this Agreement.
9 23. No Waiver of Obligation
10 Change, waiver or discharge by the County of any liability or obligation of the Contractor
11 under this Exhibit D on any one or more occasions is not a waiver of performance of any
12 continuing or other obligation of the Contractor and does not prohibit enforcement by the County
13 of any obligation on any other occasion.
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
D-9
Exhibit E
1 Data Security
2 A. Definitions.
3 Capitalized terms used in this Exhibit E have the meanings set forth in this section A.
4 "Authorized Employees" means the Contractor's employees who have access to
5 Personal Information.
6 "Authorized Persons" means: (i) any and all Authorized Employees; and (ii) any and all of
7 the Contractor's subcontractors, representatives, agents, outsourcers, and consultants, and
8 providers of professional services to the Contractor, who have access to Personal Information and
9 are bound by law or in writing by confidentiality obligations sufficient to protect Personal Information
10 in accordance with the terms of this Exhibit E.
11 "Director" means the County's Chief Information Officer or his or her designee.
12 "Disclose" or any derivative of that word means to disclose, release, transfer, disseminate,
13 or otherwise provide access to or communicate all or any part of any Personal Information orally, in
14 writing, or by electronic or any other means to any person.
15 "Person" means any natural person, corporation, partnership, limited liability company,
16 firm, or association.
17 "Personal Information" means any and all information, including any data provided, or to
18 which access is provided, to the Contractor by or upon the authorization of the County, including
19 but not limited to vital records, that: (i) identifies, describes, or relates to, or is associated with, or is
20 capable of being used to identify, describe, or relate to, or associate with, a person (including,
21 without limitation, names, physical descriptions, signatures, addresses, telephone numbers, e-mail
22 addresses, education, financial matters, employment history, and other unique identifiers, as well
23 as statements made by or attributable to the person); (ii) is used or is capable of being used to
24 authenticate a person (including, without limitation, employee identification numbers, government-
25 issued identification numbers, passwords or personal identification numbers (PINs), financial
26 account numbers, credit report information, answers to security questions, and other personal
27 identifiers); or is personal information within the meaning of California Civil Code section 1798.3,
28 subdivision (a), or 1798.80, subdivision (e). Personal Information does not include publicly
E-1
Exhibit E
1 available information that is lawfully made available to the general public from federal, state, or
2 local government records.
3 "Privacy Practices Complaint" means a complaint received by the County relating to the
4 Contractor's (or any Authorized Person's) privacy practices, or alleging a Security Breach. Such
5 complaint shall have sufficient detail to enable the Contractor to promptly investigate and take
6 remedial action under this Exhibit E.
7 "Security Safeguards" means physical, technical, administrative or organizational security
8 procedures and practices put in place by the Contractor(or any Authorized Persons)that relate to
9 the protection of the security, confidentiality, value, or integrity of Personal Information. Security
10 Safeguards shall satisfy the minimal requirements set forth in subsection C.(5) of this Exhibit E.
11 "Security Breach" means (i) any act or omission that compromises either the security,
12 confidentiality, value, or integrity of any Personal Information or the Security Safeguards, or(ii) any
13 unauthorized Use, Disclosure, or modification of, or any loss or destruction of, or any corruption of
14 or damage to, any Personal Information.
15 "Use" or any derivative thereof means to receive, acquire, collect, apply, manipulate,
16 employ, process, transmit, disseminate, access, store, disclose, or dispose of Personal
17 Information.
18 B. Standard of Care.
19 (1)The Contractor acknowledges that, in the course of its engagement by the County
20 under this Agreement, the Contractor, or any Authorized Persons, may Use Personal Information
21 only as permitted in this Agreement.
22 (2)The Contractor acknowledges that Personal Information is deemed to be confidential
23 information of, or owned by, the County (or persons from whom the County receives or has
24 received Personal Information) and is not confidential information of, or owned or by, the
25 Contractor, or any Authorized Persons. The Contractor further acknowledges that all right, title, and
26 interest in or to the Personal Information remains in the County (or persons from whom the County
27 receives or has received Personal Information) regardless of the Contractor's, or any Authorized
28 Person's, Use of that Personal Information.
E-2
Exhibit E
1 (3)The Contractor agrees and covenants in favor of the County that the Contractor shall: (i)
2 keep and maintain all Personal Information in strict confidence, using such degree of care under
3 this Subsection B as is reasonable and appropriate to avoid a Security Breach; (ii) Use Personal
4 Information exclusively for the purposes for which the Personal Information is made accessible to
5 the Contractor pursuant to the terms of this Exhibit E; (iii) not Use, Disclose, sell, rent, license, or
6 otherwise make available Personal Information for the Contractor's own purposes or for the benefit
7 of anyone other than the County, without the County's express prior written consent, which the
8 County may give or withhold in its sole and absolute discretion; and (iv) not, directly or indirectly,
9 Disclose Personal Information to any person (an "Unauthorized Third Party") other than Authorized
10 Persons pursuant to this Agreement, without the Director's express prior written consent.
11 Notwithstanding the foregoing paragraph, in any case in which the Contractor believes it, or
12 any Authorized Person, is required to disclose Personal Information to government regulatory
13 authorities, or pursuant to a legal proceeding, or otherwise as may be required by applicable law,
14 the Contractor shall (a) immediately notify the County of the specific demand for, and legal
15 authority for the disclosure, including providing the County with a copy of any notice, discovery
16 demand, subpoena, or order, as applicable, received by the Contractor, or any Authorized Person,
17 from any government regulatory authorities, or in relation to any legal proceeding, and (b) promptly
18 notify the County before such Personal Information is offered by the Contractor for such disclosure
19 so that the County may have sufficient time to obtain a court order or take any other action the
20 County may deem necessary to protect the Personal Information from such disclosure, and the
21 Contractor shall cooperate with the County to minimize the scope of such disclosure of such
22 Personal Information.
23 The Contractor shall remain liable to the County for the actions and omissions of any
24 Unauthorized Third Party concerning its Use of such Personal Information as if they were the
25 Contractor's own actions and omissions.
26 C. Information Security.
27 (1)The Contractor covenants, represents and warrants to the County that the Contractor's
28 Use of Personal Information under this Agreement does and shall at all times comply with all
E-3
Exhibit E
1 federal, state, and local, privacy and data protection laws, as well as all other applicable regulations
2 and directives, including but not limited to California Civil Code, Division 3, Part 4, Title 1.81
3 (beginning with section 1798.80), and the Song-Beverly Credit Card Act of 1971 (California Civil
4 Code, Division 3, Part 4, Title 1.3, beginning with section 1747). If the Contractor Uses credit, debit,
5 or other payment cardholder information, the Contractor shall at all times remain in compliance with
6 the Payment Card Industry Data Security Standard ("PCI DSS") requirements, including remaining
7 aware at all times of changes to the PCI DSS and promptly implementing and maintaining all
8 procedures and practices as may be necessary to remain in compliance with the PCI DSS, in each
9 case, at the Contractor's sole cost and expense.
10 (2)The Contractor covenants, represents and warrants to the County that, as of the
11 Effective Date, the Contractor has not received notice of any violation of any privacy or data
12 protection laws, as well as any other applicable regulations or directives, and is not the subject of
13 any pending legal action or investigation by, any government regulatory authority regarding same.
14 (3)Without limiting the Contractor's obligations under subsection C.(1) of this Exhibit E, the
15 Contractor's (or Authorized Person's) Security Safeguards shall be no less rigorous than accepted
16 industry practices and, at a minimum, include the following: (i) limiting Use of Personal Information
17 strictly to the Contractor's and Authorized Persons' technical and administrative personnel who are
18 necessary for the Contractor's, or Authorized Persons', Use of the Personal Information pursuant
19 to this Agreement; (ii) ensuring that all of the Contractor's connectivity to the County computing
20 systems will only be through the County's security gateways and firewalls, and only through
21 security procedures approved upon the express prior written consent of the Director; (iii)to the
22 extent that they contain or provide access to Personal Information, (a) securing the Contractor's
23 business facilities, data centers, paper files, servers, back-up systems and computing equipment,
24 operating systems, and software applications, including, but not limited to, all mobile devices and
25 other equipment, operating systems, and software applications with information storage capability;
26 (b) employing adequate controls and data security measures with respect to the Contractor
27 Facilities and Equipment), both internally and externally, to protect (1)the Personal Information
28 from potential loss or misappropriation, or unauthorized Use, and (2)the County's operations from
E-4
Exhibit E
1 disruption and abuse; (c) having and maintaining network, device application, database and
2 platform security; (d) maintaining authentication and access controls within media, computing
3 equipment, operating systems, and software applications; and (e) installing and maintaining in all
4 mobile, wireless, or handheld devices a secure internet connection, having continuously updated
5 anti-virus software protection and a remote wipe feature always enabled, all of which is subject to
6 express prior written consent of the Director; (iv) encrypting all Personal Information at advance
7 encryption standards of Advanced Encryption Standards (AES) of 128 bit or higher(a) stored on
8 any mobile devices, including but not limited to hard disks, portable storage devices, or remote
9 installation, or(b)transmitted over public or wireless networks (the encrypted Personal Information
10 must be subject to password or pass phrase, and be stored on a secure server and transferred by
11 means of a Virtual Private Network (VPN) connection, or another type of secure connection, all of
12 which is subject to express prior written consent of the Director); (v) strictly segregating Personal
13 Information from all other information of the Contractor, including any Authorized Person, or
14 anyone with whom the Contractor or any Authorized Person deals so that Personal Information is
15 not commingled with any other types of information; (vi) having a patch management process
16 including installation of all operating system/software vendor security patches; (vii) maintaining
17 appropriate personnel security and integrity procedures and practices, including, but not limited to,
18 conducting background checks of Authorized Employees consistent with applicable law; and (viii)
19 providing appropriate privacy and information security training to Authorized Employees.
20 (4) During the term of each Authorized Employee's employment by the Contractor, the
21 Contractor shall cause such Authorized Employees to abide strictly by the Contractor's obligations
22 under this Exhibit E. The Contractor further agrees that it shall maintain a disciplinary process to
23 address any unauthorized Use of Personal Information by any Authorized Employees.
24 (5)The Contractor shall, in a secure manner, backup daily, or more frequently if it is the
25 Contractor's practice to do so more frequently, Personal Information received from the County, and
26 the County shall have immediate, real time access, at all times, to such backups via a secure,
27 remote access connection provided by the Contractor, through the Internet.
28 (6)The Contractor shall provide the County with the name and contact information for each
E-5
Exhibit E
1 Authorized Employee (including such Authorized Employee's work shift, and at least one alternate
2 Authorized Employee for each Authorized Employee during such work shift)who shall serve as the
3 County's primary security contact with the Contractor and shall be available to assist the County 24
4 hours per day, seven days per week as a contact in resolving the Contractor's and any Authorized
5 Persons' obligations associated with a Security Breach or a Privacy Practices Complaint.
6 D. Security Breach Procedures.
7 (1) Promptly, and without undue delay, upon the Contractor's confirmation of a Security
8 Breach, the Contractor shall (a) notify the Director of the Security Breach, such notice to be given
9 first by telephone at the following telephone number, followed promptly by email at the following
10 email address: (559) 600-5900/incidents@fresnocountyca.gov (which telephone number and
11 email address the County may update by providing notice to the Contractor), and (b) preserve all
12 relevant evidence (and cause any affected Authorized Person to preserve all relevant evidence)
13 relating to the Security Breach. The notification shall include, to the extent reasonably possible, the
14 identification of each type and the extent of Personal Information that has been, or is reasonably
15 believed to have been, breached, including but not limited to, compromised, or subjected to
16 unauthorized Use, Disclosure, or modification, or any loss or destruction, corruption, or damage.
17 (2) Immediately following the Contractor's notification to the County of a Security Breach,
18 as provided pursuant to subsection D.(1) of this Exhibit E, the Parties shall coordinate with each
19 other to investigate the Security Breach. The Contractor agrees to fully cooperate with the County,
20 including, without limitation: (i) assisting the County in conducting any investigation; (ii) providing
21 the County with physical access to the facilities and operations affected; (iii)facilitating interviews
22 with Authorized Persons and any of the Contractor's other employees knowledgeable of the
23 matter; and (iv) making available all relevant records, logs, files, data reporting and other materials
24 required to comply with applicable law, regulation, industry standards, or as otherwise reasonably
25 required by the County. To that end, the Contractor shall, with respect to a Security Breach, be
26 solely responsible, at its cost, for all notifications required by law and regulation, and the Contractor
27 shall provide a written report of the investigation and reporting required to the Director within 30
28 days after the Contractor's discovery of the Security Breach.
E-6
Exhibit E
1 (3)The County shall promptly notify the Contractor of the Director's knowledge, or
2 reasonable belief, of any Privacy Practices Complaint, and upon the Contractor's receipt of
3 notification thereof, the Contractor shall promptly address such Privacy Practices Complaint,
4 including taking any corrective action under this Exhibit E, all at the Contractor's sole expense, in
5 accordance with applicable privacy rights, laws, regulations and standards. In the event the
6 Contractor discovers a Security Breach, the Contractor shall treat the Privacy Practices Complaint
7 as a Security Breach. Within 24 hours of the Contractor's receipt of notification of such Privacy
8 Practices Complaint, the Contractor shall notify the County whether the matter is a Security
9 Breach, or otherwise has been corrected and the manner of correction, or determined not to
10 require corrective action and the reason therefor.
11 (4)The Contractor shall take prompt corrective action to respond to and remedy any
12 Security Breach and take reasonable mitigating actions, including but not limiting to, preventing any
13 reoccurrence of the Security Breach and correcting any deficiency in Security Safeguards as a
14 result of such incident, all at the Contractor's sole expense, in accordance with applicable privacy
15 rights, laws, regulations and standards. The Contractor shall reimburse the County for all
16 reasonable costs incurred by the County in responding to, and mitigating damages caused by, any
17 Security Breach, including all costs of the County incurred in relation to any litigation or other action
18 described in subsection D.(5) of this Exhibit E to the extent applicable: (1)the cost of providing
19 affected individuals with credit monitoring services for a specific period not to exceed 12 months, to
20 the extent the incident could lead to a compromise of the data subject's credit or credit standing; (2)
21 call center support for such affected individuals for a specific period not to exceed 30 days; and (3)
22 the cost of any measures required under applicable laws.
23 E. Oversight of Security Compliance.
24 (1)The Contractor shall have and maintain a written information security policy that
25 specifies Security Safeguards appropriate to the size and complexity of the Contractor's operations
26 and the nature and scope of its activities.
27 (2) Upon the County's written request, to confirm the Contractor's compliance with this
28 Exhibit E, as well as any applicable laws, regulations and industry standards, the Contractor grants
E-7
Exhibit E
1 the County or, upon the County's election, a third party on the County's behalf, permission to
2 perform an assessment, audit, examination or review of all controls in the Contractor's physical and
3 technical environment in relation to all Personal Information that is Used by the Contractor pursuant
4 to this Agreement. The Contractor shall fully cooperate with such assessment, audit or
5 examination, as applicable, by providing the County or the third party on the County's behalf,
6 access to all Authorized Employees and other knowledgeable personnel, physical premises,
7 documentation, infrastructure and application software that is Used by the Contractor for Personal
8 Information pursuant to this Agreement. In addition, the Contractor shall provide the County with
9 the results of any audit by or on behalf of the Contractor that assesses the effectiveness of the
10 Contractor's information security program as relevant to the security and confidentiality of Personal
11 Information Used by the Contractor or Authorized Persons during the course of this Agreement
12 under this Exhibit E.
13 (3)The Contractor shall ensure that all Authorized Persons who Use Personal Information
14 agree to the same restrictions and conditions in this Exhibit E. that apply to the Contractor with
15 respect to such Personal Information by incorporating the relevant provisions of these provisions
16 into a valid and binding written agreement between the Contractor and such Authorized Persons,
17 or amending any written agreements to provide same.
18 F. Return or Destruction of Personal Information.
19 Upon the termination of this Agreement, the Contractor shall, and shall instruct all
20 Authorized Persons to, promptly return to the County all Personal Information, whether in written,
21 electronic or other form or media, in its possession or the possession of such Authorized Persons,
22 in a machine readable form used by the County at the time of such return, or upon the express
23 prior written consent of the Director, securely destroy all such Personal Information, and certify in
24 writing to the County that such Personal Information have been returned to the County or disposed
25 of securely, as applicable. If the Contractor is authorized to dispose of any such Personal
26 Information, as provided in this Exhibit E, such certification shall state the date, time, and manner
27 (including standard) of disposal and by whom, specifying the title of the individual. The Contractor
28 shall comply with all reasonable directions provided by the Director with respect to the return or
E-8
Exhibit E
1 disposal of Personal Information and copies thereof. If return or disposal of such Personal
2 Information or copies of Personal Information is not feasible, the Contractor shall notify the County
3 accordingly, specifying the reason, and continue to extend the protections of this Exhibit E to all
4 such Personal Information and copies of Personal Information. The Contractor shall not retain any
5 copy of any Personal Information after returning or disposing of Personal Information as required
6 by this section F. The Contractor's obligations under this section F survive the termination of this
7 Agreement and apply to all Personal Information that the Contractor retains if return or disposal is
8 not feasible and to all Personal Information that the Contractor may later discover.
9 G. Equitable Relief.
10 The Contractor acknowledges that any breach of its covenants or obligations set forth in
11 this Exhibit E may cause the County irreparable harm for which monetary damages would not be
12 adequate compensation and agrees that, in the event of such breach or threatened breach, the
13 County is entitled to seek equitable relief, including a restraining order, injunctive relief, specific
14 performance and any other relief that may be available from any court, in addition to any other
15 remedy to which the County may be entitled at law or in equity. Such remedies shall not be
16 deemed to be exclusive but shall be in addition to all other remedies available to the County at law
17 or in equity or under this Agreement.
18 H. Indemnification.
19 The Contractor shall defend, indemnify and hold harmless the County, its officers,
20 employees, and agents, (each, a "County Indemnitee")from and against any and all infringement
21 of intellectual property including, but not limited to infringement of copyright, trademark, and trade
22 dress, invasion of privacy, information theft, and extortion, unauthorized Use, Disclosure, or
23 modification of, or any loss or destruction of, or any corruption of or damage to, Personal
24 Information, Security Breach response and remedy costs, credit monitoring expenses, forfeitures,
25 losses, damages, liabilities, deficiencies, actions,judgments, interest, awards, fines, and penalties
26 (including regulatory fines and penalties), costs or expenses of whatever kind, including attorney's
27 fees and costs, the cost of enforcing any right to indemnification or defense under the Agreement
28 and the cost of pursuing any insurance providers, arising out of or resulting from any third party
E-9
Exhibit E
1 claim or action against any County Indemnitee in relation to the Contractor's, its officers,
2 employees, or agents, or any Authorized Employee's or Authorized Person's, performance or
3 failure to perform under this Exhibit E or arising out of or resulting from the Contractor's failure to
4 comply with any of its obligations under this section H. The provisions of this section H do not apply
5 to the acts or omissions of the County. The provisions of this section H are cumulative to any other
6 obligation of the Contractor to, defend, indemnify, or hold harmless any County Indemnity under
7 this Agreement. The provisions of this section H shall survive the termination of this Agreement.
8 I. Survival.
9 The respective rights and obligations of the Contractor and the County as stated in this
10 Exhibit E shall survive the termination of this Agreement.
11 J. No Third Party Beneficiary.
12 Nothing express or implied in the provisions of in this Exhibit E is intended to confer, nor
13 shall anything herein confer, upon any person other than the County or the Contractor and their
14 respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.
15 L. No County Warranty.
16 The County does not make any warranty or representation whether any Personal
17 Information in the Contractor's (or any Authorized Person's) possession or control, or Use by the
18 Contractor (or any Authorized Person), pursuant to the terms of this Agreement is or will be secure
19 from unauthorized Use, or a Security Breach or Privacy Practices Complaint.
20
21
22
23
24
25
26
27
28
E-10