Loading...
HomeMy WebLinkAboutAgreement A-20-059 with ElanTech, Inc..pdf-1- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 A G R E E M E N T THIS AGREEMENT (“Agreement”) is made and entered into this day of , 2020 (“Effective Date”), by and between the COUNTY OF FRESNO, a political subdivision of the state of California, ("COUNTY"), and ElanTech, Inc., dba DataTech911, a Maryland corporation, whose address is 6751 Columbia Gateway Drive, Suite 300, Columbia, MD 21046, ("CONTRACTOR"). W I T N E S S E T H: WHEREAS, COUNTY purchased a software system called StatusNet911 (SN911 WEB), a hospital communications system utilized by the Department of Public Health, from CONTRACTOR, on February 24, 2015, pursuant to County Agreement No. 15-068; WHEREAS, CONTRACTOR is willing and able to continue to provide Software Hosting Services on a hosted system via Secure Socket Layer (SSL) for the SN911 WEB system; WHEREAS, COUNTY and CONTRACTOR desire to execute this Agreement for the continued maintenance and support of SN911 WEB, as further defined herein. NOW, THEREFORE, in consideration of the mutual covenants, terms and conditions herein contained, the parties hereto agree as follows: I.DEFINITIONS The following terms used throughout this Agreement shall be defined as follows: Acceptance Criteria: The performance and operating specifications that the System must meet at a minimum, as set out or referred to in this Agreement. Acceptance Test: The process of testing a specific function or functions to determine if the operation or operations are as stated in this Agreement. Application Service Provider (ASP): When servers are owned and maintained off-site by the software vendor. This is also known as on-demand software, or software as a service. 4th February Agreement No. 20-059 -2- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Authorized Facility: An Authorized Facility, includes specified Hospitals (including Emergency Room(s)), Emergency Medical Response Dispatch Centers, or County Administrative Centers, and shall be limited to those specified in Exhibit A – “Authorized Facilities”. Change Control Process: Process used by the Information Technology Services Division of COUNTY's Internal Services Department (ITSD) to inform staff of new or updated production use systems. County System Hardware: The central processing units owned or leased by COUNTY, which are described in this Agreement, on which COUNTY is licensed to use the System Software, any back-up equipment for such central processing units, and any peripheral hardware such as terminals, printers, and personal computers as described in this Agreement. County System Software: The operating system and database software installed on COUNTY System Hardware. Deficiency: The System's failure to substantially meet the System Performance Requirements. Final System Acceptance: When it is determined by COUNTY that all necessary deliverables have been delivered, the data has been converted, the base SN911 WEB License has been successfully installed and tested, and the SN911 WEB performs all functions in accordance with the Acceptance Criteria. First Production Use: Date of first use of the System in a production environment. Hosting Availability: Means the percentage of a particular month (based upon 24-hour days for the number of days in a subject month) that the Hosted System is accessible on the internet. ITSD: Information Technology Services Division of COUNTY's Internal Services Department. License: -3- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 The meaning assigned to the term "License" as defined in Section II of this Agreement and the rights and obligations which it creates under the laws of the United States of America and the State of California including without limitation, copyright and intellectual property law. Monies: The terms "Monies", "Charges", "Price", and "Fees" are considered to be equivalent. Primary Work Location: Physical location for the Application Service Provider off-site facility. Public Records: Public Records includes any writing containing information relating to the conduct of the public's business that is prepared, owned, used, or retained by any state or local agency, regardless of physical form or characteristics. Supplier: The terms "Supplier", "Vendor", "ElanTech, Inc.", “ElanTech, Inc., dba DataTech911”, and “DataTech911”, all refer to CONTRACTOR, and are considered to be equivalent throughout this Agreement. System: The System Software and System Documentation, collectively. Reference to the "System" shall include any component thereof. All modifications and enhancements to the System shall be deemed to be part of the System as defined herein and shall be subject to all terms and conditions set forth herein. The System consists of SN911 WEB, which supports the Fresno County Department of Internal Services, all interfaces, and third party software required for the system to function. System Documentation: The documentation relating to the System Software, and all manuals, reports, brochures, sample runs, specifications and other materials comprising such documentation provided by CONTRACTOR in connection with the System Software pursuant to this Agreement. System Operation: The general operation of COUNTY's hardware and all software including, but not limited to, -4- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 system restarts, configuration and operation of system peripherals (such as printers, modems, and terminals), installation of new software releases, and other related activities. System Installation: All software has been delivered, has been physically loaded on a Computer, and COUNTY has successfully executed program sessions. System Software: SN911 W EB, that certain computer software described in this Agreement provided by CONTRACTOR, and all interfaces, coding, tapes, disks, modules and similar materials comprising such software or on which it is stored. System Software shall not include operating system software, or any other third-party Software. User: The terms "User", "Customer" and "Licensee" all refer to COUNTY, and are considered to be equivalent throughout this Agreement. II. OBLIGATIONS OF CONTRACTOR A. SOFTWARE LICENSE 1. GRANT OF LICENSE CONTRACTOR grants to COUNTY and COUNTY accepts a non-exclusive, non-transferable license to use SN911 WEB, that is subject to the terms and conditions set forth in this Agreement. 2. SCOPE OF LICENSE The license granted herein shall consist solely of the non-exclusive, non-transferrable right of COUNTY to operate the System Software in support of COUNTY’s Department of Public Health and Authorized Facilities as shown in Exhibit “A”. 3. OWNERSHIP The parties acknowledge and agree that, as between CONTRACTOR and COUNTY, title and full ownership of all rights in and to the System Software, System Documentation, and all other materials provided to COUNTY by CONTRACTOR under the terms of this Agreement shall remain with CONTRACTOR. The parties acknowledge and agree that, as between CONTRACTOR and COUNTY, -5- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 full ownership of all rights in and to all COUNTY data, whether in magnetic or paper form, including without limitation printed output from the System, are the exclusive property of COUNTY. 4. POSSESSION, USE, AND UPDATE OF SOFTWARE COUNTY will use the System Software only for its own internal purposes and shall not further sublicense the System Software. CONTRACTOR may, at reasonable times, inspect COUNTY's premises and equipment to verify that COUNTY is observing all of the terms and conditions of this License. CONTRACTOR may create, from time to time, updated versions of the System Software and System Documentation and CONTRACTOR shall make such System Updates available to COUNTY. All System Updates shall be licensed under the terms of this Agreement. COUNTY agrees to follow the prescribed instructions for updating System Software and System Documentation provided to COUNTY by CONTRACTOR. COUNTY must authorize all System Updates in writing. 5. TRANSFER OF SOFTWARE COUNTY shall not rent, lease, license, distribute, sell, transfer, or assign this License, the System Software, or the System Documentation, or any of the information contained therein other than COUNTY data, to any other person or entity, whether on a permanent or temporary basis, and any attempt to do so will constitute a breach of this Agreement. No right or license is granted under this Agreement for the use or other utilization of the licensed programs, directly or indirectly, for the benefit of any other person or entity, except as provided in this Agreement. 6. POSSESSION AND USE OF SOURCE CODE Source code and other material that results from custom programming by CONTRACTOR released to COUNTY under this License shall be deemed to be CONTRACTOR software, subject to all of the terms and conditions of the License set forth in this Agreement. The scope of COUNTY's permitted use of the custom source code under this license shall be limited to maintenance and support of the System Software. For purposes of this Section, the term "maintenance and support" means correction of System Software errors and preparation of System Software modifications and enhancements. If COUNTY creates computer code in the process of enhancing the System Software, that specific new code shall be owned by COUNTY, and may be used by COUNTY's employees, officers, or agents for COUNTY's own internal business operations. However, if COUNTY's -6- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 enhancement results in the creation of a derivative work from the System Software, the copyright to such derivative work shall be owned by CONTRACTOR and COUNTY's rights to use such derivative work shall be limited to those granted with respect to the System Software in this Agreement. B. SERVICES TO BE PROVIDED BY CONTRACTOR TO COUNTY 1. SYSTEM INSTALLATION – This section intentionally deleted 2. TRAINING – This section intentionally deleted 3. DOCUMENTATION CONTRACTOR shall provide to COUNTY SN911 WEB System Documentation, which shall consist of electronic media files. The electronic media files must be printable using PC software normally available at COUNTY. CONTRACTOR shall provide new System Documentation corresponding to all new Software Upgrades. COUNTY may print additional copies of all documentation. COUNTY shall only use System Documentation for the purposes identified within this Agreement. C. SYSTEM MAINTENANCE AND SUPPORT BY CONTRACTOR System maintenance and support includes System Updates as they are released by CONTRACTOR, including updates required as a result of Federal Regulatory Changes. CONTRACTOR will support day-to-day operation of the System as follows: 1. SUPPORT HOURS / SCOPE: Provide unlimited technical assistance by phone during normal coverage hours (7:30 a.m. to 5:30 p.m. Pacific Standard Time (PST), Monday through Friday, except CONTRACTOR and COUNTY holidays), toll-free telephone assistance to keep the System in, or restored to, normal operating condition. The object of this support will be to answer specific questions related to the System Software and the application thereof. Support provided under this Agreement does not include training of new personnel (after initial staff is trained), operation of hardware, or solving other hardware/software problems unrelated to the System Software 2. SUPPORT RESPONSE: During the term of this Agreement, CONTRACTOR will (a) correct any error or malfunctions in the System as supplied by CONTRACTOR, which prevent it from operating in conformance with the -7- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Acceptance Test Criteria set forth in this Agreement or (b) provide a commercially reasonable alternative that will conform to the Acceptance Test Criteria set forth in this Agreement. If analysis by CONTRACTOR indicates a reported problem is caused by a reproducible error or malfunction in the then-current release of the System Software as supplied and maintained by CONTRACTOR that significantly impacts effective use of the System by COUNTY, CONTRACTOR will, if the System is inoperable, as reported by COUNTY, provide continuous effort to correct the error or to resolve the problem by providing a circumvention. In such cases, CONTRACTOR will provide COUNTY with corrective information, such as corrective documentation and/or program code. CONTRACTOR will endeavor to respond to COUNTY's service request no later than four (4) business hours from the time a call has been received by CONTRACTOR. In the event that a person with the necessary expertise is not available when the call is received, CONTRACTOR will endeavor to respond to the service request no later than within one (1) business day. 3. REMOTE VIRTUAL PRIVATE NETWORK (VPN) DIAGNOSTICS a. Diagnostic or corrective actions necessary to restore proper SN911 WEB operation; b. Diagnostic actions which attempt to identify the cause of system problem; c. Correction of data file problems; and d. SN911 WEB modifications CONTRACTOR product specialists will provide diagnostics via VPN on SN911 WEB. COUNTY will provide any required hardware, and equipment necessary at COUNTY site for CONTRACTOR VPN support. 4. ERROR CORRECTION PROCESS If, during the term of this Agreement, COUNTY determines that software error(s) exist, COUNTY will first follow the error procedures specified in the System Documentation. If following the error procedures does not correct the software error, COUNTY shall immediately notify CONTRACTOR, setting forth the defects noted with specificity. Upon notification of a reported software error, CONTRACTOR shall have five (5) days to determine if any actual software error(s) exist and, if so, -8- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 endeavor to correct such software error(s). At CONTRACTOR's request, additional time to solve difficult problems will not be unreasonably withheld. Within fifteen (15) days of correction, COUNTY shall retest the System Software and report any other software error(s). 5. TECHNICAL INFORMATION CONTRACTOR will provide technical information to COUNTY as necessary and helpful. Such information may cover areas such as SN911 WEB usage, third party software, and other matters considered relevant to COUNTY by CONTRACTOR. Technical information will be provided at the discretion of CONTRACTOR, but will not be unreasonably withheld. D. ADDITIONAL SYSTEM MAINTENANCE SERVICES BY CONTRACTOR CONTRACTOR may provide additional maintenance services ("Additional Maintenance and Support Services" or "Additional Maintenance Services") at an additional charge. Charges will be as identified in Section VI of this Agreement; or, if not included in this Agreement, charges will be at current prices in effect at the time goods or services are provided. Any Additional Maintenance and Support Services requested by COUNTY and determined by CONTRACTOR to be billable by CONTRACTOR must be identified as a chargeable service prior to the service being performed, and must be approved in writing in advance by COUNTY's Contract Administrator. Additional Maintenance Services include, but are not limited to, the following: 1. ADDITIONAL TRAINING A specific amount of training is designated in this Agreement. Additional training at a COUNTY facility is available upon request by COUNTY at an additional charge under the terms of this Agreement. Requests for additional training will be reviewed by CONTRACTOR, and must be requested in writing in advance by COUNTY's Contract Administrator. Charges will be at rates identified in this Agreement. 2. DATA AND SYSTEM CORRRECTIONS Data and System Corrections include any corrective actions accomplished by CONTRACTOR on-site or via VPN which are necessary due to COUNTY errors or unauthorized source code or data access by COUNTY. Unauthorized access to the data is defined as any COUNTY editing of data through other than normal system usage as -9- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 defined in System Documentation. Unauthorized access to source code is defined as any COUNTY access whatsoever to System source code. Services provided by CONTRACTOR are not billable when they result from errors caused by SN911 WEB or instruction provided by CONTRACTOR. 3. CUSTOMER SITE VISITS Site visits to COUNTY sites, as may be requested in writing by COUNTY and which are within the scope of the project services, are available for reasons including, but not limited to, (1) additional system training on hardware or software usage; (2) resolution of System difficulties not resulting from actions by, or otherwise the responsibility of CONTRACTOR; (3) installation of Software Releases; and (4) assistance in equipment maintenance, movement, or diagnosis. CONTRACTOR will review site visits outside of the scope of project services , which COUNTY’s Contract Administer must request in writing in advance. Charges will be at rates identified in this Agreement. 4. CUSTOM PROGRAMMING Requests for supplemental programming or customization of system features not covered under this Agreement are available to COUNTY. CONTRACTOR will review such requests, which COUNTY’s Contract Administrator, will be reviewed by CONTRACTOR, and must be requested in writing in advance by COUNTY's Contract Administrator. Charges will be at rates identified in this Agreement. E. CONTRACTOR’S PROJECT COORDINATOR Upon execution of this Agreement, CONTRACTOR shall appoint a Project Coordinator who will act as the primary contact person to interface with COUNTY for, maintenance, and support of SN911 WEB. F. SYSTEM UPDATES AND NEW PRODUCTS 1. SYSTEM UPDATES From time to time CONTRACTOR will develop and provide System Updates to COUNTY for COUNTY'S licensed CONTRACTOR software. System Updates shall be subject to the terms and conditions of this Agreement and shall be deemed licensed -10- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 System Software hereunder and will be made available to COUNTY at no additional charge to COUNTY. System Updates will be made available to COUNTY at the discretion of CONTRACTOR but will not be unreasonably withheld. 2. NEW PRODUCTS CONTRACTOR may from time to time release new software with capabilities substantially different from or greater than the System Software ("New Products") and which therefore do not constitute System Updates. These New Products will be made available to COUNTY at a cost not to exceed CONTRACTOR's then standard rates for customers similarly situated. G. OPERATING SYSTEM UPDATES The application must run on an operating system (O/S) that is consistently and currently supported by the operating system vendor. Applications under maintenance shall always be within one (1) year of current in regards to the O/S. Outdated or unsupported O/S will not be implemented on the production network. COUNTY will notify CONTRACTOR when a critical security patch is released. CONTRACTOR will have thirty (30) days to ensure application can perform in the updated environment. With approval from CONTRACTOR, COUNTY will apply patches to both the operating system, and non-critical security subsystems as releases are available from operating system vendors. The application shall perform in this environment. CONTRACTOR shall keep its software within 1 year of current in order to operate in this environment. These patches include critical O/S updates and security patches. H. ANTI-VIRUS MANAGEMENT COUNTY will actively run anti-virus management, where appropriate, on all application servers and PCs. The application shall perform adequately while anti-virus management is active. I. ADHERE TO CHANGE CONTROL PROCESS CONTRACTOR must adhere to COUNTY's Change Control Process, which shall be provided to CONTRACTOR in writing. COUNTY employs a procedure to implement updates, upgrades, and version releases to a system that is in production use. This forum allows ITSD to inform staff (Help Desk, Network, Server, Database, Security, and Analysts) of upcoming changes to a production system. -11- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 CONTRACTOR must inform ITSD a minimum of one (1) week prior to any planned, non-emergency changes so that the Change Control Process may be followed. J. OTHER Unless otherwise specified, for third-party software, CONTRACTOR shall provide standard documentation in electronic form (via the Internet or File Transfer Protocol (FTP)). The System runs in a Local Area Network and Web environment. As such, the performance of the System is directly related to, among other things: available network bandwidth, and the performance of other applications. For this reason, CONTRACTOR makes no guarantees as to System response time. K. SOFTWARE HOSTING SERVICES CONTRACTOR shall select a reputable host for the server on which SN911 WEB is hosted and from which access is to be provided to COUNTY for Authorized Facilities. In the event of a Security Breach, CONTRACTOR will be liable for payment of or reimbursement to COUNTY for all remediation expenses, and any monetary losses up to the maximum Total Agreement not-to-exceed amount. as set forth in Section VI. CONTRACTOR will make every reasonable effort to maintain a 99.9% up-time for the hosted SN911 WEB system. CONTRACTOR reserves the right to establish a monthly maintenance window for the purpose of upgrading, patching, or modifying, or repairing portions of or the entire SN911 WEB environment. The monthly window will be mutually agreed to in writing by CONTRACTOR's Project Coordinator. L. SYSTEM RELIABILITY "Downtime" shall be defined as System non-availability due to System Software error, malfunction, or Deficiency in the Application Software, or due to System Maintenance activity other than in accordance with the scheduling parameters set forth in this Agreement. Examples of Downtime include, without limitation: 1. One (1) or more COUNTY facilities cannot access the System for reasons within CONTRACTOR'S Control; or 2. Any functional Component of the System or Interface is not available and is within CONTRACTOR'S control. -12- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 COUNTY requires that there be no unscheduled Downtime for routine maintenance of the Application Software. COUNTY will accept occasional scheduled Downtime for significant non-routine Updates and maintenance to be scheduled by CONTRACTOR only with COUNTY'S prior written approval and at COUNTY'S discretion, exercised in good faith. Such scheduled Downtime for non- routine maintenance shall not occur more than four (4) times per year and shall not last more than four (4) hours per occurrence. Non-routine maintenance includes such tasks as major System Software version Updates. CONTRACTOR shall use its best efforts to keep scheduled Downtime for non-routine maintenance to a minimum and if required, any excess scheduled Downtime will be agreed to in writing in advance by COUNTY. M. PRIVACY REQUIREMENTS CONTRACTOR shall be responsible for the following privacy and security safeguards: 1. To the extent required to carry out the assessment and authorization process and continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any COUNTY data collected and stored by CONTRACTOR, CONTRACTOR shall afford COUNTY access as necessary at CONTRACTOR's discretion, to CONTRACTOR's facilities, installations, technical capabilities, operations, documentation, records, and databases. 2. If new or unanticipated threats or hazards are discovered by either COUNTY or CONTRACTOR, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. 3. CONTRACTOR shall also comply with any additional privacy requirements provided by COUNTY. 4. During the term of this Agreement, COUNTY has the right to perform manual or automated audits, scans, reviews, or other inspections of CONTRACTOR's IT environment being used to provide or facilitate services for COUNTY. CONTRACTOR shall be responsible for the following privacy and security safeguards: a. Other than for CONTRACTOR's own use and purposes, CONTRACTOR shall not publish or disclose in any manner the details of any safeguards either designed or -13- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 developed by CONTRACTOR under this Agreement, or otherwise provided by COUNTY. b. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of COUNTY data, CONTRACTOR shall afford COUNTY access as necessary to CONTRACTOR'S facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours’ request by COUNTY. The program of inspection shall include, but is not limited to: Authenticated and unauthenticated operating system/network vulnerability scans, authenticated and unauthenticated web application vulnerability scans, and authenticated and unauthenticated database application vulnerability scans. Automated scans may be performed by COUNTY personnel, or agents acting on behalf of COUNTY, using COUNTY-operated equipment, and COUNTY-specified tools. Should CONTRACTOR choose to run its own automated scans or audits, results from these scans may, at COUNTY's discretion, be accepted in lieu of COUNTY-performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by COUNTY. In addition, the results of CONTRACTOR conducted scans shall be provided in full to COUNTY. N. PROTECTION OF INFORMATION CONTRACTOR shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this Agreement. CONTRACTOR shall also protect all COUNTY data, equipment, etc. by treating such information as sensitive. It is anticipated that this information will be gathered, created, and stored within the Primary Work Location. Should CONTRACTOR personnel remove any information from the Primary Work Location, CONTRACTOR shall protect such information to the same extent it would its own proprietary data and/or company trade secrets. The use of any information subject to the Privacy Act will be utilized in full accordance with all rules of conduct applicable to Privacy Act Information. COUNTY will retain unrestricted rights to COUNTY data. COUNTY retains ownership of any user created/loaded data and applications hosted on CONTRACTOR's infrastructure, as well as maintains -14- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the right to request full copies of these at any time. Data processed and stored by the various applications within the network infrastructure contains financial data, personally identifiable information (PII), and protected health information (PHI). This data, PII, and PHI shall be protected against unauthorized access, disclosure, modification, theft, or destruction. CONTRACTOR shall ensure that the facilities housing the network infrastructure are physically secure. The data must be available to COUNTY upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. CONTRACTOR shall provide requested data at no additional cost to COUNTY. No data shall be released by the CONTACTOR without the consent of COUNTY in writing. All requests for release must be submitted in writing to COUNTY. III. OBLIGATIONS OF COUNTY A. COUNTY CONTRACT ADMINISTRATION COUNTY appoints its Director of Internal Services/Chief Information Officer (CIO) or his/her designee, as COUNTY's Contract Administrator with full authority to deal with CONTRACTOR in all matters concerning this Agreement. B. CONTRACTOR RESPONSE COMMITMENT CONTRACTOR will follow its present practices to safeguard System Software delivered to COUNTY by CONTRACTOR. A copy of COUNTY’s “Information Technology (IT) Standards and Preferred Preferences” will be made available upon request C. SAFEGUARDING SYSTEM SOFTWARE COUNTY will follow its present practices to safeguard System Software delivered to COUNTY by CONTRACTOR. A copy of COUNTY'S "Information Technology (IT) Standards and Preferences" will be made available to CONTRACTOR upon request. 1) COUNTY utilizes a backup and recovery system written and maintained by Commvault Systems. This application requires a backup agent to run on the server. -15- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 2) COUNTY will provide CONTRACTOR with an account with appropriate administrative rights to administer the application. The account password shall periodically expire. 3) In order for the application to run on COUNTY supported servers, the application must not require the users to have administrative rights on the servers. 4) COUNTY, at all times, during and after the performance of the installation of the System Software, is responsible for maintaining adequate data backups to protect against loss of data. D. FACILITIES AND PREPARATION COUNTY shall, at its own expense, provide all necessary labor and materials for site preparation, electrical services, and cabling required for System Installation. COUNTY shall receive the System Software, and will follow instructions provided by CONTRACTOR to load it on COUNTY’s System Hardware to prepare the System for processing E. ACCEPTANCE TESTING – This section intentionally deleted F. SYSTEM HARDWARE AND SYSTEM SOFTWARE COUNTY shall, at its own expense, provide and properly maintain, and update on an on-going basis, all necessary COUNTY System Software and County System Hardware required to operate SN911 WEB. Said COUNTY System Software and County System Hardware shall meet or exceed CONTRACTOR's recommendations. As part of COUNTY's responsibility for computer infrastructure, COUNTY is responsible for ensuring that data is secure and protected at all times. CONTRACTOR is not responsible for and cannot be held liable for inadvertent data disclosure or theft from COUNTY facilities. G. DATA SECURITY As part of COUNTY’s responsibility for computer infrastructure, COUNTY is responsible for ensuring that data is secure and protected at all times. CONTRACTOR is not responsible for, and cannot be held liable for, inadvertent data disclosure or theft from COUNTY facilities H. COUNTY PROJECT MANAGER – This section intentionally deleted. -16- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I. OTHER COUNTY OBLIGATIONS – This section intentionally deleted IV. TERM The term of this Agreement shall be for a period of three (3) years, commencing on February 24, 2020, through and including February 23, 2023. This Agreement may be extended for two (2) additional consecutive twelve (12) month periods upon written approval of both parties no later than thirty (30) days prior to the first day of the next twelve (12) month extension period. The Director of Internal Services/Chief Information Officer is authorized to execute such written approval on behalf of COUNTY based on CONTRACTOR’S satisfactory performance. V. TERMINATION A. NON-ALLOCATION OF FUNDS The terms of this Agreement, and the services to be provided hereunder, are contingent on the approval of funds by the appropriating government agency. Should sufficient funds not be allocated, the services provided may be modified, or this Agreement terminated, at any time by giving CONTRACTOR thirty (30) days advance written notice. Notwithstanding any such termination, COUNTY shall pay CONTRACTOR for all services performed under this Agreement prior to the effective date of termination. B. BREACH OF CONTRACT COUNTY may immediately suspend or terminate this Agreement in whole or in part, where in the determination of COUNTY there is: 1. An illegal or improper use of funds; 2. A failure to comply with any term of this Agreement; 3. A substantially incorrect or incomplete report submitted to COUNTY; 4. Improperly performed service. In no event shall any payment by COUNTY constitute a waiver by COUNTY of any breach of this Agreement or any default which may then exist on the part of CONTRACTOR. Neither shall such payment impair or prejudice any remedy available to COUNTY with respect to the breach or default. COUNTY shall have the right to demand of CONTRACTOR the repayment to COUNTY of any funds disbursed to CONTRACTOR under this Agreement, which in the judgment of COUNTY were not -17- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 expended in accordance with the terms of this Agreement. CONTRACTOR shall promptly refund any such funds upon demand. C. WITHOUT CAUSE Under circumstances other than those set forth above, this Agreement may be terminated by COUNTY by giving thirty (30) days advance written notice of an intention to terminate to CONTRACTOR. Notwithstanding any such termination, CONTRACTOR will be paid for all services performed under this Agreement prior to the effective date of the termination. D. TERMINATION BY CONTRACTOR CONTRACTOR may, upon thirty (30) days prior written notice to COUNTY, terminate this Agreement if COUNTY fails to comply with any material term or condition of this Agreement unless COUNTY cures such failure within such thirty (30) day period, or other such timeframe as may be mutually agreed upon in writing by the parties. If CONTRACTOR elects to terminate this agreement, CONTRACTOR shall promptly refund a prorated amount of the Annual Maintenance and Support fees, covering the period from the date of termination, to the end of the then current period. VI. COMPENSATION/INVOICING: COUNTY agrees to pay CONTRACTOR, and CONTRACTOR agrees to receive compensation as follows: A. ANNUAL MAINTENANCE AND SUPPORT FEES: Authorized Facilities are listed in Exhibit “A”. Year Facility Period Total Year 1 (prorated) Authorized Facilities (excluding CSCADU & CSCYTH) 08/05/20 – 02/23/21 $ 15,670 CSCADU 10/22/20 – 02/23/21 CSCYTH 12/31/20 – 02/23/21 Year 2 Authorized Facilities 02/24/21 – 02/23/22 $29,100 Year 3 Authorized Facilities 02/24/22 – 02/23/23 $29,100 Year 4 Authorized Facilities 02/24/23 – 02/23/24 $29,100 Year 5 Authorized Facilities 02/24/24 – 02/23/25 $29,100 COUNTY and CONTRACTOR agree that COUNTY has previously paid to CONTRACTOR, under the previous County Agreement No. 15-068, the Annual Maintenance and Support fees covering the -18- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 facilities and periods as follows: Facility Period Authorized Facilities (excluding CSCADU & CSCYTH) 02/24/20 – 08/04/20 CSCADU 02/24/20 – 10/21/20 CSCYTH 02/24/20 – 12/30/20 B. FEE CHANGES CONTRACTOR may increase Annual Maintenance and Support fees for years 2-5 of this Agreement, upon thirty (30) days' advance written notice to COUNTY, provided CONTRACTOR shall not increase such fees more than once in any one-year period, and provided further that each increase will not exceed the previous fees by the lesser of three percent (3%) per year or (ii) the cumulative percentage increase in the Consumer Price Index, All Urban Consumers for the U.S., during the previous year. C. RATES FOR ADDITIONAL SERVICES Additional services will be negotiated at the time they are needed and will be agreed upon by both parties in writing. Optional, additional services may include, but are not limited to: 1) Online Training (once per year, included with Annual Subscription Fee) 2) On-site training $850 per day, plus related travel expenses billed at actual cost plus 10% 3) Customization Services $155 per hour 4) Additional Full Facility $2,500 per year 5) Additional Partial Facility $600 per year Additional Service Fees shall only be paid to CONTRACTOR if any such services set forth herein are performed by CONTRACTOR upon COUNTY’s written request. The Director of Internal Services/Chief Information Officer, Director of Public Health, or their designees are authorized to purchase additional services on behalf of COUNTY. In no event shall Additional Service Fees exceed $5,000 per year for each one-year period of this Agreement. D. INVOICING CONTRACTOR shall submit annual invoices referencing the provided contract number, either -19- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 electronically or via mail, in triplicate to the: County of Fresno, Internal Services Department, Attention: Business Office, 333 W. Pontiac Way, Clovis CA 93612, ( isdbusinessoffice@fresnocountyca.gov ). E. TOTAL CONTRACT AMOUNT In no event shall compensation paid by COUNTY for services performed under this Agreement exceed $91,516 during the initial three-year term of this Agreement. If this Agreement is extended for an additional Year 4, in no event shall compensation for the four-year term exceed $128,314. If this Agreement is extended for an additional Year 5, in no event shall compensation for the total possible five-year term exceed $166,066. All expenses incidental to CONTRACTOR'S performance of services under this Agreement shall be borne by CONTRACTOR. COUNTY shall pay CONTRACTOR within forty-five (45) days of receipt of an approved invoice, by mail addressed to CONTRACTOR’s remittance address at, 6751 Columbia Gateway Drive, Suite 300, Columbia, MD 21046. VII. INDEPENDENT CONTRACTOR: In performance of the work, duties and obligations assumed by CONTRACTOR under this Agreement, it is mutually understood and agreed that CONTRACTOR, including any and all of CONTRACTOR'S officers, agents, and employees will at all times be acting and performing as an independent contractor, and shall act in an independent capacity and not as an officer, agent, servant, employee, joint venturer, partner, or associate of COUNTY. Furthermore, COUNTY shall have no right to control or supervise or direct the manner or method by which CONTRACTOR shall perform its work and function. However, COUNTY shall retain the right to administer this Agreement so as to verify that CONTRACTOR is performing its obligations in accordance with the terms and conditions thereof. CONTRACTOR and COUNTY shall comply with all applicable provisions of law and the rules and regulations, if any, of governmental authorities having jurisdiction over matters the subject thereof. Because of its status as an independent contractor, CONTRACTOR shall have absolutely no right to employment rights and benefits available to COUNTY employees. CONTRACTOR shall be solely liable and responsible for providing to, or on behalf of, its employees all legally required employee benefits. In addition, CONTRACTOR shall be solely responsible and save COUNTY harmless from all matters relating to payment of CONTRACTOR'S employees, including compliance with Social Security withholding and all other regulations governing such matters. It is acknowledged that during the term of this Agreement, -20- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 CONTRACTOR may be providing services to others unrelated to COUNTY or to this Agreement. VIII. MODIFICATION: Any matters of this Agreement may be modified from time to time by the written consent of all the parties without, in any way, affecting the remainder. IX. NON-ASSIGNMENT: Neither party shall assign, transfer or sub-contract this Agreement nor their rights or duties under this Agreement without the prior written consent of the other party. X. HOLD HARMLESS: CONTRACTOR agrees to indemnify, save, hold harmless, and at COUNTY'S request, defend COUNTY, its officers, agents, and employees from any and all costs and expenses (including attorney’s fees and costs), damages, liabilities, claims, and losses, and any and all claims, damages, costs, fees, regulatory fines and penalties, and forms of legal action involving Cyber Risks, occurring or resulting to COUNTY in connection with the performance, or failure to perform, by CONTRACTOR, its officers, agents, or employees under this Agreement, and from any and all costs and expenses (including attorney’s fees and costs), damages, liabilities, claims, and losses, and any and all claims, damages, costs, fees, regulatory fines and penalties, and forms of legal action involving Cyber Risks, occurring or resulting to any person, firm, or corporation who may be injured or damaged by the performance, or failure to perform, of CONTRACTOR, its officers, agents, or employees under this Agreement. In the event of a claim of alleged infringement of patent rights, copyright, trade secret rights, or intellectual property rights, to the fullest extent permitted by law, CONTRACTOR agrees to and shall indemnify, save, hold harmless, and at COUNTY’s request, defend COUNTY, including its officers, officials, agents, and employees from any and all demands, costs and expenses, penalties, attorney’s fees and court costs, damages of any nature whatsoever (including, without limitation, injury or damage to or loss or destruction of property), judgments (including, without limitation, amounts paid in settlement and amounts paid to discharge judgments), liabilities, claims and losses, suits, actions or proceedings of every name, kind and description occurring or resulting to COUNTY, out of or in connection with any claim that is based on the infringement (or assertions of infringement) of any of patent rights, copyright, trade secret rights, or intellectual property rights with respect to services, software, or any Equipment provided by -21- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 CONTRACTOR as part of this Agreement, including, but not limited to, their materials, designs, techniques, processes and information supplied or used by CONTRACTOR or any of CONTRACTOR’s subcontractor of any tier in performing or providing any portion of CONTRACTOR’s obligations as outlined in this Agreement. If, in any suit, action, proceeding or claim relating to the foregoing, a temporary restraining order or preliminary injunction is granted, CONTRACTOR shall make every reasonable effort to secure the suspension of the injunction or restraining order. If, in any such suit, action, proceeding or claim, the services, software or any Equipment provided by CONTRACTOR or any part, combination or process thereof, is held to constitute an infringement and its use is enjoined, CONTRACTOR shall immediately (a) pay the reasonable direct out-of-pocket costs and expenses to secure a license to use such infringing work, replace the infringing work or modify the same so that it becomes non-infringing, and (b) make every reasonable effort to secure for COUNTY a license, at no cost to COUNTY, authorizing COUNTY’s continued use of the infringing work. If CONTRACTOR is unable to secure such license within a reasonable time, CONTRACTOR, at its own expense and without impairing performance requirements of the services, software, or any Equipment provided by CONTRACTOR as part of this Agreement, shall either replace the affected services, software, or any Equipment provided by CONTRACTOR as part of this Agreement, combination or process thereof, with non-infringing services, software, or other equipment, or modify the same so that they become non-infringing. The provisions of this Section 10 shall survive the termination of this Agreement. XI. INSURANCE Without limiting COUNTY's right to obtain indemnification from CONTRACTOR or any third parties, CONTRACTOR, at its sole expense, shall maintain in full force and effect, the following insurance policies or a program of self-insurance, including but not limited to, an insurance pooling arrangement or Joint Powers Agreement (JPA) throughout the term of the Agreement: A. Commercial General Liability Commercial General Liability Insurance with limits of not less than Two Million Dollars ($2,000,000.00) per occurrence and an annual aggregate of Four Million Dollars ($4,000,000.00). This policy shall be issued on a per occurrence basis. COUNTY may require specific coverages including completed operations, products liability, contractual liability, Explosion-Collapse-Underground, fire legal -22- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 liability or any other liability insurance deemed necessary because of the nature of this contract. B. Automobile Liability Comprehensive Automobile Liability Insurance with limits of not less than One Million Dollars ($1,000,000.00) per accident for bodily injury and for property damages. Coverage should include any auto used in connection with this Agreement. C. Technology Professional Liability (Errors and Omissions) and Cyber Liability CONTRACTOR shall obtain Technology Professional Liability (Errors and Omissions) and Cyber Liability Insurance appropriate to CONTRACTOR’s profession, with limits not less than Three Million Dollars ($3,000,000) per occurrence or claim, Three Million Dollars ($3,000,000) aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by CONTRACTOR in this Agreement and shall include, but not be limited to, claims involving infringement of intellectual property, infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security, and claims involving Cyber Risks. The policy shall be endorsed to provide coverage for breach response costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations, and cover the full replacement value of damage to, alteration of, loss of, or destruction of intangible property (including but not limited to information or data) that is in the care, custody, or control of CONTRACTOR. For purposes of the technology professional liability insurance and the cyber liability insurance required under this Agreement, Cyber Risks include, but are not limited to, (i) security breaches, which include disclosure of, whether intentional or unintentional, information provided by COUNTY, information provided by or obtained from any person, or personal-identifying information relating to any person, to an unauthorized third party; (ii) breach of any of CONTRACTOR’s obligations under this Agreement relating to data security, protection, preservation, usage, storage, transmission, and the like; (iii) infringement of intellectual property including, but not limited to, infringement of copyright, trademark, and trade dress; (iv) invasion of privacy, including any release of private information; (v) information theft by any person or entity, whatsoever; (vi) damage to or destruction or alteration of electronic information; (vii) extortion related to CONTRACTOR’s obligations under this Agreement regarding electronic -23- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 information, including information provided by COUNTY, information provided by or obtained from any person, or personal-identifying information relating to any person; (viii) network security; (ix) data breach response costs, including security breach response costs; (x) regulatory fines and penalties related to CONTRACTOR’s obligations under this Agreement regarding electronic information, including information provided by COUNTY, information provided by or obtained from any person, or personal- identifying information relating to any person; and (xi) credit monitoring expenses. D. Professional Liability If CONTRACTOR employs licensed professional staff, (e.g., Ph.D., R.N., L.C.S.W., M.F.C.C.) in providing services, Professional Liability Insurance with limits of not less than One Million Dollars ($1,000,000.00) per occurrence, Three Million Dollars ($3,000,000.00) annual aggregate. E. Worker's Compensation A policy of Worker's Compensation insurance as may be required by the California Labor Code. Additional Requirements Relating to Insurance CONTRACTOR shall obtain endorsements to the Commercial General Liability insurance naming COUNTY of Fresno, its officers, agents, and employees, individually and collectively, as additional insured, but only insofar as the operations under this Agreement are concerned. Such coverage for additional insured shall apply as primary insurance and any other insurance, or self-insurance, maintained by COUNTY, its officers, agents and employees shall be excess only and not contributing with insurance provided under CONTRACTOR's policies herein. This insurance shall not be cancelled or changed without a minimum of thirty (30) days advance written notice given to COUNTY. CONTRACTOR hereby waives its right to recover from COUNTY, its officers, agents, and employees any amounts paid by the policy of worker’s compensation insurance required by this Agreement. CONTRACTOR is solely responsible to obtain any endorsement to such policy that may be necessary to accomplish such waiver of subrogation, but CONTRACTOR’s waiver of subrogation under this paragraph is effective whether or not CONTRACTOR obtains such an endorsement. Within Thirty (30) days from the date CONTRACTOR signs and executes this Agreement, CONTRACTOR shall provide certificates of insurance and endorsement as stated above for all of the foregoing policies, as required herein, to the County of Fresno, Internal Services Department, Attention: -24- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Director of Internal Services/Chief Information Officer, 333 W. Pontiac Way, Clovis, CA 93612, stating that such insurance coverage have been obtained and are in full force; that the County of Fresno, its officers, agents and employees will not be responsible for any premiums on the policies; that for such worker’s compensation insurance the CONTRACTOR has waived its right to recover from the COUNTY, its officers, agents, and employees any amounts paid under the insurance policy and that waiver does not invalidate the insurance policy; that such Commercial General Liability insurance names the County of Fresno, its officers, agents and employees, individually and collectively, as additional insured, but only insofar as the operations under this Agreement are concerned; that such coverage for additional insured shall apply as primary insurance and any other insurance, or self-insurance, maintained by COUNTY, its officers, agents and employees, shall be excess only and not contributing with insurance provided under CONTRACTOR's policies herein; and that this insurance shall not be cancelled or changed without a minimum of thirty (30) days advance, written notice given to COUNTY. In the event CONTRACTOR fails to keep in effect at all times insurance coverage as herein provided, COUNTY may, in addition to other remedies it may have, suspend or terminate this Agreement upon the occurrence of such event. All policies shall be issued by admitted insurers licensed to do business in the State of California, and such insurance shall be purchased from companies possessing a current A.M. Best, Inc. rating of A FSC VII or better. XII. AUDITS AND INSPECTIONS: CONTRACTOR shall at any time during business hours, and as often as COUNTY may deem necessary, make available to COUNTY for examination all of its records and data with respect to the matters covered by this Agreement. CONTRACTOR shall, upon request by COUNTY, permit COUNTY to audit and inspect all of such records and data necessary to ensure CONTRACTOR'S compliance with the terms of this Agreement. If this Agreement exceeds ten thousand dollars ($10,000.00), CONTRACTOR shall be subject to the examination and audit of the California State Auditor for a period of three (3) years after final payment under contract (Government Code Section 8546.7). XIII. NOTICES: A. AUTHORITY TO GIVE NOTICES -25- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 The persons and their addresses having authority to give and receive notices under this Agreement include the following: COUNTY CONTRACTOR County of Fresno ElanTech, Inc., dba DataTech911 Director of Internal Services/CIO President 333 W. Pontiac Way 6751 Columbia Gateway Drive, Suite 300 Clovis, CA 93612 Columbia, MD 21046 All notices between COUNTY and CONTRACTOR provided for or permitted under this Agreement must be in writing and delivered either by personal service, by first-class United States mail, by an overnight commercial courier service, or by telephonic facsimile transmission. A notice delivered by personal service is effective upon service to the recipient. A notice delivered by first-class United States mail is effective three COUNTY business days after deposit in the United States mail, postage prepaid, addressed to the recipient. A notice delivered by an overnight commercial courier service is effective one COUNTY business day after deposit with the overnight commercial courier service, delivery fees prepaid, with delivery instructions given for next day delivery, addressed to the recipient. A notice delivered by telephonic facsimile is effective when transmission to the recipient is completed (but, if such transmission is completed outside of COUNTY business hours, then such delivery shall be deemed to be effective at the next beginning of a COUNTY business day), provided that the sender maintains a machine record of the completed transmission. For all claims arising out of or related to this Agreement, nothing in this section establishes, waives, or modifies any claims presentation requirements or procedures provided by law, including but not limited to the Government Claims Act (Division 3.6 of Title 1 of the Government Code, beginning with section 810). B. PRIMARY-ESCALATION CONTACT INFORMATION The person and their contact information that COUNTY or CONTRACTOR can use to escalate problems of situations. COUNTY CONTRACTOR Contact #1 Contact #1 Applications IT Manager Vice President Office: (559) 600-5800 Office: (301) 486-0600 x102 Cell: (301) 922-8366 Email: support@datatech911.com -26- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Contact #2 Contact #2 Applications IT Division Manager President Office: (559) 600-5800 Office: (301) 486-0600 x101 Cell: (301) 922-8367 Email: contracts@elantech-inc.com XIV. GOVERNING LAW: Venue for any action arising out of or related to this Agreement shall only be in Fresno County, California. The rights and obligations of the parties and all interpretation and performance of this Agreement shall be governed in all respects by the laws of the State of California. XV. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY A. The parties to this Agreement shall be in strict conformance with all applicable Federal and State of California laws and regulations, including but not limited to Sections 5328, 10850, and 14100.2 et seq. of the Welfare and Institutions Code, Sections 2.1 and 431.300 et seq. of Title 42, Code of Federal Regulations (CFR), Section 56 et seq. of the California Civil Code, Sections 11977 and 11812 of Title 22 of the California Code of Regulations, and the Health Insurance Portability and Accountability Act (HIPAA), including but not limited to Section 1320 D et seq. of Title 42, United States Code (USC) and its implementing regulations, including, but not limited to Title 45, CFR, Sections 142, 160, 162, and 164, The Health Information Technology for Economic and Clinical Health Act (HITECH) regarding the confidentiality and security of patient information, and the Genetic Information Nondiscrimination Act (GINA) of 2008 regarding the confidentiality of genetic information. Except as otherwise provided in this Agreement, CONTRACTOR, as a Business Associate of COUNTY, may use or disclose Protected Health Information (PHI) to perform functions, activities or services for or on behalf of COUNTY, as specified in this Agreement, provided that such use or disclosure shall not violate the Health Insurance Portability and Accountability Act (HIPAA), USC 1320d et seq. The uses and disclosures of PHI may not be more expansive than those applicable to COUNTY, as the "Covered Entity" under the HIPAA Privacy Rule (45 CFR 164.500 et seq.), except as authorized for management, administrative or legal responsibilities of the Business Associate. B. CONTRACTOR, including its subcontractors and employees, shall protect, from -27- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 unauthorized access, use, or disclosure of names and other identifying information, including genetic information, concerning persons receiving services pursuant to this Agreement, except where permitted in order to carry out data aggregation purposes for health care operations [45 CFR Sections 164.504 (e)(2)(i), 164.504 (3)(2)(ii)(A), and 164.504 (e)(4)(i)] This pertains to any and all persons receiving services pursuant to a COUNTY funded program. This requirement applies to electronic PHI. CONTRACTOR shall not use such identifying information or genetic information for any purpose other than carrying out CONTRACTOR's obligations under this Agreement. C. CONTRACTOR, including its subcontractors and employees, shall not disclose any such identifying information or genetic information to any person or entity, except as otherwise specifically permitted by this Agreement, authorized by Subpart E of 45 CFR Part 164 or other law, required by the Secretary, or authorized by the client/patient in writing. In using or disclosing PHI that is permitted by this Agreement or authorized by law, CONTRACTOR shall make reasonable efforts to limit PHI to the minimum necessary to accomplish intended purpose of use, disclosure or request. D. For purposes of the above sections, identifying information shall include, but not be limited to name, identifying number, symbol, or other identifying particular assigned to the individual, such as finger or voice print, or photograph. E. For purposes of the above sections, genetic information shall include genetic tests of family members of an individual or individual, manifestation of disease or disorder of family members of an individual, or any request for or receipt of, genetic services by individual or family members. Family member means a dependent or any person who is first, second, third, or fourth degree relative. F. CONTRACTOR shall provide access, at the request of COUNTY, and in the time and manner designated by COUNTY, to PHI in a designated record set (as defined in 45 CFR Section 164.501), to an individual or to COUNTY in order to meet the requirements of 45 CFR Section 164.524 regarding access by individuals to their PHI. With respect to individual requests, access shall be provided within thirty (30} days from request. Access may be extended if CONTRACTOR cannot provide access and provides individual with the reasons for the delay and the date when access may be granted. PHI shall be provided in the form and format requested by the individual or COUNTY. CONTRACTOR shall make any amendment(s) to PHI in a designated record set at the request -28- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 of COUNTY or individual, and in the time and manner designated by COUNTY in accordance with 45 CFR Section 164.526. CONTRACTOR shall provide to COUNTY or to an individual, in a time and manner designated by COUNTY, information collected in accordance with 45 CFR Section 164.528, to permit COUNTY to respond to a request by the individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528. G. CONTRACTOR shall report to COUNTY, in writing, any knowledge or reasonable belief that there has been unauthorized access, viewing, use, disclosure, security incident, or breach of unsecured PHI not permitted by this Agreement of which it becomes aware, immediately and without reasonable delay and in no case later than two (2) business days of discovery. Immediate notification shall be made to COUNTY's Information Security Officer and Privacy Officer and COUNTY's DPH HIPAA Representative, within two (2) business days of discovery. The notification shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, disclosed, or breached. CONTRACTOR shall take prompt corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure required by applicable Federal and State Laws and regulations. CONTRACTOR shall investigate such breach and is responsible for all notifications required by law and regulation or deemed necessary by COUNTY and shall provide a written report of the investigation and reporting required to COUNTY's Information Security Officer and Privacy Officer and COUNTY's DPH HIPAA Representative. This written investigation and description of any reporting necessary shall be postmarked within the thirty (30) working days of the discovery of the breach to the addresses below: County of Fresno County of Fresno Department of Public Health Internal Services Department HIPPA Responsibility Director of Internal Services/ Privacy Officer Chief Information Officer (559) 600-6439 (559) 600-5800 P.O. Box 11867 333 W. Pontiac Way Fresno, CA 93775 Clovis, CA 93612 H. CONTRACTOR shall make its internal practices, books, and records relating to the use and disclosure of PHI received from COUNTY, or created or received by CONTRACTOR on behalf of -29- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 COUNTY, in compliance with HIPAA's Privacy Rule, including, but not limited to the requirements set forth in Title 45, CFR, Sections 160 and 164. CONTRACTOR shall make its internal practices, books, and records relating to the use and disclosure of PHI received from COUNTY, or created or received by CONTRACTOR on behalf of COUNTY, available to the United States Department of Health and Human Services (Secretary) upon demand. CONTRACTOR shall cooperate with the compliance and investigation reviews conducted by the Secretary. PHI access to the Secretary must be provided during CONTRACTOR's normal business hours, however, upon exigent circumstances access at any time must be granted. Upon the Secretary's compliance or investigation review, if PHI is unavailable to CONTRACTOR and in possession of a Subcontractor, it must certify efforts to obtain the information to the Secretary. I. SAFEGUARDS CONTRACTOR shall implement administrative, physical, and technical safeguards as required by the HIPAA Security Rule, Subpart C of 45 CFR 164, that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI, that it creates, receives, maintains or transmits on behalf of COUNTY and to prevent unauthorized access, viewing, use, disclosure, or breach of PHI other than as provided for by this Agreement. CONTRACTOR shall conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidential, integrity and availability of electronic PHI. CONTRACTOR shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of CONTRACTOR's operations and the nature and scope of its activities. Upon COUNTY's request, CONTRACTOR shall provide COUNTY with information concerning such safeguards. CONTRACTOR shall implement strong access controls and other security safeguards and precautions in order to restrict logical and physical access to confidential, personal (e.g., PHI) or sensitive data to authorized users only. Said safeguards and precautions shall include the following administrative and technical password controls for all systems used to process or store confidential, personal, or sensitive data: 1. Passwords must not be: -30- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 a) Shared or written down where they are accessible or recognizable by anyone else, such as taped to computer screens, stored under keyboards, or visible in a work area; b) A dictionary word; or c) Stored in clear text. 2. Passwords must be: a) Eight (8) characters or more in length; b) Changed every ninety (90) days; c) Changed immediately if revealed or compromised; and d) Composed of characters from at least three (3) for the following four (4) groups from the standard keyboard: 1. Uppercase letters (A-Z); 2. Lowercase Letters (a-z); 3. Arabic numerals (0-9); and 4. Non-alphanumeric characters (punctuation symbols). CONTRACTOR shall implement the following security controls on each workstation or portable computing device (e.g. laptop computer) containing confidential, personal, or sensitive data. 1. Network based firewall and/or personal firewall; 2. Continuously updated anti-virus software; and 3. Patch management process including installation of all operating system/software vendor security patches. CONTRACTOR shall utilize a commercial encryption solution that has received FIPS 140-2 validation to encrypt all confidential, personal, or sensitive data stored on portable electronic media (including, but not limited to, compact disks and thumb drives) and on portable computing devices (including, but not limited to, laptop and notebook computers). CONTRACTOR shall not transmit confidential, personal, or sensitive data via e-mail or other internet transport protocol unless the data is encrypted by a solution that has been validated by the National Institute of Standards and Technology (NIST) as conforming to the Advanced Encryption Standard (AES) Algorithm. CONTRACTOR must apply appropriate sanctions -31- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 against its employees who fail to comply with these safeguards. CONTRACTOR must adopt procedures for terminating access to PHI when employment of employee ends. J. MITIGATION OF HARMFUL EFFECTS CONTRACTOR shall mitigate, to the extent practicable, any harmful effect that is suspected or known to CONTRACTOR of an unauthorized access, viewing, use, disclosure, or breach of PHI by CONTRACTOR or its subcontractors in violation of the requirements of these provisions. CONTRACTOR must document suspected or known harmful effects and the outcome. K. CONTRACTOR’S SUBCONTRACTORS CONTRACTOR shall ensure that any of its contractors, including subcontractors, if applicable, to whom CONTRACTOR provides PHI received from or created or received by CONTRACTOR on behalf of COUNTY, agree to the same restrictions, safeguards, and conditions that apply to CONTRACTOR with respect to such PHI and to incorporate, when applicable, the relevant provisions of these provisions into each subcontract or sub-award to such agents or subcontractors. L. EMPLOYEE TRAINING AND DISCIPLINE CONTRACTOR shall train and use reasonable measures to ensure compliance with the requirements of these provisions by employees who assist in the performance of functions or activities on behalf of COUNTY under this Agreement and use or disclose PHI and discipline such employees who intentionally violate any provisions of these provisions, including termination of employment. M. TERMINATION FOR CAUSE Upon COUNTY's knowledge of a material breach of these provisions by CONTRACTOR, COUNTY shall either: 1. Provide an opportunity for CONTRACTOR to cure the breach or end the violation and terminate this Agreement if CONTRACTOR does not cure the breach or end the violation within the time specified by COUNTY; or 2. Immediately terminate this Agreement if CONTRACTOR has breached a material term of these provisions and cure is not possible. 3. If neither cure nor termination is feasible, COUNTY's Privacy Officer shall report the violation to the Secretary of the U.S. Department of Health and Human Services. -32- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 N. JUDICIAL OR ADMINISTRATIVE PROCEEDINGS COUNTY may terminate this Agreement in accordance with the terms and conditions of this Agreement as written hereinabove, if: (1) CONTRACTOR is found guilty in a criminal proceeding for a violation of the HIPAA Privacy or Security Laws or the HITECH Act; or (2) there is a finding or stipulation that CONTRACTOR has violated a privacy or security standard or requirement of the HITECH Act, HIPAA or other security or privacy laws in an administrative or civil proceeding in which CONTRACTOR is a party. O. EFFECT OF TERMINATION Upon termination or expiration of this Agreement for any reason, CONTRACTOR shall return or destroy all PHI received from COUNTY (or created or received by CONTRACTOR on behalf of COUNTY) that CONTRACTOR still maintains in any form, and shall retain no copies of such PHI. If return or destruction of PHI is not feasible, it shall continue to extend the protections of these provisions to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. This provision shall apply to PHI that is in the possession of subcontractors or agents, if applicable, of CONTRACTOR. If CONTRACTOR destroys the PHI data, a certification of date and time of destruction shall be provided to COUNTY by CONTRACTOR. P. DISCLAIMER COUNTY makes no warranty or representation that compliance by CONTRACTOR with these provisions, the HITECH Act, HIPAA or the HIPAA regulations will be adequate or satisfactory for CONTRACTOR's own purposes, or that any information in CONTRACTOR's possession or control, or transmitted or received by CONTRACTOR, is or will be secure from unauthorized access, viewing, use, disclosure, or breach. CONTRACTOR is solely responsible for all decisions made by CONTRACTOR regarding the safeguarding of PHI. Q. AMENDMENT The parties acknowledge that Federal and State laws relating to electronic data security and privacy are rapidly evolving and that amendment of these provisions may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to amend this agreement in order to implement the standards and requirements -33- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 of HIPAA, the HIPAA regulations, the HITECH Act and other applicable laws relating to the security or privacy of PHI. COUNTY may terminate this Agreement upon thirty (30) days written notice in the event that CONTRACTOR does not enter into an amendment providing assurances regarding the safeguarding of PHI that COUNTY in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA, the HIPAA regulations and the HITECH Act. R. NO THIRD-PARTY BENEFICIARIES Nothing express or implied in the terms and conditions of these provisions is intended to confer, nor shall anything herein confer, upon any person other than COUNTY or CONTRACTOR and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever. S. INTERPRETATION The terms and conditions in these provisions shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA regulations, and applicable State laws. The parties agree that any ambiguity in the terms and conditions of these provisions shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the HIPAA regulations. T. REGULATORY REFERENCES A reference in the terms and conditions of these provisions to a section in the HIPAA regulations means the section as in effect or as amended. U. SURVIVAL The respective rights and obligations of CONTRACTOR as stated in this Section shall survive the termination or expiration of this Agreement. V. NO WAIVER OF OBLIGATIONS No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other. XVI. DISCLOSURE OF SELF-DEALING TRANSACTIONS This provision is only applicable if CONTRACTOR is operating as a corporation (a for-profit or non-profit corporation) or if during the term of the agreement, CONTRACTOR changes its status to operate as a corporation. Members of CONTRACTOR’s Board of Directors shall disclose any self-dealing transactions that -34- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 they are a party to while CONTRACTOR is providing goods or performing services under this agreement. A self-dealing transaction shall mean a transaction to which CONTRACTOR is a party and in which one or more of its directors has a material financial interest. Members of the Board of Directors shall disclose any self-dealing transactions that they are a party to by completing and signing a Self- Dealing Transaction Disclosure Form, attached hereto as Exhibit “B” and incorporated herein by reference, and submitting it to COUNTY prior to commencing with the self-dealing transaction or immediately thereafter. XVII. ENTIRE AGREEMENT: This Agreement constitutes the entire agreement between CONTRACTOR and COUNTY with respect to the subject matter hereof, and supersedes all previous Agreement negotiations, proposals, commitments, writings, advertisements, publications, and understanding of any nature whatsoever unless expressly included in this Agreement. /// /// 1 IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of the day and year 2 first hereinabove written. 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 CONTRACTOR h , Leu:;,., dba DataTech911 ., 6751 Columbia Gateway Drive , Suite 300 Columbia , MD 21046 FOR ACCOUNTING USE ONLY : ORG: Account: Fund : Subclass : 56201693 7309 0001 10000 COUNTY OF FRESNO: ~~he Board of Supervisors of the County of Fresno ATTEST: Bernice E. Seidel Clerk of the Board of Supervisors County of Fresno , State of California By :_~_· -~---- Depu ~ -35- -36- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Exhibit “A” Authorized Facilities Abbreviation Hospital / Emergency Response Dispatch Center Address AMC-H Adventist Medical Center – Hanford 115 Mall Drive Hanford, CA 93230 AMC-R Adventist Medical Center – Reedley 372 W Cypress Ave Reedley, CA 93654 AMC-S Adventist Medical Center – Selma 1141 Rose Ave Selma, CA 93622 CCEMSA Central California EMS Agency 1221 Fulton Street Fresno, CA 93721 CCMC Clovis Community Medical Center 2755 Herndon Ave Fresno, CA 93611 COM Fresno EMS Communications Center 4555 E Hamilton Ave Fresno, CA 93702 CSCADU Fresno County Crisis Stabilization Center – Adult 4411 E Kings Canyon Rd Fresno, CA 93702 CSCYTH Fresno County Crisis Stabilization Center – Youth 4411 E Kings Canyon Rd Fresno, CA 93702 KCDPH Kings County Department of Public Health 330 Campus Drive Hanford, CA 93230 KH Kaiser Hospital 7300 N Fresno St Fresno, CA 93720 MCH Madera Community Hospital 1250 E Almond Ave Madera, CA 93637 MPH Madera Public Health 200 W 4th St Madera, CA 93637 RMC Community Regional Medical Center 2823 Fresno St Fresno, CA 93721 SAMC Saint Agnes Medical Center 1303 E Herndon Ave Fresno, CA 93711 VAH Veterans Administration Hospital 2615 E Clinton Ave Fresno, CA 93705 VCH Valley Children’s Hospital 9300 Valley Children’s Place Madera, CA 93638 -37- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Exhibit “B” SELF-DEALING TRANSACTION DISCLOSURE FORM In order to conduct business with the County of Fresno (hereinafter referred to as “County”), members of a contractor’s board of directors (hereinafter ref erred to as “County Contractor”), must disclose any self-dealing transactions that they are a party to while providing goods, performing services, or both for the County. A self-dealing transaction is defined below: “A self-dealing transaction means a transaction to which the corporation is a party and in which one or more of its directors has a material financial interest” The definition above will be utilized for purposes of completing this disclosure form. INSTRUCTIONS (1) Enter board member’s name, job title (if applicable), and date this disclosure is being made. (2) Enter the board member’s company/agency name and address. (3) Describe in detail the nature of the self-dealing transaction that is being disclosed to the County. At a minimum, include a description of the following: a. The name of the agency/company with which the corporation has the transaction; and b. The nature of the material financial interest in the Corporation’s transaction that the board member has. (4) Describe in detail why the self-dealing transaction is appropriate based on applicable provisions of the Corporations Code. (5) Form must be signed by the board member that is involved in the self-dealing transaction described in Sections (3) and (4). -38- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 (1) Company Board Member Information: Name: Date: Job Title: (2) Company/Agency Name and Address: (3) Disclosure (Please describe the nature of the self-dealing transaction you are a party to): (4) Explain why this self-dealing transaction is consistent with the requirements of Corporations Code 5233 (a): (5) Authorized Signature Signature: Date: