Loading...
HomeMy WebLinkAboutAgreement A-20-352 with Terranova Worldwide Corporation.pdf-1- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 A G R E E M E N T THIS AGREEMENT is made and entered into this 22nd day of September, 2020, by and between the COUNTY OF FRESNO, a Political Subdivision of the State of California, hereinafter referred to as "COUNTY", and Terranova Worldwide Corporation , a Canadian For-Profit Corporation, whose address is 1545 boul. Del’Avenir, Laval, Quebec, Canada, H7S 2N5, hereinafter referred to as "CONTRACTOR". COUNTY and CONTRACTOR are referred to herein, collectively as “Parties” or “Party” individually. W I T N E S S E T H: WHEREAS, COUNTY, through its Department of Public Health, administers training for County staff pertaining to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) and requirements relative to the provision of healthcare related services to County’s service recipients; and WHEREAS, COUNTY requires a qualified vendor that is capable and experienced to provide a customized HIPAA web-based training for County use; and WHEREAS, CONTRACTOR has the demonstrated experience, knowledge and expertise in the provision of customized and hosted HIPAA web-based training; and WHEREAS, Parties entered into Agreement No. 16-032, January 26, 2016 for the provision of customized and hosted HIPAA web-based training; and WHEREAS, County Agreement No. 16-032 expires on January 26, 2021; and WHEREAS, the Parties mutually desire for CONTRACTOR to continue to provide to COUNTY the same services they have provided under County Agreement No. 16-032 upon its termination; and WHEREAS, CONTRACTOR desires to continue to provide customized web-based, hosted training services to COUNTY. NOW, THEREFORE, COUNTY and CONTRACTOR, in consideration of the mutual covenants, terms and conditions herein contained, hereto agree as follows: 1.RESPONSIBILITIES OF CONTRACTOR A.CONTRACTOR shall perform all services and fulfill all responsibilities set forth in the Scope of Services, Exhibit A, which is attached hereto and incorporated herein by this reference. Agreement No. 20-352 -2- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 B.CONTRACTOR shall make the Micro-learning Topics and Nano-learning Modules, listed in Exhibit B hereto, available to COUNTY for use no later than February 25, 2021. C.CONTRACTOR shall provide up to 40 hours of course material customization, upon COUNTY’s written request, that is separate from any customization necessitated due to a change in HIPAA law. 2.OBLIGATIONS OF THE COUNTY A.Should additional customization to CONTRACTOR’s web-based, hosted training course material be requested by COUNTY, COUNTY shall make available to CONTRACTOR all customization materials necessary to CONTRACTOR pursuant to Exhibit A. B.COUNTY shall make a primary contact available to CONTRACTOR as the COUNTY’s primary liaison for HIPAA web-based training customization and maintenance throughout the full term of this Agreement. 3.TERM The term of this Agreement shall be for a period of three (3) years, commencing on the 26th day of January 2021 through and including the 25th day of January 2024. This Agreement may be extended for two (2) additional consecutive twelve (12) month periods upon written approval of both parties no later than thirty (30) days prior to the first day of the next twelve (12) month extension period. The COUNTY’s DPH Director, or his or her designee, is authorized to execute such written approval on behalf of COUNTY based on CONTRACTOR’s satisfactory performance. 4.TERMINATION A.Non-Allocation of Funds - The terms of this Agreement, and the services to be provided hereunder, are contingent on the approval of funds by the appropriating government agency. Should sufficient funds not be allocated, the services provided may be modified, or this Agreement terminated, at any time by giving the CONTRACTOR thirty (30) days advance written notice. B.Breach of Contract - The COUNTY may immediately suspend or terminate this Agreement in whole or in part, where in the determination of the COUNTY there is: 1)An illegal or improper use of funds; 2)A failure to comply with any term of this Agreement; -3- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 3)A substantially incorrect or incomplete report submitted to the COUNTY; 4)Improperly performed service. In no event shall any payment by the COUNTY constitute a waiver by the COUNTY of any breach of this Agreement or any default which may then exist on the part of the CONTRACTOR. Neither shall such payment impair or prejudice any remedy available to the COUNTY with respect to the breach or default. The COUNTY shall have the right to demand of the CONTRACTOR the repayment to the COUNTY of any funds disbursed to the CONTRACTOR under this Agreement, which in the judgment of the COUNTY were not expended in accordance with the terms of this Agreement. The CONTRACTOR shall promptly refund any such funds upon demand. C.Without Cause - Under circumstances other than those set forth above, this Agreement may be terminated by COUNTY upon the giving of thirty (30) days advance written notice of an intention to term inate to CONTRACTOR. 5.COMPENSATION/INVOICING COUNTY agrees to pay CONTRACTOR and CONTRACTOR agrees to receive compensation at the rates specified in Exhibit B, attached hereto and incorporated herein by this reference. In no event shall actual services performed and products provided under this Agreement be in excess of Five Thousand and No/100 Dollars ($5,000) for customization services requested by COUNTY during the term of this Agreement. In no event shall actual services performed and products provided under this Agreement be in excess of Nineteen Thousand, Six Hundred and No/100 Dollars ($19,600) for annual licenses to the Hosted Learning Management System and Micro & Nano-Learning Modules, as well as related training products and materials for each twelve (12) month period (January 26 through January 25) of this Agreement. In no event shall the total maximum compensation for the full term of the Agreement exceed One Hundred and Three Thousand and No/100 Dollars ($103,000). It is understood that all expenses incidental to CONTRACTOR’s performance of actual services under this Agreement shall be borne by CONTRACTOR. CONTRACTOR shall invoice for each of the five (5) twelve (12) month periods of the Agreement annually. CONTRACTOR shall submit an invoice to COUNTY in the amount of Nineteen -4- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Thousand, Six Hundred and No/100 Dollars ($19,600), in payment for a license to and yearly maintenance of the hosted HIPAA web-based training. CONTRACTOR shall invoice COUNTY commensurate with actual COUNTY customization requested services in arrears for customization services provided during the preceding month, within forty-five (45) days after receipt and verification of CONTRACTOR’s invoices by COUNTY’s Department of Public Health. If CONTRACTOR should fail to comply with any provision of this Agreement, COUNTY shall be relieved of its obligation for further compensation. 6. INDEPENDENT CONTRACTOR In performance of the work, duties and obligations assumed by CONTRACTOR under this Agreement, it is mutually understood and agreed that CONTRACTOR, including any and all of the CONTRACTOR's officers, agents, and employees will at all times be acting and performing as an independent contractor, and shall act in an independent capacity and not as an officer, agent, servant, employee, joint venturer, partner, or associate of the COUNTY. Furthermore, COUNTY shall have no right to control or supervise or direct the manner or method by which CONTRACTOR shall perform its work and function. However, COUNTY shall retain the right to administer this Agreement so as to verify that CONTRACTOR is performing its obligations in accordance with the terms and conditions thereof. CONTRACTOR and COUNTY shall comply with all applicable provisions of law and the rules and regulations, if any, of governmental authorities having jurisdiction over matters the subject thereof. Because of its status as an independent contractor, CONTRACTOR shall have absolutely no right to employment rights and benefits available to COUNTY employees. CONTRACTOR shall be solely liable and responsible for providing to, or on behalf of, its employees all legally-required employee benefits. In addition, CONTRACTOR shall be solely responsible and save COUNTY harmless from all matters relating to payment of CONTRACTOR's employees, including compliance with Social Security withholding and all other regulations governing such matters. It is acknowledged that during the term of this Agreement, CONTRACTOR may be providing services to others unrelated to the COUNTY or to this Agreement. 7. MODIFICATION Any matters of this Agreement may be modified from time to time by the written consent of -5- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 all the parties without, in any way, affecting the remainder. 8.NON-ASSIGNMENT Neither party shall assign, transfer or sub-contract this Agreement nor their rights or duties under this Agreement without the prior written consent of the other party. 9.HOLD HARMLESS CONTRACTOR agrees to indemnify, save, hold harmless, and at COUNTY's request, defend the COUNTY, its officers, agents, and employees from any and all costs and expenses (including attorney’s fees and costs), damages, liabilities, claims, and losses occurring or resulting to COUNTY in connection with the performance, or failure to perform, by CONTRACTOR, its officers, agents, or employees under this Agreement, and from any and all costs and expenses (including attorney’s fees and costs), damages, liabilities, claims, and losses occurring or resulting to any person, firm, or corporation who may be injured or damaged by the performance, or failure to perform, of CONTRACTOR, its officers, agents, or employees under this Agreement. 10.INSURANCE Without limiting the COUNTY's right to obtain indemnification from CONTRACTOR or any third parties, CONTRACTOR, at its sole expense, shall maintain in full force and effect, the following insurance policies or a program of self-insurance, including but not limited to, an insurance pooling arrangement or Joint Powers Agreement (JPA) throughout the term of the Agreement: A.Commercial General Liability - Commercial General Liability Insurance with limits of not less than Two Million Dollars ($2,000,000.00) per occurrence and an annual aggregate of Four Million Dollars ($4,000,000.00). This policy shall be issued on a per occurrence basis. COUNTY may require specific coverages including completed operations, products liability, contractual liability, Explosion- Collapse-Underground, fire legal liability, or any other liability insurance deemed necessary because of the nature of this contract. B.Automobile Liability - Comprehensive Automobile Liability Insurance with limits of not less than One Million Dollars ($1,000,000.00) per accident for bodily injury and for property damages. Coverage should include any auto used in connection with this Agreement. C.Professional Liability - If CONTRACTOR employs licensed professional staff (e.g., -6- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Ph.D., R.N., L.C.S.W., M.F.C.C.) in providing services, Professional Liability Insurance with limits of not less than One Million Dollars ($1,000,000.00) per occurrence, Three Million Dollars ($3,000,000.00) annual aggregate. D. Worker's Compensation - A policy of Worker's Compensation insurance as may be required by the California Labor Code. E. Additional Requirements Relating to Insurance - CONTRACTOR shall obtain endorsements to the Commercial General Liability insurance naming the County of Fresno, its officers, agents, and employees, individually and collectively, as additional insured, but only insofar as the operations under this Agreement are concerned. Such coverage for additional insured shall apply as primary insurance and any other insurance, or self-insurance, maintained by COUNTY, its officers, agents and employees shall be excess only and not contributing with insurance provided under CONTRACTOR's policies herein. This insurance shall not be cancelled or changed without a minimum of thirty (30) days advance written notice given to COUNTY. CONTRACTOR hereby waives its right to recover from COUNTY, its officers, agents, and employees any amounts paid by the policy of worker’s compensation insurance required by this Agreement. CONTRACTOR is solely responsible to obtain any endorsement to such policy that may be necessary to accomplish such waiver of subrogation, but CONTRACTOR’s waiver of subrogation under this paragraph is effective whether or not CONTRACTOR obtains such an endorsement. Within Thirty (30) days from the date CONTRACTOR signs and executes this Agreement, CONTRACTOR shall provide certificates of insurance and endorsement as stated above for all of the foregoing policies, as required herein, to the County of Fresno, Department of Public Health, P.O. Box 11867. Fresno, California, 93775, Attention: Contracts Section – 6th Floor, stating that such insurance coverage have been obtained and are in full force; that the County of Fresno, its officers, agents and employees will not be responsible for any premiums on the policies; that for such worker’s compensation insurance the CONTRACTOR has waived its right to recover from the COUNTY its officers, agents, and employees any amounts paid under the insurance policy and that waiver does not invalidate the insurance policy; that such Commercial General Liability insurance names the County of Fresno, its officers, agents and employees, individually and collectively, as additional insured, but only insofar as the operations under -7- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 this Agreement are concerned; that such coverage for additional insured shall apply as primary insurance and any other insurance, or self-insurance, maintained by COUNTY, its officers, agents and employees, shall be excess only and not contributing with insurance provided under CONTRACTOR's policies herein; and that this insurance shall not be cancelled or changed without a minimum of thirty (30) days advance, written notice given to COUNTY. In the event CONTRACTOR fails to keep in effect at all times insurance coverage as herein provided, the COUNTY may, in addition to other remedies it may have, suspend or terminate this Agreement upon the occurrence of such event. All policies shall be issued by admitted insurers licensed to do business in the State of California, and such insurance shall be purchased from companies possessing a current A.M. Best, Inc. rating of A FSC VII or better. 11.AUDITS AND INSPECTIONS The CONTRACTOR shall at any time during business hours, and as often as the COUNTY may deem necessary, make available to the COUNTY for examination all of its records and data with respect to the matters covered by this Agreement. The CONTRACTOR shall, upon request by the COUNTY, permit the COUNTY to audit and inspect all of such records and data necessary to ensure CONTRACTOR's compliance with the terms of this Agreement. If this Agreement exceeds ten thousand dollars ($10,000.00), CONTRACTOR shall be subject to the examination and audit of the Auditor General for a period of three (3) years after final payment under contract (Government Code Section 8546.7). 12.NOTICES The persons and their addresses having authority to give and receive notices under this Agreement include the following: COUNTY CONTRACTOR Director, Count of Fresno Lise Lapointe Department of Public Health Terranova Worldwide Corporation P.O. Box 11867 1545 boul. De l’Avenir Fresno, CA 93775 Laval, Quebec, Canada, H7S 2N5 All notices between the COUNTY and CONTRACTOR provided for or permitted under this Agreement must be in writing and delivered either by personal service, by first-class United States mail, by -8- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 an overnight commercial courier service, or by telephonic facsimile transmission. A notice delivered by personal service is effective upon service to the recipient. A notice delivered by first-class United States mail is effective three COUNTY business days after deposit in the United States mail, postage prepaid, addressed to the recipient. A notice delivered by an overnight commercial courier service is effective one COUNTY business day after deposit with the overnight commercial courier service, delivery fees prepaid, with delivery instructions given for next day delivery, addressed to the recipient. A notice delivered by telephonic facsimile is effective when transmission to the recipient is completed (but, if such transmission is completed outside of COUNTY business hours, then such delivery shall be deemed to be effective at the next beginning of a COUNTY business day), provided that the sender maintains a machine record of the completed transmission. For all claims arising out of or related to this Agreement, nothing in this section establishes, waives, or modifies any claims presentation requirements or procedures provided by law, including but not limited to the Government Claims Act (Division 3.6 of Title 1 of the Government Code, beginning with section 810). 13. GOVERNING LAW Venue for any action arising out of or related to this Agreement shall only be in Fresno County, California. The rights and obligations of the parties and all interpretation and performance of this Agreement shall be governed in all respects by the laws of the State of California. 14. CONFIDENTIALITY All services performed by CONTRACTOR under this Agreement shall be in strict conformance with all applicable Federal, State of California and/or local laws and regulations relating to confidentiality. 15. DISCLOSURE OF SELF-DEALING TRANSACTIONS This provision is only applicable if the CONTRACTOR is operating as a corporation (a for-profit or non-profit corporation) or if during the term of the agreement, the CONTRACTOR changes its status to operate as a corporation. Members of the CONTRACTOR’s Board of Directors shall disclose any self-dealing transactions that they are a party to while CONTRACTOR is providing goods or performing services -9- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 under this Agreement. A self-dealing transaction shall mean a transaction to which the CONTRACTOR is a party and in which one or more of its directors has a material financial interest. Members of the Board of Directors shall disclose any self-dealing transactions that they are a party to by comple ting and signing a Self-Dealing Transaction Disclosure Form, attached hereto as Exhibit C and incorporated herein by reference, and submitting it to the COUNTY prior to commencing with the self-dealing transaction or immediately thereafter. 16.ENTIRE AGREEMENT This Agreement, including Exhibits A, B, and C, constitutes the entire agreement between the CONTRACTOR and COUNTY with respect to the subject matter hereof and supersedes all previous Agreement negotiations, proposals, commitments, writings, advertisements, publications, and understanding of any nature whatsoever unless expressly included in this Agreement. /// /// /// /// /// /// /// /// /// /// /// /// /// /// /// /// /// 1 IN WITNESS WHEREOF , the parties hereto have executed this Agreement as of the day 2 and year first hereinabove written. 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ture) J-$~ L:/1/l;)//}'3 J cm Print Name & Title " Mail ing Address (Authorized Signature) Print Name & Title (Corporation , or any Assistant Secretary , or Ch ief Financial Officer, or any Assistant Treasurer) MailinQ Address FOR ACCOUNTING USE ONLY : Fund: 0001 Subclass: 10000 ORG : 56201500 Account: 7295 COUNTY OF FRESNO E. ~/ol,,-~~ Ernest Buddy Mende ~airman of the Board of Supervisors of the County of Fresno ATTEST: Bernice E . Seidel Clerk of the Board of Supervisors County of Fresno , State of California -10- Exhibit A Page 1 of 6 Scope of Services The COUNTY was designated a hybrid entity for HIPAA purposes by the Fresno County Board of Supervisors in October 2002 and within the designated hybrid entity are the HIPAA covered component departments and programs. The COUNTY’s Department of Public Health and Department of Behavioral Health make up the majority of covered entity staff who are required to be HIPAA trained. The COUNTY also provides operational support services to its Public Health and Behavioral Health departments through various other covered enti ty departments and programs such as the Auditor-Controller’s Audits and General Accounting Divisions, the County Clerk’s Records Management Unit and the Internal Services Department. COUNTY policy requires that each of the covered component departments or programs must provide HIPAA training to its workforce members within forty -five (45) days of the start of employment and at least annually thereafter. The COUNTY typically trains 2,000 to 2,500 full- time, part-time, contracted, student, and intern workforce members annually, but have trained as many as 3,500 annually in the past ; therefore, the COUNTY needs to have the capability to train up to 3,500 workforce members annually. The actual number of workforce members trained each year is dependent upon several factors including staff turnover and attrition; therefore, the COUNTY does not guarantee a minimum level of usage. The COUNTY requires the CONTRACTOR to provide customized web-based, hosted training services to COUNTY for the purpose of training COUNTY’s designated covered component department and program workforce members. The content of the tra ining will serve as the core training for privacy and security compliance knowledge that is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology Economics and Clinical Health Act of 2009 (HITECH). Training services shall be provided in consideration of and in adherence to the following components: I.Fundamental Requirements 1.The training shall comply with the requirements of HIPAA Privacy and Security (45 CFR, Parts 160 and 164) law. 2.Emphasize the HIPAA Privacy Rule specific to the confidentiality of protected health information (PHI) in medical and behavioral health care settings and health care employee required compliance with maintaining client confidentiality. 3.Include Information Technology (IT) security information appropriate for th e end user and information on the privacy and security of electronic protected health information (ePHI). 4.Include information about other federal and state laws and regulations that pertain to the privacy of health care information that the Departments of Public Health and Behavioral Health are subject to, as applicable. Exhibit A Page 2 of 6 5.At a minimum, comprehensive initial training and an abbreviated training shall be provided: A.The comprehensive, initial training will be given to workforce members upon hire. B.The abbreviated training will be given to workforce members at least annually thereafter and/or as needed to provide compliance. II.Training Design and Customization Requirements 1.The training shall be web-based. 2.The training shall comply with the requirements of HIPAA Privacy and Security (45 CFR, Parts 160 and 164) law. 3.The training shall remain legally accurate. The CONTRACTOR shall continuously monitor the law throughout the duration of the agreement. If the law changes in a way that would necessitate a change in training content, the CONTRACTOR shall update the training appropriately and shall provide access to the updated training to the COUNTY at no additional charge. The updated training shall be provided within thirty (30) days of the effective date of the change in law. 4.If a COUNTY program changes in a way that would necessitate a change in training content after the initial final training has been approved and ma de available for use by COUNTY, the CONTRACTOR shall update the training per COUNTY’s specifications. The COUNTY requested change should be completed within thirty (30)days of request by COUNTY. 5.The training shall be designed and delivered in a manner s uch that learners cannot advance through screens or modules without gaining knowledge. The training shall be structured in a way that requires workforce members to complete every page of the instruction. That is, workforce members will not be able to skip through the material but will have to be exposed to all instruction. Workforce members who have not completed every page of instruction will not be able to enter the end -of-training assessment, which will be required for a participant to be certified as having completed the training. 6.The training shall focus on behavior. The instruction shall follow these important principles: A.Instead of providing a simplistic list of “do ’s and don’ts”, the training program will focus on exploring the nuances of “gra y area” situations. B.Instruction shall be legally accurate but written in practical easy-to-understand terms. Rather than relying on legal terminology, instruction should: Exhibit A Page 3 of 6 1) Distill statutes, cases, and regulations into clear behavioral principles; 2) Teach workforce members those principles; and 3) Require workforce members to apply those principles to real-life scenarios (specific to behavioral health and public health preferred) that they may encounter in the workplace. C. The training shall be highly interactive and include numerous engaging exercises that help workforce members explore the nuances of the law. Examples should be realistic and structured around complicated work scenarios. 7. The training shall include a way to ensure that all workforce members have learned the material by utilizing a post-test assessment that requires a minimum passing score of 70%. 8. The training shall provide an easy to use report function and be provided in a format that will allow the COUNTY to maintain a record of workforce member training details. A. At a minimum, the reports must: 1) Have the ability to track workforce members’ progress and status of having completed or not completed the training, 2) Be available to specified COUNTY supervisors and administrators and must include workforce members’ names and other unique identifier (e.g., unique individual email address, Employee Number), departments, supervisor, date and time of training completion, and post -test assessment. 3) Include workforce members that did not achieve a 70% or better on the post-test assessment. 4) Have the option of allowing differing layers of administrative control and access to the training records at COUNTY’s discretion. 9. The training shall accommodate retraining on an individual basis as needed without the use of an additional user license for a workforce member who has already been granted a user license during the same year period. 10. The training shall be interactive and include audio -visual scenarios to engage learners. Text only courses will not be sufficient. 11. The training shall incorporate a COUNTY introductory video to be added to the beginning the training courses at COUNTY’s discretion. This video may be updated and/or changed periodically dependent upon the change of Privacy Office staff. COUNTY shall provide the video in a format agreeable to CONTRACTOR. 12. The training shall be easy to navigate by using a mouse to click on a simple set of buttons (e.g., forward, back, replay). The training shall also provide a navigation help feature that describes how to move about in the training. Exhibit A Page 4 of 6 13.The training shall provide the ability for the workforce member to start, stop, and come back to the training for completion. With this feature, workforce members need not complete the training in one sitting; if they exit the training, their place must be saved. When they return to the training, they must be returned to the section where they left off. 14.The training shall provide audio instruction and all audio shall also be provided in text form. In order to accommodate multiple learning styles and to make the training as engaging as possible, it shall contain extensive audio, both narration and within scenarios. All words spoken in the training shall also be available as text (closed captioning). The training shall not be written at a higher than a high school reading level. 15.Upon COUNTY request, CONTRACTOR will work with COUNTY to add additional content that covers the roles and responsibilities of supervisors and managers with regard to HIPAA compliance and reporting of incidents. This could be accomplished by offering an extra module of the training that only COUNTY -identified supervisors and managers would have to complete. 16.The initial comprehensive training shall require the average workforce member no more than three (3) hours to complete and the abbreviated training shall require no more than one (1) hour to complete. 17.The training shall be customized for the County of Fresno by use of the County Seal and by including instructions in the training specific to the County’s HIPAA Management Directives and specific incident and breach reporting procedures, at COUNTY’s discretion. III.Miscellaneous Requirements 1.The training shall be updated at least annually throughout the term of the agreement to reflect any changes to HIPAA, HITECH, or other privacy or security law. 2.Both the comprehensive and abbreviated trainings must be consistently available to the COUNTY in order to train new employees as they are hired throughout the year and then on an annual basis thereafter. 3.Access to the training will be provide d to up to 3,500 COUNTY workforce members (users). 4.CONTRACTOR must provide support to key administrative staff as identified by COUNTY. CONTRACTOR will be required to respond to designated key staff within one (1) business day. COUNTY and CONTRACTOR will mutually agree on a timeframe for any training fixes requiring greater than one (1) busin ess day for resolution. Exhibit A Page 5 of 6 IV.Project Timeframe 1.Should additional customization be requested by COUNTY, COUNTY shall provide customization materials to CONTRACTOR to allow for a rollout date for the new customized material to be made available to COUNTY’s work force member users within fourteen (14) days of providing customization materials to CONTRACTOR or upon an mutually agreed upon date , if more than (14) days. 2.COUNTY shall make a COUNTY HIPAA designated staff available to CONTRACTOR to confer with and to answer questions pertaining to the customization requirements. 3.The training, including the Micro -learning Topics and Nano-learning Modules (see Exhibit B), shall be fully delivered and fully operational within thirty (30) days of the contract being fully executed, in consideration of all necessary input being provided to the CONTRACTOR by the COUNTY. V. COUNTY’S OBJECTIVES The COUNTY’s objective is to provide its covered entity workforce members with comprehensive and engaging privacy and security tra ining that is up-to-date and will increase their knowledge and compliance with HIPAA, HITECH, and other privacy laws. Upon completion of the CONTRACTOR provided training services, COUNTY workforce members are expected to meet the following training object ives and outcomes: 1.Develop a greater understanding of HIPAA and other privacy regulations. 2.Understand the rights of COUNTY’s patients/clients. 3.Be able to identify what constitutes PHI. 4.Understand what the “minimum necessary” standard is. 5.Understand what PHI can be used or disclosed, who can use it, and to whom it can be disclosed. 6.Understand the ways in which PHI can be used specific to public health activities (what constitutes public health activities). 7.Understand the ways in which PHI can be used specific to emergency preparedness, planning, and response operations. 8.Understand additional confidentiality requirements when dealing with PHI specific to HIV/AIDS and other communicable diseases, mental heal th, substance abuse, and other extremely sensitive health information that is protected by California or federal law. Exhibit A Page 6 of 6 9.Understand how to apply HIPAA and privacy regulation requirements in their daily routines and responsibilities. 10.Develop an understanding that covered entities and individuals can be subject to internal sanctions and civil and criminal penalties for failure to comply and what the consequences of non-compliance are to the client, the County, and to the workforce member (including licensed workforce members). 11.Understand their responsibility to report to a supervisor or manager if they suspect a privacy or security incident or breach has occurred. 12.Understand their responsibilities as supervisors and managers to monitor HIPAA compliance of their staff, report suspecte d privacy or security incidents or breaches to the Privacy Officer and/or Security Officer (or designees) immediately, and to assist the Privacy Officer and/or Security Officer (or designees) in the investigation of the incident or breach. 13.Understand the County process of incident investigation, state and federal reporting, and client notification in the case of a breach. 14.Be reminded that the County of Fresno has HIPAA Management Directives that they must be familiar with and abide by. 15.Understand business associate relationships. Page 1 of 3 Agreement with Terranova WW Corporation Budget Exhibit B Products Details Year 1 Year 2 (Maintenance) Year 3 (Maintenance) Year 4 (Maintenance) Year 5 (Maintenance) HIPAA Privacy Awareness Course Up to 3,500 Users English Included Included Included Included Included HIPAA Privacy Awareness Refresher Course Up to 3,500 Users English Included Included Included Included Included HIPAA Information Security Awareness Refresher Course Up to 3,500 Users English Included Included Included Included Included HIPAA Information Security Awareness Course Up to 3,500 Users $19,600.00 $19,600.00 $19,600.00 $19,600.00 $19,600.00 (34 modules) 1.Introduction to Information Security 2.Passwords 3.Email 4.The Clean Desk Principle 5.Social Networks 6.Mobile Users 7.Physical Protection 8.Privacy 9.Malware 10.Responsible use of the Internet at work 11.Identity Theft 12.Phishing 13.Information Lifecycle 14.Information Classification 15.Intellectual Property 16.Access Control 17.Confidentiality on the Web 18.The Bring Your Own Device (BYOD) trend 19.Social Engineering 20.Smartphones 21.Cloud Computing 22.Mobile Devices 23.Traveling Safety 24.Protecting Card Data 25.Protecting Your Home Computer 26.Ransomware 27.Responsible Use of the Internet 28.Smartphones 29.Social Engineering 30.Social Networks 31.The Clean Desk Principle 32.Traveling Securely 33.Unintentional Insider Threat 34.Working Remotely English Page 2 of 3 Total Project Cost for Five (5) year Term $103,000.00 Micro-learning Topics 1.Access Control 2.Business Email Compromised (BEC) 3.Clean Desk 4.C-Level Email Impersonation 5.Handling Unidentified Individuals 6.Insider Threat 7.Mass Market Phishing 8.Malware - Risky USB 9.Physical Security 10.Ransomware 11.Smishing 12.Spear Phishing 13.Vishing 14.Web Phishing 15.Whaling Included Included Included Included Included Nano-learning Modules 1.Being Security Aware 2.Cyber Attack Detection 3.Identity Theft - Example of an Attack 4.Insider Threat 5.Phishing - Six Clues That Should Raise Your Suspicions 6.Phishing - Ransomware 7.Phishing - Vishing 8.Phishing - Spear Phishing (CEO Fraud) 9.Phishing - Phishing Website 10.Phishing - Smishing 11.Phishing - Anatomy of a Spear Phishing Attack 12.Preventing Security Breaches 13.Protecting Sensitive information - Information Handling 14.Social Engineering 15.Social Networks 16.Wi-Fi Security Included Included Included Included Included Learning Management System (Hosted) 3500 Users Included Included Included Included Included Communication Tools - (Posters, Newsletters and Wallpapers) Included Included Included Included Included Included Total – Annual Licenses $19,600.00 $19,600.00 $19,600.00 $19,600.00 $19,600.00 $19,600.00 Five Year Subtotal – ($19,600.00 x 5) For Annual Licenses, Hosted Learning Management System, Micro- & Nano-Learning Modules $98,000.00 Optional Additional Charge – Customization of the HIPAA courses including text, audio, links to policies, best practices, etc. upon County request 40 hours at $125.00 per hour $5000.00 Page 3 of 3 Miscellaneous Information: 1.The licensing cost for courses and for the LMS is annual 2.No tax will be charged to County of Fresno, as Terranova Corporation is a Canadian entity. 3.Quote expiration date: December 1st, 2020 Exhibit C SELF-DEALING TRANSACTION DISCLOSURE FORM In order to conduct business with the County of Fresno (hereinafter referred to as “County”), members of a contractor’s board of directors (hereinafter referred to as “County Contractor”), must disclose any self-dealing transactions that they are a party to while providing goods, performing services, or both for the County. A self-dealing transaction is defined below: “A self-dealing transaction means a transaction to which the corporation is a party and in which one or more of its directors has a material financial interest” The definition above will be utilized for purposes of completing this disclosure form. INSTRUCTIONS (1)Enter board member’s name, job title (if applicable), and date this disclosure is being made. (2)Enter the board member’s company/agency name and address. (3)Describe in detail the nature of the self-dealing transaction that is being disclosed to the County. At a minimum, include a description of the following: a.The name of the agency/company with which the corporation has the transaction; and b.The nature of the material financial interest in the Corporation’s transaction that the board member has. (4)Describe in detail why the self-dealing transaction is appropriate based on applicable provisions of the Corporations Code. (5)Form must be signed by the board member that is involved in the self-dealing transaction described in Sections (3) and (4). Exhibit C (1)Company Board Member Information: Name: Date: Job Title: (2)Company/Agency Name and Address: (3)Disclosure (Please describe the nature of the self-dealing transaction you are a party to): (4)Explain why this self-dealing transaction is consistent with the requirements of Corporations Code 5233 (a): (5)Authorized Signature Signature: Date: