1-03-Exhibit-B IT-Terms.pdf

EXHIBIT B

INFORMATION TECHNOLOGY TERMS & CONDITIONS

1. Data Ownership: Vendor and County agree that all data created as a result of this Agreement, amendments thereto, and related Statements of Work (“SOW”) shall be owned by County. Vendor will provide to County, at termination of this agreement, a copy of all data in a mutually agreeable form without additional cost to the County.

2. Audits: Vendor agrees to provide County with information related to data access as requested by County and warrants that its systems will track system activity by user and will produce reports indicating which users accessed participant records and/or changed data, including date and time of access/change.

3. Confidentiality: Vendor will not use or disclose any County data other than as permitted or required by the underlying SOW or as required by law.

4. Safeguards: Vendor agrees to maintain commercially reasonable administrative, physical, and technical safeguards designed to protect security and confidentiality of and prevent use or disclosure of County data. At County’s request, Vendor shall furnish County a description of its safeguards and notice of any material revision thereto. To the extent Vendor furnishes professional services to County, Vendor represents that it shall not request or access more than the minimum amount of County data necessary for the performance of its professional services

5. Effects of Disclosure: Vendor agrees to mitigate, to the extent practicable, any harmful effect that is known to Vendor of a use or disclosure of County’s data by Vendor or its agents, subcontractors in violation of the requirements of the underlying SOW.

6. Security Breaches: Vendor agrees to take appropriate measures to prevent security breaches, as defined in 73 Pa. Stat. § 2301 (“Security Breach”). In the event of an actual Security Breach at the fault of Vendor, Vendor shall comply with the notification and notice requirements of the Pennsylvania Breach of Personal Information Notification Act, 73 Pa.

Stat. § 2301. Vendor shall maintain appropriate records of its investigations of actual Security Breaches.

7. Reporting Inadvertent Disclosures: Vendor agrees to report promptly, and in writing, to County any use or disclosure of County data not provided for by this Agreement and any security breach within the meaning of 73 Pa. Stat. § 2301 of which it becomes aware.

8. Bucks County Privacy Policy: Vendor will comply with County’s Privacy Policy and will use its best efforts to ensure, through written agreement, that any agent to whom it provides County data also agrees to adhere to the Bucks County Privacy Policy and the same restrictions and conditions that apply through the underlying SOW. Vendor warrants that its Privacy Policy will allow compliance with, at a minimum, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule; The Health Information Technology for Economic and Clinical Health (HITECH) Act; Pennsylvania Breach of Personal information Notification Act as amended by the Pennsylvania Act 151 of 2022; the Pennsylvania Social Security Number Privacy Act; and 42 Code of Federal Regulations (CFR) part 2, where applicable.

9. Modification of County Data: County will have access to modify County data at any time during the term of the Agreement.

10. Provider Data Use: Except as otherwise limited in the underlying SOW, Vendor may use or disclose County data to perform functions, activities, or services for, or on behalf of the County, as specified herein.

11. Authority to Act: Vendor may act pursuant to a request of County only if such request is made by an individual who is, or who is in a position or class, authorized to act on behalf of County in such regard, as specified in the Contact Sheet filled out by County or otherwise provided via written notice from County to Vendor.

12. SOC-2 Reports: Vendor agrees to attach, for any systems that are hosted by Vendor, a currently valid SOC-2 report, from an accredited auditing firm to the Agreement. Vendor agrees to maintain such certification throughout the term of the respective SOW. SOC-2 reports shall be provided for all systems in use by Vendor to perform under this Agreement that has County Data stored, transmitted, or otherwise processed by and/or through.

13. Encryption: All County data will be encrypted in storage and in transit at all times.

14. Secondary Site: Vendor agrees, for systems hosted by Vendor, to provide for a secondary site (backup site) in the case of primary site unavailability. Vendor shall ensure that all County data is backed up and stored in a manner that safeguards against unintentional modification, destruction, or cyber-criminal activity.

15. County Logo: Vendor agrees not to use County logo or otherwise publicize its relationship with the County in any of its marketing material without County’s written consent.

16. ADA Accessibility: Vendor certifies that all content, including, but not limited to, forms, pages, fields, information windows, etc., with special detail and content that is viewable and/or editable by the public, shall be in compliance with the American with Disabilities Act.

If the successful offeror will, for public use, create web content, offer services through a web browser, or mobile applications for the County, the offeror must comply with 28 CFR 35 Subpart H (Web and Mobile Accessibility) by ensuring accessibility at WCAG 2.1, Level AA specifications at a minimum. Offeror will defend, at their own expense, any action taken that challenges the accessibility of the unaltered content provided by the offeror.

17. Any documents provided by the offeror that will be made available via the County's websites or mobile applications must also meet ADA accessibility requirements. This includes, but is not limited to, ensuring compliance with Section 508 standards for electronic documents, providing text alternatives for images, using structured headings for readability, and ensuring compatibility with screen readers.

18. The offeror must also provide editable source documents (e.g., Word files, Excel files, HTML formats) alongside final published versions to facilitate future accessibility updates and ongoing compliance.

19. Secure Networks Act. Vendor agrees that it shall not introduce onto the County network any technology covered under section 2 of the Secure Networks Act. Such prohibited technologies can be found at https://www.fcc.gov/supplychain/coveredlist.

20. Bucks County staff or other authorized users defined by Bucks County: Vendor agrees to offer Single-Sign-On authentication with Bucks County’s Active Directory (AD) controller. Any login that is not SSO-enabled, shall have multi-factor authentication enabled.

Software-as-a-service systems are excluded from the following policies. The following only applied for systems maintained on county network:

21. System Logins: Vendor agrees to use multi-factor authentication for all County system logins.

22. Network Connectivity: County will utilize best efforts to resolve connectivity issues between County and Vendor. Vendor is wholly responsible for the maintenance and support of the network connectivity, including 5G (or other technology) router supplied by Vendor to connect to County systems.

23. System Access: Vendor agrees to notify County IT Help Desk of all system access requirements in advance, when possible. Vendor agrees to work with County towards a mutually agreeable system maintenance schedule.