10769914_-_Clozapine_ANC_POC_Testing_RFO_rebid_2.pdf

REQUEST FOR OFFER (RFO) 10769914

Rebid 2

November 25, 2024

You are invited to review and respond to RFO# 10769914, rebid 2, California Correctional Health Care Services (CCHCS) to procure a Clozapine absolute neutrophil count (ANC) point-of-care (POC) testing device to be utilized for necessary laboratory monitoring for patients prescribed clozapine. By submitting your offer, you agree to comply with the instructions contained in this document as well as the requirements described in the associated Exhibit A – Scope of Work. Please read the enclosed document carefully.

The Agreement award is subject to availability of funds approved for this purpose and only by mutual consent of the parties in writing.

RFOs must be received no later than the date and time specified in Section Key Action Dates. Failure to comply with any of the instructions may cause the offer to be rejected.

Please note that no verbal information given will constitute a binding agreement with CCHCS unless such information is issued in writing as an official addendum.

CCHCS Procurement Official: Kevin Arredondo

Phone: (916) 379-4793 Email: kevin.arredondo@cdcr.ca.gov

RFO # 10769914, rebid 2

CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES

Table of Contents

I. Response Guidelines

II. Exhibit A – Scope of Work

III. Exhibit B – Budget Detail and Payment Provisions

IV. Exhibit C – Cost Worksheet

V. Exhibit D – Software/Service Provider Acknowledgment

VI. Exhibit E – HIPAA Business Associate Agreement VII. Exhibit F – Information Security Agreement (ISA)

VIII. Exhibit G – List of Participating Institutions IX. Exhibit H – CCHCS Special Provisions X. Required Attachments Checklist

Attachment 1 Required Attachment Checklist Attachment 2 Offer/Offer Certification Sheet

Attachment 3 Bidder’s Declaration Form, GSPD-05-105

Attachment 4 Disabled Veteran Business Enterprise Declarations, DGS PD 843

Attachment 5 Payee Data Record, STD. 204, and Supplement Payee Data Record, STD. 205

Attachment 6 Iran Contracting Act Verification Form

Attachment 7 California Civil Rights Laws, DGS OLS 04

Attachment 8 Darfur Contracting Act Certification, DGS PD 1

Attachment 9 Generative Artificial Intelligence (GenAI) Reporting and Factsheet, STD 1000

Attachment 10 Commercially Useful Function Documentation

Attachment 11 Mandatory Requirements

Attachment 12 Desirable Requirements

Attachment 13 Department of General Services Provisions

I.

Response Guidelines

This RFO, including all exhibits, and Offeror’s response, will be made part of the CCHCS IT ordering department’s purchase documents and/or procurement contract file.

1. Submission of Quotes

The complete RFO package submission must be emailed to kevin.arredondo@cdcr.ca.gov. The email subject must start with “RFO 10769914, rebid 2”. If attachments are too large for a single email, then you may split the response into multiple emails.

Note: It is the sole responsibility of the Offeror to contact the Contract Analyst to verify receipt of submitted Quote. CCHCS is not responsible for e-mail loss or delivery delays.

2. Key Action Dates

Time is of the essence both for the RFO submittal and contract completion. Please take note of the key dates and times shown below:

EVENT DATE AND TIME

1 RFO Release Date November 25, 2024

2 Last Day to Submit Questions December 2, 2024 by 2:00 PM

3 Final Date to Submit a RFO Package December 11, 2024 by 2:00 PM

4 Estimated Agreement Term Upon approval not to exceed 12 months

3. RFO Response Requirements and Content

RFO response must contain all requested information and data and must conform to the format described in this RFO. It is the Offeror’s responsibility to provide all necessary information for assessment by CCHCS. Responses will be verified and Offeror’s ability to perform under the RFO will be determined by CCHCS as outlined in the RFO.

A. Offerors must include all applicable items listed on the Required Attachments

Checklist. RFO packages that are conditional or fail to submit the required documentation by the date and time shown in the Key Action Dates may cause CCHCS to deem the Offer as non-responsive.

B. The specific tasks associated with this RFO are included in the Exhibit A - Scope of Work (SOW). Offerors must be submitted for the performance of all services described herein. Any deviation from the work specifications will eliminate the Offeror from further consideration and award.

C. CCHCS will not accept alternate contract language from the Offeror. CCHCS objects to and will not evaluate or consider any additional terms or conditions submitted by an Offeror. There will be no negotiations of any terms or conditions. If a contract is awarded to the Offeror, the Offeror agrees to execute CCHCS terms and conditions in:

• EXHIBIT D – Software/Service Provider Acknowledgment

• EXHIBIT H – CCHCS Special Provisions

• Attachment 13: Department of General Services Provisions

By responding to RFO# 10769914, rebid 2, Offeror agrees to the state’s Terms and Conditions above. If the Offeror refuses to agree to the state’s Terms and Conditions after an award is made, then that refusal could be grounds to rescind the award and award the contract to another Offeror.

D. Costs incurred for the development of Offers, in anticipation of award, are entirely the responsibility of Offeror and shall not be charged to CCHCS or the State of California.

E. CCHCS may amend or modify the RFO prior to the Final Date for Offer Submission indicated in the Key Action Dates of this RFO. All modifications and/or amendments to the RFO will be made in writing and released to all parties who received the RFO.

Additionally, CCHCS may extend the submission date of the RFO.

F. Offers submitted as Small Business (SB) and/or Disabled Veteran Business Enterprise (DVBE) must provide and include a SB/DVBE Certification. In accordance with California Government Code Section 14837(d) and California Military and Veterans Code Section 999, all SB and DVBE contractors, subcontractors and suppliers that offer on or participate in a State contract, shall perform a Commercially Useful Function (CUF) and provide a CUF declaration.

G. CCHCS is not required to make an award under this RFO.

H. The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI tools, while balancing the risks of these new technologies.

Bidder / Offeror / Contractor must notify the State in writing if their solution or service includes, or makes available, any GenAI including GenAI from third parties or subcontractors.

The State has developed a GenAI Reporting and Factsheet (STD 1000) to be completed by the Bidder / Offeror / Contractor.

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std1000.pdf

Failure to submit the GenAI Reporting and Factsheet (STD 1000) will result in disqualification of the Bidder / Offeror / Contractor.

Failure to report GenAI to the State may void any resulting contract. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon receipt of a Bidder / Offeror / Contractor GenAI Reporting and Factsheet (STD 1000), the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

4. Selection Process

All Offers will be reviewed for responsiveness to requirements of this RFO. If a response is missing required information, it may be deemed non-responsive. Further review is subject to the discretion of CCHCS.

Award of a contract resulting from this RFO will be based on a “Best Value” with cost as one of the criteria. CCHCS is not constrained to accept the lowest cost offer and will compare all offers to determine best value, which means the offer that best meets, and potentially exceeds, CCHCS requirements at the most reasonable overall cost.

Administrative Evaluation

The Assessment Team reviews the Offers to determine whether all Administrative Requirements were provided. Responsiveness to the requirements in this RFO will be either given a “pass” (e.g., complied with requirements, completed, and returned documents) or “fail” (e.g., did not comply with requirements, did not complete or return documents). Only those Offers that receive a passing score will proceed to the next step.

Technical Evaluation

• Review and verify the Mandatory Requirements in Attachment 11. Responsiveness to the Mandatory Requirements will be either given a “pass” (e.g., all requirements are selected as “Can Meet”) or “fail” (e.g., one or more requirements are selected as “Cannot Meet”).

• Review and verify the Desirable Requirements in Attachment 12. For each requirement that is selected as “Can Meet” one point will be awarded.

Desirable Qualifications

Each proposed Contractor that meets a desirable qualification will be scored up to the specific desirable allowable maximum points. If a Contractor does not meet the desirable qualification, the candidate will receive zero (0) points.

•Contractors must provide a copy of a Small Business Certificate from State of California Certification to receive points.

• Contractors must provide a copy of a Disabled Veteran Business Enterprise from State of California Certification to receive points.

Cost Assessment

Contractors must provide a Cost Worksheet – Exhibit C listing the total price.

Calculated as follows:

Lowest Offered Cost divided by Higher Cost = Cost Ratio. Cost Ratio multiplied by Total Cost Points = Awarded Cost Points

Example:

$120 Lowest Proposed Offer x 75 Total Cost Points = 69.23 Points $130 Vendor’s Total Cost

Step 1 – Administrative Evaluation Evaluation Criteria Review for all mandatory documents required per Required Attachments Checklist and verify compliance with the RFO instructions.

Pass / Fail

Step 2 – Technical Evaluation Evaluation Criteria Review and verify Mandatory Requirements in Attachment 11 Pass / Fail

Review and verify Desirable Requirements in Attachment 12 (1 point for each requirement)

Score Based 3 points possible

Step 3 – Desirable Qualification Evaluation Criteria Small Business (SB) Prime Contractor certification Score Based

1 Point Disabled Veteran Business Enterprise Contractor (DVBE) certification

1 Point

Step 4 – Cost Evaluation Evaluation Criteria

Cost Worksheet - Exhibit C - Cost Assessment

75 points possible

5. Award of Contract

Award of contract, if made, will be in accordance with the RFO information on Evaluation to a responsible bidder whose bid complies with all the requirements of the RFO documents and an addenda thereto, except for such immaterial defects as may be waived by the state. Award, if made, will be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFO; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

The state reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFO, unless otherwise expressly provided in the state’s RFO. Unless the bidder specifies otherwise in its bid, the state may accept any item or group of items of any bid. The state reserves the right to modify or cancel in whole or in part it’s RFO.

Written notification of the state’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the state, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the paragraph titled “Protests” of this RFO.

6. Protests

Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or if they result in a protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final.

If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFO and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the state has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful supplier” will be heard and resolved by DGS’ Government Claims Board whose decision will be final.

All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be mailed or delivered to:

Deputy Director Procurement Division 707 Third Street, Second Floor South West Sacramento, CA 95605 Facsimile No.: (916) 375-4611

All protests to the RFO or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by the DGS/PD Deputy Director as promptly as possible, but not later than the date indicated in the Notification of Intent to Award. Certified or registered mail must be used unless delivered in person; in which case the protester should obtain a receipt of delivery.

II.

Exhibit A

Scope of Work

1. Introduction and Background

California Department of Corrections and Rehabilitation/California Correctional Health Care Services (CDCR/CCHCS) Statewide Mental Health Program – Request to procure a Point of Care (POC) testing device to be utilized for necessary laboratory monitoring for patients prescribed clozapine at institutions.

This Statement of work (SOW) is for a POC testing device. The clozapine POC Absolute Neutrophil Count (ANC) testing device will allow CDCR/CCHCS to expand the footprint of institutions that offer clozapine to our severely mentally ill patients.

The benefits of this include but are not limited to increased availability of one of the most effective treatments in mental health, increased consistency of monitoring and safety for patients prescribed the medication, and increased transfer options for patients on the medication. Our aim is to reduce barriers to the use of clozapine within CDCR/CCHCS. POC testing would reduce one identified barrier to clozapine treatment.

Clozapine is a highly effective, but underutilized medication that has Food and Drug Administration (FDA) approval for targeting treatment resistant schizophrenia and suicidal behavior in patients who have schizophrenia or schizoaffective disorder. It has been shown to be effective in reducing overall suicidal and self- harm behavior.

Its use requires close monitoring of absolute neutrophil counts, as there is an estimated incidence of 0.9% for the development of severe neutropenia (1).

Providers and pharmacies are required to register with the Clozapine Risk Evaluation and Mitigation Strategy (REMS) and each patient on clozapine must be registered with their values input prior to medication being dispensed for that monitoring interval. Monitoring of ANC requires weekly testing for at least the first six (6) months, followed by testing every two (2) weeks, then monthly testing. For a patient with an uncomplicated treatment trajectory, this would equate to approximately 39 tests per year during the first year, followed by monthly tests thereafter. Currently, routine blood draws are completed in order to perform the required monitoring. One literature review conducted cited that “The complete refusal of blood tests was considered a major barrier, with patients delaying the initiation of clozapine” (2) and another article identified that “patient non-adherence with blood work” (2) was a barrier to treatment. They additionally identified articles that evaluated POC testing in overcoming barriers to the use of clozapine, and found that “both patients and practitioners showed preference for the capillary blood sampling” (2).

2. Scope of Services

The vendor providing the POC testing device shall provide, at a minimum, the physical devices, and access to any applications or software and updates needed.

Any necessary equipment or supplies needed for the utilization of the device, to include but not limited to testing strips compatible with the device, software or platform application access shall be provided by the vendor for the duration of the departments use of the device. Troubleshooting assistance, ongoing maintenance and remote service and assistance options shall be provided by the vendor.

3. Expectation of the Software Application

A. Mandatory Requirements

1) Must be able to offer POC results for ANC blood testing.

2) Health Insurance Portability and Accountability Act (HIPAA) compliant.

3) Must include all testing materials needed for the device, for the term of the contract.

4) CDCR/CCHCS must have immediate electronic availability of test results.

5) The device must be portable

6) Procurement must include training of CCHCS staff on utilization of the device.

Initial training shall be provided to CCHCS staff at State regional offices or locations specified by contract manager or liaison.

7) Maintenance and software/application updates must be included.

Maintenance shall be performed by the vendor at the Institutions listed in the Exhibit G, List of Participating Institutions.

8) Access to any applications/software programs and updates must be included.

B. Desirable Requirements

1) Ability to integrate with the Risk Evaluation and Mitigation Strategy (REMS).

2) Ability to integrate with the electronic healthcare record.

3) POC testing availability for additional laboratory tests.

4. Acceptance of Software Solutions

The POC testing device must meet the mandatory requirements as set forth above, and ideally the desirable requirements. The application must be user friendly and have the potential for direct integration with CDCR/CCHCS applications.

5. Work Location

Software updates shall be performed remotely. Maintenance shall be performed at the institutions listed on the Exhibit G, List of Participating Institutions. CCHCS reserves the right to add additional locations to this request.

6. Contractor Roles and Responsibilities

A. Provide CDCR with a POC testing device that can, at a minimum, assess a patient’s absolute neutrophil count in a timely and accurate manner.

B. Provide training to CDCR/CCHCS staff regarding the use of the device and any associated applications.

C. Provide training to CDCR/CCHCS staff regarding troubleshooting of the device and any associated applications.

D. Provide any additional equipment necessary for the utilization of the device

(such as test strips, access to platforms, etc) for the duration of the contract.

E. Provide annual maintenance on equipment.

F. Provide maintenance and support to device and software.

7. Payment Structure and Invoicing Requirements

Payment for software and maintenance for 12 months or longer will be paid for the first year only and must be invoiced on an annual basis for the remaining period. For complete details see Exhibit B – Budget Detail and Payment Provisions.

8. Security

The device and any associated applications must meet all requirements for HIPAA compliance as set forth in standard guidelines. This device must also comply with all CDCR/CCHCS confidentiality and security requirements as determined by CDCR regulations.

9. Support and Training

The vendor shall provide initial instruction to staff at field offices to describe the process for utilization of the device and any associated applications or programs.

The vendor shall be available to address questions or issues that arise with the device or any associated applications for the duration of the department’s use of the device. The vendor shall instruct institutions on and provide any necessary tools for the ongoing maintenance of the devices.

10. Period of Performance:

The term of this Agreement is upon approval not to exceed 12 months with one (1) optional one (1) year extension.

11. Amendments:

CCHCS reserves the option to extend the agreement for additional time and money at the rates evaluated and considered, through a formal Agreement amendment.

The Agreement award is subject to availability of funds approved for this purpose.

No amendment or variation of the terms of this Agreement shall be valid unless submitted in writing, and agreed upon by both parties and approved, as required.

Products are price protected (fixed prices throughout the enrollment period) at the price identified in the Exhibit C - Cost Worksheet.

12. California Correctional Health Care Services Responsibilities:

A. Designate a person (Program Manager) to whom all Contractor communication may be addressed and who has the authority to act on all aspects of the service.

This person may review the Agreement and associated documents with the Contractor to ensure an understanding of the responsibilities of both parties.

B. Provide timely review and approval of information and documentation provided by the Contractor to perform its obligations.

13. Terms and Conditions:

To submit an offer, you must comply with the instructions contained in this document as well as the requirements described in Exhibit A – Statement of Work, Exhibit C – Cost Worksheet, Exhibit D, Software/Service Provider Acknowledgment, Exhibit H, CCHCS Special Provisions, and Attachment 13, Department of General Services Provisions.

By responding to this offer, the Offeror agrees to the State’s Terms and Conditions.

If the Offeror refuses to agree to the State’s Terms and Conditions after an award is made, then that refusal could be grounds to rescind the award and award the contract to another Offeror.

14. Executive Order N-6-22 – Russia Sanctions:

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting an offer or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s offer/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

15. Coronavirus (COVID-19) Requirement

The Contractor agrees to comply with the following. Failure to meet these requirements may result in the termination of the contractor or contract.

a) Screening: The Contractor shall not dispatch any employees who are exhibiting COVID-19 symptoms to CDCR/CCHCS worksites/locations. Each Contractor employee who visits institutional grounds may be required to undergo a health questionnaire to screen for COVID-19 before being granted access into the institution.

b) Testing: In addition to the screening, Contractor employees working full time at any institution or facility grounds may be subject to COVID-19 testing in the same manner as institution staff.

c) Facial Coverings: Contractors are advised that mask requirements at each institution or facility may vary, (such as N95 masks being required and provided at certain locations) and as such, the requirements for that institution must be followed. Additionally, institutions or facilities may update their requirements in which case the Contractor’s employees must adhere to such updated requirements.

d) Vaccinations: The Contractor agrees to comply with current State Public Health Officer Orders issued by the California Department of Public Health (CDPH) as it pertains to vaccination requirements for contractor staff in certain locations/settings. Such Orders, including any CCHCS requirements, will be enforced by the Contract Manager.

16. Generative Artificial Intelligence (GenAI) Notification Clause and Disclosure

All contracts, regardless of acquisition type or acquisition method, must contain the following GenAI notification clause:

During the term of the contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAI technology, including GenAI from third parties or subcontractors. Contractor shall immediately complete the GenAI Reporting and Factsheet (STD 1000) to notify the State of any new or previously unreported GenAI technology.

At the direction of the State, Contractor shall discontinue the use of any new or previously undisclosed GenAI technology that materially impacts functionality, risk or contract performance, until use of such GenAI technology has been approved by the State.

Failure to disclose GenAI use to the State and submit the GenAI Reporting and Factsheet (STD 1000) may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAI and/or failure to submit the GenAI Reporting and Factsheet (STD 1000) as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief it may be entitled to as a result of such non-disclosure.

The State reserves the right to amend the contract, without additional cost, to incorporate GenAI Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.

17. Notices:

All notices required by or relating to this Agreement shall be in writing and shall be sent to the parties of this Agreement at their address as set below unless changed from time to time, in which event each party shall notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail and directed to the following addresses below:

18. Advertising of Data:

The Contractor and any service providers are not authorized to use, sell, resell, package, or repackage or publicly display any information or data without the express written approval of the State. This restriction includes keyword searching or data mining of state data. Advertising is not allowed in any of these services or to any of the contacts associated with these services.

19. Termination Provisions:

The State may exercise its option to terminate this Agreement at any time with 30 calendar days’ prior written notice.

20. Primary Contacts The technical representative during the term of this Agreement will be:

State

Agency Contractor

California Correctional Health Care Services

TBD

Attn: Nicole Morrison Attn:

Phone: (916) 385-1422 Phone:

Address: 10750 4th Street, Suite 150

Rancho Cucamonga CA 91730 Address:

E-mail: Nicole.morrison@cdcr.ca.gov E-mail:

Direct all contract related inquiries to:

State Agency

Contractor

California Correctional Health Care Services

TBD

Attn: Kevin Arredondo Attn:

Phone: (916) 379-4793 Phone:

Address: 8260 Longleaf Dr, Elk Grove, CA, 95758 Address:

E-mail: Kevin.arredondo@cdcr.ca.gov E-mail:

III.

Exhibit B

Budget Detail and Payment Provisions

1. Invoicing and Payment

A. For services satisfactorily rendered and upon receipt and approval of invoices, CCHCS agrees to reimburse Contractor for said services, no more than annually, upon receipt and approval of itemized invoices, and in accordance with Exhibit C - Cost Worksheet.

B. Payment for services performed under the Agreement shall be made in accordance with the State of California’s Prompt Payment Act (GC Section 927 et seq.).

C. Invoices shall include the Contract Number, sufficient scope and detail to define the actual work performed, including a description of the activities of the Contractor and Subcontractor, the hours allocated to those activities, the locations where work was performed, the expenses claimed, any required reports, and shall be submitted to:

California Department of Corrections and

Rehabilitation Sacramento Accounting Office

Attention: Accounts Payable A

PO Box 187015 Sacramento, CA 95818-7015

D. The Contractor also has the option to submit invoices electronically to the appropriate email address listed below. The Contractor must use the name on the Agreement and the Agreement on the subject line of the email. The email must include an attached PDF file of the invoices, in accordance with the information above, and must reference the institution acronym and the invoice number. For electronic submission, send invoices to:

medicalcontractinvoices@cdcr.ca.gov

2. Payment Structure

The payment structure for software and maintenance for 12 months or longer will be paid for the first year only and must be invoiced on an annual basis for the remaining period. Progress payments shall occur monthly upon approval of work completed for said services in accordance with Exhibit C - Cost Worksheet. All invoices shall be submitted to the Contract Manager for review/approval.

mailto:medicalcontractinvoices@cdcr.ca.gov

3. Budget Contingency Clause

A. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

B. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Agreement with no liability occurring to the State or offer an agreement amendment to Contractor to reflect the reduced amount.

4. Prompt Payment Clause

A. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927.

5. Subcontractor

For all Agreements, with the exception of Interagency Agreements and other governmental entities/auxiliaries that are exempt from bidding, nothing contained in the Agreement, or otherwise, shall create any contractual relation between the State and any subcontractors, and no subcontract shall relieve Contractor of contractor’s responsibilities and obligations hereunder. Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by the Contractor. The Contractor’s obligation to pay its subcontractors is an independent obligation from the State’s obligation to make payments to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any moneys to any subcontractor.

IV.

Exhibit C

Cost Worksheet

Offeror’s must submit a cost quote for each item(s) in the following list and clearly state unit and extended price.

Rates/Unit price will not be adjusted and are required to remain at the same rate throughout the entire agreement and any optional period of service resulting from this agreement.

Quantities listed on the Exhibit C, Cost Worksheet are the State’s estimates only. The State does not expressly or by implication agree that the actual amount of work/units will correspond therewith and reserves the right to increase/omit portions of the work/units as may be deemed necessary or advisable by the State. Failure to indicate a dollar amount (BLANK CELL) in any item may be grounds to reject the bid. A zero-dollar amount ($0.00) listed for any and/or all items shall be interpreted and understood by the State to mean that the bidder shall perform any such services at NO COST to the State.

A.

B.

Equipment includes initial 12 months of warranty coverage at zero cost ($0.00) upon purchase.

Item

Description Quantity Unit Price

Total Cost

1 Device 30 X $ = $

2 Test Strips 3800 X $ = $

3 Annual Maintenance 30 X $ = $

TOTAL AMOUNT OF A $

Item

Description Estimated Hours Hourly

Rate

Total Cost

Implementation: Initial training and support, device setup.

9 X $ = $

TOTAL AMOUNT OF B $

GRAND TOTAL (SUM OF A+B) $

V.

Exhibit D

Software/Service Provider Acknowledgment

TO: Vendors and Resellers of Information Technology Software

SUBJECT: Clozapine absolute neutrophil count (ANC) point-of-care (POC) testing device

California law requires that State agency information technology (IT) acquisitions follow standard procurement procedures and contract forms in accordance with Public Contract Code Sections 12100 et seq. and the State Administrative Manual (SAM). Accordingly, California Correctional Health Care Services (CCHCS) is prohibited from agreeing to supplier agreements that conflict with State IT contract forms.

To move forward with acquisition of an IT software service or product, CCHCS shall ensure the acquisition will be governed by the same State IT contract terms between CCHCS and the applicable vendor and any applicable reseller. The solicitation contains several State IT contract forms that are required by SAM Section 5230.1.

In order to consider a vendor’s or reseller’s proposal complete, the vendor and the reseller are required to sign the Software/Service Provider Acknowledgment below and return a copy of this letter as part of the response to the CCHCS procurement request. As a condition to determining the bid responsive, the vendor and reseller shall agree to the State Terms and Conditions as outlined in the solicitation as these terms will govern the awarded contract. CCHCS reserves the sole right to determine whether a bid fails to meet this requirement and bids submitted without this signed acknowledgement will not be considered or scored.

Further, as part of this solicitation or a Leveraged Procurement Agreement, this letter informs any bidder that the following will be the order of precedence noted in the final agreement, and will supersede any other documents attached to, or referenced within, the vendor or reseller solicitation response:

1) General Provisions – Information Technology (GSPD-401IT) effective 06/23/2022

2) Cloud Computing SaaS General Provisions effective 06/21/2022

3) Cloud Computing Services Special Provision effective 03/15/2018

4) Cloud Computing Services Special Provision (IaaS; PaaS) effective 5/11/2016

5) GSPD-ITGP (Non-Cloud Goods and Services – Rev. 11/12/24)

6) GSPD-ITGP (Cloud Computing Services – Rev. 11/12/24)

If after submitting the signed acknowledgement with the proposal, a winning bidder then refuses to execute the contract with those terms, such refusal is grounds for CCHCS to invalidate the bid, rescind the award, and award to another compliant vendor or republish the solicitation.

If you have any questions, contact the analyst referenced in the solicitation.

California Correctional Health Care Services Information Technology Services Division – Acquisition Services

SOFTWARE SERVICE/PROVIDER ACKNOWLEDGMENT:

[Vendor Company] (“Contractor” or “Service Provider”) agrees to the General Provisions (GSPD-401IT) dated June 23, 2022, Cloud Computing SaaS General Provisions dated June 21, 2022, Cloud Computing Services Special Provisions dated March 15, 2018, Cloud Computing Services Special Provisions (IaaS; PaaS) dated May 11, 2016, GSPD-ITGP (Non-Cloud Goods and Services – Rev. 11/12/24) and GSPD-ITGP (Cloud Computing Services – Rev. 11/12/24) if applicable, and to the order of precedence as stated herein.

Optional Signature:

FULL NAME

Job Title

Company

Date:

[Vendor Reseller, if applicable] (“Contractor” or “Service Provider”) agrees to the General Provisions (GSPD-401IT) dated June 23, 2022, Cloud Computing SaaS General Provisions dated June 21, 2022, Cloud Computing Services Special Provisions dated March 15, 2018 and Cloud Computing Services Special Provisions (IaaS; PaaS) dated May 11, 2016, GSPD-ITGP (Non-Cloud Goods and Services – Rev. 11/12/24), GSPD-ITGP (Cloud Computing Services – Rev. 11/12/24) if applicable, and to the order of precedence as stated herein.

Mandatory Signature:

Full Name:

Job Title:

Company:

Date:

VII. EXHIBIT F – INFORMATION SECURITY AGREEMENT (ISA)

1. Introduction and Purpose A. This Information Security Agreement (ISA) outlines the Service Provider requirements for the collection, maintenance, and dissemination of any information that identifies or describes an individual in conjunction with the performance of services provided to CCHCS under any contract, purchase document, Memorandum of Understanding (MOU), or any other transaction involving information receipt or information exchange between CCHCS and the Service Provider.

B. This ISA does not substitute for any other addendum, attachment, exhibit or obligation with respect to protected health information and the applicability of and requirement to comply with the Health Information Portability and Accountability Act of 1996 (HIPAA) P.L. No. 104- 191, 110 Stat. 1938 (1996), including the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2. Definitions A. The term “personal information” means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, [their] name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual under the provisions of the California Information Practices Act (Civil Code Section 1798 et Seq.).

B. The term “public information” means information maintained by State agencies that is not exempt from disclosure under the provisions of the California Public Records Act (Government Code Sections 6250-6265) or other applicable State or Federal laws.

C. The term “confidential information” means information maintained by State agencies that is exempt from disclosure under the provisions of the California Public Records Act (Government Code Sections 6250-6265) or has restrictions on disclosure in accordance with other applicable State or federal laws.

D. The term “sensitive information” means any public information or confidential information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion as identified in Information Security Program Management Standard 5305-A of the California Statewide Information Management Manual (SIMM).

E. The term “service provider” means any vendor, contractor, subcontractor, or third party, including employees, independent contractors or consultants providing any service to CCHCS under this ISA.

3. Acknowledgments As an entity engaged in a contract, agreement, MOU and/or information receipt and/or information exchange with CCHCS, you (herein referred to as the Service Provider) acknowledge and agree that in the course of a contract, agreement, MOU by and as indicated beyond, Service Provider shall comply with applicable United States and California laws and regulations, including but not limited to Sections 14100.2 and 5328 et seq. of the Welfare and Institutions Code, Section 431.300 et seq. of Title 42, Code of Federal Regulations, HIPAA, including but not limited to Section 1320 d et seq., of Title 42, United States Code and its implementing regulations (including but not limited to Title 45, CFR, Parts 160, 162 and 164) regarding the confidentiality and security of individually identifiable health information (IIHI), California Medical Information Act, Lantermann-Petris-Short Act, Alcohol Substance and Abuse Act, California Public Records Act, California Information Practices Act of 1977, the California State Administrative Manual (SAM) and its associated regulations, mandates, budget letters and memorandums, and the SIMM.

4. Standard of Care A. Service Provider acknowledges and agrees that, in the course of its engagement by

CCHCS, Service Provider may receive or have access to sensitive and/or private information.

B. Service Provider shall comply with the terms and conditions set forth in this ISA regarding creation, collection, receipt, management, sharing, exchanging, transmission, storage, disposal, use and disclosure of sensitive and confidential information.

C. Service Provider shall be responsible for, and remain liable to, CCHCS for the actions of unauthorized employees, contractors and subcontractors concerning the treatment of CCHCS related sensitive and confidential information, as if they were Service Provider’s own actions.

D. In recognition of the foregoing, Service Provider acknowledges and agrees it shall:

i. Treat sensitive and confidential information with such degree of care required by

Federal and State requirements including but not limited to the United States National Institute for Standards and Technology and the SAM Chapter 5300.

ii. Collect, use and disclose sensitive and confidential information solely and exclusively for the purposes for which the information, or access to it, is provided pursuant to the terms and conditions of this ISA;

iii. Not use, sell, rent, transfer, distribute, or otherwise disclose or make available sensitive or confidential information for the benefit of anyone other than CCHCS without CCHCS’s prior written consent.

5. Responsibilities of the Service Provider A. The Service Provider is obligated to ensure the following:

i. Safeguards. To prevent the unauthorized creation, use, management, transfer, distribution, storage, etc. other than as provided for by this ISA. The Service Provider shall develop and maintain an information privacy and security program that includes the implementation of administrative, technical, and physical safeguards appropriate to `the size and complexity of the Service Provider’s operations and the nature and scope of its activities. The information privacy and security programs must reasonably and appropriately protect the confidentiality, integrity, and availability of the CCHCS information it creates, receives, maintains, or transmits; and prevent the use or disclosure of CCHCS information other than as provided for by this ISA. The Service Provider shall provide CCHCS with information concerning such safeguards as CCHCS may reasonably request from time to time.

ii. The Service Provider shall restrict logical and physical access to CCHCS sensitive and confidential information to authorized users only.

iii. The Service Provider shall implement appropriate authentication methods to ensure information system access to sensitive and confidential information. If passwords are used in user authentication (e.g., username/password combination), the Service Provider shall implement strong password controls on all compatible computing systems (including hand held and mobile devices) that are consistent with the National Institute of Standards and Technology (NIST) Special Publication 800-68 and the SANS Institute Password Protection Policy.

B. The Service Provider shall:

i. Implement the following security controls on each server, workstation, or portable computing device (e.g., laptop or computer) that processes or stores sensitive or confidential information;

ii. Install a network-based firewall and/or personal firewalls;

iii. Continuously update anti-virus software on all systems;

iv. Institute a patch-management process including installation of all operating system/software vendor security patches; and

v. Encrypt all confidential, personal, or sensitive data stored on portable electronic media (including but not limited to CDs and thumb drives) and on computing devices (including but not limited to laptops, computers, cell phones, and tablets) with a solution that uses proven industry standard encryption algorithms.

C. The Service Provider shall not transmit confidential, personal, or sensitive data via e-mail or other Internet transport protocol over a public network unless, at minimum, a 128-bit encryption method (for example AES, 3DES, or RC4) and strong passwords are used to secure the data.

D. Mitigation of Harmful Effects. To the extent practicable, Service Provider will mitigate harmful effects known to the Service Provider of a use or disclosure of sensitive and/or confidential information by the Service Provider or its sub-Service Providers.

E. Agents and Contractors or Subcontractors of the Service Provider. To ensure any agent, including a contractor or subcontractor to the Service Provider that provides CCHCS information or created or received by the agent, contractor or subcontractor for the purposes of this Contract, Service Provider shall ensure that such agents, contractors or subcontractors comply with the same restrictions and conditions in this ISA that apply to the Service Provider with respect to such information.

F. Notification of Electronic Breach or Improper Disclosure. During the term of this ISA, Service Provider shall notify CCHCS within 24 hours upon discovery of any probable breach of sensitive or confidential information where (1) the information is reasonably believed to have been acquired by an unauthorized person and/or (2) reasonably believed to have an effect of more than 499 people/identities. Immediate notification shall be made to the CCHCS Chief Information Security Officer and/or their designee(s). Service Provider shall take prompt corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations while at the same time preserving evidence for investigation. Service Provider shall investigate such breach and provide a written report of the investigation to the CCHCS Information Security Officer, postmarked or e-mailed to CCHCS-ISO@cdcr.ca.gov within eight (8) business days of the discovery of the breach.

G. Employee Training and Discipline. To train and use reasonable measures to ensure compliance with the requirements of this ISA by employees who assist in the performance of functions or activities under this ISA and use or disclose CCHCS information; and have in place a disciplinary process for such employees who intentionally violate any provisions of this ISA, up to and including termination of employment as required by law or policy.

H. Audits, Inspection and Enforcement. From time to time, CCHCS may inspect the facilities, systems, books and records of Service Provider to monitor compliance with this ISA. Service Provider shall promptly remedy any violation of any provision of this ISA and shall certify the same to the CCHCS Information Security Officer in writing. The fact that CCHCS inspects, or fails to inspect, or has the right to inspect, Service Provider’s facilities, systems and procedures does not relieve Service Provider of its responsibilities to comply with this ISA.

CCHCS’s failure to detect or detection but failure to notify Service Provider or require Service Provider’s remediation of any unsatisfactory practice, does not constitute acceptance of such practices or a waiver of CCHCS’s enforcement rights under this ISA.

Additionally, OIS may request a SOC 2, Type II report.

mailto:CCHCS-ISO@cdcr.ca.gov

6. Termination A. Termination for Cause. Upon CCHCS’s knowledge of a material breach of this ISA by

Service Provider, CCHCS shall either:

i. Provide an opportunity for Service Provider to cure the breach or end the violation and terminate this ISA if Service Provider does not cure the breach or end the violation within the time specified by CCHCS.

ii. Immediately terminate this ISA if Service Provider has breached a material term of this ISA and cure is not possible; or

iii. If neither cure nor termination is feasible, the CCHCS Information Security Officer shall report the violation to the CCHCS Chief Privacy Officer and Director of the CCHCS Legal Office.

B. Judicial or Administrative Proceedings. CCHCS may terminate this ISA, effective immediately, if (i) Service Provider is found liable in a civil matter; or (ii) found guilty in a criminal matter proceeding for a violation of federal or State law, rules and/or regulations, in particular within the nature of information confidentiality and protection.

Effect of Termination. Upon termination or expiration of this ISA for any reason, Service Provider shall return or destroy all CCHCS information received from CCHCS that Service Provider still maintains in any form, and shall retain no copies of such information; or, if return or destruction is not feasible, it shall continue to extend the protections of this ISA to such information, and limit further use of such information to those purposes that make the return or destruction of such information infeasible. This provision shall apply to information that is in the possession of contractors to the Service Provider and/or agents of the Service Provider.

VIII. EXHIBIT G – LIST OF PARTICIPATING INSTITUTIONS

NOTE: CCHCS makes no guarantee that all Institutions listed will request services

INSTITUTIONS TELEPHONE

NUMBER

California Medical Facility (CMF) 1600 California Drive Vacaville, CA 95687

(707) 448-6841

California State Prison - Corcoran (COR) 4001 King Avenue Corcoran, CA 93212-8309

(559) 992-8800 Salinas Valley State Prison (SVSP) 31625 Highway 101 Soledad, CA 93960-1020

(831) 678-5500

California State Prison – San Quentin (SQ) Main Street San Quentin, CA 94965

(415) 454-1460

Richard J. Donovan Correctional Facility (RJD) 480 Alta Road San Diego, CA 92179

(619) 661-6500

California State Prison–Sacramento (SAC) 100 Prison Road Represa, CA 95671

(916) 985-8610

Mule Creek State Prison (MCSP) 4001 Highway 104 Ione, CA 95640

(209) 274-4911

North Kern State Prison (NKSP) 2737 West Cecil Avenue Delano, CA 93215

(661) 721-2345

California Health Care Facility (CHCF) 7707 South Austin Road Stockton, CA 95215

(209) 467-2500

California Institution for Women (CIW) 16756 Chino-Corona Road Corona, CA 92880

(909) 597-1771

Central California Women’s…