40DHHS-S3391-Insurance Requirements.docx

INSURANCE AND INDEMNIFICATION REQUIREMENTS

SECTION C – PROFESSIONAL SERVICE AGREEMENTS

Professional Contracts – Technology Products/Services (Including data and equipment)

Contracts for Technology products and services like system integration, programming and data management create specialized exposures from loss or loss of use of the state’s tangible property and intangible property (software, data or other electronically stored information).

Additionally as more systems become dependent upon network solutions, such as cloud services or mobile computing platforms; there is an increased risk for privacy and/or data security issues. Any contract involving capturing or processing the sensitive data, should include cyber liability coverage.

Sensitive data includes the following:

· Personally Identifiable Information (PII), such as name, address, date of birth, SSN

· Protected health information (PHI, HIPAA, HI-TECH);

· Student information (FERPA);

· Criminal History Repository Information (CHRI),

· Federal Tax Information (FTI);

· Bank accounts or credit/debit cards (PCI);

The fast pace of technology advances coupled with a highly competitive marketplace can lead to situations where IT vendors over-promise or misrepresent what their service/products solutions are able to deliver. Additionally, the nature of the agreements give vendors unique access to the state’s IT resources and data which could result in security issues if systems or data were misused, damaged or compromised.

The types of losses that can occur under such circumstances are often excluded under general liability policies. However, they can be covered through separate professional liability insurance policies, also known as “errors and omissions” (E&O) liability insurance.

Insurers have developed specialized policies E&O Policies that provide IT professionals coverage for the two common forms of IT liability risks: “malpractice” claims in which the company/individual were negligent in maintaining acceptable professional standards and breach of contract for failing to provide contracted services with timeframe or agreed specifications.

Examples of services that would require professional liability coverage include but are not limited to:

· Software development

· Computer consulting

· Web site design/programming

· Multi-media designers

· Integrated computer system design

· Data Management

· Other computer service providers

Sample Insurance Specifications Professional Contracts – Information Technology

The following paragraphs should be inserted into the contract

INSURANCE REQUIREMENTS:

Contractor and subcontractors shall procure and maintain until all of their obligations have been discharged, including any warranty periods under this Contract are satisfied, insurance against claims for injury to persons or damage to property which may arise from or in connection with the performance of the work hereunder by the Contractor, his agents, representatives, employees or subcontractors.

The insurance requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that might arise out of the performance of the work under this contract by the Contractor, his agents, representatives, employees or subcontractors and Contractor is free to purchase additional insurance as may be determined necessary.

A. MINIMUM SCOPE AND LIMITS OF INSURANCE: Contractor shall provide coverage with limits of liability not less than those stated below. An excess liability policy or umbrella liability policy may be used to meet the minimum liability requirements provided that the coverage is written on a “following form” basis.

1. Commercial General Liability – Occurrence Form Policy shall include bodily injury, property damage and broad form contractual liability coverage.

a. The policy shall be endorsed to include the following additional insured language: "The State of Nevada shall be named as an additional insured with respect to liability arising out of the activities performed by, or on behalf of the Contractor".

2. Automobile Liability - can be waived if contract does not involves use of motor vehicle.

Bodily Injury and Property Damage for any owned, hired, and non-owned vehicles used in the performance of this Contract.

Combined Single Limit (CSL) $1,000,000

a. The policy shall be endorsed to include the following additional insured language: "The State of Nevada shall be named as an additional insured with respect to liability arising out of the activities performed by, or on behalf of the Contractor, including automobiles owned, leased, hired or borrowed by the Contractor"

3. Worker's Compensation and Employers' Liability

4. Technology E&O/Professional Liability

The policy shall cover professional misconduct or lack of ordinary skill for those positions defined in the Scope of Services of this contract.

a. In the event that the professional liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract; and that either continuous coverage will be maintained or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

5. Network Security (Cyber) and Privacy Liability:

For Contracts under $5 Million

For Contracts greater than $5 Million

Contact Risk Management Division This errors and omissions insurance shall include coverage for third party claims and losses including with respect to network risks (such as data breaches, transmission of virus/malicious code; unauthorized access or criminal use of third party, ID/data theft) and invasion of privacy regardless of the type of media involved in the loss of private information (such as computers, paper files and records, or voice recorded tapes), covering collection, use, access, etc. of personally identifiable information., direct liability, as well as contractual liability for violation of privacy policy, civil suits and sublimit for regulatory defense/indemnity for payment of fines and penalties.

a. The retroactive coverage date shall be no later than the effective date of this contract.

b. Contractor shall maintain an extended reporting period for not less than two (2) years after termination of this contract.

6. Fidelity Bond or Crime Insurance (contracts involving financial accounts or data) Bond or Policy Limit (contact Risk Management) ___________

a. The bond or policy shall include coverage for all directors, officers, agents and employees of the Contractor.

b. The bond or policy shall include coverage for third party fidelity and name the State of Nevada as loss payee.

c. The bond or policy shall include coverage for extended theft and mysterious disappearance.

d. The bond or policy shall not contain a condition requiring an arrest and conviction.

e. Policies shall be endorsed to provide coverage for computer crime/fraud.

C. NOTICE OF CANCELLATION: Contractor shall for each insurance policy required by the insurance provisions of this Contract shall not be suspended, voided or canceled except after providing thirty (30) days prior written notice been given to the State, except when cancellation is for non-payment of premium, then ten (10) days prior notice may be given. Such notice shall be sent directly to (State of Nevada Representative's Name & Address). Should contractor fail to provide State timely notice, contractor will be considered in breach and subject to cure provisions set forth within this contract.

D. ACCEPTABILITY OF INSURERS: Insurance is to be placed with insurers duly licensed or authorized to do business in the state of Nevada and with an “A.M. Best” rating of not less than A- VII. The State in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

E. VERIFICATION OF COVERAGE: Contractor shall furnish the State with certificates of insurance (ACORD form or equivalent approved by the State) as required by this Contract. The certificates for each insurance policy are to be signed by a person authorized by that insurer to bind coverage on its behalf.

All certificates and any required endorsements are to be received and approved by the State before work commences. Each insurance policy required by this Contract must be in effect at or prior to commencement of work under this Contract and remain in effect for the duration of the project. Failure to maintain the insurance policies as required by this Contract or to provide evidence of renewal is a material breach of contract.

All certificates required by this Contract shall be sent directly to (State Department Representative's Name and Address). The State project/contract number and project description shall be noted on the certificate of insurance. The State reserves the right to require complete, certified copies of all insurance policies required by this Contract at any time. DO NOT SEND CERTIFICATES OF INSURANCE TO THE STATES RISK MANAGEMENT DIVISION.

F. SUBCONTRACTORS: Contractors’ certificate(s) shall include all subcontractors as additional insureds under its policies or Contractor shall furnish to the State separate certificates and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum requirements identified above.

G. APPROVAL: Any modification or variation from the insurance requirements in this Contract shall be made by the Attorney General’s Office or the Risk Manager, whose decision shall be final. Such action will not require a formal Contract amendment, but may be made by administrative action.

Risk Management Division Effective – March/ 2007 98