435820-O21-0887SECASMT-00.docx.pdf

Revision: 7/27/2020 (previous versions obsolete)

CONTRACT FOR SERVICES

between

State of Wisconsin Department of Health Services (DHS) and

JANUS Associates for

Security Assessment

This Contract is between the State of Wisconsin Department of Health Services (DHS), at 1 West Wilson Street, Madison, Wisconsin 53703, and JANUS Software, Inc. dba JANUS Associates, herein known as JANUS

Associates at 2 Omega Drive, Stamford, CT 06907.

Contract ID Number: 435820-O21-0887SECASMT-00

Contract Amount: See Statements of Work – Determined by Individual Statement of Work

Contract Term: 3 years (7/1/2021-6/30/2024)

Optional Renewal Terms: 2 one year renewals

DHS Division: Department-wide

DHS Contract Administrator: Jennifer Mueller

DHS Contract Manager: Barb DeYoung

Contractor Contract Administrator: Patricia A.P Fisher

Contractor Telephone: (203) 251-0236

Contractor Email: PatriciaF@janusassociates.com

Contractor FEIN: 593026157

This Contract will become effective on the date of mutual execution by the parties’ authorized representatives. By signing below, the parties acknowledge that this Contract is executed with full knowledge of and agreement with the terms and conditions of this Contract. This Contract becomes null and void if the time between the earlier dated signature and the later dated signature exceeds sixty (60) days, unless waived by DHS.

State of Wisconsin Contractor

Department of Health Services Contractor Name:

Authorized Representative Authorized Representative

Name:

Name:

Title: Title:

Signature:

Signature:

Date: Date:

DocuSign Envelope ID: 17175747-203A-408B-B7D1-297D4D2B4429

Patricia A.P. Fisher

6/21/2021

JANUS Software, Inc.

President

6/25/2021

Administrator, DES

Amy McDowell

TABLE OF CONTENTS

Definitions Order of Precedence Scope

3.1. List of Exhibits

Applicable Law and Venue Invoicing and Payments

5.1. Prompt Payment Law

5.2. State Tax Exemption

5.3. Payment Offsets for Contractor’s Delinquency

5.4. Refund of Credits

Contract Amendment No Quantity Guarantees Contractor Compliance and Responsibility for Actions Independent Contractor and Apparent Agency contractor personnel

10.1. Identification of Contracted Personnel

10.2. Right to Approve Changes of Contracted Personnel

10.3. Removal of Contracted Personnel

Background Checks Performance of Services Cooperation with Other Contractors Specifications Insurance Responsibility Warranty and Liens Conflict of Interest

17.1. Notice of Potential Conflict

Ownership Rights Confidential, Proprietary, and Personally Identifiable Information Security of Premises, Equipment, Data, and Personnel Intellectual Property Infringement and Labor Standards Records Retention Examination of Records Breach not Waiver Severability Survival Sovereign Immunity Indemnification and limited liability State Employees Promotional Advertising and News Releases Assignment Force Majeure Audits

33.1. Requirement to Have an Audit

33.2. Audit Requirements

33.3. Source of Funding

33.4. Audit Reporting Package

33.5. Audit Due Date

33.6. Submitting the Audit Reporting Package

33.7. Access to Contractor Records

DocuSign Envelope ID: 17175747-203A-408B-B7D1-297D4D2B4429

33.8. Access to Auditor’s Work Papers

33.9. Failure to Comply with the Audit Requirements

33.10. Sanctions

33.11. Closeout Audits

Default and Remedy Termination/Cancellation

35.1. Non-Appropriation

35.2. Termination for Cause

35.3. Termination for Convenience

35.4. Cancellation

Transition Services Antitrust Assignment Anti-Lobbying Act Affirmative Action Civil Rights Compliance Supplier Diversity and Reporting Requirements Federal Contract Requirements Drug Free Workplace Contact Information Federal Award Information

DEFINITIONS

Words and terms will be defined by their ordinary and usual meanings. Unless negotiated otherwise by the parties, where capitalized, the following words and terms will be defined by the meanings indicated. The meanings are applicable to the singular, plural, masculine, feminine and neuter of the words and terms.

Acceptance: a manifestation of assent by DHS to the terms, Services, Goods or other items offered by the

Contractor under the Contract. Unless the particular methodology and measure of acceptance of the offered terms, Services, or Goods is set forth herein, acceptance shall occur, in the case of Goods, after delivery is taken and the

Goods are inspected, and payment has been made; or in the case of Services, those Services have been provided to

DHS’ satisfaction and acceptance, and payment has been made.

Agency: an office, department, agency, institution of higher education, association, society or other body in State of

Wisconsin government created or authorized to be created by the Wisconsin State Constitution or any law, which is entitled to expend monies appropriated by law, including the Legislature and the courts.

Business Associate: pursuant to 45 C.F.R. § 160.103, a business associate includes:

(i) A health information organization, e-prescribing gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

Business Day: any day on which the State of Wisconsin is open for business, generally Monday through Friday unless otherwise specified in this Contract.

Confidential Information: all tangible and intangible information and materials being disclosed in connection with this Contract, in any form or medium without regard to whether the information is owned by the State of

Wisconsin or by a third party, which satisfies at least one (1) of the following criteria: (i) Personally Identifiable

Information; (ii) Protected Health Information under HIPAA, 45 C.F.R. § 160.103; (iii) non-public information related to DHS’ employees, customers, technology (including databases, data processing and communications networking systems), schematics, specifications, and all information or materials derived therefrom or based thereon; or (iv) information expressly designated as confidential in writing by DHS. Confidential Information includes all information that is restricted or prohibited from disclosure by state or federal law.

Contract Administrator: the DHS staff member responsible for the compliance, action, and evaluation of the

Contract.

Contract Manager: the DHS staff member who will provide oversight on this contract. This individual will support the Contract Administrator with the implementation, administration, and completion of the Contract. This individual will also serve as the contact person to help resolve issues that may arise during the entire Contract lifecycle.

Contractor: an individual, business, or agency that enters into a written Contract to provide Products or Services to the State. A Contractor may be a service provider, a supplier of products, a manufacturer, or a consultant. For this

Contract, the Contractor is JANUS Associates.

Day: calendar day unless otherwise specified in this Contract.

Default: the omission or failure to perform a contractual duty or provide Goods or Services as contractually required.

DHS: Department of Health Services.

Goods: articles of trade or items of merchandise, supplies, raw materials, or finished products; may also include incidental or related Services.

Inspection: a careful examination of Goods, commodities, and items produced under this Contract or the site that provides Services or Goods in order to determine their fitness for use.

Municipality: a county, city, village, town, school district, board of school directors, sewer district, drainage district, technical college district or any other public or quasi-public corporation, officer, board or other body having the authority to award public contracts. (§ 16.70(8), Wis. Stats.).

Personally Identifiable Information: an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if that element is not publicly available information and is not encrypted, redacted, or altered in any manner that renders the element unreadable: (a) the individual’s

Social Security number; (b) the individual’s driver’s license number or state identification number; (c) the number of the individual’s financial account, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual’s financial account; (d) the individual’s DNA profile;

or (e) the individual’s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation, and any other information protected by state or federal law.

Protected Health Information (PHI): health information, including demographic information, created, received, maintained, or transmitted in any form or media by the Business Associate, on behalf of the Covered Entity, where such information relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the payment for the provision of health care to an individual, that identifies the individual or provides a reasonable basis to believe that it can be used to identify an individual.

Publicly Available Information: any information that an entity reasonably believes is one of the following: a) lawfully made widely available through any media; b) lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

State Purchase Order: State of Wisconsin’s standard document of purchase.

Services: all actions, recommendations, plans, research, customizations, modifications, documentation and maintenance and support provided by the Contractor necessary to fulfill that which the Contractor is obligated to accomplish under this Contract.

Subcontract: a Contract, written or oral, financial or non-financial, between the Contractor and any other party to fulfill the requirements and performance obligations of this Contract.

Subcontractor: an entity that enters into a Contract with the Contractor for the purpose of delivering Goods or providing Services to DHS.

ORDER OF PRECEDENCE

This Contract and the following documents incorporated by reference into the Contract constitute the entire agreement of the parties and supersedes all prior communications, representations or agreements between the parties, whether oral or written. Any conflict or inconsistency will be resolved by giving precedence in the following descending order:

1. The Business Associate Agreement (BAA).

2. The terms of this Contract.

3. Any and all exhibits or attachments to this Contract.

4. The official purchase order.

5. The terms of solicitation # S-0887 DHS-21, including all attachments, addenda, and revisions.

6. The terms of Contractor’s solicitation response as accepted by DHS of Wisconsin.

SCOPE

Initial scope for this contract is the Statement of Work (SOW) within Exhibit 1 – Statement of Work. All other work resulting from this Contract must go through a Statement of Work (SOW) process and be approved by DHS.

Once additional SOWs are signed off on by both parties, they are to be included as scope within this contract.

3.1. List of Exhibits

Exhibit 1 – Statement of Work

Exhibit 2 – Service Level Agreement

Exhibit 3 – Confidentiality and Non-Disclosure Agreement – Contractor

Exhibit 4 – Business Associate Agreement with Contract

APPLICABLE LAW AND VENUE

This Contract shall be governed by the laws of the State of Wisconsin. The venue for any actions brought under this

Contract shall be the Circuit Court of Dane County, Wisconsin or the U.S. District Court for the Western District of

Wisconsin, as applicable.

INVOICING AND PAYMENTS

Invoices presented for payment must be submitted in accordance with instructions contained on the purchase order including reference to purchase order number and submittal to the correct address for processing.

5.1. Prompt Payment Law

DHS shall pay properly submitted Contractor invoices within 30 days of receipt, providing that the services to be provided to DHS have been delivered, rendered, or installed (as the case may be), and accepted as specified in this Contract and all documents incorporated herein by reference. A good faith dispute in regard to an invoice creates an exception to prompt payment pursuant to Wis. Stat. § 16.528.

5.2. State Tax Exemption

DHS is exempt from payment of Wisconsin sales or use tax on all purchases.

5.3. Payment Offsets for Contractor’s Delinquency

The State of Wisconsin may offset payments made to the Contractor under this Contract in an amount necessary to satisfy a certified or verifiable delinquent payment owed to the State or any state or local unit of government. DHS reserves the right to cancel this Contract as provided in Section 35.4, Contract Cancellation, if the delinquency is not satisfied by the offset or other means during the Contract term.

5.4. Refund of Credits

DHS may request a refund of credits owed at any time. Contractor agrees to refund credits owed within 60 days of DHS’ request.

CONTRACT AMENDMENT

This Contract may not be modified or amended except by mutual agreement of both parties in writing.

NO QUANTITY GUARANTEES

DHS may obtain related products and services from other sources during the term of the Contract. DHS makes no express or implied warranties whatsoever that any particular quantity or dollar amount of products or Services will be purchased through this Contract.

CONTRACTOR COMPLIANCE AND RESPONSIBILITY FOR ACTIONS

The Contractor shall at all times comply with and observe all federal, state, and local laws, ordinances, regulations, and DHS work rules that are in effect during the term of this Contract that may affect the Contractor’s work or obligations hereunder. The Contractor shall be solely responsible for its actions and those of its agents, employees, or Subcontractors under this Contract, and neither the Contractor nor any of the foregoing parties has authority to act or speak on behalf of DHS.

INDEPENDENT CONTRACTOR AND APPARENT AGENCY

The Contractor, its officers, agents, and employees, in the performance of this Contract, shall act in the capacity of an independent contractor and not as an officer, employee, or agent of DHS. To the extent within its reasonable control, the Contractor agrees to take such steps as may be necessary toward assuring that each Subcontractor under this Contract will be deemed to be an independent contractor and will not be considered or permitted to be an agent, servant, joint venture, or partner of DHS.

The Contractor shall not take any action, or make any omission, that may imply, or cause others to reasonably infer, that the Contractor is acting as a DHS agent in any matter or in any way not expressly authorized by this Contract.

CONTRACTOR PERSONNEL

10.1. Identification of Contracted Personnel

If requested by DHS, the Contractor will provide a list of the names of all Contractor’s employees, contracted personnel, or Subcontractor’s employees who may at any time require admission to the State’s premises in connection with the rendering of Services, specifying each such person’s connection to the Contractor, the role the person is to take in the performance of the Contract, and other information as requested by DHS. DHS reserves the right to refuse to admit to the State’s premises any person employed or contracted by the

Contractor.

The Contractor shall furnish each contracted personnel with a means of identifying themselves as agents, Subcontractors, or employees of the Contractor assigned to perform Services under the Contract, and furnish

DHS with security credentials on these contracted personnel, if requested.

10.2. Right to Approve Changes of Contracted Personnel

DHS shall be apprised of any change of contracted personnel. Any changes in personnel must ensure compliance with this Contract. DHS shall notify Contractor if it determines that any change in personnel may interfere with performance of this Contract and Contractor shall take appropriate and timely action to cure by making personnel changes as it deems necessary to perform this Contract.

10.3. Removal of Contracted Personnel

DHS shall make Contractor aware of any business concerns with Contractor’s/Subcontractor’s personnel and

Contractor shall take necessary action to ensure that its employees do not interfere with the operations of DHS, including removing Contractor’s/Subcontractor’s personnel from the DHS facility or site, if necessary. DHS’ right to do so does not implicate DHS as a party to any of the Contractor’s obligations in the Contract. DHS may request that key personnel or personnel that will perform Services on-site at a DHS facility be replaced within thirty (30) Calendar Days from such removal.

BACKGROUND CHECKS

Prior to the commencement of any Services under this Contract, in order to ensure safety and security at its premises, DHS may request a background or criminal history investigation of contracted personnel at any time during the term of this Contract for any of Contractors’ contracted personnel and Subcontractor’s employees, who will be providing Services to DHS under the Contract. If any contracted personnel, including Subcontractor’s employees, providing Services to DHS under this Contract are not acceptable to DHS to ensure safety and security in its premises, in its sole discretion as a result of the background or criminal history investigation, DHS shall provide notice to the Contractor that the contracted personnel do not meet DHS’ safety and security needs and that the personnel will not be allowed on DHS premises. Contractor shall as soon as practicable replace the contracted personnel with another of its contracted personnel in order to ensure compliance with this Contract.

PERFORMANCE OF SERVICES

Timely provision of Services required under this Contract is of the essence, including the provision of Services within any time frames specified as a part of this Contract. The Contractor shall render Services with all due skill, care, and diligence, in accordance with standard industry practices and legal requirements to the satisfaction of

DHS. DHS may inspect, observe, and examine the performance of the Services rendered on the State’s premises at any time. DHS may inspect, observe, and examine the performance of Contractor’s Services on any other premises at reasonable times, without notice.

If DHS notifies the Contractor that any part of the Services rendered are inadequate or in any way differ from the

Contract requirements for any reason other than as a result of DHS’ default or negligence, the Contractor shall at its own expense re-schedule and re-perform the work correctly within the time period specified by DHS. This remedy shall be in addition to any other remedies available to DHS by law or in equity. If requested by DHS, Contractor shall supply a Corrective Action Plan (CAP) which will outline the Contractor’s solution to the non-complying issue. Acceptance of this CAP will be at the sole discretion of DHS.

COOPERATION WITH OTHER CONTRACTORS

In the event that DHS enters into a Contract with another Contractor for additional services, the Contractor will ensure that Contractor’s personnel fully cooperate with said other Contractor. Contracted personnel shall not commit any act that interferes with the rendering of Services by any other Contractor or by DHS. Contracted personnel shall cooperate with State personnel, hardware manufacture representatives, system software Contractors, and communications systems Contractors in the provision of Services under this Contract.

SPECIFICATIONS

The apparent silence of the DHS’ specifications as to any detail, or the apparent omission of a detailed description concerning any matter, shall be regarded as meaning that only the best commercial practice shall be followed and only material and workmanship of the first quality may be used. Upon any notice of noncompliance provided by

DHS, Contractor shall supply proof of compliance with the specifications or provide written notice of their intent to deliver alternate or substitute Services or deliverables. Alternate or substitute Services or deliverables may be accepted or rejected in the sole discretion of DHS, and any such alternates or substitutes shall be accompanied by

Contractor’s certification and evidence satisfactory to DHS that the function, characteristics, performance and endurance shall be equal or superior to the original Services or deliverables specified. DHS will not unreasonably withhold the approval of alternates or substitutes under this section.

INSURANCE RESPONSIBILITY

The Contractor shall maintain the following insurance coverage:

a) Worker’s compensation insurance, as required by Wis. Stat. ch. 102 or applicable state law where contracted personnel are employed, for Contractor’s contracted personnel engaged in work performed under this Contract;

b) As the employer of the contracted personnel, Contractor shall fund an account with the Wisconsin unemployment reserve fund or, if the Contractor employs contracted personnel to work under this Contract in another state, the reserve fund in the state where the contracted employees are employed, as required by applicable statutes and regulations;

c) Commercial liability, bodily injury and property damage insurance against any claim(s) that may occur in carrying out the terms of this Contract, with a minimum coverage of one million dollars ($1,000,000) liability for bodily injury and property damage including products liability and completed operations; and

d) Motor vehicle insurance for all owned, non-owned and hired vehicles that are used in carrying out the terms of this Contract, with a minimum coverage of one million dollars ($1,000,000) per occurrence combined single limit for automobile liability and property damage.

The Contractor shall maintain a Certificate of Insurance, showing up-to-date coverage, and shall be made available to DHS upon request.

WARRANTY AND LIENS

The Contractor warrants and represents that all deliverables ordered under this Contract are free and clear of all liens, claims or encumbrances of any kind.

Deliverables and Services rendered shall be strictly in accordance with the order placed and may not deviate in any way from the terms, conditions or specifications of this Contract, without the prior written approval of DHS.

Deliverables delivered under this Contract may be subject to inspection and testing upon receipt.

The Contractor warrants that the deliverables provided shall conform to the specifications in this Contract, are fit and sufficient for the purpose manufactured, of good material and workmanship, and free from defect. Deliverables offered must be new and unused and of the latest model or manufacture, unless otherwise specified by DHS. Items shall be equal in quality and performance to the standards indicated herein. Deliverables delivered that do not conform to the Contract terms, conditions, and specifications may be rejected and returned at the Contractor’s expense. Contractor shall assign to DHS its right to recover under any warranties applicable to the deliverables offered.

CONFLICT OF INTEREST

Contractor represents and warrants the following: That Contractor has no business, professional, personal, or other interest, including, but not limited to, the representation of other clients, that would conflict in any manner or degree with the performance of its obligations under this Contract.

17.1. Notice of Potential Conflict

If any such actual or potential conflict of interest arises under this Contract, Contractor shall immediately inform DHS in writing of such conflict. Full written disclosure shall include, but is not limited to, identification of all persons implicated and a complete description of all relevant information.

If any such actual or potential conflict of interest is identified by DHS under this Contract, DHS shall immediately inform the Contractor in writing of such conflict and request a full investigation. A request for investigation must include a written disclosure that contains, but is not limited to, identification of all persons implicated and a complete description of all relevant information.

If any such actual or potential conflict of interest is identified by either DHS or the Contractor, a final determination will be made, at the sole discretion of DHS, as to whether a conflict exists, and, if so, what mitigation activities shall be taken.

Additionally, if either DHS or the Contractor identifies required work functions that present an actual or potential conflict of interest internally to the Contractor and/or externally to DHS, the Contractor shall immediately make full written disclosure of such facts to DHS. Full written disclosure shall include, but will not be limited to, identification of all persons implicated, a complete description of all relevant information and a potential resolution of the conflict describing assurance that the required work functions will not pose additional conflicts on an ongoing basis.

OWNERSHIP RIGHTS

Unless an ownership interest is granted or reserved in this Contract, a State Purchase Order issued under this

Contract shall allow DHS unrestricted authority to reproduce, distribute, and use any submitted report, data, or material, and any software or modifications and any associated documentation that is designed or developed and delivered to DHS as part of the performance of the Contract.

CONFIDENTIAL, PROPRIETARY, AND PERSONALLY IDENTIFIABLE INFORMATION

In connection with the performance of the work prescribed in this Contract, it may be necessary for DHS to disclose to Contractor certain information that is considered to be confidential, proprietary, or containing Personally

Identifiable Information (Confidential Information). The Contractor shall not use such Confidential Information for any purpose other than the limited purposes set forth in this Contract, and all related and necessary actions taken in fulfillment of the obligations herein. The Contractor shall hold all Confidential Information in confidence, and shall not disclose such Confidential Information to any persons other than those directors, officers, employees, and agents who have a business-related need to have access to such Confidential Information in furtherance of the limited purposes of this Contract and who have been apprised of, and agree to maintain, the confidential nature of such information in accordance with the terms of this Contract.

Contractor shall institute and maintain such security procedures as are commercially reasonable to maintain the confidentiality of the Confidential Information while in its possession or control including transportation, whether physically or electronically.

Contractor shall ensure that all indications of confidentiality contained on or included in any item of Confidential

Information shall be reproduced by the Contractor on any reproduction, modification, or translation of such

Confidential Information. If requested by DHS, the Contractor shall make a reasonable effort to add a proprietary notice or indication of confidentiality to any tangible materials within its possession that contain Confidential

Information of DHS, as directed.

Contractor or its employees and Subcontractors will not reuse, sell, make available, or make use in any format the data researched or compiled for this Contract for any venture, profitable or not, outside this Contract.

The restrictions herein shall survive the termination of this Contract for any reason and shall continue in full force and effect and shall be binding upon the Contractor or its agents, employees, successors, assigns, Subcontractors, or any party claiming an interest in this Contract on behalf of or under the rights of Contractor following any termination. Contractor shall advise all of their agents, employees, successors, assigns and Subcontractors which are engaged by the State of the restrictions, present and continuing, set forth herein. Contractor shall defend and incur all costs, if any, for actions that arise as a result of noncompliance by Contractor, its agents, employees, successors, assigns and Subcontractors regarding the restrictions herein.

Reporting to DHS: Contractor shall immediately report within five (5) business days to DHS any use or disclosure of

Confidential Information not provided for by this Contract, of which it becomes aware. Contractor shall cooperate with DHS’ investigation, analysis, notification and mitigation activities, and shall be responsible for all costs incurred by DHS for those activities.

Indemnification: In the event of a breach of this section by Contractor, Contractor shall indemnify and hold harmless DHS and any of its officers, employees, or agents from any claims arising from the acts or omissions of the Contractor, and its Subcontractors, employees and agents, in violation of this section, including but not limited to, costs of credit monitoring and identity theft restoration coverage for one (1) year of coverage from the date the individual enrolls, of all persons whose Confidential Information was disclosed, disallowances or penalties from federal oversight agencies, and any court costs, expenses, and reasonable attorney fees, incurred by DHS in the enforcement of this section.

Equitable Relief: The Contractor acknowledges and agrees that the unauthorized use, disclosure, or loss of

Confidential Information may cause immediate and irreparable injury to the individuals whose information is disclosed and to DHS, which injury will not be compensable by money damages and for which there is not an adequate remedy available by law. Accordingly, the parties specifically agree that DHS, in its own behalf or on behalf of the affected individuals, may seek injunctive or other equitable relief to prevent or curtail any such breach, threatened or actual, without posting security and without prejudice to such other rights as may be available under this Contract or applicable law.

Liquidated Damages: The Contractor agrees that an unauthorized use or disclosure of Confidential Information may result in damage to the State’s reputation and ability to serve the public interest in its administration of programs affected by this Contract. Such amounts of damages which will be sustained are not calculable with any degree of certainty and thus shall be set forth herein. Assessment under this provision is in addition to other remedies under this Contract and as provided in law or equity. DHS shall assess reasonable damages as appropriate and notify the Contractor in writing of the assessment. The Contractor shall automatically deduct any assessed damages from the next appropriate monthly invoice, itemizing the assessment deductions on the invoice.

Liquidated Damages shall not exceed the following:

i. $1,000 for each individual whose Confidential Information was used or disclosed;

ii. $2,500 per day for each day that the Contractor fails to substantially comply with the Corrective Action

Plan under this Section

DHS may conduct a compliance review of the Contractor’s security procedures to protect Confidential Information under Section 33 (Audits) of this Contract.

HIPAA: The Contractor IS a “business associate” pursuant to the definition under the Health Insurance Portability and Accountability Act (HIPAA) and the regulations promulgated thereunder specifically 45 C.F.R. § 160.103. If the parties are business associates, then the parties shall comply with DHS’ Business Associate Agreement.

If Contractor is a business associate, Contractor agrees to comply with the Health Insurance Portability and

Accountability Act, Public Law 104-191 and with the Standards for Privacy and Security of Individually

Identifiable Health Information, 45 C.F.R. Parts 160 and 164 applicable to business associates. As defined herein, “Business Associate” shall mean the Contractor and Subcontractors and agents of the Contractor that receive, use or have access to protected health information under this Agreement and “Covered Entity” shall mean the State of

Wisconsin, Department of Health Services.

In agreements for the provision of services, activities, or functions covered by the Health Insurance Portability and

Accountability act of 1996 (HIPAA), the Contractor as a business associate must complete a Business Associate

Agreement (BAA) F-00759. This document must be fully executed before Contract performance begins.

This Section shall survive the termination of the Contract.

SECURITY OF PREMISES, EQUIPMENT, DATA, AND PERSONNEL

During the performance of services under this Contract, the Contractor may have access to the personnel, premises, equipment, and other property, including data files, information, or materials (collectively referred to as “data”) belonging to DHS. The Contractor shall preserve the safety, security, and the integrity of the personnel, premises, equipment, data and other property of DHS, in accordance with the instruction of DHS. The Contractor shall be responsible for damage to DHS’ equipment, workplace, and its contents, or for the loss of data, when such damage or loss is caused by the Contractor, contracted personnel, or Subcontractors, and shall reimburse DHS accordingly upon demand. This remedy shall be in addition to any other remedies available to the DHS by law or in equity.

INTELLECTUAL PROPERTY INFRINGEMENT AND LABOR STANDARDS

The Contractor guarantees that any items provided to DHS under this Contract were manufactured or produced in accordance with applicable state and federal labor laws, and the sale or use of said items shall not infringe any

United States patent, copyright, or other intellectual property rights of others. The Contractor shall at its own expense indemnify, defend and hold DHS harmless from any claims brought against DHS for any alleged patent, copyright or other intellectual property right infringement due to the sale or use of such items, provided that the

Contractor is promptly notified of such suit, and is given all related documents. The Contractor shall pay all costs, damages, and profits recoverable in any such infringement lawsuit.

RECORDS RETENTION

Pursuant to §19.36 (3) of the Wisconsin Statutes, all records of the Contractor that are produced or collected under this Contract are subject to disclosure pursuant to a public records request. The Contractor shall establish and maintain adequate records of all documentation developed or compiled and expenditures incurred under this

Contract. All expenditure records shall be kept in accordance with Generally Accepted Accounting Procedures

(GAAP). All procedures shall be in accordance with federal, State and local laws or ordinances. The Contractor, following final payment, shall retain all records produced or collected under this Contract for six (6) years after final payment is made.

EXAMINATION OF RECORDS

DHS shall at any time during normal business hours, upon reasonable notice, have access to and the right to examine, audit, excerpt, transcribe, and copy, on Contractor’s premises, any of the Contractor’s records and computer data storage media involving transactions directly pertinent to this Contract. If the material is on computer data storage media, the Contractor shall provide copies of the data storage media or a computer printout of such if DHS requests. Any charges for copies of books, documents, papers, records, computer data storage media or computer printouts provided by the Contractor shall not exceed the actual cost to the Contractor. This provision shall survive the termination, cancellation, or expiration of this Contract.

BREACH NOT WAIVER

A failure to exercise any right, or a delay in exercising any right, power or remedy hereunder on the part of either party shall not operate as a waiver thereof. Any express waiver shall be in writing and shall not affect any event or default other than the event or default specified in such waiver. A waiver of any covenant, term or condition contained herein shall not be construed as a waiver of any subsequent breach of the same covenant, term or https://www.dhs.wisconsin.gov/forms/f0/f00759.docx condition. The making of any payment to the Contractor under this Contract shall not constitute a waiver of default, evidence of proper Contractor performance, or acceptance of any defective item or work furnished by the

Contractor.

SEVERABILITY

If any provision of this Contract is found to be invalid, illegal or unenforceable under any applicable statute or law, it is to that extent deemed to be omitted and the remaining provisions of this Contract will not be affected in any way.

SURVIVAL

The provisions regarding Confidential Information, Examination of Records, and Indemnification shall survive the termination, expiration or conclusion of the Contract, along with any other provisions contained in this Contract that by their language, sense and context are intended to survive.

SOVEREIGN IMMUNITY

Nothing in this Contract may be construed to constitute a waiver of the State of Wisconsin’s sovereign immunity under the Eleventh Amendment to the United States Constitution and Article IV, Section 27 of the Wisconsin

Constitution.

INDEMNIFICATION AND LIMITED LIABILITY

28.1. Contractor shall hold DHS harmless and shall defend and indemnify DHS, its Agencies, officers and employees against any and all claims, suits, actions, liabilities and costs of any kind, including attorney’s fees, for personal injury or damage to property arising from the acts or omissions of the Contractor, its agents, officers, employees or Subcontractors.

28.2. Except for sections 19, 20, and 28.1, the cumulative liability of Contractor to DHS for actual or alleged damages arising out of, based on, or relating to this agreement, whether based upon breach of Contract, tort

(including negligence), warranty or any other legal theory, will not exceed the amount invoiced by the

Contractor for services rendered during the twelve (12) calendar months immediately preceding the calendar month in which such losses occurred or, for losses that occur in the first year of the Contract, the amount in the

Reimbursement Plan for the first twelve (12) calendar months of the Contract.

In addition, the Contractor shall indemnify DHS for any federal funding disallowances or sanctions imposed on

DHS for reasons attributable to the Contractor’s failure to perform in compliance with this Contract.

STATE EMPLOYEES

The Contractor may not contract with or employ a state employee or an individual retained as a full-time Contractor by DHS during the term of this Contract.

PROMOTIONAL ADVERTISING AND NEWS RELEASES

Reference to, or use of, the Great Seal of Wisconsin, the Wisconsin Coat of Arms, the DHS logo, or the name or likeness of any state official or employee for commercial promotion is strictly prohibited. News releases or release of broadcast e-mails pertaining to this Contract shall not be made without prior written approval of DHS. The

Contractor may identify DHS of Wisconsin as a client when the Contractor provides a list of Contractor’s clients.

ASSIGNMENT

No right or duty in whole or in part of either party under this Contract may be assigned or delegated without the prior written consent of the other party.

FORCE MAJEURE

Neither party shall be in default by reason of any failure in performance of this Contract in accordance with reasonable control and without fault or negligence on their part. Such causes may include, but are not restricted to, acts of nature or the public enemy, acts of the government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, freight embargoes and unusually severe weather, but in every case, the failure to perform such must be beyond the reasonable control and without the fault or negligence of the party.

AUDITS

33.1. Requirement to Have an Audit

Unless waived by DHS, the Contractor shall submit an annual audit to DHS if the total amount of annual funding provided by DHS (from any and all of its Divisions or subunits taken collectively) through this and other Grants is $100,000 or more. In determining the amount of annual funding provided by DHS, the

Contractor shall consider both: (a) funds provided through direct Grants with the DHS; and (b) funds from

DHS passed through another agency which has one or more Grants with the Contractor.

33.2. Audit Requirements

The audit shall be performed in accordance with generally accepted auditing standards, Wis. Stat. § 46.036, Government Auditing Standards as issued by the U.S. Government Accountability Office, and other provisions specified in this Contract. In addition, the Contractor is responsible for ensuring that the audit complies with other standards and guidelines that may be applicable depending on the type of services provided and the amount of dollars received. Please reference the following audit documents for complete audit requirements:

2 Code of Federal Regulations (C.F.R.), Part 200 - Uniform Administrative Requirements, Cost

Principles, and Audit Requirements for Federal Awards, Subpart F - Audits. The guidance also includes an Annual Compliance Supplement that details specific federal agency rules for accepting federal sub-awards.

The State Single Audit Guidelines (SSAG) expand on the requirements of 2 C.F.R. Part 200 Subpart F by identifying additional conditions that require a state single audit. Section 1.3 of the SSAG lists the required conditions.

The DHS Audit Guide is an appendix to the SSAG and contains additional DHS-specific audit guidance for those entities that meet the SSAG requirements. It also provides guidance for those entities that are not required to have a Single Audit but need to comply with DHS subrecipient/contractor audit requirements. An audit report is due DHS if a Contractor receives

$100,000 or more in direct funding from DHS as determined by Wis. Stat. § 46.036.

33.3. Source of Funding

DHS shall provide funding information to all Contractors for audit purposes, including the name of the program, the federal agency where the program originated, the CFDA number and the percentages of federal, state and local funds constituting the Contract.

33.4. Audit Reporting Package

The Contractor that is required to have a Single Audit based on 2 C.F.R. Part 200 Subpart F and the State

Single Audit Guidelines is required to submit an audit reporting package which includes all of the following:

1. General-purpose financial statements of the overall agency and a schedule of expenditures of federal and state awards, including the independent auditor’s opinion on the statements and schedule.

2. Schedule of findings and questioned costs, schedule of prior audit findings, corrective action plan and the management letter (if issued).

3. Report on compliance and on internal control over financial reporting based on an audit performed in accordance with government auditing standards.

4. Report on compliance for each major program and a report on internal control over compliance.

5. Report on compliance with requirements applicable to the federal and state program and on internal control over compliance in accordance with the program-specific audit option.

6. * DHS Cost Reimbursement Award Schedule. This schedule is required by DHS if the Contractor is a non-profit, for-profit, a governmental unit other than a tribe, county, Chapter 51 board or school district; if the Contractor receives funding directly from DHS; if payment is based on or limited to an actual allowable cost basis; and if the auditee reported expenses or other activity resulting in payments totaling $100,000 or more for all of its grant(s) or contract(s) with DHS.

7. *Reserve Schedule is only required if the Contractor is a non-profit and paid on a prospectively set rate.

8. *Allowable Profit Schedule is only required if the Contractor is a for-profit entity.

9. *Additional Supplemental Schedule(s) required by funding agency may be required. Check with the funding agency.

*NOTE: These schedules are only required for certain types of entities or specific financial conditions.

For Contractors that do not meet the single audit requirements of 2 C.F.R. Part 200 and the SSAG, the audit reporting package to DHS may include all of the above items except items 4 and 5.

33.5. Audit Due Date

Audits that must comply with 2 C.F.R. Part 200 and the SSAG are due to the funding agencies nine months from the end of the fiscal period or 30 days from completion of the audit, whichever is sooner. For all other audits, the due date is six months from the end of the fiscal period unless a different date is specified within the

Contract or grant agreement.

33.6. Submitting the Audit Reporting Package

For audits that comply with 2 C.F.R. Part 200 and the SSAG, reference 2 C.F.R. § 200.512 for complete submission requirements regarding the single audit reporting package. The Contractor/auditee is responsible for ensuring that the Federal Audit Clearinghouse (FAC) receives a complete, electronically submitted audit reporting package by the audit’s due date. Please ensure that the FAC’s website is fully functional and enables complete viewing access to the audit reporting package. If the audit reporting package is not viewable on the

FAC’s website, then it is the Contractor’s/auditee’s responsibility to submit the audit reporting package to

DHSAuditors@wisconsin.gov. If a management letter was issued by the auditor, it is also the responsibility of the auditee to provide this document to DHS.

Audit reporting packages that are not single audits shall be sent by the auditor via email to

DHSAuditors@Wisconsin.gov with the Contractor /auditee copied. The audit reports shall be electronically created pdf files that are text searchable, unlocked, and unencrypted. (Note: To ensure that pdf files are unlocked and text-searchable, do not scan a physical copy of the audit report and do not change the default security settings in your pdf creator.)

33.7. Access to Contractor Records

The Contractor/auditee must provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the required audit.

The auditee shall permit appropriate representatives of DHS to have access to the auditee’s records and financial statements as necessary to review the auditee’s compliance with federal and state requirements for the use of the funding. Having an independent audit does not limit the authority of DHS to conduct or arrange for other audits or review of federal or state programs. DHS shall use information from the audit to conduct its own reviews without duplication of the independent auditor’s work.

33.8. Access to Auditor’s Work Papers

The auditor shall make audit work papers available upon request to the auditee, DHS or their designee as part of performing a quality review, resolving audit findings, or carrying out oversight responsibilities. Access to work papers includes the right to obtain copies of work papers.

33.9. Failure to Comply with the Audit Requirements

DHS may impose sanctions when needed to ensure that auditees have complied with the requirements to provide DHS with an audit reporting package that meets the applicable standards and to administer state and federal programs in accordance with the applicable requirements. Examples of situations when sanctions may be warranted include:

1. The auditee did not have an audit.

2. The auditee did not submit the audit reporting package to the FAC, DHS or another granting agency within the original or extended audit deadline.

3. The auditor did not perform the audit in accordance with applicable standards, including the standards described in the SSAG and DHS Audit Guide.

DocuSign Envelope ID: 17175747-203A-408B-B7D1-297D4D2B4429 mailto:DHSAuditors@wisconsin.gov mailto:DHSAuditors@Wisconsin.gov

4. The audit reporting package is not complete; for example, the audit reporting package omitted the corrective action plan or other required elements.

5. The auditee does not cooperate with DHS or another granting agency’s audit resolution efforts; for example, the auditee does not take corrective action or does not repay disallowed costs to the granting agency.

33.10. Sanctions

DHS will choose sanctions that suit the particular circumstances and also promote compliance and/or corrective action. Possible sanctions may include:

1. Requiring modified monitoring and/or reporting provisions;

2. Delaying payments, withholding a percentage of payments, withholding or disallowing overhead costs, or suspending the award until the auditee is in compliance;

3. Disallowing the cost of audits that do not meet these standards;

4. Conducting an audit or arranging for an independent audit of the auditee and charging the cost of completing the audit to the auditee;

5. Charging the auditee for all loss of federal or state aid or for penalties assessed to DHS because the auditee did not comply with audit requirements;

6. Assessing financial sanctions or penalties;

7. Discontinuing contracting with the auditee; and/or

8. Taking other action that DHS determines is necessary to protect federal or state pass-through funding.

33.11. Closeout Audits

A Contract specific audit of an accounting period of less than 12 months is required when a Contract is terminated for cause, when the auditee ceases operations or changes its accounting period (fiscal year). The purpose of the audit is to close-out the short accounting period. The close-out audit may be waived by DHS upon written request from the Contractor, except when the Contract is terminated for cause.

The auditee shall ensure that its auditor contacts DHS prior to beginning the audit.