Attachment A to the RFR Exposure Notification MSA Template FINAL 005.docx

EXHIBIT A

To the RFR

MASTER SERVICES AGREEMENT TEMPLATE

MASTER SERVICES AGREEMENT

BETWEEN

THE COMMONWEALTH HEALTH INSURANCE CONNECTOR AUTHORITY

AND

[CONTRACTOR’S FULL NAME]

FOR THE

MASSACHUSETTS EXPOSURE NOTIFICATION APPLICATION PROJECT

INTRODUCTION.

The following document will serve as a Master Services Agreement (“MSA”) between the Commonwealth Health Insurance Connector Authority (“Health Connector”), a state authority with its headquarters located at 100 City Hall Plaza, Boston, MA 02108, and [Full vendor name] (“[Abbreviated vendor name]”) or “Contractor”), a [characterize vendor; a nonprofit, corporation, limited liability partnership, etc.] with its headquarters located at [address of vendor headquarters], (collectively, the “Parties”) to apply to work on the Commonwealth of Massachusetts’ (the “Commonwealth’s” or “Massachusetts’”) Exposure Notification Application Project. The Health Connector is entering this Agreement on behalf of and under an agreement with the Commonwealth’s Department of Public Health (DPH). The entire agreement (the “Agreement”) between the Parties consists of the following documents in the following order of precedence: (1) the Commonwealth Standard Terms and Conditions for Information Technology Projects (the “Commonwealth Terms”); (2) the Commonwealth’s Standard Form Contract; (3) the Request for Response/Exposure Notification Application Project (“RFR”); (4) [for Workstream #1 vendors only] the DPH Confidentiality Agreement, attached hereto as Exhibit A; (5) this Master Services Agreement (“MSA”) including all exhibits and attachments hereto and any other documents negotiated between the Parties under the Opportunity; and (6) Contractor’s Response to the RFR.

DEFINITIONS.

The terms used in this Master Services Agreement, unless defined herein, shall have the meaning ascribed to them in the RFR and other documents that constitute the Agreement between the parties, except where defined herein.

“Acceptance”, “Accepted” or “Accept” means, with respect to any deliverable explicitly referenced in a SOW (a “Deliverable”), the Health Connector’s written notice of its confirmation that such Deliverable or Project Work conforms, in all material respects, with the relevant Acceptance Criteria applicable to such Deliverable or Project Work, as more fully described in this Section 2.

“Acceptance Criteria” means the objective criteria mutually agreed to by the Parties and set forth in applicable SOWs, and other requirements documentation pursuant to which Deliverables shall be Evaluated by the Health Connector during the Acceptance Process as more fully described in section 23 of this Agreement.

“Deliverable” is an item listed in a statement of work entered under this Agreement that the Contractor is explicitly required to deliver.

“Evaluate”, “Evaluated” or “Evaluation” means, with respect to a Deliverable or Services, to inspect, test or otherwise evaluate the Deliverable against the relevant Acceptance Criteria as more fully described in the relevant SOW, or if no Acceptance process is identified in the relevant SOW, in Section 23 herein.

“Flow Down Terms” shall include the following terms of this Agreement: (a) the Commonwealth’s Terms and Conditions, (b) the Commonwealth’s Standard Contract Form, (c) the order of precedence set forth in the first paragraph of this Agreement, (d) Section 10 (Subcontractors) to the extent Contractor permits its Subcontractors to enter into further subcontracts, (e) Section 15 (Title and Intellectual Property Rights), (f) Section 6(b)(Accessibility), (g) Section 17 (Confidential Information), (h) all privacy and security terms (i) Section 19 (Audit), and Exhibit A hereto, DPH Confidentiality Agreement.

“Health Connector Data” or “Commonwealth Data” means all data (including without limitation, all personal data as defined in M.G.L. c. 66A and data referred to in Section 6 of the Commonwealth Terms), Personal Data as defined in the DPH Confidentiality Agreement attached hereto as Exhibit A, and information, in each case, that is (a) Commonwealth data provided to, received, maintained or accessed by Contractor in connection with this Agreement, (b) derived or generated by Contractor in the performance of analyzing, configuring, testing data loading, cleansing or conversion or any other activities for the Health Connector under this Agreement, including the Output and/or (c) created by the Health Connector and/or end users in the use of the Services or a System. Because the Health Connector has entered this Agreement on behalf of DPH, all Health Connector Data under this agreement is owned by DPH.

The “Project” means the scope, tasks, activities, Deliverables and Project Works that are part of the Commonwealth’s effort to reduce the rate of infection of COVID-19 in the Commonwealth as set forth in Exhibit D, Statement of Work. “Deliverable” means all information, materials, Software, and other submissions and materials delivered or required to be delivered by Contractor to the Health Connector identified as Deliverables therein. A “Task” is an activity engaged in by the Contractor for the purpose of fulfilling its obligations to the Health Connector under the terms of this Agreement, which may or may not result in the creation of a Deliverable.

A “Project Work” is an item that is not listed explicitly as a Deliverable in a Statement of Work entered under this Agreement but is nonetheless created by Contractor solely for purposes of fulfilling its obligations hereunder.

“Requirements” means the business, functional and technical requirements and specifications for the Services and Deliverables as set forth in or incorporated by reference in this Agreement or an applicable SOW, or other requirements documentation.

BACKGROUND INFORMATION.

Background information about the Community Tracing Collaborative, ENS and EN Express is set forth in Exhibit E, “Background Information”.

TERM AND SURVIVAL.

The Term. This Agreement’s term (the “Term”) begins on the date that it is signed by both Parties (the “Effective Date”) and shall terminate at 5:00 p.m. on February 26, 2020 (“Termination Date”) with two (2), three (3) month options to extend at the Health Connector’s option.

Survival. Notwithstanding the foregoing, all security and privacy terms set forth herein, and Sections 22 System Security and Section 16, Title and Intellectual Property Rights shall survive the termination of the remainder of this SOW.

COMPENSATION AND PERFORMANCE.

“Services” means all services performed or required to be performed by Contractor pursuant to this Agreement and the SOW(s).

This is a zero-dollar agreement. The Contractor will not be compensated financially for any work performed under this agreement.

SCOPE DETAILS: SYSTEM REQUIREMENTS.

The “Scope” of this Agreement includes the scope of the any Services set forth in this Agreement for Workstream [list relevant workstream] including under the applicable SOW[s].

(a) Contractor will perform the Services and provide Deliverables and Project Works, as specified in the “SOW” set forth at Exhibit D. The Parties may amend this Agreement by, among other things, adding additional SOWs or task orders thereunder.

(b) Contractor will ensure, consistent with the guidance of the SPC, that all Third-Party Vendor Software delivered by it in connection with this engagement that will be used by the public is configured, to the maximum extent possible given the limits of the software, to maximize access for disabled persons, in compliance with the Enterprise IT Accessibility Standards available at https://www.mass.gov/guides/enterprise-it-accessibility-standards and the WCAG3 Standards.

GOVERNANCE.

All work conducted by Contractor under this Agreement will be delivered under the direction of the Advanced Technology Group, whose members include representatives of DPH and the Health Connector. (Both the Health Connector and DPH are also members of the Contact Tracing Collaborative, the Commonwealth members of which report to the Commonwealth of Massachusetts COVID-19 Command Center.) The Advanced Technology Group will make all decisions related to the management of this Agreement; the work delivered via this Contract will be performed under the direction of the Advanced Technology Group.

PROJECT MANAGEMENT.

Contractor and the Health Connector must notify the other party’s Project Managers of any change in the name, address, phone number, or email address of their respective Project Manager.

1.1 The Health Connector’s Project Manager

The Health Connector’s Project Manager is [Commonwealth will insert name of project manager], the [title of project manager]. The Health Connector’s Project Manager shall perform project management on behalf of the Health Connector for this engagement. The Health Connector’s Project Manager will:

a. Work closely with Contractor Project Manager to ensure successful completion of the project.

b. Consult with the Contractor Project Manager to develop the Project Management Plan.

c. Review weekly status reports and schedule weekly meetings with Contractor, as necessary.

d. Coordinate participation from Partners in Health (PIH), DPH and other Health Connector partners as required during the engagement.

e. Acquire Health Connector project team members as needed.

f. Coordinate the Health Connector’s review of the Deliverables or Project Works and sign an acceptance form to signify acceptance for each accepted Deliverable.

The Health Connector’s Project Manager reports to [name individual to whom Commonwealth project manager reports]. [Name contract signatory for Commonwealth] will sign this MSA, the DPH Confidentiality Agreement, attached hereto as Exhibit A, and the SOW and all amendments hereto on behalf of the Health Connector.

1.2 Vendor’s Project Manager

[Name Vendor project manager] (“Contractor’s Project Manager”) shall perform project management on behalf of Contractor for this engagement. Contractor’s Project Manager will:

a. Be responsible for administering this Agreement and the managing of the day-to-day operations under this Agreement.

b. Serve as an interface between the Health Connector’s Project Manager and all Contractor personnel participating in this engagement.

c. Develop and maintain the Project Management Plan, in consultation with the Health Connector’s Project Manager.

d. Facilitate regular communication with the Health Connector’s Project Manager, including weekly status reports/updates, and review the project performance against the project plan. This is a dynamic document which is expected to change over time by mutual agreement of the Parties). Facilitate weekly project status meetings for the duration of the engagement.

e. Update the project plan on a weekly basis and distribute at weekly meetings for the duration of the engagement.

f. Sign acceptance forms to acknowledge their receipt from the Health Connector.

g. Be responsible for the management and deployment of Contractor personnel.

Contractor’s Project Manager reports to [name person to whom PM reports]. [Name vendor contract signatory], being an authorized signatory named in Contractor’s response to the RFR, will sign this MSA, the DPH Confidentiality Agreement and the SOW and all amendments thereto on behalf of Contractor.

1.3 Issue Resolution

The Project Managers from each organization bear the primary responsibility for ensuring issue resolution. If they mutually agree that they are unable to resolve an issue, they are responsible for escalating the issue to Louis Gutierrez, Executive Director, the Health Connector, and [name and title of person to whom disputes are to be escalated on the vendor side].

1.4 Work Schedules

The Health Connector’s Project Manager will determine the weekly work schedule. Contractor should be available at all reasonable times as needed for performance of the Project. All meetings will be on Eastern Time. The Project Managers will support teleconferencing for all meetings until the Parties determine that the pandemic precaution of remote meetings is no longer required.

PROJECT REPOSITORY.

During the Term, Contractor shall provide a project document repository accessible to both the Bidder, the Health Connector and DPH (the “Repository”) to store the following: (a) the Project Schedule, SOW schedules, the Project Plan, status reports, organization charts, meeting agendas and minutes and all other Project management and governance documents; (b) all Deliverables and Project Works in document form that may include technical documentation, user documentation, training materials, reports and other documentation (“Documentation”), Documentation Deliverables (including all current drafts); (c) where requested by the Health Connector, Source Material (for Third Party ENS Apps and Third Party Companion Apps); and (d) other materials that the Parties mutually agree to be included in the Repository (collectively, “Repository Materials”). For purposes of this Agreement, “Source Materials” shall mean Software source code (human readable form) (for Third Party ENS Apps and Third Party Companion Apps subject to open source licenses), object code (machine readable code), technical documentation and instructions, and all other Software and statements required to implement, maintain and support such Software. For Software that Contractor will only configure under this Agreement, Source Materials include a configuration database, technical documentation and instructions, and all other Software and statements required to implement, maintain and support Software. Contractor will ensure the Repository Materials are current. Contractor shall identify to the Health Connector any Personnel who require access to the Repository. The Contractor shall include in the repository an updated version of the configuration management database for all Third-Party Software, Health Connector Third-Party Software, and Contractor Pass-Through Third-Party Vendor Software. The Health Connector must be able to copy all of the documents included in the Repository into a storage location controlled by the Health Connector.

SUBCONTRACTORS.

The Health Connector and Contractor acknowledge and agree that third-party providers (collectively, “Third-Party Vendors”) may, from time to time, provide Third-Party Software, or Third-Party Services in support of the engagement. Any Services provided by Contractor’s staff augmentation contractors shall not constitute Third-Party Vendors. (“Third-Party Services” means any services provided by a Third-Party Vendor, including Subcontractors.) Contractor shall remain responsible for all acts and omissions of Contractor’s Subcontractors.

Any Third-Party Services provided by a Subcontractor must be provided under a Subcontract between Contractor and the Third-Party Service Vendor that complies with this Section 10. Contractor will serve as the prime contractor for each Subcontract and will remain responsible for the performance of any Services provided by any such Subcontractor.

Contractor shall:

i. submit each proposed Subcontractor to the Health Connector for written approval and obtain the Health Connector’s written approval prior to engaging any such Subcontractor to provide Third-Party Services under this Agreement.

ii. with regard to Subcontracts with Third-Party Vendors that will provide Third-Party Services, execute a Subcontract that: (A) is consistent with the provisions of this Agreement and (B) unless otherwise agreed by the Health Connector in writing, requires the Subcontractor to be bound by the Flow Down Terms.

iii. be responsible for managing each such Subcontractor’s performance under this Agreement;

iv. continue to be responsible for the performance of the Services required by this Agreement, notwithstanding such Subcontractor’s performance (irrespective of any terms or limitations or exclusions of the Subcontract);

v. if such right exists, Contractor shall assign a Subcontract to the Health Connector upon the Health Connector’s request;

vi. unless otherwise mutually agreed in writing by the Parties, provide the Health Connector with copies of all draft Subcontracts with key subcontractors with an opportunity to review and comment prior to signing and final executed Subcontracts; and

vii. defend, indemnify and hold the Health Connector harmless from and against any and all third-party claims, actions, suits, proceedings, losses, liabilities, damages, costs and expenses (including attorneys’ fees) arising out of or relating to Contractor’s failure to pay any Subcontractor, including any claim made by any Subcontractor against the Health Connector alleging nonpayment by Contractor.

Unless and until a Subcontract is assigned to the Health Connector as described herein, the Health Connector shall not be required to seek a remedy against any Subcontractor. The Health Connector shall not be bound by any provisions contained in a Subcontract to which it is not a party.

QUALITY CONTROL [Workstream #1 and #3 Only].

Unless otherwise expressly set forth in a SOW, Contractor shall establish and maintain throughout the Term of this Agreement quality control standards for the Services that are consistent with the generally accepted industry and epidemiological standards. The Health Connector may conduct a quality control review at reasonable times throughout the development and implementation phases of the SOW to review and coordinate progress in accordance with the agreed-upon standards and in order for the Health Connector to determine whether the Project quality standards have been met. Such review may include, but is not limited to, pilot design review, configuration file review, code review, architectural review, system performance review or a general review of any Deliverables.

DOCUMENTATION.

a. Contractor shall supply appropriate Documentation identified in each applicable SOW to enable the Health Connector’s appropriately skilled personnel to use the Deliverables effectively.

b. Contractor shall provide Documentation identified in each applicable SOW at the time of delivery.

c. All Documentation shall be delivered to the Health Connector electronically, in such media and in such format as reasonably requested by The Health Connector.

d. Contractor shall: (i) maintain all such Documentation and (ii) make such Documentation available to the Health Connector upon the Health Connector’s request and reasonably promptly at the expiration or termination of this Agreement.

RESOURCES.

No Technology Resources are required from the Health Connector for Contractor to perform the Services. No facility resources shall be provided by the Health Connector; all work shall be conducted remotely.

PAYMENT TERMS.

This is a zero-dollar engagement. The Health Connector shall not pay Contractor for any services conducted by it under this Agreement.

TITLE AND INTELLECTUAL PROPERTY RIGHTS.

1.5 Definition of Property

The term Property as used herein includes the following forms of property: (1) confidential, proprietary, and trade secret information; (2) trademarks, trade names, discoveries, inventions processes, methods and improvements, whether or not patentable or subject to copyright protection and whether or not reduced to tangible form or reduced to practice; and (3) works of authorship, wherein such forms of property are required by Contractor to complete its work under the SOW and may consist of computer programs (in object and source code form), scripts, data, documentation, the audio, visual and audiovisual content related to layout and graphic presentation, text, photographs, video, pictures, animation, sound recordings, training materials, images, techniques, methods, algorithms, program images, text visible on the Internet, HTML code and images, illustrations, graphics, pages, storyboards, writings, drawings, sketches, models, samples, data, other technical or business information, reports, and other works of authorship fixed in any tangible medium.

1.6 Source of Property

Contractor’s work under this Agreement may involve intellectual property derived from four different sources: (1) property that is developed by a Third-Party, such as Apple and Google (also referred to herein as “Proprietary Items”); (2) property that is developed by Contractor for the open market, such as Third-Party ENS Apps and Third-Party Companion Apps; (3) property that is developed by Contractor for individual clients other than the Health Connector, or for internal purposes prior to the Effective Date of this SOW and not delivered to anyone other than the clients of Contractor (including for example Contractor’s XDR service); and (4) property that is developed by Contractor specifically for the purposes of fulfilling its obligations to the Health Connector under the terms of this Agreement. Ownership of the first and second categories of intellectual property is addressed in separate agreements, for example, without limitation, the Apple/Google licenses for ENS and ENS Express, and [here insert the name of the license governing the Contractor’s Third-Party ENS App or Third-Party Companion App], a copy of which is attached hereto as Exhibit H. This Section 15.2 addresses exclusively ownership rights in the third and fourth categories of intellectual property.

1.7 Contractor Property and License

Contractor will retain all right, title and interest in and to all Property identified in Section 15.2 (Source of Property) subsection (3), including all copyright, patent, trade secret, trademark and other intellectual property rights in such Property (hereinafter the “Contractor Property”). The Health Connector acknowledges that its possession, installation or use of Contractor Property will not transfer to it any title to such property.

The Health Connector acknowledges that Contractor Property contains or constitutes commercially valuable and proprietary trade secrets of Contractor, the development of which involved the expenditure of substantial time and money and the use of skilled development experts. The Health Connector acknowledges that Contractor Property is being disclosed to the Health Connector to be used only as expressly permitted under the terms herein. The Health Connector will take no affirmative steps to disclose such information to third parties, and, if required to do so under the Commonwealth’s Public Records Law, M.G.L. c. 66 § 10, or by legal process, will promptly notify Contractor of the imminent disclosure so that Contractor can take steps to defend itself against such disclosure.

Except as expressly authorized herein, the Health Connector will not copy, modify, distribute or transfer by any means, display, sublicense, rent, reverse engineer, decompile or disassemble Contractor Property.

Contractor grants to the Health Connector, a fully-paid, royalty-free, non-exclusive, non-transferable, worldwide, irrevocable, perpetual, assignable license to make, have made, use, reproduce, distribute, modify, publicly display, publicly perform, digitally perform, transmit, copy, sublicense to any Health Connector subcontractor for purposes of creating, implementing, maintaining or enhancing a Deliverable, and create derivative works based upon Contractor Property, in any media now known or hereafter known, to the extent the same are embodied in the Deliverables or Project Works, or otherwise required to exploit the Deliverables or Project Works. During the Term of this Agreement and immediately upon any expiration or termination thereof for any reason, Contractor will provide to the Health Connector the most current copies of any Contractor Property to which the Health Connector has rights pursuant to the foregoing, including any related documentation.

Notwithstanding anything contained herein to the contrary, and notwithstanding the Health Connector’s use of Contractor Property under the license created herein, Contractor shall have all the rights and incidents of ownership with respect to Contractor Property, including the right to use such property for any purpose whatsoever and to grant licenses in the same to third parties. Contractor shall not encumber or otherwise transfer any rights that would preclude a free and clear license grant to the Commonwealth.

In the course of the performance of the Services, certain Contractor Property, specifically the [choose appropriate app; note that this only applies to Workstream #2] Contractor’s Third-Party ENS App and Third-Party Companion may be used by Contractor. The Health Connector shall have or obtain no rights in any such Proprietary Items (or in any modifications or enhancements to them) except as expressly set out in this Agreement. The Health Connector acknowledges that toolsets used by Contractor may contain Third-Party software and be subject to separate terms and conditions.

1.8 Health Connector Property

In conformance with the Commonwealth’s Standard Terms and Conditions, all Deliverables and Project Works created under this Agreement (i.e. Deliverables and Project Works that fall under subsection (4) of section 13.2 above) whether made by Contractor, subcontractor or both are the property of the Health Connector, except for the Contractor Property embodied in the Deliverable. Contractor irrevocably and unconditionally sells, transfers and assigns to the Health Connector or its designee(s), the entire right, title, and interest in and to all intellectual property rights that it may now or hereafter possess in said Deliverables and Project Works, except for the Contractor Property embodied in the Deliverables and Project Works, and all derivative works thereof. This sale, transfer and assignment shall be effective immediately upon creation of each Deliverable and shall include all copyright, patent, trade secret, trademark and other intellectual property rights created by Contractor or Contractor’s subcontractor in connection with such work (hereinafter the "Commonwealth Property"). For the avoidance of doubt, all Output of the AIP, to the extent to which it is derived from Health Connector Data, shall constitute Health Connector Property. “

The Health Connector hereby grants to Contractor and its Affiliates a worldwide, irrevocable, non-exclusive, royalty-free license under all Intellectual Property rights to (i) its Pre-Existing IP, to the extent necessary for Contractor or its Affiliates to perform under this Agreement; and (ii) to share, directly as a contractor or indirectly through a business partner, with other governmental entities the Deliverables or Project Work created where (a) Contractor provides timely notification to the Health Connector of such sharing and sends the Health Connector a monthly report of all other governmental entities with which it has actually shared the deliverables; (b) it refrains from charging any fee of any kind whatsoever for such Deliverables or Project Work; and (c) it withholds sharing of any Deliverables or Project Work that the Health Connector requests be withheld.

All copyrightable material contained within a Deliverable or a Project Work and created under this Agreement are works made for hire. Contractor bears the burden to prove that a work within a Deliverable or Project Work was not created under this Agreement. If work is determined to not be made for hire or that designation is not sufficient to secure rights, to the fullest extent allowable and for the full term of protection otherwise accorded to Contractor under such law, Contractor shall and hereby irrevocably does, assign and transfer to the Health Connector free from all liens and other encumbrances or restrictions, all right, title and interest Contractor may have or come to have in and to such Deliverable. Contractor hereby waives in favor of the Health Connector (and shall cause its personnel to waive in favor of the Health Connector in writing signed by such personnel) any and all artist’s or moral rights (including, without limitation, all rights of integrity and attribution) it may have pursuant to any state or federal laws of the United State in respect to any deliverable and all similar rights under the laws of all other applicable jurisdictions. CONTRACTOR HEREBY WAIVES IN FAVOR OF THE HEALTH CONNECTOR ANY AND ALL ARTIST’S OR MORAL RIGHTS (INCLUDING, WITHOUT LIMITATION, ALL RIGHTS OF INTEGRITY AND ATTRIBUTION) IT MAY HAVE PURSUANT TO ANY STATE OR FEDERAL LAWS OF THE UNITED STATES IN RESPECT TO ANY THE HEALTH CONNECTOR OWNED DELIVERABLE AND ALL SIMILAR RIGHTS UNDER THE LAWS OF ALL OTHER APPLICABLE JURISDICTIONS.

Contractor agrees to execute all documents and take all actions that may be reasonably requested by the Health Connector to evidence the transfer of ownership of or license to intellectual property rights described in this Section 15.4, including providing any code used exclusively to develop such Deliverables and Project Works for the Health Connector and the documentation for such code. Contractor acknowledges that there are currently and that there may be future rights that the Commonwealth may otherwise become entitled to with respect to Commonwealth Property that does not yet exist, as well as new uses, media, means and forms of exploitation, current or future technology yet to be developed, and that Contractor specifically intends the foregoing ownership or rights by the Commonwealth to include all such now known or unknown uses, media and forms of exploitation.

The Commonwealth retains all right, title and interest in and to all derivative works of Commonwealth Property.

The Health Connector hereby grants to Contractor a nonexclusive, revocable license to use, copy, modify and prepare derivative works of Commonwealth Property only during the Term and only for the purpose of performing services and developing Deliverables and Project Works for the Health Connector under this Agreement.

With respect to web site development contracts, the Health Connector will bear sole responsibility for registering the software or system domain name or URL, applying for any trademark registration relating to the software or system domain name or URL and applying for any copyright registration related to its copyright ownership with respect to any Commonwealth Property.

For purposes of clarification, Health Connector Property shall include, at a minimum, all data received, processed, or stored during the Workstream #1 pilot, all written (paper or digital) materials prepared for the Health Connector (except to the extent that they contain Contractor Property), and the configuration management databases for all configurations performed under this Agreement.

1.9 Intellectual Property and Work Effort Agreement for Contractor’s Employees, Contractors and Consultants and Agents

Contractor shall ensure that each of Contractor personnel providing services under this Agreement, regardless of whether the individual is an employee, contractor, or agent of Contractor, shall, prior to rendering any services under this Agreement sign the “Intellectual Property and Work Effort Agreement for Vendor’s Employees, Contractors, Consultants, and Agents” (the “IPAWE Agreement”) which is attached hereto as Exhibit F. (Note that if Contractor is a Commonwealth of Massachusetts state college or university, or another Commonwealth of Massachusetts state entity, Contractor need not have any state employees working on the Project sign the IPAWE.) Contractor shall return the signed copies of the IPAWE Agreement to the Health Connector’s Project Manager prior to the rendering of any services under this Agreement.

1.10 Third-Party Intellectual Property.

(a) All Software that is Contractor Property or Third-Party Software that will be used in connection with this agreement (including, without limitation, the ENS and ENS Express) will be identified in the applicable SOW .

(b) The Health Connector shall have, in addition to its rights and remedies under this Agreement, such license rights and remedies in the Third-Party Software as are set forth in the applicable license and subscription agreements.

EFFECT OF TERMINATION; SURVIVAL.

Upon termination of this Agreement or any SOW for any reason, the Contractor will deliver Deliverables and Works in Progress in a form and timeframe reasonably requested by the Health Connector.

CONFIDENTIAL INFORMATION.

(a) Confidential Information” means (a) with respect to the Commonwealth and the Health Connector, all information provided by them and their agents and contractors to the Contractor and (b) with respect to the Contractor, (i) any information about Contractor’s Third-Party Software; (ii) proprietary information identified in this Agreement and any SOW’s hereunder; (iii) all personally identifiable information regarding its Personnel; (iv) any other proprietary information that is provided by Contractor to the Health Connector in connection with this Agreement and is (1) marked confidential if provided in written form by Contractor, or (2) if provided in oral form or visually, confirmed as confidential in writing by Contractor within thirty (30) days after its initial disclosure; and (v) all confidential information relating to its business activities, which shall be marked and/or confirmed to be confidential in accordance with subsection (a)(iv) above. Confidential Information does not include information previously known to any Party without obligation of confidence; independently developed by it or for it without reference to or reliance on the Confidential Information of the other party hereto; acquired by it from a Third-Party that is not under an obligation of confidence to the other party hereto with respect to such information; or publicly known through no breach of this Agreement.

Confidential Information will remain the property of the disclosing Party, and the receiving Party will not be deemed by virtue of this Agreement or access to the disclosing Party’s Confidential Information to have acquired any right, title or interest in the Confidential Information. Confidential Information of the other Party may be used by the receiving Party and its Personnel and Subcontractors only in connection with performing its obligations and exercising its rights under this Agreement and may not be disclosed to any Third-Party; in the case of the Health Connector Data, Contractor’s access to, use of, or disclosure of the Health Connector Data shall, in all cases conform to all of the data privacy and security provisions of this Agreement including without limitation the provisions of (1) Section 6 of the Commonwealth Terms and Conditions and (2) Exhibit A hereto, “DPH Confidentiality Agreement”;

Each Party will protect the confidentiality of Confidential Information of the other Party in the same manner that it protects the confidentiality of its own proprietary and confidential information, but in no event less than reasonable care, which efforts shall include, without limitation, entering into appropriate confidentiality agreements with Personnel and Subcontractors prior to disclosure of any Confidential Information that provide that such Personnel and Subcontractors maintain the confidentiality of the Confidential Information. as necessary for use in connection with this Agreement. Contractor may transmit electronic copies of the Health Connector Data to its servers, hard drives, and other storage locations as necessary to perform the Services.

Notwithstanding anything to the contrary in the foregoing but subject to the terms of this Section 17, the receiving Party, subject to its confidentiality obligations under this Agreement, may (i) retain copies of Confidential Information that it is required to retain by Law, (ii) retain copies of its work product that contain Confidential Information for archival purposes or to defend its work product and (iii) in accordance with legal, disaster recovery and records retention requirements, store such copies and derivative works in archival format (e.g., backup tapes), which may not be returned or destroyed upon request of The Health Connector. (d) Notwithstanding the foregoing, The Health Connector’s obligation to maintain Contractor’s Confidential Information is subject and subordinate to Mass. Gen. Laws c. 4 § 7 cl. 26 and c. 66 § 10. The receiving party agrees to promptly notify the disclosing party of any unauthorized access, use or disclosure of the disclosing party’s Confidential Information and to cooperate with and assist the disclosing party in every reasonable way to stop or minimize such unauthorized use, access or disclosure.

OFFSHORE RESOURCES.

Contractor may use offshore resources except for work under Workstream #1.

AUDIT.

(a) Security Audit (Workstream #1 only). In addition to the obligations set forth in Section 7 of the Commonwealth Terms and to the rights of the Health Connector and the Commonwealth pursuant to the terms of the Standard Contract Form, Contractor will provide to the Health Connector (or its authorized representatives), with reasonable prior notice, access to Contractor Personnel, books and records applicable to the performance of the Services, and to facilities where the Health Connector Data is maintained or the Services are performed, for the purpose of performing an audit of the security practices, procedures and safeguards utilized by Contractor in the performance of the Services as the Health Connector may reasonably request to (a) assure itself of the security of the Health Connector Data; (b) quality initiatives and quality assurance; and (c) compliance with the applicable Laws. These audits shall be conducted no more than once per calendar year (and more often, in the event that the Health Connector has a reasonable belief that the Health Connector Data is insecure or that Contractor is violation of applicable Law), at mutually convenient times to Contractor and the Health Connector during Contractor’s normal business hours and in a manner so as not to disrupt the performance of the Services.

(b) Document Requests. Client may request, upon reasonable prior written notice, such notice being sufficient to permit Contractor to gather the requested records, Contractor to produce directly pertinent records to verify compliance with: Section 17, Confidential Information; and Section 22, Security.

(c) Audit Follow-Up. Contractor shall promptly respond to any deficiencies identified by any audit report relating to Contractor and work diligently with the Health Connector regarding such identified deficiencies.

NOTICE.

Any notice or other communication required or permitted to be given pursuant to this Agreement shall be deemed delivered and received when submitted in writing in person or when received either: (a) via certified or registered mail, return receipt requested, postage prepaid; or (b) via express mail or nationally recognized courier service, by such party at the address set forth below:

To Contractor:

[Name and mailing address of Contractor business contact]

With a copy to:

[name and address of contractor legal counsel]

To Client:

Louis Gutierrez Executive Director The Commonwealth Health Insurance Connector Authority 100 City Hall Plaza Boston, MA 02108

Andrew Egan General Counsel The Commonwealth Health Insurance Connector Authority 100 City Hall Plaza Boston, MA 02108

In the case of any other notices given under this Agreement, any notice shall be deemed received when delivered by any other appropriate method evidencing actual receipt by Connector or Contractor, including email and facsimile. A party may designate a different address by notice to the other party, given in accordance with this Section 20.

POINTS OF CONTACT.

Contractor and the Health Connector will each assign a single point of contact with respect to this Agreement for purposes of providing notice. It is anticipated that the contact person will not change during the Term of this Agreement. In the event that a change is necessary, the party requesting the change will provide prompt written notice to the other. In the event a change occurs because of a non-emergency, two-week written notice is required. For a change resulting from an emergency, prompt notice is required.

Contractor’s contact person is [name] who can be reached at [email and phone number of Contractors SPOC] The Health Connector’s contact is Louis Gutierrez, Executive Director, Commonwealth Health Insurance Connector Authority, who can be reached at louis.gutierrez@mass.gov or (617) 933 3060.

SYSTEM SECURITY [Workstream #2 only].

Commonwealth Data may physically reside at a Commonwealth, the Health Connector, Contractor or Third-Party locations. In addition to the security requirements in the Agreement, Vendor must comply with the Enterprise Information Security Policies and Standards located at https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards, or a successor link.

1.11 Commonwealth Data

In connection with Commonwealth Data in Contractor’s control, Contractor will implement commercially reasonable safeguards on Contractor owned and managed systems necessary to:

a. Protect against unauthorized access to Commonwealth Data from any public or private network;

b. Protect against unauthorized physical access to any information technology resources involved in the development effort; and

c. Protect against interception and manipulation of Commonwealth Data during transmission to and from any servers.

d. Additional Contractor safeguards for the Health Connector are set forth in this Agreement.

1.12 Commonwealth Personal Data

In addition to the above requirements for Commonwealth Data, Contractor may be required to use Commonwealth Personal Data under MGL ch. 66A to work on or with information technology systems that contain such data in order to fulfill part of its specified tasks. For purposes of this work effort, electronic personal data and personal information includes data provided by the Health Connector to Contractor which may physically reside at a location owned and/or controlled by the Commonwealth, the Health Connector, Contractor, a Contractor Third-Party Vendor or a Health Connector Third-Party Vendor. Contractor shall comply with the DPH Confidentiality Agreement set forth at Exhibit A hereto. In addition, in connection with electronic personal data and personal information within Contractor’s control, Contractor shall implement safeguards reasonably needed to:

a. Ensure the security, confidentiality and integrity of electronic personal data and personal information;

b. Protect against unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network;

c. Notify the Health Connector promptly if any breach of such system or of the security occurs that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information.

d. Contractor represents that it has either executed the Commonwealth’s Standard Contract Form, which includes EO504 certification, or executed the EO504 Contractor Certification Form, available at https://www.mass.gov/lists/osd-forms.

ACCEPTANCE OR REJECTION PROCESS

Contractor will conduct Tasks and activities and produce Deliverables specified in the SOWs entered under this Agreement. The Health Connector’s Project Manager is responsible for reviewing the Tasks, activities, and work products and approving and accepting Deliverables and Project Works.

Within five (5) working days of receipt of each Deliverable the Health Connector’s Project Manager will notify Contractor, in writing, of the acceptance or rejection of said Deliverable. A form signed by the Health Connector shall indicate Acceptance. Contractor shall acknowledge receipt of acceptance forms in writing. Any rejection will include a written description of the defects of the Deliverable. If the Health Connector does not respond to the submission of the Deliverable, within five (5) working days of the Health Connector’s receipt of each Deliverable, Contractor shall provide a reminder notice to the Health Connector Project Manager If the Health Connector rejects a Deliverable, Contractor will, upon receipt of such rejection, act diligently to correct the specified defects and deliver an updated version of the Deliverable to the Commonwealth. The Health Connector will then have an additional 5 (five) business days from receipt of the updated Deliverable to notify Contractor, in writing, of the acceptance or rejection of the updated Deliverable. Any such rejections will include a description of the way in which the updated Deliverable fails to correct the previously reported deficiency.

Following any acceptance of a Deliverable which requires additional work to be entirely compliant with the pertinent specifications, and until the next delivery, Contractor will use reasonable efforts to provide a prompt correction or workaround.

“CODE REVIEW [Workstream #3 Only]

All Deliverables consisting of the review and assessment of Third-Party EN Apps or Third-Party Companion Apps shall follow and apply current industry security standards and practices, including, but not limited to those published by The National Institute of Standards & Technology (NIST), the SANS (SysAdmin, Audit, Network, Security (SANS) Institute), and other recognized bodies, as well as the requirements for “automated personal data systems” (personal data systems in which personal data is stored, in whole or in part, in a computer or in electronically controlled or accessible files) set forth in the Fair Information Practices Act, MGL ch. 66A, and the Enterprise Information Security Policies and Standards located at https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards.

MSA EXHIBITS

The following Exhibits attached hereto are hereby incorporated by reference as if fully set forth herein.

The undersigned hereby represent that they are duly authorized to execute this MSA on behalf of their respective organizations.

Commonwealth Health Insurance Connector Authority

[Vendor name]

Louis Gutierrez, Executive Director

[Signatory name and Title]

Date

Date

EXHIBIT A TO THE MSA

DPH Confidentiality Agreement

EXHIBIT B TO THE MSA

KEY QUESTIONS

Efficacy

· To what extent do Bluetooth exposure notifications increase the impact of manual contact tracing efforts on the mitigation of the spread of COVID-19? Specifically, do ENS solutions increase the number of contacts identified that have been exposed to COVID-19 and/or decrease the time it takes to notify a contact of an exposure?

· How accurate are ENS notifications? What are the rates of false positive notifications and false negatives?

· What configuration parameters optimize the performance of ENS?

· Under what conditions is ENS technology more/less accurate?

· Are there features not present in EN Express that meaningfully and demonstrably impact the efficacy of ENS that should be evaluated by the Commonwealth?

Integration

· To what extent can Bluetooth exposure notifications complement and integrate with the existing policies, processes and technologies already used in Massachusetts? What is the best way of integrating Bluetooth exposure notifications into existing systems/processes?

· What are the various operational, maintenance, and cost elements the Commonwealth would need to consider in order to deploy Bluetooth exposure notifications statewide?

Public response

· What is the public perception of Bluetooth exposure notification technology in Massachusetts?

· What are the most effective ways to encourage adoption of ENS technology?

· What is the minimum level of adoption required by the general public for ENS technology to be an effective addition to the Massachusetts COVID-19 response?

· What are reasonable target adoption rates of ENS technology in Massachusetts?

· What impact do Bluetooth exposure notifications have on the Equity of the Commonwealth’s COVID-19 response? Are there strategies to deploy ENS to improve Equity in the Commonwealth’s COVID-19 response?

Privacy/security

· What are the privacy/security considerations of deploying Apple/Google EN Express in Massachusetts?

· What are the privacy/security considerations of deploying Third-Party ENS Apps and Third-Party Companion Apps in Massachusetts?

EXHIBIT C

Workstream #1 Success Criteria

· Proximity detections

· Notification timeliness

· Rates of false positive and false negative

Many pilots and full-scale implementations of EN technology in other jurisdictions have addressed questions related to Technical Success; the Commonwealth will leverage these existing data and insights to inform its own strategy. Workstream #1 Bidders are not required to propose to test the technical success of EN Express during their pilots, but may offer, in their bid, a proposal about how EN Express could be piloted to assess technical success. The Health Connector will consider whether to include assessment of technical success in the pilots conducted by such Bidders.

· Time from test result to contact notification timeliness / lag

· Identification of unique contacts, beyond those identified through manual contact tracing

· Security & privacy assessments indicate no concerns Critical component of MA EN Express Pilot