Attachment I IT Special Conditions.pdf

Attachment I

SPECIAL CONDITIONS

1. Responsibility of Contractors. In order to comply with Section 6, Act 52, HSL 2003, which amended section 103D-310, HRS, the CONTRACTOR shall provide as proof of compliance with the requirements of section 103D-310 (c), HRS, the following documents:

a. A tax clearance certificate from the State Department of Taxation and the Internal Revenue Service, subject to section 103D-328, HRS, current within six

(6) months of the issuance date;

b. A certificate of compliance for chapters 383, 386, 392, and 393, HRS, from the State Department of Labor and Industrial Relations, current within six (6) months from the issuance date; and

c. A certificate of good standing from the Business Registration Division of the State Department of Commerce and Consumer Affairs, current within six (6) months from the issuance date.

d. Section 103D-310(c) of the HRS was amended by Act 190, HSL 2011, by adding language that if a vendor is participating in Hawaii Compliance Express (“HCE”), State and County procurement personnel are required to verify compliance via HCE. All other vendors are encouraged to subscribe to HCE, but if paper certificates are submitted, the State Procurement Office highly recommends that, State and County personnel contact the issuing agency to verify its validity as there have been fraudulent paper certificates submitted in the past.

2. Campaign Contributions by State and County Contractors. Contracts are hereby notified of the applicability of section 11-355, HRS, which states that campaign contributions are prohibited from specified State of county government contractors during the term of the contract if the contractors are paid with funds appropriated by a legislative body.

3. Insurance. The CONTRACTOR shall obtain, maintain, and keep in force throughout the period of this Contract the following types of insurance:

a. General liability insurance issued by an insurance company in the amount of at least ONE MILLION AND NO/100 DOLLARS ($1,000,000.00) for bodily injury and property damage liability arising out of each occurrence and TWO MILLION AND NO/100 DOLLARS ($2,000,000.00) aggregate.

b. Automobile insurance issued by an insurance company in an amount of at least ONE MILLION AND NO/100 DOLLARS ($1,000,000.00) per occurrence.

c. Cyber liability insurance issued by an insurance company in the amount of at least TEN MILLION AND NO/100 DOLLARS ($10,000,000.00) for liability arising out of each occurrence and TEN MILLION AND NO/100 DOLLARS ($10,000,000.00) aggregate.

The insurance shall be obtained from a company authorized by law to issue such insurance in the State of Hawaii (or meet Section 431: 8-301, Hawaii Revised Statutes, if utilizing an insurance company not licensed by the State of Hawaii).

For general liability, automobile liability and cyber liability insurance, the insurance coverage shall be primary and shall cover the insured for all work to be performed under the Contract, including changes, and all work performed incidental thereto or directly or indirectly connected therewith. The CONTRACTOR shall maintain in effect this liability insurance until the STATE has certified that the CONTRACTOR's work under the Contract has been completed satisfactorily.

Prior to or upon execution of this Contract, the CONTRACTOR shall obtain a certificate of insurance verifying the existence of the necessary insurance coverage in the amounts stated above.

Each insurance policy required by this Contract shall contain the following clause:

It is agreed that any insurance maintained by the State of Hawaii will apply in excess of, and not contribute with, insurance provided by this policy.

The general liability and automobile liability insurance policies required by this Contract shall contain the following clause:

The State of Hawaii and its officers and employees are additional insured with respect to operations performed for the State of Hawaii.

The certificate of insurance shall indicate these provisions are included in the policy.

The CONTRACTOR shall immediately provide written notice to the contracting department or agency should any of the insurance policies evidenced on its certificate of insurance forms be canceled, limited in scope, or not renewed upon expiration.

If the scheduled expiration date of the insurance policy is earlier than the expiration date of the time of performance under this Contract, the CONTRACTOR, upon renewal of the policy, shall promptly cause to be provided to the STATE an updated certificate of insurance.

4. Audit Requirements.

a. Nonprofit organizations that expend $1,000,000.00 or more in a year of federal funds from any source shall have a single audit conducted for that year in accordance with the Single Audit Act Amendments of 1996, Public Law 104-156.

b. If the preceding condition applies, the CONTRACTOR shall conduct a financial and compliance audit in accordance with the guidelines identified therein. Failure to comply may result in the withholding of payments to the CONTRACTOR.

c. Nonprofit organizations that expend less than $1,000,000.00 a year in federal funds are exempt from federal audit requirements for that year, however, records shall be available for review or audit by appropriate officials of the federal awarding agency, the STATE, or General Accounting Office.

d. If the CONTRACTOR is exempt from federal audit requirements in accordance with subparagraph c., above, the cost of any audit conducted on behalf of the CONTRACTOR shall not be charged to the federal portion of this Contract.

5. The CONTRACTOR shall comply with all Federal statutes relating to nondiscrimination.

These include but are not limited to: (a) Title VI of the Civil Rights Act of 1964 (P.L. 88-

352) which prohibits discrimination on the basis of race, color or national origin; (b) Title IX of the Education Amendments of 1972, as amended (20 U.S.C. §§1681-1683, and 1685-1686), which prohibits discrimination on the basis of sex; (c) Section 504 of the Rehabilitation Act of 1973, as amended (29 U.S.C. §§794), which prohibits discrimination on the basis of handicaps; (d) the Age Discrimination Act of 1975, as amended (42 U.S.C. §§6101-6107), which prohibits discrimination on the basis of age; (e) the Drug Abuse Office and Treatment Act of 1972 (P.L. 92-255), as amended, relating to nondiscrimination on the basis of drug abuse; (f) the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970 (P.L. 91-616), as amended, relating to nondiscrimination on the basis of alcohol abuse or alcoholism; (g) §§523 and 527 of the Public Health Service Act of 1912 (42 U.S.C. §§290 dd-3 and 290 ee-3), as amended, relating to confidentiality of alcohol and drug abuse patient records;(h) Title VIII of the Civil Rights Act of 1968 (42 U.S.C. §§ 3601 et seq.), as amended, relating to non-discrimination in the sale, rental or financing of housing; (i) any other nondiscrimination provisions in the specific statute(s) under which application for Federal assistance is being made; and (j) the requirements of any other nondiscrimination statute(s) which may apply to the application.

6. Cyber Liability Protection

a. The Standards for Security Categorization of Federal Information and Information

Systems Publication 199 (“FIPS 199”) document provides security categories applicable to electronic disease surveillance systems (https://csrc.nist.gov/pubs/fips/199/final). It specifies the categories of vulnerability risk impact based on Confidentiality risk, Integrity risk and Availability risk of the user information and systems information.

Those definitions are applied hereto and made a part hereof as stated below:

i. Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C. SEC., 3552]

ii. Integrity: Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity. [44

U.S.C., SEC. 3552]

iii. Availability: Ensuring timely and reliable access to and use of information.

[44 U.S.C., SEC. 3552]

iv. Reference the corresponding definitions for low, moderate, and high-risk data impact at https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf, the insurance liability coverage for EDSSs risk factors were identified with the corresponding cost linked to the associated data risk factors.

v. The Offeror shall obtain and maintain in full force and effect, the insurance and protection described in this section. Offeror shall provide verification of cyber-liability insurance coverage as described herein prior to contract award of this RFP. Offeror shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in the state of Hawaii (or meeting Section 431: 8-301, Hawaii Revised Statutes, if utilizing an insurance company not licensed by the State of Hawaii), United States of America and having a rating of A-, Class VII or better, in the most recently published edition of Best’s Reports. The insurance shall be maintained in full force and effect for the duration of this contract in the amount of ten million ($10,000,000) dollars as protection in the event of a data breach of public or non- public data, disabling code, privacy or cyber liability attack to EDSS, its system or other user data transmitted electronically via an interface or other type of electronic connection or manual entry into the EDSS system. This requirement is to align with State ETS requirements for cyber liability insurance.

vi. Also included shall be Offeror-created programming, coding, technical development, or other inclusions not specified here that have been or are performed in or to the EDSS for the systems’ operation that could result in the system being compromised. The Offerors’ liability shall apply to any work performed by Offeror in or on the system and all components utilized in the

EDSS.

vii. The following definitions specify the type of event(s) against which cyber liability insurance should protect:

1) Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of EDSS user(s) to access the Non-Public Data or Personal Data.

2) Disabling Code means computer instructions or programs, subroutines, code, instructions, data or functions, (including but not limited to viruses, worms, date bombs or time bombs), including but not limited to other programs, data storage, computer libraries and programs that self-replicate without manual intervention, instructions programmed to activate at a predetermined time or upon a specified event, and/or programs purporting to do a meaningful function but designed for a different function, that alter, destroy, inhibit, damage, interrupt, interfere with or hinder the operation of EDSSs software, applications and/or its end users processing environment, the system in which it resides, or any other software or data on such system or any other system with which it is capable of communicating.

3) Non-Public Data means High Risk Data and Moderate Risk Data that is not subject to distribution to the public as public information.

This system is deemed to be sensitive and confidential but not subject to Health Insurance Portability and Accountability Act

(“HIPAA”) because it contains information that is exempt by statute, ordinance and or administrative rule from access by the general public as public information.

4) Personal Data means data alone or in combination that includes information relating to an individual that identifies the individual by name, identifying number, mark or description can be readily associated with a particular individual and which is not a public record. Personal Information may include the following PII:

government- issued identification numbers (e.g., Social Security, driver’s license, passport); Medicare/Medicaid number, health insurance number, or Protected Health Information (“PHI”) relating to a person as protected under the HIPAA.

5) Protected Health Information (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI includes demographic information collected from an individual and health-related information that is created or received by a health care provider, health plan, employer or health care clearinghouse and relates to the past, present or future physical or mental health or condition of an individual which identifies the individual or there is a reasonable basis to believe the information can be used to identify the individual.

viii. Failure of the vendor to show proof of coverage at the time of contract award will result in disqualification and withdrawal of the award to said vendor.

7. Certifications. The use of federal funds requires certifications regarding the following: (a)

Debarment, Suspension, Ineligibility and Voluntary Exclusion-Lower Tier Covered Transactions; (b) Drug-Free Workplace Requirements; (c) Lobbying;(d) Program Fraud Civil Remedies Act ("PFCRA"); and (e) Environmental Tobacco Smoke.

8. Required Disclosures for Federal Awardee Performance and Integrity Information System ("FAPIIS"). In accordance with 45 Code of Federal Regulations 75.1113, the CONTRACTOR shall disclose to the STATE and the U.S. Department of Health and Human Services ("HHS"), Office of the Inspector General ("OIG"), in a timely manner, in writing, all information related to violations of the federal criminal law involving fraud, bribery, or gratuity violations potentially affecting the federal award. The CONTRACTOR shall also provide a copy of such disclosure to the Centers for Disease Control and Prevention ("CDC"). Disclosures shall be sent to the following addresses:

U.S. Department of Health and Human Services Office of the Inspector General ATTN: Mandatory Grant Disclosure, Intake Coordinator 330 Independent Avenue, SW Cohen Building, Room 5527 Washington, DC 20201 Fax: (202)-205-0624 or Email: MandatoryGranteeDisclosures@oig.hss.gov (Include "Mandatory Grant Disclosure" in subject line)

And mailto:MandatoryGranteeDisclosures@oig.hss.gov

CDC, Office of Grant Services Joelle Cadet, Grants Management Specialist Centers for Disease Control and Prevention Branch 1 2939 Flowers Road, MS-TV2 Atlanta, GA 30341 Email: qrx@cdc.gov (Include "Mandatory Grant Disclosure" in subject line)

9. Adherence to Federal Contract Provisions. The CONTRACTOR shall comply with all required contract provisions, as applicable, in "Appendix II to 45 CFR Part 75 –Contract Provisions for Non-Federal Entity Contracts Under Federal Awards." For the purposes of the Contract, the term "non- Federal Entity" means the STATE.

10. Pilot Program for Enhancement of Contractor Employee Whistleblower Protections. The CONTRACTOR shall comply with the following federal regulation as follows:

a. This Contract and employees working on this Contract shall be subject to the whistleblower rights and remedies in the pilot program on Contractor employee whistleblower protections established at 41 U.S.C. 4712 by section 828 of the National Defense Authorization Act for Fiscal Year 2013 (Pub. L. 112-239) and

FAR 3.908.

b. The CONTRACTOR shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in section 3.908 of the Federal Acquisition Regulation.

11. Federal Compliance. The CONTRACTOR shall comply with all Federal laws, regulations, policies and the Centers for Disease Control and Prevention's General Terms and Conditions for Non-Research Grant and Cooperative Agreements.

12. Language Access. The CONTRACTOR shall comply, as a covered entity, with the provisions of chapter 321 C, Hawaii Revised Statutes, regarding language access and with federal laws regarding language access, including Title VI of the Civil Rights Act of 1964, 42 USC section 2000d et seq., 45 CFR part 80, and section 1557 of the Affordable Care Act (42 USC section 18116) and its implementing regulation (45 CFR part 92).

These laws require the CONTRACTOR to, among other things, ensure that consumers are adequately informed of their rights, and ensure meaningful access to services, programs, and activities by providing clients with oral and written language services, including written translations of vital documents, if, on account of national origin, clients do not speak English as their primary language and have a limited ability to read, write, speak, or understand the English language. If it is necessary to provide oral or written language services to a client's family in order for the client to benefit from the CONTRACTOR's services, programs, or activities, the CONTRACTOR shall provide those language services to the family. If at any time, for any reason, the STATE determines that a particular employee or contracted individual is not meeting its expectations, the CONTRACTOR shall take appropriate action which could result in corrective action up to but not limited to ending that individual's assignment.

mailto:qrx@cdc.gov