BH TRP Attachment 1Template SOW FINAL.docx

TEMPLATE STATEMENT OF WORK

BETWEEN

THE EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

AND

[VENDOR]

FOR THE

BEHAVIORAL HEALTH TREATMENT AND REFERRAL PLATFORM

1. INTRODUCTION

The following document will serve as a Statement of Work (“SOW”) between the Executive Office of Health and Human Services (“EOHHS”) of the Commonwealth of Massachusetts (“Commonwealth”) and [Vendor Name] (“Vendor”) (collectively, the “Parties”) to apply to the implementation, maintenance and support of a Behavioral Health Treatment and Referral Platform (BH TRP) for stakeholders in the Commonwealth including hospital EDs, inpatient psychiatric facilities, health insurance carriers (“carriers”), and state agencies. Additional work in support of the Application, including the BH TRP system, may follow the initial work, at EOHHS’s option, upon the execution of a Change Order or amendment, as applicable, for such work. The entire agreement between the Parties (the “Agreement”) consists of the following documents in the following order of precedence: (1) the Commonwealth Terms and Conditions for Information Technology Contracts; (2) the Commonwealth’s Standard Contract Form; (3) the RFR for the BH TRP; (4) the Data Management and Confidentiality Agreement (DMCA); (5) this SOW; and (6) the Vendor’s response to the RFR, inclusive of all attachments and modifications, as amended by any subsequent negotiations between the Parties.

2. DEFINITIONS

The terms used in this SOW, unless defined in this SOW or in an amendment made hereto, shall have the meaning ascribed to them in the other documents that constitute the Agreement between the Parties.

“Application” means the Vendor-owned or licensed system including the BH TRP and data exchange and management software solution (whether SaaS or otherwise), as well as any system or third-party components or open-source software contained therein, and any updates, upgrades, releases or enhancements thereto.

“Authorized Users” means all employees, staff, agents, contractors, and consultants of EOHHS and the other Participant Organizations, each of whom is authorized to use and/or access the Application, as well as any other parties that EOHHS grants any sublicense or right to access hereunder in connection with the Services under this Agreement and/or the Permitted Use.

“Authorized User Group” means a group of Authorized Users from the same or multiple Participant Organizations, with similar roles, credentials, and access entitlements.

“Behavioral Health Treatment and Referral Platform (BH TRP)”: refers to new technology that will support automation of the ED Behavioral Health referral screening, evaluation, and referral process, enable the electronic transmission of standardized admissions information, and create a real-time, transparent view of patients seeking behavioral health treatment for Participant Organizations.

“Business Day” means any weekday on which EOHHS employees are expected to report to work.

“Calendar Day” means any day of the week regardless of whether work is performed, including weekends and holidays.

“Change Order or Change Request” means a written amendment to the SOW, directing the Bidder to change the contract price, Requirements, or project schedule. Such changes must be within the scope of the SOW and this RFR.”

“Cloud Offering” shall refer to Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS).

“Commonwealth Data” is as defined in Section 5.

“Commonwealth Property” is as defined in Section 10.9.4.

“Deliverable” means any work product that Vendor delivers for the purposes of fulfilling its obligations to EOHHS under the terms of the Agreement, including work product that Vendor must submit to EOHHS for EOHHS's approval in accordance with the formal acceptance procedures set forth within this SOW or the Change Order(s) entered into hereunder.

“Documentation” means all generally available documentation relating to the Application, including but not limited to all user manuals, operating manuals, and other instructions, specifications, documents, and materials, in any form or media, that describe any component, feature, requirement, or other aspect of the Application, including any functionality, testing, operation, or use thereof.

“EOHHS Assets” means all property, equipment, and hardware owned by EOHHS, which EOHHS (or a Commonwealth Participant Organization) provides or provides access to Vendor solely for Vendor’s or its subcontractor’s use in the course of Vendor’s performance of Services under this Agreement.

“Executive Office of Health and Human Services or EOHHS” a secretariat-level executive agency under the Governor of Massachusetts. EOHHS oversees 12 constituent agencies, including the Department of Mental Health (DMH) and the MassHealth program.

“EOHHS IT” means EOHHS’ Information Technology Unit that provides a range of centralized IT services for EOHHS and its constituent agencies.

“Force Majeure Event” is as defined in Section 10.21.

“Maintenance and Support Services” mean technical support services for the operation and maintenance of the Application and as described in Section 3.2 of the RFR and elsewhere herein, to be provided hereunder by Vendor.

“Milestone” means an event or task described in the Project Plan that must be completed by the corresponding Milestone Date set forth therein.

“Milestone Date” means the date by which a particular Milestone must be completed as set forth in the Project Plan.

“Milestone Payment” means a defined payment amount associated with the completion of a particular Deliverable or set of Deliverables.

“Participant Organizations” shall mean those entities set forth in RFR Attachment 5, as amended or updated by EOHHS from time to time by written notice to Vendor.

“Participant Organization Assets” shall mean all property, equipment, and hardware owned by a Participant Organization (other than a Commonwealth Participant Organization) that such Participant Organization provides or provides access to Vendor solely for Vendor’s or its subcontractor’s use in making the Application available to such Participant Organization in relation to this Agreement.

“Party” or “Parties” shall mean one or both of Vendor or EOHHS.

“Permitted Use” means use and/or access of the Application and related Documentation by any Authorized User in connection with the Behavioral Health Treatment and Referral Platform related services and support operations of their respective Participant Organization.

“Project Manager” means a person responsible for leading or coordinating a project from its inception to execution, including planning, execution and managing the people, resources and scope of the project.

“Project Plan” means the schedule, or services of schedules, setting forth the sequence of events for the performance of Services, including the Milestones and Milestone Dates thereunder, as further defined in this Agreement.

“Property” is as defined in Section 10.9.1.

“Request for Responses” or “RFR” shall refer to the 22EHSBHTRPSRFR procurement specification and referenced documents.

“Requirements” shall mean the requirements set forth in the RFR and its attachments, which may be modified and clarified by EOHHS as permitted under the RFR.

“Services” shall mean the activities engaged in by the Vendor for the purpose of fulfilling its obligations under the terms of the Agreement, which may or may not result in the creation of a Deliverable, as further set forth in Section 3.1 of this SOW.

“Task” means a material activity engaged in by Vendor for the purpose of fulfilling its obligations to EOHHS under the terms of the Agreement, which may or may not result in the creation of a Deliverable.

“Term” is as defined in Section 3.2.

“Vendor Property” is as defined in Section 10.9.3.

“Warranty Period is as defined in Section 10.2.8.

3. OVERVIEW, EFFECTIVE DATE AND TERM

3.1 Services

EOHHS has engaged Vendor to implement a Behavioral Health Treatment and Referral Platform (BH TRP) and provide Maintenance and Operations Support Services, and to perform any other work as requested by EOHHS for the project as forth in this SOW.

3.1.1 Implementation Services

Vendor shall provide implementation and support services as set forth in Section 3 of the RFR and Section 12.1 of this SOW.

The services for this project include:

· Provision, customization, and configuration of the Application to implement the functionality required to implement the statewide Behavioral Health Treatment and Referral Platform

· Implementation services at the Participant Organizations (including Commonwealth Participant Organizations) including technical integration, training, and support

· Hosting and Operations of that application on a SaaS basis, including provision of a 24x7 helpdesk to address user questions and to enable emergency user authorization

3.1.2 Application License Grant

Vendor shall provide EOHHS the rights to access the Application as follows:

(a) Application Access Rights. Vendor hereby grants to EOHHS a non-exclusive, royalty-free, irrevocable, transferable and sublicensable license for the Term to access and use the Application and related Vendor Documentation for the Permitted Use in accordance with the terms and conditions of the Agreement. EOHHS, for itself and its Authorized Users, has the right and license to do each of the following for or in connection with the Permitted Use: (i) install, execute, and run an unlimited number of copies of the Application on a cloud network for use by an unlimited number of Authorized Users; (ii) have an unlimited number of Authorized Users access and use the Application by any means whatsoever, including via the internet or any WAN, LAN, or VPN, from any other device; (iii) generate print, copy, download and store all Commonwealth Data, information, and content, including all audio, visual, or digital and other displays and output, as may result from any execution or other use of the Application; (iv) prepare and use a reasonable number of copies of the Application and related Vendor Documentation as may be necessary or useful for the Permitted Use, including for purposes of: (u) operation with other software or systems; (v) hardware or system maintenance or repair; (w) software, hardware, or system testing; (x) disaster recovery; and (y) backup and archiving; and (z) to perform, and have Authorized Users perform, any other act, including the provision of any service, that is reasonably incidental to the operation of the Application for the Permitted Use.

(b) License and Access Restrictions. Except as the Agreement expressly permits, or as reasonably necessary to make any use of the Application permitted by this Section 3.1.2 or elsewhere in the Agreement, EOHHS shall not, and shall not permit others to: (1) modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of the Application except as expressly permitted by the Agreement; (2) rent, lease, lend, sell, distribute, publish, or otherwise make the Application available to any third party; or (3) reverse engineer, disassemble, decompile, decode, or adapt the Application, or otherwise attempt to derive or gain access to the source code of the Application, in whole or in part, except as and only to the extent: (u) this restriction is prohibited by applicable law; (v) such action is taken for purposes of ensuring or assessing interoperability or otherwise qualifies as a “fair use” under US Copyright Act or other applicable Law or; (w) with respect to open source components included in the Application, these acts are permitted under the applicable open source license.

(c) Grant of Use and Access for Authorized Users. Use and Access of the Application for Authorized Users will vary depending upon the specific user needs within Authorized User Groups, their respective Participant Organization and shall be determined solely by EOHHS Contract Manager, from time to time. Authorized Users may include internal EOHHS and EOHHS users (including third party service providers and vendors, as well as other agencies and programs within EOHHS and the Commonwealth), Participant Organizations (as set forth in Attachment 5 of the RFR, as may be amended), third party provider users with read-only access. Vendor is responsible for providing Authorized Users with access in accordance with its obligations as set forth in the applicable Project Plan, including credential requirements and response time, based upon the instruction of EOHHS’s Contract Manager.

3.1.3 Hosting Services

As set forth in Section 3.2 of the RFR, Vendor shall provide EOHHS all services related to hosting and operating the Application, ensuring the Application is up and running, including routine system tasks, such as backups, responsibility for the day-to-day functionality and continuing evolution of the system. These services shall include, but will not be limited to:

Vendor shall also provide design, engineering, and implementation consultation to establish, maintain, and enhance a standard and supportable architecture for communications between the Application and other internal Commonwealth services and applications that will ensure secure communications between the hosted environment and the network.

Specific Service Level Commitments shall be as set forth in Exhibit E, which shall incorporate the terms proposed by Vendor in its response to the RFR in accordance with RFR Section 3.2, and as negotiated by Parties prior to execution of this Agreement.

3.1.4 Maintenance and Support Services

Vendor shall provide EOHHS with Maintenance and Operations Support Services as further set forth in Section 3.2 of the RFR and (ii) as proposed by Vendor in its response to that RFR Section, which shall be incorporated by reference into the SOW; and as may be negotiated by Parties in writing prior execution of this Agreement. Specific Service Level Commitments and Key Performance Indicators shall be as set forth in Exhibit E, which shall incorporate the terms proposed by Vendor in its response to the RFR in accordance with RFR Section 3.2, and as negotiated by Parties prior to execution of this Agreement.

3.1.5 Services Documentation Obligations

Vendor shall be obligated to provide EOHHS with all Documentation relating to the Services within thirty (30) Business Days of acceptance of the Application or the applicable Deliverable by EOHHS, unless otherwise agreed upon by the Parties in the applicable Project Plan relative to the specific Deliverable. In the event the Documentation is not provided to EOHHS, EOHHS has the right to withhold payment of the applicable costs until receipt of such Documentation. All Documentation shall include all such information as may be reasonably necessary for the effective installation, testing, use, support, and maintenance of the Application, including the effective configuration, integration, and systems administration of the Application and performance of all other functions set forth in the Agreement.

3.2 Term

Vendor has held itself out to EOHHS as qualified to provide such services under this SOW. The SOW will have an initial term of two (2) years, and may be extended for an additional eight (8) years, in any time increments, at the discretion of EOHHS (collectively, the “Term”).

3.3 Survival

Notwithstanding the foregoing, the provisions of this Agreement which by their nature would continue beyond any termination or expiration of this Agreement, which shall include Section 5 on System Security, Section 10.2 on Warranty and Section 10.3 on Title and Intellectual Property Rights, shall survive the expiration or any termination of this SOW to the extent necessary to permit their complete fulfillment or discharge.

4. POINTS OF CONTACT

4.1 Single Point of Contact

Vendor and EOHHS will each assign a single point of contact with respect to this SOW. It is anticipated that the contact person will not change during the Term of this Agreement. In the event that a change is necessary, as a result of an emergent or unanticipated event, the Party requesting the change will provide prompt written notice to the other. In the event a change occurs because of a non-emergency, two-week written notice is required.

Vendor’s contact person is _______________________.

EOHHS’s contact is_______________________.

5. APPLICATION/SYSTEM SECURITY

As part of its work efforts under this SOW, Vendor may be required to use, or may be provided with or given access to Commonwealth Data and/or IT resources, in which case Vendor shall comply with Commonwealth system standards and all terms and conditions of this SOW during any such use or access. For purposes herein, “Commonwealth Data” shall mean data provided by EOHHS to Vendor, which may physically reside at a Commonwealth or EOHHS or Vendor location, and includes, but is not limited to, data and information relating to EOHHS, EOHHS Authorized Users, and other Commonwealth Participant Organizations.

5.1 Commonwealth Data

In connection with Commonwealth Data, Vendor will implement commercially reasonable safeguards necessary to:

5.1.1 Prevent unauthorized access to Commonwealth Data from any public or private network;

5.1.2 Prevent unauthorized physical access to any information technology resources involved in the development effort; and

5.1.3 Prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

5.2 Commonwealth Personal Data

In addition to the above requirements for Commonwealth Data, Vendor may be required to use Commonwealth personal data under MGL Ch. 66A and/or personal information under MGL Ch. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified tasks, and such personal data shall be considered as “Commonwealth Data” as defined herein. For purposes of this work effort, electronic personal data and personal information includes data provided by EOHHS to Vendor which may physically reside at a location owned and/or controlled by the Commonwealth or EOHHS or Vendor. In connection with electronic personal data and personal information, Vendor shall implement the maximum feasible safeguards reasonably needed to:

5.2.1 Ensure the security, confidentiality and integrity of electronic personal data and personal information;

5.2.2 Prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network; and

5.2.3 Notify EOHHS immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

5.3 Software Integrity Controls

Address the following controls if applicable, usually in the case wherein the Vendor will be developing code and migrating that code to a production environment.

Vendor and EOHHS recognize the serious threat of fraud, misuse, and destruction or theft of data or funding. These threats could be introduced when unauthorized or inappropriate modifications are made to a production system. Vendor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software creation life cycle, including during development, testing, and production:

5.3.1 Vendor shall configure the RFR required software and systems environments.

5.3.2 Vendor shall implement a change management procedure to ensure that activities in the non-production environments remain separate and distinct from the production environment. In particular, the change management procedure shall incorporate at least the following:

5.3.2.1 Segregates duties between development and testing of software changes and migration of changes to the production environment.

5.3.2.2 Implements security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment.

5.3.2.3 Includes a process to log and review all source control activities.

5.3.3 Vendor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment.

5.3.4 Vendor shall not make any development or code changes in a production environment.

5.3.5 Vendor shall implement additional internal controls as specified by EOHHS.

5.4 Data Management and Confidentiality Agreement

Vendor agrees that it is bound by the terms and conditions of the EOHHS Data Management and Confidentiality Agreement (DMCA) attached hereto as Exhibit B.

6. ACCEPTANCE OR REJECTION PROCESS

Vendor will submit the required Deliverables specified in the Agreement, including Deliverables or Tasks required by any Change Order or other amendment entered into hereunder, to the EOHHS Project Manager for approval and acceptance. EOHHS will review work product for each of the Deliverables and evaluate whether each Deliverable has clearly met in all material respects the criteria established in the Agreement and the relevant Change Order specifications. Once reviewed and favorably evaluated in accordance with the Metrics for Acceptance (set forth in Table 12.1), the Deliverables will be deemed acceptable.

Within fifteen (15) working days of receipt of each Deliverable, the EOHHS Project Manager will notify Vendor, in writing, of the acceptance or rejection of said Deliverable using the Metrics for Acceptance (set forth in Table 12.1) and associated with the Task or Deliverable specifications in this Agreement. A form signed by EOHHS shall indicate acceptance. Vendor shall acknowledge receipt of acceptance forms in writing. Any rejection will include a written description of the defects of the Deliverable. If EOHHS does not respond to the submission of the Deliverable, within five (5) Business Days of EOHHS’s receipt of each Deliverable, Vendor shall provide a reminder notice to the EOHHS Project Manager. If EOHHS fails to reject a Deliverable within five (5) Business Days after EOHHS's receipt of the reminder notice, the Task or Deliverable is deemed accepted.

If EOHHS rejects a Deliverable, Vendor will, upon receipt of such rejection, act diligently to correct the specified defects and deliver an updated version of the Deliverable to EOHHS at no cost to EOHHS. EOHHS will then have an additional 5 (five) Business Days from receipt of the updated Deliverable to notify Vendor, in writing, of the acceptance or rejection of the updated Deliverable. Any such rejections will include a description of the way in which the updated Deliverable fails to correct the previously reported deficiency.

Following any acceptance of a Deliverable which requires additional work to be entirely compliant with the pertinent specifications, Vendor will provide a prompt correction or workaround; the timing of any workaround or partially compliant correction will be in compliance with the Project Plan.

7. PROJECT MANAGEMENT - Project Managers Vendor and EOHHS shall each designate a Project Manager. Vendor and EOHHS must notify the other Party’s Project Manager of any change in the name, address, phone number, fax number, or email address of their respective Project Manager. The Parties shall use their best efforts to maintain the same Project Manager throughout the duration of the Agreement. However, if a Party needs to replace its Project Manager, the Party shall provide the other written notice thereof at least forty-five (45) Calendar Days prior to the date the Project Manager shall be replaced; however, a Party has the right to appoint a temporary Project Manager in connection with short term unavailability, sick leave or reasonable vacations, upon as much advance notice to the other as reasonably practicable. EOHHS may require Vendor to replace its Project Manager, by giving Vendor notification thereof and EOHHS’s objective reasons therefor.

7.1 EOHHS Project Manager

EOHHS’S designated Project Manager shall perform project management on behalf of EOHHS for this engagement. EOHHS's Project Manager will:

7.1.1 Work closely with Vendor Project Manager to ensure successful completion of the project.

7.1.2 Consult with Vendor Project Manager to develop the project schedule.

7.1.3 Review weekly status reports and schedule weekly meetings with Vendor, as necessary.

7.1.4 Coordinate participation from other agencies and/or vendors as required during the engagement.

7.1.5 Acquire EOHHS project team members as needed.

7.1.6 Coordinate EOHHS's review of the Deliverables and sign an acceptance form to signify acceptance for each accepted Deliverable.

7.2 Vendor Project Manager

Vendor's designated Project Manager shall perform project management on behalf of Vendor for this engagement. Vendor's Project Manager will:

7.2.1 Be responsible for administering this Agreement and the managing of the day-to-day operations under this Agreement.

7.2.2 Serve as an interface between the EOHHS Project Manager and all Vendor personnel participating in this engagement.

7.2.3 Develop and maintain the Project Plan, in consultation with the EOHHS Project Manager.

7.2.4 Facilitate regular communication with the EOHHS Project Manager, including weekly status reports/updates, and review the project performance against the Project Plan. Facilitate weekly project status meetings for the duration of the engagement.

7.2.5 Update the project plan on a weekly basis and distribute at weekly meetings for the duration of the engagement.

7.2.6 Sign acceptance forms to acknowledge their receipt from EOHHS.

7.2.7 Be responsible for the management and deployment of Vendor personnel.

Vendor’s Project Manager reports to _____________________

7.3 Vendor Solution Architect Responsibilities

7.3.1 Vendor shall use best efforts to work with EOHHS Enterprise Architecture Team to ensure that the proposed solution architecture and design are in line with EHS Architecture Guidelines in the Secretariat Application Reference Manual Version 3.5.

7.4 Issue Resolution

The Project Managers (Vendor and EOHHS) bear the primary responsibility for ensuring issue resolution. If they mutually agree that they are unable to resolve an issue, they are responsible for escalating the issue to the appropriate representative of senior management for each Party. The names and contact information for such representatives shall be submitted to the Project Managers prior to the commencement of work hereunder.

7.5 Corrective Action Plan

At any point during this Agreement, if EOHHS identifies, in its sole judgment, any deficiency in the Vendor’s performance under this Agreement, EOHHS may require the Vendor to develop a corrective action plan to correct such deficiency. The Vendor must submit any such corrective action plan to EOHHS and must, within three Calendar days of the request, implement such corrective action plan only as approved or modified by EOHHS.

8. AMENDMENTS AND CHANGE ORDERS

This Agreement may be amended prior to the end of the Term and Vendor and EOHHS may agree, from time to time during the Term, to execute amendments to the scope of work or Change Orders, which, when signed by the authorized representatives of each of the Parties, will be deemed incorporated herein by reference. Either Party may elect to submit Change Requests, including Change Requests resulting from changes in law, to the other Party to propose Changes, including, without limitation, changes to the scope, Services, or schedule. Vendor will make a good faith effort to accommodate Change Requests that are the result of any change in applicable laws, rules or regulations or changes needed to implement a legislative action, a legislative request, executive order, or judicial decision that requires a change to the Application.

A. Change Requests shall be submitted in writing to the other Party in a form to be agreed upon by the Parties which shall contain a sufficient level of detail to permit the other Party to properly evaluate the Change Request. The Parties will mutually decide whether the Change Request is sufficient to document the Change Order, or if an Amendment to the Agreement is necessary. If the Parties determine it is necessary, they will amend the Agreement.

B. Change Requests may only be submitted by State Organizations’ ESS Program Manager and/or Vendor’s Project Manager.

C. The Project Managers will jointly determine whether the change impacts any terms contained within the Agreement.

D. Neither Party will be entitled to or obligated by a Change Request or Amendment until it has been presented and approved by both Parties in accordance with the above-mentioned procedures. Work performed by either Party to prepare, analyze and respond to a Change Request shall not be chargeable to the other Party hereunder.

E. Where one Party has submitted a Change Request and mutual agreement cannot be reached between the Parties with respect to the change within fifteen (15) Business Days of the Party’s receipt of the Change Request Form, Vendor shall continue to provide the Services as stated in this Agreement, and the Party may submit such matter for issue resolution in accordance with this SOW

Vendor acknowledges that this Agreement does not constitute a retainer and that EOHHS is not required to enter into any amendments or Change Orders with Vendor subsequent to the initial work described in this SOW.

For any amendment entered into under this Agreement where Vendor will be providing services on a Time and Materials basis, the Parties shall apply the Time and Materials terms as described in Section 11.3.2 of this SOW to the relevant Change Order or amendment.

9. PERSONNEL

9.1 Key Personnel

Vendor agrees to provide the following personnel for the following amounts of time for the duration of the Services:

Table 1: Key Personnel

Project Manager

Solution Architect

Vendor shall assign all of the foregoing personnel to this engagement on the time basis set forth in Table 6 and such personnel shall remain engaged in the project on with the Time Commitment set forth in Table 1 unless otherwise agreed to in writing by EOHHS or unless no longer employed by Vendor. In the event that a change is necessary, Vendor Project Manager will provide prompt written notice to EOHHS Project Manager of the proposed change. If the personnel change is a result of a non-emergency, the Vendor Project Manager shall provide EOHHS Project Manager two-week written notice. For personnel changes that result from an emergency, Vendor Project Manager shall provide prompt written notice to EOHHS Project Manager. EOHHS Project Manager has the right to accept or reject all personnel. Vendor's personnel must comply with the Executive Office of Technology Services and Security Enterprise Information Security Policies and Standards (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards) and EOHHS’s workplace policies, which may be located at EOHHS locations. If any personnel cease to provide the Services in accordance with the terms of the Agreement for any reason Vendor shall promptly replace such member(s) with personnel having similar qualifications and experience and ensure that any such replacements are immediately trained and brought up to date on Services being provided. This replacement will occur at no charge to EOHHS. Vendor acknowledges and agrees that, in the course of providing the Services, Vendor personnel may have access to, or acquire, knowledge of confidential, proprietary or sensitive information regarding EOHHS, its providers, their clients, or other parties with whom EOHHS or its providers have a relationship. Vendor will advise its personnel of the standards imposed upon them with respect to the Services they render pursuant to the terms of the Agreement and shall remain responsible for any breach of confidentiality, security or privacy by any of its personnel.

9.2 Equipment, Work Space, Office Supplies

Vendor will submit a list of employees who will need access to the building and to state systems before execution of this SOW. Any Vendor employees who have access to IT resources must comply with the Acceptable Use Policy of Information Technology Policy (https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy)) or any alternative Acceptable Use Policy adopted by EOHHS. The Parties agree that on-site work will be limited or may not be possible given COVID-19 guidelines. On-site support by Vendor may be requested by the EOHHS at such time as the Parties jointly agree in good faith that it is safe to do so and in compliance with any law, rule or policy related to COVID-19 imposed by either Party hereto or any governmental entity.

9.3 EOHHS Assets and Participant Organization Assets

Title in and to EOHHS Assets shall remain with EOHHS but EOHHS Assets may be used by Vendor and subcontractors for the sole purpose of performing the Services. EOHHS reserves the right to recall EOHHS Assets at any time, in which case any obligations of Vendor that cannot be performed as a result of such EOHHS Assets recall shall be suspended. Vendor shall not make any changes to any EOHHS Assets without receiving express written permission from EOHHS. Vendor hereby assumes risk and liability for loss of any EOHHS Assets while in the possession of Vendor, unless such loss is caused by EOHHS or EOHHS personnel or a Force Majeure Event, as well as for any changes made to EOHHS Assets by anyone other than EOHHS without prior approval by EOHHS. It is the responsibility of Vendor to inform EOHHS when wear of EOHHS Assets has progressed beyond normal. Upon termination of this Agreement for any reason or at any time upon prior written notice from EOHHS, and regardless of whether Vendor has any claim against EOHHS under this Agreement, all EOHHS Assets in Vendor’s possession or control shall be returned to EOHHS. Except for property to which title is transferred to Vendor as evidenced by a bill of sale or comparable written instrument, no interest or obligation is conferred upon Vendor regarding EOHHS Assets beyond the limited right to use such EOHHS Assets in accordance with the terms of this Agreement.

With respect to Participant Organization Assets, Vendor shall implement and comply with written arrangements with the respective Participant Organizations to govern the use of Participant Organization Assets by Vendor, consistent with the terms above and herein. For the avoidance of doubt, EOHHS shall not be a party to such agreements.

9.4 Related Project Knowledge

In addition to the “Statewide Contract IT Specifications,” Vendor shall, prior to commencing any other work under this SOW, become familiar with the following state statute and regulations related to quality and patient safety: M.G.L. c. 112, § 5; M.G.L. c. 111, § 302(d); and 243 CMR 3.00-3.14.

9.5 Intellectual Property and Work Effort Agreement for Vendor's Employees, Contractors and Consultants and Agents Vendor agrees and shall ensure that is personnel and subcontractor personnel agree to the following terms.

Vendor shall not use for its own benefit, or divulge or disclose to anyone, except to (i) persons within the Commonwealth whose positions require them to know it and (ii) persons designated by Agency who have a need to know, any information not already lawfully available to the public concerning the Commonwealth (“Confidential Information”), including but not limited to information regarding any project of the Commonwealth, any e-commerce products or services, any web development strategy, any financial information or any information regarding users of or vendors to the Commonwealth. Confidential Information also includes, without limitation, any technical data, design, pattern, formula, computer program, source code, object code, algorithm, subroutine, manual, product specification, or plan for a new, revised or existing product or web site; any business, marketing, financial or sales information; and the present or future plans of the Commonwealth.

As of the termination of the Agreement with the Commonwealth, Vendor agrees to return to the Commonwealth all Commonwealth Property, Commonwealth Information and materials, documents and property, in Vendor’s possession or control, including without limitation, all materials relating to work done while assigned to Commonwealth projects. Vendor shall return to the Commonwealth all materials concerning past, present and future or potential products and/or services of the Commonwealth. Vendor shall return to the Commonwealth all materials provided by persons doing business with the Commonwealth and all teaching materials provided by the Commonwealth.

Vendor represents and warrants that it is not a party to any agreement or arrangement which would constitute a conflict of interest with the obligations undertaken under the SOW or would prevent Vendor from carrying out its obligations hereunder.

Vendor represents and warrants that it has paid all due state and federal taxes, or, if its tax status is in dispute or in the process of settlement, that it has responded as directed and within the required timeframes to all communications received from the state or federal government.

Vendor acknowledges that it is not an employee of any Massachusetts state or municipal government agency, and is not entitled to any benefits, guarantees or other rights granted to state or municipal government agencies, including but not limited to group insurance, disability insurance, paid vacations, sick leave or other leave, retirements plans, health plans, or premium overtime pay. Should Vendor be deemed to be entitled to receive any such benefits by operation of law or otherwise, Vendor expressly waives any claim or entitlement to receiving such benefits from Massachusetts state or municipal government agencies.

10. ADDITIONAL TERMS

10.1 Code Review

All Deliverables that include software code or applications shall follow current industry design and best practices, including, but not limited to those published by The National Institute of Standards & Technology (NIST), the SANS (SysAdmin, Audit, Network, Security (SANS) Institute), and other recognized bodies.

As applicable, Vendor shall cooperate with code review of the relevant software or application Deliverables. Prior to implementation or acceptance of a Deliverable, Vendor shall subject Deliverables that include software code or script to independent application review by EOHHS or its delegated reviewer to validate that all applicable EOTSS Enterprise Information Security Policies and Standards, and EOHHS IT standards and security policies have been met, as well as other specifications as identified in this Agreement or the relevant Change Order or other amendment. The review shall be performed by individuals other than Vendor or EOHHS's staff who developed the Deliverables. For purposes of this requirement, “independent” may include other staff of the EOHHS provided no direct reporting relationships exist between the development and review organizations.

10.2 Warranty

In connection with this performance of the Services under this Agreement, Vendor represents and warrants to EOHHS that:

10.2.1 Vendor and its subcontractors are sufficiently staffed and equipped to fulfill Vendor’s obligations under this Agreement;

10.2.2 Vendor’s Services will be performed:

10.2.2.1 By appropriately qualified and trained personnel;

10.2.2.2. With due care and diligence and to a high standard of quality as is customary in the industry;

10.2.2.3 In compliance with the project schedule and the terms and conditions of this Agreement; and

10.2.2.4 In accordance with all applicable professional standards for the field of expertise;

10.2.3 Deliverables delivered under this Agreement will substantially conform with the Tasks and Deliverable descriptions set forth in this Agreement;

10.2.4 Vendor has obtained all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties supplied or specified by Vendor for incorporation in the Deliverables to be developed;

10.2.5 Documentation provided by Vendor under this Agreement shall be in sufficient detail so as to allow suitably skilled, trained, and educated EOHHS personnel to understand the operation of the Deliverables. Vendor shall promptly, at no additional cost to EOHHS make corrections to any documentation that does not conform to this warranty;

10.2.6 Any software or systems provided, created or modified by Vendor under this SOW shall operate in substantial conformance with the specifications for the software and/or systems provided, created or modified for a minimum of six (6) months (the “Warranty Period”) after EOHHS accepts such software and/or systems created or modified pursuant to Section 6 of this SOW. During the Warranty Period, Vendor shall correct any defects at no charge to EOHHS;

10.2.7 The Deliverables and Services will conform to the specifications stated in the Agreement as well as the applicable Project Plan and will be suitable for their intended purpose;

10.2.8 Neither the Application, Deliverables nor any update or revision thereof will include any virus, Trojan horses, back doors, and other malicious code or mechanism that is designed to delete, disable, interfere with or otherwise harm the Deliverables (or EOHHS’s hardware, data or other programs), make it inaccessible to EOHHS once the Application, Deliverable or such update or revision thereof has been installed, or that is intended to provide access to or produce modifications not authorized by EOHHS;

10.2.9 All updates and improvements to the Application and Services will comply in all material respects with the requirements and representations specified in the Project Plan and the Documentation (including performance, capabilities, accuracy, completeness, characteristics, specifications, configurations, standards, functions and requirements);

10.2.10 It is the lawful owner or license holder of all Vendor materials (including but not limited to those non-EOHHS-owned portions of the Application, the Vendor Property and any Vendor Confidential Information) and used by it in the performance of the Services contemplated hereunder and has the right to permit EOHHS access to or use of the Services and each component thereof; and

10.2.11 To the extent that Vendor has used open source software in connection with any Services, Vendor represents and warrants that it is in compliance with any applicable open source software license(s) and the use rights of EOHHS, as set forth herein, are not is not infringing and further any open source software license does not subvert any of EOHHS’s rights, including but not limited to EOHHS’s use and access and ownership rights, as set forth in this Agreement.

10.3 Cooperation with Other Parties

Vendor represents, warrants and undertakes that it will use commercially reasonable efforts to cooperate with any third party providers or users, whether selected by Vendor or EOHHS and including but not limited to those third party providers that may be required of EOHHS in connection with its funding for the Services, as may be required in connection with its provision or support of the Services under this Agreement.

10.4 Additional Notification and Remedial Requirements

Any of the following events may, in EOHHS’s sole judgment, constitute a substantial breach by Vendor, if due to any action or inaction on the part of Vendor or its subcontractor(s): (a) failure to complete to the satisfaction of EOHHS the required Milestones for each phase of the Services (design, development, implementation, and optional operations) within the completion times specified; or (b) inability to continue Application operations without repeated or lengthy interruptions to normal business operations; or (c) failure of Vendor to continue to conduct business in the normal course, or the making of a general assignment for the benefit of creditors, or the appointment of a receiver for all or substantially all of its business assets, or the filing of a voluntary or involuntary petition in bankruptcy; provided that in the event of an involuntary petition, Vendor shall not have been able to obtain a dismissal of the petition within thirty (30) Calendar Days after the date of filing. Vendor agrees to provide advance notice of the potential initiation of any one of the above actions through a written special status reports within three (3) Calendar Days upon written request by EOHHS in response to particular problems identified by EOHHS in the performance of work performed under the Agreement. Each report, signed by Vendor’s Project Manager, shall include a description of the problem, the reason(s) the problem occurred, corrective action plan(s) proposed to prevent the problem(s) from recurring and an implementation date for the corrective action plan(s). This is to occur no later than three (3) Calendar Days from the date of its discovery of any problem that may jeopardize the successful or timely completion of its obligations, notify EOHHS in writing of the problems, including in such notice Vendor’s recommendation for expeditious resolution of the problem.

10.5 Disclaimer

EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS CONTRACT, EACH PARTY HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, WITH RESPECT TO THIS AGREEMENT.

10.6 Data and Intellectual Property

Notwithstanding Section 11 of the Commonwealth Terms and Conditions, Vendor shall indemnify, defend and hold harmless, EOHHS and its officers, directors, employees and agents against any and all losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees, arising out of or related to any third party claim (a) alleging any failure by Vendor or its personnel to comply with any applicable laws, rules or regulations in the performance of its obligations under this Agreement, including any applicable data protection and privacy laws, or any breach of Vendor's confidentiality and security or (b) to the extent that it is based on an assertion that the Application, Deliverables or the Services constitute infringement, misappropriation or other violation of any intellectual property rights, and shall indemnify and hold EOHHS harmless from and against all costs, damages and expenses, including reasonable attorney's fees, asserted against EOHHS or any of its officers, directors, employees and agents which result from any such claim. Without limiting the generality of the foregoing, should the Application, Deliverables or Services or any part thereof become, or in Vendor's opinion be likely to become, the subject of a claim of infringement, misappropriation or other violation under applicable intellectual property laws, Vendor shall either procure for EOHHS the right to continue using the Application, Deliverables or Services, or to replace or modify the Deliverables or Services, without changing their functional capabilities, so that the Application, Deliverables or Services becomes non-infringing. If Vendor is unable to do either of the foregoing within thirty (30) Business Days, upon request, Vendor shall refund the entire costs paid to Vendor by EOHHS prorated to reflect use of the Application, Deliverable or Services by EOHHS prior to commencement of the claim or proceeding described herein. The indemnity obligations in subsection (b) shall not apply to the extent that any infringement, misappropriation or other violation directly arises out of or directly relates to: (i) any use of the Application, Deliverables or Services for other than the intended purposes, or (ii) any action or inaction in violation of the terms of this Agreement by EOHHS.

10.7 Indemnification Procedures

Notwithstanding Section 11 of the Commonwealth Terms and Conditions, the indemnified party will promptly notify the indemnifying party in writing of any matter in respect of which indemnity is being sought under the Agreement, provided that any delay to so notify the indemnifying party will not relive the indemnifying party for any liability under the Agreement, except to the extent that they are materially prejudiced thereby. The indemnifying party shall, at its own expenses, be entitled, exclusively, to control and direct the investigation, defense and settlement of any claim, provided that: (i) the indemnified party shall provide reasonable assistance to the indemnifying party; (ii) the indemnifying party shall keep the indemnified party reasonably apprised as to the selection of counsel and the status of the matter, including settlement; (iii) the indemnified party may retain separate counsel at its own expense unless the indemnifying party specifically authorizes the retaining of such counsel or the indemnified party determines in good faith that the retention of such counsel if required as a result of a conflict of interest; (iv) the indemnifying party may settle a claim without the consent of the indemnified party, provided that the settlement (a) involves only the payment of money, (b) fully and unconditionally releases the indemnified party for any liability in exchange for the amount paid in settlement and (c) does not include any admission of fault of liability in relating to the indemnified party.