CTR026863_STS026863_Contract_V1__032825_.pdf

STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

GENERAL SERVICES DIVISION

OFFICE OF PROCUREMENT SERVICES

4200 SURFACE ROAD, COLUMBUS, OH 43228-1395

OPTIONAL USE CONTRACT FOR: IT HARDWARE, SOFTWARE AND SERVICES

CONTRACT No.: STS026863

CONTRACT ID: CTR026863

EFFECTIVE DATES: 04/01/2025 to 06/30/2034 SUPPLIER: Concordance Healthcare Solutions LLC

STS SUB-TYPE: S&LG

This Contract is effective beginning and ending on the dates noted above unless, prior to the expiration date, the Contract is renewed, terminated or cancelled in accordance with the Contract Terms and Conditions.

This Contract is available to ALL STATE AGENCIES, STATE INSTITUTIONS OF HIGHER EDUCATION AND PROPERLY REGISTERED COOPERATIVE PURCHASING MEMBERS, as applicable.

MANDATORY USE CONTRACTS: All Contracts with Contract Type "Competitive Selection" or "Competitive Selection - Two Phase" take precedence over this Contract. This Contract is only for governmental entities without a mandatory use contract.

EXCLUDED ITEMS: (State Agencies Only) in accordance with the Ohio Revised Code Section 125.035 State Agencies are required to purchase through Ohio Penal Industries (OPI); Community Rehabilitation Programs (CRP); Department of Mental Health and Addiction Services and Pharmacy Services (MHAS);

Opportunities for Ohioans with Disabilities (OOD); Department of Administrative Services State Printing (Printing); Department of Administrative Services Office of Information Technology (OIT), Ohio Facility Construction Commission (OFCC). If any items on this Contract can be provided by a requisite program, State Agencies must obtain a waiver from OPI, CRP, DMHAS Pharmacy Services, OOD, State Printing, OIT and/or OFCC to procure from this Contract.

CONTRACT UTILIZATION: The State of Ohio including but not limited to its agencies, boards, commissions, departments, state universities, state vocational schools, state community colleges of Ohio, and any entity authorized by law to use this Contract is not obligated to procure any products or services from this Contract. This Contract shall not be construed to prevent the State from purchasing products or services using other procurement methods as authorized by law.

This Contract and any Amendments thereto are available from the OhioBuys public portal at the following address:

https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

IN WITNESS WHEREOF, the parties have executed this Contract as of the dates below.

For CONCORDANCE HEALTHCARE SOLUTIONS LLC:

Signed: _____________________________________________________________________ Sean Spraley, Chief Financial Officer

For the OHIO DEPARTMENT OF ADMINISTRATIVE SERVICES:

Signed: _____________________________________________________________________ Kathleen C. Madden, Director

1 - STS NEW OFFER INSTRUCTIONS

Download the instructions and forms needed to initiate an offer to establish an STS contract.

2 - STANDARD TERMS AND CONDITIONS

State of Ohio Standard Terms and Conditions (revised 3/01/24) will apply to this Contract.

3 - STS PROCUREMENT TERMS AND CONDITIONS

3.1 ENTIRE AGREEMENT

This Contract, which includes the Contractor’s catalog and all documents referred to and incorporated into this Contract, is the entire agreement between the parties with respect to its subject matter, and it supersedes any previous statements or agreements, whether oral or written.

3.2 CONTRACT COMPONENTS AND ORDER OF PRIORITY

The components of this Contract are listed in the following order of priority:

a. Contract Specific Terms and Conditions in Article 4;

b. STS Procurement Terms and Conditions in Article 3; then

c. Standard Terms and Conditions in Article 2.

3.3 CERTIFICATION OF ACCURACY

The Contractor certifies that the Contractor's prices under this Contract are one of the following:

a. The prices at which the Contractor currently offers each product and service to the US Government under a federal schedule;

b. The best prices at which the Contractor has offered each product and service to its similarly situated, most favored customers within one year before the date the Contractor executed this Contract or adds the product or service to this Contract, whichever is later.

If the Contractor is offering price catalog(s) for specific items based on its most favored customer prices, the Contractor represents that it does not have a federal contract.

The Contractor further certifies that the above representations will apply and be true with respect to all future pricing information submitted to revise this Contract.

3.4 CONTROLLING BOARD AUTHORIZATION

The State's obligations under this Contract are subject to the Ohio Controlling Board continuing to authorize the State’s use of its term contracts program. If the Ohio Controlling Board fails to authorize or withdraws its authorization for this program, this Contract will terminate immediately, and the Contractor may not take any more orders under it.

3.5 PRICELIST

The Contractor's pricelist for the products and services that the Contractor may provide to the State under this Contract is in the catalog. For convenience, those products and services are called "Deliverables" in this Contract. Any custom materials resulting from the Contractor’s services also are called “Deliverables” in this https://procure.ohio.gov/zip/STS%20New%20Offer%20Packet%20OB.zip https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/TCond/Standard_T_C%203-1-24.pdf

Contract. The Contractor may not provide any other Deliverables under this Contract without a prior written amendment to this Contract that both the State and the Contractor have signed. Furthermore, the Contractor may not charge the State greater prices for these Deliverables than the prices in the catalog. If the catalog contains or incorporates by reference any terms or conditions other than a description of the scope of license for software, a description of the Contractor’s products and services, and the prices for those products and services, those terms or conditions are excluded from this Contract and are of no effect. Contractor’s catalog is incorporated into the Contract as if fully rewritten herein and the most recent catalog can be found in OhioBuys.

For contracts leveraging a punchout catalog, Contractor is required to provide a catalog in the Supplier- Managed Catalog Template format for all items. This Supplier-Managed Catalog will be attached to the contract record and is incorporated into the Contract. In the event of a discrepancy the Supplier-Managed Catalog will prevail. Contractor must not modify the available items or pricing presented in their punchout catalog until an amendment is requested, fully executed, and effective.

Except in the case of operating systems licensed in conjunction with desktop PCs, notebook computers and similar personal computing devices that the OEM does not distribute without an operating system, the Contractor will not sell or license any Microsoft software to the State. If any of the foregoing items are listed in the Contractor’s catalog, they are deleted for purposes of this Contract.

3.6 PRICE ADJUSTMENTS (GSA BASED)

If the Contractor has relied on its Federal Contract pricing, the State will be entitled to any price decreases that the Contractor offers to the GSA for any of its products and services during the term of this Contract. The Contractor must notify the State of any reduction in its Federal Contract pricing within 30 days of its occurrence and immediately reduce the price of the affected products or services to the State under this Contract. Price increase requests for a Contract based on a federal schedule must be accompanied by documentation signifying approval of the price increase by the federal government.

3.7 PRICE ADJUSTMENTS (S&LG BASED)

If the Contractor has relied on its similarly situated, most favored customer pricing, the contract prices(s) will remain firm unless the Contractor submits a request to adjust their price(s). Price increases shall be effective 30 calendar days after acceptance by DAS. No price adjustment will be permitted prior to the effective date of the increase received by the Contractor from its suppliers, or on purchase orders that are already being processed, or on purchase orders that have been filled and are awaiting shipment. If the Contractor receives orders requiring quarterly delivery, the increase will apply to all deliveries made after the effective date of the price increase.

The price increase must be supported by a general price increase in the cost, due to increases in the cost of raw materials, labor, freight, Workers' Compensation and/or Unemployment Insurance, etc. Detailed documentation, to include a comparison list of the contract items and proposed price increases, must be submitted to support the requested increase. Supportive documentation should include, but is not limited to, copies of the old and the current price lists or similar documents which indicate the original base cost of the product to the Contractor and the corresponding increase, and/or copies of correspondence sent by the Contractor's supplier on the supplier's letterhead, which contain the above price information and explains the source of the increase in such areas as raw materials, freight, fuel or labor, etc. Any price increases shall not exceed prices offered to similarly-situated, most favored customers.

The State will be entitled to a price decrease any time the Contractor or any of its distributors under this Contract sells a product or a service to any of its similarly situated customers for less than the price agreed to between the State and the Contractor under this Contract. Any time the Contractor or any of its distributors of this Contract sells a product or provides a service to any similarly situated customer for less than it is then available to the State under this Contract, the Contractor must notify the State of that event within 30 days of its occurrence and immediately reduce the price of the affected products or services to the State under this Contract.

The Contractor also must notify the State within 30 days of any general reduction in the price of any product or service covered by this Contract, even if the general reduction does not place the price of the product or service below the price available to the State under this Contract. The purpose of this notice of a general reduction in price is to allow the State to assess the value the State believes it is receiving under this Contract in light of the general reduction due to a general decline in the market or some other factor. If the State believes it is appropriate, the State may ask to renegotiate the Contract price for the products and services affected by the general reduction in price. If the Contractor and the State cannot agree on a renegotiated price, then on written notice to the Contractor, the State may immediately require the Contractor to remove the affected products and services from this Contract.

3.8 DEALERS AND DISTRIBUTORS

The State authorizes the Contractor to name one or more dealers to work with the State on behalf of the Contractor. If the Contractor decides to use any dealers, the Contractor must submit the name, principal business address, addresses for purchase orders and for payments, telephone number, and its federal tax identification number. The Contractor also must submit a completed W9 form for each dealer it wishes to name under this section. The Contractor's submission must be on its official letterhead, signed by an authorized representative, and addressed to Department of Administrative Services, Office of Procurement Services. In doing so, the Contractor warrants that:

a. The Contractor has provided the dealer with a copy of this Contract, and an authorized representative of the dealer has agreed, in writing, to be bound by the terms and conditions in this Contract.

b. The dealer’s agreement as noted in subparagraph (a) above is for the benefit of the State as well as the Contractor.

c. The Contractor will remain liable under this Contract for the services of any dealer and will remedy any breach of the dealer under this Contract.

d. Payments under this Contract for the services of any dealer may be made directly to that dealer, and the Contractor will look solely to the dealer for any payments due to the Contractor once the State has paid the dealer.

e. To the extent that there is any liability to the State arising from doing business with a dealer that has not signed the agreement required under this section with the Contractor, the Contractor will indemnify the State for such liability.

If the Contractor wants to designate a dealer that will not receive payments (a "distributor"), the Contractor may do so by identifying the person or organization as a distributor in the authorizing letter. In such cases, information regarding taxpayer identification and payment addressing may be omitted, as may the distributor's W9 form. All other requirements and obligations for designating a dealer apply to designating a distributor.

3.9 COMMERCIAL MATERIAL

As used in this section, "Commercial Material" means anything that the Contractor or a third party has developed at private expense and that is commercially available in the marketplace, subject to intellectual property rights, and readily copied through duplication on magnetic media, paper, or other media. Examples include the written reports, books, pictures, videos, movies, computer programs, computer source code, and documentation.

Any Commercial Material that the Contractor intends to deliver as a Deliverable must have the scope of the license granted in such material disclosed in the catalog or an exhibit to this Contract, including the BD Standard Agreement set forth in Exhibit B, associated with this Contract, if that scope of license is different than the scope of license contained in this section for Commercial Materials.

The State acknowledges that Contractor shall license, and does not sell, Commercial Material, and that there are no custom products or work-for hire under the Contract. Except for Commercial Material that is software ("Commercial Software"), if the Commercial Material is copyrighted and published material, then the State will have the rights permitted under the federal copyright laws as a licensee for each copy of the Commercial Material delivered to it by the Contractor.

Except for Commercial Software, if the Commercial Material is patented, then the State will have the rights permitted as a licensee under the federal patent laws for each copy of the Commercial Material delivered to it by the Contractor.

Except for Commercial Software, if the Commercial Material consists of trade secrets, then the State will treat the material as confidential. In this regard, the State will assume all obligations with respect to the Commercial Material that the Contractor assumes under the Confidentiality section of this Contract with respect to the State’s Confidential Information. Otherwise, the State will have the same rights and duties permitted under the federal copyright laws for each copy of the Commercial Material delivered to it by the Contractor, whether or not the material is copyrighted when delivered to the State.

For Commercial Software not otherwise subject to an express license set forth in an exhibit to this Contract, the State will have the perpetual rights in items (a) through (h) of this section with respect to the software. The State will not use any Commercial Software except as provided in items (a) through (h) of this section or as expressly stated otherwise in this Contract. The Commercial Software may be:

a. Used or copied for use in or with the computer or computers for which it was acquired, including use at any State installation to which such computer or computers may be transferred.

b. Used or copied for use in or with a backup computer for disaster recovery and disaster recovery testing purposes or if any computer for which it was acquired is inoperative.

c. Reproduced for safekeeping (archives) or backup purposes.

d. Modified, adapted, or combined with other computer software, but the modified, combined, or adapted portions of the derivative software incorporating any of the Commercial Software will be subject to same restrictions set forth in this Contract.

e. Disclosed to and reproduced for use on behalf of the State by support service contractors or their subcontractors, subject to the same restrictions set forth in this Contract.

f. Used or copied for use in or transferred to a replacement computer.

g. However, if the Commercial Software delivered under this Contract is published and copyrighted, it is licensed to the State without disclosure prohibitions.

h. However, if any Commercial Software is delivered under this Contract with the copyright notice in 17

U.S.C. 401, it will be presumed to be published, copyrighted, and licensed to the State without disclosure restrictions, unless a statement substantially as follows accompanies such copyright notice: "Unpublished rights reserved under the copyright laws of the United States.'' The State will treat such Commercial Software as Confidential Information to the extent that such is actually the case.

In the case of any other scope of license (e.g., MIPs, tier, concurrent users, enterprise, site, or otherwise), the foregoing will apply except as expressly modified by the applicable license description, which must be incorporated as part of the Contractor’s catalog. If the Contractor provides greater license rights in an item included in the Contractor’s catalog to its general customer base for the Software's list price, those additional license rights also will be provided to the State without additional cost or obligation. No license description may reduce the rights in items (a) through (h) above; it may only define the extent of use if the use is other than a CPU license.

The State will treat any Commercial Software as Confidential Information, in accordance with the requirements of the Confidential Information section of this Contract.

3.10 CONFIDENTIALITY AGREEMENTS

When the Contractor performs services under this Contract that require the Contractor’s and its subcontractors’ personnel to access facilities, data, or systems that the State in its sole discretion deems sensitive, the State may require the Contractor’s and its subcontractors’ personnel with such access to sign an individual confidential agreement and policy acknowledgements consistent with the terms of this Contract and have a background check performed before accessing those facilities, data, or systems. Each State agency, board, and commission may require a different confidentiality agreement or acknowledgement, and the Contractor’s and its subcontractors’ personnel may be required to sign a different confidentiality agreement or acknowledgement for each agency. The Contractor must immediately replace any of its or its subcontractors’ personnel who refuse to sign a required confidentiality agreement or acknowledgment or have a background check performed.

3.11 CONTRACTOR QUARTERLY SALES REPORT

Contractor must report the quarterly dollar value (in U.S. currency rounded to the nearest whole dollar) of the sales under this Contract each calendar quarter (i.e., January-March, April-June, July-September and October-December). The dollar value of the sales reported must equal the price paid by all State agencies and Cooperative Purchasing Members for purchases under this Contract during the reporting period.

Contractor must submit the quarterly sales report to the State via the State’s Ordering System, and when Contractor will be submitting a payment, Contractor must also complete and submit the Quarterly Sales Report and Revenue Share Remittance Form (available at https://das.ohio.gov/revenueshareform) with Contractor’s Revenue Share payment. If no sales occur, Contractor must show zero sales on the report. The report must be submitted 30 days after the completion of the reporting period.

Contractor also must submit a closeout sales report within 120 days after the expiration of this Contract. For purposes of this subsection 1.9.2, the Contract expires on the physical completion of the last, outstanding task or completion of an Order of the Contract. The closeout sales report must cover all sales not shown in the final quarterly sales report and reconcile all errors and credits. If Contractor reported all Contract sales and reconciled all errors and credits on the final quarterly sales report, then Contractor should show zero sales in the closeout sales report.

If Contractor fails to submit any sales report in a timely manner or falsifies any sales report, the State may terminate this Contract for cause.

3.12 CONTRACTOR REVENUE SHARE

The Contractor must pay to the State a share of the sales transacted under this Contract as a fee to the State to cover the estimated costs the State will incur in administering this Contract and the Services offered under it (“Revenue Share”).

The Contractor must remit the Revenue Share in U.S. dollars within 30 days after the end of the quarterly reporting period. The Revenue Share that the Contractor must pay under this Contract equals ¾ of 1% of the total quarterly sales reported. The Revenue Share must be included in the prices reflected in any order and https://das.ohio.gov/revenueshareform reflected in the total amount charged to the State, and the Contractor may not add a surcharge to orders under this Contract to cover the cost of the Revenue Share.

The Contractor must remit any amount due as the result of a quarterly or closeout sales report at the time the quarterly or closeout sales report is submitted to the Department of Administrative Services, Office of State Purchasing. To ensure the payment is credited properly, the Contractor must identify the payment as a “State of Ohio Revenue Share” and include this Contract number, total report amount, and reporting period covered.

Contractor will pay the Revenue Share by check remittance, both normal and overnight, credit card payment via the State’s epayment portal, or ACH payment, if approved by the State, using the instructions below.

Check remittance: Follow the remittance instructions on the required Quarterly Sales Report and Revenue Share Remittance Form at the following link, https://das.ohio.gov/revenueshareform.

Credit Card Payments: To pay by credit card, use the following link, https://epay.das.ohio.gov/Payment, select “Revenue Share” as the payment type and follow the on-screen prompts.

ACH Payments: If this payment method is approved by the State, the State will provide payment instructions to Contractor.

If the full amount of the Revenue Share is not paid within 30 days after the end of the applicable reporting period, the non-payment will constitute a contract debt to the State. The State may setoff any unpaid Revenue Share from any amount owed to the Contractor under this Contract and employ all other remedies available to it under Ohio law for the non-payment of the Revenue Share. Additionally, if the Contractor fails to pay the Revenue Share in a timely manner, the failure will be a breach of this Contract, and the State may terminate this Contract for cause as set forth herein and seek damages for the breach.

3.13 SOFTWARE WARRANTY

The State acknowledges and agrees that Contractor shall license and does not create or sell custom software or work-for-hire. If any Customer Order includes work to develop custom software as a Deliverable, then the parties to that Customer Order shall expressly identify such custom software in an attachment to the Customer Order identifying how the parties shall manage source code and reference this Section 3.13. On acceptance and for 12 months after the date of acceptance of any custom software, the Contractor warrants that:

a. The software will operate on the device or equipment for which the software is intended in the manner described in the relevant software documentation;

b. The software will be free of any material defects;

c. The Contractor will deliver and maintain relevant and complete software documentation, and commentary; and

e. The software and all maintenance will be provided in a professional, timely, and efficient manner.

For Commercial Software developed by the Contractor or a subcontractor, the warranties for such Commercial Software are set forth in Exhibit B. For purposes of the warranties and the delivery requirements in this Contract, software documentation means well written, readily understood, clear, and concise instructions for the software's users as well as a system administrator. The software documentation will provide the users of the software with meaningful instructions on how to take full advantage of all of the capabilities designed for end users.

https://das.ohio.gov/revenueshareform https://epay.das.ohio.gov/Payment

3.14 SOFTWARE WARRANTY, MAINTENANCE, AND UPGRADES

See Exhibit B.

3.16 EQUIPMENT MAINTENANCE

See Exhibit B.

3.19 PRINCIPAL PERIOD OF MAINTENANCE (GENERAL)

Software and Equipment maintenance must be available twelve working hours per weekday, between 7:00 a.m. and 7:00 p.m. (Columbus, Ohio local time). Travel time and expenses related to remedial and preventative maintenance will not be considered billable but will be included in the price of the maintenance.

3.20 MAINTENANCE ACCESS (GENERAL)

The Contractor must keep the Deliverable(s) Properly Performing (as defined in Exhibit B) during the warranty period and any annual maintenance period during which the State contracts for continued maintenance. The State will provide the Contractor with reasonable access to the Deliverable to perform maintenance. All maintenance that requires a Deliverable to be inoperable must be performed outside the State’s customary working hours, except when the Deliverable is already inoperable, unless otherwise agreed by the Parties. Preventative or scheduled maintenance must be performed at mutually agreeable times, within the parameters of the manufacturer’s published schedule.

3.21 CONTINUING OBLIGATIONS

Any terms, conditions, representations, or warranties contained in this Contract that must survive termination or expiration of this Contract to be fully effective will survive the termination or expiration of the Contract. Additionally, termination or expiration of this Contract will not affect the State’s right to continue to use any Deliverable for which it has paid, including licensed material. And no termination or expiration of the Contract will affect the State’s right to receive maintenance, warranty work, or other services for which the State has paid.

3.22.COOPERATIVE PURCHASING CONTRACT

This Contract may be utilized by Cooperative Purchasing Members. “Cooperative Purchasing Members” are entities that qualify for participation in the State’s cooperative purchasing program under Section 125.04 of the Ohio Revised Code (“R.C.”) and that have completed the steps necessary to participate in that program.

They may include Ohio political subdivisions, such as counties, townships, municipal corporations, school districts, conservancy districts, township park districts, park districts created under R.C. Chapter 1545, regional transit authorities, regional airport authorities, regional water and sewer districts, and port authorities.

They also may include any Ohio county board of elections, state institutions of higher education, private fire companies, private, nonprofit emergency medical service organizations, and chartered nonpublic schools.

If a purchase is made from this Contract by an entity that is not properly registered with the State’s Cooperative Purchasing Program, it may be a violation of law, may be contrary to the entity’s competitive bidding requirements, and will be a breach of this Contract by the Contractor. If a Cooperative Purchasing Member relies upon this Contract to issue a purchase order or other ordering document, the Cooperative Purchasing Member “steps into the shoes” of the State under this Contract. The Cooperative Purchasing Member’s order and this Contract are between the Contractor and the Cooperative Purchasing Member. The Contractor must look solely to the Cooperative Purchasing Member for performance, including payment. The Contractor agrees to hold the state of Ohio harmless with regard to Cooperative Purchasing Member’s orders and

Cooperative Purchasing Member’s performance. DAS may cancel this Contract and may seek remedies if the Contractor fails to honor its obligations under an order from a Cooperative Purchasing Member.

4 - CONTRACT SPECIFIC TERMS AND CONDITIONS

4.1 Additional Insurance Requirements

4.1.1 Professional Liability

Professional Liability (Errors and Omissions) Insurance appropriate to the Contractor’s profession, with limits n of $5,000,000 per claim, $5,000,000 aggregate. Coverage shall respond to the duties and obligations as is undertaken by Contractor in this Contract and shall cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract.

4.1.2 Cyber Liability

Technology Errors and Omissions and Cyber Liability Insurance with limits not less than $5,000,000 per occurrence or claim, $5,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as are undertaken by Contractor in this Contract and shall cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract. Coverage shall include, but not be limited to, infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage shall provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with sub-limits sufficient to respond to these obligations. This coverage requirement may be satisfied with any combination of policies, whether packaged or standalone, and include any applicable excess or umbrella coverage.

4.1.3 Self-Insurance

Notwithstanding the foregoing, the Parties understand and agree that Contractor or its subcontractor, Becton Dickinson and Company, may at any time self-insure for all or part of the insurance required hereunder upon prior written notice to the State, provided the Contractor provides documentation to the State of its financial ability to fund claim investigations, defense, and settlement under this Contract.

4.2 Standard Terms and Conditions Revisions

The parties agree to the changes to the Standard Terms and Conditions set forth in Exhibit A attached hereto and incorporated as if fully rewritten herein.

4.3 Contractor Additional Terms and Conditions

The parties agree to the additional terms and conditions set forth in Exhibit B attached hereto and incorporated as if fully rewritten herein.

4.4 Contract Renewals.

Contractor may provide written notice to the State of its desire not to renew the Contract at any time prior to the expiration date of the Contract. Notwithstanding the foregoing, if the Contractor does not provide such notice and the State’s issues the renewal, the Contractor may decline to renew the Contact by providing immediate written notice to the State. The Contractor shall not obligate resources in anticipation of a renewal until notice is provided.

4.5 Business Associate Agreement

The Business Associate Agreement (BAA) set forth in Exhibit C to the Contract is incorporated by reference as if fully rewritten herein.

4.6 Data Security and Privacy Terms

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms applies to all work and services across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with these Terms and must accept the security and privacy requirements outlined in these Terms in their entirety, as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management in accordance with the applicable State IT Security Policies and Standards.

These Terms apply to the following:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the Contract.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State Data directly or indirectly.

E. Any Contractor personnel that have access to State Data.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contractor for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

2. Personally Identifiable Information means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics, E. The definitions of “personal information” in Revised Code chapters 1347.01, 1347.04 through

1347.99, and F. The various other definitions of “personal information” throughout the Ohio Revised Code.

3. Security Event has the meaning set forth in Section 7 of these Terms.

4. Security Incident has the meaning set forth in Section 7 of these Terms.

5. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Sensitive Data.

6. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45

CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R.

431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards;

G. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

7. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with the applicable security baseline of the current published version of the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (“NIST 800-53”) commensurate with the type of State Data involved in the Contract as communicated by the State. If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. In either scenario, the Contractor must implement information security policies, standards, and capabilities as set forth in the Contract, adhere to State IT Security Policies and Standards IT- 04, IT-14, 2100-15, and ITS-SEC-02 (available at the link in the definition above), and use procedures in a manner that does not diminish established State capabilities and standards. All work performed by the Contractor, all deliverables provided by the Contractor, and all environments utilized to perform the Contractor’s work must comply with State IT Security Policies and Standards. The Contractor’s information https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Support State IT security policies, standards and procedures development and maintenance activities. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of State Data

Contractor shall maintain an Information Security Program (“ISP”) made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction.

To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in non-State controlled systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations and be handled in accordance with the requirements of these Terms at all Contractor locations.

If the Contractor will be handling State’s Sensitive Data, the State may require additional documentation from Contractor to comply with federal and/or State security audit requirements. Contractor agrees to provide reasonable assistance to the State to comply with such requirements provided that all such documentation disclosed to the State shall be maintained as Confidential Information and shall not require disclosure of information that is proprietary to Contractor or its dealers or documentation that contains the PII of Contractor’s or its dealers’ employees.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq. (“FISMA 2014”) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications as set forth in the applicable User Guide for a Deliverable, or as otherwise agreed upon by the Parties in a scope of work for a Customer Order.

Contractor’s information security program protects State Data by aligning with NIST 800-53 to implement an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against the unauthorized access to, disclosure of, or use of State Data.

D. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroy or return to the State, in a format designated by the State, all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

G. Maintain appropriate and effective business continuity and disaster recovery plans to ensure resiliency of State Data and business operations, as applicable.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered State Data and Confidential Information under this Contract.

Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, and shall use commercially reasonable efforts proportional to the vulnerability to remediate vulnerabilities and provide the State with patches to address the vulnerabilities at no cost to the State.

Contractor must follow industry standard practices for application code review.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), Contractor warrants that, upon delivery, its software and/or service are free from any and all defects in materials, workmanship, and design. Contractor warrants that, upon delivery, the software is free from any and all viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of State Data is permitted as set forth in the Contract. Additionally, disclosure of State Data is also permitted when required by applicable law, regulation, court order or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Sensitive Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State in accordance with Exhibit A, Section VII(A)(6), in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also reasonably cooperate in the State’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the State.

If, in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Contractor may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. The Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

B. Upon written request and no more than once per year, unless otherwise required by law, rule, or regulation, the State may, at any time in its sole discretion and with notice to Contractor, elect to perform a Security and Data Protection Audit. This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will work with the Contractor to schedule time to conduct the audit. All such information and documentation provided by Contractor shall be maintained as Confidential Information under this Contract.

C. At no cost to the State, the Contractor shall use commercially reasonable efforts proportional to the risk to remedy any material issues identified in each audit as they pertain to the services provided under this Contract.

6. Background Investigations of Contractor Personnel

The State of Ohio may conduct background investigations on Contractor personnel that may have access to State Data or as otherwise deemed necessary by the State. Any person who (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform certain services under the Contract.

7. Security Incidents

A. Definitions. A security incident threatens the…