CTR062097-iTedium-ContractAPP.pdf

Scope of Work

Contract No.: CTR062097 Description: ASRS Cobra Administration Services

Page

COBRA ADMINISTRATION

The Contractor will provide high quality, efficient COBRA administration and services including but not limited to:

1. Implementation

1.1. Contractor will assist ASRS in initial notice to participants

2. Contractor will maintain accurate participant information needed for plan administration.

3. Contractor will send the following notices to applicable participants:

3.1. Qualifying event notices including HIPAA Certificates of Creditable Coverage.

3.1.1. Contractor will provide proof of mailing

3.2. New eligible employee initial notices, including the Women’s Health and Cancer Act Notice.

3.3. COBRA termination notices including HIPAA Certificates of Creditable Coverage.

3.3.1. Contractor will provide proof of mailing

3.4. Carrier notification.

3.5. Any other required notices such as underpayment letters, significant or insignificant, NSF letters, SSD Letters, etc.

4. Contractor will bill and collect participant premiums per COBRA rules.

4.1. Premium payments will be deposited and posted on the day of receipt.

4.2. Contractor will remit participant premium payments twice a month to ASRS.

5. Technology and System Access

5.1. Contract will provide a portal for ASRS staff to access standard reporting and plan information.

5.1.1. Contractor will provide unlimited user IDs to access portal

5.2. Contractor will provide a web portal to qualifying participants.

5.3. Contractor will image/archive ASRS COBRA participant correspondence.

5.4. Contractor will provide ADHOC reporting upon ASRS request.

6. Contractor will monitor the ASRS COBRA program to ensure accurate legal and regulatory compliance.

All terms not defined herein shall have the meaning given to them in the Uniform Terms and Conditions.

SPECIAL TERMS AND CONDITIONS

Description: ASRS Cobra Administration Services

CONTENTS

1. Definition of Terms

2. Contract Interpretation

3. Contract Administration and Operation

4. Pricing and Payments

5. Contract Changes

6. Contract Termination

7. Risk and Liability

8. INFORMATION SECURITY AND DATA PRIVACY

PRICING SCHEDULE

Description: ASRS Cobra Administration Services

1. OTHER FEES

Fees are based on the events or actions performed in Contractor’s COBRA software.

Service Fee

Monthly Access Fee $385 One Time Estimated Implementation Fee. This includes initial notice generation assistance. $1,500-$2,500

Per COBRA Active Participant. $8.25 Per Qualifying Event Notices including HIPAA Certificates of Creditable Coverage with proof of mailing. $13.20

Per Newly Eligible Employee Initial Notices (includes the Women's Health and Cancer Act Notice). $3.30

Per Termination of COBRA Notice including HIPAA Certificates of Creditable Coverage with proof of mailing $5.50

Per Any other required notice sent via US Mail: Underpayment Letters - Significant or Insignificant, NSF Letters, SSD Letters, etc. $3.85

Unlimited standard reports available via the COBRATrak database. Included

Billing and Premium collection from COBRA participants. Included Per Premium remittance to the group and/or the carriers of COBRA participant's premium. $27.50

Mandatory record keeping and 24/7 account access via our secure site. Included

COBRA Participant Portal via: www.mycobra.info.com. Included

Access to our Account Management Team. Included

Digital Imaging/Archiving of COBRA participant correspondence. Included

Per Carrier Notification. $0.28

Participant Premium remittance to ASRS 2% administration fee

2. OTHER FEES

The Offeror should disclose any additional fees associated with subcontractor arrangements that involved the services provided to ASRS and are not included in attachments.

Service Fee

Open enrollment packets (optional service) $9.50 per packet plus postage

ADHOC Reports $150/hr 1-6 hrs $100/hr 7-12 hrs

ADHOC Reporting >12 hours development Flat fee determined at time of service.

Development of Custom data feed $150/hr up to 6 hrs

Description: ASRS Cobra Administration Services

The Special Terms and Conditions modify the Uniform Terms and Conditions. It can modify them by replacing, deleting, appending to, or revising the text of an existing provision or by inserting a new paragraph into an existing article. No other document modifies or adds to the Uniform Terms and Conditions, except as may subsequently be otherwise and expressly agreed and incorporated by Contract Amendment.

1. DEFINITION OF TERMS

All other terms not defined herein shall have the meaning given to them in the Uniform Terms and Conditions.

“Acceptance of Offer” means the Attachment labeled “Offer and Acceptance” bearing the State contract number once the Procurement Officer has signed it to signify the (1) formal acceptance of the Offer and (2) the formation of the Contract. For clarity of intent, the foregoing is not to be confused with the term ‘acceptance’ used throughout the Contract in the context of delivery, inspection, etc., with respect to Materials or Services.

“Order” means the instrument by which ASRS authorizes Contractor to perform some or all of the Work. Whether the Contract will have one Order or many Orders depends on the scope of the Contract and how the ASRS will use it. Any of the following is to be construed as being an “Order”:

1.2.1. A purchase order;

1.2.2. A task order or service order;

1.2.3. Written correspondence or instruction.

“Subcontractor” has the meaning given in A.R.S. § 41-2503(38), which, for convenience of reference only, is “… a person who contracts to perform work or render service to … [C]ontractor or to another [S]ubcontractor as a part of a contract with a state governmental unit. . . .” The Contract is to be construed as “a contract with a state governmental unit” for purposes of the definition. For clarity of intent, a person carrying out any element of the Work is a Subcontractor from the moment they first carry out that element of the Work regardless of whether or not a Subcontract exists then or subsequently.

“Work” means the totality of the materials and the Services and all the acts of administration, creation, production, and performance necessary to fulfill and incidental to fulfilling all of Contractor's obligations and duties under the Contract in conformance with the Contract and applicable laws.

2. CONTRACT INTERPRETATION

Usage. Where the Contract:

2.1.1. assigns obligations to Contractor, any reference to “Contractor” is to be construed to be a reference to Contractor and all Subcontractors, whether they are first-tier subcontractors, sub-subcontractors, suppliers, sub-suppliers, consultants, or sub-consultants, as well as all of Contractor’s and the Subcontractors’ respective agents, representatives, and employees in every instance unless the context plainly requires that it is be a reference only to Contractor as apart from Subcontractors;

2.1.2. uses the permissive “may” with respect to a party’s actions, determinations, etc., the term is to be interpreted as in A.A.C. R2-7-101(31) [Definitions]. For clarity of intent, any right given to ASRS using “ASRS may” or a like construction denotes discretion and freedom to act so far as any regulatory or operative constraints permit in the relevant circumstances, provided that: (a) where written “may, at its discretion,” the discretion extends to whatever is most advantageous to ASRS; and (b) where written only as “may,” the discretion is constrained by what is fair, reasonable, and as accommodating of the respective best interests of both parties as practicable under the circumstances;

2.1.3. uses the imperative “shall” with respect to a party’s actions, duties, etc., the term is to be interpreted as in A.A.C. R2-7-101(43) [Definitions]. Conversely, the phrase “shall not” is to be interpreted as an imperative prohibition.

2.1.4. uses the term “must” with respect to a requirement, criterion, etc., the term is to be interpreted as conveying compulsion or strict necessity, and is to be read as though written “must, if [the subject] is to be entitled to

Description: ASRS Cobra Administration Services have [the object] considered or credited as being compliant with, conforming to, or satisfying [the requirement, criterion, constraint, etc.], otherwise, [the object] will be considered or debited as being non-compliant, non-conforming, or unsatisfactory for its Contract-related purposes” in every instance;

2.1.5. uses the term “might” with respect to an event, outcome, action, etc., the term is to be interpreted as conveying contingency or non-discretionary conditionality; and

2.1.6. uses the term “will” or the phrases “is to be” or “are to be” with respect to an event, outcome, action, etc., the term or phrase is to be interpreted as conveying such certainty or imperativeness that “shall” is either unnecessary or irrelevant in that instance.

Independent Contractor. Contractor is an independent contractor and shall act in an independent capacity in performance under the Contract. Neither party is or is to be construed as being to be the employee or agent of the other party, and no action, inaction, event, or circumstance will be grounds for deeming it to be so.

Complete Integration. The Contract, including any documents incorporated into the Contract by reference, is intended by the parties as a final and complete expression of their agreement. There are no prior, contemporaneous, or additional agreements, either oral or in writing, pertaining to the Contract.

3. CONTRACT ADMINISTRATION AND OPERATION

Authority to Contract. This Contract activity is issued under the authority of the State Procurement Administrator, through the Arizona State Retirement System (“ASRS”). No alteration of any portion of the Contract, any services awarded, or any other agreement that is based upon this Contract may be made without express written approval of the ASRS Chief Procurement Officer or other personnel delegated authority in the form of an official Contract Amendment. Any such action is subject to the legal and contractual remedies available to the State inclusive of, but not limited to, Contract termination, cancellation, suspension, and/or debarment of the Contractor.

Contract Applicability. Any Contract resulting from this Solicitation shall be for the exclusive use of the ASRS.

Contract Usage. Contractor shall understand and agree that no quantity of service is guaranteed under the Contract and that ASRS does not guarantee that Contractor’s services will be utilized to any degree. ASRS reserves the right to contract for the services as a whole, or any of the various parts/scenarios listed separately.

Term of Contract. The term of the Contract shall commence on the effective date indicated in the “Acceptance of Offer” and shall remain in effect for a period of two (2) years thereafter unless terminated, canceled or extended as otherwise provided herein.

Contract Extensions. The Contract shall not bind nor purport to bind the ASRS for any contractual commitment in excess of the original Contract term. The ASRS shall have the right, as its sole option, to extend the Contract for one or more months, provided that the maximum aggregate term of the Contract including extensions cannot exceed five (5) years. If the ASRS exercises such rights, all terms, conditions, and provisions of the original Contract shall remain the same and apply during an extension period.

3.5.1. The Contractor shall provide the ASRS with notice of any requests for program/operation changes or modifications of any type, including those on price, at least ninety (90) days prior to the effective date for each extension period. Any such request shall be accompanied by supporting documentation.

Click Through Terms and Conditions. If either party uses a web-based ordering system, an electronic purchase order system, an electronic order acknowledgement, a form of an electronic acceptance, or any software based ordering system with respect to the Contract (each an “Electronic Ordering System”), the parties acknowledge and agree that an Electronic Ordering System is for ease of administration only, and Contractor is hereby given notice that the persons using Electronic Ordering Systems on behalf of State do not have any actual or apparent authority to create legally binding obligations that vary from the terms and conditions of the Contract. Accordingly, where an authorized State user is required to “click through” or otherwise accept or be made subject to any terms and conditions in using an Electronic Ordering Systems, any such terms and conditions are deemed void upon presentation. Additionally, where an authorized State user is required to accept or be made subject to any terms and conditions in accessing or employing any Materials or Services, those terms and conditions will also be void.

Description: ASRS Cobra Administration Services

Notices. All notices, requests, demands, consents, approvals, and other communications which may or are required to be served or given hereunder (collectively, “Notices”):

3.7.1. If intended for the ASRS, shall be hand-delivered, emailed to ASRSProcurement@azasrs.gov or sent by registered or certified United States mail, return receipt requested, postage prepaid, and addressed to the ASRS as indicated on the Offer and Acceptance document of this Contract or to such other address as may from time be furnished in writing to the Contractor.

3.7.2. If intended for the Contractor, such Notice shall be given to the person named in the Offer and Acceptance document of this Contract or to such other person as the Contractor may from time to time furnish in writing to the ASRS.

3.7.3. Any Notice so given shall be deemed to have been given as of the date such Notice is received as shown on the return receipt or on the date such Notice is personally delivered to the other party.

Key Personnel. It is essential that the Contractor provide an adequate staff of experienced personnel capable of and devoted to the successful accomplishment of work to be performed under this Contract. The Contractor must assign specific individuals, including account specialist to the key positions. Once key personnel are assigned to work under the Contract, the ASRS shall have the opportunity to review the qualifications and approve the assignment of additional or replacement key personnel.

Warranty

Unless otherwise modified elsewhere in the terms and conditions, the Contractor warrants that, for one year after acceptance by the ASRS, the Materials shall be fully compatible with the ASRS's computer hardware and software environment. Contractor represents and warrants to the ASRS that Contractor has the skill and knowledge possessed by members of its trade or profession and Contractor will apply that skill and knowledge with care and diligence so Contactor and Contractor's employees and any authorized subcontractors shall perform the Services described in this Contract in accordance with the Statement of Work.

Contractor represents and warrants that the Materials provided through this Contract and Statement of Work shall be free of viruses, backdoors, worms, spyware, malware and other malicious code that will hamper performance of the Materials, collect unlawful personally identifiable information on users or prevent the Materials from performing as required under the terms and conditions of this Contract.

Offers of Employment

The Contractor shall comply with A.R.S. § 41-2517, as it relates to a person, firm or lobbyist making an offer of employment to an employee having a significant procurement role, as defined in A.R.S. § 41-741 and A.R.S. § 41- 2503.

Performance in Public Health Emergency. The Contractor warrants that it will:

3.11.1. Have in effect promptly after commencement a plan for continuing performance in the event of a declared public health emergency that addresses, at a minimum: (a) identification of response personnel by name;

(b) key succession and performance responses in the event of sudden and significant decrease in workforce; and (c) alternative avenues to keep sufficient product on hand or in the supply chain; and

3.11.2. Provide a copy of its current plan to the ASRS within three (3) business days after the ASRS’s written request. If Contractor claims relief under paragraph 6.4 (Force Majeure) of the Uniform Terms and Conditions for an occurrence of force majeure that is a declared public health emergency, then that relief will be conditioned on Contractor having first implemented its plan and exhausted all reasonable opportunity for that plan implementation to overcome the effects of that occurrence, or mitigate those effects to the extent that overcoming entirely is not practicable.

For clarification of intent, being obliged to implement the plan is not of itself an occurrence of force majeure, and Contractor will not be entitled to any additional compensation or extension of time by virtue of having mailto:ASRSProcurement@azasrs.gov

Description: ASRS Cobra Administration Services to implement it. Furthermore, failure to have or implement an appropriate plan will be a material breach of contract.

4. PRICING AND PAYMENTS

Most Favored Client Pricing. Contractor represents and warrants that its fee structure under this Contract is, and at all times during the term of this Contract and any extension will remain, the equal of or less than any fee structure offered for similar services to any other of its customers. Within thirty (30) days of offering a more advantageous fee structure to any other customer, Contractor shall offer the ASRS for immediate implementation at least the same fee structure.

Price Adjustments

4.2.1. The Contractor shall agree that the prices stated in the original Contract shall not be increased unless otherwise negotiated.

4.2.2. A price increase adjustment shall only be considered at the time of a contract extension and shall be a factor in the extension review process. The ASRS shall determine whether the requested price increase or an alternate option is in the best interest of the ASRS.

4.2.3. Price reduction may be offered at any time during the term of the Contract and shall become effective upon acceptance by the ASRS.

4.2.4. The Contractor understands and agrees the needs of the ASRS may change during the life of the Contract and the ASRS may propose changes to any part of this Contract with a commensurate, fair, and equitable adjustment in price. Any such changes shall be made in accordance with Article 5.1 (Amendments) of the Uniform Terms and Conditions of this Contract.

Billing

4.3.1. All billing notices should be identified by Contractor’s name, list the Contract number, and clearly identify the line item, if applicable. Billing notices or invoices must be submitted by email to: asrsap@azasrs.gov.

4.3.2. Without prejudice to its other rights under the Contract or further obligation to Contractor, the ASRS may, at its discretion, reject any material defective invoice if it is determined that the invoice is materially defective.

4.3.3. If ASRS determines that an over-payment has been made to Contractor on any prior invoice, ASRS may deduct the over-paid amount from amounts then or thereafter due to Contractor.

Travel. In accordance the Pricing Schedule, travel must be inclusive of all fee. ASRS will not reimburse travel expenses unless ASRS requests travel not related to services contemplated within the Contract. In the case of ASRS approved travel expense reimbursement, Contractor may be reimbursed travel expenses in accordance with the published rates specified in the State of Arizona Travel Policy, located at https://gao.az.gov/travel/welcome-gao-travel, and incorporated herein.

Discounts. Contractor will apply discounts in accordance with the Pricing Schedule or subsequent Contract Amendment. Payment discount periods shall be computed from the date of receipt of services or correct invoice, whichever is later, to the date the ASRS makes payment. Unless charges are itemized, any discount provided shall be taken on full amount of the invoice. The ASRS shall be entitled to take advantage of any payment discount offered by Contractor provided payment is made within the discount period.

5. CONTRACT CHANGES

Contract Amendments. The Contract may be modified only through a Contract Amendment within the scope of the Contract. Changes to the Contract, including the addition of Work or Materials, the revision of payment terms, or the substitution of Work or Materials, directed by a person who is not specifically authorized by the Procurement Officer in writing or made unilaterally by Contractor are violations of the Contract and of applicable law. Such https://gao.az.gov/travel/welcome-gao-travel

Description: ASRS Cobra Administration Services changes, including unauthorized written Contract Amendments shall be void and without effect, and Contractor shall not be entitled to any claim under this Contract based on those changes.

Signing of Contract Amendments. Contractor’s counter-signature – or “approval” in The State’s e-Procurement System, in the case of an amendment, – is not required to give effect if the Contract Amendment only covers either:

5.2.1. extension of the term of the Contract within the maximum aggregate term;

5.2.2. revision to Procurement Officer appointment or contact information; or

5.2.3. modifications of a clerical nature that have no effect on terms, conditions, price, scope, or other material aspect of the Contract.

In every case other than those listed in (1), (2), and (3) above, both parties’ signatures – or “approval” in The State’s e-Procurement System, in the case of an Amendment – are required to give it effect.

Contract Assignment. Contractor may not assign, transfer or convey any of its rights or obligations under this Contract without the written permission of the ASRS.

6. CONTRACT TERMINATION

Termination for Default

6.1.1. The ASRS reserves the right to terminate the whole or any part of this Contract due to failure of Contractor to carry out any obligation, term, or condition of the Contract, subject to sections 6.2 and 6.3 below.

6.1.1.1. The ASRS will issue a written ten (10) day notice of default to the Contractor for acting or failing to act, including in doing the following:

6.1.1.2. The Contractor fails to adequately perform the services set forth in the Scope of Work of the

Contract;

6.1.1.3. The Contractor fails to complete the work required within the time stipulated in the Contract;

6.1.1.4. The Contractor attempts to impose on the ASRS, personnel which are of an unacceptable quality;

6.1.1.5. The Contractor fails to make progress in the performance of the Contract and/or gives the ASRS reason to believe the Contractor will not or cannot perform to the requirements of the Contract.

6.1.2. If the Contractor does not correct the above problem(s) within ten (10) days after receiving the notice of default, the ASRS may terminate the Contract. If the ASRS terminates the Contract pursuant to this clause, the ASRS reserves all rights or claims to damage for breach of contract.

6.1.3. The ASRS may recover reasonable excess costs from the Contractor by:

6.1.1.6. Deduction from an unpaid balance;

6.1.1.7. Collection against the offer and/or performance bond; or

6.1.1.8. Any combination of the above or any other remedies as provided by law.

Termination for Convenience. The Contract is for the convenience of the ASRS and as such may be terminated without default by the ASRS when in the best interest of the ASRS by providing a written thirty (30) day notice of termination to Contractor.

Description: ASRS Cobra Administration Services

6.2. Performance of Contract Following Termination or Expiration In the event the Contract expires or is terminated for any reason or cause, Contractor agrees to continue performance of its duties, if so requested by the ASRS, as though no expiration or termination had occurred for a period not to exceed six (6) months from the first day of the month following termination. Contractor shall cooperate fully with a replacement service contractor (“Replacement Contractor”) who assumes the Services under the Contract. In such event, Contractor shall continue to receive compensation set forth in the Contract unless modified by Contract Amendment to address unforeseen transition costs.

Data Relating to Contract

6.3.1. In the event of the expiration, termination or non-renewal of the Contract, Contractor, at its own expense, is obligated to return all data and records relating to the acquisition and performance of the Contract (“Data”) to the ASRS and to provide such Data to the Replacement Contractor in a format acceptable to the Replacement Contractor and that will ensure no loss of crucial data is incurred and no Services are interrupted.

6.3.2. The ASRS does not expect the Contractor to release any proprietary or trade secret information to the Replacement Contractor.

7. RISK AND LIABILITY

Contractor Insurance

7.1.1. The Insurance Requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State of Arizona in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that arise out of the performance of the work under this Contract by the Contractor, its agents, representatives, employees or subcontractors, and the Contractor is free to purchase additional insurance.

MINIMUM SCOPE AND LIMITS OF INSURANCE Contractor shall provide coverage with limits of liability not less than those stated below.

1. Commercial General Liability (CGL) – Occurrence Form

Policy shall include bodily injury, property damage, and broad from contractual liability coverage.

• General Aggregate $2,000,000

• Products – Completed Operations Aggregate $1,000,000

• Personal and Advertising Injury $1,000,000

• Damage to Rented Premises $50,000

• Each Occurrence $1,000,000

a. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by or on behalf of the Contractor.

b. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

2. Business Automobile Liability

Bodily Injury and Property Damage for any owned, hired, and/or non- owned automobiles used in the performance of this Contract.

• Combined Single Limit (CSL) $1,000,000

a. Policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its

Description: ASRS Cobra Administration Services departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by, or on behalf of, the Contractor involving automobiles owned, hired and/or non-owned by the Contractor.

b. Policy shall contain a waiver of subrogation endorsement as required by this written agreement in favor officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

3. Workers’ Compensation and Employers' Liability

• Workers' Compensation Statutory

• Employers' Liability

Each Accident $1,000,000 Disease – Each Employee $1,000,000 Disease – Policy Limit $1,000,000

a. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

b. This requirement shall not apply to each Contractor or subcontractor that is exempt under A.R.S. § 23- 901, and when such Contractor or subcontractor executes the appropriate waiver form (Sole Proprietor or Independent Contractor).

4. Professional Liability (Errors and Omissions Liability)

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. In the event that the Professional Liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained, or an extended discovery period will be exercised, for a period of two (2) years beginning at the time work under this Contract is completed.

b. The policy shall cover professional misconduct or negligent acts for those positions defined in the Scope of Work of this contract.

5. Network Security (Cyber) and Privacy Liability

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. Such insurance shall include, but not be limited to, coverage for third party claims and losses with respect to network risks (such as data breaches, unauthorized access or use, ID theft, theft of data) and invasion of privacy regardless of the type of media involved in the loss of private information, crisis management and identity theft response costs. This should also include breach notification costs, credit remediation and credit monitoring, defense and claims expenses, regulatory defense costs plus fines and penalties, cyber extortion, computer program and electronic data restoration expenses coverage (data asset protection), network business interruption, computer fraud coverage, and funds transfer loss.

b. In the event that the Network Security and Privacy Liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained, or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

c. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its department, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

Additional Insurance Requirements

The policies shall include, or be endorsed to include, as required by this Contract, the following provisions:

Description: ASRS Cobra Administration Services

7.2.1. The Contractor's policies, as applicable, shall stipulate that the insurance afforded the Contractor shall be primary and that any insurance carried by the ASRS, its agents, officials, employees or the State of Arizona shall be excess and not contributory insurance, as provided by A.R.S. § 41-621 (E).

7.2.2. Insurance provided by the Contractor shall not limit the Contractor’s liability assumed under the indemnification provisions of this Contract.

Notice of Cancellation

Applicable to all insurance policies required within the Insurance Requirements of this Contract, Contractor’s insurance shall not be permitted to expire, be suspended, be canceled, or be materially changed for any reason without thirty (30) days prior written notice to the ASRS. Within two (2) business days of receipt, Contractor must provide notice to the ASRS if they receive notice of a policy that has been or will be suspended, canceled, materially changed for any reason, has expired, or will be expiring. Such notice shall be sent directly to the ASRS and shall be emailed to ASRSProcurement@azasrs.gov.

Acceptability of Insurers

Contractor’s insurance shall be placed with companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers. Insurers shall have an “A.M. Best” rating of not less than A- VII. The ASRS in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

Verification of Coverage

Contractor shall furnish the ASRS with certificates of insurance (valid ACORD form or equivalent) evidencing that Contractor has the insurance as required by this Contract. An authorized representative of the insurer shall sign the certificates.

7.5.1. All such certificates of insurance and policy endorsements must be received by the ASRS before work commences. The ASRS’s receipt of any certificates of insurance or policy endorsements that do not comply with this written agreement shall not waive or otherwise affect the requirements of this Contract.

7.5.2. Each insurance policy required by this Contract must be in effect at, or prior to, commencement of work under this Contract. Failure to maintain the insurance policies as required by this Contract, or to provide evidence of renewal, is a material breach of contract.

7.5.3. All certificates required by this Contract shall be sent directly to the ASRS by email to ASRSProcurement@azasrs.gov. The ASRS Contract number and project description should be noted on the certificate of insurance. The State of Arizona reserves the right to require complete copies of all insurance policies required by this Contract at any time.

Subcontractors

Contractor’s certificate(s) shall include all subcontractors as insureds under its policies or Contractor shall be responsible for ensuring and/or verifying that all subcontractors have valid and collectable insurance as evidenced by the certificates of insurance and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum Insurance Requirements identified above. The ASRS reserves the right to require, at any time throughout the life of this contract, proof from the Contractor that its subcontractors have the required coverage.

Approval and Modifications

The ASRS, in consultation with ADOA-Risk Management Division, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary. Such action will not require a formal Contract amendment but may be made by administrative action.

8. INFORMATION SECURITY AND DATA PRIVACY

Description: ASRS Cobra Administration Services

Applicability. Article 8 applies to the extent the Work includes handling of any (1) ASRS proprietary and sensitive data or (2) confidential or access-restricted information obtained from the ASRS or from others at ASRS’s behest.

Definitions. For the purposes of this Article:

8.2.1. “Confidential Information” (CI) means data that is protected from unauthorized disclosure based on laws, regulations, and other legal agreements. CI includes critical business infrastructure information as defined by A.R.S. § 41-1801.

8.2.2. “Breach” (HIPAA (45 CFR §§ 164.400-414)) means an impermissible use or disclosure under the HIPAA Privacy Rule that compromises the security or privacy of the protected health information. An impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

8.1.1.1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

8.1.1.2. The unauthorized person who used the PHI or to whom the disclosure was made;

8.1.1.3. Whether the PHI was actually acquired or viewed; and

8.1.1.4. The extent to which the risk to PHI has been mitigated.

8.2.3. “Incident” means an act of violating an explicit or implied security or privacy policy. The definition includes but is not limited to types of activities that are widely recognized as being in violation of policy:

8.2.3.1. Attempts (either failed or successful) to gain unauthorized access to a system or it’s data/information;

8.2.3.2. Unwanted disruption or denial of service;

8.2.3.3. The unauthorized use of a system for the processing or storage of data;

8.2.3.4. Changes to system hardware, firmware, or software characteristics without the owner’s knowledge, instruction or consent; and

8.2.3.5. Unauthorized access, alteration, disclosure, loss, theft or acquisition of non-electronic confidential information.

8.2.4. “Personal Information” (A.R.S. § 18-551(7(a)(b))) means

8.2.3.6. Any of the following: An individual’s first name or first initial and last name in combination with one or more specified data elements.

8.2.3.7. An individual’s user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account.

8.2.3.8. Does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.

8.2.5. “Personally Identifiable Information” (PII) means any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records;

and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

8.2.6. “Protected Health Information” (PHI) means individually identifiable health information as defined by the HIPAA Privacy Rule at 45 CFR § 160.103 (Health Information), 45 CFR § 160.103 (Individually Identifiable Health Information) and 45 CFR § 164.501 (Protected Health Information) including the following identifiers (see 45 CFR § 164.514(b)(2)(i)): an individual’s name; address; dates of birth, dates of health care services, certain age categories and other elements of dates; telephone numbers; fax numbers; e-mail addresses; social security numbers; medical records and account numbers; health plan beneficiary numbers; certificate and license numbers; vehicle identifiers, serial numbers and license plate numbers;

device identifiers and serial numbers; Web Universal Resource Locators (URLs or web addresses);

Internet Protocol (IP) addresses; biometric identifiers, including voice and finger prints; facial photographs and comparable images; and any other unique identifying number, characteristic or code.

Description: ASRS Cobra Administration Services

8.2.7. “Sensitive Data” means data that is private, personal, or proprietary and must be protected from unauthorized access. This may include personal identifying information as defined in the Arizona Revised Statutes, Title 18, Chapter 5, Article 2, Government Anti-Identification Procedures (A.R.S. § 18-521 and § 18-522) when such information is not otherwise defined as PI of CI.

8.2.8. “Unauthorized Access” occurs when a user, legitimate or unauthorized, accesses a resource that the user is not permitted to use or any access that violates a stated security policy. It may include the loss or other unauthorized access of a device, technology component or record containing PI, CI or Sensitive Data or the destruction/disposal of records that does not comply with the Arizona Record Destruction Law, A.R.S.

§ 44-7601.

Contractor’s Obligation Regarding Information Security and Data Privacy

8.3.1. Contractor shall establish and maintain procedures and controls acceptable to the ASRS for the purpose of ensuring that the ASRS’s proprietary information or any PI, CI, or Sensitive Data in Contractor’s possession and contained in its records is protected from unauthorized access and is accessed, viewed, used, disclosed, retained or disposed of by its agents, subcontractors, officers or employees only as intended or approved in writing by the ASRS and consistent with applicable law.

8.3.2. Contractor shall abide by and secure data related to the performance of this Contract in a manner substantially similar to the State of Arizona’s policy or its corresponding standards for data classification (https://aset.az.gov/resources/psp).

8.3.3. Contractor acknowledges that all information disclosed to it concerning the ASRS’s operations during performance of the Contract and after the full term of the Contract shall not be disclosed to other parties except as determined necessary by the ASRS and only with the ASRS’s prior written consent.

8.3.4. The ASRS shall have the right to assess, inspect, review, monitor and validate compliance with information and data requirements of the Contract. The ASRS’s right to inspect shall apply to all physical locations where performance of this Contract occurs, to personnel performing work authorized by this Contract, to any records (as defined by A.R.S. §41-151.18) or devices used in performance of this Contract, and to documented policies and procedures, including but not limited to information security and privacy controls.

The right to inspect shall apply to all subcontractors or other agents who perform under the Contract.

Information Security and Data Privacy Incident Reporting. To comply with 8.3, unless authorized by law or in writing by the ASRS, Contractor shall report any unauthorized use or disclose of CI or Sensitive Data. Contractor shall make the report to the ASRS’s Privacy or Information Security Officer within 24 hours after the Contractor learns of the unauthorized access, use or disclosure. In its report, the Contractor shall, at a minimum:

8.4.1. Identify the nature of the unauthorized access, use or disclosure;

8.4.2. Identify the CI or Sensitive Data accessed, used or disclosed;

8.4.3. Identify who made the unauthorized access/use or received the unauthorized disclosure;

8.4.4. Identify what Contractor has done or will do to mitigate or contain the risk of harm of the unauthorized access, use or disclosure;

8.4.5. Identify what corrective action Contractor has taken or shall take to prevent future similar unauthorized access, use or disclosure; and

8.4.6. Provide such other information, including a written report as requested by the ASRS’s Privacy or Information Security Officer.

Unauthorized Access Mitigation https://aset.az.gov/resources/psp

Description: ASRS Cobra Administration Services

8.5.1. The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of an access, use or disclosure of the ASRS’s information in violation of the requirements of this Contract.

8.5.2. Mitigation will include the Contractor’s cooperation with the ASRS to investigate the unauthorized access, use or disclosure, identify the individuals and their contact information for purposes of breach notification and other collaboration as may be reasonably requested to notify, respond to inquiries and remediate the risk associated with the unauthorized access, including credit protection or other information theft prevention services. The ASRS at its sole discretion may require the Contractor to pay for or reimburse the ASRS for expenses and costs associated with unauthorized access and risk mitigation.

Secure Facilities

8.6.1. The Contractor’s work area(s) shall provide for a secure locked location where uncompleted work shall be stored. This area shall be secure enough whereby access by unauthorized personnel shall be restricted or eliminated. The ASRS reserves the right to visit the Contractors to confirm security, throughout the term of the Contract.

8.6.2. Upon termination of the Contract, all goods, materials, documents, data and reports prepared by the Contractor under the Contract shall become the property of and be delivered to the ASRS upon request.

The Contractor must ensure that all digital storage devices containing ASRS data, including data storage at the native file level, are sanitized, and electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800–88, Guidelines for Media Sanitization, 6 such that the information or data cannot be retrieved. (see https://www.nist.gov/publications/nist-special-publication- 800-88-revision-1-guidelines-media-sanitization). Contractor may retain copies as applicable in order to meet its record retention requirements.

8.6.3. Contractor must provide the ASRS with an information safeguard management plan for its primary sites and work that will be performed by employees, agents or subcontractors at locations other than the primary site including but not limited to personal residences and other remote locations. The ASRS must be notified in writing of any changes in operations or this plan. The ASRS reserves the right to approve and monitor the information safeguard plan. The Contractor, its subcontractors and agents shall maintain a complete, current and accurate log identifying the location of each person completing work for the ASRS that requires access, use or disclosure of confidential or sensitive information.

Network Security

Contractor and its subcontractors shall maintain the following minimum network security controls:

8.7.1. Encryption of data in transit and at rest if the data contains confidential or personal information. Data at rest includes laptops, thumb drives, desk tops, CDs, and any other removable media; it does not include data resting on a server;

8.7.2. Maintain updated patches on all software and technology infrastructure;

8.7.3. Role based access controls and network access authentication controls;

8.7.4. Immediate removal from network access for employees, agents, and subcontractors who leave employment or whose contractual relationships terminate;

8.7.5. Firewalls are installed and reviewed;

8.7.6. Logs are continuously monitored for threats and vulnerabilities at all points of entry to organization’s network;

8.7.7. All organizational technology infrastructure and devices maintain continuously updated security software to safeguard against malware and other technology threats;

https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization

Description: ASRS Cobra Administration Services

8.7.8. Employees and subcontractors receive data security awareness training;

8.7.9. Organization has a disaster recovery plan which is tested on a periodic basis;

8.7.10. Technology infrastructure has an effective and periodically tested continuity of business operations plan and process; and

8.7.11. Network outages or other security events are reported as soon as possible but no later than 24 hours to the agency’s Chief Information Security Officer or other designated security officer as indicated by the Contract when the affected system contains data or performs services related to the performance of this Contract.

Personnel Security and Background Checks

8.8.1. The Contractor’s current and subsequent personnel and all tiers of subcontractors shall comply with the information security and data privacy requirements of this Contract.

8.8.2. Notwithstanding any additional security requirements in the Scope of Work, as deemed necessary by the ASRS, Contractor’s personnel or subcontractors with access to confidential information or sensitive data and/or infrastructure may be subject to background checks at the Contractor’s expense, including but not limited to fingerprint criminal background clearance prior to beginning performance of the Contract and periodically thereafter as may be required by the ASRS to comply with law or agency policy, standard or procedure.

Remote Access

To the extent the Contractor or any subcontractors is authorized by ASRS to and must perform work that requires remote access to a network containing ASRS information or data, Contractor shall ensure that such remote access

(i) is obtained through a secure connection, (ii) is restricted to authorized users, (iii) is used solely for the purposes of fulfilling Contractor’s obligations, (iv) shall not permit access to Contractor’s computer system or browser capabilities, and (v) shall not permit printing/faxing/copying or other reproduction or the ability to retain data or application software data on Contractor’s computer or network.

Access Privileging and Authorization Requirements

8.10.1. Contractor’s access to ASRS facilities and resources shall be properly authorized by ASRS personnel, based on business need and will be restricted to least possible privilege. Upon approval of access privileges to ASRS systems and facilities, the Contractor shall maintain strict adherence to the ASRS’s and State’s information security and privacy policies, standards, and procedures.

8.10.2. Upon removal of an employee, agent, or officer, Contractor shall immediately revoke logical and physical access to a device, network, system, operating infrastructure or physical location containing the State’s information or proprietary property or the ability to access the ASRS’s network by an employee removed by the Contractor.

Subcontracts and Agents Contractor shall require all tiers of subcontractors or agents who perform work under this Contract to provide a written and signed assurance to abide by and comply with the information security and data privacy provisions of this Contract.

State of Arizona

UNIFORM TERMS AND CONDITIONS

Contract No.: CTR062097 Description: ASRS Cobra Administration Services

As Issued by the State of Arizona State Procurement Office

(Updated: January, 28 2020)

1. DEFINITION OF TERMS

As used in the Contract, the terms listed below are defined as follows:

1.1. “Attachment” means any item the Solicitation requires the Offeror to submit as part of the Offer.

1.2. “Contract” means the combination of the Solicitation, including the Uniform and Special Instructions to Offerors, the Uniform and Special Terms and Conditions, and the Specifications and Statement or Scope of Work; the Offer and any Best and Final Offers; and any Solicitation Amendments or Contract Amendments.

1.3. “Contract Amendment” means a written document signed by the Procurement Officer that is issued for the purpose of making changes in the Contract.

1.4.