CTR075401_Contract.pdf

ATTACHMENT A

Offer and Acceptance

REQUEST FOR PROPOSAL

No.: BPM005969

ARIZONA DEPARTMENT OF

HEALTH SERVICES

150 North 18th Avenue, Suite 530 Phoenix, AZ 85007

Arizona State Trauma Registry

TO THE STATE OF ARIZONA:

The Undersigned hereby offers and agrees to furnish the material, service or construction in compliance with all terms, conditions, specifications and amendments in the Solicitation and any written exceptions in the offer.

Company Name Signature of Person Authorized to Sign Offer

Address Printed Name

City State Zip Title

UEI Number Phone & Email Address

By signature in the Offer section above, the Offeror certifies:

1. The submission of the Offer did not involve collusion or other anticompetitive practices.

2. The Offeror shall not discriminate against any employee or applicant for employment in violation of Federal Executive Order 11246, State Executive

Order 2009-9 or A.R.S.

3. The Offeror has not given, offered to give, nor intends to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with the submitted offer. Failure to provide a valid signature affirming the stipulations required by this clause shall result in rejection of the offer. Signing the offer with a false statement shall void the offer, any resulting contract and may be subject to legal remedies provided by law.

4. The Offeror certifies that the above referenced organization IS/ IS NOT a small business with less than 100 employees or has gross revenues of $4 million or less.

ACCEPTANCE OF OFFER

The Offer is hereby accepted.

The Contractor is now bound to sell the materials or services listed by the attached contract and based upon the solicitation, including all terms, conditions, specifications, amendments, etc., and the Contractor’s Offer as accepted by the State.

This Contract shall henceforth be referred to as Contract No.:

The effective date of the Contract is

The Contractor is cautioned not to commence any billable work or to provide any material or service under this contract until Contractor receives purchase order, contact release document or written notice to proceed.

State of Arizona Awarded this _ day of 2

Chief Procurement Officer or Designee

ESO Solutions, Inc.

11500 Alterra Parkway, Ste 100 Robert Munden

Austin Texas 78758 Chief Legal Officer

36-4566209 (FEIN) 512.643.0859 | robert.munden@eso.com

X

CTR075401

Upon Signature

16th January

Gina Corwin Digitally signed by Gina Corwin Date: 2025.01.16 12:11:25 -07'00'

PART ONE (1) - Scope of Services

ARIZONA

DEPARTMENT OF

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

Arizona State Trauma Registry System Phoenix, Arizona 85007

SCOPE OF SERVICES

1. BACKGROUND

1.1 Arizona Revised Statutes (A.R.S.) §36-2222 mandates a state trauma registry and the submission of data to the registry by trauma centers.

1.2 The Bureau of Emergency Medical Services & Trauma System is responsible for establishing, coordinating and administering a statewide system of emergency medical services, trauma care and a trauma registry.

1.3 This is accomplished through a variety of collaborative processes including education, quality improvement and protocol development.

1.4 It is the Mission of the Bureau to protect the health and safety of people requiring emergency medical services; promote improvements in Arizona's EMS and trauma system through research and education of the public and EMS providers; and provide courteous, professional and responsible service to the public and EMS providers.

1.5 https://www.azdhs.gov/preparedness/emergency-medical-services-trauma-system/index.php#trauma-programs-home

2. OBJECTIVES

The Arizona Department of Health Services (ADHS) Bureau of Emergency Medical Services and Trauma Systems (BEMSTS) desires to purchase trauma registry software for use by ADHS, designated trauma centers, and other Arizona health care institutions voluntarily participating in the Arizona State Trauma Registry (ASTR). The ASTR currently consists of forty-seven (47) state designated trauma centers with the expectation of adding more in the future. There are fourteen (14) level one (1) trauma centers, six (6) level three (3) trauma centers, and twenty-seven (27) level four (4) trauma centers. Level one (1) and three (3) trauma centers submit a “full: data set and level four (4) trauma centers submit a “reduced” data set. Additionally, ADHS requires technical support from the Contractor for the ASTR, designated trauma centers, and other Arizona health care institutions participating in the

ASTR.

3. SCOPE OF SERVICE

The Contractor shall:

3.1 Provide system components that support the quality and maintenance of the ASTR.

3.2 Provide technical assistance to trauma facilities to collect required data elements.

3.3 Provide technical services and support to ADHS and ASTR participating healthcare institutions.

3.4 Provide a functional Patient Registry Web-based Software that is National Trauma Data Bank (NTDB) compliant.

3.5 Assist ADHS in creating each ASTR participating healthcare institution’s unique view screen setup, setting the securities properly, adding users, and performing other requisite tasks.

http://www.azdhs.gov/preparedness/emergency-medical-services-trauma-

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

3.6 Provide, maintain, and upgrade the system data validator for the web-based software.

3.7 Provide a Quality Assurance (QA) view screen page for the ASTR.

3.8 Assist third-party vendors with successfully importing and exporting National Trauma Data Standards (NTDS) and State data.

3.9 Provide Abbreviated Injury Scale (AIS) to International Classification of Disease (ICD) ten (10) translational software.

3.10 Adhere to data backup and entry as directed in Section 5.8 of this document.

3.11 Provide customization development options as directed in Section 5.9 of this document.

3.12 Provide import and record linking capabilities as directed in Section 5.13 of this document.

3.13 Provide plans as directed in Section 5.14 of this document.

3.14 Provide AIS coding capabilities for all participating ASTR facilities.

4. REQUIREMENTS

The Contractor shall:

4.1 Maintain updated security requirements as determined by ADHS Information Technology Services (ITS) including, but not limited to, the following:

4.1.1 Injection - Injection flaws, such as Structured Query Language (SQL), Operating System (OS), and Lightweight Directory Access Protocol (LDAP) injection occur when untrusted data is sent to an interpreter as part of a command or query the attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

4.1.2 Broken Authentication and Session Management - Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users' identities.

4.1.3 Cross-Site Scripting (XSS) - XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

4.1.4 Insecure Direct Object References - A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.

4.1.5 Security Misconfiguration - Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530 platform Secure settings should be defined, implemented, and maintained, as defaults are often insecure Additionally, software must be kept up to date.

4.1.6 Sensitive Data Exposure - Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.

4.1.7 Missing Function Level Access Control - Most web applications verify function level access rights before making that functionality visible in the UL However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.

4.1.8 Cross-Site Request Forgery (CSRF) - A CSRF attack forces a logged-on victim's browser to send a forged HTTP request, including the victim's session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim's browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

4.1.9 Using Components with Known Vulnerabilities - Components, such as libraries, frameworks, and other software modules, almost always run with full privileges If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts.

4.1.10 Invalidated Redirects and Forwards - Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

4.1.11 If not already certified, Contractor must be able to pass AZRAMP certification.

5. TASKS

The Contractor Shall:

5.1 Provide technical service and support as follows:

5.1.1 Determine, upon request by ADHS or an ASTR participating healthcare institution, if technical issues originate from the Contractor’s software.

5.1.1.1 Both the Contractor and ADHS will both cooperate and assist one another in identifying the cause and origin of issues and restoring the ASTR to optimal functionality.

5.1.2 Promptly rectify and restore the ASTR to designed functionality if the issue is deemed to have originated from the Contractor’s software.

5.1.3 If the issue is deemed to originate from ADHS or ASTR participating healthcare institution owned software, it will be the sole responsibility of the owning agency to rectify the issue and restore the ASTR to optimal functionality.

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

5.1.4 Notify ADHS, via email, of problems that occur during routine maintenance of servers, routers, etc., including problems accomplishing backups, within one (1) hour of the onset of the problem.

5.1.5 Notify ADHS, via email, of functionality, configuration, or compliance issues and the actions that will be taken to resolve them within one (1) hour of the onset of the issues.

5.1.6 Notify ADHS, via email, an estimation of the completion time and regular status updates regarding product defects that are being corrected.

5.1.7 Notify ADHS, via email, a notice of non-emergency, vendor-controlled changes.

5.1.8 Provide a schedule of installation, testing, and implementation.

5.2 Provide a functional Patient Registry Web-based Software as follows:

5.2.1 The Patient Registry must be NTDB compliant.

5.2.2 The Patient Registry must adhere to and maintain the requirements for ADHS security data entry access and storage for each healthcare institution site.

5.2.3 The Patient Registry must maintain functionality to report across sites and regions across the State with the option to add healthcare institutions at no additional charge upon written request by ADHS.

5.2.4 The Patient Registry must provide the ability for State trauma facilities to export data to the NTDB.

All other exports from the ASTR system require a signed Data Use Agreement.

5.2.5 The ASTR shall be able to accommodate an unlimited number of users accessing the web-based application.

5.2.6 The ASTR shall allow for auto-fill of Injury Severity Score (ISS), Abbreviated Injury Score (AIS), and other fields as requested by the State or participating facilities.

5.3 Assist ADHS with the following ASTR tasks:

5.3.1 Creating unique-view screen setups for current ASTR participating healthcare institutions.

5.3.2 Properly setting site securities.

5.3.3 Adding and removing users.

5.3.4 Adding sites for new ASTR participating healthcare institutions at no additional cost, with the exception of AIS licensing fees.

5.3.5 Other tasks deemed necessary by ADHS.

5.4 Provide, maintain, and upgrade the system data validator for the web-based software as follows:

5.4.1 The system data validator shall be NTDB compliant and must meet current and future ASTR data needs.

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

5.4.2 The system data validator shall be capable of validating trauma records generated by healthcare institutions that collect and submit the full ASTR dataset both at the originating institution and

ADHS.

5.4.3 The system data validator shall be capable of validating trauma records generated by healthcare institutions that collect and submit the reduced ASTR dataset both at the originating institution and ADHS without generating validation errors resulting solely from the reduced ASTR dataset process.

5.4.4 Validation rules shall be translated into an XML file (schema) to allow third-party vendors to successfully submit data to ASTR standards.

5.4.5 A schematron (XML) file shall be produces that translates the newest validation rules and complies with ASTR standards.

5.5 Provide a QA view screen page for the ASTR that meets the following:

5.5.1 The view screen page shall be viewable by all ASTR current and future participating healthcare institutions.

5.5.2 The specific content and format of the respective QA view screen for the ASTR and each participating healthcare institutions will be mutually agreed upon by ADHS, ASTR participating healthcare institutions, and the Contractor.

5.6 Assist third-party vendors with successfully importing and exporting National Trauma Data Standards

(NTDS) and State data.

5.7 Provide AIS to International Classification of Diseases,10th Revision (ICD 10) translational software, including:

5.7.1 The ability to generate an Injury Severity Score (ISS) from AIS code to ICD 10 code mapping.

5.7.2 This software shall be utilized as requested by ADHS.

5.8 Adhere to the following data backup and entry standards:

5.8.1 Maintain legacy data previously entered.

5.8.2 Migrate legacy data contained in the current ASTR site from 2008 through the completion of the new ASTR at no additional charge.

5.8.3 Maintain quarterly backup file of the Patient Registry database using the SQL server backup utility.

ADHS reserves the right to request a backup file more frequently, as necessary.

5.8.4 The Department anticipates that this shall be completed within the first twelve (12) months of the contract.

5.9 Provide the custom development of the registry product to increase effectiveness and efficiency of the system for all system users, including:

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

5.9.1 Provide all current and new ASTR participating healthcare institutions general customization support services for new data elements or modifying existing fields and picklists as requested by

ADHS.

5.9.2 Reviewing ADHS proposed custom development specifications to determine feasibility.

5.9.3 Preparing a custom development work order based on the proposed custom development specifications received from ADHS.

5.9.4 Facilitating a kick-off meeting with ADHS.

5.9.5 Alpha testing customizations under development in non-production environments.

5.9.6 Beta testing customizations in production environments, including a demonstration of the tested custom development for final deployment by ADHS.

5.9.7 Providing a schedule for the release date of a custom project.

5.10 Provide two (2) one (1) day on-site training sessions, as requested by ADHS. Trainings shall have a virtual option for remote attendees.

5.11 Provide, manage, and host ten (10) hours of web-based training, annually, as requested by ADHS.

5.12 Provide ASTR and participating facilities with report-running software that has the ability to run reports, build populations, and develop analytical reports utilizing data from each individual facility.

5.13 Provide the following import and record linking capabilities:

5.13.1 Provide participating facilities with the ability to import financial data into the total hospital charges, total hospital reimbursements, and primary and secondary payor fields.

5.13.2 ADHS anticipates enhancements for regulatory compliance as well as future changes to the National Data Standards and Policy, including, but not limited to, the ability to link data between the NTDB and National Emergency Medical Services Information Systems (NEMSIS) compliant systems. All data transfers must be in XML format.

5.14 Provide the following plans upon Contract award:

5.14.1 Statewide Implementation Plan, to include:

5.14.1.1 A completion date not later than June 30, 2025.

5.14.1.2 Detailed schedule indicating the date each client site will implement the new system.

5.14.1.3 Guidelines and instructions for each client site.

5.14.1.4 A realistic and achievable timeline and implementation methodology that includes:

5.14.1.4.1 All aspects of implementing a statewide EMS data collection and reporting tool.

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

5.14.1.4.2 A “go live” status that includes infrastructure requirements, database establishment, distribution and access of software, roll out, and communication of change management.

5.14.1.4.3 The plan shall identify what resources are to be provided by the

Contractor and what resources will be required by AHDS.

5.14.2 Training Plan, to include:

5.14.2.1 A comprehensive training program, manual, and PowerPoint presentation that shall be presented and turned over to ADHS staff to use in a Train-the-Trainer environment.

5.14.2.2 ADHS staff will be allowed to duplicate and distribute the training plan without additional charge, provided all copyrights are not infringed.

5.14.2.3 The training plan shall be easy to use and understand.

5.14.2.4 As agreed and accepted, Exception Letter dated September 25, 2024: ESO uses ODL (On Demand Learning), not Powerpoint presentations for training.

5.14.3 Project Work Plan, to include:

5.14.3.1 Significant work tasks, steps, timeframes, QA checkpoints, and deliverables required to complete the project.

5.14.3.2 Tasks for the entire project life-cycle including, but not limited to, planning, detailed requirements gathering, analysis, design, development, modification, installation, testing, revisions, conversion, training, system rollout, and post-production support.

5.14.3.3 The mutually agreed upon final project plan for each phase must be completed and signed within thirty (30) days following Contract award. Failure to arrive at a mutually agreed upon final project plan may be cause for Contract cancellation.

5.14.3.4 As agreed and accepted, Exception Letter dated September 25, 2024: ESO does not typically commit to project plan within thirty (30) days as plans are dependent on variable factors. ESO will provide a milestone view.

5.14.3.5 The final project plan will become an Amendment to the Contract. Any changes to the final plan will require the signature of both ADHS and the Contractor.

5.15 Provide a Project Manager (PM) who shall, at a minimum:

5.15.1 Serve as a primary day-to-day contact with ADHS.

5.15.2 Attend, lead, and prepare materials for meetings, as requested by ADHS.

5.15.3 Ensure all necessary operational components are completed prior to implementation.

5.15.4 Designate an alternate contact for when the PM is unavailable.

5.15.5 Assure that the Contractor, as well as any subcontractors, fulfills all duties and responsibilities and delivers all required documents under the awarded Contract.

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

6. DOCUMENTS/REFERENCES

6.1 ASTR Data Dictionary –

https://www.azdhs.gov/documents/preparedness/emergency-medical-services-trauma-system/data/ASTR/astr-data-dictionary-full.pdf?v=20240125

7. DELIVERABLES

The Contractor shall submit to ADHS:

7.1 A finished registry product, as agreed upon by ADHS, by June 30, 2025.

7.2 An annual ASTR update for both full and reduced ASTR datasets and the Trauma One Validator consistent with the annual NTDB update. This update shall be completed within two (2) months of the NTDB update.

7.3 A Certificate of Insurance (COI) in conformance with the Special Terms and Conditions within ten (10) business days of Contract award and annually throughout the life of the contract. A Purchase Order will not be issued without a current and valid COI on file.

7.4 Thirty (30) days from Contract award, a Statewide Implementation Plan as directed in Section 5.14 of this document.

7.5 Thirty (30) days from Contract award, a Project Work Plan as directed in Section 5.14.3 of this document.

7.6 Invoices shall be submitted quarterly for the initial year of the contract along with documents showing progress made on the Statewide Implementation Plan. Invoices for any subsequent contract years, may be submitted annually and no later than sixty (60) days from the beginning of the state fiscal year.

8. NOTICES, CORRESPONDENCE REPORTS AND INVOICES

8.1 All notices, correspondences, and reports from the Contractor to ADHS shall be sent electronically via email to:

Arizona Department of Health Services, Bureau of Emergency Medical Services and Trauma System Attn: Julia Vinton and Carissa Wilson 150 North 18th Avenue, Suite 540 Phoenix, Arizona 85007 Phone: (602) 364-3173 E-mail: Julia.vinton@azdhs.gov and carissa.wilson@azdhs.gov

8.2 All invoices and CERs shall be submitted to: invoices@azdhs.gov with Julia.vinton@azdhs.gov and carissa.wilson@azdhs.gov cc’d.

8.3 AUTOMATED CLEARING HOUSE. ADHS may pay invoices for some or all Orders through an Automated Clearing House (ACH). In order to receive payments in this manner, the Contractor must complete an ACH Vendor Authorization Form (form GAO-618) within 30 (thirty) days after the effective date of the Contract. The form is available online at: https://gao.az.gov/sites/default/files/GAO- 618%20ACH%20Authorization%20Form%20101019.pdf https://www.azdhs.gov/documents/preparedness/emergency-medical-services-trauma-system/data/ASTR/astr-data-dictionary-full.pdf?v=20240125 https://www.azdhs.gov/documents/preparedness/emergency-medical-services-trauma-system/data/ASTR/astr-data-dictionary-full.pdf?v=20240125 mailto:Julia.vinton@azdhs.gov mailto:carissa.wilson@azdhs.gov mailto:invoices@azdhs.gov mailto:Julia.vinton@azdhs.gov mailto:carissa.wilson@azdhs.gov https://gao.az.gov/sites/default/files/GAO-618%20ACH%20Authorization%20Form%20101019.pdf https://gao.az.gov/sites/default/files/GAO-618%20ACH%20Authorization%20Form%20101019.pdf

REQUEST FOR PROPOSAL No.: BPM005969

HEALTH SERVICES

150 N. 18th Avenue, Suite 530

8.3.1 ACH Vendor Authorization Form shall be emailed to Vendor.Payautomation@azdoa.gov

8.4 All notices, and correspondences from ADHS to the Contractor will be sent electronically via email to the individual(s) notated on Attachment B.

mailto:Vendor.Payautomation@azdoa.gov

PART ONE (1) - Special Terms and Conditions

ARIZONA DEPARTMENT

OF HEALTH SERVICES

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

SPECIAL TERMS AND CONDITIONS

1. PURPOSE

Pursuant to provisions of the Arizona Procurement Code, A.R.S. 41-2501 Et Seq., the State of Arizona, ADHS intend to establish a Contract for the materials or services as listed herein.

2. TERM OF CONTRACT

The term of any resultant Contract shall commence upon final signature and shall continue for a period of two(2) years thereafter, unless terminated, canceled, or extended as otherwise provided herein.

3. CONTRACT EXTENSIONS 5 YEAR MAXIMUM

The Contract term shall begin as specified in the section Two (2) above, and shall continue for a period of two (2 ) years subject to additional successive periods of twelve (12) months per extension with a maximum aggregate including all extensions not to exceed five (5) years.

4. CONTRACT TYPE

X Fixed Price

5. LICENSES

The Contractor shall maintain in current status, all federal, state and local licenses and permits required for the operation of the business conducted by the Contractor.

6. KEY PERSONNEL

It is essential that the Contractor provide adequate experienced personnel, capable of and devoted to the successful accomplishment of work to be performed under this Contract. The Contractor must agree to assign specific individuals to the key positions.

6.1 The Contractor agrees that, once assigned to work under this Contract, key personnel shall not be removed or replaced without written notice to the State. Such notice shall be given thirty (30) days prior to the reassignment or personnel’s last day assigned to the Contract;

6.2 If key personnel are not available for work under this Contract for a continuous period exceeding thirty (30) calendar days, or are expected to devote substantially less effort to the work than initially anticipated, the Contractor shall immediately notify the State, and shall, subject to the concurrence of the State, replace such personnel with personnel of substantially equal ability and qualifications; and

6.3 The State Agency reserves the right to review resumes and participate in interviews for the hiring of any staff assigned to this Contract. Further, the State Agency reserves the right to deny or refuse any offered replacement personnel by the Planning Contractor.

6.4 As agreed and accepted, Exception Letter dated September 25, 2024: ESO agrees it shall attempt to involve the State in any decisions to remove key personnel in advance when possible. The State shall have the option to approve replacement personnel.

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

7. POINT OF CONTACT

7.1 It is essential that the Contractor provide a Point of Contact, capable of and devoted to the successful accomplishment of work to be performed under this Contract. The Contractor must agree to assign a specific individual to serve as a primary day-to-day contact.

7.2 The Contractor agrees that, once assigned to work under this Contract, the Point of Contact shall not be removed or replaced without written notice to the State.

7.3 As agreed and accepted, Exception Letter dated September 25, 2024: ESO agrees it shall attempt to involve the State in any decisions to remove key personnel in advance when possible. The State shall have the option to approve replacement personnel.

7.4 If the Point of Contact is not available for work under this Contract for a continuous period exceeding thirty

(30) calendar days, or is expected to devote substantially less effort to the work than initially anticipated, the Contractor shall immediately notify the State, and shall, subject to the concurrence of the State, replace such personnel with personnel of substantially equal ability and qualifications.

8. MOST FAVORED CUSTOMER

Throughout the life of the Contract, the Contractor shall always offer the State the Most-Favored Customer or Highest Tier Customer price discount rate on contracted product(s) concurrent with a published price discount rate made to other Customers (both Private and Public sectors). The Contractor shall extend to the State that most-favored customer or Highest Tier Customer price discount on all new product lines during the life of the contract.

9. PRICE INCREASE

The Department may review a fully documented request for a price increase only after the Contract has been in effect for twenty-four (24) months. A price increase adjustment shall only be considered at the time of a Contract renewal and shall be a factor in the renewal review process. The Department shall determine whether the requested price increase or an alternate option is in the best interest of the State. The price increase adjustment, if approved, will be effective upon the effective date of the Contract renewal.

10. PRICE REDUCTION

A price reduction may be offered at any time during the term of the contract and shall become effective upon issuance of a contract amendment.

11. NON-EXCLUSIVE CONTRACT

Any contract resulting from this solicitation shall be awarded with the understanding and agreement that it is for the sole convenience of the State of Arizona. The State reserves the right to obtain like goods or services from another source when necessary, or when determined to be in the best interest of the State.

12. VOLUME OF WORK

The ADHS does not guarantee a specific amount of work either for the life of the Contract or on an annual basis.

13. INFORMATION DISCLOSURE

The Contractor shall establish and maintain procedures and controls that are acceptable to the State for the purpose of assuring that no information contained in its records or obtained from the state or from others in carrying out its functions under the Contract shall be used or disclosed by it, its agents, officers, or employees, except as required

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

Phoenix, Arizona 85007

Arizona State Trauma Registry System to efficiently perform duties under the Contract. Persons requesting such information should be referred to the State.

The Contractor also agrees that any information pertaining to individual persons shall not be divulged other than to employees or officers of the Contractor as needed for the performance of duties under the Contract, unless otherwise agreed to in writing by the State.

12. EMPLOYEES OF THE CONTRACTOR

All employees of the Contractor employed in the performance of work under the Contract shall be considered employees of the Contractor at all times, and not employees of the ADHS or the State. The Contractor shall comply with the Social Security Act, Workman’s Compensation laws and Unemployment laws of the State of Arizona and all State, local and Federal legislation relevant to the Contractor’s business.

13. ORDER PROCESS

The award of a contract shall be in accordance with the Arizona Procurement Code. Any attempt to represent any material and/or service not specifically awarded as being under contract with ADHS is a violation of the Contract and the Arizona Procurement Code. Any such action is subject to the legal and contractual remedies available to the state inclusive of, but not limited to, Contract cancellation, suspension, and/or debarment of the Contractor.

14. CONTRACTOR PERFORMANCE REPORTS

Program management shall document Contractor performance, both exemplary and needing improvements where corrective action is needed or desired. Copies of corrective action reports will be forwarded to the ADHS Procurement Office for review and any necessary follow-up. The Procurement Office may contact the Contractor upon receipt of the report and may request corrective action. The Procurement Office shall discuss the Contractor’s suggested corrective action plan with the Program for approval of the plan prior to sending it to the Contractor.

15. PAYMENT PROCEDURES

15.1 ADHS accounting will not make payments to any Entity, Group or individual other than the Contractor with the Federal Employer Identification (FEI) Number identified in the Contract. Contractor invoices requesting payment to any Entity, Group or individual other than the contractually specified Contractor shall be returned to the Contractor for correction;

15.2 The Contractor shall review and insure that the invoices for services provided show the correct Contractor name prior to sending them to the ADHS Accounting Office for payment; and

15.3 If the Contractor Name and FEI Number change, the Contractor must complete an “Assignment and Agreement” form transferring contract rights and responsibilities to the new Contractor. ADHS must indicate consent on the form. A written Contract Amendment must be signed by both parties and a new W-9 form must be submitted by the new Contractor and entered into the system prior to any payments being made to the new Contractor;

16. FINANCIAL MANAGEMENT

16.1 For all contracts, the practices, procedures, and standards specified in the State of Arizona Accounting

Manual https://gao.az.gov/publications/SAAM/ and required by the Arizona Department of Health Services and Guidance for Federal Grant Award Management Manual shall be used by the Contractor in the management of contract funds and by the ADHS when performing a contract audit.

https://azdhs.gov/documents/operations/financial-services/bluebook-2018.pdf The contractor also agrees to abide by the rules as outlined by 2 CFR 200 Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards. Funds collected by the Contractor in the form of fees, donations, and/or charges for the delivery of these contract services shall be accounted for in a separate fund.

https://gao.az.gov/publications/SAAM/ https://azdhs.gov/documents/operations/financial-services/bluebook-2018.pdf

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

Phoenix, Arizona 85007 https://ecfr.io/Title-02/cfr200_main;

16.2 State Funding Contractors receiving state funds under this Contract shall comply with the certified

Compliance provisions of A.R.S. § 35-181.03; and

16.3 Federal Funding Contractors receiving federal funds under this contract shall comply with the certified finance and compliance audit provision of the Office of Management and Budget (OMB) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200), if applicable. The federal financial assistance information shall be stated in a Change Order or Purchase Order.

17. INSPECTION AND ACCEPTANCE

All services, data, and required reports are subject to final inspection, review, evaluation, and acceptance by the ADHS. The ADHS may withhold payment for services that are deemed to not meet contract standards.

18. AUTHORIZATION FOR SERVICES

Authorization for purchase of services under this Contract shall be made only upon ADHS issuance of a Purchase Order that is signed by an authorized agent. The Purchase Order will indicate the Contract number and the dollar amount of funds authorized. The Contractor shall only be authorized to perform services up to the amount on the Purchase Order. ADHS shall not have any legal obligation to pay for services in excess of the amount indicated on the Purchase Order. No further obligation for payment shall exist on behalf of ADHS unless a) the Purchase Order is changed or modified with an official ADHS Procurement Change Order, and/or b) an additional Purchase Order is issued for purchase of services under this Contract.

19. INDEMNIFICATION CLAUSE

19.1 To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of

Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as "Indemnitee") from and against any and all claims, actions, liabilities, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of Contractor's directors, officers, agents, employees, volunteers or subcontractors. This indemnity includes any claim or amount arising or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to conform to any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all Claims. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable. This indemnification will survive the termination of the above listed contract with the Contractor; and

19.2 This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona;

20. INSURANCE REQUIREMENTS

20.1 Contractor and subcontractors shall procure and maintain, until all of their obligations have been discharged, including any warranty periods under this Contract, insurance against claims for injury to persons or damage to property arising from, or in connection with, the performance of the work hereunder https://ecfr.io/Title-02/cfr200_main

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530 by the Contractor, its agents, representatives, employees or subcontractors ;

20.2 The Insurance Requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State of Arizona in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that arise out of the performance of the work under this Contract by the Contractor, its agents, representatives, employees or subcontractors, and the Contractor is free to purchase additional insurance ;

20.3 Minimum Scope and Limits of Insurance

Contractor shall provide coverage with limits of liability not less than those stated below.

20.3.1 Commercial General Liability (CGL) – Occurrence Form, Policy shall include bodily injury, property damage, and broad form contractual liability coverage.

20.3.1.1 General Aggregate $2,000,000.00

20.3.1.1.1 Products – Completed Operations Aggregate $1,000,000.00

20.3.1.1.2 Personal and Advertising Injury $1,000,000.00

20.3.1.1.3 Damage to Rented Premises $ 50,000.00

20.3.1.1.4 Each Occurrence $1,000,000.00

20.3.1.2 Policy shall be endorsed, as required by this written agreement, to include the

State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by or on behalf of the Contractor.

20.3.1.3 Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

20.3.2 Business Automobile Liability

20.3.2.1 Bodily injury and Property Damage for any owned, hired, and/or non-owned automobiles used in the performance of this contract.

20.3.2.1.1 To Combined Single Limit (CSL) $1,000,000.00

20.3.2.2 Policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to liability arising out of the activities performed by, or on behalf of, the Contractor involving automobiles owned, hired and/or non-owned by the Contractor.

20.3.2.3 Policy shall contain a waiver of subrogation endorsement as required by this written agreement in favor of the State of Arizona, and its departments, agencies, boards, REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530 commissions, universities, officers, officials, agents and employees for losses arising

20.3.3 Workers; Compensation and Employers’ Liability

20.3.3.1 Workers Compensation Statutory

20.3.3.2 Employers’ Liability

20.3.3.2.1 Each accident $1,000,000.00

20.3.3.2.2 Disease – Each employee $1,000,000.00

20.3.3.2.3 Disease – Policy Limit $1,000,000.00

20.3.3.3 Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents and employees for losses arising

20.3.3.4 This requirement shall not apply to each Contractor or subcontractor that is exempt under A.R.S. § 23.901 and when such Contractor or subcontractor executes the appropriate waiver form (Sole Proprietor or Independent Contractor).

20.3.4 Technology Errors & Omissions Insurance

20.3.4.1.1 Each Claim $2,000,000.00

20.3.4.1.2 Annual Aggregate $2,000,000.00

20.3.4.2 Such insurance shall cover any, and all errors, omissions, or negligent acts in the delivery of products, services, and/or licensed programs under this contract.

20.3.4.3 Coverage shall include copyright infringement, infringement of trade dress, domain name, title or slogan.

20.3.4.4 In the event that the Tech E&O insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained or an extended discovery period will be exercised for a period of two (2) years, beginning at the time work under this Contract is completed.

20.3.5 Network Security (Cyber) and Privacy Liability

20.3.5.1.1 Each Claim $2,000,000.00

20.3.5.1.2 Aggregate $2,000,000.00

20.3.5.2 Such insurance shall include, but not be limited to, coverage for third party claims and losses with respect to network risks (such as data breaches, unauthorized

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530 access or use, ID theft, theft of data) and invasion of privacy regardless of the type of media involved in the loss of private information, crisis management and identity theft response costs. This should also include breach notification costs, credit remediation and credit monitoring, defense and claims expenses, regulatory defense costs plus fines and penalties, cyber extortion, computer program and electronic data restoration expenses coverage (data asset protection), network business interruption, computer fraud coverage, and funds transfer loss.

20.3.5.3 In the event that the Network Security and Privacy Liability insurance required by this

Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained, or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

20.3.5.4 The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to vicarious liability of the insured arising out of the activities performed by or on behalf of the Contractor.

20.3.5.5 Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

20.4 Additional Insurance Requirements

The policies shall include, or be endorsed to include, as required by this written agreement, the following provisions:

20.4.1 The Contractor’s policies as applicable, shall stipulate that the insurance afforded the Contractor shall be primary and that any insurance carried by the Department, its agents, officials, employees or the State of Arizona shall be excess and not contributory insurance, as provided by A.R.S. § 41-621 (E).

20.4.2 Insurance provided by the Contractor shall not limit the Contractor’s liability assumed under the indemnification provisions of this Contract.

20.5 Notice of Cancellation

Applicable to all insurance policies required within the Insurance Requirements of this Contract, Contractor’s insurance shall not be permitted to expire, be suspended, be canceled, or be materially changed for any reason without thirty (30) days prior written notice to the State of Arizona. Within two (2) business days of receipt, Contractor must provide notice to the State of Arizona if they receive notice of a policy that has been or will be suspended, canceled, materially changed for any reason, has expired, or will be expiring. Such notice shall be sent directly to the Department and shall be mailed, emailed, or hand delivered to Arizona Department of Health Services, 150 N 18th Ave, Suite 260, Phoenix, AZ 85007.

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

20.6 Acceptability of Insurers

Contractor’s insurance shall be placed with companies licensed in the State of Arizona or hold approved non-admitted status on the Arizona Department of Insurance List of Qualified Unauthorized Insurers.

Insurers shall have an “A.M. Best” rating of not less than A- VII. The State of Arizona in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

20.7 Verification of Coverage

Contractor shall furnish the State of Arizona with certificates of insurance (COI) (valid ACORD form or equivalent approved by the State of Arizona) evidencing that Contractor has the insurance as required by this Contract. An authorized representative of the insurer shall sign the certificates.

20.7.1 All such certificates of insurance and policy endorsements must be received by the State before work commences. The State’s receipt of any certificates of insurance or policy endorsements that do not comply with this written agreement shall not waive or otherwise affect the requirements of this agreement,

20.7.2 Each insurance policy required by this Contract must be in effect at, or prior to, commencement of work under this Contract. Failure to maintain the insurance policies as required by this Contract, or to provide evidence of renewal, is a material breach of contract, and

20.7.3 All certificates required by this Contract shall be sent directly to the Department. The State of

Arizona project/contract number and project description shall be noted on the certificate of insurance. The State of Arizona reserves the right to require complete copies of all insurance policies required by this Contract at any time,

20.8 Subcontractors

Contractor’s certificate(s) shall include all subcontractors as insureds under its policies or Contractor shall be responsible for ensuring and/or verifying that all subcontractors have valid and collectable insurance as evidenced by the certificates of insurance and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum Insurance Requirements identified above. The Department reserves the right to require, at any time throughout the life of this contract, proof from the Contractor that its subcontractors have the required coverage.

20.9 Approval and Modifications

The Contracting Agency, in consultation with State Risk, reserves the right to review or make modifications to the insurance limits, required coverages, or endorsements throughout the life of this contract, as deemed necessary. Such action will not require a formal Contract amendment but may be made by administrative action.

20.10 Exceptions

In the event the Contractor or subcontractor(s) is/are a public entity, then the Insurance Requirements shall not apply. Such public entity shall provide a certificate of self-insurance. If the Contractor or subcontractor(s) is/are a State of Arizona agency, board, commission, or university, none of the above shall apply.

REQUEST FOR PROPOSAL No.: BPM005969 150 North 18th Ave, Suite 530

21. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996

21.1 If applicable, the Contractor warrants that it is familiar with the requirements of HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) of 2009, and accompanying regulations and will comply with all applicable HIPAA requirements in the course of this Contract. Contractor warrants that it will cooperate with the Arizona Department of Health Services (ADHS) in the course of performance of the Contract so that both ADHS and Contractor will be in compliance with HIPAA, including cooperation and coordination with the Arizona Department of Administration-Arizona Strategic Enterprise Technology (ADOA-ASET) Office, the ADOA-ASET Arizona State Chief Information Security Officer and HIPAA Coordinator and other compliance officials required by HIPAA and its regulations. Contractor will sign any documents that are reasonably necessary to keep ADHS and Contractor in compliance with HIPAA, including, but not limited to, business associate agreements; and

21.2 If applicable, and requested by the ADHS Procurement Office, Contractor agrees to sign a “Pledge To Protect Confidential Information” and to abide by the statements addressing the creation, use and disclosure of confidential information, including information designated as protected health information and all other confidential or sensitive information as defined in policy.