Enclosure_1_-_Standard_Agreement_Template_and_Attachments_(1).pdf

Agreement No. ____________________

AGREEMENT BETWEEN THE COUNTY OF SAN MATEO AND TBD

This Agreement is entered into this Thursday, , by and between the County of San Mateo, a political subdivision of the state of California, hereinafter called “County,” and TBD, hereinafter called “Contractor.”

Whereas, pursuant to Section 31000 of the California Government Code, County may contract with independent contractors for the furnishing of such services to or for County or any Department thereof; and

Whereas, it is necessary and desirable that Contractor be retained for the purpose of test test test.

Now, therefore, it is agreed by the parties to this Agreement as follows:

1. Exhibits and Attachments

The following exhibits and attachments are attached to this Agreement and incorporated into this Agreement by this reference:

Exhibit A—Services Exhibit B—Payments and Rates Exhibit B1 – Budget Exhibit C- Performance and Reports Exhibit D – HMIS Clarity

2. Services to be performed by Contractor

In consideration of the payments set forth in this Agreement and in Exhibit B, Contractor shall perform services for County in accordance with the terms, conditions, and specifications set forth in this Agreement and in Exhibit A.

3. Payments

In consideration of the services provided by Contractor in accordance with all terms, conditions, and specifications set forth in this Agreement and in Exhibit A, County shall make payment to Contractor based on the rates and in the manner specified in Exhibit B. County reserves the right to withhold payment if County determines that the quantity or quality of the work performed is unacceptable. In no event shall County’s total fiscal obligation under this Agreement exceed TBD (TBD). In the event that the County makes any advance payments, Contractor agrees to refund any amounts in excess of the amount owed by the County at the time of contract termination or expiration. Contractor is not entitled to payment for work not performed as required by this agreement.

4. Term

Subject to compliance with all terms and conditions, the term of this Agreement shall be from Thursday, April 2, 2026 through Thursday, April 1, 2027.

5. Termination

This Agreement may be terminated by Contractor or by the Director or his/her designee at any time without a requirement of good cause upon thirty (30) days’ advance written notice to the other party. Subject to availability of funding, Contractor shall be entitled to receive payment for work/services provided prior to termination of the Agreement. Such payment shall be that prorated portion of the full payment determined by comparing the work/services actually completed to the work/services required by the Agreement.

County may terminate this Agreement or a portion of the services referenced in the Attachments and Exhibits based upon the unavailability of Federal, State, or County funds by providing written notice to Contractor as soon as is reasonably possible after County learns of said unavailability of outside funding.

County may terminate this Agreement for cause. In order to terminate for cause, County must first give Contractor notice of the alleged breach. Contractor shall have five business days after receipt of such notice to respond and a total of ten calendar days after receipt of such notice to cure the alleged breach. If Contractor fails to cure the breach within this period, County may immediately terminate this Agreement without further action. The option available in this paragraph is separate from the ability to terminate without cause with appropriate notice described above. In the event that County provides notice of an alleged breach pursuant to this section, County may, in extreme circumstances, immediately suspend performance of services and payment under this Agreement pending the resolution of the process described in this paragraph. County has sole discretion to determine what constitutes an extreme circumstance for purposes of this paragraph, and County shall use reasonable judgment in making that determination.

6. Contract Materials

At the end of this Agreement, or in the event of termination, all finished or unfinished documents, data, studies, maps, photographs, reports, and other written materials (collectively referred to as “contract materials”) prepared by Contractor under this Agreement shall become the property of County and shall be promptly delivered to County. Upon termination, Contractor may make and retain a copy of such contract materials if permitted by law.

7. Relationship to Parties

Contractor agrees and understands that the work/services performed under this Agreement are performed as an independent contractor and not as an employee of County and that neither Contractor nor its employees acquire any of the rights, privileges, powers, or advantages of County employees.

8. Hold Harmless

a. General Hold Harmless

Contractor shall indemnify and save harmless County and its officers, agents, employees, and servants from all claims, suits, or actions of every name, kind, and description resulting from this Agreement, the performance of any work or services required of Contractor under this

Agreement, or payments made pursuant to this Agreement brought for, or on account of, any of the following:

(A) injuries to or death of any person, including Contractor or its employees/officers/agents;

(B) damage to any property of any kind whatsoever and to whomsoever belonging;

(C) any sanctions, penalties, or claims of damages resulting from Contractor’s failure to comply, if applicable, with the requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and all Federal regulations promulgated thereunder, as amended; or

(D) any other loss or cost, including but not limited to that caused by the concurrent active or passive negligence of County and/or its officers, agents, employees, or servants. However, Contractor’s duty to indemnify and save harmless under this Section shall not apply to injuries or damage for which County has been found in a court of competent jurisdiction to be solely liable by reason of its own negligence or willful misconduct.

The duty of Contractor to indemnify and save harmless as set forth by this Section shall include the duty to defend as set forth in Section 2778 of the California Civil Code.

9. Assignability and Subcontracting

Contractor shall not assign this Agreement or any portion of it to a third party or subcontract with a third party to provide services required by Contractor under this Agreement without the prior written consent of County. Any such assignment or subcontract without County’s prior written consent shall give County the right to automatically and immediately terminate this Agreement without penalty or advance notice.

10. Insurance

10.1. General Requirements

Contractor shall not commence work or be required to commence work under this Agreement unless and until all insurance required under this Section has been obtained and such insurance has been approved by County’s Risk Management, and Contractor shall use diligence to obtain such insurance and to obtain such approval. Contractor shall furnish County with certificates of insurance evidencing the required coverage, and there shall be a specific contractual liability endorsement extending Contractor’s coverage to include the contractual liability assumed by Contractor pursuant to this Agreement. These certificates shall specify or be endorsed to provide that thirty (30) days’ notice must be given, in writing, to County of any pending change in the limits of liability or of any cancellation or modification of the policy.

10.2. Workers’ Compensation and Employer’s Liability Insurance Contractor shall have in effect during the entire term of this Agreement workers’ compensation and employer’s liability insurance providing full statutory coverage. In signing this Agreement, Contractor certifies, as required by Section 1861 of the California Labor Code, that (a) it is aware of the provisions of Section 3700 of the California Labor Code, which require every employer to be insured against liability for workers’ compensation or to undertake self-insurance in accordance with the provisions of the Labor Code, and (b) it will comply with such provisions before commencing the performance of work under this Agreement.

10.3. Liability Insurance

Contractor shall take out and maintain during the term of this Agreement such bodily injury liability and property damage liability insurance as shall protect Contractor and all of its employees/officers/agents while performing work covered by this Agreement from any and all claims for damages for bodily injury, including accidental death, as well as any and all claims for property damage which may arise from Contractor’s operations under this Agreement, whether such operations be by Contractor, any subcontractor, anyone directly or indirectly employed by either of them, or an agent of either of them. Such insurance shall be combined single limit bodily injury and property damage for each occurrence and shall not be less than the amounts specified below:

(a) Comprehensive General Liability…………. $1,000,000 , (b) Motor Vehicle Liability Insurance…………. $1,000,000 , (c) Professional Liability……….………………. $1,000,000

County and its officers, agents, employees, and servants shall be named as additional insured on any such policies of insurance, which shall also contain a provision that (a) the insurance afforded thereby to County and its officers, agents, employees, and servants shall be primary insurance to the full limits of liability of the policy and (b) if the County or its officers, agents, employees, and servants have other insurance against the loss covered by such a policy, such other insurance shall be excess insurance only.

In the event of the breach of any provision of this Section, or in the event any notice is received which indicates any required insurance coverage will be diminished or canceled, County, at its option, may, notwithstanding any other provision of this Agreement to the contrary, immediately declare a material breach of this Agreement and suspend all further work and payment pursuant to this Agreement.

11. Compliance With Laws

All services to be performed by Contractor pursuant to this Agreement shall be performed in accordance with all applicable Federal, State, County, and municipal laws, ordinances, regulations, and executive orders, including but not limited to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Federal Regulations promulgated thereunder, as amended (if applicable), the Business Associate requirements set forth in Attachment H (if attached), the Americans with Disabilities Act of 1990, as amended, and Section 504 of the Rehabilitation Act of 1973, which prohibits discrimination on the basis of disability in programs and activities receiving any Federal or County financial assistance, as well as any required economic or other sanctions imposed by the United States government or under state law in effect during the term of the Agreement. Such services shall also be performed in accordance with all applicable ordinances and regulations, including but not limited to appropriate licensure, certification regulations, provisions pertaining to confidentiality of records, and applicable quality assurance regulations. In the event of a conflict between the terms of this Agreement and any applicable State, Federal, County, or municipal law, regulation, or executive order, the requirements of the applicable law, regulation, or executive order will take precedence over the requirements set forth in this Agreement.

Further, Contractor certifies that it and all of its subcontractors will adhere to all applicable provisions of Chapter 4.107 of the San Mateo County Ordinance Code, which regulates the use of disposable food service ware. Accordingly, Contractor shall not use any non-recyclable plastic disposable food service ware when providing prepared food on property owned or leased by the County and instead shall use biodegradable, compostable, reusable, or recyclable plastic food service ware on property owned or leased by the County. (This paragraph may be deleted without County Attorney Review if not relevant to this agreement)

Contractor will timely and accurately complete, sign, and submit all necessary documentation of compliance.

12. Levine Act Compliance

The Contractor certifies and warrants that Contractor has fully complied, and will remain in full compliance, with all applicable requirements of the Levine Act in connection with this Agreement, including making any required disclosures of campaign contributions to County Officers, which includes but may not be limited to elected County Officers. Elected County Officers include members of the San Mateo County Board of Supervisors, as well as the Assessor-County Clerk-Recorder, Controller, Coroner, District Attorney, Sheriff, and Tax Collector-Treasurer. Any campaign contribution required to be disclosed under the Levine Act in connection with this Agreement shall be disclosed on the disclosure form provided by the County of San Mateo Levine Act Disclosure Form, a copy of which is available from the County upon request.

13. Non-Discrimination and Other Requirements

13.1. General Non-discrimination

No person shall be denied any services provided pursuant to this Agreement (except as limited by the scope of services) on the grounds of race, color, national origin, ancestry, age, disability (physical or mental), sex, sexual orientation, gender identity, marital or domestic partner status, religion, political beliefs or affiliation, familial or parental status (including pregnancy), medical condition (cancer-related), military service, or genetic information.

13.2. Equal Employment Opportunity

Contractor shall ensure equal employment opportunity based on objective standards of recruitment, classification, selection, promotion, compensation, performance evaluation, and management relations for all employees under this Agreement. Contractor’s equal employment policies shall be made available to County upon request.

13.3. Section 504 of the Rehabilitation Act of 1973

Contractor shall comply with Section 504 of the Rehabilitation Act of 1973, as amended, which provides that no otherwise qualified individual with a disability shall, solely by reason of a disability, be excluded from the participation in, be denied the benefits of, or be subjected to discrimination in the performance of any services this Agreement. This Section applies only to contractors who are providing services to members of the public under this Agreement.

13.4. Compliance with County’s Equal Benefits Ordinance

Contractor shall comply with all laws relating to the provision of benefits to its employees and their spouses or domestic partners, including, but not limited to, such laws prohibiting discrimination in the provision of such benefits on the basis that the spouse or domestic partner of the Contractor’s employee is of the same or opposite sex as the employee.

13.5. Discrimination Against Individuals with Disabilities

The nondiscrimination requirements of 41 C.F.R. 60-741.5(a) are incorporated into this Agreement as if fully set forth here, and Contractor and any subcontractor shall abide by the requirements of 41 C.F.R. 60–741.5(a). This regulation prohibits discrimination against qualified individuals on the basis of disability and requires affirmative action by covered prime contractors and subcontractors to employ and advance in employment qualified individuals with disabilities.

13.6. History of Discrimination

Contractor certifies that no finding of discrimination has been issued in the past 365 days against Contractor by the Equal Employment Opportunity Commission, the California Department of Fair Employment and Housing, or any other investigative entity. If any finding(s) of discrimination have been issued against Contractor within the past 365 days by the Equal Employment Opportunity Commission, the California Department of Fair Employment and Housing, or other investigative entity, Contractor shall provide County with a written explanation of the outcome(s) or remedy for the discrimination prior to execution of this Agreement. Failure to comply with this Section shall constitute a material breach of this Agreement and subjects the Agreement to immediate termination at the sole option of the County.

13.7. Reporting; Violation of Non-discrimination Provisions

Contractor shall report to the County Executive Officer the filing in any court or with any administrative agency of any complaint or allegation of discrimination on any of the bases prohibited by this Section of the Agreement or the Section titled “Compliance with Laws”. Such duty shall include reporting of the filing of any and all charges with the Equal Employment Opportunity Commission, the California Department of Fair Employment and Housing, or any other entity charged with the investigation or adjudication of allegations covered by this subsection within 30 days of such filing, provided that within such 30 days such entity has not notified Contractor that such charges are dismissed or otherwise unfounded. Such notification shall include a general description of the circumstances involved and a general description of the kind of discrimination alleged (for example, gender-, sexual orientation-, religion-, or race-based discrimination).

Violation of the non-discrimination provisions of this Agreement shall be considered a breach of this Agreement and subject the Contractor to penalties, to be determined by the County Executive Officer, including but not limited to the following:

i. termination of this Agreement;

ii. disqualification of the Contractor from being considered for or being awarded a County contract for a period of up to 3 years;

iii. liquidated damages of $2,500 per violation; and/or

iv. imposition of other appropriate contractual and civil remedies and sanctions, as determined by the County Executive Officer.

To effectuate the provisions of this Section, the County Executive Officer shall have the authority to offset all or any portion of the amount described in this Section against amounts due to Contractor under this Agreement or any other agreement between Contractor and County.

13.8. Compliance with Living Wage Ordinance

As required by Chapter 2.88 of the San Mateo County Ordinance Code, Contractor certifies all contractor(s) and subcontractor(s) obligated under this contract shall fully comply with the provisions of the County of San Mateo Living Wage Ordinance, including, but not limited to, paying all Covered Employees the current Living Wage and providing notice to all Covered Employees and Subcontractors as required under the Ordinance.

14. Compliance with County Employee Jury Service Ordinance

Contractor shall comply with Chapter 2.85 of the County’s Ordinance Code, which states that Contractor shall have and adhere to a written policy providing that its employees, to the extent they are full-time employees and live in San Mateo County, shall receive from the Contractor, on an annual basis, no fewer than five days of regular pay for jury service in San Mateo County, with jury pay being provided only for each day of actual jury service. The policy may provide that such employees deposit any fees received for such jury service with Contractor or that the Contractor may deduct from an employee’s regular pay the fees received for jury service in San Mateo County. By signing this Agreement, Contractor certifies that it has and adheres to a policy consistent with Chapter 2.85. For purposes of this Section, if Contractor has no employees in San Mateo County, it is sufficient for Contractor to provide the following written statement to County: “For purposes of San Mateo County’s jury service ordinance, Contractor certifies that it has no full-time employees who live in San Mateo County. To the extent that it hires any such employees during the term of its Agreement with San Mateo County, Contractor shall adopt a policy that complies with Chapter 2.85 of the County’s Ordinance Code.” The requirements of Chapter 2.85 do not apply unless this Agreement’s total value listed in the Section titled “Payments”, exceeds two-hundred thousand dollars ($200,000); Contractor acknowledges that Chapter 2.85’s requirements will apply if this Agreement is amended such that its total value exceeds that threshold amount.

15. Retention of Records; Right to Monitor and Audit

(a) Contractor shall maintain all required records relating to services provided under this Agreement for three (3) years after County makes final payment and all other pending matters are closed, and Contractor shall be subject to the examination and/or audit by County, a Federal grantor agency, and the State of California.

(b) Contractor shall comply with all program and fiscal reporting requirements set forth by applicable Federal, State, and local agencies and as required by County.

(c) Contractor agrees upon reasonable notice to provide to County, to any Federal or State department having monitoring or review authority, to County’s authorized representative, and/or to any of their respective audit agencies access to and the right to examine all records and documents necessary to determine compliance with relevant Federal, State, and local statutes, rules, and regulations, to determine compliance with this Agreement, and to evaluate the quality, appropriateness, and timeliness of services performed.

16. Merger Clause; Amendments

This Agreement, including the Exhibits and Attachments attached to this Agreement and incorporated by reference, constitutes the sole Agreement of the parties to this Agreement and correctly states the rights, duties, and obligations of each party as of this document’s date. In the event that any term, condition, provision, requirement, or specification set forth in the body of this Agreement conflicts with or is inconsistent with any term, condition, provision, requirement, or specification in any Exhibit and/or Attachment to this Agreement, the provisions of the body of the Agreement shall prevail. Any prior agreement, promises, negotiations, or representations between the parties not expressly stated in this document are not binding. All subsequent modifications or amendments shall be in writing and signed by the parties.

17. Controlling Law; Venue

The validity of this Agreement and of its terms, the rights and duties of the parties under this Agreement, the interpretation of this Agreement, the performance of this Agreement, and any other dispute of any nature arising out of this Agreement shall be governed by the laws of the State of California without regard to its choice of law or conflict of law rules. Any dispute arising out of this Agreement shall be venued either in the San Mateo County Superior Court or in the United States District Court for the Northern District of California.

18. Notices

Any notice, request, demand, or other communication required or permitted under this Agreement shall be deemed to be properly given when both: (1) transmitted via email to the email address listed below; and (2) sent to the physical address listed below by either being deposited in the United States mail, postage prepaid, or deposited for overnight delivery, charges prepaid, with an established overnight courier that provides a tracking number showing confirmation of receipt.

In the case of County, to:

Name/Title: LisaAnn Wolfskill/Contract Administrator Address: 1 Davis Dr, Belmont, CA, 94002 Telephone: (650) 802-7919 Email: lwolfskill@smcgov.org

In the case of Contractor, to:

Name/Title: TBD/TBD Address: TBD Telephone: TBD Email: TBD

19. Electronic Signature

Both County and Contractor wish to permit this Agreement and future documents relating to this Agreement to be digitally signed in accordance with California law and County’s Electronic Signature Administrative Memo. Any party to this Agreement may revoke such agreement to permit electronic signatures at any time in relation to all future documents by providing notice pursuant to this Agreement.

20. Payment of Permits/Licenses

Contractor bears responsibility to obtain any license, permit, or approval required from any agency for work/services to be performed under this Agreement at Contractor’s own expense prior to commencement of said work/services. Failure to do so will result in forfeit of any right to compensation under this Agreement.

21. Indirect Costs

21.1. Indirect Costs (County De Minimis)

The County’s De Minimis indirect cost rate shall apply for indirect costs paid to Contractor under this Agreement. The De Minimis indirect cost rate is calculated as up to 15% of the Modified Total Direct Costs (“MTDC”). MDTC means all direct salaries and wages, applicable fringe benefits, materials and supplies, services, travel, and up to the first $50,000 of each subaward (regardless of the period of performance of the subawards under the award). MTDC excludes equipment, capital expenditures, charges for patient care, rental costs, tuition remission, scholarships and fellowships, participant support costs, and the portion of each subaward in excess of $50,000. While Contractor will not be required to submit documentation supporting indirect costs with their invoices, Contractor shall maintain such documentation for audit purposes for the retention period set forth in this Agreement.

22. Finger Printing and Child Abuse

22.1. Child Abuse Prevention and Reporting

Contractor agrees to ensure that all known or suspected instances of child abuse or neglect are reported to a child protective agency. Contractor agrees to fully comply with the Child Abuse and Neglect Reporting Act, Cal Pen Code 11164 et seq. Contractor will ensure that all known or suspected instances of child abuse or neglect are reported to an agency (police department, sheriff’s department, county probation department if designated by the County to receive mandated reports, or the county welfare department) described in Penal Code Section

11165.9. This responsibility shall include:

A. A requirement that all employees, consultants, or agents performing services under this contract who are required by the Penal Code to report child abuse or neglect, sign a statement that he or she knows of the reporting requirement and will comply with it.

B. Establishing procedures to ensure reporting even when employees, consultants, or agents who are not required to report child abuse under the Penal Code gain knowledge of, or reasonably suspect that a child has been a victim of abuse or neglect.

C. Contractor agrees that its employees, subcontractors, assignees, volunteers, and any other persons who provide services under this contract and who will have supervisory or disciplinary power over a minor or any person under his or her care (Penal 11105.3) will be fingerprinted in order to determine whether they have a criminal history which would compromise the safety of children with whom Contractor's employees, subcontractors, assignees or volunteers have contact. All fingerprinting services will be at County's sole discretion and Contractor's sole expense.

County of San Mateo Fingerprinting Certification Form

DATE:

AGREEMENT WITH:

FOR:

Contractor agrees that its employees and/or its subcontractors, assignees and volunteers who, during the course of performing services under this agreement, have contact with children will be fingerprinted in order to determine whether they have a criminal history which would compromise the safety of children with whom contractors’ employees, assignees and subcontractors or volunteers have contact.

NAME:

TITLE:

SIGNATURE:

DATE:

23. Health Insurance Portability and Accountability Act (HIPAA)

23.1. DEFINITIONS

Terms used, but not otherwise defined, in this Schedule shall have the same meaning as those terms are defined in 45 Code of Federal Regulations (CFR) sections 160.103, 164.304, and 164.501. All regulatory references in this Schedule are to Title 45 of the Code of Federal Regulations unless otherwise specified.

a. Business Associate. “Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the parties to this agreement shall mean Contractor.

b. Covered Entity. "Covered entity" shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement shall mean County.

c. HIPAA Rules. "HIPAA rules" shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR part 160 and part 164, as amended and supplemented by Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009.

d. Designated Record Set. "Designated Record Set" shall have the same meaning as the term "designated record set" in Section 164.501.

e. Electronic Protected Health Information. "Electronic Protected Health Information" (EPHI) means individually identifiable health information that is transmitted or maintained in electronic media; it is limited to the information created, received, maintained or transmitted by Business Associate from or on behalf of Covered Entity.

f. Individual. "Individual" shall have the same meaning as the term "individual" in Section 164.501 and shall include a person who qualifies as a personal representative in accordance with Section 164.502(g).

g. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. h. Protected Health

Information. "Protected Health Information" (PHI) shall have the same meaning as the term "protected health information" in Section 160.103 and is limited to the information created or received by Business Associate from or on behalf of County.

i. Required By Law. "Required by law" shall have the same meaning as the term "required by law" in Section 164.103.

j. Secretary. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his or her designee.

k. Breach. The acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI and subject to the exclusions set forth in Section 164.402. Unless an exception applies, an impermissible use or disclosure of PHI is presumed to be a breach, unless it can be demonstrated there is a low probability that the PHI has been compromised based upon, at minimum, a four-part risk assessment:

1. Nature and extent of PHI included, identifiers and likelihood of re-identification; 2.

Identity of the unauthorized person or to whom impermissible disclosure was made; 3.

Whether PHI was actually viewed or only the opportunity to do so existed; 4. The extent to which the risk has been mitigated.

l. Security Rule. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.

m. Unsecured PHI. “Unsecured PHI” is protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in relevant HHS guidance.

n. Security Incident. "Security Incident" shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems operations in an information system. “Security Incident” includes all incidents that constitute breaches of unsecured protected health information.

23.2. OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE

a. Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by the Agreement or as required by law.

b. Business Associate agrees to use appropriate safeguards to comply with Subpart C of 45 CFR part 164 with respect to EPHI and PHI, and to prevent the use or disclosure of the Protected Health Information other than as provided for by this Agreement.

c. Business Associate agrees to make uses and disclosures requests for Protected Health Information consistent with minimum necessary policy and procedures.

d. Business Associate may not use or disclose protected health information in a manner that would violate subpart E of 45 CFR part 164.504 if used or disclosed by Covered Entity.

e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement.

f. Business Associate agrees to report to County any use or disclosure of Protected Health Information not authorized by this Agreement.

g. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of County, agrees to adhere to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.

h. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to provide access, at the request of County, and in the time and manner designated by County, to Protected Health Information in a Designated Record Set, to County or, as directed by County, to an Individual in order to meet the requirements under Section 164.524.

i. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the County directs or agrees to make pursuant to Section

164.526 at the request of County or an Individual, and in the time and manner designed by County.

j. Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of County, available to the County at the request of County or the Secretary, in a time and manner designated by the County or the Secretary, for purposes of the Secretary determining County's compliance with the Privacy Rule.

k. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528.

l. Business Associate agrees to provide to County or an Individual in the time and manner designated by County, information collected in accordance with Section (k) of this Schedule, in order to permit County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528.

m. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that Business Associate creates, receives, maintains, or transmits on behalf of County.

n. Business Associate shall conform to generally accepted system security principles and the requirements of the final HIPAA rule pertaining to the security of health information.

o. Business Associate shall ensure that any agent to whom it provides EPHI, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect such

EPHI.

p. Business Associate shall report to County any Security Incident within three (3) business days of becoming aware of such incident. Business Associate shall also facilitate breach notification(s) to the appropriate governing body (i.e. HHS, OCR, etc.) as required by law. As appropriate and after consulting with County, Business Associate shall also notify affected individuals and the media of a qualifying breach.

q. Business Associate understands that it is directly liable under the HIPAA rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of Protected Health Information that are not authorized by this Attachment, the underlying contract as or required by law.

23.3. PERMITTED USES AND DISCLOSURES BY CONTRACTOR AS BUSINESS

ASSOCIATE

Except as otherwise limited in this Schedule, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, County as specified in the Agreement; provided that such use or disclosure would not violate the Privacy Rule if done by County.

23.4. OBLIGATIONS OF COUNTY

a. County shall provide Business Associate with the notice of privacy practices that County produces in accordance with Section 164.520, as well as any changes to such notice.

b. County shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect Business Associate's permitted or required uses and disclosures.

c. County shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that County has agreed to in accordance with Section 164.522.

23.5. PERMISSIBLE REQUESTS BY COUNTY

County shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if so requested by County, unless the Business Associate will use or disclose Protected Health Information for, and if the Agreement provides for, data aggregation or management and administrative activities of Business Associate.

23.6. DUTIES UPON TERMINATION OF AGREEMENT

a. Upon termination of the Agreement, for any reason, Business Associate shall return or destroy all Protected Health Information received from County, or created, maintained, or received by Business Associate on behalf of County, that Business Associate still maintains in any form. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information.

b. In the event that Business Associate determines that returning or destroying Protected Health Information is infeasible, Business Associate shall provide to County notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of the Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protection Health Information.

23.7. MISCELLANEOUS

a. Regulatory References. A reference in this Schedule to a section in the HIPAA Privacy Rule means the section as in effect or as amended, and for which compliance is required.

b. Amendment. The Parties agree to take such action as is necessary to amend this Schedule from time to time as is necessary for County to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act, Public Law 104-191.

c. Survival. The respective rights and obligations of Business Associate under this Schedule shall survive the termination of the Agreement.

d. Interpretation. Any ambiguity in this Schedule shall be resolved in favor of a meaning that permits County to comply with the Privacy Rule.

e. Reservation of Right to Monitor Activities. County reserves the right to monitor the security policies and procedures of Business Associate.

24. Personally Identifiable Information

Requirements for County Contractors, Subcontractors, Vendors and Agents

24.1. Definitions

Personally Identifiable Information (PII), or Sensitive Personal Information (SPI), as used in Federal information security and privacy laws, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. PII may only be used to assist in the administration of programs in accordance with 45 C.F.R. § 205.40, et seq. and California Welfare & Institutions Code section 10850.

a. “Assist in the Administration of the Program” means performing administrative functions on behalf of County programs, such as determining eligibility for, or enrollment in, and collecting context PII for such purposes, to the extent such activities are authorized by law.

b. “Breach” refers to actual loss, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than authorized purposes have access or potential access to context PII, whether electronic, paper, verbal, or recorded.

c. “Contractor” means those contractors, subcontractors, vendors and agents of the County performing any functions for the County that require access to and/or use of PII and that are authorized by the County to access and use PII.

d. "Personally Identifiable Information” or “PII” is personally identifiable information that can be used alone, or in conjunction with any other reasonably available information, to identify a specific individual. PII includes, but is not limited to, an individual's name, social security number, driver's license number, identification number, biometric records, date of birth, place of birth, or mother’s maiden name. PII may be electronic, paper, verbal, or recorded.

e. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PII, or interference with system operations in an information system which processes PII that is under the control of the County or County’s

Statewide Automated Welfare System (SAWS) Consortium, or under the control of a contractor, subcontractor or vendor of the County, on behalf of the County.

f. “Secure Areas” means any area where:

i. Contractors administer or assist in the administration of County programs; ii. PII is used or disclosed; or

iii. PII is stored in paper or electronic format.

24.2. Restrictions on Contractor re Use and Disclosure of PII

a. Contractor agrees to use or disclose PII only as permitted in this Agreement and only to assist in the administration of programs in accordance with 45 CFR § 205.50, et seq. and California Welfare & Institutions Code section 10850 or as otherwise authorized or required by law. Disclosures, when authorized or required by law, such as in response to a court order, or when made upon the explicit written authorization of the individual, who is the subject of the PII, are allowable. Any other use or disclosure of PII requires the express approval in writing by the County. No Contractor shall duplicate, disseminate or disclose PII except as allowed in this Agreement.

b. Contractor agrees to only use PII to perform administrative functions related to the administration of County programs to the extent applicable.

c. Contractor agrees that access to PII shall be restricted to Contractor’s staff who need to perform specific services in the administration of County programs as described in this Agreement.

d. Contractor understands and agrees that any of its staff who accesses, discloses or uses PII in a manner or for a purpose not authorized by this Agreement may be subject to civil and criminal sanctions available under applicable Federal and State laws and regulations

24.3. Use of Safeguards by Contractor to Protect PII

a. Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides PII received from, or created or received by Contractor on behalf of County, agrees to adhere to the same restrictions and conditions contained in this Attachment PII.

b. Contractor agrees to advise its staff who have access to PII, of the confidentiality of the information, the safeguards required to protect the information, and the civil and criminal sanctions for non-compliance contained in applicable Federal and State laws and regulations.

c. Contractor agrees to train and use reasonable measures to ensure compliance by Contractor’s staff, including, but not limited to (1) providing initial privacy and security awareness training to each new staff within thirty (30) days of employment; (2) thereafter, providing annual refresher training or reminders of the PII privacy and security safeguards to all Contractor’s staff; (3) maintaining records indicating each Contractor’s staff name and the date on which the privacy and security awareness training was completed; and (4) retaining training records for a period of three (3) years after completion of the training.

d. Contractor agrees to provide documented sanction policies and procedures for Contractor’s staff who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment when appropriate.

e. Contractor agrees that all Contractor’s staff performing services under this Agreement sign a confidentiality statement prior to accessing PII and annually thereafter. The signed statement shall be retained for a period of three (3) years, and the statement include at a minimum: (1) general use; (2) security and privacy safeguards; (3) unacceptable use; and (4) enforcement policies.

f. Contractor agrees to conduct a background check of Contractor’s staff before they may access PII with more thorough screening done for those employees who are authorized to bypass significant technical and operational security controls. Contractor further agrees that screening documentation shall be retained for a period of three (3) years following conclusion of the employment relationship.

g. Contractor agrees to conduct periodic privacy and security reviews of work activity, including random sampling of work product by Contractor’s staff by management level personnel who are knowledgeable and experienced in the areas of privacy and information security in the administration of County’s programs and the use and disclosure of PII. Examples include, but are not limited to, access to data, case files or other activities related to the handling of PII.

h. Contractor shall ensure that PII is used and stored in an area that is physically safe from access by unauthorized persons at all times and safeguard PII from loss, theft, or inadvertent disclosure by securing all areas of its facilities where Contractor’s staff assist in the administration of the County’s programs and use, disclose, or store PII.

i. Contractor shall ensure that each physical location, where PII is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee of Contractor and access is revoked.

j. Contractor shall ensure that there are security guards or a monitored alarm system at all times at Contractor’s facilities and leased facilities where five hundred (500) or more individually identifiable records of PII is used, disclosed, or stored. Video surveillance systems are recommended.

k. Contractor shall ensure that data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only those authorized by this Agreement. Visitors to any Contractor data centers area storing PII as a result of administration of a County program must be escorted at all times by authorized Contractor’s staff.

l. Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which Contractor staff can transport PII, as well as the physical security requirements during transport.

m. Contractor shall ensure that any PII stored in a vehicle shall be in a non-visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time.

n. Contractor shall ensure that PII shall not be left unattended at any time in airplanes, buses, trains, etc., including baggage areas. This should be included in training due to the nature of the risk.

o. Contractor shall ensure that all workstations and laptops, which use, store and/or process PII, must be encrypted using a FIPS 140-2 certified algorithm 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk. It is encouraged, when available and when feasible, that the encryption be 256 bit.

p. Contractor shall ensure that servers containing unencrypted PII must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review. It is recommended to follow the guidelines documented in the latest revision of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations.

q. Contractor agrees that only the minimum necessary amount of PII required to perform required business functions will be accessed, copied, downloaded, or exported.

r. Contractor shall ensure that all electronic files, which contain PII data is encrypted when stored on any mobile device or removable media (i.e. USB drives, CD/DVD, smartphones, tablets, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm 128 bit or higher, such as AES.