STATEMENT OF WORK – Electronic Medication Administration Record Contract

Statement of Work Electronic Medication Administration Record Contract

Youth and Community Programs 10601 Bear Hollow Drive

Rancho Cordova, CA, 95670

Author: CSM Aller / CW2 Jung

1. Background A. The California Youth ChalleNGe Program (CYCP) operates four (4) residential academies under the National Guard Youth ChalleNGe Program (NGYCP) in accordance with CNGBM 9350.01.

B. Current paper-based medication administration processes are insufficient to meet the program’s needs. The California Military Department (CMD) requires a commercial-off-the-shelf (COTS), cloud-based Electronic Medication Administration Record (eMAR) system to standardize and safeguard medication administration statewide.

2. Definitions

The following terms have the meanings set forth below wherever they appear in this Statement of Work (SOW). Acronyms are spelled out on their first use and abbreviated thereafter.

A. Cadet: An enrolled participant of the California Youth ChalleNGe Program (CYCP).

B. Cadet data: All data created, collected, processed, transmitted, or stored by the eMAR System relating to a Cadet, including but not limited to: the Cadet Profile;

medication orders, administrations, refusals, and waste events (with dates, times, dosages, and routes); allergies, adverse reactions, and clinical notes; alert acknowledgments and clinical overrides; electronic signatures and audit trail entries. This enumeration is illustrative and not exhaustive; any data the eMAR System creates, processes, or stores about a Cadet is Cadet data, regardless of whether its category is specifically listed in this Statement of Work.

C. Contractor: The entity awarded this contract to provide the eMAR System.

D. Contracting Manager (CM): The CMD official designated in writing as the primary point of contact and approval authority for deliverables under this contract.

E. Cadet Profile: An individual electronic record within the eMAR System containing a Cadet's identifying, medical, and medication information.

F. eMAR System: The Contractor's commercial, vendor-owned, cloud-hosted

Electronic Medication Administration Record Software-as-a-Service product, including all components and interfaces described in this Statement of Work.

G. Five Rights Verification: The sequential confirmation of the right patient, right medication, right dose, right route, and right time prior to medication administration, enforced by the eMAR System.

H. Medication Administrator: A CMD employee or other authorized person responsible for physically administering medication to a Cadet, who interacts with the eMAR System at the point of medication administration.

I. Notice to Proceed (NTP): Written notice issued by the CMD Contracting Officer authorizing the Contractor to begin work under this contract.

J. Patient Identification Tag: A scannable barcode or radio-frequency identification (RFID) tag uniquely identifying a Cadet and all related information to the eMAR System when scanned.

K. Route: The method by which a medication is administered to a Cadet, including but not limited to oral, topical, inhalation, injection, ophthalmic, or other administration.

L. Quantity-Wasted Entry: A documented record in the eMAR system identifying the specific amount of a medication that was dispensed but not administered to a Cadet (e.g., partial dose remaining after administration, dose drawn but refused, or dose rendered unusable after dispensing).

3. Contract Term A. The term of this contract shall be three (3) years, commencing on the date set forth in the Notice to Proceed (NTP) issued by the CMD, unless terminated earlier in accordance with this Section.

B. The CMD may terminate the contract:

i) For convenience with 30 days’ written notice.

ii) For cause (e.g., material breach, poor performance) following a thirty (30) day written cure notice; if not cured, immediate termination. CMD may suspend the Contractor's system access during the cure period.

iii) Without fault (e.g., budget cuts) with 60 days’ notice.

4. Objectives A. The primary goal of this contract is to streamline and standardize medication administration for CYCP cadets across all four academies and ensure full compliance with applicable state and federal law. The Contractor shall provide, implement, host, support, and maintain a secure Software-as-a-Service (SaaS) eMAR system that:

i) Standardizes medication administration records and workflows across all CYCP academy sites;

ii) Creates and implements mandatory verification of the Five Rights (right patient, right medication, right dose, right route, right time) at every medication administration to minimize human error;

iii) Ensures continuous compliance with applicable California and federal health and data privacy laws, including the California Confidentiality of Medical Information Act (CMIA, California Civil Code section 56 et seq.), the California Consumer Privacy Act (CCPA, California Civil Code section

1798.100 et seq.), the federal Health Insurance Portability and Accountability Act (HIPAA, where applicable), and the federal Family Educational Rights and Privacy Act (FERPA, where applicable); and

iv) Integrates with existing CYCP operations with minimal disruption to cadet care.

5. Locations of Performance A. The eMAR system shall be fully deployed and operational at all four CYCP academy sites, which collectively serve approximately 500 cadets annually:

i) Discovery Challenge Academy: 700 E. Roth Rd, Lathrop, CA 95330

ii) Grizzly Youth Academy: 721 Mendocino Ave, San Luis Obispo, CA 93405

iii) Sunburst Youth Academy: 4022 Saratoga Ave, Bldg. 21, Los Alamitos, CA

90720

iv) California Job Challenge: 4122 Saratoga Ave, Bldg. 20, Los Alamitos, CA

90720

6. Scope of Services and Technical Requirements

A. This Section establishes the scope of services the Contractor shall provide. All deliverables, performance standards, and acceptance criteria elsewhere in this Statement of Work (SOW) reference the requirements stated in this Section.

B. Cadet Profile Creation and Management. The eMAR System shall enable CMD personnel to create, maintain, and update an individual Cadet Profile for each Cadet enrolled at any of the four academy sites. Each Cadet Profile shall contain, at minimum:

i) Cadet's legal name and date of birth;

ii) Academy site of enrollment;

iii) Documented medication allergies and known adverse reactions;

iv) Active medication orders, including medication name, dosage, route, frequency, prescribing authority, and start/end dates;

v) As-needed (PRN) medication authorizations with associated indications, instructions, and limitations; and

vi) A unique Patient Identification Tag value (barcode, QR code, or RFID) generated by the eMAR System and associated with that Cadet Profile.

C. The eMAR System shall not permit a medication administration event to be recorded for any individual who does not have an active Cadet Profile.

D. Five Rights Verification Workflow. The eMAR System shall enforce a sequential Five Rights Verification at every medication administration. The workflow shall operate as follows:

i) The Medication Administrator authenticates to the eMAR System using their assigned credentials and multi-factor authentication (MFA);

ii) The Medication Administrator scans the Cadet's Patient Identification Tag, and the eMAR System retrieves the active Cadet Profile and displays scheduled or PRN medications due for administration;

iii) The Medication Administrator scans the barcode or QR Code, or RFID of the medication container intended for administration, and the eMAR System verifies (1) right patient, (2) right medication, (3) right dose, (4) right route, and (5) right time/scheduled window;

iv) If all five verifications match, the eMAR System displays a confirmation screen authorizing administration;

v) Upon administration, the Medication Administrator records the administration in the eMAR System with an electronic signature, and the System logs the event in the audit trail.

vi) If any verification fails, the eMAR System shall not display the confirmation screen and shall display a clear failure message identifying which verification(s) did not match.

E. The eMAR System shall not permit a Medication Administrator to override a failed Five Rights Verification. Any clinical override of an active medication order shall require a separate authorization workflow by a CMD-designated authorizing official, with the override and its justification recorded in the audit trail. The CMD-designated authorizing official will be identified within thirty (30) days of NTP.

F. Alerts and Notifications. The eMAR System shall generate and deliver the following alert categories:

i) Allergy and Drug Interaction Alerts. When a Medication Administrator initiates a medication administration that the eMAR System identifies as conflicting with a documented Cadet allergy, with another active medication in the Cadet's Profile, or with a documented contraindication, the System shall display the alert on the device the Medication Administrator is using, immediately upon scanning the medication and before the Five Rights confirmation screen. The Medication Administrator shall acknowledge each alert before proceeding. The acknowledgment, the Medication Administrator's identity, the time, and any free-text justification entered shall be recorded in the audit trail.

ii) Missed and Overdue Dose Alerts. If a scheduled medication has not been administered or affirmatively refused within the one (1) hour of scheduled administration window, the eMAR System shall (1) display a visible indicator on the Cadet Profile and on a configurable dashboard accessible to the on-duty Medical Officer or designee; and (2) generate a notification deliverable by in-System message, email, and short-message-service (SMS) text, addressed to the user role(s) designated by CMD.

iii) Configuration of Alert Delivery. CMD shall designate, in writing during implementation, which user roles receive which alert types, the delivery methods for each, and any escalation rules. The eMAR System shall allow CMD to update these designations without Contractor assistance.

G. Controlled Substance and PRN Workflow. For medications classified as controlled substances under the California Uniform Controlled Substances Act (Division 10 (commencing with Section 11000) of the Health and Safety Code), the eMAR System shall enforce, in addition to the Five Rights Verification, a witness workflow requiring a second authenticated user to confirm administration before the medication can be marked administered or wasted. The witness's identity, time, and any quantity-wasted entry shall be recorded in the audit trail.

For PRN medications, the eMAR System shall require the Medication Administrator to enter (1) the indication or symptom prompting administration, and (2) any post-administration observation entered within a CMD-configurable timeframe. The eMAR System shall enforce maximum dosing intervals and daily-maximum limits set in the Cadet Profile.

H. Audit Trail, Electronic Signature, and Security Information and Event Management (SIEM) Integration. The eMAR System shall maintain a tamper-evident, append-only audit trail of every action taken in the System, including:

user authentication events (successful and failed); Cadet Profile creations and modifications; medication order entries and modifications; medication administrations, refusals, and waste events; alert acknowledgments; clinical overrides; administrative configuration changes; bulk data exports; and any access to or export of protected health information (PHI).

i) Each audit trail entry shall record the date and time (to the second, in Pacific Time), the authenticated user's identity, the action taken, the affected Cadet Profile (where applicable), and any associated free-text entry. Audit trail records shall not be editable or deletable by any user, including system administrators. The eMAR System shall make the audit trail available to CMD on-demand through a query interface via digital report.

ii) Electronic signatures recorded by the eMAR System shall be associated with the authenticated user's unique account credentials and shall not be transferable. The Contractor shall not permit shared accounts.

iii) The Contractor shall support secure transmission of audit log data to CMD's centralized SIEM platform, Microsoft Sentinel. The integration shall transmit, at minimum, authentication events (successful and failed), administrative configuration changes, bulk data exports, and security-relevant events on a near-real-time basis. The Contractor shall provide documentation of the integration interface and shall support CMD's testing and validation of the integration during implementation.

iv) The eMAR System shall generate and forward to CMD's SIEM automated security alerts for the following events, at minimum: (1) repeated failed authentication attempts indicative of credential abuse; (2) administrative configuration changes affecting user accounts, role assignments, or permissions; (3) bulk data exports exceeding a CMD-configurable threshold; and (4) access events flagged by the System as anomalous.

CMD shall configure the alert thresholds and destinations during implementation.

I. User Roles, Authentication, and Access Control. The eMAR System shall enforce role-based access control (RBAC), single sign-on (SSO), and multi-factor authentication (MFA) for all users, in conformance with the principle of least privilege. The following minimum role set shall be supported:

i) Supervisor Role: Permitted to create and modify Cadet Profiles and medication orders; administer medications; authorize clinical overrides;

view all audit trail entries for Cadets at the Supervisor's assigned academy. [CMD to confirm/refine permissions in writing within fifteen

(15) days of NTP.]

ii) Medication Administrator (Cadre/Staff) Role: Permitted to scan Patient Identification Tag and medication; complete the Five Rights Verification workflow; record administration, refusal, and waste; acknowledge alerts;

and view limited Cadet Profile information necessary to administer. [CMD to confirm/refine permissions in writing within fifteen (15) days of NTP.]

iii) System Administrator Role: Permitted to manage user accounts and role assignments; configure alert delivery; run reports; and view the audit trail. System Administrators shall not create or modify Cadet Profiles or medication orders. [CMD to confirm/refine permissions in writing within fifteen (15) days of NTP.]

iv) The Contractor shall implement the access scopes specified by CMD without additional charge. The eMAR System shall permit a System Administrator to create additional user roles and modify existing role permissions without Contractor assistance.

v) Single Sign-On (SSO) Integration. The Contractor shall support federated authentication via industry-standard SSO protocols, including Security Assertion Markup Language (SAML) 2.0 or OpenID Connect, integrated with CMD's identity provider (Microsoft Azure Active Directory / Entra ID, or successor identity provider designated by CMD). User identity, role assignment, and access provisioning may, at CMD's election, be managed through CMD's identity provider with permissions inherited by group membership.

vi) Multi-Factor Authentication. MFA shall be required for all users at login.

At a minimum, MFA shall be required for all administrative-role users.

Supported MFA factors shall include time-based one-time password (TOTP) applications and FIDO2 security keys. Short-message-service (SMS) text messages shall not be the sole MFA factor for administrative-role users.

vii) Deny by Default. Any user account not affirmatively assigned to one of the roles supported by the eMAR System shall have no access to the System or to any Cadet data. The Contractor shall not enable any default access for new accounts.

viii) Least Privilege and Permission Granularity. The eMAR System shall provide permission granularity sufficient to implement the principle of least privilege, including (but not limited to) separate permissions for:

viewing versus modifying Cadet Profile data; viewing versus exporting audit trail data; administering user accounts; and configuring System settings. The Contractor shall provide CMD a documented permission matrix during implementation.

ix) Unique Accounts and Service Account Controls. Each user shall have a unique account associated with that user's identity. The Contractor shall not provision shared accounts or generic accounts. The Contractor shall provide CMD a documented process for non-user service accounts (e.g., system integration accounts) with controls restricting their use, rotating their credentials, and logging their activity.

J. Security, Hosting, and Compliance Requirements.

i) Data Hosting, Residency, and FedRAMP Authorization. The Contractor shall host all Cadet data on cloud infrastructure that (1) is located exclusively within the contiguous United States (CONUS), and (2) is Federal Risk and Authorization Management Program (FedRAMP) authorized at the Moderate impact level or higher. The Contractor shall provide a current FedRAMP Authorization to Operate (ATO) letter or FedRAMP Marketplace listing demonstrating this authorization at proposal submission and shall maintain such authorization throughout the contract term. The Contractor shall not transfer, share, or permit access to Cadet data by any third party (including subprocessors) without express prior written authorization by CMD.

ii) Encryption. The Contractor shall encrypt all Cadet data in transit using Transport Layer Security (TLS) version 1.2 or higher, and at rest using the Advanced Encryption Standard (AES) with a 256-bit key length or equivalent.

iii) Integration and Application Programming Interface (API) Security. Any integration between the eMAR System and a CMD or third-party system shall (1) use industry-standard authentication (Auth 2.0, SAML, or equivalent); (2) be encrypted in transit; (3) be logged in the audit trail and forwarded to the SIEM; and (4) be implemented under the principle of least privilege. The Contractor shall provide CMD a documented inventory of all integration interfaces and their authentication mechanisms during implementation.

iv) System Availability. The eMAR System shall always be available except for scheduled maintenance periods. The Contractor shall provide CMD not less than forty-eight (48) hours advance written notice of any planned maintenance window. CMD may reject any proposed maintenance window that conflicts with active medication administration hours at any academy site, in which case the Contractor shall propose an alternative window. CMD's written acceptance of the proposed window shall be required before the Contractor performs the maintenance. Emergency maintenance addressing an active security or stability incident may proceed with whatever notice is practicable, with full written notice to CMD as soon as possible thereafter.

v) Security Attestation. The Contractor shall maintain a current annual System and Organization Controls 2 Type II (SOC 2 Type II) attestation, or an equivalent independent third-party security attestation acceptable to CMD, for the duration of the contract. The Contractor shall provide CMD a copy of each annual attestation within thirty (30) days of issuance.

vi) Healthcare and Privacy Compliance. The Contractor shall comply with all applicable provisions of the California Confidentiality of Medical Information Act (CMIA, California Civil Code section 56 et seq.); the California Consumer Privacy Act (CCPA, California Civil Code section

1798.100 et seq.); the federal Health Insurance Portability and Accountability Act (HIPAA), where applicable; and the federal Family Educational Rights and Privacy Act (FERPA), where applicable.

vii) Breach Notification. The Contractor shall notify the CM, the CMD Contracting Officer, and the CMD Chief Information Security Officer (CISO) in writing within twenty-four (24) hours of discovery of any actual or suspected breach, unauthorized access, or unauthorized disclosure of Cadet data or protected health information (PHI). The Contractor shall provide a complete written incident report within seventy-two (72) hours of discovery, identifying the nature, scope, root cause, affected Cadets, and remedial actions taken or planned. The Contractor shall cooperate with CMD in providing any notifications required by any applicable law including but not limited to CMIA, CCPA, HIPAA, or FERPA and shall participate in CMD-led incident response activities including (without limitation) post-incident reviews and corrective action planning.

viii) Data Export and Download Controls. The eMAR System shall restrict the ability to export or bulk-download Cadet data to user roles affirmatively authorized by CMD for that purpose. Export and bulk-download events shall be logged in the audit trail and forwarded to the SIEM. The Contractor shall make available a configurable threshold for triggering an alert on bulk-download events.

K. Implementation. The Contractor shall complete implementation of the eMAR System at all four academy sites within the timeline established in the Deliverables section. Implementation shall include the following Contractor responsibilities, each of which shall be performed without additional charge:

i) Project Kick-Off Meeting. Within five (5) business days after NTP, the Contractor shall convene a written-agenda kick-off meeting with the CM and CMD designees. The meeting shall confirm the implementation schedule, key personnel, communication protocols, and escalation procedures.

ii) Implementation Schedule. Within ten (10) business days after NTP, the Contractor shall deliver a written implementation schedule covering:

System configuration; user account creation; Cadet Profile data entry support; training; user-acceptance testing; and go-live at each academy.

iii) System Configuration. The Contractor shall configure the eMAR System to reflect CMD's user roles, alert configurations, maintenance window preferences, and any other configurable settings designated by CMD in writing.

iv) Data Entry Support. The Contractor shall not be required to enter Cadet data on CMD's behalf. The Contractor shall provide CMD with documented tools and procedures for bulk or individual data entry and shall provide reasonable technical assistance during initial data entry.

v) User-Acceptance Testing (UAT). Prior to go-live at each academy, the Contractor shall support CMD-conducted user-acceptance testing covering each functional area of this Section. Go-live at an academy shall not occur without written CMD acceptance of UAT results for that academy.

L. Tutorial/Training. The Contractor shall deliver online training in the use of the eMAR System to CMD personnel as follows:

i) Audience. Training shall be provided to all CMD personnel who will use the eMAR System in any role, including Medical Officers, Medication Administrators (Cadre and Staff), and System Administrators.

ii) Content. Training shall cover, at minimum: user authentication and MFA;

Cadet Profile management (for roles with that access); the Five Rights Verification workflow; alert acknowledgment workflows; controlled substance and witness workflows; and breach reporting expectations.

iii) Format. Training shall be delivered via live virtual session at CMD's election. Recorded training materials and written user guides shall be provided to CMD for use in onboarding new personnel after go-live, at no additional cost.

iv) Duration. Initial training shall consist of not less than three (3) hours of instruction for Supervisor and System Administrator roles, and not less than two (2) hours for Medication Administrator roles, exclusive of any pre- and post-assessments.

v) Competency Assessment. The Contractor shall create and administer a written or electronic post-training competency assessment to each trainee. CMD shall determine, based on the assessment results, whether a trainee is qualified to use the eMAR System in their assigned role. The Contractor shall provide remedial training, at no additional cost, to any trainee CMD determines is not yet qualified.

vi) Attendance Records. The Contractor shall maintain an attendance roster for each training session, signed by the Contractor's training lead and by each trainee, and shall provide a copy to the CM within two (2) business days after each session.

vii) Training Frequency. The Contractor shall provide the initial tutorial/training no later than 5 (5) business days prior to Go-Live and thereafter provide refresher tutorial/training annually between the months of June or July. The CM shall coordinate with the Contractor sixty

(60) days prior to scheduling of training each year in writing.

viii) Contract shall provide user-guide on how to use the eMAR software (i.e.

visual power-point slide, video platform, etc)

M. Technical Support and Maintenance. The Contractor shall provide ongoing technical support and maintenance of the eMAR System as follows:

i) Support Hours and Response Times. The Contractor shall provide technical support twenty-four (24) hours per day, seven (7) days per week. The Contractor shall acknowledge support requests within the times set forth below, measured from CMD's submission of the request:

(1) Priority 1 (System Down or Unusable): Acknowledge within one

(1) hour; Contractor shall work continuously until restoration.

(2) Priority 2 (Significant Functional Impairment): Acknowledge within four (4) hours; Contractor shall work continuously during business hours until restoration.

(3) Priority 3 (Standard / Non-Urgent): Acknowledge within eight (8) business hours.

ii) Adverse Medical Events Are Not Within Support Scope. Support requests involving an actual or suspected adverse Cadet medical event are not within the Contractor's support obligations and shall be handled by CMD personnel through normal medical emergency response procedures. The Contractor's support obligation is limited to eMAR System functionality.

iii) Maintenance and Updates. All software updates, security patches, bug fixes, and routine maintenance of the eMAR System shall be included in the contracted price at no additional cost. The Contractor shall comply with the maintenance window requirements set forth above.

N. End-of-Contract Data Return and Transition. Upon expiration, non-renewal, or termination of this contract for any reason, the Contractor shall:

i) Data Export. Within fifteen (15) business days after the end of the contract, export and deliver to CMD all Cadet data in the eMAR System in HL7 FHIR format or another open, machine-readable format acceptable to CMD. Cadet data shall include:

ii) Format Specification. Provide written documentation of the export format, schema, and contents sufficient for CMD or a successor contractor to import the data into a replacement system.

iii) Transition Support. Provide up to forty (40) hours of technical transition support to CMD or a successor contractor, at no additional cost, for the purpose of validating and importing the exported data.

iv) Retention Pending CMD Confirmation; Subsequent Deletion. The Contractor shall retain all Cadet data in the eMAR System until CMD provides written confirmation of successful receipt and validation of the exported data. Within thirty (30) calendar days after CMD's written confirmation, the Contractor shall permanently delete all copies of Cadet data from all Contractor systems, backups, and storage, and shall provide CMD a written certification of deletion identifying the deletion method used. CMD will determine in writing whether any portion of the data must be retained beyond that period for legal hold or other reason.

7. Deliverables and Milestones A. All deliverables shall be provided in accordance with the schedule below.

Deliverable Due Date Acceptance Criteria 1 Project Kick-Off Meeting and Written Implementation Schedule (per Scope of Services).

Kick-off: within 5 business days after

NTP.

Implementation Schedule: within 10 business days after

NTP.

Mutually agreed upon by the CM and the Contractor.

2 Configured eMAR System ready for User- Acceptance Testing (per Scope of Services).

Per the Implementation Schedule.

All configurable items set per CMD's written instructions; ready for UAT.

3 Training Delivery and Competency Assessment Results (per Scope of Services).

No later than 5 business days prior to Go-Live

Signed attendance rosters delivered to CM within 2 business days after each session; competency assessment results provided.

4 Go-Live at All Four Academy Sites.

July 6th 2026 unless determined otherwise by the

CM.

Written CMD acceptance of UAT at each academy; eMAR System operational at all four sites.

5 End-of-Contract Data Export and Deletion Certification (per Scope of Services).

Export: within 15 business days after end of contract.

Deletion certification: within 30 days after CMD's written confirmation of receipt.

Data delivered in format specified in Scope; written certification of deletion delivered.

8. State Responsibilities

A. Designation of CM. Within five (5) days of contract execution, CMD shall designate the CM by name and contact information.

B. Points of Contact. Within five (5) business days after NTP, CMD shall designate a point of contact at each of the four academy sites.

C. Information for Configuration. Within ten (10) business days after NTP, CMD shall provide the Contractor with the information necessary to configure the eMAR System, including but not limited to user lists with assigned roles, alert delivery preferences, and maintenance window preferences.

D. Deliverable Review. CMD shall review each Contractor deliverable and provide written acceptance or rejection (with rationale) within ten (10) business days of receipt.

E. Staff Availability for Training. CMD shall make CMD personnel available for training sessions in accordance with the training schedule established in the Implementation Schedule.

F. User-Acceptance Testing. CMD shall conduct user-acceptance testing in accordance with the Implementation Schedule and shall provide written acceptance or rejection of UAT results at each academy.

9. Data Ownership, Security, and Disposition A. Ownership of Data. The State of California owns all Cadet data and all derivative data created, processed, transmitted, or stored under this contract. The Contractor acquires no ownership interest, license to use beyond contract performance, or right to retain, transfer, sell, or repurpose any such data.

B. Security, Breach Notification, Export, and Deletion. The Contractor's obligations regarding data hosting, encryption, security attestation, breach notification, end-of-contract data export, and data deletion are set forth in the Scope of Services (security, hosting, and compliance requirements; end-of-contract data return and transition). Nothing in this Section adds to, modifies, or limits those obligations.

C. Cooperation with Legal Hold. If CMD provides the Contractor with written notice of a legal hold or preservation order applicable to any Cadet data, the Contractor shall preserve the identified data under the same security and confidentiality obligations as during the contract term, until CMD provides written notice that the hold has been released.

10. Acceptance Criteria A. The Contractor's deliverables and ongoing performance under this contract shall be accepted by CMD upon satisfaction of the criteria set forth in this Section.

Acceptance under this Section does not waive any other right or remedy of CMD under this contract or applicable law.

B. Deliverable Acceptance. CMD shall review each deliverable identified in this Statement of Work within ten (10) business days of receipt and provide written acceptance, rejection (with rationale), or a request for clarification. A deliverable shall be deemed accepted only upon CMD's written acceptance.

C. User Acceptance Testing (UAT). Prior to go-live at each academy site, CMD shall conduct user acceptance testing of the configured eMAR System against the functional and technical requirements set forth in the Scope of Services. Go-live at any site shall not occur without CMD's written acceptance of UAT results for that site.

D. Ongoing Performance Acceptance. The Contractor's ongoing performance shall be deemed accepted on a monthly basis subject to CMD's written notice of any performance deficiency, which shall trigger the cure provisions set forth in the Contract Term Section.

E. Material Failure. Failure by the Contractor to meet any acceptance criterion shall, at CMD's election, (1) be subject to the cure period set forth in the Contract Term Section; (2) result in payment withholding pending cure; or (3) constitute grounds for termination for cause.

11. Mandatory Submittals A. Technical Capability Documentation. Documentation demonstrating that the proposed eMAR System meets the technical, functional, security, hosting, integration, and compliance requirements set forth in the Scope of Services.

B. Bidder Experience. The Bidder's demonstrated experience providing eMAR or comparable healthcare Software-as-a-Service products to residential, educational, behavioral health, or other institutional settings of comparable scope and complexity.

C. References. Verifiable references from prior or current customers of the Bidder, with preference given to references from state agencies, public-sector clients, or healthcare clients of comparable size and operating model.

End of Statement of Work

Page 1 of 10 February 2025 rev.

SECTION 1

REQUEST FOR PROPOSAL

1-01. The State of California Military Department shall accept proposals until June 5, 2026 at 10:00AM, from qualified proposers offering to provide equipment, materials, labor, licenses, bonds and insurance required for the Electronic Medication Administration Record Software Subscription & Training Services from on or around June 15 2026 through June 14, 2026 in accordance with the terms and conditions, and requirements of this Request for Proposal (RFP).

All questions regarding this RFP must be submitted in writing to Ash Erickson at bids@cmd.ca.gov no later than May 27, 2026 at 12:00PM. If an addendum is necessary it will be issued prior to May 29, 2026 at 12:00PM.

a. Basis of award of this contract will be the lowest responsive proposal from a qualified, responsible contractor.

b. In the event of a tie between two proposals, the Military Department Contracting Officer shall conduct a coin toss to determine award. The coin toss shall be witnessed by a minimum of two personnel from the Purchasing and Contracting Branch.

c. Proposers are not required to visit the worksite. Contractors are responsible for satisfying themselves as to the local conditions, to accurately measure area and insure the actual area of work for the preparation of their bid. Contractors providing a proposal without visiting the worksite, do so at their own risk. Contractors can schedule a worksite visit by contacting the Ash Erickson at bids@cmd.ca.gov.

1-02. The State is seeking a single proposal, not to exceed, to be inclusive of all contract's costs involved in performing the full scope of this service.

a. Proposal MUST be submitted for the entire work described therein. Any deviation from the specification will not be considered and will be cause for rejection of your proposal.

b. The Military Department reserves the right to reject any or all proposals.

1-03. Contractor shall provide qualified and trained personnel during the contract period. Personnel skilled in the work to be done shall execute in a careful, neat, proficient manner, and in compliance with acceptable trade practices.

a. Specific schedule and definition of level of service will be found in the Technical Specifications of this RFP.

b. All services called for in this RFP and the resulting contract will be performed in accordance with the specific requirements and schedule of performance found in the technical specifications.

c. Costs of developing and submitting proposals are entirely the responsibility of the firm and shall not be chargeable to or paid by the State of California.

d. The Prime Contractor shall self-perform on the site with its own organization, work equivalent to at least twenty percent (20%) of the total amount of work to be performed under the contract. The Prime Contractor shall provide at all times sufficient competent labor, materials, and equipment to properly carry on the work and to ensure completion within the time agreed.

1-04. Questions regarding this RFP, worksite conditions, and/or contractor responsibilities shall be directed as follows: Please email CA Military Department personnel who initiated this solicitation (Ash Erickson at bids@cmd.ca.gov) between 8:00 am and 3:00 p.m. Monday through Friday.

1-05. The use of the proposal forms provided in this RFP is mandatory (or a xerox copy of the attached forms).

1-06. Withholding on Independent Contractors doing business with the State:

a. Pursuant to California Revenue and Taxation Code Section 18806.1, independent contractors may be subject to one (1) percent State Income Tax Withholding.

Page 2 of 10 February 2025

b. An independent contractor as defined in the Black's Law Dictionary is: "one who, in the exercise of independent employment, contracts to do a piece of work according to their own methods and is subject to their employer's control only as to the end product or final result of work."

1-07. Contract Standard Clauses - Contractor awarded a contact pursuant to this RFP will be required to sign contract documents containing the following provisions:

a. The Contractor agrees to indemnify and save harmless the Military Department, the State, its officers, agents and employees from any and all claims and losses accruing or resulting to any and all contractors, subcontractors, material men, laborers and any other person, firm or corporation furnishing or supplying work, services, materials or supplies in connection with the performance of this contract, and from any and all claims and losses accruing or resulting to any person, firm or corporation who may be injured or damaged by the contractor in the performance of this contract.

b. The Contractor, and the agents and employees of Contractor, in the performance of this agreement, shall act in an independent capacity and not as officers or employees or agents of the State of California.

c. The State may terminate this agreement and be relieved of the payment of and consideration to the Contractor should Contractor fail to perform the covenants herein contained at the time and in the manner herein provided. In the event of such termination the State may precede with the work in any manner deemed proper by the State. The cost to the State shall be deducted from any sum due the contractor under this agreement and the balance, if any, shall be paid the Contractor upon demand.

d. Without the written consent of the State, This agreement is not assignable by Contractor either in whole or in part.

e. Time is of the essence in this agreement.

f. No alteration or variation of the terms of this contract shall be valid unless made in writing and signed by the parties hereto, and no oral understanding or agreement not incorporated herein, shall be binding on any of the parties hereto.

g. The consideration to be paid Contractor, as provided herein, shall be in compensation for all of Contractor's expenses incurred in the performance hereof, including travel and per diem, unless otherwise expressly provided.

h. Contractor swears under penalty of perjury that no more than one final unappealable finding of contempt of court by a Federal Court has been issued against the Contractor within the immediately preceding two-year period because of the Contractor's failure to comply with an order of the National Labor Relations Board.

i. This contract may be amended during the period of contract performance, subject to the mutual agreement of parties.

j. This contract shall be subject to and construed in accordance with the laws of the State of California, whether or not specifically cited herein (including but not limited to Government Code § 927).

k. This agreement contains all the terms and conditions agreed to by all parties. No other understanding, oral or otherwise, regarding the subject matter of this agreement, shall be deemed to exist or to bind any of the parties hereto.

l. The contractor agrees to recognize the mandatory standards and policies relating to the energy efficiency in the

State Energy Conservation Plan Title 23, California Code of Regulations, as required by the U.S. Energy Policy and Conservation Act (Public Law 94-165).

m. Contractor shall not enter into any subcontracts for the performance of the principle services to be rendered under this agreement without the express consent in writing of the State. Any subcontractors authorized to provide such services MUST meet and comply with all requirements set forth in this agreement.

Page 3 of 10 February 2025

n. All Contracting parties shall be subject to the examination and audit of the Auditor General for a period of three years after final payment under the contract (Government Code Section 10532) should the contract amount exceed $10,000.

o. Contractor agrees that the Military Department or its delegatee will have the right to review, obtain, and copy all records pertaining to performance of the contract. Contractor agrees to provide the Military Department with any relevant information requested and shall permit the Military Department access to its premises, upon reasonable notice, during normal business hours for the purpose of interviewing employees and inspecting and copying such books, records, accounts, and other material that may be relevant to a matter under investigation for the purpose of determining compliance with Public Contract Code Section 10115 et. seq. and Title 2, California Code of Regulations, Section 1896.60 et. seq. and for the purpose of determining compliance with the State requirements for M/WBE and DVBE. Contractor further agrees to maintain such records for a period of three (3) years after final payment under the contract.

p. This agreement is valid and enforceable only if sufficient funds are made available by the Budget Act for each

Fiscal Year of this agreement for the purposes of this contract. This contract is further subject to any additional restrictions, limitations, or conditions enacted by the Legislature and contained in the above Budget Bills or any statute enacted by the Legislature which may effect the provisions, terms, or funding of this or any subsidiary contract in any manner.

1-08. Cancellation, Modification, and Waiver: The Military Department reserves the right to cancel or modify this RFP, in whole or in part. The Military Department may reject any or all proposals for cause, and may waive any immaterial deviation or defect in a proposal. The Military Department's waiver of a deviation or defect shall in no way modify the IFB documents, or excuse the contractor from full compliance with the RFP specifications if awarded the contract.

1-09. Drug-Free Workplace Certification: Senate Bill 1120, Chapter 1170, Statutes of 1990, requires state contractors to maintain a "drug-free workplace".

a. Every contractor MUST comply with the following:

(1) Certify that the individual or organization "will provide a drug-free workplace" (Government Code Section 83355).

(2) Publish a statement notifying employees that company policy prohibits specified activities involving controlled substances, and defining actions to be taken for violating the policy (Government Code Section 8355(a)).

(3) Establish a drug-free awareness program to inform employees about specified topics (Government

Code Section 8355 (b)).

(4) Provide the drug-free statement to each employee working on a state contract and require that these employees agree to abide by the terms of the statement (Government Code Section 8355(c)).

a. A state agency may cancel a contract if it finds that the contractor has falsely certified a drug-free workplace or failed to fulfill the requirements defined in Government Code Section 8355(a) thru (c). Every month the Department of General Services is required to publish a list of individuals and organizations whose contracts have been canceled; this list will appear in the State Contracts Register. State agencies are forbidden to contract with, or award to, individuals or organizations appearing on this list.

1-10. The California Taxpayer and Shareholder Protection Act of 2003, Public Contract Code section 10286, et seq., which prohibits state agencies from contracting with expatriate companies, unless they satisfy minimum requirements related to shareholder rights, or obtain a waiver, effective April 1, 2004. An expatriate company is a United States company that has moved, in name and on paper only, to a tax haven country (typically Bermuda or the Bahamas) and has no substantial business activities in the country of reincorporation.

1-11. Antitrust Claims (GC §§ 4552, 4553 & 4554) are hereby incorporated by reference and made part of this solicitation as if attached hereto. This provision can be viewed on the DGS/OLS website http://www.dgs.ca.gov/pd/Home.aspx http://www.dgs.ca.gov/pd/Home.aspx

Page 4 of 10 February 2025

1-12. TACPA Preference, if applicable (GC § 4530, et seq. and 2 CCR § 189.30) is hereby incorporated by reference and made part of this solicitation as if attached hereto. Contact DGS/Dispute Resolution/Preference Program Section for information on TACPA at (916) 375-4604 or (916) 375-4600.

1-13. Loss Leader Provisions (PCC § 10344) are hereby incorporated by reference and made part of this solicitation as if attached hereto.

1-14. Iran Contracting Act Certification (PCC § 2202) are hereby incorporated by reference and made part of this solicitation as if attached hereto.

1-15. General Provisions (DGS PD 403-ITGP) Non-Cloud IT, Effective 02/20/2025 https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General- Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf

1-16. General Provisions (DGS PD 402-ITGP) Cloud IT – Software as a Service (SaaS), Effective 02/20/2025 https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General- Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf

1-17. In the event of a precise tie, the CA Military Department will utilize a coin toss, observed by witnesses documented in the procurement file. In the event of a precise tie between two SB supplies in which one is also a DVBE, the award shall go to the SB that is also a DVBE. It is unlawful for any person engaged in business within this state to sell or use any article or product as a “loss leader” as defined in §17030 of the Business and Professions Code.

A five percent (5%) bid preference is available to a non-small business claiming twenty-five percent (25%) California certified small business subcontractor participation. If claiming the non-small business subcontractor preference, the bid response must include a list of the small business(as) with which you commit to subcontract in an amount of at least twenty-five percent (25%) of the net bid price with one of more California certified small businesses. Each listed certified small business must perform a “commercially useful function” in the performance of the contract as defined in Government Code Section 14837(d)(4).

The required list of California certified small business subcontracts must be attached to the bid response and must include the following: 1) subcontractor name, 2) address, 3) phone number, 4) a description of the work to be performed and/or products supplied, 5) and the dollar amount or percentage of the net bid price (as specified in the solicitation) per subcontractor. Bidders claiming the five percent (5%) preference must commit to subcontract at least twenty-five percent (25%) of the net bid price with one or more California certified small businesses.

Completed certification applications and required support documents must be submitted to the office of Small Business and DVBE Certification (OSDC) no later than 5:00 p.m. on the bid due date, and the OSDC must be able to approve the application as submitted. Questions regarding certification should be directed to the OSDC at (916) 375-4940. The DVBE Participation Program Requirements have been waived for this solicitation.

1-18. Award of Contract - Award of contract, if made, will be in accordance with the RFQ information on Evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ documents and an addendum thereto, except for such immaterial defects as may be waived by the State. The award, if made, will be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its bid, the State may accept any item or group of items of any bid. The State reserves the right to modify or cancel in whole or in part its RFQ.

Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the paragraph titled “Protests” of this RFQ.

https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf…