Exhibit_A-1_Service_Specifications_Rev._10-4-24.pdf

Proposal Number: SD23-00094 California Department of Corrections and Rehabilitation (CDCR)/ Exhibit A-1 California Correctional Health Care Services (CCHCS) Service Specifications

ELECTROCARDIOGRAPH (ECG) EQUIPMENT AND CARDIOLOGIST OVER-READ AND

INTERPRETATION SERVICES

1. Contractor’s and/or Provider’s Qualifications

Contractors and/or Providers performing services to California Department of Corrections and Rehabilitation/California Correctional Health Care Services (CDCR/CCHCS) shall have the minimum experience outlined below:

a. Minimum of twelve (12) continuous months of experience within the last three (3) years performing services similar in scope to those defined herein, in a public or private institution. Internship does not count towards the required experience.

b. All Contractors and/or Providers shall have the required licenses, permits, and/or certifications as stated below and as required by law; refer to Provision (2), Licenses, Permits, and Certification Requirements for details.

c. Patient health care is of paramount importance. Accuracy and security of communications is critical to ensure timely, correct care is provided. Therefore, Contractors and/or Providers providing services through this Agreement shall be proficient in the English language and be able to communicate effectively with CDCR/CCHCS and transmit data electronically through a secure HIPAA compliant platform. All Contractors and/or Providers shall be able to speak, understand oral and written communication, and write effectively, in the English language.

d. Any Contractor and/or Providers who fail to meet the minimum qualifications shall not be permitted to perform service. The Institution’s Chief Executive Officer (CEO), Chief Medical Executive (CME), or designee, shall state in writing the reason(s) the Provider does not meet minimum qualifications and submit to the Contractor and the CDCR/CCHCS, Direct Care Contracts Section Help Desk at CCHCSHealthCareContractsHelpDesk@cdcr.ca.gov. After notification of failure to meet minimum qualifications has been provided, CDCR/CCHCS shall not pay the Contractor and/or Provider for any additional services identified as not meeting the minimum qualification.

2. Licenses, Permits, and Certification Requirements

Prior to providing services as outlined in this Agreement, Contractor shall:

a. Ensure that each Provider referred by the Contractor shall possess and maintain throughout the term of this Agreement, a current and valid Cardiovascular Disease/Internal Medicine license issued by the Medical Board of California; and/or a current and valid license/certification credentialed by the Cardiovascular Credentialing International (CCI), in order to perform services in the State of California.

The Provider shall provide a minimum of one (1) Physician licensed to practice medicine in the State of California as defined in the Medical Practice Act, Chapter 5, commencing with Section 2000, of the Business and Professions Code.

b. Contractor and/or Provider shall possess and maintain throughout the term of this Agreement, valid and unconditional licensure with no pending accusations from the licensing board by which they are licensed to practice and board certification in the area of the medical specialty.

c. Each Cardiologist who provides services under this Agreement shall possess and maintain throughout the term of this Agreement, a valid and unconditional licensure with no pending accusations. Provider shall be Board Certified with either the American Board of Internal Medicine or American Osteopathic Board of Internal Medicine to practice in the area of Cardiology.

mailto:CCHCSHealthCareContractsHelpDesk@cdcr.ca.gov

Proposal Number: 23-00094 CDCR/CCHCS Exhibit A-1 Service Specifications

d. Provide copies of any required license(s), permits, and/or certification(s) for each Provider to the Institution’s CEO/CME or designee, to be kept on file at the institution throughout the term of this Agreement. Contractor shall ensure that all required licenses, permits, certifications, and any other requirements outlined herein are current and in effect at all times during the term of this Agreement.

e. In the event the required licenses, permits, and/or certifications are to expire, Contractor shall provide current/renewed license(s), permit(s) and/or certification(s) to CDCR/CCHCS not less than thirty (30) calendar days prior to their expiration. If, during the course of this Agreement, any of the licenses and/or requirements are found to be inactive or not in compliance, CDCR/CCHCS may withhold payment for services rendered during the expiration period and/or immediately terminate this Agreement.

f. Assume responsibility for verifying through the appropriate licensing boards that no current or unresolved adverse actions have been taken by the State licensing authorities against any Providers assigned to CDCR/CCHCS, and that all licenses are active and void of misconduct. Contractor is required to notify CDCR/CCHCS of any license status changes upon notification from the licensing entity. CDCR/CCHCS may, at its discretion, verify the current status of Providers assigned.

3. Contractor’s and/or Provider’s Responsibilities – ECG Services

Under the direction of the Institution’s CEO/CME or designee, Contractor and/or Provider shall provide services as permitted within the scope of practice for ECG Equipment and Cardiologist Over-read and Interpretation Services in accordance with institution policies and procedures. Duties/Responsibilities shall include, but are not limited to:

a. ECG Equipment shall contain the following at no additional charges listed in the Exhibit B-1:

(1) ECG machine shall include a display screen, keyboard, and utilizes standard size paper and tab electrodes.

(2) Provide the most advanced interpretation algorithm available on the market.

(3) A hook-up mechanism (Advisor) that notifies the nurse when the patient is hooked up correctly.

(4) ECG machine shall have the auto interpretation option and have the ability to print out the interpretation (results) immediately.

(5) ECG machine shall have the ability to transmit the data securely via local area network, telephone, and wireless network.

(6) ECG machine shall be set up to only transmit to the Contractor’s servers when an Over-read is requested.

(7) If and when requested by from the Institution(s), the ECG machines will be set up to transmit each test to the Contractor through a portal.

b. The additional services shall be performed at no additional charges listed in Exhibit B-1:

(1) Ship, deliver and/or pick up all ECG machines/carts, including machines needing repair or replacement.

(2) Data storage and data retrieval, during the life of the contract, shall be provided at no cost to

CDCR/CCHCS.

Service Specifications

(3) Data storage and data retrieval, after the life of the contract, shall be provided by the Provider according to Exhibit D, Special Terms and Conditions & Additional Provisions, Provision 7, Computer Software Management Memo.

(4) Install each ECG machine on-site.

(5) Train CDCR/CCHCS staff at each individual institution on the operation and monitoring the equipment when new ECG equipment is initially set up or upgraded.

(6) Provider will work with CDCR/CCHCS Institution staff as needed for transmission of data.

(7) Throughout the term of this Agreement, Contractor and/or Provider shall comply with all information technology updates and/or upgrades.

(8) Throughout the term of this Agreement, Contractor and/or Provider shall supply shipping labels for any return shipping of used ECG machine that institution no longer need or old/used ECG machines being replaced with new machines.

(9) Work with CDCR/CCHCS Institution to set up a scheduled rollout regarding Provider’s equipment set-up or removal.

(10) A supply starter kit shall be included with each machine (including all necessary paper, clips, cords and cables).

(11) Contractor will troubleshoot equipment if not working properly and will replace within seventy-two

(72) hours if any equipment is deemed faulty at the contractor’s expense.

c. Other Services Provided by Contractor

If a bidirectional specific ECG machine integration is implemented in the future with the CDCR/CCHCS electronic health record system (EHRS), the Contractor’s ECG machines, and network shall have the ability to do a bidirectional interface with EHRS at no additional cost to CDCR/CCHCS. Contractor’s machines/network shall receive ECG data electronically from CDCR institutions and directly upload reports into CDCR/CCHCS EHRS specific patient charts. CDCR/CCHCS staff shall host the system interface and have access to CDCR/CCHCS patient electronic health records and/or data at all times.

d. Preventative Maintenance

Contractor and/or Provider shall perform all maintenance services as required in the manufacturer's recommendations as specified herein, and as necessary to maintain the optimum level of efficiency for each specified piece of equipment. All services provided by Provider, including calibration, preventative maintenance, safety inspections, etc., shall conform to all applicable City, County, State and Federal laws, ordinances, regulations, guidelines, pamphlets, circulation letters, or any other applicable directives. This includes but is not limited to: Title 17 and Title 22. California Code of Regulations, California Rehabilitation Control Regulations, Subchapters 4 and 45, Chapter 5, Safety Orders of the State of California Division of Industrial Safety, Joint Commission of Accreditation of Hospitals Organization, American Hospital Association, College of American Pathologists, National Association of Fire Protection, California Occupational Health and Safety Administration, National Sanitation Foundation, and the State Fire Marshall’s Office. Provider shall submit proof of compliance for each machine on an annual basis, or as often as is required per the regulating agency.

e. In case of equipment failure or need of emergency repair, Provider shall respond to the institution by telephone within eight (8) hours of notification of failure or emergency repair and ship replacement unit within twenty-four (24) hours of notification by institution that the ECG machine is damaged or not working

Service Specifications properly. At contract expiration, Provider is responsible for all costs associated with shipping ECG machines back from the institution(s).

f. Provider expressly agrees that Provider shall not charge CDCR for any and all loss of damaged ECG machines provided by Provider prior to this Agreement and, in consideration of this Agreement hereby waives all claims for recovery of any expenses for their loss or damage.

g. Contractor and/or Provider shall give at least twenty-four (24) hours’ notice prior to bringing to an institution any medical/surgical equipment that has not specifically been authorized by CDCR Custody Services.

h. Contractor and/or Provider is responsible for ensuring medical equipment brought on-site for performance of the contracted duties meets all regulatory compliance, calibrations, including any requirements for sterilization. CDCR/CCHCS reserves the right to request verification of equipment compliance prior to equipment being brought into an Institution and throughout the term of the Agreement as necessary. CDCR/CCHCS is not responsible for ensuring storage or compliance of the equipment.

i. CDCR shall provide a copy of the CDCR’s formulary to be kept on file by the Contractor and/or Provider.

Contractor and/or Provider shall consult with CDCR physicians to assure whenever possible Contractor and/or Provider will prescribe only those medications which are on the CDCR’s formulary unless the Institution’s CEO/CME or designee grants prior authorization for deviation.

j. Cardiologist Over-read Portal

Shall have the ability to accept daily batches through an online portal that meets the requirements in Exhibit G. Cardiologist shall be able to interpret over-reads from batches uploaded into portal within the time specified in Sections k and I of this Exhibit.

k. Routine (regular) Over-reads

Regular Over-reads, when requested by CDCR/CCHCS personnel, shall be performed by a Board Certified Cardiologist. An Over-read shall be deemed requested when the site transmits the ECG to the Contractor. Each transmitted ECG will get a regular Over-read unless requested. Provider shall submit the results of the regular Over-reads by electronic mail to the requesting CDCR/CCHCS personnel within twenty-four (24) hours of the request. In the event that electronic mail is not available at the institution, Provider shall email regular Over-reads back to the requesting personnel within twenty-four (24) hours of the request.

l. STAT Over-reads

STAT Over-reads, when requested by CDCR/CCHCS personnel, shall be performed by a Board Certified Cardiologist. Provider shall submit the results of the STAT Over-reads to the requesting CDCR/CCHCS personnel within one (1) hour of the request. In the event that electronic email is not available at the institution, Provider shall email STAT Over-reads back to the requesting institution within one (1) hour of the request.

m. Inspections

Inspections shall be carried out by the Institution’s CEO/CME or designee, at various times during the Agreement term to check on the quality and quantity of work and determine acceptability of work performed before Agreement payment will be approved.

n. ECG Holter Monitor Device

ECG Holter Monitor Device shall contain the following at no additional charges listed in Exhibit B-1:

Service Specifications

(1) Easy to use Cardiac Event Monitoring device with all accompanying wires and supplies that continuously records for up to 24 to 48 hours;

(2) Upload of monitored data from the patch to the Contractor’s secure server;

(3) Train CDCR/CCHCS staff via an instructional DVD, online course or learning module, or printed user guide;

(4) Provide for shipping of devices to and from institution via carrier;

o. Cardiac Event Monitor Patch

Cardiac Event Monitor Patch shall contain the following at no additional charges listed in Exhibit B-1:

(1) Wireless, non-invasive, water-resistant, easy to use single quantity Cardiac Event Monitoring patch with all accompanying supplies that continuously records for up to fourteen (14) days.

(2) Utilization of Contractor’s proprietary algorithm to analyze data by a Board Certified Cardiologist;

(3) Upload of monitored data from the patch to the Contractor’s secure server;

(4) Train CDCR/CCHCS staff via an instructional DVD or guide;

(5) Provide for shipping of devices to and from institution via carrier;

(6) Replacement of defective patch(es) as necessary; and

(7) Any other patch and/or services not listed above that are associated with the provisions identified under this Agreement.

p. Interpretations (for ECG Holter Monitor devices and Cardiac Event Monitor patches)

Interpretations shall be performed by a Board Certified Cardiologist. Provider shall assess the determination of the heart rate, assess the rhythm, and evaluate the electrical condition pattern. Once the monitor is received by the Contractor and/or Provider, email confirmation shall be provided to CDCR/CCHCS within thirty (30) minutes and interpretation shall be provided via email to requesting CDCR/CCHCS personnel within one (1) hour of the receipt.

q. Training and Customer Service

(1) At the discretion of the Institution’s CEO/CME or designee, Contractor shall provide instructional training via DVD, online course or learning module, webinar, or printed training guide to the institution’s medical staff;

(2) Provide a twenty-four (24) hour customer service telephone number to assist institution 7 days per week as needed; and

(3) Provide continuous customer service support throughout the term of the Agreement.

r. Reporting Requirements

(1) Provide preliminary cardiac arrhythmia findings to the Institution’s CEO/CME or designee, in accordance with institution’s policies and procedures and Contractor’s standards. Upon receipt of the Contractor’s completed data analysis (report), CDCR/CCHCS physician will review and respond accordingly.

Service Specifications

(2) Report submission detail shall be determined by CDCR/CCHCS; and

(3) Comply with Exhibit G - Business Associates Agreement (HIPAA) privacy and security rules.

4. Information Security

a. Acknowledgement

As an entity engaged in a contract, agreement, memorandum of understanding (MOU) and/or information receipt and/or information exchange with CDCR/CCHCS, you (herein referred to as the Contractor and/or Provider) acknowledge and agree that in the course of contract, agreement, MOU by and as indicated beyond, Contractor and/or Provider shall comply with applicable United States and California laws and regulations, including but not limited to Sections 14100.2 and 5328 et seq. of the Welfare and Institutions Code, Section 431.300 et seq. of Title 42, Code of Federal Regulations, the Health Insurance Portability and Accountability Act (HIPAA), including but not limited to Section 1320 d et seq., of Title 42, United States Code and its implementing regulations (including but not limited to Title 45, CFR, Parts 160, 162 and 164) regarding the confidentiality and security of individually identifiable health information (IIHI), California Medical Information Act, Lantermann-Petris-Short Act, Alcohol Substance and Abuse Act, California Public Records Act, California Information Practices Act of 1977, the California State Administrative Manual and its associated regulations, mandates, budget letters and memorandums, and the State Information Management Manual.

b. Standard of Care

(1) Contractor and/or Provider acknowledges and agrees that, in the course of its engagement with CDCR/CCHCS, Contractor and/or Provider may receive or have access to sensitive and/or private information.

(2) Contractor and/or Provider shall comply with the terms and conditions regarding creation, collection, receipt, management, sharing, exchanging, transmission, storage, disposal, use, and disclosure, of sensitive and confidential information.

(3) Contractor and/or Provider shall be responsible for, and remain liable to, CDCR/CCHCS for the actions of unauthorized employees, contractors and subcontractors concerning the treatment of CDCR/CCHCS related sensitive and confidential information, as if they were Contractor and/or Provider’s own actions.

(4) In recognition of the foregoing, Contractor and/or Provider acknowledges and agrees it shall:

i. Treat sensitive and confidential information with such degree of care required by federal and state requirements including but not limited to the United States National Institute for Standards and Technology and the State Administrative Manual Chapter 5300.

ii. Collect, use and disclose sensitive and confidential information solely and exclusively for the purposes for which the information, or access to it, is provided pursuant to the terms and conditions of this Agreement;

iii. Not use, sell, rent, transfer, distribute, or otherwise disclose or make available sensitive or confidential information for the benefit of anyone other than CDCR/CCHCS without CDCR/CCHCS’s prior written consent.

(5) Responsibilities of Contractor

Service Specifications

The Contractor is obligated to ensure the following:

i. Safeguards to prevent the unauthorized creation, use, management, transfer, distribution, storage, etc. The Contractor shall develop and maintain an information privacy and security program that includes the implementation of administrative, technical, and physical safeguards appropriate to the size and complexity of the Contractor’s operations and the nature and scope of its activities. The information privacy and security programs shall reasonably and appropriately protect the confidentiality, integrity, and availability of the CDCR/CCHCS information it creates, receives, maintains, or transmits; and prevent the use or disclosure of CDCR/CCHCS. Contractor shall provide CDCR/CCHCS with information concerning such safeguards as CDCR/CCHCS may reasonably request from time to time.

ii. Contractor shall restrict logical and physical access to CDCR/CCHCS sensitive and confidential information to authorized users only.

iii. Contractor shall implement appropriate authentication methods to ensure information system access to sensitive and confidential information. If passwords are used in user authentication (e.g., username/password combination), Contractor shall implement strong password controls on all compatible computing systems (including handheld and mobile devices) that are consistent with the National Institute of Standards and Technology (NIST) Special Publication 800-68 and the SANS Institute Password Protection Policy.

(6) Contractor shall:

Implement the following security controls on each server, workstation, or portable (e.g., laptop computer) computing device that processes or stores sensitive or confidential information:

i. Install a network-based firewall and/or personal firewalls;

ii. Continuously update anti-virus software on all systems;

iii. Encrypt all confidential, personal, or sensitive data stored on portable electronic media (including but not limited to CDs and thumb drives) and on computing devices (including but not limited to laptop computers, cell phones, and tablets) with a solution that uses proven industry standard encryption algorithms.

(7) Contractor and/or Provider

To ensure any agent that provides CDCR/CCHCS information or created or received by the Contractor and/or provider, for the purposes of this contract, Contractor shall ensure that such Providers comply with the same restrictions and conditions that apply to the Contractor with respect to such information.

(8) Notification of Electronic Breach or Improper Disclosure

During the term of this Agreement, Contractor and/or Provider shall notify CDCR/CCHCS within twenty-four (24) hours upon discovery of any probable breach of sensitive or confidential information where the information is reasonably believed to have been acquired by an unauthorized person.

Immediate notification shall be made to the CDCR/CCHCS Chief Information Security Officer, Information Security Officer and/or their designee(s). Contractor and/or Provider shall take prompt corrective action to cure any deficiencies and any action pertaining to such unauthorized disclosure

Service Specifications required by applicable Federal and State laws and regulations while at the same time preserving evidence for investigation. Service Provider shall investigate such breach and provide a written report of the investigation to the CDCR/CCHCS Information Security Officer, postmarked or emailed within eight (8) business days of the discovery of the breach.

(9) Employee Training and Discipline

To train and use reasonable measures to ensure compliance with the requirements of this Agreement by employees who assist in the performance of functions or activities under this Agreement and use or disclose CDCR/CCHCS information; and have in place a disciplinary process for such employees who intentionally violate any provisions of this Agreement, up to and including termination of employment as required by law or policy.

(10) Audits, Inspection and Enforcement

From time to time, CDCR/CCHCS may inspect the facilities, systems, books and records of Contractor and/or Provider to monitor compliance. Contractor and/or Provider shall promptly remedy any violation of any provision of this Agreement and shall certify the same to the CDCR/CCHCS Information Security Officer in writing. The fact that CDCR/CCHCS inspects, or fails to inspect, or has the right to inspect, Contractor and/or Provider facilities, systems and procedures does not relieve Contractor and/or Provider of its responsibilities to comply with this Agreement. CDCR/CCHCS’s failure to detect or detection, but failure to notify Contractor and/or Provider or require Contractor and/or Provider’s remediation of any unsatisfactory practice, does not constitute acceptance of such practices or a waiver of CDCR/CCHCS’s enforcement rights under this Agreement.

5. Acknowledgement of Duties

a. Contractor

As the Contractor, I hereby certify that I have read the above Electrocardiograph (ECG) Equipment and Cardiologist Over-read and Interpretation Services – Contractors and/or Providers Qualifications;

Licenses, Permits and Certification Requirements; and Contractors and/or Providers Responsibilities and that I understand the duties required to successfully perform the services stated herein.

b. Additional Provider Hired by Contractor

As the Provider hired by the Contractor, I hereby certify, that I have discussed the above Electrocardiograph (ECG) Equipment and Cardiologist Over-read and Interpretation Services – Contractors and/or Providers Qualifications; Licenses, Permits and Certification Requirements; and Contractors and/or Providers Responsibilities with the Contractor and that I understand the duties required to successfully perform the services stated herein.

Print Name of Contractor’s Representative Signature Date

Print Name of Contractor’s Representative Signature Date