Exhibit_A_-_SOW_Skillbridge_Final_Draft.docx

DSH RFQ #I-1270

Name of Contractor SkillBridge Program

Exhibit A – Statement of Work A. Overview:

Contractor shall provide Client Support Technicians through the SkillBridge Program to the Department of State Hospitals (DSH) through a current Memorandum of Understanding (MOU).

The United States Department of War (DOW) SkillBridge program is an opportunity for United States (U.S.) Armed Forces service members, (“Service Members”) to participate in job training and employment skills training, including apprenticeships and internships, and gain valuable civilian work experience during the last one hundred eighty (180) days of active service.

B. Contracted Parties:

This agreement is between the Department of State Hospitals (DSH), and (Contractor).

C. Period of Performance:

The period of performance for this agreement shall be from November 1, 2026, or upon final execution of this agreement by the DSH, whichever is later, through, June 30, 2028 with one (1) optional one (1) year extension, consistent with the original Scope of Services and at the contracted rates as referenced in the Exhibit B-1, Cost Table.

D. Time and Materials The Contractor must follow Payment Provisions guidelines regarding invoicing instructions and requirements as spelled out specifically in Exhibit B-1 Cost Table.

This agreement shall be based on Time and shall be task oriented. Tasks shall be Cleary defined in the Statement of Work Section F. Time is defined as an hourly base rate that supports the overall effort of this agreement, and where the staff member provides labor at an hourly rate as noted in Exhibit B-1 Cost Table, in exchange for payment, billed monthly in arrears. Services are billed in the Fiscal Year the Services are rendered and cannot cross Fiscal Years.

E. Contractor Onboarding Contractor and Contractor’s staff must be able to pass a background check with the State of California to be eligible for a contractor identification badge (ID). The ID badge will allow the Contractor to act as an independent service provider. Contractor and service staff, if applicable, shall submit to the background check within ten (10) business days upon execution of the contract and provide DSH with proof of submission. Failure to do so will result in termination of the contract. Background check shall be completed at the Contractor’s expense. The Contractor and service staff shall submit to a LIVE SCAN background check at the Contractor’s choice of Law Enforcement Agency. It is the responsibility of the Contractor to obtain DSH – site specific ORI number, which will direct the return results to the appropriate DSH site. Contractor shall obtain a Request for LIVE SCAN Service Form and provide their full legal name to the DSH Human Resources Department, which will include the hospital’s ORI number, for the law enforcement agency conducting the LIVE SCAN process.

Contractor resources may not begin billable work until the Onboarding Readiness Checklist is accepted by DSH.

1) Onboarding Readiness Checklist:

i. Account Provisioning

ii. Privacy and Security Training

iii. Site Clearance i.e. Livescan

iv. Supervisor Site Assignment

F. Objectives:

Contractor shall provide Client Support Technicians through SkillBridge Program to assist with activities in support of the DSH Technology Services Division (TSD) for all six (6) DSH locations. Based on operational needs, assigned individuals may be required to perform work either remotely or in person. Remote assignments may be authorized at DSH’s discretion, particularly for individuals assigned to the DSH Virtual Enterprise Service Team (V.E.S.T.). Contractor resources will work under the technical direction of the assigned DSH TSD stakeholder at the following locations:

1) DSH Atascadero - 10333 El Camino Real, Atascadero, CA 93423

2) DSH Coalinga - 24511 West Jayne Avenue, Coalinga, CA 93210-5000

3) DSH Metropolitan LA - 11401 South Bloomfield Avenue, Norwalk, CA 90650

4) DSH Napa - 2100 Napa Vallejo Highway, Napa, CA 94558-6293

5) DSH Patton - 3102 East Highland Avenue, Patton, CA 92369

6) DSH Sacramento - 1215 O Street, Sacramento, CA 95814 Contractor resources will perform the following duties:

1) Maintaining, configuring, testing, documenting and repairing software and hardware used on DSH’s business desktops, laptops, mobile computers, printers, VOIP phones, mobile phones, peripherals, audio/visual and other unique hardware or software used within DSH.

2) Responding to service desk calls and tickets and resolving issues in a timely manner.

3) Calling in and tracking Warranty replacements.

4) Works with Asset manager to accurately track hardware placements.

5) Escorting vendors who provide technology services across all of the DSH locations within the perimeter of the Secure DSH Facility.

6) Coordinate vendor maintenance and warranty repairs for defective equipment.

7) Provide front‑line support for Electronic Health Record (EHR) system access, navigation, and peripheral integration.

8) Replace defective Personal Duress Alarm System tags.

9) Provision and manage user accounts, passwords, and access rights using Active Directory, ServiceNow, and SOPs.

10) Travel to DSH facilities or other locations as required; telework may be permitted with approval.

11) Perform physical duties such as walking, bending, crawling, working in tight spaces, and lifting 20–50 lbs occasionally, 15–25 lbs frequently.

G. Unanticipated Tasks The DSH is expecting during the Agreement term, legislative and/or program changes may necessitate modifications to this Agreement. Unanticipated Tasks may result in an Amendment, and the Amendment rates are based on the Contractor staff hourly labor rates as identified on Exhibit B-1 Cost Table. The agreed-upon rates shall be to support Amendments (change requests) to this Agreement.

Unanticipated Tasks are defined as additional work which must be performed, and are generally within Exhibit A SOW, but were unforeseen and not identified at the time of offer. Both parties shall agree upon the work needing to be performed, which shall result in Unanticipated Costs and Tasks as identified on the Work Authorization (WA) form, Exhibit A-1. No work shall be performed in advance of the Contractor’s written proposal and the DSH approved Amendment of Unanticipated Tasks.

1. A WA shall be performed for each item of unanticipated work not specified in Exhibit A, SOW. All unanticipated work shall be clearly defined in Exhibit A-1, Work Authorization.

2. Before work can begin, a WA shall be completed by the DSH Contract Manager and signed by both the DSH and the Contractor.

3. Each WA shall outline in detail the purpose, objective, goals, and costs.

4. The DSH may, at any time, order the Consultant/Contractor staff to stop work on any WA. The Contractor shall be compensated for all work performed before any work stoppage.

5. The Contractor shall inform the DSH Contract Manager if a WA needs to be revised for additional work hours. It is at the discretion of the DSH Contract Manager to accept or reject the request, and the revised WA must be signed by both the DSH Contract Manager and the Contractor.

6. The WA shall not supersede the terms of this Agreement; all terms within this Agreement shall remain in full force.

7. The Contractor shall be compensated under the WA by the rates provided on Exhibit B-1, Cost Table.

8. For all Work Orders, Contractor will provide a Delivery Lead for personnel management, reporting of utilization of team members on a regular basis, risk and issue reporting and managing overall engagement Change Management control.

1. Performance Feedback and Management

2. Capacity Management and Forecasting (attrition)

a. Resource Management to include recruiting.

b. Onboarding and Readiness

c. Performance Feedback and Management

3. Governance

a. Program Status Reporting

b. Financial and Cost Management

c. Risk and Issues Reporting

d. Change Order Management

4. Customer Satisfaction (CSAT) Program

H. Contractor Roles and Responsibilities The Contractor shall perform and/or provide the following:

1) Provide experienced contract staff with the skill and knowledge appropriate to carry out the in-person services for a minimum of 90 days and maximum of 180 days.

2) Participate in any job-related training provided or required by the DSH location to which they are assigned.

3) Provide annual proof of tuberculosis screening to the DSH in accordance with the California Code of Regulations, Title 22. Testing shall be completed at the Contractor’s expense.

4) Adhere to all COVID guidelines implemented at the facility to which they are assigned based off of “The California Department of State Hospitals COVID-19 Transmission-Based Precautions and Testing” developed in partnership between the DSH, and the California Department of Public Health, Healthcare Associated Infections Program.

5) Provide a listing of all designated employees to the DSH with their vaccination status. Listing shall include dosages completed and exemptions on file. Listing shall be updated as needed and provided to the DSH Contract Manager upon request.

6) Participate in all of the DSH workplace violence prevention, infection control-illness prevention, and workplace safety measures or programs as may be required by the DSH facility to which they are assigned. This responsibility includes compliance with infection control measures, use of the Personal Protective Equipment (PPE) as prescribed by DSH, attending any and all related training or orientation to such measures or programs as may be required and scheduled by the DSH. The DSH will provide the contractor with electronic versions of DSH’s current Illness and Injury Prevention Plan (IIPP), Workplace Violence Prevention Plan (WVPP), DSH Code of Safe Practices, and other appropriate documents to support worksite safety and infection control.

7) Shall be issued a Personal Duress Alarm System (PDAS) tag and charger. These devices are issued for the security of all contractors. It will be the responsibility of each person to ensure they wear the device during each shift worked at a hospital location and to maintain the battery by charging it when necessary. Each person performing services under this Agreement may be required, at the discretion of DSH, to be oriented to the use of PDAS, including but not limited to videos, classroom time, etc.

8) Upon completion of the services, ensure that each technician performing services under this Agreement return all of their PDAS tags and chargers to the appropriate DSH Police Department. DSH Contract Manager shall ensure all PDAS tags and accessories are returned to the appropriate DSH Police Department prior to signing off approval on the final invoice for payment. If a PDAS tag and accessories are not returned to the DSH, Contractor will be responsible for the current replacement cost of the PDAS tag and accessories (a value not less than $150.00). Contractor will be billed accordingly for any PDAS tags and accessories not returned. Failure to reimburse cost by Contractor will result in the DSH withholding the cost of unreturned PDAS tags and/or chargers against any outstanding invoices. If all invoices have been paid, the DSH will issue an invoice to the Contractor for payment.

9) Not take pictures or videos with any electronic device or camera anywhere on DSH grounds without the written consent of the Executive Director. If any Contractor is caught taking photos or videos without prior authorization, their phone or camera will be subject to search and further action may be taken by the DSH.

10) Adhere to the dress code of the location where work is being performed. The dress codes may include limitations on the length, color, and material of clothing, or anything else required by the location where work is being performed. Contractor is advised that tan and khaki clothing shall prevent entry to the secured areas of the hospitals. Contractor and contractor technicians shall obtain a current copy of each location’s dress code prior to the performance of any work. Contractor and Contractor technicians may be refused entry into DSH grounds if their clothing is found to violate the established dress codes. DSH retains the right to change its dress codes at any time.

11) Agrees that DSH reserves the right to limit or restrict the equipment, including but not limited to, tools and communications devices that Contractor, contractor technicians, their personnel, subcontractors and anyone else affiliated with this Agreement may bring on grounds. In no way shall DSH be held liable or accountable for tools misplaced or left behind. Upon notice by DSH, Contractor shall comply with such limitations and restrictions.

12) Not possess or use any tobacco products (including smokeless tobacco) on DSH grounds (Welfare and Institutions Code section 4138).

13) Participate in any of the DSH safety measures or programs as may be required by the DSH. This responsibility includes attending any and all related training or orientation to such measures or programs as may be required and scheduled by the DSH.

14) Complete the Offboarding Checklist below prior to final invoice approval for those ending participation in the program.

i. Offboarding checklist

1. Hardware Returns

2. PDAS return

3. Keys returned

4. DSH established contractor exit process per site assignment

ii. DSH may hold final invoice(s) until all checklist items are accepted or Contractor cures deficiencies

I. DSH Roles and Responsibilities:

1) The DSH will provide a Contract Manager to serve as a single point of contact for each site. The DSH Contract Manager(s) will provide:

i. A walkthrough of the features contained within the scope of this initiative to facilitate the analysis.

ii. Access to the Contractor to the project plan to review priorities, steer the engagement, attend status meetings and approve engagement deliverables.

iii. Access to and cooperations from the DSH development, QA, IT and business resources where appropriate.

iv. Access to all relevant documentation, including, but not limited to, business and functional requirements, systems architecture and design, use cases, etc. necessary for the engagement.

2) DSH agrees to respond to Contractor requests and issues within three (3) business days so delivery schedules are not adversely impacted. If issues do arise, Contractor will escalate to the Contract Manager according to a mutually agreed upon escalation process.

3) DSH will provide all access and connectivity required for Contractor technicians by the anticipated start date; at that time all team members will have access to all required resources as needed for the engagement.

4) DSH agrees to comply with all applicable export controls including but not limited to the International Traffic and Arms Regulations (ITAR), the Export Administration Regulations (EAR), and all regulations and orders administered by the Office of Foreign Asset Control of the U.S. Department of Treasury (“Export Laws”). It shall be DSH responsibility (and not Contractor’s) to file Encryption Classification Requests (and DSH shall not require Contractor to rely on self-classification of software), request encryption reviews, obtain export permissions, or procure any export licenses, required by applicable law and regulations (including the Export Laws). To the extent any Contractor’s employees work on DSH premises, network or systems, DSH further assumes responsibility for Contractor’s employees’ actions with regard to any transfer of export-controlled articles to include technical data, and defense services while acting within the scope of work under the Agreement or applicable SOWs. DSH shall be responsible for identifying in writing for Contractor any information, instructions, software, products, services, or positions that involve export-controlled data or require Contractor personnel to participate in the export of controlled information and technologies to foreign persons.

5) The DSH will provide hardware with a DSH image configuration, provision and manage all required access to the DSH network, environment, and applications for all Contractor technicians.

6) The DSH will provide all required email accounts, software, licenses, and any additional hardware appropriate for the Contractor technicians.

7) The DSH will provide Contractor technicians with a secure VPN connection to the applicable controlled DSH environment that has reasonable controls in place to prevent, (1) the removal/transfer/copying of data, and (2) the unauthorized disclosure of data in the DSH controlled environments. At no time will the Contractor be storing DSH data or information on Contractor equipment, systems, or Contractor’s managed networks.

8) The DSH will identify the scope of work required on a Work Order basis. Terms of this SOW will not be modified without prior written agreement by the DSH and the Contractor and will be managed through the Change Management process outlined within this SOW.

J. Deliverables Contractor’s reporting Deliverables under this Agreement are limited to:

1) Consolidated Weekly Status Report,

2) Consolidated Monthly invoice, and

3) Monthly Budget burn report and spend analysis The acceptance process will be as follows:

Deliverables submitted under this Agreement shall be subject to a five (5) business‑day DSH review and shall be accepted only if they are complete, accurate, reconciled to the applicable Work Order, aligned with defined duties and KPIs, compliant with all DSH security and operational requirements including Exhibit F, and supported by required proof‑of‑work documentation such as the monthly burn report, ticket metrics, staffing roster, and onboarding/offboarding status log; DSH may reject any Deliverable not meeting these criteria, and Contractor shall correct deficiencies within five (5) business days at no additional cost, and no Deliverable—including monthly invoices—will be approved or accepted for any period in which required offboarding activities (including PDAS return, account deprovisioning, and hardware recovery) remain incomplete for any Contractor resource whose assignment ended during that billing cycle.

K. Agreement Conditions The terms “shall” and “must” are considered by the DSH to mean mandatory or required. The terms “may” or “can” are considered to be optional and are at the discretion of the DSH.

The duration of each SkillBridge engagement will not exceed one hundred eighty (180) days per DOW requirements for each individual Client Support Technician assignment. The minimum duration of a contractor assignment shall be 90 days and may be established for any period up to a maximum of 180 days based on operational needs.

1) Per DOW requirements, the SkillBridge Service Member will not exceed forty (40) hours of work per week.

The Service Member will not be required nor held to a “non-compete” contract while participating in the SkillBridge program for the DSH by Contractor. If at the end of the SkillBridge program, DSH wishes to hire a Service Member directly, Contractor will waive any restrictive covenants it may have with the Service Member The State reserves the right at its sole discretion to require the Contractor to replace and/or terminate any assigned staff, key staff or additional staff, at any time for reasons that may include, but are not limited to, poor performance, lack of experience, or unprofessional behavior / harassment in the workplace (subject to compliance with applicable law and departmental policies). Such determinations may be made by The State without cause and without penalty. The State will notify the Contractor in writing when exercising that right. The Contractor, within 5 calendar days of such notification, shall provide a replacement candidate that meets or exceeds the requirement.

The parties shall comply with Exhibit F – Information Privacy and Security Requirements (Non‑HIPAA). In the event of any conflict, Exhibit F shall prevail over the MSOW, Work Orders and Change Orders. Contractor shall not store DSH data on Contractor systems; access shall occur via DSH‑provided VPN with encryption and logging. Security incidents shall be reported immediately by phone and within twenty‑four (24) hours in writing, per Exhibit F.

Participation in the SkillBridge/MSEP CA Program does not create any employment relationship between the Service Member/Military Spouse and the State of California or DSH. DSH makes no commitment or guarantee of post-program employment. Neither party shall be obligated to hire or convert any participant at the conclusion of the program.

Assistance with Cybersecurity and Artificial Intelligence (AI), including assessments, architecture/design, tool selection/evaluation, tuning, or operational runbooks, is prohibited from this agreement unless added by Change Order.

L. Terms and Conditions IT General Provisions for Non-Cloud Goods and Services (Effective 02/20/2025) M. Contacts:

Department of State Hospitals:

IT Contract Manager:

Tammy Karas 10333 El Camino Real Atascadero CA 93422 Phone: (805) 600-4031 Email: Tammy.Karas@dsh.ca.gov Contractor Information Contractor’s Name:

Address City, State, Zip

Phone:

Email:

Site Specific Contact Information:

Department of State Hospitals – Atascadero:

Mark Luna Email: MarkGregor.Luna@dsh.ca.gov Department of State Hospitals – Napa:

Andrew DeMayo Email: Andrew.DeMayo@dsh.ca.gov

Department of State Hospitals – Coalinga:

Isabel Montoya Email:

Isabel.Montoya@dsh.ca.gov Department of State Hospitals – Patton:

Justin Duncan Email: Justin.Duncan@dsh.ca.gov

Department of State Hospitals – Metro:

Renlo Santos Email:

Renlo.Santos@dsh.ca.gov Department of State Hospitals – Sacramento:

Christopher White Email: Christopher.White3@dsh.ca.gov

N. Amendment Any amendment that adds funding will be subject to the DSH Delegated Purchasing Authority Thresholds. Any amendment shall be in writing and approved by both parties and, if applicable, be approved by the Department of General Services/or California Department of Technology.

Exhibit B – Budget Detail and Payment Provisions A. Invoicing and Payment For services satisfactorily rendered, and upon receipt and approval of Contractor’s invoices, DSH agrees to pay the Contractor for products and services accepted in accordance with Exhibit B-1, Cost Table attached hereto and made a part of this Agreement.

Invoices shall include the Agreement Number and Purchase Order, and upon completion and acceptance of each task and product, the Contractor shall bill for, but not more frequently than, monthly in arrears. Monthly in arrears is defined as a calendar month from the first day of the month to the last day of the month, including weekends and holidays. Invoices submitted for billing periods for more than one month per invoice will not be accepted by the DSH. The Contractor shall invoice per job title and hourly rate, and shall mail or email invoices to:

Department of State Hospitals – Accounting Division Attn: Accounts Payable Contract Number: PO 4440-XXXXX 1215 O Street, Sacramento, CA 95814 Phone Number: (916) 562-2572 Email: DSHSAC.AccountsPayable@dsh.ca.gov The hourly rates are based on a consecutive 40-hour standard workweek with no planned or authorized overtime.

B. BUDGET CONTINGENCY CLAUSE

It is mutually agreed that if the California State Budget Act for the current fiscal year and/or any subsequent fiscal years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to Contractor, or to furnish any other considerations under this Agreement, and Contractor shall not be obligated to perform any provisions of this Agreement.

If funding for the purposes of this program is reduced or deleted for any fiscal year by the California State Budget Act, the State shall have the option to either cancel this Agreement with no liability occurring to the State, or offer an Agreement amendment to Contractor to reflect the reduced amount.

C. PROMPT PAYMENT CLAUSE

Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.

D. SUBCONTRACTORS

For all Agreements, with the exception of Interagency Agreements and other governmental entities/auxiliaries that are exempt from bidding, nothing contained in this Agreement, or otherwise, shall create any contractual relation between the State and any subcontractors, and no subcontract shall relieve the Contractor of Contractor’s responsibilities and obligations hereunder. The Contractor agrees to be as fully responsible to the State for the acts and omissions of its subcontractors and of persons either directly or indirectly employed by any of them as it is for the acts and omissions of persons directly employed by the Contractor. The Contractor’s obligation to pay its subcontractors is an independent obligation from the State’s obligation to make payments to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any money to any subcontractor.

E. TAXES

DSH is exempt from federal excise taxes, and no payment shall be made for personal property taxes levied on the Contractor or on any employee wages. The hourly rate shall include all applicable taxes.

F. OVERTIME AND VACTION

Overtime and vacation for Client Support Technicians are not reimbursed.

G. BILLING FOR SERVICES RENDERED

DSH Contract Manager will be responsible for approving payment based on DSH receipt and approval of invoices. All tasks shall be submitted for approval to the DSH Contract Manager for review and approval. If the tasks or products are not approved, the Contractor will be notified in writing and must take appropriate measures to correct or remedy the reason(s) for rejection.

The Contractor may not invoice DSH for any costs exceeding the maximum amount identified to complete a specific task or product. Any excess shall be at no cost to DSH, unless negotiated and preapproved by DSH where circumstances beyond the control of the Contractor have occurred.

Exhibit B-1– Cost Table As noted on this Exhibit B-1, the Contractor shall bill only for actual services or products provided at the rates as noted on this Time and Materials agreement. If the total quantities are listed below, those quantities cannot exceed the Contractor's total line-item price.

The total cost of this agreement is $1,500,000.00 Costs for Services for the term of this agreement.

EXHIBIT F

Information Privacy and Security Requirements (Non-HIPAA/HITECH Act Contracts)

This Information Privacy and Security Requirements Exhibit (For Non-Health Insurance Portability and Accountability Act/Health Information Technology for Economic and Clinical Health (Non-HIPAA/HITECH Act Contracts) (hereinafter referred to as “this Exhibit”) sets forth the information privacy and security requirements Contractor is obligated to follow with respect to all personal and confidential information (as defined herein) disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of the California Department of State Hospitals (hereinafter “DSH”), pursuant to Contractor’s agreement with DSH. (Such personal and confidential information is referred to herein collectively as “DSH PCI”.) DSH and Contractor desire to protect the privacy and provide for the security of DSH PCI pursuant to this Exhibit and in compliance with state and federal laws applicable to the DSH PCI.

1. Order of Precedence: With respect to information privacy and security requirements for all DSH PCI, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the agreement between Contractor and DSH, including Exhibit A (Scope of Work), all other exhibits and any other attachments, and shall prevail over any such conflicting terms or conditions.

1. Effect on lower tier transactions: The terms of this Exhibit shall apply to all contracts, subcontracts, and subawards, and the information privacy and security requirements Contractor is obligated to follow with respect to DSH PCI disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of DSH, pursuant to Contractor’s agreement with DSH. When applicable the Contractor shall incorporate the relevant provisions of this Exhibit into each subcontract or subaward to its agents, subcontractors, or independent consultants.

1. Definitions: For purposes of the agreement between Contractor and DSH, including this Exhibit, the following definitions shall apply:

1. Breach: “Breach” means:

0. the unauthorized acquisition, access, use, or disclosure of DSH PCI in a manner which compromises the security, confidentiality or integrity of the information; or

0. the same as the definition of "breach of the security of the system" set forth in California Civil Code section 1798.29(f) (2021).

1. Confidential Information: “Confidential information” means information that:

1. does not meet the definition of “public records” set forth in California Government Code section 6252(e) (2021), or is exempt from disclosure under any of the provisions of Section 6250, et seq. of the California Government Code or any other applicable state or federal laws; or

1. is contained in documents, files, folders, books or records that are clearly labeled, marked or designated with the word “confidential” by DSH.

1. Disclosure: “Disclosure” means the release, transfer, provision of, access to, or divulging in any manner of information outside the entity holding the information.

1. PCI: “PCI” means “personal information” and “confidential information” collectively (as these terms are defined herein).

1. Personal Information: “Personal information” means information, in any medium (paper, electronic, oral) that:

1. directly or indirectly collectively identifies or uniquely describes an individual; or

1. could be used in combination with other information to indirectly identify or uniquely describe an individual, or link an individual to the other information; or

1. meets the definition of “personal information” set forth in California Civil Code section 1798.3, subdivision (a) (2021); or

1. is one of the data elements set forth in California Civil Code section 1798.29, subdivision (g)(1) or (g)(2) (2021); or

1. meets the definition of “medical information” set forth in either California Civil Code section 1798.29, subdivision (h)(2) (2021), or California Civil Code section 56.05, subdivision (j) (2021); or

1. meets the definition of “health insurance information” set forth in California Civil Code section 1798.29, subdivision (h)(3) (2021); or

1. is protected from disclosure under applicable state or federal law.

1. Security Incident: “Security Incident” means:

1. an attempted breach; or

1. the attempted or successful unauthorized access or disclosure, modification or destruction of DSH PCI, in violation of any state or federal law or in a manner not permitted under the agreement between Contractor and DSH, including this Exhibit; or

1. the attempted or successful modification or destruction of, or interference with, Contractor’s system operations in an information technology system, that negatively impacts the confidentiality, availability or integrity of DSH PCI; or

1. any event that is reasonably believed to have compromised the confidentiality, integrity, or availability of an information asset, system, process, data storage, or transmission. Furthermore, an information security incident may also include an event that constitutes a violation or imminent threat of violation of information security policies or procedures, including acceptable use policies.

1. Use: “Use” means the sharing, employment, application, utilization, examination, or analysis of information.

1. Disclosure Restrictions: The Contractor and its employees, agents, and subcontractors shall protect from unauthorized disclosure any DSH PCI. The Contractor shall not disclose, except as otherwise specifically permitted by the agreement between Contractor and DSH (including this Exhibit), any DSH PCI to anyone other than DSH personnel or programs without prior written authorization from the DSH Program Contract Manager, except if disclosure is required by State or Federal law.

1. Use Restrictions: The Contractor and its employees, agents, and subcontractors shall not use any DSH PCI for any purpose other than performing the Contractor's obligations under its agreement with DSH.

1. Safeguards: The Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the privacy, confidentiality, security, integrity, and availability of DSH PCI, including electronic or computerized DSH PCI. At each location where DSH PCI exists under Contractor’s control, the Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Contractor’s operations and the nature and scope of its activities in performing its agreement with DSH, including this Exhibit, and which incorporates the requirements of Section VII, Security, below. Contractor shall provide DSH with Contractor’s current and updated policies within five (5) business days of a request by DSH for the policies.

1. Security: The Contractor shall take any and all steps reasonably necessary to ensure the continuous security of all computerized data systems containing DSH PCI. These steps shall include, at a minimum, complying with all of the data system security precautions listed in the Contractor Data Security Standards set forth in Attachment 1 to this Exhibit.

1. Security Officer: At each place where DSH PCI is located, the Contractor shall designate a Security Officer to oversee its compliance with this Exhibit and to communicate with DSH on matters concerning this Exhibit.

1. Training: The Contractor shall provide training on its obligations under this Exhibit, at its own expense, to all of its employees who assist in the performance of Contractor’s obligations under Contractor’s agreement with DSH, including this Exhibit, or otherwise use or disclose DSH PCI.

1. The Contractor shall require each employee who receives training to certify, either in hard copy or electronic form, the date on which the training was completed.

1. The Contractor shall retain each employee’s certifications for DSH inspection for a period of three years following contract termination or completion.

Contractor shall provide DSH with its employee’s certifications within five (5) business days of a request by DSH for the employee’s certifications.

1. Employee Discipline: Contractor shall impose discipline that it deems appropriate (in its sole discretion) on such employees and other Contractor workforce members under Contractor’s direct control who intentionally or negligently violate any provisions of this Exhibit.

1. Contractor CCPA Responsibilities: Contractor, its employees, agents, and sub-contractors, shall comply with all Contractor’s legal obligations pursuant to the California Consumer Privacy Protection Act (CCPA), including but not limited to the handling and disclosure of personal information received resulting from this agreement, abiding by CCPA notice requirements on Contractor’s website(s), safeguarding personal information received in connection with this agreement, refraining from using personal information received in connection with this agreement outside of the enumerated business purpose contained therein. Contractor’s failure to comply with such laws and regulations shall constitute a material breach of this Agreement, and shall be grounds for immediate termination of the Agreement by DSH, pursuant to section 23 of the DGS PD 401IT. By executing this Agreement, Contractor certifies that it is aware of its legal obligations as set forth under the CCPA, that it is in compliance with the CCPA, and shall remain in compliance with all such laws and regulations for the term of this Agreement.

To the fullest extent permitted by State law, pursuant to section 28 of the DGS PD 401IT of this Agreement, Contractor agrees to indemnify and hold the DSH harmless from and against any and all liability, loss, suit, damage or claim, including third party claims brought against the DSH, section 28 of the DGS PD 401IT, as well as damages and reasonable costs assessed against the DSH by a court of competent jurisdiction (or, at Contractor's option, that are included in a settlement of such claim or action in accordance herewith), to the extent such claim arises from Contractor’s violation of the CCPA in relation to Contractor’s performance under this agreement; provided, that (i) Contractor is notified promptly in writing of the claim; (ii) Contractor controls the defense and settlement of the claim; (iii) Contractor provides a defense with counsel approved by the DSH; and (iv) the DSH cooperates with all reasonable requests of Contractor (at Contractor's expense) in defending or settling the claim.

1. Breach and Security Incident Responsibilities:

1. Notification to DSH of Breach or Security Incident: The Contractor shall notify DSH immediately by telephone call plus email or fax upon the discovery of a breach (as defined in this Exhibit), and within twenty-four (24) hours by email or fax of the discovery of any security incident (as defined in this Exhibit), unless a law enforcement agency determines that the notification will impede a criminal investigation, in which case the notification required by this section shall be made to DSH immediately after the law enforcement agency determines that such notification will not compromise the investigation. Notification shall be provided to the DSH Program Contract Manager, the DSH Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XI(F), below. If the breach or security incident is discovered after business hours or on a weekend or holiday and involves DSH PCI in electronic or computerized form, notification to DSH shall be provided by calling the DSH Information Security Office at the telephone numbers listed in Section XI(F), below. For purposes of this Section, breaches and security incidents shall be treated as discovered by Contractor as of the first day on which such breach or security incident is known to the Contractor, or, by exercising reasonable diligence would have been known to the Contractor. Contractor shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee or agent of the Contractor.

Contractor shall take:

1. prompt corrective action to mitigate any risks or damages involved with the breach or security incident and to protect the operating environment; and

1. any action pertaining to a breach required by applicable federal and state laws, including, specifically, California Civil Code sections 1798.29 and 1798.82 (2021).

1. Investigation of Breach and Security Incidents: The Contractor shall immediately investigate such breach or security incident. As soon as the information is known and subject to the legitimate needs of law enforcement, Contractor shall inform the DSH Program Contract Manager, the DSH Privacy Officer, and the DSH Chief Information Security Officer of:

1. what data elements were involved, and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and

1. a description of the unauthorized persons known or reasonably believed to have improperly used the DSH PCI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the DSH PCI, or to whom it is known or reasonably believed to have had the DSH PCI improperly disclosed to them; and

1. a description of where the DSH PCI is believed to have been improperly used or disclosed; and

1. a description of the probable and proximate causes of the breach or security incident; and

1. whether Civil Code sections 1798.29 and 1798.82 (2021) or any other federal or state laws requiring individual notifications of breaches have been triggered.

1. Written Report: The Contractor shall provide a written report of the investigation to the DSH Program Contract Manager, the DSH Privacy Officer, and the DSH Chief Information Security Officer as soon as practicable after the discovery of the breach or security incident. The report shall include, but not be limited to, the information specified above, as well as a complete, detailed corrective action plan, including information on measures that were taken to halt and/or contain the breach or security incident, and measures to be taken to prevent the recurrence or further disclosure of data regarding such breach or security incident.

1. Notification to Individuals: If notification to individuals whose information was breached is required under state or federal law, and regardless of whether Contractor is considered only a custodian and/or non-owner of the DSH PCI, Contractor shall, at its sole expense, and at the sole election of DSH, either:

1. make notification to the individuals affected by the breach (including substitute notification), pursuant to the content and timeliness provisions of such applicable state or federal breach notice laws. Contractor shall inform the DSH Privacy Officer of the time, manner and content of any such notifications, prior to the transmission of such notifications to the individuals; or

1. cooperate with and assist DSH in its notification (including substitute notification) to the individuals affected by the breach.

1. Submission of Sample Notification to Attorney General: If notification to more than 500 individuals is required pursuant to California Civil Code section 1798.29 or 1798.82 (2021), and regardless of whether Contractor is considered only a custodian and/or non-owner of the DSH PCI, Contractor shall, at its sole expense, and at the sole election of DSH, either:

1. electronically submit a single sample copy of the security breach notification, excluding any personally identifiable information, to the Attorney General pursuant to the format. content and timeliness provisions of Section 1798.29, subdivision (e), or 1798.82, subdivision (f) (2021). Contractor shall inform the DSH Privacy Officer of the time, manner and content of any such submissions, prior to the transmission of such submissions to the Attorney General; or

1. cooperate with and assist DSH in its submission of a sample copy of the notification to the Attorney General.

1. DSH Contact Information: To direct communications to the above referenced DSH staff, the Contractor shall initiate contact as indicated herein. DSH reserves the right to make changes to the contact information below by verbal or written notice to the Contractor. Said changes shall not require an amendment to this Exhibit or the agreement to which it is incorporated.

Office of Legal Services 1215 O Street, MS-5 Sacramento, CA 95814

Email: privacy.officer@dsh.ca.gov and dshsaclegalprivacy@dsh.ca.gov Telephone: 916-562-3721

Chief Information Security Officer Information Security Office 1215 O Street, MS-4 Sacramento, CA 95814

Email: iso@dsh.ca.gov and security@dsh.ca.gov Telephone: 916-654-4218

[Privacy Officer Name] [Contractor Name] [Address]

Email: [email address] Telephone: [Telephone number]

[Information Security Officer Name] [Contractor Name] [Address]

Email: [email address] Telephone: [Telephone number]

1. Documentation of Disclosures for Requests for Accounting: Contractor shall document and make available to DSH or (at the direction of DSH) to an Individual such disclosures of DSH PCI, and information related to such disclosures, necessary to respond to a proper request by the subject Individual for an accounting of disclosures of personal information as required by Civil Code section 1798.25 (2021), or any applicable state or federal law.

1. Requests for DSH PCI by Third Parties: The Contractor and its employees, agents, or subcontractors shall promptly transmit to the DSH Program Contract Manager all requests for disclosure of any DSH PCI requested by third parties to the agreement between Contractor and DSH (except from an Individual for an accounting of disclosures of the individual’s personal information pursuant to applicable state or federal law), unless prohibited from doing so by applicable state or federal law.

1. Audits, Inspection and Enforcement: DSH may inspect the facilities, systems, books and records of Contractor to monitor compliance with this Exhibit. Contractor shall promptly remedy any violation of any provision of this Exhibit and shall certify the same to the DSH Program Contract Manager in writing.

1. Return or Destruction of DSH PCI on Expiration or Termination: Upon expiration or termination of the agreement between Contractor and DSH for any reason, Contractor shall securely return or destroy the DSH PCI. If return or destruction is not feasible, Contractor shall provide a written explanation to the DSH Program Contract Manager, the DSH Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XI(F), above.

1. Retention Required by Law: If required by state or federal law, Contractor may retain, after expiration or termination, DSH PCI for the time specified as necessary to comply with the law.

1. Obligations Continue Until Return or Destruction: Contractor’s obligations under this Exhibit shall continue until Contractor destroys the DSH PCI or returns the DSH PCI to DSH; provided however, that on expiration or termination of the agreement between Contractor and DSH, Contractor shall not further use or disclose the DSH PCI except as required by state or federal law.

1. Notification of Election to Destroy DSH PCI: If Contractor elects to destroy the DSH PCI, Contractor shall certify in writing within 30 days of the expiration or termination of the agreement to the DSH Program Contract Manager, the DSH Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XI(F), above, that the DSH PCI has been securely destroyed. The notice shall include the date and type of destruction method used.

1. Amendment: The parties acknowledge that federal and state laws regarding information security and privacy rapidly evolves and that amendment of this Exhibit may be required to provide for procedures to ensure compliance with such laws. The parties specifically agree to take such action as is necessary to implement new standards and requirements imposed by regulations and other applicable laws relating to the security or privacy of DSH PCI. The parties agree to promptly enter into negotiations concerning an amendment to this Exhibit consistent with new standards and requirements imposed by applicable laws and regulations.

1. Assistance in Litigation or Administrative Proceedings: Contractor shall make itself and any subcontractors, workforce employees or agents assisting Contractor in the performance of its obligations under the agreement between Contractor and DSH, available to DSH at no cost to DSH to testify as witnesses, in the event of litigation or administrative proceedings being commenced against DSH, its director, officers or employees based upon claimed violation of laws relating to security and privacy, which involves inactions or actions by the Contractor, except where Contractor or its subcontractor, workforce employee or agent is a named adverse party.

1. No Third-Party Beneficiaries: Nothing express or implied in the terms and conditions of this Exhibit is intended to confer, nor shall anything herein confer, upon any person other than DSH or Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.

1. Interpretation: The terms and conditions in this Exhibit shall be interpreted as broadly as necessary to implement and comply with regulations and applicable State laws. The parties agree that any ambiguity in the terms and conditions of this Exhibit shall be resolved in favor of a meaning that complies and is consistent with federal and state laws and regulations.

1. Survival: If Contractor does not return or destroy the DSH PCI upon the expiration or termination of the Agreement, the respective rights and obligations of Contractor under Sections VI, VII and XI of this Exhibit shall survive the completion or termination of the agreement between Contractor and DSH.

Attachment 1 Contractor Data Security Standards

1. General Security Controls

1. Confidentiality Statement. All persons that will be working with DSH PCI must sign a confidentiality statement. The statement must include at a minimum, General Use, Security and Privacy safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to DSH PCI. The statement must be renewed annually. The Contractor shall retain each person’s written confidentiality statement for DSH inspection for a period of three (3) years following contract termination.

1. Background check. Before a member of the Contractor’s workforce may access DSH PCI, Contractor must conduct a thorough background check of that worker and evaluate the results to assure that there is no indication that the worker may present a risk for…