IT-24-071_HIPAA_Compliance_and_Cyber_Security_Defense_Strategy.pdf

SALT RIVER PIMA-MARICOPA INDIAN COMMUNITY

NOTICE OF SOLICITATION

SOLICITATION # IT-24-071

HIPAA Compliance & Cyber Security Defense Strategy for Microsoft 365 and Microsoft Teams

Notice is hereby given that sealed proposals are being accepted by the Salt River Pima-Maricopa Indian Community (SRPMIC or the “Community”) in conjunction with this Solicitation.

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 INTENT

1.2 BACKGROUND

1.3 TERM

2.0 PROPOSAL INSTRUCTIONS

2.1 TIMELINE

2.2 QUESTIONS AND CHANGES

2.3 DELIVERY OF PROPOSALS

2.4 PROPOSAL FORMAT

3.0 PROPOSAL EVALUATION

3.1 EVALUATION PANEL

3.2 EVALUATION CRITERIA

4.0 GENERAL TERMS AND CONDITIONS

4.1 RFP CONFIDENTIALITY

4.2 RIGHT TO AMEND

4.3 ACCEPTANCE OF PROPOSAL

4.4 LIMITATION AND AWARD

4.5 RFP AS THE BASIS FOR PROPOSALS

4.6 COST LIABILITY

4.7 AMENDED PROPOSALS

4.8 VENDORS RIGHT TO WITHDRAW PROPOSALS

4.9 NON-DISCLOSURE

4.10 GOVERNING LAW

4.11 PROHIBITION AGAINST CONTINGENT FEES

4.12 LICENSURE AND INSURANCE

4.13 PURCHASE ORDER REQUIRED

4.14 PURCHASE ORDER TERMS AND CONDITIONS

5.0 APPENDIX A: CLIENT REFERENCES

6.0 APPENDIX B: NON-COLLUSIVE AFFIDAVIT

7.0 APPENDIX C: SAMPLE CONTRACT

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 3

1.0 INTRODUCTION

1.1 INTENT

The intent of this Request for Proposals is to award a contract for a Health Insurance

Portability and Accountability Act (HIPAA) Compliance and Cyber Security Defense Strategy for the Microsoft 365 product family to include Microsoft Teams as required for the Salt River Pima-Maricopa Indian Community (SRPMIC, or ‘the Community’.)

1.2 BACKGROUND

SRPMIC is interested in a HIPAA Compliance and Cyber Security Defense Strategy for the Microsoft 365 product family. To include pursuing all advanced security and compliance capabilities within Microsoft licensing and the Microsoft 365 E5 Compliance Suite (Microsoft Purview). SRPMIC has 2600 M365 G3, G5 and G5 Security licenses on a GCC tenant. The license breakdown is 2000 G3, 600 G5 (SRPMIC River People Health Center), 2600 G5 Security GCC and 550 licenses for Microsoft Defender for Endpoint Server GCC.

SRPMIC would like a complete solution to include discovery, guidance, governance, access and security policies, tenant review, configuration, data classification, encryption, documentation, knowledge transfer, IT staff training, user training, best practices and implementation. Additionally, our River People Health Center (RPHC) implemented an OCHIN/EPIC Electronic Health Record (EHR) system in July 2024.

1.3 TERM

This solicitation will result in a purchasing contract with a three (3) year term.

2.0 PROPOSAL INSTRUCTIONS

2.1 TIMELINE

RFP Issued: August 26, 2024 Last date for RFP Questions: September 13, 2024 Response to RFP Questions: September 20, 2024 Proposals Due: September 27, 2024

2.2 QUESTIONS AND CHANGES

All questions and communication regarding this solicitation must be submitted in writing to purchasing-bids@srpmic-nsn.gov and include “IT-24-071” in the subject line.

Unauthorized contact of SRPMIC employees and/or its agents may result in disqualification.

Responses to all questions will be published and communicated to all participants.

mailto:purchasing-bids@srpmic-nsn.gov

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 4

Changes to this solicitation will be in writing as an addendum.

2.3 DELIVERY OF PROPOSALS

Deliver one (1) electronic copy to purchasing-bids@srpmic-nsn.gov.

Email larger than 25 MB will not be accepted.

If you do not receive confirmation that your proposal was received, contact purchasing-bids@srpmic-nsn.gov.

The Community shall not be responsible for late proposals.

2.4 PROPOSAL FORMAT

Proposals shall be prepared as simply as possible and provide a straightforward, concise description of capabilities. Emphasis is to be concentrated on accuracy, completeness, and clarity of content. All parts, pages, figures, and tables are to be numbered and clearly labeled. The proposal is to be organized and indexed in the following format, containing, at a minimum, all listed items in the sequence indicated:

Instructions relative to each part of the proposal are defined in the remainder of this section.

Title Page

The title page will include the following:

• Name of project – IT-24-071 HIPAA Compliance & Cyber Security Defense Strategy

• Name of submitter – Company Name

• Date of submittal

SECTION TITLE

Title Page Letter of Transmittal Table of Contents

1.0 Executive Summary

2.0 Company Background

3.0 Solution Design and Implementation

4.0 Price Proposals

5.0 Client References

6.0 Appendices

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 5

Letter of Transmittal The letter of transmittal will:

• Identify the primary organization responding to the RFP

• Identify the name, title, telephone number and e-mail address of the primary and secondary contact persons for any follow-up questions, information requests

• Identify the name and address of the corporate headquarters of the parent company, if any

• Acknowledge receipt of any and all amendments to the RFP

• Include a statement that proposal, including prices, will be valid for 60 days after the date of receipt of the proposal.

Table of Contents The table of contents is to outline Sections 1 thru 6, as stated above.

Executive Summary [Section 1.0] The executive summary shall be a brief narrative highlighting and summarizing the proposal. The summary is to contain as little technical jargon as possible and will be oriented toward non-technical personnel. The summary will not include pricing.

Company and Relevant Background [Section 2.0] This section shall provide the following information about the company and applicable products and services. It will include, at a minimum, the following information:

• How long the company has been in business

• A brief description of the company size and organization

• Legal form of the company (i.e., sole proprietor, partnership, corporation, etc.)

• An overview of relevant experience with Native American organizations

• An organization chart of the group within the organization responsible for delivering solutions of the type required by SRPMIC

• Similar projects/solutions that have been delivered by your organization to other customers

• List of any major subcontractors involved in delivery of services required by this RFP

Solution Design and Implementation [Section 3.0] Describe your proposed comprehensive strategy for SRPMIC to obtain HIPAA Compliance and Cyber Defense for the Microsoft 365 product family (Outlook, Teams, SharePoint, OneDrive, Power Automate, Word, Excel, PowerPoint, Forms, etc.). Include discovery, guidance, governance, access and security policies, tenant review, M365 configuration, data classification, encryption, documentation, knowledge transfer, IT staff training, user training, best practices, implementation and any other relevant information.

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 6

Pricing [Section 4.0] Provide an itemized list of estimated professional services costs based on the requirements described in the RFP. The cost estimates shall include both non-recurring (one-time) and recurring costs for recommended periodic reviews. Please distinguish between items associated with the proposed engagement and any additional services which may be relevant to the engagement. SRPMIC qualifies for federal, GSA, and many other cooperative and open market pricing programs.

Client References

[Section 5.0] Provide a list of existing customers for which the organization has delivered similar engagements along with contact name, title, address, phone number and e-mail address, and authorization for SRPMIC to contact them as a reference. Please include similar references for previous work done with any tribal community. Please provide a minimum of three references.

Please use the form provided in Appendix A.

Appendices

[Section 6.0] In addition to Sections 1 through 6, Appendix B shall be included in proposals. Information considered relevant to this project, but not specifically requested in this RFP, may also be placed in an appendix.

3.0 PROPOSAL EVALUATION

3.1 EVALUATION PANEL

An evaluation panel will review and score each proposal. The panel will consist of representatives from the IT Department, Health and Human Services, Purchasing, and other subject matter experts.

3.2 EVALUATION CRITERIA

Proposals will be evaluated based on the following criteria:

• 35 Points: Solution Design and Implementation

• 35 Points: Pricing

• 10 Points: Company and Relevant Background

• 10 Points: Client References

• 10 Points: Relevant Experience with other Native American Organizations

4.0 GENERAL TERMS AND CONDITIONS

4.1 RFP CONFIDENTIALITY

All material, data, information, or any item in any form (including any derived intellectual property rights), except information in the public domain, supplied by or obtained from SRPMIC, IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 7 or derived from any data which the RFP recipient may have acquired in connection with this RFP and the selection process under this RFP, both before and after the issuance of the RFP:

• Is the sole property of SRPMIC and shall be treated as confidential

• Is not to be used for any purpose other than responding to this RFP

• Shall not be disclosed without prior written authorization from SRPMIC

• Shall be returned to SRPMIC upon request

The proposal package and any accompanying documentation submitted prior to the closing date/time shall become the property of SRPMIC and shall not be returned. Documents provided by the Vendor and specifically identified as being confidential will be held in confidence by SRPMIC and reasonable care will be taken to ensure they are not released (unless required by law), without prior authorization of the Vendor. The confidential data is to be identified as such on every page where the same may be contained.

In the event that a Vendor is awarded a contract, SRPMIC’s confidentiality agreement is required to be signed by any Vendor employee or subcontractor providing services prior to accessing documents.

4.2 RIGHT TO AMEND

It is SRPMIC’s policy not to solicit proposals unless there is a bona fide intention to ultimately award one or more contracts. This notwithstanding, SRPMIC reserves the right to withdraw this RFP at any time. In addition, at any time prior to the RFP closing date/time identified in this RFP, SRPMIC may alter, amend, delete, or add to, in whole or in part, any terms or provisions of this RFP. SRPMIC will provide any such revisions by issuing an addendum in the same manner as this RFP is issued.

4.3 ACCEPTANCE OF PROPOSAL

This RFP neither expresses nor implies any obligation on the part of SRPMIC to enter into a contract with any Vendor submitting a proposal. SRPMIC reserves the right to award a contract in whole or in part to address individual elements of the systems solutions described in this RFP.

4.4 LIMITATION AND AWARD

This RFP does not commit SRPMIC to award a contract. SRPMIC reserves the right to reject all proposals. If SRPMIC rejects all proposals, the project may be abandoned, re-advertised, or performed in any manner authorized under SRPMIC’s procurement policies.

4.5 RFP AS THE BASIS FOR PROPOSALS

This RFP, including any addenda, will represent the most definitive statement SRPMIC will make concerning information upon which proposals are to be based. Any information, verbal or written, which is not contained in this RFP and any of the addenda, will not be considered by SRPMIC in evaluating the proposals. The only exception is any material demonstrated as part of a product demonstration or site visit.

4.6 COST LIABILITY

All costs and expenses incurred by a Vendor relating to preparation or presentation of its proposal or in any way related to this RFP shall be borne by the Vendor.

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 8

SRPMIC will not be liable for, nor shall it reimburse any Vendor for, any costs, fees, or expenses, which are incurred in the preparation or submission of any proposal in response to this RFP.

4.7 AMENDED PROPOSALS

Any Vendor may submit an amended proposal before the deadline for receipt of proposals. Such amended proposals must be complete replacements for a previously submitted proposal and must be clearly identified as such in the transmittal letter.

4.8 VENDORS RIGHT TO WITHDRAW PROPOSALS

Vendors will be allowed to withdraw their proposal at any time prior to the deadline for receipt of proposals. The Vendor must submit a written withdrawal request addressed to the RFP Coordinator.

4.9 NON-DISCLOSURE

The parties hereby agree that Vendors/responders to this RFP shall (1) not disclose proprietary information contained herein to any third party, (2) restrict dissemination of proprietary information contained herein to only those employees of their entity who must be directly involved with proprietary information, (3) use the same degree of care as for its own information of like importance, but at a minimum use reasonable care in safeguarding against disclosure of proprietary information of the other party, and (4) not use proprietary information for any purpose without the prior written consent of the discloser.

4.10 GOVERNING LAW

This RFP and subsequent agreements shall be governed by, construed, and enforced in accordance with the Code of Ordinances and laws of SRPMIC. Nothing in this RFP, or in subsequent agreements, shall be construed as a waiver of sovereign immunity. An example of our standard contract agreement can be found in Appendix C.

4.11 PROHIBITION AGAINST CONTINGENT FEES

Vendors shall not retain a person or agency to solicit or obtain a SRPMIC contract for a contingent fee, except a bona fide employee or agency. For breach or violation of this policy, SRPMIC shall have the right to annul such contract without liability or to deduct from the contract price or consideration, or otherwise recover, the full amount of the contingent fee.

Definitions:

Agency. A business or organization established to provide a particular service, typically one that involves organizing transactions between two other parties.

Bona Fide Agency. An established commercial or selling agency, maintained by a contractor or supplier for the purpose of securing business, that neither exerts nor proposes to exert improper influence to solicit or obtain Government contracts nor holds itself out as being able to obtain any Government contract or contracts through improper influence.

Bona Fide Employee. A person, employed by a contractor or supplier and subject to the contractor's or supplier’s supervision and control as to time, place, and manner of performance, who neither exerts nor proposes to exert improper influence to solicit or obtain Government contracts nor holds out as being able to obtain any Government contract or contracts through improper influence.

IT-24-071 HIPAA – Compliance & Cyber Security Defense Strategy Page 9

Contingent Fee. Any commission, percentage, brokerage, or other fee that is contingent upon the success that a person or concern has in securing a Government contract.

Improper Influence. Any influence that induces or tends to induce a Government employee or officer to give consideration or to act regarding a Government contract on any basis other than the merits of the matter.

4.12 LICENSURE AND INSURANCE

In the event that a Vendor is awarded a contract, the Vendor shall be required to obtain a SRPMIC tribal business license in accordance with the SRPMIC Procurement Policy.

General liability and automobile insurance will also be required at the following minimum specifications:

a) Professional or commercial liability/errors and omissions coverage for liability arising out of acts, errors, or omissions in providing, or failing to provide, professional services in an amount not less than two million dollars. The aggregate limits must apply on a per-project or per-location basis. The total amount may be met by means of umbrella or excess coverage or other liability coverage deemed acceptable to the Community. Liability insurance will be reviewed by the Community to ensure proper coverage.

b) Proof of insurance: Contractor shall provide the Community with an original certificate of insurance for each type of insurance coverage described herein and with originals of any required additional insured endorsement(s). Documents may be faxed directly from the insurance carrier to the Community.

c) Except for professional liability and workers compensation coverage, the Community shall be named as an additional insured on the Certificate of Insurance. The Contractor’s insurance shall be primary in the event of loss and the additional insured endorsement must include language specifically stating that the Community is to be covered for all the activities performed by or on behalf of the Contractor, including the Community’s general supervision of Contractor.

d) Each coverage described above shall be on an “occurrence” basis and not on a “claims made” basis. If “occurrence” basis coverage is unavailable, Contractor agrees to obtain and keep in force tail coverage for three (3) years beyond the end of the Agreement. Any such period may be extended by agreement of the parties.

e) Auto liability coverage as shown in the ISO Business Auto Coverage standard form, or the equivalent, with Covered Auto Designation Symbol 1, in an amount not less than one million dollars, or other auto liability coverage acceptable to the Community.

f) With regards to handling fragile, historically pertinent documents, additional insurance requirements may need to be met.

4.13 PURCHASE ORDER REQUIRED

A valid Purchase Order is required prior to the start of any work or service and prior to the shipment of any goods.

4.14 PURCHASE ORDER TERMS AND CONDITIONS

All Purchases Orders shall be subject to the Community’s Purchase Order Terms and Conditions: https://www.srpmic-nsn.gov/wp-content/uploads/2017/04/PO- TermsConditions.pdf https://www.srpmic-nsn.gov/wp-content/uploads/2017/04/PO-TermsConditions.pdf https://www.srpmic-nsn.gov/wp-content/uploads/2017/04/PO-TermsConditions.pdf

IT-24-071 HIPAA – Appendix A Page 10

5.0 APPENDIX A: CLIENT REFERENCES

List between three (3) and six (6) references that closely reflect this project’s scope of work within the past five (5) years. Include similar projects done with other tribal communities if applicable.

1. Name of Firm: ________________________________________________________________ Address: ______________________________________________________________________ Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________ Population of Government Entity (if applicable): _______________

2. Name of Firm: ________________________________________________________________

Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________

3. Name of Firm: ________________________________________________________________

Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________

IT-24-071 HIPAA – Appendix A Page 11

CLIENT REFERENCES (continued)

4. Name of Firm: ________________________________________________________________

Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________

5. Name of Firm: ________________________________________________________________

Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________

6. Name of Firm: ________________________________________________________________

Telephone: _______________Contact: __________________ Title: _______________________ Contact e-mail: ____________________________ Service Dates: _________________________ Summary of Project: _____________________________________________________________

IT-24-071 HIPAA – Appendix B Page 12

6.0 APPENDIX B: NON-COLLUSIVE AFFIDAVIT

State of _____________________________, County of ___________________________, ______________________________________, being first duly sworn, deposes and says:

That he is,____________________________________________ the party making the foregoing proposal for bid, that such proposal or bid is genuine and not collusive or sham; that said bidder has no colluded, conspired, connived or agreed, directly or indirectly, with any bidder or person, to put in a sham bid or to refrain from bidding, and has not, in any manner, directly or indirectly, sought by agreement or collusion, or communication or conference, with any person, to fix the bid price of affiant or of any other bidder, or to fix any overhead, profit or cost element of said bid price, or of that of any other bidder, or to secure any advantage against the Owner or any person interested in the proposed contract, and that all statements in said proposal for bid are true.

Project No._____________________________

Location _______________________________

Signature

Name and Title

Date

(Signature must be notarized.)

IT-24-071 HIPAA – Appendix C Page 13

7.0 APPENDIX C: SAMPLE CONTRACT

AGREEMENT FOR SERVICES

This Agreement is made at the Salt River Pima-Maricopa Indian Community on MM/DD/YY between the Salt River Pima-Maricopa Indian Community, herein called “Community” a federally recognized Indian Tribe whose principal place of business is 10005 East Osborn Road, Scottsdale, Arizona 85256, and <Contractor>, herein called “Contractor,” whose principal place of business is <Contractor’s Mailing Address>.

IT IS AGREED:

1. SERVICES TO BE PERFORMED: Contractor agrees to perform the services described in Schedules A and C (if applicable) and incorporated and made a part of this Agreement.

2. CONTRACTOR COMPLIANCE: Contractor declares that it is engaged in business and serves clients other than the Community and further declares that it has complied, and will timely comply, with all applicable federal, state, and Community laws related to the conduct of its business, including but not limited to all permit and license requirements. Contractor declares that it is properly licensed and in good standing in the State of Arizona.

3. CONSIDERATION, TERMS OF PAYMENT: The Community agrees to pay Contractor for its services rendered according to the terms and conditions set forth in Schedule B of this Agreement, incorporated and made a part of this Agreement, provided however, that Contractor is required to submit billing invoices for its services at the beginning of each month, identifying Contractor’s reimbursable costs, if any, time and description of services rendered for the month immediately preceding submission of such invoice as specifically described in Schedule B.

4. INSTRUMENTALITIES: Contractor agrees to supply all equipment, machinery, tools, and materials necessary or reasonable to perform the services described and enumerated in Schedules A and C (if applicable) of this Agreement except that the Community may provide certain supplies and other resources but only upon such further terms and conditions as may be described in this Agreement.

5. PERFORMANCE AND ACCEPTANCE: Contractor retains the sole and exclusive right to control and direct the manner or means by which the services described herein are to be performed subject only to the parameters of control or direction set forth in Schedules A and C (if applicable) of this Agreement and the standards of Contractor’s trade or profession. The Community retains the right of approval and acceptance of Contractor’s performance based upon Contractor’s completion and satisfaction of all obligations created by the terms of the Agreement.

IT-24-071 HIPAA – Appendix C Page 14

6. INDEPENDENT CONTRACTOR: The parties intend that an independent contractor relationship will be created by this Agreement. Contractor is not to be considered an agent or employee of the Community for any purpose and neither Contractor nor employees of Contractor are entitled to any of the benefits that the Community provides for its employees. The Community is interested only in the results to be achieved. The conduct, and control of the work, will lie solely with Contractor. It is understood that the Community does not agree to use Contractor exclusively. It is further understood that Contractor is free to contract for similar services to be performed for others while under contract with the Community.

7. PAYROLL WITHHOLDING: Contractor bears the sole responsibility of abiding by all payroll-withholding laws. No payroll deductions or employment taxes of any kind shall be withheld by the Community for Contractor, or any of its employees, and no such amounts shall be paid to any federal, state, or local government by the Community on behalf of Contractor, or any of its employees.

8. LIABILITY: The work performed by the Contractor under this Agreement will be performed solely and entirely at Contractor’s risk. Contractor specifically assumes all responsibility for the instrumentalities in its performance of this Agreement.

9. INDEMNIFICATION: The Contractor agrees to the fullest extent permitted by law to indemnify and hold harmless the Community from any and against any and all costs, losses and damages, (including reasonable attorney’s fees and costs of defense), caused by the negligent, or wrongful acts, errors, or omissions of Contractor in the performance of all services under this Agreement and those of his or her sub-consultants, or anyone for whom the Contractor is liable and for any willful misconduct by the Contractor, sub-contractor, or anyone for whom the contractor is responsible. The Contractor is not obligated to indemnify the Community for the Community’s own negligence.

10. INSURANCE: Contractor agrees to carry insurance as follows:

a) Professional (Errors and Omissions) or Commercial General liability coverage for liability arising out of acts, errors, or omissions in providing, or failing to provide, professional services in an amount not less than one (1) million dollars per occurrence or as may be otherwise required and approved by the Community, which must apply on a per-project or per-location basis where applicable The aggregate limits shall be in an amount not less than two (2) million dollars per occurrence or as may be otherwise required and approved by the Community, and must apply on a per-project or per-location basis where applicable. The total amount may be met by means of umbrella or excess coverage or other liability coverage deemed acceptable to the Community.

b) Proof of insurance: Contractor shall provide the Community with an original certificate of insurance for each type of insurance coverage described herein and with originals of any required additional insured endorsement(s). Documents may be faxed directly from the insurance carrier to the Community.

IT-24-071 HIPAA – Appendix C Page 15

c) Except for professional liability and workers compensation coverage, the Community must be named as an additional insured on the Certificate of Insurance. The Contractor’s insurance shall be primary in the event of loss and the additional insured endorsement must include language specifically stating that the Community is to be covered for all the activities performed by or on behalf of the Contractor, including the Community’s general supervision of Contractor.

d) Each form of coverage described above shall be on an “occurrence” basis and not on a “claims made” basis. If “occurrence” basis coverage is unavailable, Contractor agrees to obtain and keep in force tail coverage for three (3) years beyond the end of the Agreement. Any such period may be extended by agreement of the parties.

e) Auto liability coverage as shown in the ISO Business Auto Coverage standard form, or the equivalent, with Covered Auto Designation Symbol 1, in an amount not less than one million dollars, or other auto liability coverage acceptable to the Community.

f) Workers Compensation coverage and Employers Liability coverage in an amount not less than the statutory amount required by the state in which the services are being performed or as may be otherwise required and approved by the Community.

11. DURATION AND TERMINATION: This Agreement shall commence on and end on . Either party may cancel this Agreement provided the canceling party provides prior written notice which shall include a detailed statement of the reasons for cancellation at least fourteen (14) days prior to the intended date of cancellation consistent with its existing contractual obligations.

12. ENTIRE UNDERSTANDING: This Agreement embodies the entire understanding between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements and understandings, inducements and conditions, express or implied, oral or written, except as herein contained. This Agreement may not be modified or amended other than by an agreement in writing.

13. BINDING NATURE OF AGREEMENT: This Agreement shall be binding upon and inure to the benefit of the parties and their respective heirs, personal representatives, successors and assigns, except no party may assign or transfer such party’s rights or obligations under this Agreement without the prior written consent of the other party.

14. SEVERABILITY: The provisions of this Agreement shall be deemed severable and the invalidity or enforceability of any provision shall not affect the validity or enforceability of the other provisions hereof.

15. ARBITRATION: Any dispute or claim arising from, or relating to this Agreement, or breach thereof that cannot be resolved promptly by the parties shall be resolved by arbitration in accordance with the rules, then obtaining, of the American Arbitration Association. It is understood that neither this Agreement nor the Rules of the American Arbitration Association shall confer

IT-24-071 HIPAA – Appendix C Page 16 jurisdiction on any courts of the State of Arizona or of the United States. It is further understood that arbitration as set forth in this paragraph is the exclusive remedy for any dispute, or claim related to this Agreement.

16. SOVEREIGN IMMUNITY: Nothing in this Agreement, or any current or future schedules, attachments, exhibits, amendments, or addenda, is intended to be or shall be construed as a waiver of the Community’s sovereign immunity, except as may be provided in paragraph 15 above.

17. OTHER See Schedules A through D and Exhibit A.

In witness whereof, the parties have executed this Agreement at the Salt River Pima-Maricopa Indian Community, on the day and year first written below.

SALT RIVER PIMA-MARICOPA CONTRACTOR:

INDIAN COMMUNITY: <CONTRACTOR NAME>:

BY______________________________ BY_________________________

NAME/TITLE NAME/TITLE

DATE:___________________________ DATE:_____________________

IT-24-071 HIPAA – Appendix C Page 17

SCHEDULE “A”

SCOPE OF WORK

The scope of work must accurately and with sufficient specificity describe what, when, where and how the contractor will perform the work (the deliverables), including references to goods and services, plans, specifications, codes, if applicable, temporal references, etc. Also, the work not to be performed should be so stated. Typically the scope of work is already contained in the bid solicitation and can be tailored and inserted here. In the event of non-performance by the contractor, the language in this section must be relied upon to establish a breach of the agreement.

IT-24-071 HIPAA – Appendix C Page 18

SCHEDULE “B”

TERMS OF PAYMENT

INSTRUCTIONS FOR SUBMISSION OF PAYMENT:

The Contractor shall invoice the Community for each completed task defined in the Schedule “A” Scope of Work for all projects under this contract. The description of each task and each task's deliverables are defined in each project's Scope of Work.

APPROVAL OF PAYMENT:

All invoices shall be forwarded to Accounts Payable, Finance Department with a copy to the Xxxx Department who will be responsible for verifying that the work for which the invoice has been received has been satisfactorily completed. The Xxxx Department shall return the invoices with their appropriate charge numbers for billing after verifying that the work stated on the billing statement has been performed to the satisfaction of the Community.

In no event shall Contractor be paid until the Xxxxx Department approves the invoice.

The Community shall pay all invoices approved by the Xxxxxx Department within thirty (30) days of approval.

FEES:

{INSERT FEE SCHEDULE HERE}

IT-24-071 HIPAA – Appendix C Page 19

SCHEDULE “C”

OTHER TERMS AND CONDITIONS

INSTRUCTIONS (DELETE THIS PARAGRAPH UPON COMPLETION OF THE FOLLOWING):

Special terms and conditions appear in this section only if they are not already contained in the agreement or other schedules, exhibits, etc. If this schedule is not needed, so indicate with “N/A”.

IT-24-071 HIPAA – Appendix C Page 20

Schedule “D”

DATA PROCESSING AND SECURITY POSTURING ADDENDUM

This Data Processing and Security Posturing Addendum (“Processing Addendum”) sets out the data privacy, protection, and security obligations applicable to Contractor under this Agreement.

1. Cyber Security/Cyber Liability. During the term of this Agreement, and for two (2) years thereafter, Contractor must provide and maintain coverage for cybersecurity and/or cyber liability in an amount no less than Five Million Dollars ($5,000,000) per claim and in the aggregate, including but not limited to, coverage for all unauthorized access, use, or disclosure; data loss;

transmission of malicious code or virus; exploitation designed to compromise network or data security and/or denial of or impairment of service; failure to protect the confidentiality of information of COMMUNITY, its employees, customer, or agents; violation of any right to privacy;

corruption, misuse or disclosure of personal information of third parties; and failure to protect privacy or personal identifying information, covering the liability of Contractor or any other person for whose acts the insured is legally liable, and the liability of COMMUNITY arising from or out of performance of Services. Insurer must have a Best’s rating of A- VIII or better. Any material changes in the provider or coverage required under this Agreement or cancellation of coverage required under this Agreement must be reported to COMMUNITY with not less than thirty (30) days prior written notice. This insurance shall apply as primary and non-contributory insurance with respect to any other insurance or self-insurance programs afforded by the COMMUNITY.

Contractor shall require that all of its subcontractors maintain insurance of the same types as required of Contractor and in the same amounts as required of Contractor unless COMMUNITY agrees in writing to a lesser amount. Contractor’s failure to procure and maintain the required insurance coverage or failure to ensure its subcontractors maintain the required insurance coverage shall constitute a breach of this Agreement by Contractor.

2. COMMUNITY Data. Any proprietary content or data, including without limitation Confidential Information and personally identifiable information, supplied, or generated by COMMUNITY, or its employees, contractors, agents, licensees and clients (“COMMUNITY Data”), is and will remain COMMUNITY intellectual property. COMMUNITY has and maintains all right, title, and interest in and to such COMMUNITY Data, whether express or implied, or whether deidentified or aggregated. COMMUNITY shall own all rights in any enriched COMMUNITY Data including reports, charts, databases, or other works created from COMMUNITY Data using the Service or any deliverables. Contractor may not use COMMUNITY Data in an anonymized and aggregated manner (e.g., statistical analysis, market trend reporting, marketing, or advertising) without COMMUNITY’s prior written consent. In the event COMMUNITY grants such consent, COMMUNITY hereby grants to Contractor a non-exclusive, revocable, royalty-free, worldwide, perpetual license to aggregate and de-identify the specified COMMUNITY Data obtained by Contractor under this Agreement in accordance with the NIST Standards CSF, ISO 27001 or other similar commercially-acceptable de-identification standards, or such other more stringent standards as required under applicable law and to use such de-identified and aggregated data for its internal business purposes consistent with this Agreement. Contractor shall ensure removes agency or any other indicator that in any way identifies COMMUNITY as the source of such data.

If Contractor hosts COMMUNITY Data, upon request by COMMUNITY at any time and upon any termination of this Agreement or any Statement of Work, Contractor will provide a COMMUNITY Data export at Contractor’s cost, including all enriched COMMUNITY Data from any Contractor database suitable for import in a mutually agreed upon format. Upon request or upon termination, after COMMUNITY confirms the integrity and completeness of the COMMUNITY Data export, Contractor will destroy COMMUNITY Data in a manner that renders all COMMUNITY

IT-24-071 HIPAA – Appendix C Page 21

Data unrecoverable consistent with NIST 800-88 Rev. 1 guidelines or equivalent unless instructed otherwise by COMMUNITY.

3. No Presence Outside the United States. Without the prior written consent of COMMUNITY, Contractor will not store, maintain, host, transmit to, or permit the transitory presence of COMMUNITY Data outside of the United States.

4. Safeguards. Contractor agrees to implement administrative, physical, technical, and organizational safeguards to protect the availability, confidentiality, and integrity of COMMUNITY Data and, at minimum, all NIST Standards CSF, ISO 27001 or other similar commercially-acceptable standards applicable to the information technology infrastructure and/or environment, including without limitation, computers, software, databases, electronic systems (including database management systems), and networks used or accessed in connection with the services (“System(s)”) or Services or products accessing or storing COMMUNITY Data, and/or Contractor’s connection or access to the COMMUNITY’s Systems. All such safeguards shall be in accordance with industry-wide best practices and standards and commensurate with the importance of the information being protected, but in no event less protective than safeguards that Contractor uses to protect its own information or data of similar importance, or as required by applicable law.

5. Access Controls and Authentication. Contractor shall implement and maintain access and authentication controls and processes in accordance with the generally recognized industry standards and, at minimum, the NIST Standards CSF, ISO 27001 or other similar commercially-acceptable standards applicable for access to COMMUNITY Data and as approved by COMMUNITY. Contractor shall implement and maintain procedures to ensure that any users of Contractor who access COMMUNITY Data on any System have appropriate clearance, authorization, and supervision. These procedures should include, but are not limited to: (i) documented authorization and approval procedures for access to applications or data stores which contain COMMUNITY Data; (ii) annual review of user access rights in all applications or data stores which contain or may access COMMUNITY Data; (iii) termination procedures which ensure user accounts are promptly deactivated from applications or data stores which contain COMMUNITY Data when users are terminated or transferred or no longer require access to such information; and (iv) procedures which ensure all users use unique authentication credentials which are associated with the user’s identity (for tracking and auditing purposes) when accessing Systems which contain COMMUNITY Data.

6. Intrusion Detection and Prevention. All Contractor Systems involved in accessing, holding, transporting, and/or storing COMMUNITY Data that are connected to the Internet must be protected by a comprehensive intrusion detection and prevention solution and policy implemented in accordance with the NIST Standards CSF, ISO 27001 or other similar commercially-acceptable standards applicable to the products, Services or Systems accessing or storing COMMUNITY Data, and/or Contractor’s connection or access to the COMMUNITY System, as approved by COMMUNITY in advance. Contractor will configure all inbound servers to scan all email and network traffic for viruses, ransomware, and other malware or malicious code.

Contractor acknowledges and agrees COMMUNITY may deny any traffic due to any perceived and/or actual risk and may require Contractor to use a more secured protocol for such traffic.

Contractor shall conduct periodic penetration tests, and as necessary, implement in an expedient manner all appropriate corrective actions to mitigate potential vulnerabilities. Upon request and subject to entering into a non-disclosure agreement between the parties, Contractor shall provide the results of any penetration test performed by Contractor with respect to any services, products or Systems accessing, storing, processing, or transmitting any COMMUNITY Data as requested by

IT-24-071 HIPAA – Appendix C Page 22

COMMUNITY and implement all reasonable suggestions or requirements communicated by COMMUNITY in response to the review of such penetration test.

7. Encryption. Contractor shall encrypt all COMMUNITY Data at rest, transmitted through, or processed or located within Contractor’s Systems or third-party data center using generally recognized industry standards then-applicable to the COMMUNITY Data and at minimum commensurate with NIST Standards or other similar commercially-acceptable standards applicable to the products, Services or System accessing or storing COMMUNITY Data, and/or Contractor’s connection or access to the COMMUNITY Systems. Unless otherwise authorized in writing by COMMUNITY, all COMMUNITY Data (including any COMMUNITY authentication credentials) may only be transmitted, processed, exchanged, or stored using strong encryption or other secure network connection approved by COMMUNITY. No COMMUNITY Data provided in encrypted form to Contractor may be unencrypted by Contractor without COMMUNITY’s prior written consent.

8. Physical Controls. Contractor shall use commercially reasonable efforts to prevent theft or damage to Contractor Systems or other storage media containing COMMUNITY Data. Contractor shall conduct regular maintenance on Systems which contain COMMUNITY Data and to facility physical and environmental controls (e.g., temperature, physical access). Contractor shall implement and maintain adequate physical controls to protect COMMUNITY Data including use of keys, card access systems, biometrics, and security.

9. Risk Management; Third-Party Audits. Contractor shall implement internal risk management practices to ensure the confidentiality, integrity, and availability of COMMUNITY Data in accordance with the terms herein. If available, Contractor shall provide COMMUNITY a copy of its current Service Organization Control (SOC) 1 Type II, SOC 2 Type II and SOC 3 report or equivalent at no cost to COMMUNITY annually. If Contractor does not have a current SOC 1, SOC 2 and SOC 3, COMMUNITY may commission an audit on Contractor’s Systems at Contractor’s cost.

Failure by Contractor to consent to or provide COMMUNITY with a copy of its SOC 1, SOC 2 and SOC 3 as required in this provision shall be considered a material breach of this Agreement. If the SOC 1 or SOC 2 provided to COMMUNITY contains an exception raised by the independent auditor, COMMUNITY may provide written notice to Contractor and if such exception remains uncured after 90 days, COMMUNITY may terminate this Agreement and any Statements of Work upon written notice, and Contractor shall return to COMMUNITY any payments made by COMMUNITY for Services, products or deliverables not yet received on a pro rata basis.

10. Reporting Breaches. Contractor shall promptly report to COMMUNITY at 480-

362-7777 and IT-Cybersecurity@SRPMIC-nsn.gov any suspected or confirmed security incident or data breach reasonably effecting COMMUNITY’s Data within forty-eight (48) hours of discovery, or any such earlier period as required under applicable law. Vendor shall promptly provide a report detailing the breach or security incident and shall include, at a minimum, but not be limited to: (a) date and time when the breach, incident, or failure occurred; (b) the date and time when such breach, incident, or failure was discovered by Contractor; (c) identification of the systems, programs, networks, aspects of the COMMUNITY System and/or COMMUNITY Data impacted or otherwise effected by such breach; (d) preliminary impact analysis regarding such breach; (e) a description of the scope of the breach; and, (f) all mitigation steps taken by Contractor to prevent and reduce the potential harm of such breach. Contractor shall use best efforts and take all necessary actions to prevent, contain, and mitigate the impact of, such data breach. Contractor shall develop and maintain a documented breach response plan for promptly responding to a breach, and/or which has a potential to impact or effect (or has impacted or effected) on the mailto:IT-Cybersecurity@SRPMIC-nsn.gov

IT-24-071 HIPAA – Appendix C Page 23

COMMUNITY System, or COMMUNITY Data, and such procedure shall comply with all applicable laws. Upon the request of COMMUNITY, Contractor shall provide COMMUNITY with a copy of all incident response plans applicable to a breach. Contractor shall designate in writing a contact person for COMMUNITY to contact in the event of breach. This contact person should possess the requisite authority and knowledge to: (i) act as a liaison to communicate between Contractor and COMMUNITY regarding the incident (including providing information requested by COMMUNITY);

(ii) perform the reporting obligations of Contractor under this Processing Addendum; and, (iii) develop a mitigation strategy to remedy or mitigate any damage to COMMUNITY Systems, data, or the product or Service that may result from the breach. If required by applicable law, Contractor shall, at its sole cost and expense, provide notice to individuals or entities whose confidential information or data was or may have been affected in a manner and format specified by the COMMUNITY. If applicable, Contractor shall provide credit monitoring for the affected individuals for a period of not less than twelve (12) months, at Contractor’s sole expense, to the extent any such unauthorized access, disclosure or use was the result of any action or inaction by Contractor or its personnel, including permitted contractors and subcontractors, agents, or representatives. Contractor shall also provide resources, cooperation, and be responsible for expenses related to public relations and reputational repair in the event of an actual or suspected breach or unauthorized use of the COMMUNITY Data.

11. Disaster Recovery/Backup. Contractor will employ and maintain security, backup, and disaster recovery measures including, but not limited to, facility security and safety equipment, back up and disaster recovery procedures and measures, and physical and logical server security measures, sufficient to protect the security and integrity of COMMUNITY Data, to harden against disaster and loss of COMMUNITY Data, and to comply with applicable laws regarding data security and privacy including, but not limited to, measures sufficient to prevent

(i) an unauthorized third party from accessing COMMUNITY Data; (ii) any unauthorized access to COMMUNITY Data; and, (iii) loss, corruption, disclosure, or misuse of COMMUNITY Data. In no event shall Contractor employ less than those industry standard security measures generally employed by those service providers providing products, services, equipment, or materials similar in nature and type to the Services provided by Contractor.

12. PCI Compliance. If Contractor stores, processes, or transmits credit/debit cardholder data, Contractor agrees to comply with all applicable PCI-DSS standards and requirements and other applicable payment card issuer regulatory requirements (“PCI Regulatory Requirements”) and represents and warrants that it has performed the necessary steps to validate its compliance with the PCI Regulatory Requirements. Without limitation of any obligations herein, in the event of the occurrence of a breach involving cardholder data, Contractor shall reasonably cooperate with payment card processors and card issuers involved and allow them to reasonably investigate, review, and audit Contractor’s facilities, Systems, files, procedures, and records related to such breach and shall promptly comply with any applicable PCI Regulatory Requirements.

13. Security Training. Contractor represents to COMMUNITY that Contractor personnel who handle sensitive data as a part of this Agreement have received an appropriate level of formal training on handling sensitive data securely and/or secure application development.

IT-24-071 HIPAA – Appendix C Page 24

14. Audit Logging/Intrusion Detection. Where relevant to the Services provided, Contractor shall collect and retain audit logs recording privileged user access activities, authorized and unauthorized access attempts, system exceptions, and information security events, complying with…