Network_Infrastructure_Assessment.pdf

REQUEST FOR PROPOSAL

2026-RFP-0001

NETWORK INFRASTRUCTURE ASSESSMENT

County of Sacramento

9660 Ecology Lane

Sacramento, CA 95827

RELEASE DATE: February 2, 2026

DEADLINE FOR QUESTIONS: February 16, 2026

RESPONSE DEADLINE: March 9, 2026, 3:00 pm

RESPONSES MUST BE SUBMITTED ELECTRONICALLY TO:

https://secure.procurenow.com/portal/saccounty https://secure.procurenow.com/portal/%7bproject.government.code%7d

County of Sacramento

REQUEST FOR PROPOSAL

Network Infrastructure Assessment

1. Definitions

2. Introduction

3. Proposer's Instructions

4. Basis for Award

5. Final Acceptance

6. Project Details

7. Vendor Submissions

8. Sacramento County Standard Terms and Conditions

9. Additional Terms and Conditions

10. Environmental Purchasing Policy

Request for Proposal #2026-RFP-0001 Title: Network Infrastructure Assessment

1. Definitions

Response: The written, signed and sealed complete document(s) submitted according to the proposal instructions. Response does not include any verbal or documentary interaction apart from submittal of a formal Response.

Request/Proposal/Bid: The completed and released solicitation, including all subsequent addenda, made publicly available to all prospective proposers.

We/Us/Our: Terms that refer to the County of Sacramento, a duly organized public entity. They may also be used as pronouns for various subsets of the County organization, including, as the context will indicate:

• Purchasing - the Contracts and Purchasing Services Division of the Department of General

Services.

• Department/Division – The department or division requesting the goods or services contained in this request, for which this Proposal is prepared and which will be the end user of the requested goods or services.

• Constituency – the client base or County population which may benefit from the procurement of goods and/or services requested herein.

You/Your: Terms that refer to businesses/individuals submitting a response. The term may apply differently as the context will indicate.

• Supplier - A business entity engaged in the business of providing services.

• Proposer - A business entity submitting a Response to this proposal. Suppliers which may express interest in this proposal, but who do not submit a Response, have no obligations with respect to the proposal requirements.

• Contractor - The Proposer(s) whose Response to this proposal is evaluated as meeting the needs of the County. Contractor(s) will be selected for award, and will enter into a contract(s) for provision of the services described in this proposal.

• Contractor’s Employee - All persons who can be offered to provide the services described in the proposal. All employees of the Contractor shall be covered by the insurance programs normally provided to persons employed by a company (ex: Worker’s Comp, SDI, etc.).

Mandatory: A required element of this request/proposal/bid. Failure to satisfy any element of this request/proposal/bid defined as “mandatory” will disqualify the particular response.

Default: A failure to act as required by any contract resulting from this request, which may trigger the right to sue or may excuse the other party's obligation to perform under the contract.

Cancellation/Termination: A unilateral or mutual decision to not complete an exchange or perform an obligation under any contract resulting from this request.

“Or Equal”: A statement used for reference to indicate the character or quality desired in a requested product or service. When specified in a proposal document, equal items will be considered, provided the response clearly describes the article. Offers of equal items must state the brand and number, or level of quality. When brand, number, or level of quality is not stated by proposer, the offer will be considered exactly as specified. The determination of the Purchasing Agent as to what items are equal is final and conclusive.

2. Introduction

2.1. Summary

The scope of work for this RFP is to deliver a thorough Network Infrastructure Assessment for the

County of Sacramento.

The goal is to understand the security and efficiency of the County's Network to meet the needs of

County of Sacramento departments and constituents currently and in the future. This RFP seeks qualified vendors capable of providing the expertise needed to perform a through Network

Infrastructure Assessment.

2.2. Background

Sacramento County was incorporated in 1850 as one of the original 27 counties of the State of

California. A five-member elected Board of Supervisors serves as the government body of the County, establishing policy and exercising legislative authority. The County Executive, appointed by the Board, serves as the Chief Executive Officer of the County and is generally responsible for the County’s day-to-day operations. Sacramento County has an estimated population of 2.1 million residents. The County is staffed by approximately 12,000 full-time employees and manages an annual budget of almost $5.8 billion.

This RFP is required to award a contract(s) to perform an assessment of the County's Network environment. The Contract(s) will provide for specialized services as outlined in this RFP and may need approval of by the County Board of Supervisors before work can begin.

The County intends to issue a 1 (one) year contract with the ability to extend for up to 4 (four) additional

1 (one) year periods.

2.3. Contact Information

Any inquiries or requests regarding this solicitation must be submitted via OpenGov. Contact with unauthorized County personnel during the selection process may result in disqualification.

Chris Anderson

Senior Contract Services Officer

9660 Ecology Ln.

Sacramento, CA 95827

Email: andersonch@saccounty.gov

Phone: (916) 874-7034

Department:

DGS: CAPSD - Procurement

Department Head:

Brandalyn Tramel

Purchasing Agent mailto:andersonch@saccounty.gov tel:(916)874-7034

2.4. Timeline

Release Project Date February 2, 2026

Question Submission Deadline February 16, 2026, 3:00pm

Addendum Issued (if necessary) February 20, 2026, 3:00pm

Submission Deadline March 9, 2026, 3:00pm

Award Contract March 31, 2026

3. Proposer's Instructions

General Format: Respond to all requests for information and completion of forms contained in this

Request for Proposal. You may use additional sheets as necessary. A qualifying response must address all items. Brochures and advertisements will not be considered a complete reply to requests for information and will not be accepted as such. Proposer is solely responsible for accuracy and completeness of proposal response and for electronically separating confidential documents when submitting their response through SacCountyEbids. Responses considered incomplete may be rejected.

Alteration of Proposal Text: the original text of this proposal document, as well as any attachments, amendments or other official correspondence related to this proposal document, may not be manually, electronically or otherwise altered by proposer or proposer’s agent(s). Any response containing altered, deleted, additional or otherwise non-original text will be disqualified.

Preparation of Response:

A. All responses must be signed by an authorized officer or employee of the responder.

B. Responses must be submitted prior to the specified date and time, using the SacCountyEbids.

Responses delivered by hand, fax, telephone, e-mail, or any postal carrier will not be accepted. If bidder uploads a file to SacCountyEbids, it is bidder responsibility to ensure the file is not corrupt or damaged. If County is unable to open an attachment because it is damaged, corrupt, infected, etc., it may disqualify bidder’s submission. See this training guide for guidance entering your online response.

C. Time of delivery must be stated as the number of calendar days following receipt of the order by the proposer to receipt of the goods or services by the County.

D. Time of delivery may be a consideration in the award.

E. Prices will be considered as net if no cash discount is offered. If a discrepancy between the unit price and the item total exists, the unit price prevails.

F. Shipping Terms: N/A; Payment Terms: NET/30.

Confidential Information/Public Record: All responses become property of the County. All responses, including the accepted proposal and any subsequent contract, become public records per the requirements of the California Government Code, Sections 6250 -6270, “California Public Records Act”.

Proprietary material must be clearly marked as such. Pricing and service elements of the successful proposal are not considered proprietary information.

The County will treat all information submitted in a proposal as available for public inspection once the

County has selected a contractor. If you believe that you have a legally justifiable basis under the

California Public Records Act (Government Section 6250 et. seq.) for protecting the confidentiality of any information contained within your proposal, you must identify any such information, together with the legal basis of your claim in your proposal, and present such information separately (see "Confidential" section in Vendor Submissions) as part of your response package.

https://secure.procurenow.com/portal/saccounty https://secure.procurenow.com/portal/saccounty https://secure.procurenow.com/portal/saccounty http://help.procurenow.com/en/articles/5815468-opengov-procurement-vendor-training

The final determination as to whether the County will assert your claim of confidentiality on your behalf shall be at the sole discretion of the County. If the County makes a determination that your information does not meet the criteria for confidentiality, you will be notified as such. Any information deemed to be non-confidential shall be considered public record.

4. Basis for Award

This proposal award will be determined by factors other than price alone. The County’s sole purpose in the evaluation process is to determine from among the Responses received, which one is best suited to meet the County’s needs. Any final analysis or weighted point score does not imply that one proposal is superior to another, but simply that in our judgment the proposal(s) we select offer(s) the best overall solution for our current and anticipated needs. The County reserves the right to make modifications to any scoring and/or weight structure prior to the evaluation of responses. The responses will remain sealed during the proposal evaluation period, and will be made available for public inspection upon notice of proposal award.

Bid responses will be considered valid for a period of 120 calendar days after bid closing date above.

Note: All specifications, terms and conditions of this request will apply to any resulting order.

4.1. Scoring Criteria

Proposals will be scored on pricing and other factors in your proposal such as ability to meet the requirements of the RFP, experience, references, risk assessment, etc. Contract(s) will be awarded to the highest scoring proposer(s).

4.2. Proposal Award

All specifications, terms and conditions of this request will apply to any resulting order.

The County reserves the right to make a single award, multiple awards, or no award at all to this RFP, or to procure any materials, equipment or services specified in this RFP by any other means, or to determine that no project will be pursued. In addition, the RFP may be amended, canceled, or reissued as necessary to meet requirements. The County reserves the right to waive or correct any informalities and minor irregularities in proposals received. The County reserves the right prior to proposal submission deadline, to modify all or any portion of the selection procedures, including deadlines for accepting responses, the specifications or requirements for any materials, equipment or services to be provided under this RFP, or the requirements for contents or format of the proposals.

The evaluation factors reflect the totality of considerations to be used in evaluating the requested

Proposal responses. While cost is important, other factors are also significant, and the County may not select the lowest cost proposal. The objective is to choose the proposal that offers the highest quality product and services and will achieve the project’s goals and objectives.

4.3. Evaluation Phases

All proposals will be evaluated by a County designated Evaluation Committee consisting of key County stakeholders. All proposals will be evaluated using the same criteria and with the same amount of possible points. Evaluations will be based on the criteria listed below, which correspond to information requested in various sections of the proposal:

The evaluation process will be completed in two phases. The first phase will evaluate the timely submitted written proposals including Risk Assessment, Organization and Experience and the Description of Services submittals. Proposals that do not include all relevant required forms and sections, or do not meet minimum qualifications, are subject to rejection without further evaluation.

Based on the scores from the proposal evaluation, the Evaluation Committee will determine which

Proposers will be invited to participate in the second phase.

The second phase will evaluate proposer interviews, cost information and customer references. Phase 2 will consist of an in-person/Microsoft Teams video conference interview from each invited Proposer.

The interviews may be held on-site at a County facility. Interview questions will be scripted so that each

Proposer follows a standardized outline; the County is not interested in a corporate or sales presentation. Proposers must be prepared to demonstrate their understanding of any requirement outlined within the proposal. The County reserves the right to ask additional questions during interviews to clarify the scope and content of the submitted written proposal and verbal responses.

Points from Phase 1 (proposal review) will not be factored into the Phase 2 (interview, cost and references) evaluations.

During the course of evaluations, the Evaluation Committee may:

• Choose to contact officials from other jurisdictions regarding the Proposer, their prior work experience, and their ability to successfully complete the scope of services. The County may coordinate independent site visits to other jurisdictions to understand the product and services in a working environment.

• Request clarification or additional information from a Proposer in order to assist in the evaluation process. This process may not be used as an opportunity to submit missing documentation, change pricing, or make major revisions to the original response.

• Request work product examples for any documentation deliverables outlined in this proposal.

• Require changes in the scope of services, as deemed necessary by the County, before Contract execution.

• Invite additional Proposers from Phase 1 to participate in Phase 2 evaluations.

Phase 1

Appendix U Description of Services

Appendix S Organization and Experience

Phase 2

Proposer’s Interview

Appendix I Total Costs

Proposer’s References

5. Final Acceptance

Equipment/Supplies/Services

The County of Sacramento will agree to final acceptance only after the supplied equipment, product or service is tested and is found to perform within acceptable standards of operation, is in compliance with all published and implied performance standards, and is considered by the County to be ready for practical application.

6. Project Details

6.1. Important Instructions for Electronic Submittal

The County is accepting electronic bid submissions. Bidders shall create a FREE account with OpenGov

Procurement by signing up at Sign Up (opengov.com). Once you have completed account registration, browse back to this page, click on "Submit Response", and follow the instructions to submit the electronic bid.

6.2. Downloading Required Submittals

The required documents for submittal must be downloaded from the Opengov website and not from the downloaded RFP document, attempting to download from the RFP document will result in a broken link message.

If you experience technical difficulties with the Opengov site, use the help function in the lower right corner of your screen, the County does not own or maintain Opengov.

6.3. Scope of Work or Project Details

The required submittal documents making up the project details for this RFP are located in the Vendor

Submission section of this RFP.

6.4. Contractor Responsibilities Instructions:

Implementation

County recognizes that the involvement, understanding and commitment of employees are essential to the successful implementation of the proposed network infrastructure assessment solution. As such, County employees will assist in all key process modifications and be involved in any changes or decisions that may be required based on any recommendations.

• The successful Contractor, with appropriate involvement from County employees, must provide all professional services required to implement the proposed network infrastructure assessment solutions.

• The Contractor may submit multiple recommendation options which can be discussed with the

County if they are awarded the contract, and each option must have its own specific Appendix I Pricing document submitted. The County would like to understand available Proposer service offerings.

Enhancements and Updates

Any enhancements needed to satisfy the requirements outlined in this RFP must be included as part of the services rendered core product and identified in the proposal.

https://procurement.opengov.com/signup

All updates provided to the County should continue to be subject to the terms and conditions of any existing service agreements, i.e. any existing cell phone or circuit contracts/agreements that are in place.

Project Schedule

The Contractor will work with the County to develop a project schedule after contract award.

Place of Performance

The location of worksite, if applicable, will be 799 G Street Sacramento, CA 95814.

The Proposer must outline in the proposal the planned on-site time and costs associated with providing on-site resources. The County does not pay for travel expenses; these must be factored into the total cost of the project proposal and included in Appendix I - Pricing.

Deliverables

The following section outlines the high-level project deliverables. Some deliverables will be the sole responsibility of the awarded Proposer, while others will be a shared responsibility of both the Proposer and Sacramento County.

All deliverables become the property of Sacramento County.

6.5. Network Assessment Scope

General:

Contractor may need FTI clearance depending on whether the firm/contractors have access to the data in the environment.

For each area, the chosen vendor will be expected to include findings as well as suggest improvements.

Network Infrastructure Scope Overview

The network infrastructure assessment will encompass a comprehensive review of design, architecture, and operational practices to ensure optimal performance, security, and scalability. Key focus areas include evaluating the current topology for efficiency, verifying segmentation to protect critical systems, and assessing redundancy and failover mechanisms for high availability. Hardware health checks, firmware updates, and lifecycle management will be conducted to maintain reliability and plan for future upgrades. Compliance with regulatory standards and adherence to industry best practices will be validated, supported by accurate documentation of network diagrams and configurations. Additionally, the assessment will address scalability for future growth, recommend technology enhancements, and evaluate staffing levels, skillsets, and organizational readiness to support ongoing network operations effectively.

Network Infrastructure Detail:

Network Design and Architecture

• Topology Review: Assess the current network topology to ensure it is optimized for performance and scalability.

• Segmentation: Evaluate the segmentation of the network, ensuring that critical systems are isolated and protected.

• Redundancy and Failover: Review redundancy and failover mechanisms to ensure they are adequate for maintaining network availability.

Hardware and Equipment

• Equipment Health: Check the health and performance of network hardware such as switches, routers, and wireless access points.

• Firmware and Software Updates: Ensure all network equipment is running the latest firmware and software updates.

• Lifecycle Management: Evaluate the age and condition of network equipment to plan for replacements or upgrades.

Compliance and Best Practices

• Regulatory Compliance: Ensure the network meets relevant regulatory and industry standards.

• Best Practices: Evaluate the network against best practices for design, security, and performance.

Documentation

• Network Diagrams: Ensure that network diagrams are up-to-date and accurately reflect the current network.

• Configuration Management: Maintain detailed documentation of network configurations and changes.

Future Planning and Recommendations

• Scalability: Assess the network's ability to scale with future growth and technological advancements.

• Technology Upgrades: Provide recommendations for network upgrades and new technologies to improve performance and security.

Staffing and Organizational Readiness

• Staffing Levels o Inventory current personnel supporting network operations (FTEs, contractors).

o Compare staffing levels to industry benchmarks for similar environments.

o Identify gaps in coverage (e.g., after-hours support, specialized roles).

• Skillset and Training o Assess technical competencies in routing, switching, firewalls, wireless, SD-WAN, and cloud networking.

o Identify training needs or certifications (e.g., CCNA/CCNP, Azure Networking).

o Evaluate cross-training and redundancy in critical roles.

• Organizational Structure o Review team structure and reporting lines.

o Assess collaboration between network, security, and infrastructure teams.

• Operational Maturity o Evaluate use of automation, orchestration, and Infrastructure as Code (IaC).

o Review documentation practices, runbooks, and knowledge transfer processes.

7. Vendor Submissions

7.1. Proposal Requirements*

Did you read through and confirm that you met all of the proposal requirements?

☐ Yes

☐ No

*Response required

7.2. Please confirm that you have read the County Terms and Conditions and Sample Contract and your company will accept the County's contract terms and conditions

☐ Please confirm

7.3. 2026-RFP-0001 Appendix S Organization and Experience this is a required document, no substitute documents will be accepted.*

Please download the below documents, complete, and upload this document.

• 2026-RFP-0001_Appendix_S_-_...

*Response required

7.4. 2026-RFP-0001 Appendix U Description of Services this is a required document, no substitute documents will be accepted.*

Please download the below document, complete, and upload this document, add additional pages as needed to complete each section.

• 2026-RFP-0001_Appendix_U_-_...

*Response required

7.5. 2026-RFP-0001 Appendix I Pricing this is a required document, no substitute documents will be accepted.*

Please download the below document, complete, and upload this document.

• 2026-RFP-0001_Appendix_I_-_...

*Response required

7.6. Confidential Company Information (if applicable)

The County will treat all information submitted in a proposal as available for public inspection once the

County has selected a contractor. If you believe that you have a legally justifiable basis under the

California Public Records Act (Government Section 6250 et. seq.) for protecting the confidentiality of any information contained within your proposal, you must identify any such information, together with the legal basis of your claim in your proposal, and present such information in this section as part of your response package. Click "File Upload" below to upload your confidential documents.

https://government-project.s3.us-west-2.amazonaws.com/229323/15f94588-8b40-44ba-9edb-ad950abab357_2026-RFP-0001_Appendix_S_-_Organization_and_Experience.docx https://government-project.s3.us-west-2.amazonaws.com/229323/e0df1ef0-2f18-4c94-a9be-c218965217bb_2026-RFP-0001_Appendix_U_-_Description_of_Services.docx https://government-project.s3.us-west-2.amazonaws.com/229323/77346084-8ecb-4f38-8dbb-a6ac4ce3f4aa_2026-RFP-0001_Appendix_I_-_Pricing.docx

7.7. This section is not required and will not be scored or effect RFP results in any way: Sacramento County Purchasing Alliance (SCOPA) information

Please download the below document for information about SCOPA.

• 2026-RFP-0001_SCOPA_ADDENDU...

7.8. Please review the attached Network Infrastructure Assessment sample contract

Please download and review the below documents.

• 2026-RFP-0001_Network_Infra...

7.9. Contractor Certification of Compliance, part 1*

WHEREAS it is in the best interest of Sacramento County that those entities with whom the County does business demonstrate financial responsibility, integrity and lawfulness, it is inequitable for those entities with whom the County does business to receive County funds while failing to pay court-ordered child, family and spousal support which shifts the support of their dependents onto the public treasury.

Therefore, in order to assist the Sacramento County Department of Child Support Services in its efforts to collect unpaid court-ordered child, family and spousal support orders, the following certification must be provided by all entities with whom the County does business:

CONTRACTOR hereby certifies that either:

☐ (a) the CONTRACTOR is a government or non-profit entity (exempt); or

☐ (b) the CONTRACTOR has no Principal Owners (25% or more) (exempt); or

☐ (c) each Principal Owner (25% or more), does not have any existing child support orders; or

☐ (d) CONTRACTOR’S Principal Owners are currently in substantial compliance with any court-ordered child, family and spousal support order, including orders to provide current residence address, employment information, and whether dependent health insurance coverage is available. If not in compliance, Principal Owner has become current or has arranged a payment schedule with the

Department of Child Support Services or the court.

*Response required

7.10. Contractor Certification of Compliance, part 2*

New CONTRACTOR shall certify that each of the following statements is true:

A. CONTRACTOR has fully complied with all applicable state and federal reporting requirements relating to employment reporting for its employees; and

B. CONTRACTOR has fully complied with all lawfully served wage and earnings assignment orders and notices of assignment and will continue to maintain compliance.

NOTE: Failure to comply with state and federal reporting requirements regarding a contractor's employees or failure to implement lawfully served wage and earnings assignment orders or notices of assignment constitutes a default under the contract; and failure to cure the default within 90 days of notice by the County shall be grounds for termination of the contract. Principal Owners can contact the https://government-project.s3.us-west-2.amazonaws.com/229323/328405e8-cc58-4f80-b191-74c16aef6fe0_2026-RFP-0001_SCOPA_ADDENDUM.pdf https://government-project.s3.us-west-2.amazonaws.com/229323/3980dd2c-71aa-4f99-8f57-bc49de8508fe_2026-RFP-0001_Network_Infrastructure_Assessment_Sample_Contract.docx

Sacramento Department of Child Support Services at 1-866-901-3212, by writing to P.O. Box 269112, Sacramento, 95826-9112, or via the Customer Connect website at www.childsup.ca.gov.

☐ Please confirm

*Response required

7.11. Solicitation Exceptions*

Please list all exceptions below referring to name of specific section and (where applicable) paragraph, subsection number, or other identifier. For each exception, please quote the statement(s) to which you are taking an exception, for reference during bid analysis. Exceptions considered excessive or affecting vital terms, conditions or specifications may reduce or eliminate your prospects for award.

Please include the following with every exception (if your company has no exceptions, type "N/A" in this field):

A. Page #

B. Section#/Title

C. Exception Description

*Response required

7.12. Non-Collusion Affidavit*

I state that I am authorized to make this affidavit on behalf of my firm, and its owners, directors, and officers. I am the person responsible in my firm for the price(s) and the amount of this proposal.

I state that:

A. The price(s) and amount of this proposal have been arrived at independently and without consultation, communication or agreement with any other contractor, bidder or potential bidder, except as disclosed below in the exceptions field (accept with exceptions).

B. That neither the price(s) nor the amount of this proposal, and neither the approximate price(s) nor approximate amount of this proposal, have been disclosed to any other firm or person who is a bidder or potential bidder, and that they will not be disclosed before proposal opening.

C. No attempt has been made or will be made to induce any firm or person to refrain from submitting a proposal on this contract, or to submit a proposal higher than this proposal, or to submit any intentionally high or noncompetitive proposal/bid or other form of complementary proposal.

D. The proposal by my firm is made in good faith and not pursuant to any agreement or discussion with, or inducement from, any firm or person to submit a complementary or other noncompetitive proposal.

E. My firm, its affiliates, subsidiaries, officer, directors and employees are not currently under investigation by any governmental agency and have not in the last five years been convicted of or found liable for any act prohibited by State or Federal law in any jurisdiction, involving conspiracy or collusion with respect to bidding on any public contract.

F. No current or previous employee of the County of Sacramento (employed by County of

Sacramento within the last calendar year) has been involved or is currently involved in any manner, directly or indirectly, with bidder’s response or considerations in responding to this request.

I understand and my firm understands and acknowledges that the above representations are material and important, and will be relied upon by the County of Sacramento in awarding the contract(s) for which this proposal is submitted. I understand and my firm understands that any misstatement in this affidavit is and shall be treated as fraudulent concealment from the County of Sacramento of the true facts relating to the submission of proposals/bids for this contract. Any violation of this certification shall render bidder’s response invalid. In such a case, bidder’s response will be immediately disqualified.

☐ Please confirm

*Response required

7.13. Customer References*

Include three (3) Company references here:

Reference 1

• Agency/Company Name

• Project Name

• Project Size (Cost/Unit & Total Cost)

• Project Type

• Year Completed

• Name of Project Manager

• Email Address & Phone Number

• Brief Physical Description of Project

Reference 2

• Agency/Company Name

• Project Name

• Project Size (Cost/Unit & Total Cost)

• Project Type

• Year Completed

• Name of Project Manager

• Email Address & Phone Number

• Brief Physical Description of Project

Reference 3

• Agency/Company Name

• Project Name

• Project Size (Cost/Unit & Total Cost)

• Project Type

• Year Completed

• Name of Project Manager

• Email Address & Phone Number

• Brief Physical Description of Project

*Response required

7.14. Risk Assessment Questionnaire*

Please download the below documents, complete, and upload.

• Risk_Assessment_Questionnai...

*Response required

7.15. HIPAA Business Associate Exhibit to Contract*

Whereas, COUNTY, pursuant to the terms of the Agreement, wishes to disclose to CONTRACTOR and

CONTRACTOR wishes to disclose to COUNTY, certain information, some of which may constitute

Protected Health Information (PHI) including any in an electronic format (Electronic Protected Health

Information or EPHI);

Whereas, in the course of the performance of the Agreement, CONTRACTOR will be provided with access to PHI;

Whereas, COUNTY and CONTRACTOR desire to protect the privacy and provide for the security of PHI disclosed to each other in compliance with the Health Insurance Portability and Accountability Act of

1996 (HIPAA) Title 45 Code of Federal Regulations (CFR), Title 42 CFR Section 1320d, and regulations promulgated thereunder by the U.S. Department of Health and Human Services (the HIPAA Regulations) and other applicable laws and regulations.

Whereas, it appears that the CONTRACTOR is a Business Associate of COUNTY as that term is defined in the HIPAA regulations; and https://government-project.s3.us-west-2.amazonaws.com/14692/69c0247d-f232-4964-94df-52ab07e78aa1_Risk_Assessment_Questionnaire.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4NVZV2G2F%2F20260203%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20260203T000000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECYaCXVzLXdlc3QtMiJHMEUCIDLOJPU7KTyuoB5UOoNoZ62VPGtaLzq1Fx0QRWH6lWjqAiEA42BS4zUOovrf%2B2AN913Gowqqr980XrWsHe14M4VAR9IqlQUI7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARACGgw4OTIzNjQ2ODc2NzIiDNs5K6DaTt7waBXgwSrpBIQpnPzEDMOYMMQt5nWhj%2FkvEUKXJSH1BsBurdFPTc%2BYmr5p3wWukRr4nwTgfiIVWGnEEEGtoo12eykJiuJvke60ipDwSG0Uz2RmcqnKCgmxM5MLVbwnJvtq9BFHEpEA8UsQ7rwKi77lVUI119ts2DjsKfl4lCvv4fF7DYWfpampX%2F8MGSL3gUS0uzLIvtJCr4i%2FPS%2BhUYAcE7147xpO7SM5glJl6eBqcrK%2FUDov7OT9EKl77I8TuPYjtX1%2Ff8MW5Zvo4TBHAimmkDEIYBe%2BYa0A3QADVddqQuHtdvv6jpXGTQdHvD7cNFGPpillzq6qTOT5u3ePoohFqDxkVzkMfLZ%2B9fQ9xjZZ5mpo%2BzL%2BFbmfEUTTIAjeoTPW0QtYXJyncOl%2BiLUOInAfpLEWR3dcmZi%2FawKKArEgb6OY9AwvNXQUB2UW19FNqljADHoZDfhdP34pFInjPzrz1zN2NaW%2FDB1EMxu1vVEpZay8smVwjwuOSXxcdShGzRg65qhYKUHWPMgWjDYi5PVZvdA%2BnoTrXXKn4mPT3DKBALbm%2FxkLvtRQk4vMFJN2MFBPSJOhRnkaRs%2BCsgzqgcQYVhwehpZSjo5OPa6aXwv0wvALra8OZFuUZdAvQlpRoLz1l1JFydeJKndVjzxH5veDNNOwGzrnUMAGhuD%2FaPPQAxSSq06IE9IVSwcznb2MxRwNn%2BebXZ3qCUnLau%2FYlcsQ5xxVsRJGYBihErcXqU7JQrQt7vjSLijF1P504Y7XTQxgaItkNONgaP6HzC%2BJha%2BtoMDwFrY89WGaoaDodWZjyOZ5Orqt8eFKePDqT6hzmgSCMO7DhMwGOpkBg9viU3tE8AJHCrOdtNCVxwhIwCg6crmTwGpsV0jm3IztUSlx0RbR4Wn0a4upJ%2BlbNVOavimQFyPg4lLuIq%2FFOKfgTyqYasMPQYtenSTXVN9XRMhrJ8fxc4iPxFqQ9gXPjbulwTmMrM%2BCDcvISYpDnHABFZoasX6erdJUSD7fgXnmo34pMV5yHBlrVZbGiex2Sy0c%2F639mXG7&X-Amz-Signature=3fbacdcf032e119ad7a5a466d0a109724332439257f81a413125cf527f035e53&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Risk_Assessment_Questionnaire.pdf%22&x-id=GetObject

Whereas, COUNTY is willing to provide CONTRACTOR and its agents with access to PHI such that

CONTRACTOR can perform under the Agreement, under the terms of this Exhibit;

Whereas, the purpose of this Exhibit is to satisfy certain standards and requirements of HIPAA and the

HIPAA Regulations, including, but not limited to, Title 45, Section 164.504(e) of the Code of Federal

Regulations (CFR), as the same may be amended from time to time.

NOW, THEREFORE, in consideration of the mutual promises made herein, the parties agree as follows:

A. HIPAA REQUIREMENTS

1. Definitions

a. "Protected Health Information" or "PHI" means any information, whether oral or recorded in any form or medium, including electronic (EPHI) as that term is defined in the Security Rule: 1) that relates to the past, present, or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and 2) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under HIPAA and the HIPAA Regulations, including, but not limited to, 45

CFR Section 164.501;

b. "Individual" shall have the same meaning as the term "individual” in 45 CFR Section

164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g);

c. "Privacy Rule" shall mean the “Standards for Privacy of Individually Identifiable Health

Information”, 45 CFR Part 160 and Part 164, subparts A and E, as amended from time to time.

d. "Security Rule" shall mean the “Security Standards”, 45 CFR Parts 160, 162, and 164.

2. Permitted Uses and Disclosures: CONTRACTOR may use and/or disclose PHI received by it pursuant to the Agreement and this Exhibit solely for the purpose of performing its obligations under the Agreement and this Exhibit or as otherwise required by law.

CONTRACTOR may disclose PHI to, and permit the use of PHI by, its employees, contractors, agents, or other representatives only to the extent directly related to and necessary for the performance of the Agreement and this Exhibit. CONTRACTOR shall not use or disclose PHI in any manner that would constitute a violation of HIPAA and the HIPAA regulations if so used by COUNTY.

3. Use and Disclosure for Contractor's Purposes and Data Aggregation: CONTRACTOR may, if necessary, use and disclose PHI for the proper management and administration of

CONTRACTOR's business or to carry out CONTRACTOR's legal responsibilities. CONTRACTOR may also use PHI to provide data aggregation services to COUNTY as permitted by 45 CFR

Section 164.504(e)(2)(i)(B).

4. De-Identification: Notwithstanding anything herein to the contrary, CONTRACTOR may store, analyze, access and use components of PHI that have been "de-identified" and that do not contain individually identifiable health information, provided that any such use is consistent with applicable laws and regulations.

5. Appropriate Safeguards: Prior to receipt of PHI in connection with the Agreement and

Exhibit, CONTRACTOR shall implement and maintain appropriate security safeguards to ensure that PHI is not used or disclosed by CONTRACTOR in violation of this Exhibit or applicable laws and regulations. Security measures maintained by CONTRACTOR shall include such appropriate administrative, technical and physical safeguards as are necessary to protect such PHI. Such safeguards shall be designed to protect the confidentiality and integrity of such PHI obtained, accessed or created from or on behalf of COUNTY. Upon request by COUNTY, CONTRACTOR shall provide a written description of such safeguards.

CONTRACTOR shall ensure that any sub-contract it maintains in order to meet the terms of this AGREEMENT includes the same requirements for appropriate safeguards as found in this AGREEMENT.

6. Reporting Unauthorized Uses and Disclosures: As required by 45 CFR Section 164.308(a)(2), the designated HIPAA Security Officer of CONTRACTOR shall notify COUNTY in writing within five (5) working days of its discovery of any use or disclosure of PHI not permitted by the

Agreement or this Exhibit of which CONTRACTOR or its officers, employees or agents become aware. Such notice shall include the name of each individual, with address or other identifiers where known, whose unsecured protected health information (PHI) has been, or is reasonably believed by the CONTRACTOR to have been, accessed, acquired, or disclosed during such unauthorized use or disclosure.

a. Any unauthorized use or disclosure shall be treated as discovered by the CONTRACTOR on the first day on which such access, acquisition or disclosure is known to the

CONTRACTOR, including any person, other than the individual committing the unauthorized use or disclosure, that is an employee, officer or other agent of the

CONTRACTOR, or who should reasonably have known such unauthorized activities had occurred.

b. CONTRACTOR shall promptly identify, respond to and report to COUNTY any suspected or known "security incident" of which it becomes aware. Such term is defined in the

HIPAA Security Rule, 45 CFR Section 164.304: “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.” CONTRACTOR’s incident report shall identify the date of the security incident, the scope of the security incident, the

CONTRACTOR's response to the security incident and the identification of the party responsible for causing the security incident, if known.

c. CONTRACTOR agrees that any sub-contractor of the CONTRACTOR that provides services to the CONTRACTOR directly related to this AGREEMENT has the same responsibilities regarding reporting unauthorized uses or disclosures as the

CONTRACTOR. CONTRACTOR further agrees that it shall ensure that these responsibilities are defined in any sub-contract it enters into in order to service this

AGREEMENT.

7. Mitigating the Effect of Unauthorized Uses and Disclosures: CONTRACTOR shall take prompt corrective action to mitigate to the greatest extent possible, any harmful effects arising from any improper use and/or disclosure of PHI and shall take such other action pertaining to such unauthorized use or disclosure as may be required by applicable federal and state laws and regulations.

a. Mitigation shall include CONTRACTOR notification to each individual whose unsecured protected health information (PHI or EPHI) has been, or is reasonably believed by the

CONTRACTOR to have been, accessed, acquired, or disclosed during such unauthorized use or disclosure. The standard for such notification shall comply with all notification requirements as specified in 45 CFR Subpart D.

b. Upon completion of such notification, the designated HIPAA Security Officer of

CONTRACTOR shall provide the COUNTY Compliance Officer a report including the following: method(s) of communication used, as specified in 45 CFR Subpart D; date such notification was made; number of individuals notified; and a copy of the content of the notification.

c. CONTRACTOR agrees that any sub-contractor of the CONTRACTOR that provides services to the CONTRACTOR directly related to this AGREEMENT has the same responsibilities regarding mitigating any unauthorized uses or disclosures as the

CONTRACTOR. CONTRACTOR further agrees that it shall ensure that these responsibilities are defined in any sub-contract it enters into in order to service this

AGREEMENT.

8. Individual Rights: CONTRACTOR shall comply with the following individual rights requirements as applicable to PHI obtained, used or maintained by CONTRACTOR:

a. Right of Access. CONTRACTOR shall provide access to PHI, at the request of COUNTY and in the time and manner designated by COUNTY, to COUNTY or, as directed, to an individual in order to meet the requirements under 45 CFR Section 164.524.

b. Right of Addendum. CONTRACTOR shall make any Addendum to PHI that COUNTY directs or agrees to pursuant to 45 CFR Section 164.526 at the request of COUNTY or an individual, and in the time and manner designated by COUNTY.

c. Documenting of Disclosures. CONTRACTOR shall document such disclosures of PHI as would be required for COUNTY to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

d. Right to Accounting of Disclosures. CONTRACTOR agrees to provide COUNTY or an individual, in the time and manner designated by COUNTY, such information collected in order to permit COUNTY to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

9. County Obligations:

a. COUNTY shall notify CONTRACTOR of any limitation in its notice of privacy practices in accordance with 45 CFR Section 164.520 to the extent that such limitation may affect

CONTRACTOR's use or disclosure of PHI.

b. COUNTY shall notify CONTRACTOR of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect

CONTRACTOR's use or disclosure of PHI.

c. COUNTY shall notify CONTRACTOR of any restriction to the use or disclosure of PHI that

COUNTY has agreed to in accordance with 45 CFR Section 164.522, to the extent that such restriction may affect CONTRACTOR's use or disclosure of PHI.

10. Contractor's Agents: CONTRACTOR shall require that any agent, subcontractor or other representative that is authorized to receive, use or have access to PHI obtained or created under the Agreement or this Exhibit shall agree in writing to adhere to the same restrictions, conditions and requirements regarding the use and/or disclosure of PHI and safeguarding of

PHI that apply to CONTRACTOR under this Agreement and Exhibit. CONTRACTOR shall implement and maintain sanctions against any agent, subcontractor or other representative that violates such restrictions, conditions or requirements and shall mitigate the effects of any such violation. Such agreement shall identify COUNTY as a third-part beneficiary with rights of enforcement in the event of any violations by CONTRACTOR's agents, subcontractors or other representatives. Additionally, the agent, subcontractor or other representative shall be required to notify CONTRACTOR of any instances of which it is aware in which the confidentiality of PHI has been breached.

11. Regulatory Compliance: CONTRACTOR shall make its internal practices, books and records relating to the use and disclosure of PHI received from COUNTY, or created or received by

CONTRACTOR on behalf of COUNTY, available to any state or federal agency, including the

U.S. Department of Health and Human Services, for purposes of determining compliance with the HIPAA Regulations.

12. Inspection of Records: Within ten (10) calendar days of a written request, CONTRACTOR shall make available to COUNTY for inspection during normal business hours at

CONTRACTOR's place of business all records, books, agreements, data, systems, policies and procedures relating to the use and/or disclosure of PHI received from, or created or received by CONTRACTOR on behalf of COUNTY, for purposes of enabling COUNTY to determine CONTRACTOR's compliance with the terms of this Exhibit. In the event that protected health information (PHI) has been, or is reasonably believed by the CONTRACTOR to have been, accessed, acquired, or disclosed, pursuant to (G) of this Exhibit, this advance notice by COUNTY may be waived.

13. Audit, Inspection and Enforcement By County: With reasonable notice, COUNTY and its authorized agents or contractors may audit and/or examine CONTRACTOR's facilities, systems, policies and procedures, data and records as may be necessary to determine compliance with the terms of this Exhibit. CONTRACTOR shall promptly correct any violation of this Exhibit found by COUNTY and shall certify in writing that the correction has been made. COUNTY's failure to detect any unsatisfactory practice does not constitute acceptance of the practice or a waiver of COUNTY's enforcement rights under this

Agreement and Exhibit.

14. Compliance With Law: CONTRACTOR shall comply with all applicable federal and state laws and regulations, including, if applicable under the terms and requirements of the Agreement and this Exhibit, the HIPAA Standards for Electronic Transactions, 45 CFR Parts 160 and 162.

15. Interpretation: Any ambiguity in this Exhibit shall be resolved in favor of a meaning that permits COUNTY to comply with HIPAA and its implementing regulations.

16. Amendment: The parties agree to amend this Exhibit from time to time as necessary for

COUNTY to comply with the requirements of HIPAA and its implementation.

17. Term and Termination:

a. The terms of this Exhibit shall remain in effect for the duration of all services provided by CONTRACTOR and for so long as CONTRACTOR shall remain in possession of any PHI received from, or created or received by CONTRACTOR on behalf of COUNTY, unless

COUNTY has agreed in accordance with this section that it is not feasible to return or destroy all PHI.

b. Upon termination of the Agreement and this Exhibit, CONTRACTOR shall recover any

PHI relating to the Agreement and this Exhibit in the possession of its subcontractors, agents or representatives. CONTRACTOR shall return to COUNTY, or destroy with consent of COUNTY, all such PHI plus all other PHI relating to the Agreement and this

Exhibit in its possession and shall retain no copies. If CONTRACTOR believes that it is not feasible to return or destroy the PHI as described above, CONTRACTOR shall so notify

COUNTY in writing. The notification shall include: i) a statement that CONTRACTOR has determined that it is not feasible to return or destroy the PHI in its possession, and ii) the specific reasons for such determination. If COUNTY agrees in its sole discretion that

CONTRACTOR cannot feasibly return or destroy the PHI, CONTRACTOR shall ensure that any and all protections, requirements and restrictions contained in this Agreement and

Exhibit shall be extended to any PHI retained after the termination of the Agreement and the Exhibit, and that any further uses and/or disclosures will be limited to the purposes that make the return or destruction of the PHI infeasible.

18. Insurance: In addition to any insurance requirements in the Agreement, CONTRACTOR shall maintain insurance, in such amounts as the COUNTY Risk Manager may deem necessary, to cover loss of PHI data and claims based upon alleged violations of privacy rights through improper use or disclosure of PHI. All such policies shall meet or exceed any minimum insurance requirements of the Agreement.

☐ Please confirm

*Response required

7.16. Procurement Opportunities Program - Local and Micro Business Preference

PURPOSE

The purpose of the Procurement Opportunities Program is to promote and enhance the utilization of local and small business enterprises in the County’s procurement and contracting processes. Small businesses contribute to the overall economic health of the community. Therefore, government has a compelling interest to provide economic opportunity to small businesses. The economic health of the community is dependent upon an active and thriving business community, including both large and small businesses. For this reason, the program is designed to provide procedural assistance and contracting information to any firm wishing to do business with the County.