RFI_Wearable_Monitoring_Solutions.docx

REQUEST FOR INFORMATION (RFI)

TO: All Interested Parties

FROM: California Correctional Health Care Services (CCHCS)

SUBJECT: Request for Information (RFI) SD25-00039, Wearable Monitoring Solutions

1. Purpose

California Correctional Healthcare Services (CCHCS) is releasing this Request for Information (RFI) to solicit information from the vendor community about solutions currently available in the marketplace based on the objectives and requirements described herein.

The purpose of this RFI is to obtain input from the vendor community who can provide wearable monitoring solutions in a Correctional Healthcare environment. The RFI responses will also be utilized to assist CCHCS in identifying and understanding various solutions offered in the marketplace for wearable monitoring systems.

The collective information provided by the vendor community will be used to develop alternatives for consideration and may be used to estimate costs related to system acquisition for a proposed solution. CCHCS understands that the data provided in this RFI is not sufficient to enable detailed analysis and costing by vendors. Please provide your best advice based on your experience with other organizations and initiatives of this kind. Responses to this RFI should adhere to the questions listed in the Attachments.

Please read this RFI document thoroughly and adhere to the response submission guidelines.

2. Project Background

California Correctional Health Care Services (CCHCS) is responsible for the delivery of comprehensive medical, dental, and mental health care services to individuals incarcerated within the California Department of Corrections and Rehabilitation (CDCR). These services are provided across 34 institutions statewide in secure and operationally complex environments that require a high level of coordination between custody and healthcare staff.

To support safety, operational efficiency, and quality of care, CCHCS is exploring the potential use of wearable monitoring solutions within correctional healthcare settings. These technologies may provide capabilities such as real-time location tracking, vital signs monitoring, and automated alerting for emergency events (e.g., duress, man-down, or abnormal physiological conditions). The intent is to enhance situational awareness, improve response times, and support data-driven decision-making for both custody and clinical operations.

Wearable solutions deployed in a correctional environment must operate reliably under conditions that may include limited connectivity, physical constraints, and heightened security requirements. Additionally, any proposed solution must align with applicable federal and state regulations, including but not limited to the Health Insurance Portability and Accountability Act (HIPAA) and Criminal Justice Information Services (CJIS) requirements, and must support secure integration with existing CCHCS and CDCR enterprise systems.

Through this Request for Information (RFI), CCHCS seeks to obtain information from the vendor community regarding available wearable monitoring technologies, including system capabilities, deployment models, interoperability, scalability, and estimated costs. The information gathered will be used for planning purposes, including evaluation of potential pilot implementations and development of a future solicitation, if warranted.

3. Location

TBD

4. Acquisition Plan Overview

This RFI is the first step in creating a competitive bid to provide Wearable Monitoring solution to CCHCS. Based on information received in response to this RFI, the scope of work will be developed, and a solicitation may be released.

5. Key Action Dates

Listed below are the RFI Key Action Dates and Times by which actions should be taken or completed.

6. Response Instructions

1) Responses to this RFI must be submitted via e-mail, in a Portable Document Format (PDF), to the State’s contact listed in Section 8. Contact Information and must include the following information in the e-mail subject line: RFI #SD25-00039, Wearable Monitoring Solutions.

2) Contact information including the name, title, address, phone number, and e-mail address of the primary contact person for the RFI.

3) Responses must be submitted by the date and time stated in the Key Action Dates.

4) Vendors must submit a signed cover letter with their response to the RFI.

5) Vendors should respond to all applicable information in the Attachments.

7. Vendor Questions

Vendors must submit questions regarding the RFI, via e-mail, by the specified date and time stated in the Key Action Dates.

What to Include in an Inquiry

1) Include in the subject line of the e-mail: RFI #SD25-00039, Project Name and “Question(s)”

2) Vendor name and contact, telephone number, e-mail address

3) A description of the subject or issue in question, or discrepancy found.

4) RFI section, page number, or other information useful in identifying the specific problem or issue stated in the in question.

8. Contact Information

Respondents must email their written response to Jonathan.Raitt@cdcr.ca.gov. The email subject must begin with “Response to SD25-00039. If attachments are too large for a single email then you may split the response into multiple emails.

Jonathan.Raitt@cdcr.ca.gov

9. Disclaimer

This RFI is issued for information and planning purposes only and does not constitute a solicitation. A response to this RFI is not an offer and cannot be accepted by the State to form a binding contract. The State is not responsible for any expenses associated with responding to this RFI.

Vendors are advised that all documents submitted in response to this RFI will become the property of the State of California and will be regarded as public records under the California Public Records Act (Government Code Section 6250 et seq.) and subject to review by the public.

Please read this RFI document thoroughly and adhere to the response submission guidelines.

Note: The intent of this RFI is solely for information and planning purposes and does not constitute a solicitation. Therefore, do not include any proprietary information or any specific solution in your response to this RFI.

10. Addenda

The State may modify the solicitation at any time prior to submission due dates by issuing an addendum. Addenda will be numbered consecutively.

Attachment – A Vendor Profile

1. Identify the Company Name, address, city, state, and zip code, telephone, and fax numbers.

2. Identify the name, title, address, phone and fax numbers, and email address of the primary contact person for this RFI.

3. Provide a brief overview of your company including number of years in business, number of employees, nature of business, and description of clients.

4. Identify any parent corporation and/or subsidiaries, if applicable.

5. Give a brief description of your product, system and any included services: Include the date of the first installed site or first service provided.

6. Indicate the total number of installations in the last Five (5) years by the year of installation and the total number of users.

7. Provide a list of three references of clients, external to your organization, who have had their system installed within the past twenty‐four (24) months. (Include name, contact, address, telephone, systems installed and date of installation).

8. Is your company Health Insurance Portability and Accountability Act (HIPAA) compliant?

Attachment – B System Proposal

Hardware, Durability & Usability:

1. What form factors do you offer (provide all examples if more than one), and

2. How do they support tamper resistance?

3. How does the wearable hold up under extreme environmental conditions, such as heat, moisture, or physical impact?

4. How long does the device operate on battery under different usage modes, and what charging or hot‑swap options exist?

Geolocation, Tracking & Geofencing:

1. How does your system deliver real‑time indoor and outdoor location tracking?

A. What accuracy levels can you guarantee?

2. How do you maintain functional tr1.Acking in restricted‑signal or high‑interference environments, such as correctional facilities?

3. How does your system create, manage, and update geofences, including dynamic changes based on operational needs?

4. How are geofence breaches detected and escalated, and what is the typical end‑to‑end alert latency?

5. How does your solution record, store, and provide access to historical movement trails for investigative or operational purposes?

Vitals Monitoring:

1. Which vitals does your wearable continuously or intermittently monitor, and what is the clinical or technical validation behind each measurement?

2. How do you ensure vitals accuracy under motion, stress, heat, or other real‑world correctional conditions?

3. How do you generate alerts when vitals exceed configured thresholds, and how can those thresholds be customized per user or role?

4. How does your system correlate vitals with events, risk factors, or environmental conditions to support early intervention?

5. How are vitals transmitted, stored, and integrated into downstream systems while maintaining HIPAA‑compliant handling?

Operational Safety & Alerting:

1. How does your wearable detect man‑down, falls, or duress events, and what mechanisms ensure rapid alerting?

2. How does your platform support multi‑modal notifications (haptic, audible, visual) tailored to high‑noise correctional environments?

3. How do you support configurable escalation workflows based on role, shift, facility, or event severity?

4. How does your system support safety drills or simulations, and how are response times measured and reported?

Facility‑Wide & Enterprise Capabilities:

1. How does your system support multi‑facility hierarchy, including institution‑level, yard‑level, or housing‑unit‑level segmentation?

2. How does your dashboard present location, vitals, alerts, and trends in a way that supports operational decision‑making?

Attachment – C System Implementation and Technical Support

Deployment, Support & Program Management:

1. What is your recommended pilot approach, including duration, scale, staffing needs, and success metrics?

2. How do you support device provisioning, inventory, and rapid replacement workflows at enterprise scale?

3. How do you provide training for custody, medical, and administrative users, and what materials or simulations accompany onboarding?

4. How do you provide ongoing support, firmware updates, and troubleshooting, including SLAs for critical failures?

5. How do you document and communicate risks, dependencies, or required facility modifications as part of deployment?

Integration & Interoperability:

1. How does your solution integrate with APIs (REST, FHIR/HL7) for exchanging vitals or event data with CDCR/CCHCS systems?

2. How do you support integration with command‑center dashboards, SIEM tools, or incident‑management platforms?

3. How does your platform enable enterprise‑scale device management, such as remote updates, policy enforcement, and device health monitoring?

Attachment – D Technical Requirements

Security & Compliance:

1. How does your solution ensure end‑to‑end encryption for data in transit and at rest, and what cryptographic standards do you use?

2. How do you implement device security, including secure boot, signed firmware, tamper detection, and protection against unauthorized access?

3. How does your platform support role‑based access controls that align with CDCR/CCHCS security separation (custody, medical, administrative)?

4. How do you generate, maintain, and audit security logs, and how do these logs align with CDCR/CCHCS auditing expectations (e.g., similar to SecOps requirements referenced in CCHCS solicitations)?

5. How does your solution comply with CJIS and HIPAA requirements, and what evidence or certifications do you provide to demonstrate compliance?

6. How do you ensure that only authorized individuals can access system features, data, or sessions, consistent with CDCR expectations for mandatory security controls (similar to prior mandatory access‑control requirements added in RFI/RFO processes)?

Analytics, AI & Automation:

1. How does your system use AI or machine learning to improve location accuracy, predict safety risks, or identify anomalies?

2. How does your platform shorten the observation → intervention → outcome cycle, and what automation features support that?

3. How do you provide predictive alerts, such as fatigue, heat stress, or unusual behavior patterns?

4. How does your system reduce false positives and alert fatigue, and does it provide confidence scoring or signal‑quality indicators?

1. Estimated cost for initial and subsequent (home) sessions (if applicable/available)

2. Estimated System Cost

3. Estimated Cost of Ongoing Support

NOTE: This is not a quote. All requested estimates are for CCHCS to assess the feasibility of the system. No estimate will oblige CCHCS to purchase or enter into a contract.

I. Exhibit A INFORMATION TECHNOLOGY GENERAL PROVISIONS NON-CLOUD, DGS PD 403- ITGP (Non-Cloud) https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf revised 2/20/2025 is hereby incorporated by reference.

II. Exhibit B

INFORMATION TECHNOLOGY GENERAL PROVISIONS CLOUD – COMPUTING SERVICES

https://www.dgs.ca.gov/-/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf revised 2/20/2025 is hereby incorporated by reference.

III. Exhibit C

SOFTWARE AS A SERVICE GENERAL PROVISIONS

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model-Language/CLOUDCOMPUTING_SaaSGPs-ADA.pdf?la=en&hash=718FE3BFA75ABB6357016BB81BDACBC49D6BF376

IV. Exhibit D

SOFTWARE AS A SERVICE SPECIAL PROVIONS

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/CLOUDCOMPUTINGSERVICESSPECIALPROVISIONS_18_0301.docx?la=en&hash=D15B144C86A54D492E4E19AE810F7F35EA8D171F

V. Exhibit E - HIPAA BUSINESS ASSOCIATE AGREEMENT HIPAA Business Associate Agreement rev. 10/03/2023 is hereby incorporated by reference

VI. Exhibit F - CCHCS IT Special Provisions

1. Subcontractor/Personnel Information

Contractor is required to identify all subcontractors who will perform labor or render services in the performance of the Agreement. Additionally, the Contractor shall notify the CCHCS Contract Manager, or designee, within ten working days, of any changes to the subcontractor and/or personnel information.

2. Employment of Ex-Offenders (DOM 31060.5.5)

A. Contractor cannot and will not, either directly or via a subcontracted consultant and/or firm, employ in connection with this Agreement:

(1) Ex-Offenders on active parole or probation;

(2) Ex-Offenders at any time if they are required to register as a sex offender pursuant to Penal Code Section 290 or if such ex-offender has an offense history involving a “violent felony” as defined in subparagraph (c) of Penal Code Section 667.5; or

(3) Any ex-felon in a position which provides direct supervision of parolees.

B. Ex-Offenders who can provide written evidence of having satisfactorily completed parole or probation may be considered for employment by the Contractor subject to the following limitations:

(1) Contractor shall obtain the prior written approval to employ any such ex-offender from the Authorized Administrator; and

(2) Any ex-offender whose assigned duties are to involve administrative or policy decision-making; accounting, procurement, cashiering, auditing, or any other business-related administrative function shall be fully bonded to cover any potential loss to the State of California.

3. Licenses and Permits (revised 03/04)

The Contractor shall be an individual or firm licensed to do business in California and shall obtain, at Contractor’s expense, all licenses and permits required by law for accomplishing any work required in connection with this Agreement.

In the event any licenses and/or permits expire at any time during the term of this Agreement, Contractor agrees to provide the CCHCS with a copy of the renewed licenses and/or permits within 30 days following the expiration date. In the event the Contractor fails to keep in effect at all times all required licenses and/or permits, the State may, in addition to any other remedies it may have, terminate this Agreement upon occurrence of such event.

4. Conflict of Interest (revised 1/28/02)

The Contractor and their employees shall abide by the provisions of Government Code (GC) Sections 1090, 81000 et seq., 82000 et seq., 87100 et seq., and 87300 et seq., Public Contract Code (PCC) Sections 10335 et seq. and 10410 et seq., California Code of Regulations (CCR), Title 2, Section 18700 et seq. and Title 15, Section 3409, and the Department Operations Manual (DOM) Section 31100 et seq. regarding conflicts of interest.

Consultant Contractors shall file a Statement of Economic Interests, Fair Political Practices Commission (FPPC) Form 700 prior to commencing services under the Agreement, annually during the life of the Agreement, and within 30 days after the expiration of the Agreement. Other service Contractors and/or certain of their employees may be required to file a Form 700 if so requested by the CCHCS or whenever it appears that a conflict of interest may be at issue. Generally, service Contractors (other than Consultant Contractor required to file as above) and their employees shall be required to file an FPPC Form 700 if one of the following exists:

(1) The Agreement service has been identified by the CDCR as one where there is a greater likelihood that a conflict of interest may occur;

(2) The Contractor and/or Contractor’s employee(s), pursuant to the Agreement, makes or influences a governmental decision; or

(3) The Contractor and/or Contractor’s employee(s) serves in a staff capacity with the CDCR and in that capacity participates in making a governmental decision or performs the same or substantially all the same duties for the CDCR that would otherwise be performed by an individual holding a position specified in the CDCR’s Conflict of Interest Code.

(4) No officer or employee shall engage in any employment, activity or enterprise from which the officer or employee receives compensation or has a financial interest and which is sponsored or funded by any State agency, unless the employment, activity or enterprise is required as a condition of regular State employment.

(5) No officer or employee shall contract on his or her own behalf as an independent Contractor with any State agency to provide goods or services.

(6) In addition to the above, CDCR officials and employees shall also avoid actions resulting in or creating an appearance of:

0. Using an official position for private gain;

0. Giving preferential treatment to any particular person;

0. Losing independence or impartiality;

0. Making a decision outside of official channels; and

0. Affecting adversely the confidence of the public or local officials in the integrity of the program.

(7) Officers and employees of the Department must not solicit, accept or receive, directly or indirectly, any fee, commission, gratuity or gift from any person or business organization doing or seeking to do business with the State.

(8) For the two year (2-year) period from the date he or she left State employment, no former State officer or employee may enter into an Agreement in which he or she engaged in any of the negotiations, transactions, planning, arrangements or any part of the decision-making process relevant to the Agreement while employed in any capacity by any State agency.

(9) For the twelve-month (12-month) period from the date he or she left State employment, no former State officer or employee may enter into an Agreement with any State agency if he or she was employed by that State agency in a policy-making position in the same general subject area as the proposed Agreement within the 12-month period prior to his or her leaving State service.

(10) In addition to the above, the Contractor shall avoid any conflict of interest whatsoever with respect to any financial dealings, employment services, or opportunities offered to incarcerated persons or parolees. The Contractor shall not itself employ or offer to employ incarcerated persons or parolees either directly or indirectly through an affiliated company, person or business unless specifically authorized in writing by the CDCR.

(11) In addition, the Contractor shall not (either directly, or indirectly through an affiliated company, person or business) engage in financial dealings with incarcerated persons or parolees, except to the extent that such financial dealings create no actual or potential conflict of interest, are available on the same terms to the general public, and have been approved in advance in writing by the CDCR.

(12) For the purposes of this paragraph, “affiliated company, person or business” means any company, business, corporation, nonprofit corporation, partnership, limited partnership, sole proprietorship, or other person or business entity of any kind which has any ownership or control interest whatsoever in the Contractor, or which is wholly or partially owned (more than 5% ownership) or controlled (any percentage) by the Contractor or by the Contractor’s owners, officers, principals, directors and/or shareholders, either directly or indirectly. “Affiliated companies, persons or businesses” include, but are not limited to, subsidiary, parent, or sister companies or corporations, and any company, corporation, nonprofit corporation, partnership, limited partnership, sole proprietorship, or other person or business entity of any kind that is wholly or partially owned or controlled, either directly or indirectly, by the Contractor or by the Contractor’s owners, officers, principals, directors and/or shareholders.

(13) The Contractor shall have a continuing duty to disclose to the State, in writing, all interests and activities that create an actual or potential conflict of interest in performance of the Agreement.

(14) The Contractor shall have a continuing duty to keep the State timely and fully apprised in the writing of any material changes in the Contractor’s business structure and/or status. This includes any changes in business form, such as a change from sole proprietorship or partnership into a corporation or vice-versa; any changes in company ownership; any dissolution of the business; any change of the name of the business; any filing in bankruptcy; any revocation of corporate status by the Secretary of State; and any other material changes in the Contractor’s business status or structure that could affect the performance of the Contractor’s duties under the Agreement.

(15) If the Contractor violates any provision of the above paragraphs, such action by the Contractor shall render this Agreement void.

(16) Members of boards and commissions are exempt from this section if they do not receive payment other than payment for each meeting of the board or commission, payment for preparatory time and payment for per diem.

5. Disclosure

Neither the State nor any State employee will be liable to the Contractor or its personnel for injuries inflicted by incarcerated persons or parolees of the State. The State agrees to disclose to the Contractor any statement(s) known to State staff made by any incarcerated person or parolee which indicates violence may result in any specific situation, and the same responsibility will be shared by the Contractor in disclosing such statement(s) to the State.

6. Security Clearance/Fingerprinting

The State reserves the right to conduct fingerprinting and/or security clearance through the California Department of Justice, Bureau of Criminal Identification and Information (BCII), prior to award and at any time during the term of the Agreement, in order to permit Contractor and/or Contractor’s employees’ access to State premises. The State further reserves the right to terminate the Agreement should a threat to security be determined.

7. Notification of Personnel Changes

Contractor must notify the State, in writing, of any changes of those personnel allowed access to State premises for the purpose of providing services under this Agreement. In addition, Contractor must recover and return any State-issued identification card provided to Contractor’s employee(s) upon their departure or termination.

8. Non-Eligible Alien Certification (Sole Proprietor Contracts only) Req’d by SCM, added 4/04

By signing this Agreement Contractor certifies, under penalty of perjury, that Contractor, if a sole proprietor, is not a nonqualified alien as that term is defined by the United States Code (U.S.C.) Title 8, Chapter 14, Section 1621 et seq.

The following provisions apply to services provided on departmental and/or institution grounds:

9. Bloodborne Pathogens

Provider shall adhere to California Division of Occupational Safety and Health (CAL-OSHA) regulations and guidelines pertaining to bloodborne pathogens.

10. Tuberculosis (TB) Testing (revised 01/05)

Contractors and their employees shall be required to furnish to CDCR, at no cost to CDCR, a form CDCR 7354, “TB Infectious Free Staff Certification,” prior to assuming their contracted duties and annually thereafter, showing that the Contractor and their employees have been examined and found free of TB in an infectious stage. The form CDCR 7354 will be provided by CDCR upon Contractor’s request.

11. Coronavirus (COVID-19) Screening Requirement

The Contractor agrees to comply with the following. Failure to meet these requirements may result in the termination of the contractor or contract.

A. Screening: The Contractor shall not dispatch any employees who are exhibiting COVID-19 symptoms to CDCR/CCHCS worksites/locations. Each Contractor employee who visits institutional grounds may be required to undergo a health questionnaire to screen for COVID-19 before being granted access into the institution.

B. Testing: In addition to the screening, Contractor employees working full-time at any institution or facility grounds may be subject to COVID-19 testing in the same manner as institution staff.

C. Facial Coverings: Contractors are advised that mask requirements at each institution or facility may vary, (such as N95 masks being required and provided at certain locations) and as such, the requirements for that institution must be followed. Additionally, institutions or facilities may update their requirements in which case the Contractor’s employees must adhere to such updated requirements.

D. Vaccinations: The Contractor agrees to comply with current State Public Health Officer Orders issued by the California Department of Public Health (CDPH) as it pertains to vaccination requirements for contractor staff in certain locations/settings. Such Orders, including any CCHCS requirements, will be enforced by the Contract Manager.

(from CDCR 181 Rev 5/98)

12. Primary Laws, Rules, & Regulations Regarding Association with Incarcerated persons

Individuals who are not CDCR employees, but who are working in and around inmates who are incarcerated within California’s institutions/facilities or camps, are to be apprised of the laws, rules and regulations governing conduct in associating with prison incarcerated persons. The following is a summation of pertinent information when non-departmental employees come in contact with prison incarcerated persons.

(The following paragraph is not in the CDCR 181)

By signing this Contract, the Contractor agrees that if the provisions of the Contract require the Contractor to enter an institution/facility or camp, the Contractor and any employee(s) and/or subcontractor(s) shall be made aware of and shall abide by the following laws, rules and regulations governing conduct in associating with prison incarcerated persons:

0. Persons who are not employed by CDCR, but are engaged in work at any institution/ facility or camp must observe and abide by all laws, rules and regulations governing the conduct of their behavior in associating with prison incarcerated persons. Failure to comply with these guidelines may lead to expulsion from CDCR institutions/facilities or camps. SOURCE: California Penal Code (PC) Sections 5054 and 5058; CCR, Title 15, Sections 3283, 3285, 3289, 3292 and 3415

0. CDCR does not recognize hostages for bargaining purposes. CDCR has a "NO HOSTAGE" policy and all prison incarcerated persons, visitors, non-employees & employees shall be made aware of this. SOURCE:PC Sections 5054 and 5058; CCR, Title 15, Section 3304

0. All persons entering onto institution/facility or camp grounds consent to a search of their person, property or vehicle at any time. Refusal by individuals to submit to a search of their person, property or vehicle may be cause for denial of access to the premises or restrictions to visiting or facility access. SOURCE: PC Sections 2601, 5054 and 5058; CCR, Title 15, Sections 3173, 3267, 3288, 3289, and 3292

0. Persons normally permitted to enter an institution/facility or camp may be barred, for cause, by the CDCR Secretary, Director of Division of Adult Institutions (DAI), Warden, Regional Parole Administrator and/or their designees. SOURCE: PC Sections, 5054 and 5058; CCR, Title 15, Section 3176(a).

0. It is illegal for an individual who has been previously convicted of a felony offense to enter into CDCR institutions/facilities or camps without the prior approval of the Warden. It is also illegal for an individual to enter onto these premises for unauthorized purposes or to refuse to leave said premises when requested to do so. Failure to comply with this provision could lead to prosecution. SOURCE: PC Sections 602, 4570.5 and 4571; CCR, Title 15, Section 3289

0. Encouraging and/or assisting prison incarcerated persons to escape is a crime. It is illegal to bring firearms, deadly weapons, explosives, tear gas, drugs or drug paraphernalia on CDCR institutions/facilities or camp premises. It is illegal to give prison incarcerated persons firearms, explosives, alcoholic beverages, wireless communication devices or components thereof, tobacco products, narcotics, or any drug or drug paraphernalia, including cocaine or marijuana. SOURCE: PC Sections 2772, 2790, 4533, 4535, 4550, 4573, 4573.5, 4573.6, 4574

0. It is illegal to give or take letters from prison incarcerated persons without the authorization of the Warden. It is also illegal to give or receive any type of gift and/or gratuities from prison incarcerated persons. SOURCE: PC Sections 2540, 2541 and 4570; CCR, Title 15, Sections 3010, 3399, 3401, 3424 and 3425

0. In an emergency situation the visiting program and other incarcerated person program activities may be suspended by the Warden or designee. SOURCE: PC Sections 2601; CCR, Title 15, Section 3383

0. For security reasons, volunteers, media, contractors, dignitaries and guests must not wear clothing that in any way resembles state issued prison incarcerated person clothing (blue denim shirts, blue denim pants). SOURCE: CCR, Title 15, Sections 317(b)

0. Interviews with SPECIFIC INCARCERATED PERSONS are not permitted. Conspiring with an incarcerated person to circumvent policy and/or regulations constitutes a rule violation that may result in appropriate legal action. SOURCE: CCR, Title 15, Section 3261.5

13. Clothing Restrictions

While on institution grounds, Contractor and all its agents, employees, and/or representatives shall be professionally and appropriately dressed in clothing distinct from that worn by incarcerated persons at the institution. Specifically, blue denim pants and blue chambray shirts, orange/red/yellow/ white/chartreuse jumpsuits and/or yellow rainwear shall not be worn onto institution grounds, as this is incarcerated person attire. The Contractor should contact the institution regarding clothing restrictions prior to requiring access to the institution to assure the Contractor and their employees are in compliance.

14. Tobacco-Free Environment (Authority: AB 384, effective 07/01/05)

Pursuant to Penal Code Section 5030.1, the use of tobacco products by any person on the grounds of any institution or facility under the jurisdiction of the CDCR is prohibited.

15. Security Regulations

0. Unless otherwise directed by the entrance gate officer and/or Contract Manager, the Contractor, Contractor’s employees and subcontractors shall enter the institution through the main entrance gate and park private and nonessential vehicles in the designated visitor’s parking lot. Contractor, Contractor’s employees and subcontractors shall remove the keys from the ignition when outside the vehicle and all unattended vehicles shall be locked and secured while on institution grounds.

0. Any State- and Contractor-owned equipment used by the Contractor for the provision of contract services, shall be rendered temporarily inoperative by the Contractor when not in use, by locking or other means unless specified otherwise.

0. In order to maintain institution safety and security, periodic fire prevention inspections and site searches may become necessary and Contractor must furnish keys to institutional authorities to access all locked areas on the worksite. The State shall in no way be responsible for Contractor’s loss due to fire.

0. Due to security procedures, the Contractor, Contractor’s employees & subcontractors may be delayed at the institution vehicle/pedestrian gates and sally ports. Any loss of time checking in & out of the institution gates and sally ports shall be borne by the Contractor.

0. Contractor, Contractor’s employees and subcontractors shall observe all security rules and regulations and comply with all instructions given by institutional authorities.

0. Electronic and communicative devices such as pagers, cell phones and cameras/ microcameras are not permitted on institution grounds.

0. Contractor, Contractor’s employees and subcontractors shall not cause undue interference with the operations of the institution.

0. No picketing is allowed on State property.

16. Prison Rape Elimination Policy

CDCR is committed to providing a safe, humane, secure environment, free from sexual misconduct. This will be accomplished by maintaining a program to ensure education/ prevention, detection, response, investigation and tracking of sexual misconduct and to address successful community re-entry of the victim. CDCR shall maintain a zero tolerance for sexual misconduct in its institutions, community correctional facilities, conservation camps and for all offenders under its jurisdiction. All sexual misconduct is strictly prohibited. As a Contractor with CDCR, you and your employee(s) are expected to ensure compliance with this policy as described in Department Operations Manual, Chapter 5, Article 44.

17. Gate Clearance

Contractor and Contractor’s employee(s) and/or subcontractors(s) must be cleared prior to providing services. The Contractor will be required to complete a Request for Gate Clearance for all persons entering a facility a minimum of ten working days prior to commencement of service. The Request for Gate Clearance must include the person’s name, social security number, valid state driver’s license number or state identification card number and date of birth. Information shall be submitted to the Contract Liaison or his/her designee. CDCR uses the Request for Gate Clearance to run a California Law Enforcement Telecommunications System (CLETS) check. The check will include a California Department of Motor Vehicles check, Wants and Warrants check, and Criminal History check.

Gate clearance may be denied for the following reasons: Individual’s presence in the institution presents a serious threat to security, individual has been charged with a serious crime committed on institution property, inadequate information is available to establish positive identity of prospective individual, and/or individual has deliberately falsified his/her identity. All persons entering the facilities must have a valid state driver’s license or photo identification card on their person.

18. Business Associate Agreement

Contracts subject to CCHCS Business Associate Agreement require the awarded Contractor to meet provisions of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (HIPAA) and the regulations promulgated thereunder. The Business Associate Agreement, if applicable, is included in this Agreement as Exhibit E.

19. Electronic Data

CCHCS electronic data stored upon any Provider device must be returned to the CCHCS immediately and the Contractor must certify that CCHCS data is either removed from the Providers devices by degaussing or shredding per National Institute of Standards and Technology (NIST) Special Publication Series 800-88 and National Industrial Security Program (NISP) Operating Manual (DOD 5220.22-M) and Clearing and Sanitization Matrix (C&SM) based on NSA/CSS PolicManual 9-12, “Storage Device Declassification Manual”.

Revised 4/28/2025

VII. EXHIBIT F - INSURANCE REQUIREMENTS

CCHCS will not provide for nor compensate Contractor for any insurance premiums or costs for any type or amount of insurance.

1. Commercial General Liability – When Contractor submits a signed Contract to the State, Contractor shall furnish to the State a certificate of insurance, stating that there is commercial general liability insurance presently in effect for the Contractor of not less than $1,000,000.00 per occurrence for bodily injury and property damage liability combined.

The certificate of insurance will include provisions below in their entirety:

A. Contractor is responsible to notify the State within five (5) business days of any cancellation, non-renewal or material change that affects required insurance coverage.

B. That the State of California, its officers, agents, employees, and servants are included as additional insured, but only with respect to work performed for the State of California under the Contract.

C. The additional insured endorsement must accompany the certificate of insurance.

D. That the State will not be responsible for any premiums or assessment on the policy.

Contractor agrees that the bodily injury liability insurance herein provided for shall be in effect at all times during the term of this Contract. In the event said insurance coverage expires at any time or times during the term of this Contract, Contractor agrees to provide, within at least five (5) business days, a new certificate of insurance evidencing insurance coverage as provided for herein for not less than the remainder of the term of the Contract, or for a period of not less than one year. New certificates of insurance are subject to the approval of the Department of General Services, and Contractor agrees that no work or services shall be performed prior to the giving of such approval. In the event the Contractor fails to keep in effect at all times insurance coverage as herein provided, the State may, in addition to any other remedies it may have, terminate this Contract uponwhile utilizing a motor vehicle in the performance of this contract. Such insurance shall cover liability arising out of a motor vehicle including owned, hired, and non-owned motor vehicles. For contracted serv occurrence of such event.

2. Automobile Liability Insurance – The Contractor shall furnish to the State a certificate of insurance evidencing automobile liability insurance presently in effect for the Contractor for not less than $1,000,000.00 per accident ices involving transportation of hazardous materials, evidence of an MCS-90 endorsement is required.

3. Worker’s Compensation Insurance – The Contractor shall furnish to the State a certificate of insurance evidencing workers compensation insurance and employer’s liability presently in effect with limits not less than $1,000,000.00 by an insurance carrier licensed to write Workers’ Compensation Insurance in California. Such certificate shall include the name of the carrier, policy inception and expiration dates. If the Contractor is self-insured for workers compensation, a certificate must be presented evidencing Contractor is a qualified self-insurer in the State of California.

4. Special Requirement: Professional Liability (Errors and Omissions) Insurance – Contractor shall maintain Professional Liability insurance covering any damages caused by an error, omission or any negligent acts. Limits of not less than $1,000,000.00 shall be provided.

VIII. EXHIBIT G – INFORMATION SECURITY AGREEMENT (ISA)

1. Introduction and Purpose

A. This Information Security Agreement (ISA) outlines the Service Provider requirements for the collection, maintenance, and dissemination of any information that identifies or describes an individual in conjunction with the performance of services provided to CCHCS under any contract, purchase document, Memorandum of Understanding, or any other transaction involving information receipt or information exchange between CCHCS and the Service Provider.

B. This ISA does not substitute for any other addendum, attachment, exhibit or obligation with respect to protected health information and the applicability of and requirement to comply with the Health Information Portability and Accountability Act of 1996 (HIPAA) P.L. No. 104-191, 110 Stat. 1938 (1996), including the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2. Definitions

A. The term “personal information” means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual under the provisions of the California Information Practices Act (Civil Code Section 1798.3 et Seq.).

B. The term “public information” means information maintained by state agencies that is not exempt from disclosure under the provisions of the California Public Records Act (Government Code Sections 7920.000- 7931.000) or other applicable state or federal laws.

C. The term “confidential information” means information maintained by state agencies that is exempt from disclosure under the provisions of the California Public Records Act (Government Code Sections 7920.000- 7931.000) or has restrictions on disclosure in accordance with other applicable state or federal laws.

D. The term “sensitive information” means any public information or confidential information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion as identified in Information Security Program Management Standard 5305-A of the California Statewide Information Management Manual (SIMM).

E. The term “service provider” means any vendor, contractor, subcontractor, or third party, including employees, independent contractors or consultants providing any service to CCHCS under this ISA.

3. Acknowledgments

A. As an entity engaged in a contract, agreement, memorandum of understanding (MOU) and/or information receipt and/or information exchange with CCHCS, you (herein referred to as the Service Provider) acknowledge and agree that in the course of contract, agreement, MOU by and as indicated beyond, Service Provider shall comply with applicable United States and California laws and regulations, including but not limited to Sections 14100.2 and 5328 et seq. of the Welfare and Institutions Code, Section 431.300 et seq. of Title 42, Code of Federal Regulations, the Health Insurance Portability and Accountability Act (HIPAA), including but not limited to Section 1320 d et seq., of Title 42, United States Code and its implementing regulations (including but not limited to Title 45, CFR, Parts 160, 162 and 164) regarding the confidentiality and security of individually identifiable health information (IIHI), California Medical Information Act, Lantermann-Petris-Short Act, Alcohol Substance and Abuse Act, California Public Records Act, California Information Practices Act of 1977, the California State Administrative Manual and its associated regulations, mandates, budget letters and memorandums, and the State Information Management Manual.

4. Standard of Care

A. Service Provider acknowledges and agrees that, in the course of its engagement by CCHCS, Service Provider may receive or have access to sensitive and/or private information.

B. Service Provider shall comply with the terms and conditions set forth in this ISA regarding creation, collection, receipt, management, sharing, exchanging, transmission, storage, disposal, use and disclosure of sensitive and confidential information.

C. Service Provider shall be responsible for, and remain liable to, CCHCS for the actions of unauthorized employees, contractors and subcontractors concerning the treatment of CCHCS related sensitive and confidential information, as if they were Service Provider’s own actions.

D. In recognition of the foregoing, Service Provider acknowledges and agrees it shall:

i. Treat sensitive and confidential information with such degree of care required by federal and state requirements including but not limited to the United States National Institute for Standards and Technology and the State Administrative Manual Chapter 5300.

ii. Collect, use and disclose sensitive and confidential information solely and exclusively for the purposes for which the information, or access to it, is provided pursuant to the terms and conditions of this ISA;

iii. Not use, sell, rent, transfer, distribute, or otherwise disclose or make available sensitive or confidential information for the benefit of anyone other than CCHCS without CCHCS’s prior written consent.

5. Responsibilities of the Service Provider

A. The Service Provider is obligated to ensure the following:

i. Safeguards. To prevent the unauthorized creation, use, management, transfer, distribution, storage, etc. other than as provided for by this ISA. The Service Provider shall develop and maintain an information privacy and security program that includes the implementation of administrative, technical, and physical safeguards appropriate to the size and complexity of the Service Provider’s operations and the nature and scope of its activities. The information privacy and security programs must reasonably and appropriately protect the confidentiality, integrity, and availability of the CCHCS information it creates, receives, maintains, or transmits; and prevent the use or disclosure of CCHCS information other than as provided for by this ISA. The Service Provider shall provide CCHCS with information concerning such safeguards as CCHCS may reasonably request from time to time.

ii. The Service Provider shall restrict logical and physical access to CCHCS sensitive and confidential information to authorized users only.

iii. The Service Provider shall implement appropriate authentication methods to ensure information system access to sensitive and confidential information. If passwords are used in user authentication (e.g., username/password combination), the Service Provider shall implement strong password controls on all compatible computing systems (including hand held and mobile devices) that are consistent with the National Institute of Standards and Technology (NIST) Special Publication 800-53 Rev. 5 and NIST Special Publication 800-171 Rev. 3.

B. The Service Provider shall implement the following security controls on each server, workstation, or portable (e.g., laptop computer) computing device that processes or stores sensitive or confidential information:

i. Install a network-based firewall and/or personal firewalls;

ii. Continuously update anti-virus software on all systems;

iii. Institute a patch-management process including installation of all operating system/software vendor security patches; and

iv. Encrypt all confidential, personal, or sensitive data stored on portable electronic media (including but not limited to CDs and thumb drives) and on computing devices (including but not limited to laptop computers, cell phones, and tablets) with a solution that uses proven industry standard encryption algorithms.

C. The Service Provider shall not transmit confidential, personal, or sensitive data via e-mail or other Internet transport protocol over a public network unless employing encryption methodologies. CCHCS’ minimum encryption standard for internet transport is AES-256, leveraging SHA-1 or stronger hash algorithms in conjunction with the use of strong passwords to ensure the security of CCHCS data.

D. Mitigation of Harmful Effects. To the extent practicable, Service Provider will mitigate harmful effects known to the Service Provider of a use or disclosure of sensitive and/or confidential information by the Service Provider or its sub-Service Providers.

E. Agents and Contractors or Subcontractors of the Service Provider. To ensure any agent, including a contractor or subcontractor to the Service Provider that provides CCHCS information or created or received by the agent, contractor or subcontractor for the purposes of this contract, Service Provider shall ensure that such agents, contractors or subcontractors comply with the same restrictions and conditions in this ISA that apply to the Service Provider with respect to such information.

F. Notification of Electronic Breach or Improper Disclosure. During the term of this ISA, Service Provider shall notify CCHCS within 24 hours upon discovery of any probable breach of sensitive or confidential information where (1) the information is reasonably believed to have been acquired by an unauthorized person and/or (2) reasonably believed to have an effect of more than 499 people/identities.