RFP 844415 (CAD) and (RMS) Software.docx

REQUEST FOR PROPOSAL

PROJECT TITLE: Computer Aided Dispatch (CAD) and Records Management System (RMS) Ref # 844415

The University of Washington is soliciting proposals from potential vendors to provide the above referenced services. Vendors interested in providing the required services must submit proposals per the requirements detailed in this RFP.

This solicitation is open to those vendors that satisfy the minimum qualifications stated herein and that are available for work in Washington State.

Contents of this Solicitation

I. General Instructions

II. Requirements

III. Evaluation and Contract Award

VI. Attachments

Section I General Instructions

1.1 PURPOSE

The University of Washington Police Department is requesting proposals for a comprehensive, fully integrated cloud-based or on-premises public safety information management solution, including a new, modern Computer Aided Dispatch (CAD), Mobile Data (MobileCAD), and Law Enforcement Records Management System (LERMS) for dispatchers, mobile officers, and supporting personnel. The vendor must maintain the software, servers, and server operating systems under their standard maintenance/service agreement. This request aims to replace our legacy CAD and RMS system, with data migration included as part of this agreement

1.2 RFP COORDINATOR

The RFP Coordinator is the sole point of contact in the University for this Procurement. All communication between the Contractor and the University upon release of this RFP shall be with the RFP Coordinator, in writing, as follows: Benjamin Cory - bcory@uw.edu

1.3 Definition of Terms

“Supplier”, “Proposer”

“Request for Proposal ”

-A written solicitation document which identifies the UW’s need, and consultants are invited to submit proposals which outline their solution to the need, their qualifications and experience to provide the services, and their costs or fees.

1.4 tIMETABLE

1.5 WORKDAY SUBMISSION

Vendors shall submit a information in PDF OR Word format, via the University’s Workday Strategic Sourcing website. Information must be submitted on or before the time specified in 1.4 Timetable. Any information received after that date and time may not be considered. All information shall remain valid for a minimum of 180 days following the RFI closing date. Workday Portal - https://university-of-washington.public-portal.us.workdayspend.com/

1.6 COMPLAINTS

A. Contractors may submit a complaint to the RFP Coordinator based on any of the following:

· The solicitation unnecessarily restricts competition;

· The solicitation evaluation or scoring process is unfair or flawed; or

· The solicitation requirements are inadequate or insufficient to prepare a response.

B. Contractors may submit complaints up to 5 business days prior to the proposal due date. Complaints must meet the following requirements:

· Must be in writing.

· Must be sent to the procurement coordinator, or designee.

· Should clearly articulate the basis for the complaint.

· Should include a proposed remedy.

The RFP coordinator or designee will respond to complaints in writing; the response to complaints including any changes to the solicitation will be posted as an amendment on WEBS, https://fortress.wa.gov/ga/webs/ and in ARIBA. The complaint may not be raised again during the protest period. The complaint process does not include an appeal process.

1.7 Interpretation of the RFP

Should any discrepancies be found in or omissions from the specifications, or doubt as to their meaning, the Contractor shall at once notify the Coordinator, in writing. The Coordinator will send written instructions or addenda as required to all interested parties. All addenda issued shall be incorporated into the contract. The Purchaser shall not be responsible for or bound by oral interpretations. Only questions answered by written addenda are binding. Questions received less than five (5) working days before the proposed due date for submission of proposals cannot be answered.

1.8 REVISIONS TO THE RFP

The University reserves the right to change the acquisition schedule or cancel the RFP at any time. The University reserves the right to make corrections or amendments due to errors identified in the RFP by the University or a Contractor. Any changes will be dated and attached to, and made a part of, the RFP. All changes must be coordinated in writing with, authorized by, and made by the RFP Coordinator.

All RFP corrections and amendments will be posted to https://fortress.wa.gov/ga/webs/ and also to the Workday sourcing module. Contractors are responsible for checking the website for this information.

1.9 Signature

Each proposal must be signed by the Contractor with the usual signature and dated. The name and title shall be typed or printed below each signature.

A. Proposals submitted by a proprietorship must be signed by the Owner.

B. Proposals submitted by a partnership must be signed with the partnership name by one of the partners, followed by the signature and designation of the partner signing.

C. Proposals by a corporation must be signed with the legal name of the corporation, followed by the name of an authorized officer.

1.10 Cost of Proposals

Costs incurred in preparing and presenting the proposals or incurred in any other manner by the Contractor in responding to this solicitation are not reimbursable and may not be charged to the University.

1.11 Withdrawal or Modifications of Proposals

Any Contractor may withdraw their proposal upon written request at any time prior to the scheduled due date for submission of proposals.

1.12 Public Disclosure

The University is subject to RCW 42.56 (Public Records Act). All Contractor Responses and any subsequent Contract will be “public records” as defined in RCW 42.56.010

The Contractor must clearly specify any specific information that it claims is confidential or proprietary. Marking of the entire Response or entire sections as proprietary will not be honored. The University may not accept Responses where pricing is marked as proprietary.

All Responses received will remain confidential until the Contract, if any, resulting from this RFP is signed by the University and the Apparent Successful Contractor; thereafter, the Responses will be deemed public records.

To the extent consistent with RCW 42.56, the University will maintain the confidentiality of all information marked confidential or proprietary. If a request is made to view the Contractor’s information, the University will notify the Contractor of the request and the date that such records will be released unless the Contractor obtains a court order enjoining that disclosure. The Contractor will have five (5) business days from receipt of notice to obtain the court order. If the Contractor fails to obtain the court order enjoining disclosure, the University will release the requested information on the date specified.

1.13 ACCEPTANCE PERIOD

Contractor’s proposal must provide 120 business days for acceptance by University from the due date for receipt of Proposals.

1.14 RESPONSIVENESS

All Proposals will be reviewed by the RFP Coordinator to determine compliance with administrative requirements and instructions specified in this RFP. The Contractor is specifically notified that failure to comply with any part of the RFP may result in rejection of the Proposal as non-responsive.

1.15 Selection of Proposals

In determining the “apparent successful Contractor”, in addition to cost, the Contractor’s compliance with the requirements of this solicitation, and the items listed below, shall be given consideration.

A. The ability, capacity, and skills of the Contractor to perform the contract or provide the service required.

B. The character, integrity, reputation, judgment, experience, and efficiency of the Contractor.

C. The quality of performance of previous contracts or service.

D. The previous and existing compliance by the Contractor with the laws relating to contract and services.

E. Such other information as may be secured having a bearing on the decision to award the contract.

1.16 No Obligation to Contract

This solicitation does not obligate the University of Washington to contract for the solicited services specified herein.

1.17 Contract in Best Interest

The University reserves the right to accept or reject proposals on each item separately or as a whole, to reject any or all proposals without penalty, to waive informalities or irregularities, and to contract in the best interests of the University.

1.18 PUBLICITY

Advertising, including use of the University marks and logos, press releases, or any other general public announcement by a Contractor, stating the availability of its products or services to University employees is strictly prohibited unless the Contractor has obtained prior written authorization from the UW Procurement Services Department.

1.19 NON-ENDORSEMENT

The successful Contractor agrees to make no reference to the University in any literature, promotional material, brochures, sales presentation or the like without express written consent of the University.

1.20 FUNDING

Any contract awarded as a result of this procurement is contingent upon the continued availability of state or federal agency funding.

1.21 Contract and Terms & Conditions

The Apparent Successful Vendor will be expected to enter into a contract which is substantially the same as the University of Washington’s General Terms and Conditions which can be located here: https://finance.uw.edu/ps/suppliers/terms-conditions, and are also attached as Exhibit D. In no event is a Vendor to submit its own standard contract terms and conditions in response to this solicitation. All exceptions to the contract terms and conditions must be submitted as an attachment to the bidder’s proposal. The Agency will review requested exceptions and accept or reject the same at its sole discretion.

1.22 Data-Security

If, during the course of the performance, administration, or maintenance of this contract, or any extension or renewal thereof, CONTRACTOR acquires, uses, or otherwise obtains access to ‘University Data’ as those terms are defined in the UW Data Processing Agreement, incorporated herein, then the UW and CONTRACTOR agree that all of the terms and conditions of the UW’s Data Processing Agreement and/or IT Data Security Addendum(s) shall apply.

1.23 IN-STATE RECIPROCITY

The Department of Enterprise Services has established a schedule of states (Schedule) which grant a preference to their own in-state businesses for goods and services. Detailed information regarding the various States’ reciprocity policies is contained in the following URL. Bids submitted by Consultants with addresses in any of the states as described in the Schedules shall be evaluated in accordance with the instructions stated in the Schedule.

http://www.des.wa.gov/services/ContractingPurchasing/Pages/ReciprocalPreference.aspx

1.24 GRATUITIES

In accordance with RCW 42-52-150 and 160, Ethics in Public Service, no gifts, gratuities or any item of economic value may be accepted by University Employees. Contractors agree to offer no such items to any University employee.

1.25 Minority and Women Business Enterprise Participation

In accordance with chapter 39.19 RCW, the University of Washington encourages participation in all of its contracts by firms certified by the Office of Minority and Women’s Business Enterprises (OMWBE). Participation may be either on a direct basis in response to this solicitation or on a subcontractor basis. However, no preference will be included in the evaluation of proposals, no minimum level of MWBE participation shall be required as a condition for receiving an award and proposals will not be rejected or considered non-responsive on that basis. Any affirmative action requirements set forth in federal regulation or statutes included or referenced in the contract documents will apply.

The established annual procurement participation goals for this solicitation are MBE 6% and WBE 4%. For information on certified firms, Contractors may contact OMWBE at 360/753-9693or http://www.omwbe.wa.gov.”

1.26 U.S. Small Business Participation

Participation in contracts for goods and services is encouraged by firms which qualify under definitions by the U.S. Small Business Administration as small business (SB), or small disadvantaged business (SDB), or small women owned business (WOB).

The percentage listed below is voluntary. No preference will be included in the evaluation of bids/proposals. Participation in University contracts may be either direct as the Contractor in response to this solicitation, or as a subcontractor to a Contractor.

Voluntary U.S. Small Business goals for this solicitation are 15% SB/SDB/WOB

SECTION II

REQUIREMENTS

21 Background and Purpose

The primary objective of procuring a new CAD and RMS is to enhance daily operations for the safety and security of the University of Washington community.

The proposed solution should:

· Replace the current CAD and RMS system with the latest available technology platform that meets or exceeds the needs of the University of Washington Police Department, to include:

· Emergency and non-emergency call handling and event management

· Caller location resolution, automatic resource location (ARL), automatic vehicle tracking (AVL), and GIS functionality

· Dispatching and tracking Police resources to calls for service

· Efficient unit recommendation, including quickest response (unit and route)

· Field reporting

· Document management, site information management, premise history

· Workflow/collaboration

· Historical data query and statistical reporting, including ad hoc, based on configurable timelines dependent on type of data

· Any associated services necessary to fulfill the purposes outlined above

· Provide a system that will allow for the use of technology to provide robust crime analysis, identifying historical, current, and predictive crime trends and patterns that will assist the Department in deploying staff and assets to aid in proactive policing services to the campus community.

· Reduce inefficiencies in locating current information

· Include upgrades and maintenance releases by the System Contractor to be fully tested and stable with minimal impact to users.

· Provide bug fixes and problem resolutions in a timely manner, which should be based on commercially reasonable efforts and industry best practices. A system of classifications and timeline for response and resolution will be included in the contract in the form of a service level agreement, including contact escalation pipelines to ensure timely service with economic remuneration triggers.

· Support accurate NIBRS reporting to the Washington State Patrol and the FBI (Federal Bureau of Investigation).

· Meet Nextgen 911 requirements and functionality.

· Allow staff and IT personnel to configure the system as needed.

· Allow for integration with other systems used by UWPD, including IAPro/BlueTeam, Axon/Evidence.com, SECTOR and TraCS.

· Allow for data sharing with other systems used by UWPD, including LiNX NW, KC Pros Office,

· Case Management control from CAD creation to retention/destruction The goals are to:

· Deliver a fully integrated CAD and RMS on time and within budget.

· Implement new systems without disrupting users and operations.

· Manage and verify data conversion.

· Ensure sufficient training for staff.

· Establish a long-term maintenance and support contract.

· Automate data input processes.

· Provide access to near real-time data.

2.1 Period of Service

If applicable, UW reserves the right to extend the Contract on a month-by-month basis beyond the expiration of the Contract at the then current rate to facilitate establishment of a new Contract.

Proposal Requirements and Instructions

The proposed systems and Offeror’s proposal shall:

· Serve as a system software CAD/RMS that meets the RFP requirements.

· Include all necessary installation, data migration, and implementation services.

· Provide ongoing training, maintenance, warranty services, and support.

· Allow updates to the CAD/RMS system as needed.

· Offer ongoing technical support for system updates.

· Ensure integration of all modules to enhance information sharing and reduce duplication.

· Support detailed and customizable reports. Web-based query reporting and analytic tools that provide capability to search and view CAD and LERMS data using pre-built reports, custom ad hoc reports, and on demand search functionality.

· Ensure system availability to first responders through various devices with proper security and encryption.

· Include a state-of-the-art records and crime analysis system compatible with existing systems.

· The System shall be public safety mission critical and must provide for 99.99 percent “uptime” excluding planned maintenance windows that shall be scheduled in off-peak hours and have a documented roll-back plan if maintenance will exceed the planned window.

· The System shall maintain the security of all data stored in the System in accordance with the Criminal Justice Information Services (CJIS) security policy standards.

· The System shall support the rules, regulations, records retention, disclosure, privacy, access, and other legal requirements related to the use of the System in the State of Washington, including any Federal requirements.

· The System shall be able to communicate with and export data to other systems. Data export should support a variety of flat data file formats and modern web service description languages, including CSV and XML. Communication between systems should support file export, direct database connections, and web services. Ability to interface with the system using an API is “preferred” (not required). Real-time or near real-time export capabilities are preferred.

· The System shall be able to expunge/seal any records (juvenile or other) as directed by a court of competent jurisdiction in compliance with Federal and State of Washington standards.

· The System shall be able to enter, track, and fully report on incidents (times, locations, etc.), persons, vehicles, officers and other personnel, and property within each event.

· The System shall provide robust reporting and data querying capabilities. This functionality includes reports, statistics, and analytics across all data entered into the System.

· The System shall allow the attachment and viewing/retrieval of a variety of files and file types, including documents, photos, video, and audio, among others.

· The System shall require only a single point of entry for each data element – no duplicate entries of any information shall be required.

· The System shall be able to provide a web-based, low bandwidth encrypted remote solution for Records Clerk event creation and disposition. The web-based component shall include the capability to message mobile data users and CAD users.

· System Administrators shall be enabled to configure and extend the System to meet the dynamically changing needs of the agencies and departments using the System.

· The user interfaces (desktop, mobile, web) shall be simple, easy to use, interactive, and intuitive while demonstrating sufficient sophistication to meet the needs of complex investigations

· The System shall support all Microsoft supported Windows operating systems and remain functionally current with new Windows operating systems.

· Be a fully redundant system with failover capability.

· Be adaptable to the continuous growth of the Police Department.

· Be compatible with existing and proposed systems, including but not limited to LiNX, Rapid SOS, Esri ArcGIS Mapping, Intrado Viper 7 911 phone system, ILETS, and Evidence.com.

· Meet CJIS requirements as directed by the U.S. Department of Justice.

· Allow modularity expansion to Next Generation 911 capabilities, IAPRO and Blueteam or other requirements.

· Provide comprehensive user and technical support.

· Include a comprehensive training program for all system upgrades or enhancements.

Agency Background Information Provide specific information about the University of Washington Police Department Communications Center, the community served, and Client Agencies, including:

· Population Served: 70,000

· Average Annual Calls for Service

· Number of Dispatch users: 9

· Number of Dispatch Stations: 5

· Number of Emergency Communications Officers per shift: 1-3

· Number of Mobile/Officer users

· Number of Officer/mobile users per shift

· Total number of users

Financial Stability: Describe the financial status of the company. Attach a copy of the most recent annual financial statement or other similar document.

Technical Approach and Methodology: Describe Bidder’s technical approach and methodology for accomplishing the described Scope of Work. The proposed approach and methodology should include a detailed work plan and schedule. All information to be provided by participating Hospital(s) as part of this plan must be specified including content, format and frequency.

Project Team and Management Structure: Identify proposed project team and management structure for completing the Scope of Work. This should identify roles and responsibilities, including Bidder expectations of participating UW Medicine Hospital(s) staff resources. Provide resumes of key professional staff to be assigned to the project and their level of commitment to this engagement.

Proposed Fees: Provide a cost proposal to accomplish the Scope of Work or provide the requested product.

Firm Experience and Credentials: Provide evidence of Bidder’s experience in projects or providing products as described within this RFP.

References: List three (3) relevant references, including a description of the engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number and e-mail address

Contract Management Information: Provide primary Contract Manager Contact name, title, mailing address, telephone number and email address.

SECTION III EVALUATION AND CONTRACT AWARD

1.

2.

3.

3.1 Evaluation of Proposals

The University reserves the right to make Vendor selections based solely on the proposal submitted. Responsive proposals will be evaluated strictly in accordance with the requirements stated in this solicitation and any addenda issued. The evaluation of proposals shall be accomplished by an evaluation team to be designated by the UW, which will determine the ranking of the proposals. The RFP Coordinator may contact the Vendor for clarification of any portion of a Vendor’s proposal.

3.2 Interview / Presentation

At its sole discretion, the University may require Vendors to participate in an interview or provide a presentation to the evaluation committee. If so, the score from the interview and/or the presentation may be combined with the score of the proposal to identify the apparent successful Vendor. The University will contact the Vendor directly to schedule the interview/presentation.

3.3 Evaluation Criteria & Scoring

The following weighting and points will be assigned to the proposal for evaluation purposes:

Submitted proposals will be evaluated based on:

· Qualifications

· Reputation/customer service

· Software solutions

· Implementation

· Warranty/service plan

· Price

· Ease of use

· Features

Total possible points: 100

3.4 Notification to Proposers

Once the final evaluation phase has been completed, the solicitation Coordinator will issue a written announcement to all participants, citing the name(s) of the apparent successful vendors.

Section IV Attachments

1. Attachment A. Data Processing Agreement

4. Attachment D. University of Washington General Terms and Conditions

5. Attachment E. Question Template

6. Attachment F. IT Accessibility Rider

7. Attachment G. IT Security Terms image1.emf

C-to-P-DPA.docx

UNIVERSITY OF WASHINGTON

CONTROLLER TO PROCESSOR

DATA PROCESSING AGREEMENT

Introduction, Parties, AND Effective Date

This Data Processing Agreement (the “DPA”) is hereby incorporated into and amends the [insert name of Underlying Agreement] (the “Agreement”) between the University of Washington, an agency of the State of Washington, with its main campus located in Seattle, Washington (the “University”) and [insert entity name], a [insert name of jurisdiction within which entity was formed (ex. Delaware)] [insert type of entity type (ex. corporation)], with a principal place of business at [insert entity’s address] as of the Effective Date below. With respect to Data Processing performed under the Agreement and this DPA, the University is the Controller and the [insert non-UW entity] is the Processor. The parties agree as follows:

Definitions

1. “Controller” refers to the person or entity that determines the purpose and means for Data Processing.

2. “Data Breach” means any technical or physical incident or set of circumstances that leads to the unauthorized, accidental or unlawful access to, or destruction, loss, alteration, or disclosure of, University Personal Data undergoing Data Processing by the Processor.

3. “Data Processing” means any operation(s) performed on University Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, access, use, disclosure by transmission, dissemination, combination, restriction or destruction.

4. "Data Request” means a request to exercise rights available under any applicable law with respect to University Personal Data.

5. “Processor” refers to the person or entity that performs Data Processing on behalf of the Controller.

6. “Sub-processor” means any person or entity appointed by or on behalf of the Processor to carry out any portion of the Work.

7. “University Personal Data” or “UPD” means any records or information relating to an identified or identifiable natural person, such as name, identification number, location data, online identifiers, or factor(s) specific to physical, physiological, genetic, mental, economic, cultural, or social identity or characteristics, or is identified as personally identifiable data (or a similar term) by any applicable law, that:

a. Is created, received, or maintained by the University and transmitted to, accessed by, or otherwise made available to the Processor in connection with the Processor’s performance of the Work;

b. Is created or compiled by the Processor in performing the Work; or

c. Is appended to, aggregated with, or associated with any University Personal Data originating from the University that was transmitted to or accessed by the Processor in connection with the Processor’s performance of the Work.

Notwithstanding the foregoing, UPD does not include personal data relating to the Processor’s or Sub- processor’s personnel or personal data that is acquired from non-UW sources and is processed by the Processor not in association with the Work.

8. “Processor” as used in this DPA includes both the Processor identified above, and any third party and/or entity that owns or controls, is owned or controlled by, or is under common ownership or control with the Processor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting security, by contract, or otherwise.

9. “Work” refers to any and all activities carried out by the Processor or a Sub-processor in providing services, work product or deliverables under the Agreement, or in fulfilling any other obligations set forth in the Agreement.

standard of care

1. The Processor represents and warrants that any Data Processing shall be by personnel who (a) are obligated to maintain confidentiality under applicable law or job expectations, and (b) are sufficiently trained and experienced to use reasonable care commensurate with state-of-the-art professional practices to comply with the obligations in this DPA.

2. The Processor shall ensure that there are appropriate personnel-vetting processes, and appropriate policies and/or controls over activities as necessary to safeguard UPD per this DPA and applicable law.

3. Prior to the disclosure of UPD to, or the commencement of Data Processing by any Sub-processor, the Processor shall cause each Sub-processor to execute an agreement with the Processor that includes terms and conditions which establish at least the same level of protection for UPD as those set out in this DPA and applicable law. If a Sub-processor fails to fulfill its data protection obligations under this DPA or applicable law, the Processor shall remain fully liable to the University for the performance of that Sub-processor’s obligations.

purpose And LIMITS OF DATA PROCESSING

1. The Description of Data Processing Exhibit to this DPA sets forth certain information relating to the Data Processing by the Processor for the purpose of carrying out the Work. The Processor may only engage in Data Processing for the limited purpose described in the Description of Data Processing Exhibit (the “Purpose”). The Processor shall limit its Data Processing to include only the minimum UPD needed to fulfill the Purpose. The Processor’s Data Processing will not involve any secondary uses of UPD beyond the Purpose. Without limiting the generality of the foregoing, the Processor shall not use any UPD to market or sell goods or services to persons named or otherwise identified in UPD.

2. When the University reasonably deems necessary to meet its own requirements and/or applicable laws, the University may make reasonable changes to the Data Processing by amending the Description of Data Processing Exhibit or providing the Processor with an additional exhibit in the same form as the Description of Data Processing Exhibit. Any material change to the Description of Data Processing Exhibit that increases the cost of the Work shall be subject to the mutual agreement of the parties.

3. The University shall have sole control over determinations related to (a) the lawfulness of the Data Processing, and (b) the necessity of any privacy notice to and/or solicitation of consent from individuals whose personal data will undergo Data Processing in relation to the Work.

Non-Disclosure AND DATA REQUESTS

1. UPD shall not be disclosed by the Processor (or any Sub-processor) to a third party, unless the University grants permission in writing to the Processor to disclose, or unless such disclosure is required by applicable law.

2. If the Processor receives any subpoena, discovery request, court order, or other legal request or order that calls for disclosure of any UPD, then the Processor shall promptly notify the University unless specifically prohibited by law from doing so. The Processor’s notification shall give the University sufficient time to object to the disclosure, obtain a protective order, or otherwise protect UPD by limiting disclosure. The Processor shall provide the University with prompt and full assistance in the University’s efforts to protect UPD. Any disclosure pursuant to this section shall be limited to the minimum disclosure required by law.

3. The Processor shall assist the University by implementing technical and organizational measures, to the extent practicable, in order for the University to meet its obligations (as understood by the University) to respond to Data Requests relating to UPD held by the Processor. The Processor shall promptly notify the University if the Processor receives a Data Request, assist the University in the University’s response, and respond to the Data Request directly only on the documented instructions of the University or as required by applicable laws to which the Processor is subject, in which case the Processor shall, to the extent permitted by applicable laws, inform the University of the Processor’s legal obligations before any response to the Data Request.

Compliance and Data Transfers

1. The Processor shall conduct all Work and Data Processing in full compliance with any and all applicable statutes, regulations, rules, standards and orders of any official body with jurisdiction over the Processor or the University. Applicable statutes, regulations, rules, or orders may include, but are not necessarily limited to:

a. The Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. §1232g; 34 CFR Part 99;

b. The Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 300gg and 29 U.S.C § 1181 et seq. and 42 USC 1320d et seq.; and/or the Washington Health Care Information Act, Ch. 70.02 RCW; and

c. European Union General Protection Data Regulation (“GDPR”), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. The University’s obligations and rights with respect to GDPR are set forth in the Agreement and this DPA. The Agreement, this DPA, and any directions contained in notices from the University to the Processor pursuant to § J.4 together constitute the University’s documented instructions to the Processor for the purposes of GDPR. The subject matter of the Data Processing with respect to GDPR is the Work, as defined above, in the Agreement, and/or in the Description of Data Processing Exhibit to this DPA (including any change(s) pursuant to § D.1). Compliance with GDPR includes, without limitation, the following:

i. The Processor shall provide the University with assistance and information required by GDPR, to the extent applicable, as it relates to Data Processing. As contemplated by GDPR, the Processor’s provision of assistance may relate to data protection impact assessments, prior consultations, demonstration of compliance with Article 28 of GDPR, and audits. The Processor will also immediately notify the University if, in its opinion, a University instruction infringes GDPR.

ii. The Sub-processors that are identified and described by the Processor in the Description of Data Processing Exhibit of this DPA are the only Sub-processors permitted to perform Data Processing. Prior to engaging a new Sub-processor for Data Processing, the Processor shall: (1) notify the University in writing of the intended addition or replacement of the Sub-processor; and (2) give the University the opportunity to object to such change.

2. For Data Processing that involves transfers of UPD from the European Economic Area, Switzerland, or the United Kingdom to a country that does not ensure an adequate level of data protection (including, but not limited to, the United States) within the meaning of the applicable laws of the foregoing territories, the Standard Contractual Clauses (accessible at https://privacy.uw.edu/design/agreements/dpa/ shall govern such transfers.

SAFEGUARDING DATA

1. Taking into consideration the state of the art, costs of implementation and the nature, scope, context and purposes of the Data Processing, the likelihood and potential severity of risks to the rights and freedoms of natural persons, and the risk of Data Breach, the Processor represents and warrants that it shall implement technical, physical, and administrative security measures appropriate to such risks, which may include, but are not necessarily limited to:

a. The de-identification, anonymization, pseudonymization, and encryption of UPD;

b. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, facilities, and services;

c. The ability to restore the availability of and access to UPD in a timely manner in the event of a physical or technical incident; and

d. A process for regularly testing, assessing, and evaluating the effectiveness of technical, physical, and administrative measures for ensuring the security of the Data Processing.

2. The Processor’s measures for protecting UPD shall (a) meet or exceed industry best practices for safeguarding personal data, and (b) be based on the concepts of privacy by design and by default.

DATA BREACH responsE

1. The Processor shall have sufficient capabilities for detecting, identifying, and responding to a Data Breach.

2. If the Processor has reason to believe that a Data Breach has occurred, then, without undue delay, the Processor shall notify the University of said Data Breach. Such notification to the University shall include sufficient information to enable the University to meet its obligations under applicable law.

3. In the event of a Data Breach, the Processor shall cooperate with the University and immediately:

a. Investigate and identify the nature of the Data Breach;

b. Preserve relevant evidence;

c. Contain, remediate, and mitigate the Data Breach; and

d. Notify the University of any additional or newly-emerged information beyond the initial Data Breach notification to the University described in § H.2.

4. In the event of a Data Breach caused in whole or part by the Processor:

a. The University may instruct the Processor, at the Processor’s expense, to provide:

i. Notice when required by applicable law, or when a Data Breach could result in harm to individuals and/or risk to the University; and/or

ii. Services such as credit monitoring or identity theft protection to individuals when the absence of such services could result in harm to individuals and/or individuals would have a reasonable expectation that such services be provided.

b. Alternatively, the University may elect to provide the aforementioned notice and services itself.

5. Notwithstanding the foregoing, unless the Processor is required by law to provide the aforementioned notice and/or services in a particular manner, the University shall control the time, place, content, and manner of such notice and services.

DISPOSITION OF UPD UPON Termination OR FULFILLMENT OF PURPOSE

4. The duration of Data Processing by the Processor shall be no longer than the expiration or termination of the Agreement or fulfillment of the Purpose with respect to UPD, whichever is earlier.

5. Upon expiration or termination of the Agreement, or fulfillment of the Purpose with respect to UPD, whichever is earlier, the Processor shall transfer to the University any and all UPD, unless otherwise instructed by the University in writing.

gENERAL TERMS

1. SURVIVAL AND ORDER OF PRECEDENCE. This DPA shall survive the expiration or earlier termination of the Agreement. In the event the provisions of this DPA conflict with any provision of the Agreement, or the Processor’s warranties, support agreement, or service level agreement, the provisions of this DPA shall prevail.

2. SEVERABILITY. If any provision of this DPA is found to be unenforceable, the remainder of the Agreement and this DPA shall remain in effect.

3. HEADINGS FOR CONVENIENCE ONLY. Any and all subject headings are not substantive and are for convenience only.

4. NOTICES. Any notices or communications required or permitted to be given by this DPA must be (a) given in writing, and (b) personally delivered; mailed by prepaid, certified mail, or overnight courier; or transmitted by electronic mail (including PDF) with receipt acknowledged, to the party to whom such notice or communication is directed, or to the mailing address or regularly monitored electronic email address of such party.

IN WITNESS WHEREOF, this DPA has been executed as of the date of the last party to sign below (“Effective Date”). If signed in counterparts, then each shall be considered an original thereof.

University:

Signature

Processor:

Name and Title

Date

DESCRIPTION OF DATA PROCESSING EXHIBIT

This Description of Data Processing Exhibit to the Data Processing Agreement (the “DPA”) sets forth certain information relating to the Data Processing, current as of the date of the last signature below (including in a countersigned version of this Description of Data Processing Exhibit), that the Parties anticipate will be carried out in connection with the Work as defined in the DPA. This version of this Description of Data Processing Exhibit may be superseded by subsequent versions issued in accordance with Section § D.2 of the DPA.

1. NATURE AND PURPOSE

[Describe the nature (such as the operations to be undertaken by the Processor, volume of personal data, etc.) and the purpose (such as the University’s mission and the University department or unit’s specific objectives that will be fulfilled through the Processor’s Data Processing)]

2. CATEGORIES OF DATA SUBJECTS

[List the categories of individuals about whom personal data relates (such as currently enrolled undergraduate students, prospective academic personnel, alumni who have donated to the University between 2008-2018, etc.)]

3. TYPES OF PERSONAL DATA

[List the personal data points that will undergo Data Processing including any special categories of personal data. NOTE: special categories of personal data include information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.]

4. PROCESSOR CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

5. UNIVERSITY DEPT/UNIT CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

6. SUB-PROCESSORS

[The Processor must list all Sub-processors that will perform any GDPR-governed Data Processing (such as cloud storage providers, hosting providers, etc.), with an explanation of each Sub-processor’s Data Processing activities. If GDPR does not apply or the Processor does not use any Sub-processors for GDPR-governed Data Processing, insert “Not Applicable”.]

University:

Processor:

Controller to Processor Data Processing Agreement

Version September 2021 image1.gif image2.emf

Confidentiality Statement RFP.docx Attachment B

To be completed and returned with proposal

CONFIDENTIALITY STATEMENT

The provider of services shall keep all work and services carried out hereunder for the University of Washington entirely confidential and not use, publish or make known any information to any persons other than the personnel of the parties of the agreement. The confidentiality of such information will survive the conclusion of the provider’s work and the termination of the agreement.

AGREED TO:

Signature: ____________________________________________________

Printed Name: ________________________________________________

Date: ________________

RFQQ 11-0025 Attachment B image1.jpeg image3.emf

OMWBE RFP.doc

ATTACHMENT C

Complete and return with proposal

Minority and Women's Business Enterprise (MWBE) Response Form

This solicitation includes voluntary goals for MWBE participation. If the Vendor has been certified by the State of Washington Office of Minority and Women's Business Enterprises (OMWBE), please complete Part 1 below. If the Vendor is proposing to subcontract or joint venture with certified Minority Business Enterprises (MBE's) or Women's Business Enterprises (WBE's) please complete Part 2. If the Vendor proposes no MWBE participation in the bid, so indicate in Part 3.

1.

MWBE VENDOR:

Vendor is certified by the OMWBE as: (check as applicable)

MBE

FORMCHECKBOX

Both Minority and Woman Owned FORMCHECKBOX

WBE

FORMCHECKBOX

Combination 50% Minority / 50% Woman Owned FORMCHECKBOX

2.

MWBE SUBCONTRACT PARTICIPATION:

The voluntary goals for MWBE participation in this contract are established in the accompanying solicitation. Vendor proposes to include certified MWBE's in the contract as described below:

Certified MWBE Subcontract Participation

Name(s) of Participating MWBE: ______________________________________

Description of Participation: __________________________________________

Amount of Participation: $______________ Contract% Participation: ______%

3.

NO MWBE PARTICIPATION PROPOSED:

No certified MWBE participation is proposed by this vendor.

Signed: Vendor or authorized representative

Title:

Contact OMWBE at (360) 753-9693 or the University's MWBE Representative at (206) 543-5753 for details on certification.

For more description on State certification, see next page

Federal Small Business Certification Response

Please indicate (check) the appropriate selection:

_ Small Business _ Small Disadvantaged Business _ Small Woman Owned

Please include the four digit Standard Industrial Classification (SIC) code, if known: _________

For more description on Federal certification, see next page

State of Washington Office of Minority and Women Owned Business Certification and Federal Qualification

GENERAL STATEMENT: In accordance with the legislative findings and policies set forth in Chapter 39.19 RCW the State of Washington encourages participation in all of its contracts by MWBE firms certified by the Office of Minority and Women’s Business Enterprises (OMWBE). Participation may be either on a direct basis in response to this solicitation/invitation or as a subcontractor to a Vendor/Proposer. However, unless required by federal statutes, regulations, grants or contract terms referenced in the contract documents, no preference will be included in the evaluation of bids/proposals. No minimum level of MWBE participation shall be required as a condition for receiving an award and bids/proposals will not be rejected or considered non-responsive on that basis. Any affirmative action requirements set forth in federal regulations or statutes included or referenced in the contract documents will apply.

RECORD KEEPING: The Contractor shall maintain, for at least three years after completion of this contract, relevant records and information necessary to document the level of utilization of MWBEs and other businesses as subcontractors and suppliers in this contract as well as any efforts the contractor makes to increase the participation of MWBEs as listed below. The contractor shall also maintain, for at least three years after completion of this contract, a record of all quotes, bids, estimates, or proposals submitted to the Contractor by all businesses seeking to participate as subcontractors or suppliers in this contract. The State shall have the right to inspect and copy such records. If this contract involves federal funds, Contractor shall comply with all record keeping requirements set forth in any federal rules, regulations or statutes included or referenced in the contract documents.

AFFIRMATIVE EFFORTS TO INCREASE PARTICIPATION BY MWBE’s: Vendors/Proposers/Contractors are encouraged to:

1. Advertise opportunities for subcontractors or suppliers in a manner reasonably designed to provide MWBEs capable of performing the work with timely notice of such opportunities, and include a provision encouraging participation by MWBE bids/proposals directly from MWBEs.

2. Provide MWBEs that express interest with adequate and timely information about plans, specifications, and requirements of the Contract.

3. Break down total requirements into smaller tasks or quantities, where economically feasible, in order to permit maximum participation by MWBEs and other small businesses.

4. Establish delivery schedules, where the requirements of this contract permit, that encourage participation by MWBEs and other small businesses.

5. Reduce bonding requirements where practicable.

6. Utilize the services of available minority community organizations, minority contractors groups, local minority assistance offices and organizations that provide assistance in the recruitment and placement of MWBEs and other small businesses.

7. The actions described in this section should supplement efforts to provide information to all qualified firms, and nothing in this section is intended to prevent or discourage the Vendors/Proposers/Contractors from inviting proposals for participation from non-MWBE firms as well as MWBE firms.

NON-DISCRIMINATION: Contractors, Vendors and Proposers shall not create barriers to open and fair opportunities for all businesses including MWBEs to participate in all State contracts and to obtain or compete for contracts and subcontracts as sources of supplies, equipment, construction and services. In considering offers from and doing business with subcontractors and suppliers, the Contractor shall not discriminate on the basis of race, color, creed, religion, sex, age, nationality, marital status, or the presence of any mental or physical disability in an otherwise qualified disabled person.

FEDERAL Small, Small Disadvantaged or Small Woman Owned Business Certification accordance with Public Law 95-507, Federal Contracts that contain Federal Acquisition Regulations (FAR) clause 52.219-8 (Utilization of Small Business Concerns and Small Disadvantaged Business Concerns) impose requirements regarding subcontracting with small businesses and small business subcontracting plans. Refer to FAR 19.001 for guideline definitions. With regards to certification, the Small Business Administration (SBA) classifies small businesses on an industry-by-industry basis, utilizing a Standard Industrial Classification (SIC) code as described in the Code of Federal Regulations (CFR) Title 13, Part 121.The offeror certifies that the information is true and understands that whoever, for the purpose of securing a contract or subcontract is accountable under Public Law 99-661 and the CFR Title 13, Part 124 & 125.