Soldiers Homes EMR RFR Attachment F Model SOW.docx

STATEMENT OF WORK

BETWEEN

THE COMMONWEALTH OF MASSACHUSETTS

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

ON BEHALF OF THE

DEPARTMENT OF VETERANS’ SERVICES’

CHELSEA SOLDIERS’ HOME AND THE HOLYOKE SOLDIERS’ HOME

AND

[VENDOR]

FOR

THE SOLDIERS’ HOMES ELECTRONIC MEDICAL RECORD (EMR) SYSTEM

INTRODUCTION

The following document will serve as a statement of work (“SOW”) between the Commonwealth of Massachusetts Executive Office of Health and Human Services (“EOHHS”) on behalf of the Department of Veterans’ Services’ Chelsea Soldiers’ Home and the Holyoke Soldiers’ Home (“collectively, the “Soldiers’ Homes”) and [Vendor] (“Vendor”) to apply to work related to the Soldiers’ Homes Electronic Medical Record (EMR) System. The entire agreement between the parties (the “Agreement”) consists of the following documents in the following order of precedence: (1) the Commonwealth Terms & Conditions for Information Technology Contracts; (2) the Commonwealth’s Standard Contract Form; (3) the Request for Response (Document # XXX) (“RFR”); (4) this SOW, and any other documents negotiated between the Parties; and (5) Vendor’s response to the RFR. The documents comprising the Agreement supersede all prior written or verbal negotiations and statements. This SOW shall not be modified by any subsequent written or verbal communications other than in accordance with Section 4.5, Amendments and Change Orders. By signing the attached Standard Contract Form, the Parties represent that they are duly authorized to execute this Statement of Work on behalf of their respective organizations.

DEFINITIONS

The terms used in this SOW, unless defined in this SOW or in an amendment made hereto, shall have the meaning ascribed to them in the other documents that constitute the Agreement between the Parties.

Application: means the Vendor-owned or licensed Electronic Medical Record (EMR) System, as well as any third-party components or open-source software contained therein, and any updates, upgrades, releases or enhancements thereto.

Business Day: means any weekday on which Commonwealth or Vendor resources, respectively, are expected to report to work, excluding legal holidays as defined by MGL Ch. 4, Section 7, paragraph 18.

Calendar Day: Any day of the week regardless of whether work is performed, including weekends and holidays.

Change Order or Change Request: A written amendment to the SOW, directing Vendor to change the contract price, Requirements, or project schedule. Such changes must be within the scope of this SOW and the RFR.

Commonwealth Data: All data used or owned by the Soldiers’ Homes or the Commonwealth to which the Vendor gains access through its contractual obligations under this SOW.

Deliverable: Any work product that Vendor delivers for the purposes of fulfilling its contractual obligations.

Disaster: A malfunctioning of a critical component without which the Application is unavailable to provide the function and features required by the Agreement.

Disaster Recovery: The procedures required to ensure continued business operations through adequate alternative facilities, equipment, back-up files, and documentation in the event that a Disaster is declared.

Downtime: Any period of time where EOHHS/Soldiers’ Homes users cannot access any portion of the Application.

Effective Date: The date of the last Party’s signature on the Standard Contract Form.

Electronic Medical Record System (EMR): A system of records and interconnected functionality that is an electronic version of a patient’s medical history. The system is maintained by providers over time and may include all of the key administrative clinical data relevant to that person’s care, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The EMR automates access to information and has the potential to streamline the clinician's workflow. The EMR also has the ability to support other care-related activities directly or indirectly through various interfaces, including evidence-based decision support, quality management, and outcomes reporting.

Executive Office of Health and Human Services or EOHHS: A secretariat-level executive agency under the Governor of Massachusetts. EOHHS oversees 16 constituent agencies, including the Department of Veterans’ Services, and in addition, the Chelsea and Holyoke Soldiers’ Homes and the MassHealth program.

EOHHS IT: EOHHS’ Information Technology Unit that provides a range of centralized IT services for EOHHS and the Soldiers’ Homes.

Executive Office of Technology and Security Services or EOTSS: Formerly the Massachusetts Office of Information Technology, EOTSS provides a range of centralized IT services; oversees IT policies, standards and architecture; and promotes cross-agency collaboration and adoption of shared services.

Full-Time Equivalent (FTE): An individual who works forty hours per week or individuals who work in aggregate forty hours per week.

Key Personnel: Personnel directly responsible for management of the contract; or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the contract.

MassHealth: The medical assistance or benefit program administered by EOHHS pursuant to M.G.L. c.118E and Title XIX of the Social Security Act (42 USC 1396) and other applicable laws and waivers to furnish and pay for medical services for eligible individuals. MassHealth pays for health care for certain low- and medium-income people living in Massachusetts, including a program for individuals who are HIV positive. MassHealth also manages the Insurance Partnership for small businesses, the Children's Medical Security Plan, Healthy Start, and the Special Kids/Special Care Pilot Program, cosponsored with the Department of Social Services.

Party or Parties: As applicable, one or both of Vendor or EOHHS/Soldiers’ Homes.

Patient/Client: The individual receiving services or care.

Permitted Use: Use of the Application by EOHHS/Soldiers’ Homes and its Authorized Users to help support the management of client eligibility determination, admission/enrollment, clinical care, regulatory documentation, and reimbursement for provided services. The EMR System shall be able to serve EOHHS/Soldiers’ Homes, and to connect with the network of vendor community providers providing continuum of care to the State clients/patients.

Project Managers: Individuals from EOHHS, DVS, Soldiers’ Homes and Vendor identified and designated as Project Managers who shall perform project management on behalf of EOHHS/Soldiers’ Homes and Vendor under this SOW.

Project Plan: means the schedule, or services of schedules, setting forth the sequence of events for the performance of Services, including the milestones and milestone dates.

Provider: A provider that furnishes medical services.

Requirements: The Technical and Functional requirements for the Soldiers’ Homes’ EMR listed in the RFR Attachment A and B.

Security: Refers to the processes, methodologies, and means which are designed and implemented to protect information systems and information - including print, electronic, or any other form of confidential, private and sensitive information or data - from unauthorized access, use, misuse, disclosure, destruction, modification or disruption, which includes but is not limited to the ability to authenticate and authorize users to provide secure access to the system in a traceable (auditable) manner.

Services: The activities engaged in by Vendor for the purpose of fulfilling its obligations under the terms of this SOW, which may or may not result in the creation of a Deliverable.

Task: A material activity engaged in by Vendor for the purpose of fulfilling its obligations to EOHHS/Soldiers’ Homes under the terms of this SOW, which may or may not result in the creation of a Deliverable.

OVERVIEW, EFFECTIVE DATE AND TERM

Services EOHHS/Soldiers’ Homes has engaged Vendor to provide implementation and maintenance and support services as well as rights to use and access the EMR (collectively, the “Services”) as further set forth in this SOW.

Implementation Services Vendor shall provide implementation services with the Deliverables and Milestones as set forth in the Project Plan in Attachment X.

Application License Grant Vendor shall provide EOHHS/Soldiers’ Homes the rights to access the Application as follows:

(a) Application Access Rights. Vendor hereby grants to EOHHS/Soldiers’ Homes a non-exclusive, royalty-free, irrevocable, transferable and sublicensable license for the Term to access and use the Application and related Vendor Documentation for the Permitted Use in accordance with the terms and conditions of the Agreement. EOHHS/Soldiers’ Homes, for itself and its Authorized Users, has the right and license to do each of the following for or in connection with the Permitted Use: (i) install, execute, and run an unlimited number of copies of the Application on a cloud network for use by an unlimited number of Authorized Users; (ii) have an unlimited number of Authorized Users access and use the Application by any means whatsoever, including via the internet or any WAN, LAN, or VPN, from any other device; (iii) generate print, copy, download and store all Commonwealth Data, information, and content, including all audio, visual, or digital and other displays and output, as may result from any execution or other use of the Application; (iv) prepare and use a reasonable number of copies of the Application and related Vendor Documentation as may be necessary or useful for the Permitted Use, including for purposes of: (u) operation with other software or systems; (v) hardware or system maintenance or repair; (w) software, hardware, or system testing; (x) disaster recovery; and (y) backup and archiving; and (z) to perform, and have Authorized Users perform, any other act, including the provision of any service, that is reasonably incidental to the operation of the Application for the Permitted Use.

(b) License and Access Restrictions. Except as the Agreement expressly permits, or as reasonably necessary to make any use of the Application permitted by this Section 3.1.2 or elsewhere in the Agreement, EOHHS/Soldiers’ Homes shall not, and shall not permit others to: (1) modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of the Application except as expressly permitted by the Agreement; (2) rent, lease, lend, sell, distribute, publish, or otherwise make the Application available to any third party; or (3) reverse engineer, disassemble, decompile, decode, or adapt the Application, or otherwise attempt to derive or gain access to the source code of the Application, in whole or in part, except as and only to the extent: (u) this restriction is prohibited by applicable law; (v) such action is taken for purposes of ensuring or assessing interoperability or otherwise qualifies as a “fair use” under US Copyright Act or other applicable Law or; (w) with respect to open source components included in the Application, these acts are permitted under the applicable open source license.

(c) Grant of Use and Access for Authorized Users. Use and Access of the Application for Authorized Users will vary depending upon the specific user need and will be determined solely by EOHHS/DVS Project Manager. Authorized Users may include internal Soldiers’ Homes and EOHHS users (including third party service providers and vendors, as well as other agencies and programs within EOHHS and the Commonwealth), third party provider users and public users with read-only access. Vendor is responsible for providing Authorized Users with access in accordance with its obligations as set forth in the applicable Project Plan, including credential requirements and response time, based upon the instruction of EOHHS/DVS Project Manager.

Hosting Services Vendor shall provide EOHHS/Soldiers’ Homes with [Vendor-hosted]/[Vendor-managed hosting] services for the Application and SLA Commitments as set forth in Attachment X.

Maintenance and Support Services Vendor shall provide maintenance and support services with the Deliverables and Milestones as set forth in Attachment X.

Term The SOW shall have an initial term of five (5) years from the Effective Date, and may be extended for an additional ten (10) years, in any time increment, at the discretion of EOHHS/Soldiers’ Homes (collectively, the “Term”).

Survival Notwithstanding the foregoing, the provisions of this Agreement which by their nature would continue beyond any termination or expiration of this Agreement, which shall include Section 5.1 Application Security, Section 5.2 Warranty, and Section 5.5 Title and Intellectual Property Rights, shall survive the expiration or any termination of this SOW to the extent necessary to permit their complete fulfillment or discharge.

PROJECT MANAGEMENT

Project Managers Vendor and EOHHS/Soldiers’ Homes must notify the other Party’s Project Managers of any change in the name, address, phone number, fax number, or email address of their respective Project Manager.

EOHHS/DVS Project Manager Project management of this engagement will be performed by the Soldiers’ Homes. The EOHHS/DVS Project Manager will:

· Provide, as a part of the project kick-off, a list of relevant EOHHS, DVS and Soldiers’ Homes staff with titles, areas of responsibility, telephone numbers, and e-mail addresses

· Work closely with the Vendor’s Project Manager to ensure successful completion of the project

· Consult with the Vendor’s Project Manager to revise and manage the project management plan

· Review weekly status reports and schedule weekly meetings with Vendor, as necessary

· Perform an active Quality Assurance role

· Coordinate participation from other agencies and/or Vendor as required during the engagement

· Acquire the EOHHS/DVS and Soldiers’ Homes’ project team members as needed

· Coordinate EOHHS/DVS and Soldiers’ Homes’ review of the Deliverables/Tasks and sign an acceptance form to signify acceptance for each accepted Deliverable

· Provide advance notice when presentations by the Vendor are requested by EOHHS/Soldiers’ Homes management The EOHHS/DVS Project Manager reports to the Secretary of the Department of Veterans Services. The Secretary of the Department of Veterans Services, or his/her designee, will sign this SOW and all amendments hereto on behalf of EOHHS/DVS.

Vendor’s Project Manager The Vendor’s Project Manager will:

· Serve as an interface between EOHHS/DVS Project Manager and all Vendor personnel participating in this engagement

· Develop and maintain a project management plan, in consultation with EOHHS/DVS Project Manager

· Facilitate regular communication with EOHHS/DVS Project Manager, including weekly status reports/updates, and review the project performance against the Project Plan

· Facilitate regular communication with EOHHS IT Project Manager, or their designee, as needed

· Facilitate weekly project status meetings for the duration of the engagement

· Update the Project Plan on a weekly basis and distribute at weekly meetings for the duration of the engagement

· Sign acceptance forms to acknowledge their receipt from EOHHS/Soldiers’ Homes

· Be responsible for the management and deployment of Vendor personnel Vendor’s Project Manager reports to [TO INSERT]. [TO INSERT], being an authorized signatory named in Vendor’s response to RFR, will sign this SOW and all amendments thereto on behalf of Vendor.

EOHHS IT Project Manager Technical Resource project management of this engagement will be performed by the EOHHS IT Project Manager, or their designee. EOHHS IT Project Manager, or their designee, will:

· Work closely with the EOHHS/DVS Project Manager to ensure successful completion of the project

· Support coordination of all EOHHS resources including agreed upon dates and milestones

· Support alignment with EOHHS IT entities to support alignment of vendor configuration with EOHHS standards EOHHS/DVS Contract Officer In addition to the EOHHS/DVS EOHHS/DVS Project Manager, the EOHHS/DVS shall designate a Contract Officer, who shall be:

Name: Robert Engell Title: Interim Administrator Address: 600 Washington Street, 7th Floor Address: Boston MA 02111 Email address: Robert.engell@mass.gov The EOHHS/DVS Contract Officer shall be authorized and empowered to represent the EOHHS/DVS with respect to all matters relating to this Agreement. Any change to the EOHHS/DVS Contract Officer shall be made in a written notice to the Vendor.

Vendor’s Status Reports Vendor shall submit status reports to the EOHHS/DVS Project Manager, and/or the EOHHS/DVS Contract Officer, as designated by EOHHS/Soldiers’ Homes. The status reports shall be delivered every other week.

Upon submission of each status report, Vendor shall certify that, during the period for which the status report applies, Vendor is unaware of any EOHHS/Soldiers’ Homes’ action or inaction that has caused or will cause any changes to the project or Deliverables timeline, scope, or cost. If Vendor believes that EOHHS/Soldiers’ Homes has caused or will cause such delay or change to scope or cost, Vendor shall describe such activity and its potential impact on the project or Deliverables in writing in the applicable status report.

Issue Resolution The Project Managers from each organization bear the primary responsibility for ensuring issue resolution. If they mutually agree that they are unable to resolve an issue, they shall escalate the issue to the EOHHS/Soldiers’ Homes’ [name and title here] and Vendor’s [name and title] for consideration.

Amendments and Change Orders This Agreement may be amended prior to the end of the Term and Vendor and EOHHS/Soldiers’ Homes may agree, from time to time during the Term, to execute amendments to the scope of work or Change Orders, which, when signed by the authorized representatives of each of the Parties, will be deemed incorporated herein by reference. Either Party may elect to submit Change Requests, including Change Requests resulting from changes in law, to the other Party to propose Changes, including, without limitation, changes to the scope, Services, or schedule. Vendor will make a good faith effort to accommodate Change Requests that are the result of any change in applicable laws, rules or regulations or changes needed to implement a legislative action, a legislative request, executive order, or judicial decision that requires a change to the Application and/or Services.

a) Change Requests shall be submitted in writing to the other Party and shall contain a sufficient level of detail to permit the other Party to properly evaluate the Change Request. The Parties will mutually decide whether the Change Order Form is sufficient to document the Change Order, or if an Amendment to the Agreement is necessary. If the Parties determine it is necessary, they will amend the Agreement.

b) Change Requests may only be submitted by EOHHS/DVS Project Manager and/or Vendor’s Project Manager.

c) The Project Managers will jointly determine whether the change impacts any terms contained within the Agreement.

d) Neither Party will be entitled to or obligated by a Change Request or Amendment until it has been presented and approved by both Parties in accordance with the above-mentioned procedures. Work performed by either Party to prepare, analyze and respond to a Change Request shall not be chargeable to the other Party hereunder.

e) Where one Party has submitted a Change Request and mutual agreement cannot be reached between the Parties with respect to the change within fifteen (15) Business Days of the Party’s receipt of the Change Request, Vendor shall continue to provide the Services as stated in this Agreement, and the Party may submit such matter for issue resolution in accordance with this SOW.

Vendor acknowledges that this Agreement does not constitute a retainer and that Soldiers’ Homes is not required to enter into any amendments or Change Orders with Vendor subsequent to the initial work described in this SOW.

For any amendment entered into under this Agreement where Vendor will be providing services on a Time and Materials basis, the Parties shall apply the Time and Materials terms as described in Section 7.5 of this SOW to the relevant Change Order or amendment.

Key Personnel Vendor agrees to provide the following key personnel for the following amounts of time for the duration of this project:

TABLE 1

KEY VENDOR PERSONNEL

Vendor will assign all of the foregoing personnel to this engagement on the time basis set forth in Table 1. In the event that a change is necessary, the Vendor Project Manager will provide prompt written notice to the EOHHS/DVS Project Manager of the proposed change. If a personnel change is necessary and a result of a non-emergency, two weeks’ prior written notice shall be provided by Vendor Project Manager to the EOHHS/DVS Project Manager. For personnel changes that result from an emergency, prompt written notice shall be provided by Vendor Project Manager. The EOHHS/DVS Project Manager has the right to interview all current and prospective Vendor personnel and accept or reject all personnel.

Approval of Key Personnel Vendor will assign all of the personnel to this engagement as identified as Key Personnel in RFR Section 5.1.

EOHHS/Soldiers’ Homes will have final approval of staff proposed for ‘Key Personnel.’ Over the term of the Agreement, including any extension, Vendor shall take no action inconsistent with the terms of the RFR and Vendor’s Response thereto regarding the availability and assignment of named individuals to positions identified as Key Personnel, without the prior written approval of the EOHHS/DVS Project Manager. If any Key Personnel become unavailable, Vendor shall notify the EOHHS/DVS Project Manager immediately and provide the name(s) and résumé(s) of suitable replacement(s). Vendor shall, upon EOHHS/Soldiers’ Homes’ request, replace any staff. If requested by EOHHS/Soldiers’ Homes, Vendor shall make proposed replacements available for interview by EOHHS/Soldiers’ Homes. If EOHHS/Soldiers’ Homes are not reasonably satisfied that a proposed replacement has comparable ability and experience, then EOHHS/Soldiers’ Homes shall so notify Vendor in writing as soon as possible, but no longer than within five (5) Business Days after receiving the résumé and completing any interview, whereupon Vendor shall propose another replacement for approval. The process shall be repeated until a proposed replacement is approved by EOHHS/Soldiers’ Homes.

Equipment, Workspace, Office Supplies EOHHS/Soldiers’ Homes will provide reasonable workspace, standard office equipment, and standard network connectivity provided to state employees for Vendor team members working on-site for activities defined in this Agreement. Vendor will provide a written list of those project staff that require access to the Commonwealth of Massachusetts’ information systems, including the dates each staff member will need access. At EOHHS’/Soldiers’ Homes’ request, project staff granted network connectivity will be required to review and sign a Network Access Request Form and Acceptable Use Policy. Any Vendor employees who have access to IT resources must comply with the “Acceptable Use Policy” (see https://www.mass.gov/orgs/executive-office-of-technology-services-and-security) or any alternative Acceptable Use Policy adopted by the EOHHS/ Soldiers’ Homes. Except as needed to perform the services hereunder, Vendor project staff will not access, modify, or otherwise conduct activity affecting the Soldiers’ Homes’ information systems without the prior approval of EOHHS/Soldiers’ Homes. Vendor shall immediately notify the EOHHS/DVS Project Manager of any staff who no longer requires access rights as originally requested, or whose employment as part of the project staff is terminated, so that EOHHS/Soldiers’ Homes may terminate such person’s access rights.

Intellectual Property and Work Effort Agreement for Vendor's Employees, Vendor’s and Consultants and Agents Vendor shall ensure that each of Vendor personnel providing services under this SOW, regardless of whether the individual is an employee, contractor, or agent of Vendor, shall, prior to rendering any services under this SOW, sign the “Intellectual Property and Work Effort Agreement for Vendor’s Employees, Contractors, Consultants, and Agents” (the “IPAWE Agreement”) which is attached hereto as Exhibit A. Vendor shall return the signed copies of the IPAWE Agreement to the EOHHS/DVS Project Manager prior to the rendering of any services under this SOW.

ADA Accessibility Pursuant to the requirements in RFR Section 2.3.2 A3 Accessibility, Vendor shall ensure that all Deliverables adhere to the Enterprise Information Technology Accessibility Policy issued by the Massachusetts’ Executive Office of Technology Services and Security available at Enterprise Information Technology Accessibility Policy | Mass.gov.

Corrective Action Plan At any point during the Agreement, if EOHHS/Soldiers’ Homes identify, in their sole judgment, any deficiency in Vendor’s performance under the Agreement, EOHHS/Soldiers’ Homes may require Vendor to develop a corrective action plan to correct such deficiency. Vendor must submit any such corrective action plan to the EOHHS/DVS Project Manager and must, within three (3) Business Days of the request, implement such corrective action plan only as approved or modified by EOHHS/Soldiers’ Homes. Under such corrective action plan, EOHHS/Soldiers’ Homes may require Vendor to:

· Subcontract with a material subcontractor deemed satisfactory by EOHHS/Soldiers’ Homes to perform certain Agreement responsibilities at no additional cost to EOHHS/Soldiers’ Homes

· Otherwise alter the manner or method in which Vendor performs certain Agreement responsibilities at no additional cost to EOHHS/Soldiers’ Homes; and

· Implement, at no additional cost to EOHHS/Soldiers’ Homes, any other action that EOHHS/Soldiers’ Homes may deem appropriate Policy Determinations EOHHS/Soldiers’ Homes shall make and determine all policy relating to design, configuration, implementation, testing and operations. Vendor may request of the EOHHS/DVS Contract Officer in writing that the Soldiers’ Homes issue policy determinations or operating guidelines required for proper performance of the Agreement, in which event the EOHHS/DVS Contract Officer will deliver to Vendor a written reply within ten (10) Business Days of receipt of Vendor’s request. Vendor must be entitled to rely upon and act in accordance with such policy determinations and operating guidelines, unless and until they are superseded, suspended, or revoked, so long as it does not act negligently, maliciously, fraudulently, or in bad faith.

ADDITIONAL TERMS

Application Security As set forth in RFR Attachment B Technical Requirements, as part of its work efforts under this SOW, Vendor will be required to use Commonwealth Data and IT resources. For purposes of this work effort, “Commonwealth Data” shall mean data provided by EOHHS/Soldiers’ Homes to Vendor, which may physically reside at a Commonwealth, EOHHS or Soldiers’ Homes or Vendor location.

Commonwealth Data In connection with Commonwealth Data, Vendor will implement commercially reasonable safeguards necessary to:

5.1.1.1 Prevent unauthorized access to Commonwealth Data from any public or private network;

5.1.1.2 Prevent unauthorized physical access to any information technology resources involved in the development effort; and

5.1.1.3 Prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

Commonwealth Personal Data Vendor agrees to prevent the unauthorized use and disclosure of confidential and personally identifiable data, pursuant to the terms set forth in the Data Management and Confidentiality Agreement (DMCA) attached hereto as Exhibit B. As set forth in the DMCA, Vendor shall comply with all state and federal laws and regulations relating to confidentiality and privacy.

In addition to the above requirements for Commonwealth Data, Vendor may be required to use Commonwealth personal data under MGL Ch. 66A and/or personal information under MGL Ch. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified Tasks, and such personal data shall be considered as “Commonwealth Data” as defined herein. For purposes of this work effort, electronic personal data and personal information includes data provided by EOHHS/Soldiers’ Homes to Vendor which may physically reside at a location owned and/or controlled by the Commonwealth, EOHHS or Soldiers’ Homes or Vendor. In connection with electronic personal data and personal information, Vendor shall implement the maximum feasible safeguards reasonably needed to:

5.1.2.1 Ensure the security, confidentiality and integrity of electronic personal data and personal information;

5.1.2.2 Prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network; and

5.1.2.3 Notify EOHHS/Soldiers’ Homes immediately if any breach of such system (including the Application) or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

Software Integrity Controls Address the following controls if applicable, usually in the case wherein Vendor will be developing code and migrating that code to a production environment.

Vendor and EOHHS/Soldiers’ Homes recognize the serious threat of fraud, misuse, and destruction or theft of data or funding. These threats could be introduced when unauthorized or inappropriate modifications are made to a production system. Vendor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software creation life cycle, including during development, testing, and production:

5.1.3.1 Vendor shall configure Application in accordance with the required software and systems environments as set forth in the RFR.

5.1.3.2 Vendor shall implement a change management procedure to ensure that activities in the non-production environments remain separate and distinct from the production environment. In particular, the change management procedure shall incorporate at least the following:

5.3.2.1.1 Segregates duties between development and testing of software changes and migration of changes to the production environment.

5.3.2.1.2 Implements security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment.

5.3.2.1.3 Includes a process to log and review all source control activities.

5.1.3.3 Vendor shall implement a source control tool to ensure that all changes made to the Application production system are authorized, tested, and approved before migration to the production environment.

5.1.3.4 Vendor shall not make any development or code changes in a production environment.

5.1.3.5 Vendor shall implement additional internal controls as specified by EOHHS/Soldiers’ Homes.

Compliance with NIST SP800-53 Standards

a) As of the Effective Date and during the Term, the Vendor shall implement administrative, physical and technical safeguards to protect information it receives under this Agreement that are no less rigorous than accepted industry practices including the current National Institute of Standards and Technology (NIST) Special Publications (SP) standard: 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations, moderate security control baseline (“Standards”).

i) In the event Vendor is unable to fully comply with the Standards on the Effective Date, Vendor must submit to the EOHHS IT Project Manager, or their designee, a gap analysis detailing with which parts of the Standards Vendor is unable to comply and a Plan of Actions and Milestones (“POAM”), providing an overview of the reasonable effort and time required to comply with the Standards. EOHHS/Soldiers’ Homes may review the gap analysis and proposed POAM with Vendor and the parties will agree to a timeline for implementation of the Standards and/or correction of any deficiencies that are in EOHHS/Soldiers’ Homes’ opinion material that is mutually acceptable to the parties (“Implementation Timeline”). EOHHS/Soldiers’ Homes may meet with Vendor from time to time and/or as deadlines to correct deficiencies approach and/or come due and review the POAM, Implementation Timeline, and any other documentation requested by EOHHS/Soldiers’ Homes with Vendor to determine Vendor’s compliance with such documents and assess what further actions need to be taken. In the event EOHHS/Soldiers’ Homes is assessed any fine, penalty, or monetary damages as a result of a finding or judgment based in whole or in part on Vendor’s non-compliance with the Standards, inability to meet any part of the Implementation Timeline, inability to abide by the POAM, or any misstatements or omissions in the POAM, (“Liabilities”) Vendor will indemnify EOHHS/Soldiers’ Homes for any such Liabilities and EOHHS/Soldiers’ Homes will be entitled to reimbursement from the Vendor for any such Liabilities. If, in EOHHS/Soldiers’ Homes’ determination, Vendor demonstrates an inability to meet any part of the Implementation Timeline, inability to abide by the POAM, or any misstatements or omissions in the POAM, EOHHS/Soldiers’ Homes may pursue remedies specified elsewhere in this Agreement including, but not limited to, seeking monetary damages and/or terminating the Agreement in whole or in part.

b) On an annual basis, Vendor must internally review their compliance with the Standards and create an assessment report based on the findings of such internal review. Vendor must submit the assessment report and an updated POAM to Soldiers’ Homes.

c) Vendor understands that it is solely responsible for meeting the security standards in this Section a. EOHHS/Soldiers’ Homes’ review of any gap analysis and/or POAM, or any such discussions related to the gap analysis and/or POAM, shall not constitute approval by EOHHS/Soldiers’ Homes of their contents and will not otherwise operate to indemnify, remove liability, or otherwise absolve Vendor of any responsibility for non-compliance with the Standards.

d) In the event Vendor is unable to fully comply with the Standards by the Effective Date, Vendor shall prioritize remediation of Standards controls based on agreed-upon risk ratings.

e) If Vendor does host any Commonwealth Data or other data on behalf of EOHHS/Soldiers’ Homes, in addition to the foregoing security requirements, as of the Effective Date, Vendor must either be capable of providing or have subcontracted with a hosting company to provide a server environment that meets the Uptime Institute’s standards for Tier 3 data center certification. Vendor must within a time mutually agreed to by the parties in the Implementation Timeline provide a server environment that meets the Uptime Institute’s standards for Tier 4 data center certification and which is FEDRAMP compliant and is able to be FEDRAMP certified (collectively the “Hosting Standards”).

f) Vendor must ensure the technical services are hosted on servers owned, operated, housed, maintained by Vendor or its hosting company, and located within the continental United States.

g) Once every two years, starting two years after the Effective Date, and at no additional cost to EOHHS/Soldiers’ Homes, have conducted by an independent third-party auditor an audit, such as an SSAE-16 SOC 2 audit, of Vendor’s compliance with the Standards and Hosting Standards including, but not limited to, an audit of the Vendor’s facilities and hosting facilities and provide the EOHHS IT Project Manager, or their designee, the results of such audit. In the event the results of such audit demonstrate that Vendor’s systems (including the Application) and protections with regards to data security or privacy are insufficient to meet the requirements of the Standards and the Hosting Standards, Vendor must submit an updated POAM that addresses such deficiencies EOHHS/Soldiers’ Homes may review the audit results and POAM with Vendor and may develop an Implementation Timeline.

h) On at least a semiannual basis and at no additional cost to EOHHS/Soldiers’ Homes, have conducted by an independent third-party testing company a vulnerability assessment of Vendor’s computing environment. Such vulnerability assessment shall include a penetration test, using industry-standard methodology, of Vendor’s computing environment. Vendor must provide the EOHHS IT Project Manager, or their designee, the findings of the vulnerability assessment and penetration test. If the findings demonstrate security vulnerabilities in Vendor’s computing environment, Vendor must submit an updated POAM that addresses such deficiencies. EOHHS/Soldiers’ Homes may review the audit results and POAM with Vendor and may develop an Implementation Timeline.

Notwithstanding the foregoing, nothing contained herein this section shall abrogate or restrict EOHHS/Soldiers’ Homes’ ability to audit and inspect Vendor’s facility, hosting facility or books and records, including but not limited to Vendor’s Information Security Plan, business continuity plan, disaster recovery plan, or other documentation required to be maintained by the Standards or otherwise in this Agreement. Such audit and/or inspection shall be conducted with reasonable notice and during Vendor’s standard business hours.

Warranty Vendor makes the following warranties with respect to any Deliverables/Tasks delivered under this Agreement:

a. By appropriately qualified and trained personnel;

b. With due care and diligence and to a high standard of quality as is customary in the industry;

c. In compliance with the Project Plan and the terms and conditions of this Agreement; and

d. In accordance with all applicable professional standards for the field of expertise;

Documentation provided by Vendor under this Agreement shall be in sufficient detail so as to allow suitably skilled, trained, and educated the Soldiers’ Homes personnel to understand the operation of the Deliverables. Vendor shall promptly, at no additional cost to EOHHS/Soldiers’ Homes make corrections to any documentation that does not conform to this warranty;

Cooperation with Other Parties Vendor represents, warrants and undertakes that it will use commercially reasonable efforts to cooperate with any third-party providers or users, whether selected by Vendor or EOHHS/Soldiers’ Homes and including but not limited to those third-party providers that may be required of EOHHS/Soldiers’ Homes in connection with its funding for the Services, as may be required in connection with its provision or support of the Services under this Agreement.

Additional Notification and Remedial Requirements Any of the following events may, in EOHHS/Soldiers’ Homes’ sole judgment, constitute a substantial breach by Vendor, if due to any action or inaction on the part of Vendor or its subcontractor(s): (a) failure to complete to the satisfaction of Vendor the required Milestones for each phase of the Services (configuration, implementation, and optional operations) within the completion times specified; or (b) inability to continue Application operations without repeated or lengthy interruptions to normal business operations; or (c) failure of Vendor to continue to conduct business in the normal course, or the making of a general assignment for the benefit of creditors, or the appointment of a receiver for all or substantially all of its business assets, or the filing of a voluntary or involuntary petition in bankruptcy; provided that in the event of an involuntary petition, Vendor shall not have been able to obtain a dismissal of the petition within thirty (30) Calendar Days after the date of filing. Vendor agrees to provide advance notice of the potential initiation of any one of the above actions through a written special status reports within three (3) Business Days upon written request by EOHHS/Soldiers’ Homes in response to particular problems identified by EOHHS/Soldiers’ Homes in the performance of work performed under the Agreement. Each report, signed by Vendor’s Project Manager, shall include a description of the problem, the reason(s) the problem occurred, corrective action plan(s) proposed to prevent the problem(s) from recurring and an implementation date for the corrective action plan(s). This is to occur no later than three (3) Calendar Days from the date of its discovery of any problem that may jeopardize the successful or timely completion of its obligations, notify EOHHS/Soldiers’ Homes in writing of the problems, including in such notice Vendor’s recommendation for expeditious resolution of the problem.

Title and Intellectual Property Rights Definition of Property The term “Property” as used herein includes the following forms of property: (1) confidential, proprietary, and trade secret information; (2) trademarks, trade names, discoveries, inventions processes, methods and improvements, whether or not patentable or subject to copyright protection and whether or not reduced to tangible form or reduced to practice; and (3) works of authorship, wherein such forms of property are required by Vendor to develop, test, and install the any product to be developed that may consist of computer programs (in object and source code form), scripts, data, documentation, the audio, visual and audiovisual content related to the layout and graphic presentation of the quality patient safety system or any component part or module, text, photographs, video, pictures, animation, sound recordings, training materials, images, techniques, methods, algorithms, program images, text visible on the Internet, HTML code and images, illustrations, graphics, pages, storyboards, writings, drawings, sketches, models, samples, data, other technical or business information, reports, and other works of authorship fixed in any tangible medium.

Vendor Property and License Vendor will retain all right, title and interest in and to all Property developed by it, i) for clients other than the Commonwealth, and ii) for internal purposes and not yet delivered to any client, including all copyright, patent, trade secret, trademark and other intellectual property rights created by Vendor in connection with such work (hereinafter the “Vendor Property”). EOHHS/Soldiers’ Homes acknowledge that its possession, installation or use of Vendor Property will not transfer to it any title to such property. “Vendor Property” also includes Vendor’s proprietary tools, methodologies and materials developed prior to the performance of Services and used by Vendor in the performance of its business and specifically set forth in this SOW and which do not contain, and are not derived from, EOHHS/Soldiers’ Homes’ Confidential Information (including as defined in Exhibit A to this SOW), EOHHS/Soldiers’ Homes’ Property or the Commonwealth Data. EOHHS/Soldiers’ Homes acknowledge that Vendor Property contains or constitutes commercially valuable and proprietary trade secrets of Vendor, the development of which involved the expenditure of substantial time and money and the use of skilled development experts. EOHHS/Soldiers’ Homes acknowledge that Vendor Property is being disclosed to EOHHS/Soldiers’ Homes to be used only as expressly permitted under the terms herein.

Except as expressly authorized herein, EOHHS/Soldiers’ Homes will not copy, modify, distribute or transfer by any means, display, sublicense, rent, reverse engineer, decompile or disassemble Vendor Property.

Vendor grants to EOHHS/Soldiers’ Homes, a fully-paid, royalty-free, non-exclusive, non-transferable, worldwide, irrevocable, perpetual, assignable license to make, have made, use, reproduce, distribute, modify, publicly display, publicly perform, digitally perform, transmit, copy, sublicense to any EOHHS/Soldiers’ Homes’ subcontractor for purposes of creating, implementing, maintaining or enhancing a Deliverable, and create derivative works based upon Vendor Property, in any media now known or hereafter known, to the extent the same are embodied in the Deliverables, or otherwise required to exploit the Deliverables. During the Term of this Agreement and immediately upon any expiration or termination thereof for any reason, Vendor will provide to EOHHS/Soldiers’ Homes the most current copies of any Vendor Property to which EOHHS/Soldiers’ Homes has rights pursuant to the foregoing, including any related Documentation.

Notwithstanding anything contained herein to the contrary, and notwithstanding EOHHS/Soldiers’ Homes’ use of Vendor Property under the license created herein, Vendor shall have all the rights and incidents of ownership with respect to Vendor Property, including the right to use such property for any purpose whatsoever and to grant licenses in the same to third parties. Vendor shall not encumber or otherwise transfer any rights that would preclude a free and clear license grant to the Commonwealth.

Commonwealth Property In conformance with the Commonwealth Terms and Conditions for Information Technology Contracts, all Deliverables created under this Agreement whether made by Vendor, subcontractor or both are the property of EOHHS/Soldiers’ Homes, except for the Vendor Property embodied in the Deliverable.