Soldiers Homes EMR RFR_Attachment F_Model SOW.docx

STATEMENT OF WORK

BETWEEN

THE COMMONWEALTH OF MASSACHUSETTS

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES’

DEPARTMENT OF VETERANS’ SERVICES’

CHELSEA SOLDIERS’ HOME

AND

[CONTRACTOR]

FOR

THE SOLDIERS’ HOMES ELECTRONIC MEDICAL RECORD (EMR) SYSTEM

INTRODUCTION

The following document will serve as a statement of work (“SOW”) between the Commonwealth of Massachusetts Executive Office of Health and Human Services (“EOHHS”)’ Department of Veterans’ Services’ Chelsea Soldiers’ Home (“Soldiers’ Home”) and [Contractor] (“[Contractor]” or “Vendor”) to apply to work related to the Soldiers’ Homes Electronic Medical Record (EMR) System. The entire agreement between the parties (the “Agreement”) consists of the following documents in the following order of precedence: (1) the Commonwealth Terms & Conditions; (2) the Commonwealth’s Standard Contract Form; (3) the Request for Response (Document # 21EHSKAEMRSYSTEM) (“RFR”); (4) this SOW, and any other documents negotiated between the Parties; and (5) [Contractor]’s response to the RFR. The documents comprising the Agreement supersede all prior written or verbal negotiations and statements. This SOW shall not be modified by any subsequent written or verbal communications other than in accordance with Section 4.5, Amendments and Change Orders. By signing the attached Standard Contract Form, the Parties represent that they are duly authorized to execute this Statement of Work on behalf of their respective organizations.

DEFINITIONS

The terms used in this SOW, unless defined in this SOW or in an amendment made hereto, shall have the meaning ascribed to them in the other documents that constitute the Agreement between the Parties.

Application: means the [Contractor]-owned or licensed Electronic Medical Record (EMR) System, as well as any third-party components or open source software contained therein, and any updates, upgrades, releases or enhancements thereto.

Business Day: means any weekday on which Commonwealth or [Contractor] resources, respectively, are expected to report to work.

Calendar Day: Any day of the week regardless of whether work is performed, including weekends and holidays.

Centers for Medicare and Medicaid Services (CMS): The agency within the U.S. Department of Health and Human Services that is responsible for oversight of the federal Medicare and the state Medicaid programs.

Change Order or Change Request: A written amendment to the SOW, directing [Contractor] to change the contract price, Requirements, or project schedule. Such changes must be within the scope of this SOW and the RFR.

Commonwealth Data: All data used or owned by the Soldiers’ Homes or the Commonwealth to which the [Contractor] gains access through its contractual obligations under this SOW.

Deliverable: Any work product that [Contractor] delivers for the purposes of fulfilling its contractual obligations.

Disaster: A malfunctioning of a critical component without which the system is unavailable to provide the function and features required by the Agreement.

Disaster Recovery: The procedures required to ensure continued business operations through adequate alternative facilities, equipment, back-up files, and documentation in the event that a Disaster is declared.

Domiciliary services: The Domiciliary services are designed to function largely as a stepping stone to independence: veterans often come from homelessness, many needing a sober-living environment, and the domiciliary is set up as a place where they can stay to get back on their feet.

Downtime: Any period of time where Soldiers’ Homes users cannot access any portion of the system.

Effective Date: The date of the last Party’s signature on the Standard Contract Form.

Electronic Medical Record System (EMR): A system of records and interconnected functionality that is an electronic version of a patient’s medical history. The system is maintained by providers over time and may include all of the key administrative clinical data relevant to that person’s care, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The EMR automates access to information and has the potential to streamline the clinician's workflow. The EMR also has the ability to support other care-related activities directly or indirectly through various interfaces, including evidence-based decision support, quality management, and outcomes reporting.

Executive Office of Health and Human Services or EOHHS: A secretariat-level executive agency under the Governor of Massachusetts. EOHHS oversees 16 constituent agencies, including the Department of Veterans’ Services, and in addition to the Chelsea and Holyoke Soldiers’ Homes and the MassHealth program.

EOHHS IT: EOHHS’ Information Technology Unit that provides a range of centralized IT services for EOHHS and the Soldiers’ Homes.

Executive Office of Technology and Security Services or EOTSS: Formerly the Massachusetts Office of Information Technology, EOTSS provides a range of centralized IT services; oversees IT policies, standards and architecture; and promotes cross-agency collaboration and adoption of shared services.

Full-Time Equivalent (FTE): An individual who works forty hours per week or individuals who work in aggregate forty hours per week.

Key Personnel: Personnel directly responsible for management of the contract; or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the contract.

MassHealth: The medical assistance or benefit program administered by EOHHS pursuant to M.G.L. c.118E and Title XIX of the Social Security Act (42 USC 1396) and other applicable laws and waivers to furnish and pay for medical services for eligible individuals. MassHealth pays for health care for certain low- and medium-income people living in Massachusetts, including a program for individuals who are HIV positive. MassHealth also manages the Insurance Partnership for small businesses, the Children's Medical Security Plan, Healthy Start, and the Special Kids/Special Care Pilot Program, cosponsored with the Department of Social Services.

Party or Parties: As applicable, one or both of [Contractor] or Soldiers’ Homes.

Patient/Client: The individual receiving services or care.

Project Managers: Individuals from EOHHS, Soldiers’ Homes and [Contractor] identified and designated as Project Managers who shall perform project management on behalf of EOHHS/Soldiers’ Homes and [Contractor] under this SOW.

Project Plan: means the schedule, or services of schedules, setting forth the sequence of events for the performance of Services, including the milestones and milestone dates.

Provider: A provider that furnishes medical services.

Request for Response or RFR: The RFR (document number 21EHSKAEMRSYSTEM) procurement specification and referenced documents.

Requirements: The technical and functional requirements for the Soldiers’ Homes’ EMR incorporated into Section 2 of the RFR.

Security: Refers to the processes, methodologies, and means which are designed and implemented to protect information systems and information - including print, electronic, or any other form of confidential, private and sensitive information or data - from unauthorized access, use, misuse, disclosure, destruction, modification or disruption, which includes but is not limited to the ability to authenticate and authorize users to provide secure access to the system in a traceable (auditable) manner.

Services: The activities engaged in by [Contractor] for the purpose of fulfilling its obligations under the terms of this SOW, which may or may not result in the creation of a Deliverable as further set forth in Section 3.1.

Soldiers’ Homes: Refers collectively to Chelsea Soldiers’ Home and Holyoke Soldiers’ Home. Chelsea Soldiers’ Home is the single Commonwealth party to this SOW; however, [Contractor]’s Application and related services will serve both Soldiers’ Homes. “Soldiers’ Homes” is used to collectively refer to the Commonwealth entities served by this SOW.

SureScripts: National e-prescription network Task: A material activity engaged in by [Contractor] for the purpose of fulfilling its obligations to the Soldiers’ Homes under the terms of this SOW, which may or may not result in the creation of a Deliverable.

OVERVIEW, EFFECTIVE DATE AND TERM

Services On behalf of Chelsea Soldiers’ Home and Holyoke Soldiers’ Home (collectively referred to herein as “the Soldiers’ Homes”), Chelsea Soldiers’ Home has engaged [Contractor] to provide implementation and maintenance and support services for a comprehensive electronic medical records (EMR) system for the Soldiers’ Homes as set forth in this SOW.

Implementation Services [Contractor] shall provide implementation services with the Deliverables and Milestones as set forth in the Project Plan in [Attachment X].

Application License Grant [Contractor] shall provide Soldiers’ Homes the rights to access the Application as follows:

(a) Application Access Rights. [Contractor] hereby grants to Soldiers’ Homes a non-exclusive, royalty-free, irrevocable, transferable and sublicensable license for the Term to access and use the Application and related [Contractor] Documentation for the Permitted Use in accordance with the terms and conditions of the Agreement. Soldiers’ Homes, for itself and its Authorized Users, has the right and license to do each of the following for or in connection with the Permitted Use: (i) install, execute, and run an unlimited number of copies of the Application on a cloud network for use by an unlimited number of Authorized Users; (ii) have an unlimited number of Authorized Users access and use the Application by any means whatsoever, including via the internet or any WAN, LAN, or VPN, from any other device; (iii) generate print, copy, download and store all Commonwealth Data, information, and content, including all audio, visual, or digital and other displays and output, as may result from any execution or other use of the Application; (iv) prepare and use a reasonable number of copies of the Application and related [Contractor] Documentation as may be necessary or useful for the Permitted Use, including for purposes of: (u) operation with other software or systems; (v) hardware or system maintenance or repair; (w) software, hardware, or system testing; (x) disaster recovery; and (y) backup and archiving; and (z) to perform, and have Authorized Users perform, any other act, including the provision of any service, that is reasonably incidental to the operation of the Application for the Permitted Use.

(b) License and Access Restrictions. Except as the Agreement expressly permits, or as reasonably necessary to make any use of the Application permitted by this Section 3.1.2 or elsewhere in the Agreement, Soldiers’ Homes shall not, and shall not permit others to: (1) modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of the Application except as expressly permitted by the Agreement; (2) rent, lease, lend, sell, distribute, publish, or otherwise make the Application available to any third party; or (3) reverse engineer, disassemble, decompile, decode, or adapt the Application, or otherwise attempt to derive or gain access to the source code of the Application, in whole or in part, except as and only to the extent: (u) this restriction is prohibited by applicable law; (v) such action is taken for purposes of ensuring or assessing interoperability or otherwise qualifies as a “fair use” under US Copyright Act or other applicable Law or; (w) with respect to open source components included in the Application, these acts are permitted under the applicable open source license.

(c) Grant of Use and Access for Authorized Users. Use and Access of the Application for Authorized Users will vary depending upon the specific user need and will be determined solely by Soldiers’ Homes Project Manager. Authorized Users may include internal Soldiers’ Homes and EOHHS users (including third party service providers and vendors, as well as other agencies and programs within EOHHS and the Commonwealth), third party provider users and public users with read-only access. [Contractor] is responsible for providing Authorized Users with access in accordance with its obligations as set forth in the applicable Project Plan, including credential requirements and response time, based upon the instruction of Soldiers’ Homes’ Project Manager.] Hosting Services [Contractor] shall provide the Soldiers’ Homes with [[Contractor]-hosted]/[[Contractor]-managed hosting] services for the Application and Specific Service Level Commitments as set forth in [Attachment X].

Maintenance and Support Services [Contractor] shall provide maintenance and support services with the Deliverables and Milestones as set forth in [Attachment X].

Term [Contractor] has held itself out to Chelsea Soldiers’ Home as qualified to provide such services under this SOW. The SOW shall have an initial term of five (5) years from the Effective Date, and may be extended for an additional ten (10) years, in any time increment, at the discretion of Chelsea Soldiers’ Home or the Commonwealth (collectively, the “Term”).

Survival Notwithstanding the foregoing, the provisions of this Agreement which by their nature would continue beyond any termination or expiration of this Agreement, which shall include Section 5.1 System Security, Section 5.2 Warranty, and Section 5.7 Title and Intellectual Property Rights, shall survive the expiration or any termination of this SOW to the extent necessary to permit their complete fulfillment or discharge.

PROJECT MANAGEMENT

Project Managers [Contractor] and Soldiers’ Homes must notify the other party’s Project Managers of any change in the name, address, phone number, fax number, or email address of their respective Project Manager.

Soldiers’ Homes’ Project Manager Project management of this engagement will be performed by the Soldiers’ Homes. The Soldiers’ Homes’ Project Manager will:

· Provide, as a part of the project kick-off, a list of relevant Soldiers’ Homes staff with titles, areas of responsibility, telephone numbers, and e-mail addresses

· Work closely with the [Contractor]’s Project Manager to ensure successful completion of the project

· Consult with the [Contractor]’s Project Manager to revise and manage the project management plan

· Review weekly status reports and schedule weekly meetings with [Contractor], as necessary

· Perform an active Quality Assurance role

· Coordinate participation from other agencies and/or [Contractor] as required during the engagement

· Acquire the Soldiers’ Homes’ project team members as needed

· Coordinate the Soldiers’ Homes’ review of the Deliverables/Tasks and sign an acceptance form to signify acceptance for each accepted Deliverable

· Provide advance notice when presentations by the [Contractor] are requested by the Soldiers’ Homes management The Soldiers’ Homes’ Project Manager reports to the Superintendent. The Superintendent of Chelsea Soldiers’ Home, or his/her designee, will sign this SOW and all amendments hereto on behalf of Chelsea Soldiers’ Home.

[Contractor]’s Project Manager The [Contractor]’s Project Manager will:

· Serve as an interface between Soldiers’ Homes Project Manager and all [Contractor] personnel participating in this engagement

· Develop and maintain a project management plan, in consultation with Soldiers’ Homes Project Manager

· Facilitate regular communication with Soldiers’ Homes Project Manager, including weekly status reports/updates, and review the project performance against the Project Plan

· Facilitate regular communication with EOHHS Project Manager, as needed

· Facilitate weekly project status meetings for the duration of the engagement

· Update the Project Plan on a weekly basis and distribute at weekly meetings for the duration of the engagement

· Sign acceptance forms to acknowledge their receipt from Soldiers’ Homes

· Be responsible for the management and deployment of [Contractor] personnel [Contractor]’s Project Manager reports to [TO INSERT]. [TO INSERT], being an authorized signatory named in [Contractor]’s response to RFR, will sign this SOW and all amendments thereto on behalf of [Contractor].

EOHHS Project Manager Technical Resource project management of this engagement will be performed by the EOHHS IT project manager. EOHHS IT Project Manager will:

· Work closely with the Soldier Homes’ Project Manager to ensure successful completion of the project

· Support coordination of all EOHHS resources including agreed upon dates and milestones

· Support alignment with EOHHS IT entities to support alignment of vendor configuration with EOHHS standards Soldiers’ Homes Contract Officer In addition to the Soldiers’ Homes’ Project Manager, the Soldiers’ Homes shall designate a Contract Officer, who shall be:

Name:

Title:

Address:

Address:

Email address:

The Soldiers’ Homes’ Contract Officer shall be authorized and empowered to represent the Soldiers’ Homes with respect to all matters relating to this Agreement. Any change to the Soldiers’ Homes’ Contract Officer shall be made in a written notice to the [Contractor].

[Contractor]’s Status Reports [Contractor] shall submit status reports to the Soldiers’ Homes’ Project Manager, and/or the Soldiers’ Homes’ Contract Officer, as designated by Soldiers’ Homes. The status reports shall be delivered every other week to support the project Steering Committee.

Upon submission of each status report, [Contractor] shall certify that, during the period for which the status report applies, [Contractor] is unaware of any Soldiers’ Homes’ action or inaction that has caused or will cause any changes to the project or Deliverables timeline, scope, or cost. If [Contractor] believes that the Soldiers’ Homes has caused or will cause such delay or change to scope or cost, [Contractor] shall describe such activity and its potential impact on the project or Deliverables in writing in the applicable status report.

Issue Resolution The Project Managers from each organization bear the primary responsibility for ensuring issue resolution. If they mutually agree that they are unable to resolve an issue, they shall escalate the issue to the Soldiers’ Homes’ [name and title here] and [Contractor]’s [name and title] for consideration.

Amendments and Change Orders This Agreement may be amended prior to the end of the Term and [Contractor] and Soldiers’ Homes may agree, from time to time during the Term, to execute amendments to the scope of work or Change Orders, which, when signed by the authorized representatives of each of the Parties, will be deemed incorporated herein by reference. Either Party may elect to submit Change Requests, including Change Requests resulting from changes in law, to the other Party to propose Changes, including, without limitation, changes to the scope, Services, or schedule. [Contractor] will make a good faith effort to accommodate Change Requests that are the result of any change in applicable laws, rules or regulations or changes needed to implement a legislative action, a legislative request, executive order, or judicial decision that requires a change to the Application and/or System.

a) Change Requests shall be submitted in writing to the other Party and shall contain a sufficient level of detail to permit the other Party to properly evaluate the Change Request. The Parties will mutually decide whether the Change Order Form is sufficient to document the Change Order, or if an Amendment to the Agreement is necessary. If the Parties determine it is necessary, they will amend the Agreement.

b) Change Requests may only be submitted by Soldiers’ Homes’ Project Manager and/or [Contractor]’s Project Manager.

c) The Project Managers will jointly determine whether the change impacts any terms contained within the Agreement.

d) Neither Party will be entitled to or obligated by a Change Request or Amendment until it has been presented and approved by both Parties in accordance with the above-mentioned procedures. Work performed by either Party to prepare, analyze and respond to a Change Request shall not be chargeable to the other Party hereunder.

e) Where one Party has submitted a Change Request and mutual agreement cannot be reached between the Parties with respect to the change within fifteen (15) Business Days of the Party’s receipt of the Change Request, [Contractor] shall continue to provide the Services as stated in this Agreement, and the Party may submit such matter for issue resolution in accordance with this SOW.

[Contractor] acknowledges that this Agreement does not constitute a retainer and that Soldiers’ Homes is not required to enter into any amendments or Change Orders with [Contractor] subsequent to the initial work described in this SOW.

For any amendment entered into under this Agreement where [Contractor] will be providing services on a Time and Materials basis, the Parties shall apply the Time and Materials terms as described in Section 8.5 of this SOW to the relevant Change Order or amendment.

Key Personnel [Contractor] agrees to provide the following key personnel for the following amounts of time for the duration of this project:

TABLE 1

KEY [Contractor] PERSONNEL

[Contractor] will assign all of the foregoing personnel to this engagement on the time basis set forth in Table 1. In the event that a change is necessary, the [Contractor] Project Manager will provide prompt written notice to the Soldiers’ Homes’ Project Manager of the proposed change. If a personnel change is necessary and a result of a non-emergency, two weeks’ prior written notice shall be provided by [Contractor] Project Manager to the Soldiers’ Homes’ Project Manager. For personnel changes that result from an emergency, prompt written notice shall be provided by [Contractor] Project Manager. The Soldiers’ Homes’ Project Manager has the right to interview all current and prospective [Contractor] personnel and accept or reject all personnel.

Additional [Contractor] personnel are set forth on Attachment [ ] (Deliverables/Tasks and Pricing Schedule; Personnel Rates), attached hereto.

Approval of Key Personnel Vendor will assign all of the personnel to this engagement as identified as Key Personnel in RFR Section 3.2.6.5.

EOHHS/Soldiers’ Homes will have final approval of staff proposed for ‘Key Personnel.’ Over the term of the Agreement, including any extension, Vendor shall take no action inconsistent with the terms of the RFR and Vendor’s Response thereto regarding the availability and assignment of named individuals to positions identified as Key Personnel, without the prior written approval of the EOHHS/Soldiers’ Homes’ Project Manager. If any Key Personnel become unavailable, Vendor shall notify the EOHHS/Soldiers’ Homes’ Project Manager immediately and provide the name(s) and résumé(s) of suitable replacement(s). Vendor shall, upon EOHHS/Soldiers’ Homes’ request, replace any staff. If requested by EOHHS/Soldiers’ Homes, Vendor shall make proposed replacements available for interview by EOHHS/Soldiers’ Homes. If EOHHS/Soldiers’ Homes are not reasonably satisfied that a proposed replacement has comparable ability and experience, then EOHHS/Soldiers’ Homes shall so notify Vendor in writing as soon as possible, but no longer than within five (5) Business Days after receiving the résumé and completing any interview, whereupon Vendor shall propose another replacement for approval. The process shall be repeated until a proposed replacement is approved by EOHHS/Soldiers’ Homes.

Equipment, Work Space, Office Supplies The Soldiers’ Homes will provide reasonable workspace, standard office equipment, and standard network connectivity provided to state employees for [Contractor] team members working on-site for activities defined in this SOW. [Contractor] will provide a written list of those project staff that require access to the Commonwealth of Massachusetts’ information systems, including the dates each staff member will need access. At the Soldiers’ Homes’ request, project staff granted network connectivity will be required to review and sign a Network Access Request Form and Acceptable Use Policy. Any [Contractor] employees who have access to IT resources must comply with the “Acceptable Use Policy” (see https://www.mass.gov/orgs/executive-office-of-technology-services-and-security) or any alternative Acceptable Use Policy adopted by the EOHHS/ Soldiers’ Homes. Except as needed to perform the services hereunder, [Contractor] project staff will not access, modify, or otherwise conduct activity affecting the Soldiers’ Homes’ information systems without the prior approval of the Soldiers’ Homes. [Contractor] shall immediately notify the Soldiers’ Home’s Project Manager of any staff who no longer requires access rights as originally requested, or whose employment as part of the project staff is terminated, so that the Soldiers’ Homes may terminate such person’s access rights.

Intellectual Property and Work Effort Agreement for Vendor's Employees, [Contractor]’s and Consultants and Agents Vendor shall ensure that each of Vendor personnel providing services under this SOW, regardless of whether the individual is an employee, contractor, or agent of Vendor, shall, prior to rendering any services under this SOW, sign the “Intellectual Property and Work Effort Agreement for Vendor’s Employees, Contractors, Consultants, and Agents” (the “IPAWE Agreement”) which is attached hereto as Exhibit A. Vendor shall return the signed copies of the IPAWE Agreement to the Soldiers’ Homes’ Project Manager prior to the rendering of any services under this SOW.

ADA Accessibility [Contractor] shall ensure that all Deliverables delivered under this agreement adhere to (1) the Section 508 Standards for Electronic and Information Technology Accessibility, issued under Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794(d)) (the “Section 508: Section 508 Standards”), and (2) the Web Accessibility Standards, (the “ITD Standards”) issued by the Commonwealth of Massachusetts’ Executive Office of Technology Services and Security (“EOTSS”). For purposes of this Agreement, [Contractor’s] obligations pertaining to these standards shall be limited to those subsections thereof that have been certified by EOTSS and the Massachusetts Office on Disability as objective and measurable. Such subsections shall be posted by EOTSS at https://www.mass.gov/orgs/executive-office-of-technology-services-and-security. The Section 508 and EOTSS Standards may be modified from time to time, and [Contractor] is responsible for compliance with the most current version in effect on the date that [Contractor] executes this Agreement.

Prior to commencing any design work under this Agreement, [Contractor’s] Project Manager and design professionals shall meet with the Soldiers’ Homes’ Project Manager to review the Section 508 and EOTSS Standards and the Generic Assistive Technology and Information Technology (AT/IT) Environment List and to discuss their impact on the design process.

Corrective Action Plan At any point during the Agreement, if the Soldiers’ Homes identify, in their sole judgment, any deficiency in Vendor’s performance under the Agreement, the Soldiers’ Homes may require Vendor to develop a corrective action plan to correct such deficiency. Vendor must submit any such corrective action plan to the Soldiers’ Homes and must, within three (3) Business Days of the request, implement such corrective action plan only as approved or modified by the Soldiers’ Homes. Under such corrective action plan, the Soldiers’ Homes may require Vendor to:

· Subcontract with a material subcontractor deemed satisfactory by the Soldiers’ Homes to perform certain Agreement responsibilities at no additional cost to the Soldiers’ Homes

· Otherwise alter the manner or method in which Vendor performs certain Agreement responsibilities at no additional cost to the Soldiers’ Homes; and

· Implement, at no additional cost to the Soldiers’ Homes, any other action that the Soldiers’ Homes may deem appropriate Policy Determinations The Soldiers’ Homes shall make and determine all policy relating to design, configuration, implementation, testing and operations. Vendor may request of the Contract Officer in writing that the Soldiers’ Homes issue policy determinations or operating guidelines required for proper performance of the Agreement, in which event the Contract Officer will deliver to Vendor a written reply within ten (10) Business Days of receipt of Vendor’s request. Vendor must be entitled to rely upon and act in accordance with such policy determinations and operating guidelines, unless and until they are superseded, suspended, or revoked, so long as it does not act negligently, maliciously, fraudulently, or in bad faith.

ADDITIONAL TERMS

System Security As set forth in RFR Section 2.3.2 - A1 Security, as part of its work efforts under this SOW, Vendor will be required to use Commonwealth Data and IT resources. For purposes of this work effort, “Commonwealth Data” shall mean data provided by Soldiers’ Homes to Vendor, which may physically reside at a Commonwealth or Soldiers’ Homes or Vendor location, and includes, but is not limited to [TO INSERT] Commonwealth Data In connection with Commonwealth Data, Vendor will implement commercially reasonable safeguards necessary to:

5.1.1.1 Prevent unauthorized access to Commonwealth Data from any public or private network;

5.1.1.2 Prevent unauthorized physical access to any information technology resources involved in the development effort; and

5.1.1.3 Prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

Commonwealth Personal Data In addition to the above requirements for Commonwealth Data, Vendor may be required to use Commonwealth personal data under MGL Ch. 66A and/or personal information under MGL Ch. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified Tasks, and such personal data shall be considered as “Commonwealth Data” as defined herein. For purposes of this work effort, electronic personal data and personal information includes data provided by Soldiers’ Homes to Vendor which may physically reside at a location owned and/or controlled by the Commonwealth or Soldiers’ Homes or Vendor. In connection with electronic personal data and personal information, Vendor shall implement the maximum feasible safeguards reasonably needed to:

5.1.2.1 Ensure the security, confidentiality and integrity of electronic personal data and personal information;

5.1.2.2 Prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network; and

5.1.2.3 Notify Soldiers’ Homes immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

Software Integrity Controls Address the following controls if applicable, usually in the case wherein Vendor will be developing code and migrating that code to a production environment.

Vendor and Soldiers’ Homes recognize the serious threat of fraud, misuse, and destruction or theft of data or funding. These threats could be introduced when unauthorized or inappropriate modifications are made to a production system. Vendor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software creation life cycle, including during development, testing, and production:

5.1.3.1 Vendor shall configure the RFR required software and systems environments.

5.1.3.2 Vendor shall implement a change management procedure to ensure that activities in the non-production environments remain separate and distinct from the production environment. In particular, the change management procedure shall incorporate at least the following:

5.3.2.1.1 Segregates duties between development and testing of software changes and migration of changes to the production environment.

5.3.2.1.2 Implements security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment.

5.3.2.1.3 Includes a process to log and review all source control activities.

5.1.3.3 Vendor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment.

5.1.3.4 Vendor shall not make any development or code changes in a production environment.

5.1.3.5 Vendor shall implement additional internal controls as specified by Soldiers’ Homes.

Compliance with NIST SP800-53 Standards

a) As of the Effective Date and during the entire effective period of the contract thereafter, the [Contractor] shall implement administrative, physical and technical safeguards to protect information it receives under this Agreement that are no less rigorous than accepted industry practices including the current National Institute of Standards and Technology (NIST) Special Publications (SP) standard: 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations, moderate security control baseline (“Standards”).

i) In the event [Contractor] is unable to fully comply with the Standards on the Effective Date, [Contractor] must submit to the EOHHS Project Manager a gap analysis detailing with which parts of the Standards [Contractor] is unable to comply and a Plan of Actions and Milestones (“POAM”), providing an overview of the reasonable effort and time required to comply with the Standards. Soldiers’ Homes may review the gap analysis and proposed POAM with [Contractor] and the parties will agree to a timeline for implementation of the Standards and/or correction of any deficiencies that are in Soldiers’ Homes’ opinion material that is mutually acceptable to the parties (“Implementation Timeline”). Soldiers’ Homes may meet with [Contractor] from time to time and/or as deadlines to correct deficiencies approach and/or come due and review the POAM, Implementation Timeline, and any other documentation requested by Soldiers’ Homes with [Contractor] to determine [Contractor]’s compliance with such documents and assess what further actions need to be taken. In the event Soldiers’ Homes is assessed any fine, penalty, or monetary damages as a result of a finding or judgment based in whole or in part on [Contractor]’s non-compliance with the Standards, inability to meet any part of the Implementation Timeline, inability to abide by the POAM, or any misstatements or omissions in the POAM, (“Liabilities”) [Contractor] will indemnify the Soldiers’ Homes for any such Liabilities and Soldiers’ Homes will be entitled to reimbursement from the [Contractor] for any such Liabilities. If, in Soldiers’ Homes’ determination, [Contractor] demonstrates an inability to meet any part of the Implementation Timeline, inability to abide by the POAM, or any misstatements or omissions in the POAM, Soldiers’ Homes may pursue remedies specified elsewhere in this Agreement including, but not limited to, seeking monetary damages and/or terminating the Agreement in whole or in part.

b) On an annual basis, [Contractor] must internally review their compliance with the Standards and create an assessment report based on the findings of such internal review. [Contractor] must submit the assessment report and an updated POAM to Soldiers’ Homes.

c) [Contractor] understands that it is solely responsible for meeting the security standards in this Section a. Soldiers’ Homes’ review of any gap analysis and/or POAM, or any such discussions related to the gap analysis and/or POAM, shall not constitute approval by Soldiers’ Homes of their contents and will not otherwise operate to indemnify, remove liability, or otherwise absolve [Contractor] of any responsibility for non-compliance with the Standards.

d) In the event [Contractor] is unable to fully comply with the Standards by the Effective Date, [Contractor] shall prioritize remediation of Standards controls based on agreed-upon risk ratings.

e) If [Contractor] does host any Commonwealth Data or other data on behalf of Soldiers’ Homes, in addition to the foregoing security requirements, as of the Effective Date, [Contractor] must either be capable of providing or have subcontracted with a hosting company to provide a server environment that meets the Uptime Institute’s standards for Tier 3 data center certification. [Contractor] must within a time mutually agreed to by the parties in the Implementation Timeline provide a server environment that meets the Uptime Institute’s standards for Tier 4 data center certification and which is FEDRAMP compliant and is able to be FEDRAMP certified (collectively the “Hosting Standards”).

f) [Contractor] must ensure the technical services are hosted on servers owned, operated, housed, maintained by [Contractor] or its hosting company, and located within the continental United States.

g) Once every two years, starting two years after the Effective Date, and at no additional cost to Soldiers’ Homes, have conducted by an independent third party auditor an audit, such as an SSAE-16 SOC 2 audit, of [Contractor]’s compliance with the Standards and Hosting Standards including, but not limited to, an audit of the [Contractor]’s facilities and hosting facilities and provide the EOHHS Project Manager the results of such audit. In the event the results of such audit demonstrate that Contractor’s systems and protections with regards to data security or privacy are insufficient to meet the requirements of the Standards and the Hosting Standards, [Contractor] must submit an updated POAM that addresses such deficiencies. Soldiers’ Homes may review the audit results and POAM with [Contractor] and may develop an Implementation Timeline.

h) On at least a semiannual basis and at no additional cost to Soldiers’ Homes, have conducted by an independent third-party testing company a vulnerability assessment of [Contractor]’s computing environment. Such vulnerability assessment shall include a penetration test, using industry-standard methodology, of [Contractor]’s computing environment. [Contractor] must provide the EOHHS Project Manager the findings of the vulnerability assessment and penetration test. If the findings demonstrate security vulnerabilities in [Contractor]’s computing environment, [Contractor] must submit an updated POAM that addresses such deficiencies. Soldiers’ Homes may review the audit results and POAM with [Contractor] and may develop an Implementation Timeline.

Notwithstanding the foregoing, nothing contained herein this section shall abrogate or restrict Soldiers’ Homes’ ability to audit and inspect [Contractor]’s facility, hosting facility or books and records, including but not limited to [Contractor]’s Information Security Plan, business continuity plan, disaster recovery plan, or other documentation required to be maintained by the Standards or otherwise in this Agreement. Such audit and/or inspection shall be conducted with reasonable notice and during [Contractor]’s standard business hours.

Data Management and Confidentiality Agreement Vendor agrees that it is bound by the terms and conditions of the Data Management and Confidentiality Agreement attached hereto as Exhibit B.

Warranty [Contractor] makes the following warranties with respect to any Deliverables/Tasks delivered under this Agreement:

a. By appropriately qualified and trained personnel;

b. With due care and diligence and to a high standard of quality as is customary in the industry;

c. In compliance with the Project Plan and the terms and conditions of this Agreement; and

d. In accordance with all applicable professional standards for the field of expertise;

Documentation provided by [Contractor] under this Agreement shall be in sufficient detail so as to allow suitably skilled, trained, and educated the Soldiers’ Homes personnel to understand the operation of the Deliverables. [Contractor] shall promptly, at no additional cost to the Soldiers’ Homes make corrections to any documentation that does not conform to this warranty;

Cooperation with Other Parties [Contractor] represents, warrants and undertakes that it will use commercially reasonable efforts to cooperate with any third party providers or users, whether selected by [Contractor] or the Soldiers’ Homes and including but not limited to those third party providers that may be required of the Soldiers’ Homes in connection with its funding for the Services, as may be required in connection with its provision or support of the Services under this Agreement.

Additional Notification and Remedial Requirements Any of the following events may, in the Soldiers’ Homes’ sole judgment, constitute a substantial breach by [Contractor], if due to any action or inaction on the part of [Contractor] or its subcontractor(s): (a) failure to complete to the satisfaction of [Contractor] the required Milestones for each phase of the Services (configuration, implementation, and optional operations) within the completion times specified; or (b) inability to continue Application operations without repeated or lengthy interruptions to normal business operations; or (c) failure of [Contractor] to continue to conduct business in the normal course, or the making of a general assignment for the benefit of creditors, or the appointment of a receiver for all or substantially all of its business assets, or the filing of a voluntary or involuntary petition in bankruptcy; provided that in the event of an involuntary petition, [Contractor] shall not have been able to obtain a dismissal of the petition within thirty (30) Calendar Days after the date of filing. [Contractor] agrees to provide advance notice of the potential initiation of any one of the above actions through a written special status reports within three (3) Business Days upon written request by the Soldiers’ Homes in response to particular problems identified by Soldiers’ Homes in the performance of work performed under the Agreement. Each report, signed by [Contractor]’s Project Manager, shall include a description of the problem, the reason(s) the problem occurred, corrective action plan(s) proposed to prevent the problem(s) from recurring and an implementation date for the corrective action plan(s). This is to occur no later than three (3) Calendar Days from the date of its discovery of any problem that may jeopardize the successful or timely completion of its obligations, notify the Soldiers’ Homes in writing of the problems, including in such notice Vendor’s recommendation for expeditious resolution of the problem.

Disclaimer EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS AGREEMENT, EACH PARTY HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, WITH RESPECT TO THIS AGREEMENT.

Data and Intellectual Property Notwithstanding Section 11 of the Commonwealth Terms and Conditions, Vendor shall indemnify, defend and hold harmless, the Soldiers’ Homes and its officers, directors, employees and agents against any and all losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees, arising out of or related to any third party claim (a) alleging any failure by [Contractor] or its personnel to comply with any applicable laws, rules or regulations in the performance of its obligations under this Agreement, including any applicable data protection and privacy laws, or any breach of [Contractor]'s confidentiality and security or (b) to the extent that it is based on an assertion that the Application, Deliverables or the Services constitute infringement, misappropriation or other violation of any intellectual property rights, and shall indemnify and hold the Soldiers’ Homes harmless from and against all costs, damages and expenses, including reasonable attorney's fees, asserted against the Soldiers’ Homes or any of its officers, directors, employees and agents which result from any such claim. Without limiting the generality of the foregoing, should the Application, Deliverables or Services or any part thereof become, or in [Contractor]'s opinion be likely to become, the subject of a claim of infringement, misappropriation or other violation under applicable intellectual property laws, [Contractor] shall either procure for the Soldiers’ Homes the right to continue using the Application, Deliverables or Services, or to replace or modify the Deliverables or Services, without changing their functional capabilities, so that the Application, Deliverables or Services becomes non-infringing. If [Contractor] is unable to do either of the foregoing within thirty (30) Business Days, upon request, [Contractor] shall refund the entire costs paid to [Contractor] by Soldiers’ Homes prorated to reflect use of the Application, Deliverable or Services by Soldiers’ Homes prior to commencement of the claim or proceeding described herein. The indemnity obligations in subsection (b) shall not apply to the extent that any infringement, misappropriation or other violation directly arises out of or directly relates to: (i) any use of the Application, Deliverables or Services for other than the intended purposes, or (ii) any action or inaction in violation of the terms of this Agreement by the Soldiers’ Homes.

Title and Intellectual Property Rights Definition of Property The term “Property” as used herein includes the following…