Solicitation_Documents_Combined_9.28.26.pdf

TABLE OF CONTENTS

REQUEST FOR QUOTE (RFQ) 1

1. General Information 2

1.1. Method of Award 2

1.2. Bidder Instruction DGS PD 451 2

1.3. Award of the Purchase Order (PO) 2

1.4. Document Attachments 2

1.5. Information Technology (IT) General Provisions 2

1.6. Small Business Preference 3

1.7. DVBE Incentive 3

1.8. Suppliers Responding 4

2. Administrative Requirements 5

2.1. Cover Sheet 5

2.2. DSH Cost Table 5

2.3. Commercially Useful Function (CUF) Documentation 5

2.4. STD 204, Payee Data Record 5

2.5. Bidder Declaration (GSPD-05-105) 5

2.6. DVBE Declaration 6

2.7. Statement of Work (SOW) 6

2.8. Delivery 6

2.9. SOW CONTACT INFORMATION 6

2.10. GenAI Technology Use & Reporting 6

ATTACHMENT 1: COVER SHEET 8

ATTACHMENT 2: DSH COST TABLE 9

ATTACHMENT 3: COMMERCIALLY USEFUL FUNCTION DOCUMENTATION 10

ATTACHMENT 4: Exhibit A -SOW - GA Printer Support RFQ.pdf 11

Request for Quote (RFQ) #: 89 IDEA1466 Graphic Art Printer Support Open Market (Competitive)

Please review this RFQ and if interested in responding, submit a quotation via the Vendor Submission Portal. Fax quotations will not be accepted. To be considered responsive, the quotation must be received by the RFQ Due Date, and the Administrative Requirements listed below must be included in the Supplier’s submitted quotation. In submitting a proposal, Proposers agree that they have read, understood, and will comply with the instructions found herein. Failure to comply with any of the requirements may result in rejection of a Proposer's proposal. By submitting a response, Proposers agree to the terms and conditions stated in this solicitation and any resulting agreement.

Release of RFQ: September 28, 2026 RFQ Due Date: October 12, 2026 04:00 PM

Jasmine McKenzie jasmine.mckenzie@dsh.ca.gov

(916) 654-2597

ACTION DATES

DSH Procurement Office Contact

1. General Information

1.1. Method of Award

DSH reserves the right to determine the successful quotations(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in DSH’s RFQ. Unless the supplier specifies otherwise in its quotation, DSH may accept any item or groups of items of any quotation. DSH reserves the right to modify or cancel in whole or in part it’s RFQ at any time.

1.2. Bidder Instruction DGS PD 451

The following Bidder Instructions contains information to assist in the bidder in submitting their response. Form DGS PD 451, Bidder Instructions – Effective 11/09/2011 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

1.3. Award of the Purchase Order (PO)

Award of the Purchase Order (PO) will be made to the supplier that meets all of the Section 2.

Administrative Requirements stated below and provides the lowest net cost quotation.

1.4. Document Attachments

If applicable, the following documents will be attached to this solicitation and will be made as part of the Purchase Order: Attachment 4: Statement of Work and Budget Details and Payment Provisions.

1.5. Information Technology (IT) General Provisions

https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

Information Technology (IT) General Provisions for IT goods and services (Form - DGS PD 403-ITGP, revised and effective 02/20/2025) that are published in the link below will be incorporated and made part of the PO by reference. No other terms, conditions, policies or general provisions from the supplier are applicable or operative. A quotation that includes a supplier’s policy, terms and/or conditions may be rejected.

Information Technology - General Provisions - Non-Cloud Goods & Services

1.6. Small Business Preference

Suppliers who request and qualify as a California-certified small business will be given a five (5) percent preference for bid evaluation purposes only.

In addition, a five (5) percent bid preference is available to a non-small business claiming 25 percent California-certified small business subcontractor participation. Suppliers claiming this preference must be certified by California as a small business or must commit to subcontract at least 25 percent of the net bid price with one or more California-certified small businesses.

Small Business Nonprofit Veteran Services Agencies (SB/NVSA) prime Suppliers meeting requirements specified in the Military and Veterans Code §999.50 et seq. and obtaining a California certification as a small business are eligible for the five (5) percent small business preference.

Suppliers desiring to claim this preference must choose a Small Business Preference Statement(s) required at the following link: https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf

1.7. DVBE Incentive

For suppliers that request and qualify for the Disabled Veteran Business Enterprise (DVBE) Incentive, in accordance with Military and Veterans Code §999.5(a), an incentive will be given to suppliers who provide DVBE participation. For evaluation purposes only, DSH shall apply an incentive to the quotations that propose California certified DVBE participation as identified on the Section 2.5. Bidder Declaration (GSPD-05-105) and confirmed by DSH. The incentive amount for the https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dgs.ca.gov%2F-%2Fmedia%2FDivisions%2FPD%2FAcquisitions%2FSolicitation-Document-Attachments%2FIT-General-Provisions-NonCloud-DGS-PD-403ITGP-Revised-02202025.pdf&data=05%7C02%7CJeanette.Anderson%40dsh.ca.gov%7Cdf378ca0396a4ef6798e08dd55cec2dc%7C807536a6a6b14893a01370509c59ebbb%7C0%7C0%7C638761068706715872%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2BvNcr6vNkfdDcV0RkXORaqd%2BLky64d26PjSFyN1Gbl8%3D&reserved=0 https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf lowest net cost quotation will vary in conjunction with the percentage of DVBE participation. The following table identifies the percentages that will be used to adjust the net quotation price when calculating the DVBE Incentive:

Confirmed DVBE Participation of: DVBE Incentive:

5 percent and Over 5 percent

4 percent – 4.99 percent inclusive 4 percent

3 percent – 3.99 percent inclusive 3 percent

Suppliers responding to this solicitation who have been certified by California as a DVBE (or who are offering rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) must also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). The form link is as follows: https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_8 43.pdf

All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s).

The completed form should be included in the solicitation response. At DSH’s option prior to award, contractors responding to a solicitation may be required to submit additional written clarifying information. Failure to submit the requested written information as specified may be grounds for quotation rejection.

1.8. Suppliers Responding

All Suppliers responding to this solicitation must complete the Bidder Declaration GSPD-05-105 and include it with their response. When completing the declaration, Suppliers responding to the solicitation, if applicable, must identify all subcontractors proposed for participation in the contract.

Suppliers awarded a PO/Contract as a result of this solicitation are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution and it is https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf incorporated by amendment to the PO/Contract. The Section 2.5. Bidder Declaration (GSPD-05-105) form link is in the Section 2. Administrative Requirements below.

2. Administrative Requirements

Please complete, sign and return all required administrative documents listed below.

2.1. Cover Sheet

ATTACHMENT 1: COVER SHEET

2.2. DSH Cost Table

ATTACHMENT 2: DSH COST TABLE

2.3. Commercially Useful Function (CUF) Documentation

ATTACHMENT 3: COMMERCIALLY USEFUL FUNCTION DOCUMENTATION

2.4. STD 204, Payee Data Record

STD 204, Payee Data Record http://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf

2.5. Bidder Declaration (GSPD-05-105)

Bidder Declaration (GSPD-05-105) must be completed and attached using the link below:

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf http://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf

Vendors who have been certified by California as a DVBE (or who are providing rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) should also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s).

Form - STD. 843 (Rev. 11/2005) (ca.gov)

2.6. DVBE Declaration

If DVBE is claimed, a DVBE Declarations (STD 843) must be completed and attached using the link below:

2.7. Statement of Work (SOW)

Review SOW in its entirety, complete Vendor contact information and Privacy and Information Security Officer information and return SOW.

2.8. Delivery

Final delivery, inspection and acceptance shall be at the location described in the "Ship To" address.

2.9. SOW CONTACT INFORMATION

Please complete the following information regarding the Primary and Back up Point of Contact (POC) for the duration of the contract. This information will be used to complete the language in the Statement of Work. This document is required

First, download this file. Then after you've completed it, please export it and attach it below.

https://sb-public-files.s3.us-gov-west-1.amazonaws.com/SOW+CONTACT+INFORMATION+x+(1).pdf

2.10. GenAI Technology Use & Reporting

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or

(iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.

https://www.dgs.ca.gov/Resources/SAM/TOC/4900/4986-2 https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=GOV&sectionNum=11549.64.&highlight=true&keyword=Generative%20Artificial%20Intelligence

ATTACHMENT 1: COVER SHEET

The Cover Sheet must be completed by all bidders. If this document is incomplete or not provided, the bidder may be deemed non-responsive.

Cover Sheet

The submission of this quotation does not obligate the Department of State Hospitals (DSH) to award the proposed Agreement. If the quotation is awarded, a Agreement will be executed between the DSH and the supplier.

The undersigned supplier hereby proposes to furnish all labor, materials, tools and equipment, to provide goods and/or services in accordance with the specifications and provisions within the solicitation.

1 Supplier’s Quotation/Offer Submission Date:

2 Supplier’s Quotation/Offer Reference Number:

3 Quotation/Offer Term (i.e., “Quotation is good for 45 days”):

4 Full Legal Name of Supplier’s Organization:

5 Mailing Address:

Street City State Zip

Telephone Email

6 Federal Taxpayer Identification Number:

7 Seller's Permit Number (if applicable):

8 Principal who is authorized to bind the Supplier:

Typed Name Title

Original Signature Date

9 Supplier’s SB/DVBE Certification Number(s):

10 Supplier’s contact person shall be:

Name Phone Number

11 Supplier’s contact person’s email address:

12 Estimated time to deliver the items in the Quotation (for example, 10 days After Receipt of Order [ARO])

13 Warranty Description and Term Dates (if applicable)

The RFQ Cost Table must be completed by all bidders. If this document is incomplete, calculations are incorrect or the document is not provided, the bidder may be deemed non-responsive.

RFQ #:

11/1/2026 to 10/31/2027

Item Qty UOM Part Number Description Unit Price Item Subtotal

Tax Rate

Taxable Amount

Freight Amount

Line Item Total

1 12 Months Monthly Base Charge - for IMAGEPRESS C810 Clicks per month: 48,000 Color and 24,000 B&W includes the following:

Base Charge - includes OEM toner, labor (no staples) $0.00 $0.00 8.75% $0.00 $0.00 $0.00 Overage Rate for COLOR $0.00 $0.00 0.00% $0.00 $0.00 $0.00 Overage rate for B&W $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for inclusion of staples for COLOR $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for inclusion of staples for B&W $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for Rural Service Zone $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for Remote Service Zone $0.00 $0.00 0.00% $0.00 $0.00 $0.00

2 12 Months Monthly Base Charge - for VARIOPRINT DP LINE 115 Clicks per month: 100,000 B&W includes the following:

Base Charge - includes OEM toner, labor (no staples) $0.00 $0.00 8.75% $0.00 $0.00 $0.00 Overage rate for B&W $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for inclusion of staples for B&W $0.00 $0.00 0.00% $0.00 $0.00 $0.00 % increase in rate for Rural Service Zone $0.00 $0.00 0.00% $0.00 $0.00 $0.00

% increase in rate for Remote Service Zone $0.00 $0.00 0.00% $0.00 $0.00 $0.00

Competitive Informal

Quotation Cost Table

IDEA1466 Graphic Art Printer Support Renewal

REQUIREMENTS for Goods in the Quotation (Terms: Net 45 Days, F.O.B. Destination Freight Prepaid)

Delivery Location:

Aaron Steinbock 10333 El Camino Real Atascadero, CA 93422 (805)468.3292 Email: Aaron.Steinbock@dsh.ca.gov

Total Freight $0.00 Other Non-Taxable $0.00

Grand Total $0.00

Subtotal $0.00 Total Tax $0.00

The Commercially Useful Function Documentation must be completed by all bidders. If this document is incomplete, calculations are incorrect or the document is not provided, the bidder may be deemed non-responsive.

ATTACHMENT C:Commercially Useful Function Documentation Mandatory - Must Be Submitted With Response

All certified Small Business, Microbusiness, and/or DVBE contractors, subcontractors or suppliers must meet the commercially useful function requirements under Government Code, Section 14837(d)(4) (for SB) and Military and Veterans Code, Section 999(b)(5)(B) (for DVBE).

Please answer the following questions as they apply to your company for the goods/services being acquired in this procurement.

Yes No

1) Will your company be responsible for the execution of a distinct element of the resulting purchase order?

Yes No

2) Will your company be actually performing, managing, or supervising an element of the resulting purchase order?

Yes No

3) Will your company be performing work on the resulting purchase order that is normal for its business, services and functions?

Yes No

4) Will your company be responsible, with respect to products, inventories, materials, supplies required for the contract, for negotiating price, determining quality and quantity, ordering, installing, if applicable, making payment?

Yes No

5) Will there be any subcontracting that is greater than that expected to be subcontracted by normal industry practices for the resulting purchase order?

A response of No in questions 1-4, or a response of Yes in question 5, may result in your quotation being eliminated from consideration.

At the State’s option prior to award, bidders may be required to submit additional written clarifying information.

DSH RFQ #IDEA1466

Contractor Name (TBD)

Graphic Arts Printers Support Renewal

Exhibit A – Statement of Work

1. OVERVIEW

DSH-Atascadero uses Canon imagepress and varioprint hardware to facilitate graphic arts department printing operations. These business machines fall outside of Enterprise Xerox printing solutions. To maintain day-to-day operations on printer hardware, a renewed monthly rate support contract is needed.

2. CONTRACTED PARTIES:

This agreement is between the Department of State Hospitals (DSH), and TBD, (Contractor).

3. SCOPE:

(a) CONTRACTOR RESPONSIBILITIES:

Contractor (TBD) agrees to provide Canon Equipment Support to the Department of State Hospitals (DSH) pursuant to the terms and conditions of the Agreement.

4. CONTACTS:

Department of State Hospitals:

Aaron Steinbock 10333 El Camino Real Atascadero, CA 93422 805-468-2840 Aaron.Steinbock@dsh.ca.gov

Contractor Information: TBD

5. GEN AI TECHNOLOGY USE & REPORTING:

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or (iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data

6. AGREEMENT TERMS:

The term of this agreement is from November 1, 2026, through October 31, 2027.

7. COST:

Item Qty UOM Description Unit Price Line Item Total

1 12 Months

Monthly Base Charge - for IMAGEPRESS C810 Clicks per month: 48,000 Color and 24,000 B&W includes the following:

Base Charge - includes OEM toner, labor (no staples) $ $

Overage Rate for COLOR $ $ Overage rate for B&W $ $

% increase in rate for inclusion of staples for

COLOR $ $

% increase in rate for inclusion of staples for B&W $ $

% increase in rate for Rural Service Zone $ $ % increase in rate for Remote Service Zone $ $

2 12 Months

Monthly Base Charge - for VARIOPRINT DP

LINE 115

Clicks per month: 100,000 B&W includes the following:

Base Charge - includes OEM toner, labor (no staples) $ $

Overage rate for B&W $ $

% increase in rate for inclusion of staples for B&W $ $

% increase in rate for Rural Service Zone $ $ % increase in rate for Remote Service Zone $ $

TAXES $

GRAND TOTAL $

The total cost of this agreement is $XXX.XX.

8. Terms and Conditions –

(a) IT General Provisions for Non-Cloud Goods and Services (Effective 02/20/2025)

9. LOCATIONS:

The services shall be performed for the Department of State Hospitals at the following location(s):

☒ DSH-Atascadero 10333 El Camino Real P.O. Box 7001 Atascadero, CA 93423-7001

☐ DSH-Coalinga 24511 West Jayne Avenue P.O. 5000 Coalinga, CA 93210

☐ DSH-Metropolitan 11401 South Bloomfield Avenue Norwalk, CA 90650

☐ DSH-Patton 3102 East Highland Avenue Patton, CA 92369

☐ DSH-Napa 2100 Napa-Vallejo Highway Napa, CA 94558-6293

☐ DSH-Sacramento 1215 O Street Sacramento, CA 95814

10. AMENDMENT:

This agreement may be amended at the DSH’s sole discretion to extend the term for up to one (1) additional year and to add funding sufficient for that period at the same rates if it does not exceed the DSH’s Purchasing Authority at the time of amendment. Any amendment shall be in writing and approved by both parties and, if applicable, be approved by the Department of General Services/or California Department of Technology.

11. PAYMENT PROVISIONS

(a) Invoicing and Payment

i) Contractor shall submit one original and three copies of each invoice, unless emailed.

ii) Invoices shall clearly reference the agreement and PO number.

iii) To expedite the processing of invoices submitted to the DSH for payment, all invoice(s) shall be submitted to the DSH for review and approval at either:

Department of State Hospitals- Accounting Division Attn: Accounts Payable

Address: 1215 O Street, Sacramento, CA 95814 Phone Number: (916) 562-2572

Email: DSHSAC.AccountsPayable@dsh.ca.gov

iv) Licenses shall be paid annually upon each term start date(s).

v) Hardware Maintenance shall be paid monthly, in arrears.

vi) Hardware Warranty shall be paid in full

(b) Budget Contingency Clause:

i) It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall no longer be in full force and effect. In this event, the State shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

ii) If funding for any Fiscal Year (FY) is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Agreement with no liability occurring to the State or offer an Agreement amendment to Contractor to reflect the reduced amount.

iii) If this Agreement overlaps Federal and State FY’s, should funds not be appropriated by Congress or approved by the Legislature for the FY in which the Agreement was entered into, and/or any subsequent years covered under this Agreement, the State may exercise its option to cancel this Agreement.

iv) In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by Congress or the Legislature which may affect the provisions or terms of funding of this Agreement in any manner.

(c) Prompt Payment Clauses:

i) Payment will be made in accordance with, and within the time specified in, Government Code section 927, et seq.

(d) Travel and per Diem

i) DSH will not pay for Travel or Per Diem.

v.17 Rev. 03/01/2025

EXHIBIT F (Non-HIPAA/HITECH Act Contracts)

INFORMATION PRIVACY AND SECURITY REQUIREMENTS

This Information Privacy and Security Requirements Exhibit (For Non-Health Insurance Portability and Accountability Act/Health Information Technology for Economic and Clinical Health (Non-HIPAA/HITECH Act Contracts) (hereinafter referred to as “this Exhibit”) sets forth the information privacy and security requirements Contractor is obligated to follow with respect to all personal and confidential information (as defined herein) disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of the California Department of State Hospitals (hereinafter “DSH”), pursuant to Contractor’s agreement with DSH. (Such personal and confidential information is referred to herein collectively as “DSH PCI”.) DSH and Contractor desire to protect the privacy and provide for the security of DSH PCI pursuant to this Exhibit and in compliance with state and federal laws applicable to the DSH PCI.

I. Order of Precedence: With respect to information privacy and security requirements for all DSH PCI, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the agreement between Contractor and DSH, including Exhibit A (Scope of Work), all other exhibits and any other attachments, and shall prevail over any such conflicting terms or conditions.

II. Effect on lower tier transactions: The terms of this Exhibit shall apply to all contracts, subcontracts, and subawards, and the information privacy and security requirements Contractor is obligated to follow with respect to DSH PCI disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of DSH, pursuant to Contractor’s agreement with DSH. When applicable the Contractor shall incorporate the relevant provisions of this Exhibit into each subcontract or subaward to its agents, subcontractors, or independent consultants.

III. Definitions: For purposes of the agreement between Contractor and DSH, including this Exhibit, the following definitions shall apply:

A. Breach: “Breach” means:

1. the unauthorized acquisition, access, use, or disclosure of DSH PCI in a manner which compromises the security, confidentiality or integrity of the information; or

2. the same as the definition of "breach of the security of the system" set forth in California Civil

Code section 1798.29, subdivision (f).

B. Confidential Information: “Confidential information” means information that:

1. does not meet the definition of “public records” set forth in California Government Code section

7920.530, or is exempt from disclosure under any of the provisions of Section 7920.000, et seq.

of the California Government Code or any other applicable state or federal laws; or

2. is contained in documents, files, folders, books or records that are clearly labeled, marked or designated with the word “confidential” by DSH.

C. Disclosure: “Disclosure” means the release, transfer, provision of, access to, or divulging in any manner of information outside the entity holding the information.

D. PCI: “PCI” means “personal information” and “confidential information” collectively (as these terms are defined herein).

E. Personal Information: “Personal information” means information, in any medium (paper, electronic, oral) that:

1. directly or indirectly collectively identifies or uniquely describes an individual; or

2. could be used in combination with other information to indirectly identify or uniquely describe an individual, or link an individual to the other information; or

3. meets the definition of “personal information” set forth in California Civil Code section 1798.3, subdivision (a); or

4. is one of the data elements set forth in California Civil Code section 1798.29, subdivision (g)(1) or (g)(2); or

5. meets the definition of “medical information” set forth in either California Civil Code section 1798.29, subdivision (h)(2), or California Civil Code, section 56.05, subdivision (j); or

6. meets the definition of “health insurance information” set forth in California Civil Code section

1798.29, subdivision (h)(3); or

7. is protected from disclosure under applicable state or federal law.

F. Security Incident: “Security Incident” means:

1. an attempted breach; or

2. the attempted or successful unauthorized access or disclosure, modification or destruction of

DSH PCI, in violation of any state or federal law or in a manner not permitted under the agreement between Contractor and DSH, including this Exhibit; or

3. the attempted or successful modification or destruction of, or interference with, Contractor’s system operations in an information technology system, that negatively impacts the confidentiality, availability or integrity of DSH PCI; or

4. any event that is reasonably believed to have compromised the confidentiality, integrity, or availability of an information asset, system, process, data storage, or transmission.

Furthermore, an information security incident may also include an event that constitutes a violation or imminent threat of violation of information security policies or procedures, including acceptable use policies.

G. Use: “Use” means the sharing, employment, application, utilization, examination, or analysis of information.

IV. Disclosure Restrictions: The Contractor and its employees, agents, and subcontractors shall protect from unauthorized disclosure any DSH PCI. The Contractor shall not disclose, except as otherwise specifically permitted by the agreement between Contractor and DSH (including this Exhibit), any DSH PCI to anyone other than DSH personnel or programs without prior written authorization from the DSH Contract Manager, except if disclosure is required by state or federal law. Contractor shall inform DSH of any disclosure required by law that is not contemplated by this Agreement, prior to making the disclosure.

V. Use Restrictions: The Contractor and its employees, agents, and subcontractors shall not use any

DSH PCI for any purpose other than performing the Contractor's obligations under its agreement with

DSH.

VI. Safeguards: The Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the privacy, confidentiality, security, integrity, and availability of DSH PCI, including electronic DSH PCI. At each location where DSH PCI exists under Contractor’s control, the Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Contractor’s operations and the nature and scope of its activities in performing its agreement with DSH, and incorporates the requirements of Section VII, Security, below. Contractor shall provide DSH with Contractor’s current and updated policies within five (5) business days of a request by DSH for the policies.

VII. Security: The Contractor shall take any and all steps reasonably necessary to ensure the continuous security of all electronic data systems containing DSH PCI. These steps shall include, at a minimum, complying with all of the data system security precautions listed in the Contractor Data Security Standards set forth in Attachment 1 to this Exhibit.

VIII. Security Officer: At each place where DSH PCI is located, the Contractor shall designate a Security

Officer to oversee its compliance and to communicate with DSH on matters concerning this Agreement.

IX. Training: The Contractor shall provide training on its obligations under this Agreement, at its own expense, to all of its employees who assist in the performance of Contractor’s obligations under Contractor’s agreement with DSH, or otherwise use or disclose DSH PCI.

A. The Contractor shall require each employee who receives training to certify, either in hard copy or electronic form, the date on which the training was completed.

B. The Contractor shall retain each employee’s certifications for DSH inspection for a period of three years following contract termination or completion.

C. Contractor shall provide DSH with its employee’s certifications within five (5) business days of a request by DSH.

X. Employee Discipline: Contractor shall impose discipline that it deems appropriate (in its sole discretion) on such employees and other Contractor workforce members under Contractor’s direct control who intentionally or negligently violate any provisions of this Agreement.

XI. Contractor California Consumer Privacy Protection Act (CCPA) Responsibilities: Contractor, its employees, agents, and sub-contractors, shall comply with all Contractor’s applicable legal obligations pursuant to the CCPA, including but not limited to the handling and disclosure of personal information received resulting from this agreement, abiding by CCPA notice requirements on Contractor’s website(s), safeguarding personal information received in connection with this agreement, refraining from using personal information received in connection with this agreement outside of the enumerated business purpose contained therein. Contractor’s failure to comply with such laws and regulations shall constitute a material breach of this Agreement, and shall be grounds for immediate termination of the Agreement by DSH, pursuant to ADMIN CONTRACT: section 7 of Exhibit C OR If this is a TSD IT CONTRACT: IT Provisions for GSPD-ITGP. By executing this Agreement, Contractor certifies that it is aware of its legal obligations as set forth under the CCPA, that it is in compliance with the CCPA, and shall remain in compliance with all such laws and regulations for the term of this Agreement.

To the fullest extent permitted by State law, pursuant to section 5 of Exhibit C OR If this is a TSD IT CONTRACT TSD Contract IT Provisions for GSPD-ITGP of this Agreement, Contractor agrees to indemnify and hold the DSH harmless from and against any and all liability, loss, suit, damage or claim, including third party claims brought against the DSH, ADMIN CONTRACT: section 5 of Exhibit C OR If this is a TSD IT CONTRACT: IT Provisions for GSPD-ITGP], as well as damages and reasonable costs assessed against the DSH by a court of competent jurisdiction (or, at Contractor's option, that are included in a settlement of such claim or action in accordance herewith), to the extent such claim arises from Contractor’s violation of the CCPA in relation to Contractor’s performance under this agreement;

provided, that (i) Contractor is notified promptly in writing of the claim; (ii) Contractor controls the defense and settlement of the claim; (iii) Contractor provides a defense with counsel approved by the DSH; and (iv) the DSH cooperates with all reasonable requests of Contractor (at Contractor's expense) in defending or settling the claim.

XII. Breach and Security Incident Responsibilities:

A. Notification to DSH of Breach or Security Incident: The Contractor shall notify DSH immediately upon the discovery of a breach (as defined in this Exhibit), and within twenty-four (24) hours by email of the discovery of any security incident (as defined in this Exhibit), unless a law enforcement agency determines that the notification will impede a criminal investigation, in which case the notification required by this section shall be made to DSH immediately after the law enforcement agency determines that such notification will not compromise the investigation. Notification shall be provided to the DSH Program Contract Manager, the DSH Chief Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XII.F., below. If the breach or security incident is discovered after business hours or on a weekend or holiday and involves DSH PCI in electronic or computerized form, notification to DSH shall be provided by calling the DSH Chief Information Security Office at the telephone numbers listed in Section XII.F., below. For purposes of this Section, breaches and security incidents shall be treated as discovered by Contractor as of the first day on which such breach or security incident is known to the Contractor, or, by exercising reasonable diligence would have been known to the Contractor.

Contractor shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee or agent of the Contractor.

Contractor shall take:

1. prompt corrective action to mitigate any risks or damages involved with the breach or security incident and to protect the operating environment; and

2. any action pertaining to a breach required by applicable federal and state laws, including, specifically, California Civil Code sections 1798.29 and 1798.82 (2021).

B. Investigation of Breach and Security Incidents: The Contractor shall immediately investigate security incidents/suspected breaches which potentially expose DSH data or impact DSH system.

Within 8 hours of discovery (of the incident), and subject to the legitimate needs of law enforcement, Contractor shall inform the DSH Contract Manager, the DSH Chief Privacy Officer, and the DSH Chief Information Security Officer of:

1. what data elements were potentially involved, and the extent of the data disclosure or access involved in the breach, including, the approximate number of individuals whose personal information was suspected to be breached; and

2. a description of the unauthorized persons known or reasonably believed to have improperly used the DSH PCI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the DSH PCI, or to whom it is known or reasonably believed to have had the DSH PCI improperly disclosed to them; and

3. a description of where the DSH PCI is believed to have been improperly used or disclosed; and

4. a description of impacted systems, including hardware or software elements which process, store, or transmit DSH data or provide services on behalf of DSH; and

5. a description of the probable and proximate causes of the breach or security incident; and

6. whether Civil Code sections 1798.29 and 1798.82 or any other federal or state laws requiring individual notifications of breaches have been triggered.

C. Written Report: The Contractor shall provide a written report of the investigation to the DSH

Contract Manager, the DSH Chief Privacy Officer, and the DSH Chief Information Security Officer as soon as practicable, but no later than ten (10) working days, after the discovery of the breach or security incident. The report shall include, but not be limited to, the information specified above, a complete list of impacted individuals, as well as a complete, detailed corrective action plan, including information on measures that were taken to halt and/or contain the breach or security incident, and measures to be taken to prevent the recurrence or further disclosure of data regarding such breach or security incident.

D. Notification to Individuals: If notification to individuals whose information was breached is required under state or federal law, and regardless of whether Contractor is considered only a custodian and/or non-owner of the DSH PCI, Contractor shall, at its sole expense, and at the sole election of DSH, either:

1. make notification to the individuals affected by the breach (including substitute notification), pursuant to the content and timeliness provisions of such applicable state or federal breach notice laws. Contractor shall inform the DSH Chief Privacy Officer, DSH Chief Information Officer, and DSH Contract Manager of the time, manner and content of any such notifications, prior to the transmission of such notifications to the individuals; or

2. cooperate with and assist DSH in its notification (including substitute notification) to the individuals affected by the breach.

E. Submission of Sample Notification to Attorney General: If notification to more than 500 individuals is required pursuant to California Civil Code section 1798.29 or 1798.82, and regardless of whether Contractor is considered only a custodian and/or non-owner of the DSH PCI, Contractor shall, at its sole expense, and at the sole election of DSH, either:

1. electronically submit a single sample copy of the security breach notification, excluding any personally identifiable information, to the Attorney General pursuant to the format. content and timeliness provisions of Section 1798.29, subdivision (e), or 1798.82, subdivision (f). Contractor shall inform the DSH Chief Privacy Officer of the time, manner and content of any such submissions, prior to the transmission of such submissions to the Attorney General; or

2. cooperate with and assist DSH in its submission of a sample copy of the notification to the

Attorney General.

F. DSH Contact Information: To direct communications to the above referenced DSH staff, the

Contractor shall initiate contact as indicated herein. DSH reserves the right to make changes to the contact information below by written notice to the Contractor. Said changes shall not require an amendment to this Exhibit or the agreement to which it is incorporated.

Contract Managers DSH Chief Privacy Officer Chief Information Security Officer

See Exhibit A - Scope of Work for contact information

Chief Privacy Officer

Legal Division

California Dept. State Hospitals

Email: privacy.officer@dsh.ca.gov

Telephone: 916-654-2319

Chief Information Security Officer

Information Security Office

California Dept. State Hospitals

Email: iso@dsh.ca.gov and security@dsh.ca.gov

Telephone: 916-654-4218

XIII. Documentation of Disclosures for Requests for Accounting: Contractor shall document and make available to DSH or (at the direction of DSH) to an Individual such disclosures of DSH PCI, and information related to such disclosures, necessary to respond to a proper request by the subject Individual for an accounting of disclosures of personal information as required by Civil Code section 1798.25, or any applicable state or federal law.

XIV. Requests for DSH PCI by Third Parties: The Contractor and its employees, agents, or subcontractors shall promptly transmit to the DSH Contract Manager all requests for disclosure of any DSH PCI requested by third parties to the agreement between Contractor and DSH.

XV. Audits, Inspection and Enforcement: DSH may inspect the facilities, systems, books and records of

Contractor to monitor compliance with this Exhibit. Contractor shall promptly remedy any violation of any provision of this Agreement and shall certify the same to the DSH Contract Manager in writing.

XVI. Return or Destruction of DSH PCI on Expiration or Termination: Upon expiration or termination of the agreement between Contractor and DSH for any reason, Contractor shall securely return or destroy the DSH PCI. If return or destruction is not feasible, Contractor shall provide a written explanation to the DSH Program Contract Manager, the DSH Chief Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XII.F., above.

A. Retention Required by Law: If required by state or federal law, Contractor may retain, after expiration or termination, DSH PCI for the time specified as necessary to comply with the law.

B. Obligations Continue Until Return or Destruction: Contractor’s obligations under this Exhibit shall continue until Contractor destroys the DSH PCI or returns the DSH PCI to DSH; provided however, that on expiration or termination of the agreement between Contractor and DSH, Contractor shall not further use or disclose the DSH PCI except as required by state or federal law.

C. Notification of Election to Destroy DSH PCI: If Contractor elects to destroy the DSH PCI, Contractor shall certify in writing within 30 days of the expiration or termination of the agreement to the DSH Contract Manager, the DSH Chief Privacy Officer and the DSH Chief Information Security Officer, using the contact information listed in Section XII.F, above, that the DSH PCI has been securely destroyed. The notice shall include the date and type of destruction method used.

XVII. Amendment: The parties acknowledge that federal and state laws regarding information security and privacy rapidly evolves and that amendment of this Exhibit may be required to provide for procedures to ensure compliance with such laws. The parties specifically agree to take such action as is necessary to implement new standards and requirements imposed by regulations and other applicable laws relating to the security or privacy of DSH PCI. The parties agree to promptly enter into negotiations concerning an amendment to this Exhibit consistent with new standards and requirements imposed by applicable laws and regulations.

XVIII. Assistance in Litigation or Administrative Proceedings: Contractor shall make itself and any subcontractors, workforce employees or agents assisting Contractor in the performance of its obligations under the agreement between Contractor and DSH, available to DSH at no cost to DSH to testify as witnesses, in the event of litigation or administrative proceedings being commenced against DSH, its director, officers or employees based upon claimed violation of laws relating to security and privacy, which involves inactions or actions by the Contractor, except where Contractor or its subcontractor, workforce employee or agent is a named adverse party.

XIX. No Third-Party Beneficiaries: Nothing express or implied in the terms and conditions of this Exhibit is intended to confer, nor shall anything herein confer, upon any person other than DSH or Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.

XX. Interpretation: The terms and conditions in this Exhibit shall be interpreted as broadly as necessary to implement and comply with regulations and applicable Federal and State laws. The parties agree that any ambiguity in the terms and conditions of this Exhibit shall be resolved in favor of a meaning that complies and is consistent with federal and state laws and regulations.

XXI. Survival: If Contractor does not return or destroy the DSH PCI upon the expiration or termination of the

Agreement, the respective rights and obligations of Contractor under Sections VI, VII and XI of this Exhibit shall survive the completion or termination of the agreement between Contractor and DSH.

Attachment 1 Contractor Data Security Standards

1. General Security Controls

A. Confidentiality Statement. All persons that will be working with DSH PCI must sign a confidentiality statement, within their organization. The statement must include at a minimum, General Use, Security and Privacy safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to DSH PCI. The statement must be renewed annually. The Contractor shall retain each person’s written confidentiality statement for DSH inspection for a period of three (3) years following contract termination.

B. Background check. Before a member of the Contractor’s workforce may access DSH PCI, Contractor must conduct a thorough background check of that worker and evaluate the results to assure that there is no indication that the worker may present a risk for theft of confidential data.

The Contractor shall retain each workforce member’s background check documentation for a period of three (3) years following contract termination.

C. Workstation/Laptop encryption. All workstations and laptops that process and/or store DSH PCI must be encrypted using a FIPS 140-2 certified algorithm, such as Advanced Encryption Standard (AES), with a 128-bit key or higher. The encryption solution must be full disk unless approved by the DSH Information Security Office.

D. Server Security. Servers containing unencrypted DSH PCI must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.

E. Minimum Necessary. Only the minimum necessary amount of DSH PCI required to perform necessary business functions may be copied, downloaded, or exported.

F. Removable/portable electronic devices. All electronic files that contain DSH PCI data must be encrypted when stored on any removable media or portable device (i.e. USB thumb drives, CD/DVD, smart devices tapes etc.). PCI must be encrypted using a FIPS 140-2 certified algorithm, such as Advanced Encryption Standard (AES), with a 128bit key or higher

G. Antivirus software. All workstations, laptops and other systems that process and/or store DSH PCI must install and actively use a comprehensive next generation anti-virus (NGAV) software solution with automatic updates scheduled at least daily. NGAV software must be able to provide real-time detection and prevention of malware and non-malware attacks, including file based as well as memory-based and file-less attacks. NGAV software must be designed to detect and prevent abnormal behaviors including “zero day” (never before seen malware) attacks and use indicators of compromise to identify abnormalities. Vendor-managed devices operating within DSH networks will utilize DSH-provided endpoint protection software to permit monitoring and isolation of devices which exhibit abnormal behavior.

H. Patch Management. All workstations, laptops and other systems that process and/or store DSH

PCI must have operating system and application security patches applied, with system reboot if necessary. There must be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. Patches rated critical or high, have a common vulnerability scoring system (CVSS) score of 7.0 or greater, or correct exploitable vulnerabilities, must be installed within a maximum 30 days from vendor release.

I. User IDs/User Accounts and Password Controls. All users must be issued a unique user account for accessing DSH PCI. User accounts must be promptly disabled or deleted upon the transfer or termination of an employee. Passwords are not to be shared. Passwords must be at least eight characters. Password policy requiring a length of fifteen characters or more does not require periodic password changes. Passwords of between eight and fourteen characters must require the password be changed at most every 90 days. Passwords must not be comprised of a single dictionary word. Passwords must not be stored in readable format on any computer or system.

Passwords must be changed if compromised or revealed to any party other than the assigned user.

Passwords must be composed of characters from at least three of the following four groups from the standard keyboard:

• Upper case letters (A-Z)

• Lower case letters (a-z)

• Arabic numerals (0-9)

• Non-alphanumeric characters (punctuation symbols)

J. Data Sanitization. All DSH PCI must be sanitized using NIST Special Publication 800-88 standard methods for data sanitization when the DSH PCI is no longer needed.

2. System Security Controls

A. System Timeout. The system must…