Agenda packet — Cotati City Council, September 8, 2026 (part 2 of 2)

which is 128bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by the County Privacy and Security Office.

B. Server Security. Servers containing unencrypted County PHI or PI must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.

C. Minimum Necessary. Only the minimum necessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.

D. Removable media devices. All electronic files that contain County PHI or PI data must be encrypted when stored on any removable media or portable device (i.e.: USB thumb drives, floppies, CD/DVD, Blackberry, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm which is 128bit or higher, such as AES.

E. Antivirus software. All workstations, laptops and other systems that process and/or store County PHI or PI must install and actively use comprehensive anti-virus software solution with automatic updates scheduled at least daily.

F. Patch Management. All workstations, laptops and other systems that process and/or store County PHI or PI must have critical security patches applied, with system reboot if necessary. There must be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable patches must be installed within 30 days of vendor release.

Applications and systems that cannot be patched within this time frame due to significant operational reasons must have compensatory controls implemented to minimize risk until the patches can be installed. Applications and systems that cannot be patched must have compensatory controls implemented to minimize risk, where possible.

G. User IDs and Password Controls. All users must be issued a unique user name for accessing County PHI or PI. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the password. Passwords are not to be shared. Passwords must be at least eight characters and must be a non-dictionary word. Passwords must not be stored in readable format on the computer. Passwords must be changed at least every 90 days, preferably every 60 days.

Passwords must be changed if revealed or compromised. Passwords must be composed of characters from at least three of the following four groups from the standard keyboard:
1) Upper case letters (A-Z)
2) Lower case letters (a-z)
3) Arabic numerals (0-9)
4) Non-alphanumeric characters (punctuation symbols)
H. Data Destruction. When no longer needed, all County PHI or PI must be wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7 Pass) standard, or by degaussing. Media may also be physically destroyed in accordance with NIST Special Publication 800-88. Other methods require prior written permission of the County Privacy and Security Office.

I. System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity. 176 of 280
Agreement No: 2026-6419-A00
Exhibit C (Privacy #4 – v20231218)

Page 29 of 32 ends

J. Warning Banners. All systems providing access to County PHI or PI must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.

K. System Logging. The system must maintain an automated audit trail which can identify the user or system process which initiates a request for County PHI or PI, or which alters County PHI or PI. The audit trail must be date and time stamped, must log both successful and failed accesses, must be read only, and must be restricted to authorized users. If County PHI or PI is stored in a database, database logging functionality must be enabled. Audit trail data must be archived for at least 3 years after occurrence.

L. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user authentications, enforcing the principle of least privilege.

M. Transmission encryption. All data transmissions of County PHI or PI outside the secure internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as AES. Encryption can be end to end at the network level, or the data files containing County PHI can be encrypted. This requirement pertains to any type of County PHI or PI in motion such as website access, file transfer, and E-Mail.

N. Intrusion Detection. All systems involved in accessing, holding, transporting, and protecting County PHI or PI that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

5. Audit Controls
A. System Security Review. Contractor must ensure audit control mechanisms that record and examine system activity are in place. All systems processing and/or storing County PHI or PI must have at least an annual system risk assessment/security review which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews should include vulnerability scanning tools.

B. Log Reviews. All systems processing and/or storing County PHI or PI must have a routine procedure in place to review system logs for unauthorized access.

C. Change Control. All systems processing and/or storing County PHI or PI must have a documented change control procedure that ensures separation of duties and protects the confidentiality, integrity and availability of data.

D. Random Audits. Contractor will accommodate and upon reasonable notice by Sonoma County, work with Sonoma County and/or its subcontractors to submit to a random information security audit. This is to ensure that Contractor’s and/or vendor’s information security practices or standards comply with Sonoma County’s information security policies, standards, procedures and guidelines. Contractor shall ensure that its subconsultants or vendors comply with this requirement.

6. Business Continuity/Disaster Recovery Controls
A. Emergency Mode Operation Plan. Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of County PHI or PI held in an electronic format in the event of an emergency. Emergency means any 177 of 280
Agreement No: 2026-6419-A00
Exhibit C (Privacy #4 – v20231218)

Page 30 of 32 ends

circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than 24 hours.

B. Data Backup Plan. Contractor must have established documented procedures to backup County PHI to maintain retrievable exact copies of County PHI or PI. The plan must include a regular schedule for making backups, storing backups offsite, an inventory of backup media, and an estimate of the amount of time needed to restore County PHI or PI should it be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite storage of County data.

7. Paper Document Controls
A. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information.

County PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

B. Escorting Visitors. Visitors to areas where County PHI or PI is contained shall be escorted and County PHI or PI shall be kept out of sight while visitors are in the area.

C. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as cross cut shredding and pulverizing.

D. Removal of Data. Only the minimum necessary County PHI or PI may be removed from the premises of the Contractor except with express written permission of the County.

County PHI or PI shall not be considered “removed from the premises” if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.

E. Faxing. Faxes containing County PHI or PI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax.

F. Mailing. Mailings containing County PHI or PI shall be sealed and secured from damage or inappropriate viewing of such PHI or PI to the extent possible. Mailings which include 500 or more individually identifiable records of County PHI or PI in a single package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of the County to use another method is obtained.

Part V: Provisions for Access to County Electronic Health Records System (Applies to contractors that have access to County E.H.R. system)

1. General Controls
AGREEMENTS AND CONDITIONS OF ACCESS AND USE In consideration for use of the Department of Health Services (DHS) Electronic Health Record system (“EHR”), User agrees to the following terms and conditions:

A. Contractor shall only use the EHR system to support clients served pursuant to a contract with the County.
178 of 280
Agreement No: 2026-6419-A00
Exhibit C (Privacy #4 – v20231218)

Page 31 of 32 ends

B. Contractor and Contractor staff shall only access the EHR and Protected Health Information for the purpose of providing healthcare services.

C. Contractor shall ensure that staff will not use or disclose Protected Health Information other than as permitted or as required by law or this Agreement.

D. Contractor shall ensure that staff will not share or give authentication credentials, such as a USERID or password, to any other individual, or fail to take appropriate measures to safeguard their authentication credentials.

E. Contractor shall ensure that all staff with EHR access shall be trained on (i) the use of the EHR system; (ii) safeguards necessary to protect the EHR system, and (iii) the proper use/disclosure of information stored in the EHR system.

F. Contractor shall ensure that all staff with access to the EHR system sign a confidentiality agreement stating they will maintain confidentiality of protected information maintained in the EHR System. This agreement may be combined with other required confidentiality agreements.

G. Within 24 hours of discovery, Contractor shall report to DHS Privacy and Security Officer any use or disclosure of Protected Health Information which would violate State/federal regulations or the terms of this Agreement.

H. Contractor shall notify County of staff enrollment, staff changes job duties/credentialling, or staff separation from employment within 24 hours of the staff change using the form provided by the County.

I. County shall be responsible for enrollment of new staff into the EHR system, and adjustments to staff’s level of access when staff changes job duties/credentialling or staff is separated from employment.

J. Contactor shall comply with all other information privacy and security provisions as articulated in this Agreement and exhibits.

K. If any use or disclosure of Protected Health Information by Contractor or Contractor’s agents, staff, subcontractors, or invitees violates State/Federal regulations or the terms of this Agreement, Contractor agrees to accept all responsibility in accordance with Provision 19 (Indemnification) of the Business Associate Agreement. 179 of 280
Agreement No: 2026-6419-A00
Exhibit D

Page 32 of 32 ends

Exhibit D. Mobile Support Team (MST) SmartCare “On Demand” Report Parameters 180 of 280
MST Report Parameters
MST SmartCare “On Demand” Report Parameters
Inclusion Criteria:

Procedure = Mobile Crisis Dispatch Screening Service AND/OR Procedure = Mobile Crisis Encounter
Status = Show or Complete
Date range = 7/1/2023 to end of prior month
Data from Mobile Crisis Dispatch Screening Service and from Mobile Crisis Progress Note linked by logic same/similar as/to that used by Victor in SR1115547.

Columns:

SmartCare
Screen/location Field Name Details
Inquiry Client ID
Inquiry DOB Initial tab – Client information (potential) Inquiry Program Crisis tab, AKA Mobile Crisis Dispatch Screening Tool – Service Information
Inquiry Start Date Initial tab – inquirer information
Inquiry Start Time Initial tab – Inquirer Information
Inquiry End Date Initial tab
Inquiry
End Time*
Initial tab
*If no Inquiry, please use end time of Screening
Service as Victor kindly did for SR 1111159
“Screening Duration”
Calculated Field:

Output: minutes
[End Time] - [Start Time]
Account for End Date and Start Date to ensure
correct calculations for services that cross
midnight.

Client Age
Calculated Field:

Output: years
[Start Date] – [DOB]
Inquiry Presenting Problem Initial tab – Client information (potential) Inquiry Referral Type Initial tab – Referral Resource
Inquiry Referral Subtype Initial tab – Referral Resource Inquiry Relation to Client Initial tab – Inquirer Information Inquiry “Inquiry Disposition”
Disposition dropdown #1 Initial tab - top drop down in screenshot 2 Inquiry “Inq Disp Comments”
Disposition Comments Initial tab – text field in screenshot 2 Inquiry “Screening Disposition 1” Crisis tab, AKA Mobile Crisis Dispatch Screening Tool – screenshot 5 (1 of 3 primary options)
Inquiry
“Screening Disposition 2”
Crisis tab, AKA Mobile Crisis Dispatch Screening
Tool – screenshot 5 (selection from dependent
options)
181 of 280
MST Report Parameters
Inquiry
“Screening Disposition 3”
Crisis tab, AKA Mobile Crisis Dispatch Screening
Tool – screenshot 5 (selection from dependent
options)
Inquiry City Crisis tab, AKA Mobile Crisis Dispatch Screening Tool – Screen for Location Safety screenshot 6
Inquiry “Standardized City” Logic-based field using Victor’s existing list of City misspellings
Inquiry
Location of person in crisis
Crisis tab, AKA Mobile Crisis Dispatch Screening
Tool – Screen for Location Safety dropdown
screenshot 6
Inquiry
“Unsafe?”
Crisis tab, AKA Mobile Crisis Dispatch Screening
Tool – Screen for Location Safety screenshot 7
“Is the location where services are needed unsafe
for the person in crisis or for the mobile crisis
team to deliver services?”
Inquiry Location Concerns Crisis tab, AKA Mobile Crisis Dispatch Screening Tool – Screen for Location Safety screenshot 7
Inquiry Gender Identity Demographics Tab – Identifying Information (optional)
Inquiry Sexual Orientation Demographics Tab – Identifying Information (optional)
Inquiry Client does not speak
English Demographics Tab - Language
Inquiry Interpreter Services
Needed Demographics Tab - Language
Inquiry Primary/Preferred
Language Demographics tab
Mobile Crisis
Progress Note
Interpreter Services
Needed
Service Tab screenshot 8
Output: 1,0 (checked =1, blank =0)
Mobile Crisis
Progress Note “Interpreter Used” Service Tab screenshot 8“Was an interpreter utilized?” Mobile Crisis
Progress Note “Language” Service Tab screenshot 8“Language service was provided in” Mobile Crisis
Progress Note “Interpreter Telehealth”
Calculated field:

Output: 1,0 (yes=1, no=0, blank=0)
“Was an interpreter engaged via telehealth?”
Note Tab 2026 Update Detail screenshot 12
Mobile Crisis
Progress Note Program Service Tab screenshot 8
Mobile Crisis
Progress Note Procedure Service Tab screenshot 8
Mobile Crisis
Progress Note Start Time Service Tab screenshot 8
Mobile Crisis
Progress Note Arrival Date on Scene Note Tab screenshot 9(# Episodes counted by arrival time.) Mobile Crisis
Progress Note Arrival Time on Scene Note Tab screenshot 9(# Episodes counted by arrival time.) 182 of 280
MST Report Parameters
“Response Time”
Calculated Value:
=[Arrival Time] – [Start Time]
Take dates into consideration to ensure correct
calculations if crossing midnight.

Mobile Crisis
Progress Note Service Time Service Tab screenshot 8
Mobile Crisis
Progress Note “Provider 1” Author field of Mobile Crisis Progress Notescreenshots 8-11 Mobile Crisis
Progress Note Provider 2 Note Tab 2026 Update Detail screenshot 12 Mobile Crisis
Progress Note Provider 2 Location Note Tab 2026 Update Detail screenshot 12 Mobile Crisis
Progress Note Provider 3 Note Tab 2026 Update Detail screenshot 12 Mobile Crisis
Progress Note Provider 3 Location Note Tab 2026 Update Detail screenshot 12 Mobile Crisis
Progress Note “Specialist Telehealth”
Calculated Value:

Output: 1,0 (yes=1, no=0, blank=0)
Note Tab 2026 Update Detail screenshot 12
Mobile Crisis
Progress Note Location Service Tab screenshot 8
Mobile Crisis
Progress Note Mode of Delivery Service Tab screenshot 8 Mobile Crisis
Progress Note Cancel Reason Service Tab screenshot 8
Mobile Crisis
Progress Note Disposition of Encounter Note Tab screenshot 10 Mobile Crisis
Progress Note Disposition Details Full text of Disposition Details fieldNote Tab screenshot 10 Mobile Crisis
Progress Note “CJ Diversion”
Calculated field:

Output: 1,0
Is “Criminal Justice Diversion” phrase present in
Disposition Details text field?
Mobile Crisis
Progress Note “ED Diversion”
Calculated field:

Output: 1,0
Is “Emergency Department (ED) Diversion”
phrase present in Disposition Details text field?
Mobile Crisis
Progress Note “EMS Diversion”
Calculated field:

Output: 1,0
Is “Emergency Medical Services (EMS) Diversion”
phrase present in Disposition Details text field?
Mobile Crisis
Progress Note “Fire Diversion”
Calculated field:

Output: 1,0
Is “Fire Diversion” phrase present in Disposition
Details text field?
Mobile Crisis
Progress Note “LE Diversion”
Calculated field:

Output: 1,0
Is “Law Enforcement (LE) Diversion” phrase
present in Disposition Details text field?
183 of 280
MST Report Parameters
Mobile Crisis
Progress Note “LE Involvement”
Was law enforcement involved in the encounter?
Drop-Down field
Note Tab 2026 Update Detail screenshot 12
Mobile Crisis
Progress Note “Involuntary Hold”
Note Tab screenshot 10
“Was the client on an involuntary hold at the end
of the encounter?”
Mobile Crisis
Progress Note
“DTS”
Note Tab screenshot 10
Output: 1,0 – “N/A” if “Involuntary Hold” = “No” or
“Unknown”
“Reason(s) for hold:” DTS checked=1,
unchecked=0
Mobile Crisis
Progress Note
“DTO”
Note Tab screenshot 10
Output: 1,0 – “N/A” if “Involuntary Hold” = “No” or
“Unknown”
“Reason(s) for hold:” DTO checked=1,
unchecked=0
Mobile Crisis
Progress Note
“GD”
Note Tab screenshot 10
Output: 1,0 – “N/A” if “Involuntary Hold” = “No” or
“Unknown”
“Reason(s) for hold:” GD checked=1,
unchecked=0
“Multiple Reasons”
Calculated field:

Output: 1,0 – “N/A” if “Involuntary Hold” = “No” or
“Unknown”
1 if more than one “Reason(s) for hold:” are
checked
Mobile Crisis
Progress Note “Transport/Accompany”
Note Tab screenshot 10
“Did Mobile Crisis Team provide transport or
accompany the client while they were being
transported to a treatment setting?”
Mobile Crisis
Progress Note Miles Driven Note Tab screenshot 10
Mobile Crisis
Progress Note
Provider 1 Transportation
Time Note Tab screenshot 10
Mobile Crisis
Progress Note
Provider 2 Transportation
Time Note Tab screenshot 10
Mobile Crisis
Progress Note Type of Transportation Note Tab screenshot 10 Has Mobile Crisis
Assessment?
Calculated field:

Output: 1,0
Use same logic as Mobile Crisis Audit
Has Mobile Crisis Follow
Up?
Calculated field:

Output: 1,0
Use same logic as Mobile Crisis Audit
(screenshot 11 for reference)
Referral to Ongoing
Services
Not sure how to collect this – maybe something
has been built for the DHCS report that could be
borrowed for this?
184 of 280
MST Report Parameters
Screenshots

1. Inquiry Initial Tab
185 of 280
MST Report Parameters

2. Inquiry Initial Tab Detail: Disposition

3. Inquiry Demographics Tab
186 of 280
MST Report Parameters
4a. Inquiry Crisis Tab top
187 of 280
MST Report Parameters
4b. Inquiry Crisis Tab middle
188 of 280
MST Report Parameters
4c. Inquiry Crisis Tab bottom

5. Inquiry Crisis Tab Detail: Disposition
189 of 280
MST Report Parameters

6. Inquiry Crisis Tab Detail: Screen for Location Safety

7. Inquiry Crisis Tab Detail: Location Concerns
190 of 280
MST Report Parameters

8. Mobile Crisis Progress Note – Service Tab (Service Note) 191 of 280
MST Report Parameters

9. Mobile Crisis Progress Note – Note Tab A
192 of 280
MST Report Parameters

10. Mobile Crisis Progress Note – Note Tab B
193 of 280
MST Report Parameters

11. Mobile Crisis Follow-Up
194 of 280
MST Report Parameters

12. Mobile Crisis Progress Note 2026 Update Detail
195 of 280
Cotati City Council
Agenda Staff Report
Item type: REGULAR AGENDA (ACTION)
To: City Council
Subject: APPROVAL OF SECOND AMENDED AND RESTATED SAFE

MEMORANDIUM OF UNDERSTANDING
Date: September 8, 2026
Written by: Damien O'Bid, City Manager
Recommendation
It is recommended that the City Council approve a resolution authorizing the City Manager to enter into and execute the Second Amended and Restated Memorandum of Understanding (MOU) with the City of Rohnert Park, Sonoma State University and Petaluma People Services Center to Operate and Manage the Rohnert Park/Cotati SAFE Team (Specialized Assistance for Everyone) to provide crisis response services to our communities, subject to final review and such revisions as may be approved by the City Attorney.

Background
In 1989, the City of Eugene, Oregon developed an innovative community-based public safety system to provide mental health first response for crises involving mental illness, homelessness, and addiction. As a result, the White Bird Clinic launched CAHOOTS (Crisis Assistance Helping Out On The Streets) as a community policing initiative.

The CAHOOTS model mobilizes two-person teams consisting of a medic (a nurse, paramedic, or EMT) and a crisis worker who has substantial training and experience in the mental health field.

The CAHOOTS teams deal with a wide range of mental health-related crises, including conflict resolution, welfare checks, substance abuse, suicide threats, and more, relying on traumainformed de-escalation and harm reduction techniques. They also can handle non-emergency medical issues, avoiding ambulance transport and emergency room treatment.

CAHOOTS staff are not law enforcement officers and do not carry weapons and are dispatched through 911 or through a non-emergency line for issues that do not involve an immediate safety threat to the individual in crisis or the general public. 196 of 280
After approval by the Cotati City Council, the City of Cotati (City), in partnership with Rohnert Park, launched a 12 hour per day crisis response team in November 2021. This has gradually grown to cover 18 hours per day, and then 24 hours per day in FY 2024-25. The program is run by Petaluma People Services (PPSC) and has been branded the “SAFE Team” (Specialized Assistance for Everyone), which was intended to align with the City of Petaluma’s pilot program that had already launched as the “SAFE Team”. This was intended to reduce public confusion over the service.

In October 2022, the City Council approved the partnership and addition of Sonoma State University to the SAFE MOU, resulting in the current composition today as the Cotati-Rohnert Park-SSU SAFE team. Operating separately, but very closely coordinated, is the Petaluma SAFE team, with both teams collectively known as the South County SAFE team. Currently, the other mobile crisis response teams operating in Sonoma County include the InResponse team (Santa Rosa) and the Mobile Support Team (MST) that serves areas of Sonoma County not served by SAFE or InResponse. While the teams are similar in function, the InResponse and MST teams are different in that they include a licensed clinician in the field and try to draw a distinction between a mental health call and homeless service.

Analysis/Discussion
The MOU identifies the roles and responsibilities of PPSC, the City of Rohnert Park, SSU and the City of Cotati. As in the current MOU, PPSC will continue to provide the personnel, supplies, management and oversight of the field program, while the City of Rohnert continues to provide and maintain the vehicle assigned to the SAFE Team. The revised MOU includes general clean up language throughout, including changes to re-align certain provisions with the Petaluma SAFE MOU and a two-year extension to the MOU term. However, the primary substantive change is to meet the requirements of the Measure O grant, which requires the City (via this MOU to PPSC) to meet the requirements necessary to bill for program costs for MediCal patients served, as part of the intermediate goal of program fiscal sustainability. In practice, this means that PPSC needed to bring on a telehealth licensed clinician, as staff believe putting a licensed clinician in the field full time is a very inefficient use of a highly trained and costly resource. As a result, the South County SAFE teams now have a licensed clinician overseeing the program and on-call when needed via telehealth. The vendor performing this service is the Committee on the Shelterless (COTS). Additionally, the SAFE team needed to be qualified to collect the necessary data for Medi-Cal billing through the SMART Care system as well as meet a variety of other health privacy and information security requirements. The fully Medi-Cal compliant SAFE teams began service on September 1, 2026.

The SMART Care system is also rolled out to MST and InResponse, with the goal of collecting the same data using the same data definitions so that data can be compared and other information, such as diversion numbers and health insurance information for non-Medi-Cal patients. This is not for billing, but for general tracking to allow the collective mobile crisis teams to have follow on conversations with the beneficiaries of the system so that they will participate financially and help build a sustainable County-wide program. In addition to tracking 197 of 280
information for fiscal sustainability, the City continues to collect information on number of responses, response times and outcomes to determine program effectiveness.

In a recent report to the Board of Supervisors, Sonoma County Department of Health Services (DHS) stated that one of their goals was to move to a single model as soon as July 1, 2027.

Presumably, this will be discussed in a forthcoming working group of mobile crisis jurisdictions that DHS says that they intend to convene in the near future. In advance of the initial working group discussions, staff anticipate the following points of discussion when determining a unified mobile crisis model:
• Cost, service level and outcomes, based at least in part on the clinician model (telehealth vs in field).
• Mental Health vs. Homeless Service
• Available program funding
Finally, the attached draft MOU has been reviewed by PPSC, Rohnert Park, SSU and Cotati staff for program scope. However, each jurisdiction may also need final legal review, so final legal changes may still occur, which is reflected in the recommendation.

Financial Considerations
The additional requirements to be Medi-Cal eligible significantly increased the overall cost of the program and the additional reporting requirements are anticipated to create longer in-service times for the SAFE teams filling out forms. However, the City intends to continue tracking responses, response times, etc. to better understand the overall impact to service levels as we move into conversations about the ideal unified system, or potentially systems, for Sonoma County.

The intent is to pair the Measure O grant with the necessary direct General Fund contributions and in-kind services to support the SAFE service during the term of the MOU. City in-kind services primarily consist of program administration and support time, dispatch services and the share of the infrastructure costs needed locally to support the SAFE program. For Cotati, the unreimbursed General Fund contributions and value of the in-kind service has averaged approximately $113,000 per year since the inception of the program. By leveraging City resources, it allows the County to improve their services to our residents. For the South County teams, DHS has been able to leverage nearly $11 million to date in local resources by supporting the South County SAFE teams:
198 of 280
The companion Measure O grant agreement (see separate agenda item, this meeting) will fund the primary “hard“ costs in Year 1 (FY 26-27) and most of the hard costs in Year 2 (FY 27-28), but very little costs in Year 3. The intent is to work collaboratively with DHS and Santa Rosa over the next two years to develop a fiscally sustainable model. The primary funding risks are:
• A reduction in Medi-Cal from the current 85% to 50%, if the supplemental funding is not renewed in the State budget for FY 27-28.
• Non-renewal of Measure O.
• Inability to leverage funding from the program beneficiaries.

Without new sources of funding, it is unlikely that the SAFE teams could continue to operate in their current form in Year 3, therefore the MOU is limited to a term of two years.

Environmental Issues
Where it can be determined with certainty that there is no possibility that the activity in question may have a significant effect on the environment, the activity is not subject to CEQA review.

This general rule can be applied to activities which could be subject to the CEQA process, but which logic dictates should not be subject to CEQA review. Therefore, based on the information provided above, the proposed resolution is exempt from CEQA pursuant to Section 14.03.021 of the CEQA Guidelines in that there is no possibility that the activity may have a significant impact on the environment.
199 of 280
RESOLUTION NO. (XX)

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF COTATI

AUTHORIZING THE CITY MANAGER TO ENTER INTO AND EXECUTE THE

SECOND AMENDED AND RESTATED MEMORANDUM OF UNDERSTANDING (MOU) WITH PETALUMA PEOPLE SERVICES CENTER, SONOMA STATE

UNIVERSITY, AND THE CITY OF ROHNERT PARK TO OPERATE AND

MANAGE AN ALTERNATIVE CRISIS RESPONSE PROGRAM KNOWN AS THE

ROHNERT PARK-COTATI SPECIALIZED ASSISTANCE FOR EVERYONE (SAFE) TEAM
WHEREAS, each year approximately 5% of all calls for service (Rohnert Park, Cotati, and Sonoma State University) are crisis calls involving homelessness, mental illness, or substance abuse which could be diverted to an alternative response team; and WHEREAS, alternative care providers are trained, suited, and equipped to deliver more cost effective and appropriate services related to mental health, substance abuse, and shelter and housing services to individuals in need, in lieu of police response to such calls for assistance; and WHEREAS, in November 2021, in accordance with a three-party Memorandum of Understanding (MOU), Petaluma People Services Center (PPSC), a California non-profit public benefit corporation, implemented a pilot program with the City of Cotati and City of Rohnert Park to provide mobile mental health crisis services; and WHEREAS, the City of Cotati (City) in partnership with the City of Rohnert Park share the benefits of the services of the new crisis response team, Specialized Assistance For Everyone (SAFE), and share the costs of the program based on a cost share that is fair and reasonable, based on a 2 year rolling average of actual calls for service; and WHEREAS, the program expanded to include Sonoma State University (SSU) in October 2022; and
WHEREAS, in Fiscal Year 2024-25, the SAFE team began 24/7 operations; and WHEREAS, to begin to develop a sustainable funding model and as a precondition for Measure O grant funding, the SAFE team must become a certified Medi-Cal service provider to allow the County of Sonoma to recover eligible Medi-Cal expenses from the SAFE team patient interactions; and
WHEREAS, on September 1, 2026, the SAFE team was fully compliant as a Medi-Cal service provider and began collection Medi-Cal billing data; and WHEREAS, the action of entering into an MOU does not constitute a project as defined by California Environmental Quality Act Guidelines Section 15378; therefore, no further environmental review is required.
200 of 280
NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Cotati that it does hereby authorize the City Manager, to execute the Second Amended and Restated MOU with Petaluma People Services Center, City of Rohnert Park and Sonoma State University in substantially similar form as Exhibit A, subject to such revisions as may be approved by the City Attorney.

IT IS HEREBY CERTIFIED that the foregoing resolution was duly adopted at a regular meeting of the City Council of the City of Cotati held on September 8, 2026, by the following vote, to wit:

SECOND AMENDED & RESTATED MEMORANDUM OF UNDERSTANDING

CITY OF COTATI,

CITY OF ROHNERT PARK,

SONOMA STATE UNIVERSITY

THE PETALUMA PEOPLE SERVICES CENTER
Mobile Crisis Intervention Team

SPECIALIZED ASSISTANCE FOR EVERYONE (SAFE TEAM)
This second amended and restated MEMORANDUM OF UNDERSTANDING (the "MOU" or "Agreement") is made this __th day of _____ 202220265, by and between the City of Cotati ("Cotati"), City of Rohnert Park ("Rohnert Park") both municipal organizations organized and existing under and by virtue of the laws of the State of California(collectively the "Cities"), the Board of Trustees of the California State University, on behalf of Sonoma State University (“Sonoma State”) (Cotati, Rohnert Park and Sonoma State are each an “Entity” and collectively the “Entities”) and The Petaluma People Services Center, a California non-profit public benefit corporation ("PPSC"). The Entities and PPSC are collectively referred to as the “Parties”.

AGREEMENT

1. Scope of Work
The Scope of Work that shall be performed by PPSC for the Entities under this MOU consists of the services in this Section 1:
• PPSC shall hire and provide the personnel, equipment, and supplies necessary for the establishment of one or more mobile crisis intervention teams, referred to in this Agreement as a Specialized Assistance for Everyone team ("SAFE team"). The Cities shall jointly provide an adequate vehicle for transport services, interoperable communication equipment for communications with dispatch. PPSC shall be responsible for direct oversight and management 202 of 280
OAK #4856-8469-1508 v1 17
of the SAFE team(s).
• PPSC shall ensure that the SAFE team(s) shall operates within the geographic boundaries of the Entities when performing services under this MOU (See Exhibit DC for Sonoma State), except when shifts are pre- scheduled and approved in advance by the Entities to serve additional jurisdictions. Otherwise, the SAFE team(s) may only leave the Entities’ service boundaries to respond to calls for service with permission from the Entities dispatchers, patrol supervisors, or watch commanders.
• SAFE team(s) shall focus proactive outreach and patrols in the areas in need within the geographic boundaries of the Entities, as identified by PPSC and the Entities. The program is intended to reach community members where they are. Services will be provided by SAFE in partnerships with the police department of the Entities. • SAFE team(s) shall proactively counsel, voluntarily transport when requested, or refer community members experiencing physical and mental health, substance abuse, or homeless related issues to the PPSC or other open treatment or social service facilities or services within the CitiesEntities or /County of Sonoma, or transport to other open social services agencies within the Cities/County of Sonoma. However, SAFE team(s) shall consult with emergency medical services (EMS) if the individual is exhibiting any signs of acute medical issues prior to voluntary transport to determine if EMS is the appropriate transporting agency. • SAFE team(s) shall provide voluntary transport for individuals with necessary chronic mental health and/or care within the geographic boundaries of the Entities. • SAFE team(s) shall follow established protocols required by this MOU, PPSC management and follow directions from Rohnert Park Department of Public Safety (RPDPS), Cotati Police Department (CPD), and Sonoma State Police Department for activities in the respective jurisdictions of the Entities, as well as PPSC staff. Each Entity will assign a point of contact for operational issues and a point of contact for Entity vehicle issues. • SAFE teams(s) shall report all vehicle crashes/damage or loss of equipment owned by the to the Entitiesy that owns the vehicle/equipment, including vehicles, radios and other equipment. • PPSC shall operate mobile crisis services as defined by the California Department of Health Care Services (DHCS) Behavioral Health Information Notice No. 23-025 (BHIN 23-025). • The Parties shall work in partnership with Sonoma County Behavioral Health (SCBH). 203 of 280
OAK #4856-8469-1508 v1 18
Hours of Service and Holidays
PPSC shall provide trained personnel appropriate to staff one or more vans in service for the number of hours per day, and times of day, as agreed to jointly by Entities and PPSC. For the term of this agreement, each SAFE team shall be comprised of no less than two qualified staff, 24 hours per day, 365 days per year. When directed by the Entities, PPSC shall expand service to 24 hours per day. The services shall be provided 365 days a year.

Upon mutual agreement between the Entities and PPSC, PPSC shall staff extra mobile crisis intervention assignments on holidays and special events not limited to:
• New Year's Eve, New Year's Day, Martin Luther King Day, St. Patrick's Day, Fourth of July, Halloween, Thanksgiving, Christmas Eve, Memorial Day weekend, Labor Day weekend, Veteran's Day, or any other day considered to need the services of a two- person mobile crisis intervention team.

The additional staffing requests shall be in four-hour increments. The Entities shall give a thirty (30) day notice of request for additional services prior to the event. PPSC shall have fourteen (14) days to advise if they can fulfill the request, and if the request is anticipated to result in overtime, and if the extra staffing will result in an increase in the total annual cost in the approved cost proposal, per paragraph 5.

After PPSC has completed the extra assignment, they will bill Entities for payment of hours performed. If the time billed is over the hours requested, PPSC shall delineate the reasons for the overage in the request. The Entities shall pay one and one-half times the hourly rate of for approved overtime worked. The payment will be made to PPSC within 60 days of the billing.

Area of Patrol and Transportation Services
PPSC shall provide proactive outreach patrol and crisis intervention services within the geographic boundaries of the Entities for services provided under this MOU, unless approved in advance by the Entities. PPSC shall also provide transportation services from within the geographic boundaries of the Entities to facilities within County of Sonoma. The SAFE Team shall maintain an emphasis in proactive outreach, servicing and preventative services in the core areas identified by the Entities, 204 of 280
OAK #4856-8469-1508 v1 19
public spaces such as parks, and other areas as identified between PPSC and by the Entities Public Safety and Police personnel.

Description of Services
Subject to compliance with applicable law, including appropriate medical direction and control, PPSC shall observe, and reach out to any person, while in a public place, that meets any of the criteria referenced in 1.A- 1.DE below. For the purpose of this section, the term "transport" means to provide a courtesy ride to a willing, self-ambulatory person who requires no medical attention or treatment during transport. While providing services under this Agreement, PPSC shall obey all lawful commands and directions received from police or fire personnel.

All PPSC provided proactive outreach, crisis intervention and transportation services shall be subject to the direction of and oversight by the Entities. The Entities and PPSC shall determine priority call types, which may be amended from time to time, as mutually agreed to by the Entities and PPSC.

PPSC shall respond to all radio dispatches and contacts from the Entities’ police and fire personnel requesting mobile crisis intervention services or PPSC's assistance, unless they are already assigned to another call for service of a higher priority. If PPSC is unable to respond, or will be delayed due to another higher priority call, PPSC shall immediately communicate this to the Entity requesting service.

Calls will generally be responded to in the order they are received by the dispatch centers, except when a higher priority call is received. PPSC can be pulled from a call for service and dispatched to a higher priority call when necessary.

The Entities and PPSC shall determine priority call types prior to beginning service, which may be amended from time to time, as mutually agreed to by the Entities and PPSC.

1.A. Persons Intoxicated/Under Influence of Controlled Substances

1.A.1. If the person is unconscious and cannot be roused or revived, PPSC shall request an ambulance from RPDPS or CPD Dispatch and standby to assist the responding emergency medical personnel, as necessary.

1.A.1. At least one (1) person on the SAFE team vehicle shall be carrying, trained, and able to administer naloxone.

1.A.1.1.A.2. If the person is willing to be transported to a treatment center, PPSC shall 205 of 280
OAK #4856-8469-1508 v1 20
transport them to the appropriate licensed or certified open treatment facility within the Countythe County of Sonoma if:
1) The person is conscious but appears mentally ill or intoxicated or under influence of controlled substances; or
2) PPSC has reasonable cause to believe that the person is dangerous to themselves.

1.A.2. If the person is unwilling to be transported to a treatment center, but appears to be experiencing symptoms of mental illness, is intoxicated, or is under influence of controlled substances, or PPSC has reasonable cause to believe the person is dangerous to others, PPSC shall immediately notify RPDPS or CPD dispatch to have police officers respond, and shall stand by to assist the officers, as necessary.

1.A.3. If PPSC has reasonable cause to believe the person is intoxicated or under the influence of a controlled substance while in a public place, PPSC may counsel the person on treatment and detoxication options, and if the person is willing to accept transport, may transport them to PPSC or other appropriate open facility for further assistance.

1.B. Persons Needing Non-Medical Care or Treatment for Mental Illness

1.B.1. If a person appears to be in need of care or treatment for mental illness, but not dangerous to themselves or others, or gravely disabled, PPSC may counsel the person on treatment options and, if the person is willing, transport them to PPSC, Crisis Stabilization Unit, or other appropriate facility within the County of Sonoma. Transports to appropriate Kaiser Medical Facilities outside the County of Sonoma may be permitted if necessary and upon advanced notification to RPDPS or CPD dispatch.

1.B.2. If PPSC has probable cause to believe that the person is dangerous to themselves or others, PPSC shall immediately notify RPDPS or CPD dispatch to have police officers respond and shall standby, as necessary.

1.C. Persons in Need of Immediate Shelter
When requested by dispatch, a police supervisor, or police officer, PPSC shall provide transportation to mentally ill or disoriented persons in need of immediate transport to an 206 of 280
OAK #4856-8469-1508 v1 21
appropriate open shelter or treatment center, or provide such persons transportation to and from other open social services agencies or publicly organized and sponsored shelters within the County of Sonoma.

1.D. First Aid and Chronic Care
The SAFE team may be dispatched to requests for minor medical complaints that do not require emergency medical care. PPSC staff will not provide diagnostic medical evaluations but may request a medical assessment by Emergency Medical Services (EMS) personnel as necessary.

1.E. Additional Services at Direction of the Entities
Upon mutual agreement between the Entities and PPSC, PPSC shall staff extra mobile crisis intervention assignments on holidays and special events not limited to:
• New Year's Eve, New Year's Day, Martin Luther King Day, St. Patrick's Day, Fourth of July, Halloween, Thanksgiving, Christmas Eve, Memorial Day weekend, Labor Day weekend, Veteran's Day, or any other day considered to need the services of a twoperson mobile crisis intervention team.

2. Staffing Qualifications & Restrictions

2.A. PPSC represents that it has employees who have qualifications, the experience, and the training to provide services as described in a reasonable and responsible manner. The Entities rely upon this representation when entering into this Agreement. PPSC shall, in compliance with applicable law, be 207 of 280
OAK #4856-8469-1508 v1 22
responsible for hiring of SAFE team members and shall be responsible for ensuring completion of a background check of prospective employees. PPSC shall inform prospective employees that their full name, date of birth, driver’s license number, and other information needed will be provided to the Entities for any necessary background and security clearances. These clearances are needed before using a police radio or operating equipment owned by the Entities, such as a vehicle. The Entities reserve the right to reject any employee of PPSC and/or its trainee observer from riding in the vehicle or participating in PPSC’s provision of services under this Agreement, on the basis of the individual’s criminal history record, serious misconduct issues, or driving record. PPSC shall immediately notify the Entities should any employee providing services under this Agreement be arrested or identified as being under criminal investigation.

2.B. Effective JanuaryJuly 1, 2026 all calls for service shall adhere to the guidelines outlined in the California Department of Health Care Services (DHCS) Behavioral Health Information Notice No. 23- 025 (BHIN 23-025), regardless of the individual’s Medi-Cal or insurance status. If the County of Sonoma ceases to provideing grant funding for the SAFE program, the Entities can elect to release PPSC from this requirement. Release from this requirement requires a written release from each of the Entities.

2.CB. As a material term to this contractAgreement, during the provision of patrol, crisis intervention, and transportation services under this contractAgreement, PPSC shall hire and retain a licensed mental health professionalLicensed Practitioner of the Healing Arts (LPHA) available for consultation to support the field team(s) as needed, 24 hours per day, 7 days per week. Alternatively, PPSC may contract with an LPHA or firm that offers LPHAs as needed, provided they are available 24 hours per day, 7 days per week for consultation. PPSC shall also hire and retain one or more supervisors to oversee the SAFE program and be available as needed to the field team(s) and the Entities, 24 hours per day, 7 days per week. and Said supervisor(s) shall ensure that the SAFE team vehicle(s) shall be staffed by at least two (2) persons per vehicle. At least one (1) person shall be currently certified as an Emergency Medical Technician, First Responder, Registered Nurse, or Licensed Health Care Practitioner (collectively "EMT Specialist"), and at least one person shall be qualified in social work ("Crisis Intervention Specialist"). If neither person is an LPHA, the field team shall have access to an LPHA via telehealth, which shall be available within 10 minutes of the request video. At least one (1) person shall be able to conduct a crisis assessment utilizing the DHCS Crisis Assessment. PPSC shall 208 of 280
OAK #4856-8469-1508 v1 23
designate either person to serve as a field lead. The field lead shall make the final decision regarding transportation of any willing person to a non-emergency medical care provider, shelter, or to an alcohol, drug, or mental health treatment facility, unless the field lead received direction from the respective Entity on where to transport the person. PPSC shall ensure that its employees use the standard of care appropriate to their profession to comply with all applicable federal, state, and local laws, codes, ordinances, and regulations. PPSC represents and warrants to Entities that it has and shall, at its sole cost and expense, keep in effect or obtain at all times during the term of this MOU any licenses, permits, insurance and approvals which are legally required for PPSC and its employees to provide the services described. Entities shall not be responsible or liable for PPSC's failure to comply with any or all of the requirements contained in this paragraph. PPSC represents that it has employees who have qualifications, experience and training to provide the services as described in a reasonable and responsible manner. The Entities rely upon this representation in entering into this contract.

2.D. Except for a trainee observer actively involved in a program leading to employment by PPSC, PPSC shall ensure that no person shall ride in the vehicle except for employees of PPSC or the Entities, who are in the course of providing services contemplated under this MOU, and persons receiving services under this MOU. PPSC shall ensure that at no time shall more than a total of three (3) persons employed by, or under training with PPSC, ride in the vehicle.

2.E.2.D.As a material term to this contract, PPSC shall require that all persons operating a vehicle on behalf of the SAFE Team have a clean driving recording, free ofwith no more than one at-fault accidents, and no more than one moving violations or points within the last 3 years. PPSC shall enroll all persons operating a vehicle on behalf of the SAFE team in the DMV Employer Pull Notice program. PPSC shall not allow any person with any of the following criminal convictions to provide services under this MOU: any conviction which requires or is grounds for the revocation or denial of licensure under 22 CCR§ 100214.3 or 22 CCR§ 100174.

2.F.2.E. It is expressly agreed that PPSC, in the performance of the work and services agreed to be performed by PPSC, shall act as and be an independent contractor and not an agent or employee of the Entities and shall have responsibility for and control over the details and means of providing its services under this MOU. With the exception of the SAFE vehicle and mobile data computers (MDC)/interoperable communication equipment for contact with dispatch, PPSC shall furnish, at its own expense, all labor, materials, equipment, tools, transportation and services necessary for the 209 of 280
OAK #4856-8469-1508 v1 24
successful completion of the services under this MOU. As an independent contractor, neither PPSC nor its employees shall obtain any rights to retirement benefits or other benefits which accrue to Entity's employees, and PPSC hereby expressly waives any claim it may have to any such rights.

PPSC, its officers, employees and agents shall not have any power to bind or commit the Entity to any decision. PPSC acknowledges that it shall pay all taxes, assessments and premiums under the federal Social Security Act, any applicable unemployment insurance contributions, Workers Compensation insurance premiums, sales taxes, use taxes, personal property taxes, or other taxes or assessments now or hereafter in effect and payable by reason of or in connection with the services to be performed by PPSC. Entities shall not be responsible for payment of PPSC's employees, and compliance with applicable wage orders and terms of employment shall be the sole responsibility of PPSC.

2.G. PPSC certifies that it is aware of the provisions of the California Labor Code which require every employee to be insured against liability for workers' compensation or to undertake self-insurance in accordance with the provisions of that Code, and certifies that it will comply with such provisions before commencing performance of this MOU and at all times in the performance of the MOU. PPSC certifies that it is aware of and has complied with the provisions of California Labor Code§ 6401.7, which requires every employer to adopt a written injury and illness prevention program.

3. Use of Equipment

3.A. Unless the Entities agree in writing to an alternate arrangement, Rohnert Park will provide PPSC with a modified passenger van type vehicle, and the MDCs with mobile and portable interoperable communications (UHF/VHF) for use during the duration of this Agreement. PPSC agrees to use SAFE Team vehicles only when they are in service as mobile crisis intervention team vehicles under this Agreement, or when reasonably necessary for transporting the vehicles to and from maintenance. Any use of the vehicles outside the mobile crisis intervention team intended purpose, and/or except for the purposes listed in the Agreement, is prohibited. Equipment shall be provided in good working order. If an MDC or mobile and portable interoperable communications do not work properly, PPSC shall make immediate arrangements with Rohnert Park to have the device(s) repaired or replaced. PPSC agrees to return any vehicle(s), MDCs, communication equipment, and any other non-consumable equipment that the Entities may agree to provide to PPSC for program use, in good working order and general condition at the completion of this MOU. Rohnert Park shall provide necessary fuel, routine vehicle maintenance, and repairs of the vehicle, except PPSC shall bear any 210 of 280
OAK #4856-8469-1508 v1 25
costs of any repair that is necessary due to deliberate or negligent acts by PPSC employees. Except for maintenance provided by Rohnert Park as provided herein, PPSC shall ensure ongoing maintenance for any other equipment. PPSC shall operate the vehicle and maintain the interior so that it is free of hazards to vehicle occupants. All vehicle backing requires the use of a spotter to avoid vehicle damage.

3.A. PPSC shall be responsible for ensuring the security of police communication equipment and MDCs, in consultation with the Entities. All employees will be trained on the proper operation of the police radio. PPSC shall ensure that its personnel will keep their communication equipment on and at a volume to hear dispatch communications.

3.A.

4. Term of Agreement
The term of this Agreement shall commence on the date of its execution by all Parties and shall continue in full force and effect until June 30October 31, 20262028, unless earlier terminated in accordance with this MOU.

5. Compensation, Payment and Cost-Share

5.A Payment to PPSC.

The compensation to be paid to PPSC, including both payment for services and reimbursable expenses, for services provided directly under this Agreement shall be at based on PPSC's actually incurred and direct personnel and operating expenses, plus a permitted 10% indirect cost rate, as particularly described in Exhibit A, attached hereto and incorporated by this reference. PPSC shall provide the Entities with a cost proposal for the following fiscal year no later than February 1, which shall be approved by the Entities and become Exhibit A for that fiscal year. PPSC shall not bill Entities for any annual increases in expenses that exceeds the CPI for Urban Wage Earners and Clerical Workers (CPI-W) for the San Francisco region. Any increase will be effective at the start of the Entities’ fiscal year (July 1).

PPSC shall submit itemized monthly statements for work performed and for costs actually incurred in providing the services to the Entities, which shall bill each of the Entities in accordance with their 211 of 280
OAK #4856-8469-1508 v1 26
respective cost share set forth in section 5.B. All statements shall include adequate documentation demonstrating work performed during the billing period and shall conform to Federal Funding invoicing requirements, if applicable. Except as otherwise provided herein, each Entity shall make payment of their respective cost- share, in full, within thirty (30) days after their approval of the invoice.

Payments due and payable to PPSC for current services must be within the current budgetnot exceed the approved cost proposal and within an available, unexhausted and unencumbered appropriation of each Entity. In the event that each Entity has not appropriated sufficient funds for payment of PPSC services beyond the current fiscal year, this Agreement shall cover only those costs incurred up to the conclusion of the current fiscal year; payment for additional work is conditional upon future appropriation to Entities. Expenses not set forth in Exhibit A shall not be subject to payment unless preapproved in writing by each Entity. PPSC will not undertake any work that will incur costs in excess of the amount set forth in this Agreement without prior written amendment to this Agreement.

However, in no event shall the amount exceed what the Entities are obligated to pay PPSC for services provided directly under this Agreement unless PPSC and all of the Entities have agreed. Each Entity's obligation to pay compensation to PPSC as provided herein is contingent upon PPSC's compliance with the terms and conditions of this Agreement and any amendments thereto. Payment by any of the Entities under this Agreement shall not be deemed a waiver of unsatisfactory work, even if such defects were known to such Entity at the time of payment.

5.B Fiscal Agent and Entity Cost Share
For the initial program year, costs shall be allocated by the initially estimated volume of SAFE calls attributable to each Entity, expressed as a percentage. For the second program year, costs shall be allocated by averaging the initially estimated volume of SAFE calls attributable to each Entity with the first program year of actual SAFE calls attributable to that Entity. For each year thereafter, For program expenses incurred between July 1, 2026 through June 30, 2028, the City of Cotati will enter into a funding agreement with the County of Sonoma on behalf of the Entities and act as the fiscal agent to pass through available funding from the County of Sonoma. Each fiscal year, the City of Cotati will invoice the County of Sonoma for the full funding contribution as soon as possible after July 1 for the then current fiscal year. Upon receipt of said funding, each Entity can invoice the City of Cotati for the full funding due to them for the fiscal year, in accordance with the then current cost 212 of 280
OAK #4856-8469-1508 v1 27
allocation. Upon receipt of invoices from the Entities, the City of Cotati will pass through funding due within 30 calendar days of receipt.

Ccosts shall be allocated by the actual 2-year moving average number of SAFE calls attributable to each Entity, using the two most recent years, expressed as a percentage. The initial program year must contain a minimum of 6 months of actual data for averaging and shall end on May January 1 using the prior 12-month period. The updated cost split percentages shall be effective at the start of the subsequent fiscal year.

Initial Estimated Volume of SAFE calls by Entity
Estimated Totals
Rohnert Park 78%
Cotati 16%
Sonoma State 6%
Total 100%
PPSC shall invoice each Entity their respective cost share, and the obligation to pay such invoices shall be deemed an individual obligation of each Entity. After the initial program year, but before the start of the subsequent fiscal year, the Entities shall provide PPSC with the updated cost split percentages for billing purposes. The Entities shall not be deemed jointly or severally liable for any expenses under this Agreement, nor shall the Entities have the power to incur debt or liabilities on behalf of another Entity except to the extent expressly set forth herein.

5.C Payments of Program Vehicle and Maintenance Expenses to Rohnert Park By Cotati Unless the Entities agree in writing to an alternate arrangement, Rohnert Park shall invoice Cotati and Sonoma State for their respective share (as determined in 5.B) of total expenses incurred by Rohnert Park related to the procurement of a SAFE team vehicle and up-fitting the SAFE team vehicle, MDC’s, interoperable communication equipment and for costs of maintenance and fuel provided by Rohnert Park to PPSC under the terms of this Agreement, on a quarterly basis, and shall provide supporting documentation with such invoices as may be reasonably requested by Cotati or Sonoma State to substantiate such expenses. Cotati and Sonoma State shall pay such invoices within thirty (30) days after approval. Sonoma State shall not provide any vehicle, communication equipment, or other state-owned property to PPSC.
213 of 280
OAK #4856-8469-1508 v1 28

6. Inspection, Audit, Records Retention
PPSC shall furnish Entities with every reasonable opportunity to ascertain that the services of PPSC are being performed in accordance with the requirements and intentions of this Agreement. The inspection of such services shall not relieve PPSC of any of its obligations to fulfill the requirements of this Agreement, nor be deemed a waiver of unsatisfactory work.

PPSC shall maintain any and all ledgers, books of account, invoices, vouchers, canceled checks, and other records or documents evidencing or relating to charges for services, or expenditures and disbursements charged to the Entities and all documents and records which demonstrate performance under this Agreement for a minimum period of three (3) years, or for any longer period required by law or specified by the Entities as a result of the use of grant funding to pay for PPSC's services, from the date of termination or completion of this Agreement.

Any records or documents required to be maintained pursuant to this Agreement shall be made available for inspection or audit, at any time during regular business hours, upon written request by any Entity. Copies of such documents shall be provided to any Entity for inspection when it is practical to do so. Otherwise, unless an alternative is mutually agreed upon, the records shall be available at PPSC's address indicated for receipt of notices in this Agreement.

7. Training and Qualifications
The Entities shall provide PPSC with applicable training familiarization in the use of the Entity’s vehicle, and training on communication equipment procedures, and as well as any other training specific to the Entity that may be provided in the discretion of the Entities. PPSC shall ensure that its staff attend such familiarizations and/or trainings once offered and complete them in a reasonable period of time. This training does not relieve PPSC of its obligation to ensure the adequate training and applicable certification of its staff in all matters. PPSC shall be responsible for ensuring the adequate training and necessary certification of its staff, including applicable training in the provision of the services. PPSC represents that it’s employees shall all have the necessary qualifications, experience and training to provide the services as described in this MOU in a reasonable and responsible manner.

8. Requirements for Services
214 of 280
OAK #4856-8469-1508 v1 29
While providing services in accordance with this contract, PPSC shall require its personnel to observe the following requirements:

A. PPSC and its employees shall not use force while observing, contacting, or transporting persons unless it is reasonably determined that such force is necessary for the protection of a person from bodily harm, and a Police Officer cannot be summoned or cannot respond quickly enough to provide protection.

B. PPSC shall summon a police officer via the Entities' dispatch when a dangerous situation appears to exist. PPSC shall request from the appropriate Entities' dispatch, based on incident location, that an ambulance respond whenever it appears the person(s) contacted need emergency medical treatment.

C. PPSC shall not provide emergency medical transportation to injured or ill persons except at the express direction of emergency medical personnel and appropriate medical direction. However, PPSC may provide first aid and/or basic life support to person(s) in need before the arrival of the emergency medical personnel.

D. Under no circumstances shall the Entities’ vehicles be used by PPSC for personal use or for the transportation of intoxicated person(s) to their place of residence or other requested location not otherwise described herein, nor shall it be driven outside the geographic boundaries of the Entities except at the direction of, or with the advanced approval of the respective Entity’s dispatch, police supervisor, or watch commander. If the SAFE vehicle leaves the County of Sonoma, PPSC shall immediately inform the Entities dispatch that it will be out of County, including anticipated time it will be out of the County. The vehicles shall be parked at a PPSC property or identified location at a designated city facility when not inservice.

E. PPSC shall be responsible for any medical protocols for the services and shall provide current medical protocols to the Entities. If medical protocols are updated, PPSC must provide updated protocols within 7 days of any update.

F. PPSC will not carry any firearms, as defined by California Penal Code section 16520, or dirk or dagger as defined by California Penal Code section 21310 upon their person 215 of 280
OAK #4856-8469-1508 v1 30
while working.

E. PPSC will ensure employees wear an appropriate uniform clearly identifying them as an employee of PPSC while in service.

F. PPSC shall have a drug-free workplace policy in accordance with the Drug-free Workplace Act of 1988, and shall ensure that its employees, observer trainees, officers or agents comply with such policies in the course of providing services under this MOU. Use of drugs and/or alcohol by PPSC’s employees, observer trainees, officers or agents while on duty to provide services under this Agreement, and/or reporting to duty with a noticeable presence or effects of alcohol or drugs is prohibited.

G. PPSC agrees to use SAFE vehicles only for providing services under this MOU, or as may be reasonably necessary for maintenance. Any use of the vehicles except for such purposes shall be prohibited.

H.G. In the event that PPSC discovers drugs, paraphernalia, or other illegal items in the course of providing services, If PPSC believes that there is a public safety threat posed by an individual that it contacted, PPSC shall immediately report this to the applicable Entities’ police department. PPSC may report such contraband or suspected illegal items to the Entities' police departments, which may take custody of such items in accordance with applicable law.

PPSC shall be responsible for any medical protocols for the services and shall provide current medical protocols to the Entities. If medical protocols are updated, PPSC must provide updated protocols within 7 days of any update.

9. Vehicle Accidents
If a PPSC employee is involved in a motor vehicle accident in SAFE team vehicle, PPSC shall notify the Entities, shall ensure that the accident is reported in accordance with applicable state law and shall comply with any additional reporting requirements of the Entities, as well as cooperate and provide information to the Entities as may be reasonably necessary for the investigation and resolution of claims. The Entity that holds title to the vehicle will provide instructions regarding the transportation and repair of a damaged vehicle. Any damage to a Entity-provided vehicle should be reported to a 216 of 280
OAK #4856-8469-1508 v1 31
supervisor and the Entity’s Fleet Services immediately. These obligations shall be in addition to any insurance and indemnity requirements in this Agreement.

If a PPSC employee is involved in a motor vehicle accident in an Entity owned vehicle, the following steps should occur:

9.A. If the accident involves an injury, contact the appropriate Entity police department dispatch center via the radio or call 9-1-1 as quickly as possible. If the accident does not involve an injury but does involve a traffic violation, another vehicle, or damage to private property, an alternative to using the radio may be to call the police non-emergency number, your immediate supervisor, and Entity Fleet Services. Any damage to an Entity provided vehicle should be reported to a supervisor and the Entity’s Fleet Services immediately.

9.B. Do not leave the scene of the accident until instructed to do so by your supervisor. If another vehicle is involved, remain at the scene and obtain all necessary insurance information. A police supervisor must be notified to respond to document an on-duty Entity owned vehicle collision incident report. Failure to notify a police supervisor immediately after an accident and/or any negligent damage may result in damages being repaired at PPSC’s expense. Complete a City-Provided Vehicle Accident Report Form at the accident scene and return it to the Entity’s Risk Management Department as soon as possible.

9.D. File a traffic collision report with the Entity police department. In accordance with applicable state law, PPSC employees shall comply with any additional reporting requirements of the Entities, as well as cooperate with and provide information to the Entities as may be reasonably necessary for the investigation and resolution of claims. This step shall occur regardless of the dollar amount of damage or extent of injury, or if the collision involves another vehicle or a fixed object.

9.E. These obligations shall be in addition to any insurance and indemnity requirements in this Agreement. The Entity that holds title to the vehicle will provide instructions regarding the transportation and repair of a damaged Entity owned vehicle.

10. Compliance with Laws
217 of 280
OAK #4856-8469-1508 v1 32
PPSC shall use the standard of care in its profession to comply with all applicable federal, state, and local laws, codes, ordinances, and regulations. PPSC represents and warrants to the Entities that it has and shall, at its sole cost and expense, keep in effect or obtain at all times during the term of this Agreement any licenses, permits, insurance and approvals which are legally required for PPSC to provide services under this Agreement. The Entities shall not be responsible or liable for PPSC's failure to comply with any or all of the requirements contained in this paragraph.

PPSC shall be an equal opportunity employer and agrees to comply with all applicable state and federal regulations governing equal employment opportunity. PPSC will not discriminate against any employee or applicant for employment because of race, religion, age, sex, creed, color, sexual orientation, marital status or national origin. PPSC will take affirmative action to ensure that applicants are treated during such employment without regard to race, religion, age, sex, creed, color, sexual orientation, marital status, or national origin. Such action shall include, but shall not be limited to, the following: employment, upgrading, demotion, or transfer; recruitment or recruitment advertising; lay-offs or termination; rates of pay or other forms of compensation; and selection for training, including apprenticeship. PPSC further agrees to post in conspicuous places, available to employees and applicants for employment, notices setting forth the provisions of this nondiscrimination clause.

11. Cooperative Planning Requirements
PPSC recognizes that planning with the Entities, other state and local agencies, and local social service providers is essential to the success of a coordinated service delivery system. At a minimum, PPSC agrees to attend police briefings for each Entity at a frequency directed by each Entity, but initially no less than 1x per week to ensure effective field coordination. PPSC also agrees to attend and participate in a reasonable number of meetings and planning efforts initiated by the Entities, and to provide non-confidential data already in PPSC's possession which may be required by the Entities and is reasonably necessary to achieve compliance with Entities programmatic goals. This includes participating in joint data sharing and uniform data collection initiatives, Rohnert Park's weekly Homeless Taskforce, which identifies homeless encampments posing health and safety hazards, and By-Name List meeting, which identifies and prioritizes individuals experiencing homelessness for housing and services. PPSC agrees to maintain open and responsive working relations with the Entities.
218 of 280
OAK #4856-8469-1508 v1 33

12. Statistical Reporting
Each month, along with the invoice, PPSC will provide the Entities with a summary of calls and summary of any out of service area activities. The summary of calls report will be as directed by the Entities, as may change from time to time, but initially shall include, at a minimum, the Entity where the service occurred, if the activity was Police or Fire divert (mobile crisis intervention team handling instead of University/city personnel) or if it was a joint response; time on call; disposition; and if possible, the transport-pick up location, client problem, time, estimated age of client, sex of client (if known), destination of transport, and any pertinent history/treatment. The summary of out of service area activities will include date, times, where, and the authorized person who directed the out of service area activity. Additionally, PPSC agrees to provide any other information mutually agreed upon between the Entities and PPSC.

13. No Joint Agency
Nothing in this alter is intended to alter, limit, or expand an Entities’ statutory and/or regulatory authority over any Party. By entering into this Agreement, the Parties are not intending to enter into any sort of joint-enterprise, joint-venture, partnership or create any separate entity; and have no authority to obligate any of the other Parties and shall not be considered an agent of any other Party, nor shall the Agreement be construed to create any joint-employment but rather each Party shall be solely responsible for its own acts and the acts of its own officers, employees, and contractors in the performance of the Agreement.

14. HIPAA Compliance and Confidentiality of Records
For services, activities or products subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), PPSC covenants that it will appropriately safeguard Protected Health Information (defined in 45 CFR 160.103), and agrees that it is subject to, and shall comply with, the provisions of 45 CFR 164 Subpart E regarding use and disclosure of Protected Health Information. Effective July 1, 20265, PPSC shall adhere to Exhibit C, the Special Terms and Conditions – Information Privacy & Security – HIPAA Business Associate Addendum, as may be subsequently amended due to changes in the law or by mutual consent of the Entities and the County of Sonoma. If there is any conflict with this section and Exhibit C, the provisions of Exhibit C will control. If the County of Sonoma ceases providing grant funding for the SAFE program, the Entities can elect to release PPSC from this requirement. Release from this requirement requires a written release from each of the Entities. PPSC 219 of 280
OAK #4856-8469-1508 v1 34
shall indemnify, defend, and hold harmless the Entities, their respective officials, elected and appointed officers, employees, agents and volunteers from any breach of this covenant.

All data, documents, discussions or other information developed or received by or for PPSC in performance of this Agreement are confidential and not to be disclosed to any person except as authorized by Entities, or as required by law.

15. Indemnity

15.A. Indemnification by PPSC. To the fullest extent permitted by law, PPSC shall, at its own expense, indemnify, protect, defend (by counsel reasonably satisfactory to the Entities) and hold harmless each of the Entities and each of their respective officers, officials, employees, agents and volunteers (“Indemnified Parties”) from and against any and all liability (including liability for claims, demands, damages, obligations, suits, actions, arbitration proceedings, administrative proceedings, regulatory proceedings, losses, expenses or costs of any kind, whether actual, alleged or threatened, including attorneys’ fees and costs, court costs, interest, defense costs and expert witness fees) of any nature (“Liability”), whether actual, alleged or threatened, which arise out of, pertain to, or relate to the performance or failure to comply with this Agreement, regardless of any fault or alleged fault of the Indemnified Parties. PPSC shall also indemnify, defend, and hold harmless the Entities for any claims arising from their use of Entity vehicles.

The only exception to PPSC’s responsibility to indemnify, protect, defend, and hold harmless the Indemnified Parties from Liability is due to the active negligence or willful misconduct of an Entity or its elective or appointive boards, officers, agents and employees.

PPSC’s duty to indemnify, protect, defend and hold harmless as set forth in this section shall include the duty to defend (by counsel reasonably satisfactory to the Entity) as set forth in California Civil Code § 2778. PPSC waives any and all rights to express or implied indemnity against the Indemnified Parties concerning any Liability of the PPSC arising out of or in connection with the Agreement or PSSC's failure to comply with any of the terms of this Agreement.

15.B. Mutual Indemnification By Entities. Without limiting the Entities respective rights under the Section 16.A, Rohnert Park, Cotati and Sonoma State each agree to protect, save harmless, indemnify, and defend the other, its governing body, officers, agents, and employees from any and all loss, damage or liability (including injury and death), including without limitation, all reasonable legal fees, expert witness or consultant fees and expenses related to the response to, settlement of, or 220 of 280
OAK #4856-8469-1508 v1 35
defense of any claims or liability, which may be suffered or incurred by any other Entity, its governing body, officers, agents and employees, caused by, arising out of, or in any way connected with the respective responsibilities and duties hereby undertaken, except that each Entity shall bear the proportionate cost of any damage attributable to the fault of that Entity, its governing body, officers, agents, contractors, and employees. It is the intention of Rohnert Park, Cotati and Sonoma State that, where the Entities are not fully indemnified by PPSC for any Liability arising out of the performance of this contract, that where fault is determined to have been contributory between these parties, principles of comparative fault will be followed.

15.C. The provisions of this section shall survive the termination of this Agreement.

16. Insurance
Without limiting PPSC's indemnification provided herein, PPSC shall, at its own expense, procure and maintain insurance that complies with the requirements set forth in Exhibit B to this Agreement, which is attached hereto and incorporated by reference.

17. Notification
Any notice, demand, request, consent, approval or communication that any party desires or is required to give to another party shall be in writing and either served personally or sent by prepaid, first-class mail. Any such notice, demand, etc. shall be addressed to the other Party(ies) at the address set forth below. Any Party may change its address by notifying the other parties of the change of address.

Notice shall be deemed communicated within 72 hours from the time of mailing if physically mailed as provided in this section. Email is provided for convenience only. If contact information changes, it shall be provided in writing to all parties to this MOU.

If to Rohnert Park:

City Manager
City of Rohnert Park – City Hall 130 Avram Avenue
Rohnert Park, CA 94928
Phone: 707.588.2223
Email: [email protected]@rpcity.org
If to Cotati:

City Manager City of Cotati
201 West Sierra Avenue Cotati, CA 94931
221 of 280
OAK #4856-8469-1508 v1 36
Phone: 707.665.3622
Email: [email protected]@cotaticity.gov
If to Sonoma State:

Contracts and Procurement
1801 East Cotati Ave., Rohnert Park, CA 94928
Phone: 707-664-3102
Email: [email protected]
With copy to:

Sonoma State University Police Department
1801 East Cotati Ave. Rohnert Park, CA 94928
Phone: 707-664-4444
Email: [email protected]
If to PPSC:

Executive Director
Petaluma People Services Center 1500 Petaluma Boulevard South Petaluma, CA 94952 Phone: 707.765.8488
Email: [email protected]@petalumapeople.org with a copy to the executive director ([email protected]).

18. Suspension of Services
Each Entity shall have the authority to suspend its participation in this Agreement and the services contemplated herein, wholly or in part, for such period as it deems necessary due to unfavorable conditions or to the failure on the part of the PPSC to perform any provision of this Agreement upon 5 days' written notice to each other Party. PPSC will be paid for satisfactory services performed prior to the date of suspension. During the period of suspension, PPSC shall not receive any payment for services or expenses incurred by PPSC by reason of such suspension.

19. Termination
This Agreement and all obligations hereunder may be terminated at any time, with or without cause, by any party upon 30 days' written notice to all other Parties. The remaining Parties may continue under this Agreement, with PPSC and vehicle costs split among the remaining Entities using the calls for service methodology. In the event this Agreement is terminated by any Entity without cause, PPSC shall be entitled to any compensation owing to it hereunder up to the time of such termination, it being 222 of 280
OAK #4856-8469-1508 v1 37
understood that any payments are full compensation for services rendered prior to the time of payment.

If PPSC fails to perform any of its obligations under this Agreement within the time and in the manner herein provided or otherwise violates any of the terms of this Agreement, in addition to all other remedies provided by law, the Entities may jointly terminate this Agreement immediately upon written notice.

20. Severability
If any one or more of the provisions contained herein shall for any reason be held to be invalid, illegal or unenforceable in any respect, then such provision or provisions shall be deemed severable from the remaining provisions hereof, and such invalidity, illegality, or unenforceability shall not affect any other provision hereof, and this Agreement shall be construed as if such invalid, illegal, or unenforceable provision had not been contained herein.

21. Applicable Law and Venue
This Agreement shall be construed and interpreted according to California law, without regard to any choice of law principles that may apply any other body of law. In the event that suit shall be brought by any Party hereunder, the Parties agree that a trial of such action shall be held exclusively in a competent court of jurisdiction in the County of Sonoma, California.

22. Remedies and Waiver
No failure on the part of any party to exercise any term, covenant, condition, right or remedy hereunder shall operate as a waiver of any other term, covenant, condition, right or remedy that such party may have hereunder. All remedies permitted or available under this Agreement, or at law or in equity, are cumulative and alternative. As a condition precedent to commencing legal action involving a claim or dispute arising from this Agreement, PPSC shall comply with claims presentation requirements under the Government Tort Claims Act, California Government Code Sections 900 et seq. and any claims presentation requirements imposed by ordinance of Rohnert Park or Cotati.

23. Time is of the Essence
Time is of the essence for this Agreement.
223 of 280
OAK #4856-8469-1508 v1 38

24. Merger; Amendment
This Agreement constitutes the complete and exclusive statement of the agreement between the Entities and PPSC and shall supersede all prior negotiations, representations, or agreements, either written or oral. This document may be amended only by written instrument, signed by all Parties. All provisions of this Agreement are expressly made conditions. [SIGNATURES ON FOLLOWING PAGE]
224 of 280
OAK #4856-8469-1508 v1 38
225 of 280
OAK #4856-8469-1508 v1 39

CITY OF ROHNERT PARK PETALUMA PEOPLE SERVICES

CORPORATION
By:________________________/_______ By:___________________________/_ Name:____________________ (Date) Name: ______________________ (Date) Title:______________________________ Title:________________________________ ATTEST:
__________________________________
City Clerk
APPROVED AS TO FORM:
__________________________________
City Attorney

CITY OF COTATI
By:________________________/_______
Name:____________________ (Date)
Title:______________________________
ATTEST:
__________________________________
City Clerk
APPROVED AS TO FORM:
__________________________________
City Attorney

SONOMA STATE
By:________________________/_______
Name:____________________ (Date)
Title:______________________________
APPROVED AS TO FORM:
__________________________________
Counsel
226 of 280
OAK #4856-8469-1508 v1 40
Exhibit A- FY 264-275 Program Budget and Maximum
Allowable Costs
Petaluma People Services Center Draft October 2021
Rohnert Park SAFE Team Budget - 10.16.22 - 6.30.22
Expenses for 8.5 months

DIRECT PERSONNEL EXPENSES NOTES
Program Director 36,100 .5 FTE for 8.5 months
Program Manager 17,459 .3 FTE for 8.5 months
Rohnert Park Coordinator 42,730 1 FTE for 8.5 months
Part-time Clinical Supervisor 8,288 .25 FTE for 8.5 months EMT Specialists 180,039 4.7 FTE for 8.5 months
Crisis Intervention Specialists 180,039 4.7 FTE for 8.5 months Subtotal - Salaries 464,655
Direct Personnel - Taxes & Insurance 92,931 20% of Salary TOTAL DIRECT PERSONNEL 557,586

OPERATING EXPENSES
Dues & Fees 884
Books & Subscriptions 94
Office Supplies 884
SAFE Medical & Other Expenses 18,420
Postage 536
Duplication & Printing 1,241
Staff Training 1,063
Staff Travel 1,420
Equipment 20,545
Equipment Repair & Maintenance 9,920
Insurance 10,625
Utilities 12,393
Communications 14,170
Audit 2,482
TOTAL OPERATING EXPENSES 94,677
INDIRECT 65,226 10% of Expenses
TOTAL EXPENSES 717,489
FY 2024 – 2025 Total Budget* Narrative
Direct Personnel Expenses
SAFE Team Director 39,520 .4 FTE of Director
SAFE Team Manager 29,120 .4 FTE of Manager
SAFE Training Manager 29,120
.4 FTE of Training
Manager
Part-time Clinical Supervisor 4,940 .05 FTE of Clinical 227 of 280
OAK #4856-8469-1508 v1 41
Supervisor
Part-time Counselor 2,288 .1 FTE of Counselor
SAFE Team Navigator 24,960 .4 FTE of Navigator
EMT Specialists 331,760

5.5 FTE EMT
Specialists
Crisis Intervention Specialists 331,760

5.5 FTE Crisis
Intervention Specialists
Direct Personnel Total 793,468
Staff Benefits Total 174,563 22% of staff salary
Operating Expenses
Dues & Fees 1,250
Books & Subscriptions 125
Office Supplies 1,250
SAFE Medical & Other Supplies 15,000
Postage 750
Duplication & Printing 1,750
Staff Training 1,500
Staff Travel 2,000
Furniture & Equipment 5,000
Equipment Repair & Maintenance 14,000
Vehicle Fuel & Repair 16,000
Insurance 15,000
Building Maintenance 5,000
Utilities 17,500
Communications 15,000
Total Operating Expenses 111,125
Indirect Expenses Total 107,916
De minimis rate of
10%
Total 1,187,072 SAFE Costs
*Indirect costs and annual CPI escalation shall be in accordance with Section 5.A of this MOU.
228 of 280
OAK #4856-8469-1508 v1 42
229 of 280
OAK #4856-8469-1508 v1
Exhibit B - Insurance Requirements
PPSC shall procure and maintain for the duration of the contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by PPSC, its agents, representatives, or employees.

MINIMUM SCOPE AND LIMIT OF INSURANCE
Coverage shall be at least as broad as:

1.Commercial General Liability (CGL): Insurance Services Office Form CG 00 01 covering CGL on an "occurrence" basis, including products and completed operations, property damage, bodily injury and personal & advertising injury with limits no less than $1,000,000 per occurrence, $2,000,000 general aggregate. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this project/location (ISO CG 25 03 or 25 04) or the general aggregate limit shall be twice the required occurrence limit.

2.Automobile Liability: Insurance Services Office Form Number CA 0001covering, Code 1 (any auto), or if Consultant has no owned autos, Code 8 (hired) and 9 (non-owned), with limit no less than $1,000,000 per accident for bodily injury and property damage. Liability coverage must include coverage for non-owned autos with the Cities named additional insured.

3.Workers' Compensation insurance as required by the State of California, with Statutory Limits, and Employer's Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease. (Not required if consultant provides written verification it has no employees)

4. Professional Liability (Errors and Omissions) Insurance appropriate to PPSC's services under this Agreement, with limit no less than $2,000,000 per occurrence or claim, $2,000,000 aggregate.

If PPSC maintains broader coverage and/or higher limits than the minimums shown above, the Cities require and shall be entitled to the broader coverage and/or the higher limits maintained by the PPSC. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to PPSC.

Other Insurance Provisions
The insurance policies are to contain, or be endorsed to contain, the following provisions:

Additional Insured Status
The City of Rohnert Park, its officers, officials, employees, and volunteers, the City of Cotati, its officers, officials, employees, and volunteers, and the State of California, the Trustees of the California State University, Sonoma State University, its officers, officials, employees, 230 of 280
OAK #4856-8469-1508 v1
representatives, volunteers and agents are to be covered as additional insureds on the CGL and automobile policy with respect to liability arising out of work or operations performed by or on behalf of PPSC including materials, parts, or equipment furnished in connection with such work or operations. General liability coverage can be provided in the form of an endorsement to PPSC's insurance (at least as broad as ISO Form CG 20 10 11 85, or both CG 20 10, CG 20 26, CG 20 33, or CG 20 38; and CG 20 37 forms, if later revisions used).

Primary Coverage
For any claims related to this contract, PPSC's insurance coverage shall be primary insurance providing primary coverage at least as broad as ISO CG 20 01 04 13 with respect to the Entity, its officers, officials, employees, and volunteers. Any insurance or self-insurance maintained by the Entities, or their officers, officials, employees, or volunteers, shall be excess of PPSC's insurance and shall not contribute with it.

Notice of Cancellation
Each insurance policy required above shall state that coverage shall not be canceled, except with notice to the Entities.

Waiver of Subrogation
Consultant hereby grants to Entities a waiver of any right to subrogation which any insurer of said Consultant may acquire against the Entities or any of their officers, officials, employees, or volunteers, by virtue of the payment of any loss under such insurance. PPSC agrees to obtain any endorsement that may be necessary to effect this waiver of subrogation, but this provision applies regardless of whether or not the Entities have received a waiver of subrogation endorsement from the insurer.

Self-Insured Retentions
Self-insured retentions must be declared to and approved by the Entities. The Entities may require PPSC to provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention. The policy language shall provide, or be endorsed to provide, that the self-insured retention may be satisfied by either the named insured or by the Entities.

Acceptability of Insurers
Insurance is to be placed with insurers authorized to conduct business in the state with a current 231 of 280
OAK #4856-8469-1508 v1
A.M. Best's rating of no less than A:VII, unless otherwise acceptable to the Entities.

Claims Made Policies
If any of the required policies provide coverage on a claims-made basis:

1.The Retroactive Date must be shown and must be before the date of the contract or the beginning of contract work.

2.Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of the contract of work.

3. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the contract effective date, PPSC must purchase "extended reporting" coverage for a minimum of five (S) years after completion of contract work.

Verification of Coverage
PPSC shall furnish the Entities with original Certificates of Insurance including all required amendatory endorsements (or copies of the applicable policy language effecting coverage required by this clause) and a copy of the Declarations and Endorsement Page of the CGL policy listing all policy endorsements to Entities before work begins. However, failure to obtain the required documents prior to the work beginning shall not waive PPSC's obligation to provide them. The Entities each reserve the right to require complete, certified copies of all required insurance policies, including endorsements required by these specifications, at any time. 232 of 280
OAK #4856-8469-1508 v1
233 of 280
OAK #4856-8469-1508 v1
Exhibit C - Special Terms and Conditions – Information Privacy & Security – HIPAA Business Associate Addendum
234 of 280
OAK #4856-8469-1508 v1
235 of 280
OAK #4856-8469-1508 v1
Exhibit DC – Map of Sonoma State
236 of 280
Exhibit A. Scope of Work and Budget
I. Program/Project Overview:

Agency/Organization Name: City of Cotati, City of Rohnert Park (collectively, “Cities”, Sonoma State University (SSU)
Program/Project Name: Mobile Crisis Services FY 2026/27 – 2028/29 Geographic Areas Served:

Central County (Santa Rosa)
North County
South County
East County
West County
Sonoma County Contract Contact Persons:

Contract Manager:

Name: David Evans
Phone: (707) 565-4935
Email: [email protected]
II. Purpose
State of California Department of Health Care Services Behavioral Health Information Notice 23-025 (BHIN 23-025) established a Medi-Cal Benefit for Mobile Crisis services providing rapid response, assessment, and stabilization to individuals experiencing a mental health and/or substance use disorder (SUD) crisis.
a. Under this agreement, the Cities/SSU will retain the services of a qualified subcontractor to operate mobile crisis services as defined by the California Department of Health Care Services (DHCS) Behavioral Health Information Notice No. 23-025 (BHIN 23-025) and specified by and in partnership with Sonoma County Behavioral Health (SCBH).
b. All calls for service shall adhere to the guidelines outlined in BHIN 23-025, regardless of the individual’s Medi-Cal or insurance status.
c. The Cities/SSU will require their qualified subcontractor to adhere to Exhibit C, the Special Terms and Conditions – Information Privacy & Security – HIPAA Business Associate Addendum as may be subsequently amended due to changes in the law or by mutual consent of the Cities/SSU and County.
237 of 280

1. Budget
FY 26-27 FY 27-28 FY 28-29
Direct Personnel Expenses Combined
FTE Total Total Total
SAFE Team Director 0.36 $42,399 $44,095 $45,858
SAFE Team Manager 0.36 $31,150 $32,396 $33,692
SAFE Training Manager 0.36 $33,313 $34,646 $36,032
Part-time Counselor 0.1 $8,592 $8,936 $9,294
SAFE Team Navigator 0.36 $25,958 $26,997 $28,077
EMT Specialists 5.5 $346,240 $360,090 $374,493
Crisis Intervention
Specialists 5.5 $346,240 $360,090 $374,493
Total Direct Personnel $833,893 $867,249 $901,938
Total Staff Benefits (23% of Salaries) $191,795 $199,467 $207,446 Operating Expenses
Dues & Fees $1,300 $1,352 $1,406
Duplication & Printing $130 $135 $141
SAFE Medical & Other Supplies $15,600 $16,224 $16,873
Staff Training $1,560 $1,622 $1,687
Staff Travel $2,080 $2,163 $2,250
Food Supplies $1,352 $1,406 $1,462
Furniture & Equipment $5,200 $5,408 $5,624
Equipment Repair & Maintenance $14,560 $15,142 $15,748
Communications $15,600 $16,224 $16,873
Total Operating Expenses $57,382 $59,677 $62,064
Total Indirect Expenses (15% de minimis rate) $162,461 $168,959 $175,717 PPSC Subtotal $1,245,531 $1,295,352 $1,347,166
24/7 COTS Telehealth Clinician (x 0.5) $167,085 $169,262 $171,467 SAFE Vehicle Costs $68,361 $68,970 $69,602
Indirect Costs (10%) $6,836 $6,897 $6,960
Subtotal $242,282 $245,128 $248,030
Grand Total $1,487,813 $1,540,480 $1,595,196
Agency Supplemental/Other Sources $0 ($128,293) ($1,295,196) DHS Funding Request $1,487,813 $1,412,187 $300,000
238 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 1 of 21 ends

Exhibit X. Special Terms and Conditions – Information Privacy & Security – HIPAA Business Associate Addendum
This Business Associate Addendum (“Addendum”) supplements and is made a part of the services agreement (“AgreementMOU”) by and between County of Sonoma (“County”) and <vendor name> (“Business Associate”).

R E C I T A L S
WHEREAS, County of Sonoma (County) is a Hybrid Entity as defined under 45 Code of Federal Regulations (“CFR”) Section 164.103;
WHEREAS, PPSC is a Business Associate as defined under 45 CFR Section 160.103; WHEREAS, <vendor name> is a Business Associate as defined under 45 CFR Section 160.103;
WHEREAS, County wishes to disclose certain information to Business Associate pursuant to the terms of Addendum, some of which information may constitute Protected Health Information (“PHI”), including electronic Protected Health Information (“ePHI”); WHEREAS, County and Business Associate intend to protect the privacy and provide for the security of PHI, including ePHI, disclosed to Business Associate pursuant to Addendum in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104 191 (“HIPAA”), regulations promulgated thereunder by the U.S. Department of Health and Human Services, and other applicable laws; and
WHEREAS, as part of the HIPAA Regulations, the Privacy Rule and Security Rule require County to enter into a contract containing specific requirements with Business Associate prior to the disclosure of PHI, including ePHI, as set forth in, but not limited to, 45 CFR Sections 164.502(e), 164.504(e), and 164.308(b)(1) and contained in Addendum.

NOW THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to Addendum, the parties agree as follows:

Part I: HIPAA Business Associate Addendum (Applies to HIPAA Business Associates)

1. Definitions
Terms used, but not otherwise defined, in Addendum shall have the same meaning as those terms in the HIPAA Regulations as set forth at 45 CFR Sections 160.103, 164.304, and 164.501.

A. HIPAA Regulations. “HIPAA Regulations” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules as set forth at 45 CFR Part 160 and Part 164.

B. Breach. “Breach” shall mean the acquisition, access, use, or disclosure of PHI in a manner not permitted under 45 CFR Part 164 Subpart E and that compromises the security or privacy of PHI as defined at 45 CFR Section 164.402.

C. Business Associate. “Business Associate” shall have the same meaning as the term “Business Associate” as set forth at 45 CFR Section 160.103.

D. Covered Entity. “Covered Entity” shall have the meaning given to such term under the Privacy Rule and the Security Rule, including, but not limited to, 45 CFR Section 239 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 2 of 21 ends

160.103. For purposes of this Addendum, this term is intended to mean the County of Sonoma.

E. Data Aggregation. “Data Aggregation” shall have the same meaning as the term “Data aggregation” as set forth at 45 CFR Section 164.501.

F. Designated Record Set. “Designated Record Set” shall have the same meaning as the term “designated record set” as set forth at 45 CFR Section 164.501.

G. Disclosure. “Disclosure” shall mean the release of, transfer of, provision of access to, or divulging in any manner information outside the entity holding the information in accordance with 45 CFR Section 160.103.

H. Health Care Operations. “Health Care Operations” shall have the same meaning as “Health care operations” as set forth at 45 CFR Section 164.501.

I. Individual. “Individual” shall have the same meaning as the term ''Individual'' as set forth at 45 CFR Section 164.501, except that the term “Individual” as used in this Addendum shall also include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g).

J. Minimum Necessary. “Minimum Necessary” shall mean the minimum amount of PHI necessary for the intended purpose, as set forth at 45 CFR Sections 164.502(b) and 164.514(d): Standard: Minimum Necessary.

K. Privacy Rule. “Privacy Rule” shall mean the HIPAA Standards for Privacy of Individually Identifiable Health Information as set forth at 45 CFR Part 160 and 45 CFR Part 164 Subparts A and E.

L. PHI. “PHI” shall have the same meaning as the term “protected health information” as set forth at 45 CFR Section 160.103, except limited to the information received from Covered Entity or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.

M. Required by Law. “Required by law” shall have the same meaning as the term “required by law” as set forth at 45 CFR Section 164.103.

N. Secretary. “Secretary” shall mean the Secretary of the United States Department of Health and Human Services (“DHHS”) or his/her designee.

O. Security Incident. “Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of personally identifiable information. . A Security Incident includes the attempted or successful unauthorized access, use, disclosure, modification, or destruction of or interference with systems operations in an information system which processes PHI that is under the control of Covered Entity or Business Associate of Covered Entity, but does not include minor incidents that occur on a daily basis, such as scans, “pings”, or unsuccessful random attempts to penetrate computer networks or servers maintained by Business Associate.

P. Security Rule. “Security Rule” shall mean the HIPAA Security Standards for the Protection of ePHI as set forth at 45 CFR Part 160 and 45 CFR Part 164 Subparts A and E.
240 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 3 of 21 ends

Q. Subcontractor. “Subcontractor” shall mean a subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate.

R. Unsecured PHI. “Unsecured PHI” shall have the same meaning as the term “unsecured protected health information” as set forth at 45 CFR Section 164.402, except limited to the information received from Covered Entity or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.

S. Use. “Use” shall mean, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information in accordance with 45 CFR Section 160.103.

2. Obligations of Business Associate
Business Associate acknowledges that Business Associate is directly required to comply with the HIPAA Regulations and that Business Associate (including its subcontractors) may be held directly liable for and be subject to penalties for failure to comply. . To the extent Business Associate is to carry out one or more of County's obligations under 45 CFR Part 164 Subpart E of the Privacy Rule, Business Associate agrees to comply with the requirements of 45 CFR Part 164 Subpart E that apply to County in the performance of such obligations.

3. Use or Disclosure of Protected Health Information
Except as otherwise provided in Addendum, Business Associate shall use and/or disclose PHI only as necessary to perform functions, activities, or services documented in the Scope of Work (Exhibit A) section of this Agreement for or on behalf of County, provided that such use and/or disclosure does not violate the HIPAA Regulations. . Business Associate agrees not to further use or disclose PHI other than as permitted or required by Addendum or as required by law. .

Business Associate must make reasonable efforts to limit PHI to the Minimum Necessary to accomplish the intended purpose of the use, disclosure, or request. The uses of PHI may not exceed the limitations applicable to County under the HIPAA Regulations.

4. Designation of a Privacy Officer and a Security Officer A. Contractor shall designate a qualified and trained Security Officer to oversee its data security program who shall be responsible for carrying out the requirements of the HIPAA Security Rule (45 CFR Part 164 Subpart C)
B. Contractor shall designate a qualified and trained Privacy Officer to oversee its information privacy program who shall be responsible for carrying out the requirements of the HIPAA Privacy Rule (45 CFR Part 164 et. seq.)

5. Safeguarding Protected Health Information
Business Associate shall use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by Addendum. Business Associate shall implement administrative, physical, and technical safeguards and shall comply with 45 CFR Part 164 Subpart C with respect to ePHI that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI created, received, maintained, or transmitted on behalf of County and prevent the use or disclosure of PHI other than as provided for by Agreement. 241 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 4 of 21 ends

A. Encryption Requirements for Transmission and Storage of Electronic Data. All ePHI transmitted to Business Associate by County, and/or for or on behalf of County by Business Associate, and/or to County by Business Associate shall be provided or transmitted using encryption methods which renders such ePHI unusable, unreadable, or indecipherable by unauthorized persons. All ePHI stored by Business Associate on electronic media shall be protected using encryption methods which render such ePHI unusable, unreadable, or indecipherable by unauthorized persons. Encryption of ePHI in transit or at rest shall use a technology or methodology set forth by the Secretary in the guidance issued under Section 13402(h)(2) of Public Law 111-5, and in accordance with the National Institute of Standards Technology (NIST) and Standards and Federal Information Processing Standards (FIPS), as applicable.

B. Destruction of PHI on paper, film, or other hard copy media must involve either shredding or otherwise destroying the PHI so that it cannot be read or reconstructed.

C. Should any employee or subcontractor of Business Associate have direct, authorized access to County computer systems that contain ePHI, Business Associate shall immediately notify County of any change of such personnel (e.g., employee or subcontractor termination, or change in assignment where such access is no longer necessary) in order for County to disable the previously authorized access.

6. Notification of Breach, Unauthorized Use or Improper Disclosure Business Associate must notify County in writing of any access, use, or disclosure of PHI not permitted or provided for by Addendum and/or any actual or suspected use or disclosure of data in violation of any applicable federal or state laws or regulations of which Business Associate becomes aware. A breach or unauthorized access, use, or disclosure shall be treated as discovered by Business Associate the first day on which such unauthorized access, use, or disclosure is known, or should reasonably have been known, to Business Associate or to any person, other than the individual committing the unauthorized disclosure, that is an employee, officer, subcontractor, agent, or other representative of Business Associate.

A. Notification must be made as soon as practicable, but not later than 24 hours after discovery, by telephone call to 707-565-5703 plus e-mail to:

DHS-Privacy&[email protected], and will include:
1) The identification of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed; and 2) A description of any remedial action taken or proposed to be taken by Business Associate.

B. Business Associate must provide a complete report of the investigation to the County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall be submitted on the “Privacy Incident Report” form and shall include an assessment of all known factors relevant to a determination of whether a breach occurred. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the County requests information in addition to 242 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 5 of 21 ends

that listed on the “Privacy Incident Report” form, Contractor shall make reasonable efforts to provide the County with such information.

C. Business Associate must mitigate any harm that results or may result from the breach, security incident, or unauthorized access, use, or disclosure of unsecured PHI by Business Associate or its employees, officers, subcontractors, agents, or other representatives.

D. Following a breach or unauthorized access, use, or disclosure of unsecured PHI, Business Associate agrees to take any and all corrective action necessary to prevent recurrence, to document any such corrective action, and to make this documentation available to County.

7. Agents and Subcontractors of Business Associate
In accordance with 45 CFR Sections 164.502(e)(1)(ii) and 164.308(b)(2), and to the extent that Business Associate uses any agent, including a subcontractor, to which Business Associate provides PHI received from, created by, maintained by, or received by Business Associate on behalf of County, Business Associate shall execute an agreement with such agent or contractor containing a requirement to ensure compliance with the same restrictions and conditions that apply through Addendum to Business Associate with respect to PHI.

8. Access to Protected Health Information
At the request of County, and in the time and manner designated by County, Business Associate shall provide access to PHI in Designated Record Set to an Individual or County to meet the requirements of 45 CFR Section 164.524, and Ca. Health & Safety Code 123100 et. seq.

9. Amendments to Designated Record Set
Business Associate shall make any amendment(s) to PHI in Designated Record Set as directed or agreed to by County, or to take other measures necessary to satisfy County's obligations under 45 CFR Section 164.526.

10. Accounting of Disclosures
Business Associate shall document and make available such disclosures of PHI and information related to such disclosures as would be required for County to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

11. Records Available to County, State, and Secretary
Business Associate shall make available internal practices, books, and records related to the use, disclosure, and privacy protection of PHI received from County, or created, maintained, or received by Business Associate on behalf of County, to County, State, or the Secretary for the purposes of investigating or auditing Business Associate's compliance with the HIPAA Regulations in the time and manner designated by County, State, or Secretary.

12. Return or Destruction of Protected Health Information A. Upon termination of Addendum for any reason, Business Associate shall:
243 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 6 of 21 ends

1) Return all PHI received from County; return all PHI created, maintained or received by Business Associate on behalf of County; and return all PHI required to be retained by the HIPAA Regulations; OR:
2) at the discretion of County, destroy all PHI received from County, or created, maintained, or received by Business Associate on behalf of County. Destruction of PHI on paper, film, or other hard copy media must involve shredding or otherwise destroying the PHI in a manner which will render the PHI unreadable, undecipherable, or unable to be reconstructed. Business Associate shall certify in writing that such PHI has been destroyed.

B. In the event Business Associate determines that returning or destroying PHI is not feasible, Business Associate shall provide County notification of the conditions that make return or destruction not feasible. Business Associate shall extend the protections of this Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

13. Data Aggregation
Business Associate may provide data aggregation services related to the health care operations of County as permitted by 45 CFR Section 164.504(e)(2)(i)(B).

14. Other Applicable Laws
Business Associate shall comply with all other applicable laws to the extent that such state confidentiality laws are not preempted by HIPAA.

15. Penalties/Fines for Failure to Comply with HIPAA
Business Associate shall pay any penalty or fine assessed against Covered Entity arising from Business Associate's failure to comply with the obligations imposed by HIPAA.

16. Training of Employees and Enforcement of Requirements Business Associate shall train and use reasonable measures to ensure compliance with the requirements of this Business Associate Agreement by employees who assist in the performance of functions or activities on behalf of County under this Contract and use or disclose protected information; and discipline employees who intentionally violate any provisions.

17. Amendments to Addendum
No amendment of Addendum shall be effective unless and until such amendment is evidenced by a writing signed by the parties. County and Business Associate agree to take such action as is necessary to amend Addendum as required for County to comply with the requirements of the HIPAA Regulations. However, any provision required by HIPAA Regulations to be in Addendum shall bind the parties whether or not provided for in Addendum.

18. Termination of Addendum
If Business Associate should fail to perform any of its obligations hereunder, or materially breach any of the terms of Addendum, County may terminate Addendum immediately upon provision of notice stating the reason for such termination to Business Associate. County, within its sole discretion, may elect to give Business Associate an opportunity to cure such breach. 244 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 7 of 21 ends

19. Material Breach
A breach by Business Associate or any of its agents or subcontractors of any provision of Addendum, as determined by County, shall constitute a material breach of Addendum and shall provide grounds for immediate termination of Addendum.

20. Indemnification
Business Associate agrees to accept all responsibility for loss or damage to any person or entity, including County, and to indemnify, hold harmless, and release County, its officers, agents, and employees from and against any actions, claims, damages, liabilities, disabilities, or expenses that may be asserted by any person or entity, including Business Associate, that arise out of, pertain to, or relate to Business Associate's or its agents', employees', contractors', subcontractors', or invitees' performance or obligations under Agreement. Business Associate agrees to provide a complete defense for any claim or action brought against County based upon a claim relating to such Business Associates' or its agents', employees', contractors', subcontractors', or invitees' performance or obligations under Agreement. Business Associates' obligations under Article 5 (Indemnification) apply whether or not there is concurrent negligence on County's part, but to the extent required by law, excluding liability due to County's conduct.

County shall have the right to select its legal counsel at Business Associate's expense, subject to Business Associate's approval, which shall not be unreasonably withheld. This indemnification obligation is not limited in any way by any limitation on the amount or type of damages or compensation payable to or for Business Associate or its agents under workers' compensation acts, disability benefits acts, or other employee benefit acts.

Part II: Privacy and Security of Personal Information and Personally Identifiable Information Not Subject to HIPAA: (Applies to all contractors)

1. Recitals
A. In addition to the Privacy and Security Rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) the County is subject to various other legal and contractual requirements with respect to the personal information (PI) and personally identifiable information (PII) it maintains. These include:
1) The California Information Practices Act of 1977 (California Civil Code §§ 1798 et seq.).
2) The Agreement between the Social Security Administration (SSA) and the County, known as the Information Exchange Agreement (IEA), which incorporates the Computer Matching and Privacy Protection Act Agreement (CMPPA) between the SSA and the California Health and Human Services Agency. The IEA, including the CMPPA, is attached to this Exhibit as Attachment B and is hereby incorporated in this Agreement.

B. The purpose of this Exhibit, Part II is to set forth Contractor’s privacy and security obligations with respect to PI and PII that Contractor may create, receive, maintain, use, or disclose for or on behalf of County pursuant to this Agreement. Specifically, this Exhibit applies to PI and PII which is not Protected Health Information (PHI) as defined by HIPAA and therefore is not addressed in this Exhibit, Part I of this Agreement, the HIPAA Business Associate Addendum.
245 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 8 of 21 ends

C. The IEA Agreement referenced in A.2) above requires the County to extend its substantive privacy and security terms to subcontractors who receive data provided to DHCS by the Social Security Administration. If Contractor receives data from County that includes data provided to DHCS by the Social Security Administration, Contractor must comply with the following specific sections of the IEA Agreement: E. Security Procedures, F. Contractor/Agent Responsibilities, and G. Safeguarding and Reporting Responsibilities for Personally Identifiable Information (“PII”), and in Attachment 4 to the IEA, Electronic Information Exchange Security Requirements, Guidelines and Procedures for Federal, State and Local Agencies Exchanging Electronic Information with the Social Security Administration. Contractor must also ensure that any agents, including a subcontractor, to whom it provides County data that includes data provided by the Social Security Administration, agree to the same requirements for privacy and security safeguards for such confidential data that apply to Contractor with respect to such information.

D. The terms used in this Exhibit, Part II, but not otherwise defined, shall have the same meanings as those terms have in the above referenced statute and Agreement. Any reference to statutory, regulatory, or contractual language shall be to such language as in effect or as amended.

19. Definitions
A. “Breach” shall have the meaning given to such term under the IEA and CMPPA. It shall include a “PII loss” as that term is defined in the CMPPA.

B. “Breach of the security of the system” shall have the meaning given to such term under the California Information Practices Act, Civil Code § 1798.29(d).

C. Confidential Information shall mean information that is exempt from disclosure under the provisions of the California Public Records Act (Government Code sections 6250-6265) or other applicable state or federal laws
D. “CMPPA Agreement” means the Computer Matching and Privacy Protection Act Agreement between the Social Security Administration and the California Health and Human Services Agency (CHHS).
https://www.ssa.gov/dataexchange/documents/CMPPA%20State%20Model.pdf E. “County PI” shall mean Personal Information, as defined below, accessed in a database maintained by the County, received by Contractor from the County or acquired or created by Contractor in connection with performing the functions, activities and services specified in this Agreement on behalf of the County.

F. “IEA” shall mean the Information Exchange Agreement currently in effect between the Social Security Administration (SSA) and the California Department of Health Care Services (DHCS).
https://www.ssa.gov/dataexchange/documents/IEA(F)%20State%20Level.pdf G. “Notice-triggering Personal Information” shall mean the personal information identified in Civil Code section 1798.29(e) whose unauthorized access may trigger notification requirements under Civil Code § 1709.29. For purposes of this provision, identity shall include, but not be limited to, name, identifying number, symbol, or other identifying 246 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 9 of 21 ends

particular assigned to the individual, such as a finger or voice print, a photograph or a biometric identifier. Notice-triggering Personal Information includes PI in electronic, paper or any other medium.

H. “Personally Identifiable Information” (PII) shall have the meaning given to such term in the IEA and CMPPA.

I. “Personal Information” (PI) shall have the meaning given to such term in California Civil Code § 1798.3(a).

J. “Required by law” means a mandate contained in law that compels an entity to make a use or disclosure of PI or PII that is enforceable in a court of law. This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand. It also includes Medicare conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.

K. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PI, or confidential data utilized in complying with this Agreement; or interference with system operations in an information system that processes, maintains or stores PI.

L. Sensitive Information shall mean information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion. Sensitive Information may be either Public Information or Confidential Information. It is information that requires a higher than normal assurance of accuracy and completeness.

Thus, the key factor for Sensitive Information is that of integrity. Typically, Sensitive Information includes records of agency financial transactions and regulatory actions.

20. Terms of Agreement
A. Permitted Uses and Disclosures of County PI and PII by Contractor Except as otherwise indicated in this Exhibit, Part II, Contractor may use or disclose County PI only to perform functions, activities or services for or on behalf of the County pursuant to the terms of this Agreement provided that such use or disclosure would not violate the California Information Practices Act (CIPA) if done by the County.

B. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose County PI or PII other than as permitted or required by this Agreement or as required by applicable state and federal law. o The Contractor and its employees, agents, or subcontractors shall protect from unauthorized disclosure any Personal Information, Sensitive Information, or Confidential Information (hereinafter identified as PSCI). 247 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 10 of 21 ends

o The Contractor and its employees, agents, or subcontractors shall not use any PSCI for any purpose other than carrying out the Contractor's obligations under this Agreement.
o The Contractor and its employees, agents, or subcontractors shall promptly transmit to the County Program Contract Manager all requests for disclosure of any PSCI not emanating from the person who is the subject of PSCI. o The Contractor shall not disclose, except as otherwise specifically permitted by this Agreement or authorized by the person who is the subject of PSCI, any PSCI to anyone other than County without prior written authorization from the County Program Contract Manager, except if disclosure is required by State or Federal law.
2) Safeguards. To implement appropriate and reasonable administrative, technical, and physical safeguards to protect the security, confidentiality and integrity of County PI and PII, to protect against anticipated threats or hazards to the security or integrity of County PI and PII, and to prevent use or disclosure of County PI or PII other than as provided for by this Agreement. Contractor shall develop and maintain a written information privacy and security program that include administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, which incorporate the requirements of Section 3, Security, below. Contractor will provide County with its current policies upon request.
3) Security. Contractor shall take any and all steps necessary to ensure the continuous security of all computerized data systems containing PHI and/or PI, and to protect paper documents containing PHI and/or PI. These steps shall include, at a minimum:
a) Complying with all of the data system security precautions listed in Part IV of this Special Terms and Conditions Document, Contractor Data Security Requirements; and
b) Providing a level and scope of security that is at least comparable to the level and scope of security established by the Office of Management and Budget in OMB Circular No. A-130, Appendix III- Security of Federal Automated Information Systems, which sets forth guidelines for automated information systems in Federal agencies; and
c) If the data obtained by User(s) from County includes PII, User(s) shall also comply with the substantive privacy and security requirements in the Computer Matching and Privacy Protection Act Agreement between the SSA and the California Health and Human Services Agency (CHHS) and in the Agreement between the SSA and DHCS, known as the Information Exchange Agreement (IEA), which are attached as Attachment B and are incorporated into this Agreement. The specific sections of the IEA with substantive privacy and security requirements to be complied with are sections E, F, and G, and in Attachment 4 to the IEA, Electronic Information Exchange Security Requirements, Guidelines and Procedures for Federal, State and Local Agencies Exchanging Electronic Information with the SSA. The User(s) also agree to ensure that any agents, 248 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 11 of 21 ends

including a subcontractor, to whom they provide County PII agree to the same requirements for privacy and security safeguards for confidential data that apply to the User(s) with respect to such information. The User(s) also agree to ensure that any agents, including a subcontractor, to whom they provide County PII agree to the same requirements for privacy and security safeguards for confidential data that apply to the User(s) with respect to such information. 4) Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of County PI or PII by Contractor or its subcontractors in violation of this Exhibit, Part II. 5) Contractor’s Agents and Subcontractors. To impose the same restrictions and conditions set forth in this Exhibit, Part II on any subcontractors or other agents with whom Contractor subcontracts any activities under this Agreement that involve the disclosure of County PI or PII to the subcontractor.
6) Availability of Information to County. To make PI and PII available to the County for purposes of oversight, inspection, amendment, and response to requests for records, injunctions, judgments, and orders for production of County PI and PII. If Contractor receives County PII, upon request by County, Contractor shall provide County with a list of all employees, contractors and agents who have access to County PII, including employees, contractors and agents of its subcontractors and agents. 7) Cooperation with County. With respect to County PI, to cooperate with and assist the County to the extent necessary to ensure the County’s compliance with the applicable terms of the CIPA including, but not limited to, accounting of disclosures of County PI, correction of errors in County PI, production of County PI, disclosure of a security breach involving County PI and notice of such breach to the affected individual(s). 8) Breaches and Security Incidents. During the term of this Agreement, Contractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps:
a) Initial Notice to the County. (1) To notify the County immediately by telephone call plus email or fax upon the discovery of a breach of unsecured County PI or PII in electronic media or in any other media if the PI or PII was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon discovery of a suspected security incident involving County PII. (2) To notify the County within 24 hours (1 hour if SSA data) by email or fax of the discovery of any suspected security incident, intrusion or unauthorized access, use or disclosure of County PI or PII in violation of this Agreement or this Exhibit, Part I, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer or other agent of Contractor.
b) Notice shall be provided to the County Privacy and Security Officer. If the incident occurs after business hours or on a weekend or holiday and involves electronic County PI or PII, notice shall be provided by calling the County 249 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 12 of 21 ends

Privacy and Security Officer. Notice shall be made using the County “Privacy Incident Report” form.
c) Upon discovery of a breach or suspected security incident, intrusion or unauthorized access, use or disclosure of County PHI, Contractor shall take:
i. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and
ii. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.
d) Investigation and Investigation Report. To immediately investigate such suspected security incident, security incident, breach, or unauthorized access, use or disclosure of PHI within 72 hours of the discovery, Contractor shall submit an updated “Privacy Incident Report” containing the information marked with an asterisk and all other applicable information listed on the form, to the extent known at the time, to the County Privacy and Security Officer. e) Complete Report. To provide a complete report of the investigation to the County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall be submitted on the “Privacy Incident Report” form and shall include an assessment of all known factors relevant to a determination of whether a breach occurred. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the County requests information in addition to that listed on the “Privacy Incident Report” form, Contractor shall make reasonable efforts to provide the County with such information. If, because of the circumstances of the incident, Contractor needs more than ten (10) working days from the discovery to submit a complete report, the County may grant a reasonable extension of time, in which case Contractor shall submit periodic updates until the complete report is submitted. If necessary, a Supplemental Report may be used to submit revised or additional information after the completed report is submitted, by submitting the revised or additional information on an updated “Privacy Incident Report” form. The County will review and approve the determination of whether a breach occurred and individual notifications are required, and the corrective action plan. f) Responsibility for Reporting of Breaches. If the cause of a breach of County PI or PII is attributable to Contractor or its agents, subcontractors or vendors, Contractor is responsible for all required reporting of the breach as specified in CIPA, § 1798.29(a) – (d) and as may be required under the IEA. Contractor shall bear all costs of required notifications to individuals as well as any costs associated with the breach. The County Privacy and Security Officer shall approve the time, manner and content of any such notifications and their review and approval must be obtained before the notifications are made. The County will provide its review and approval expeditiously and without unreasonable delay. If Contractor has reason to believe that duplicate reporting of the same breach or incident may occur because its subcontractors, agents or vendors may report the 250 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 13 of 21 ends

breach or incident to the County in addition to Contractor, Contractor shall notify the County, and the County and Contractor may take appropriate action to prevent duplicate reporting.
g) County Contact Information. To direct communications to the above referenced County staff, the Contractor shall initiate contact as indicated herein. The County reserves the right to make changes to the contact information below by giving written notice to the Contractor. Said changes shall not require an amendment to this Addendum or the Agreement to which it is incorporated.

Sonoma Co. Privacy Officer: 1450 Neotomas Ave. Suite 200, Santa Rosa, CA 95405; 707-565-5703; DHS-Privacy&[email protected] Part III: Miscellaneous Terms and Conditions including Access to 42 CFR Part 2 information. (Applies to all Contractors)

1. Confidentiality of Alcohol and Drug Abuse Patient Records If Contractor is in possession or has access to information regulated by Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2, (42 CFR Part 2), Contractor shall comply with all related regulations. Contractor is aware that criminal penalties may be imposed for a violation of these confidentiality requirements.

2. Disclaimer
The County makes no warranty or representation that compliance by Contractor with this Exhibit, HIPAA or the HIPAA regulations will be adequate or satisfactory for Contractor’s own purposes or that any information in Contractor’s possession or control, or transmitted or received by Contractor, is or will be secure from unauthorized use or disclosure. Contractor is solely responsible for all decisions made by Contractor regarding the safeguarding of the County PHI.

3. Amendment
A. The parties acknowledge that federal and state laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Exhibit may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH Act, and the HIPAA regulations. Upon either party’s request, the other party agrees to promptly enter into negotiations concerning an amendment to this Exhibit embodying written assurances consistent with the standards and requirements of HIPAA, the HITECH Act, and the HIPAA regulations. The County may terminate this Agreement upon thirty (30) days written notice in the event:
1) Contractor does not promptly enter into negotiations to amend this Exhibit when requested by the County pursuant to this section; or
2) Contractor does not enter into an amendment providing assurances regarding the safeguarding of County PHI that the County deems necessary to satisfy the standards and requirements of HIPAA and the HIPAA regulations.
251 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 14 of 21 ends

21. Judicial or Administrative Proceedings
Contractor will notify the County if it is named as a defendant in a criminal proceeding for a violation of HIPAA or other security or privacy law. The County may terminate this Agreement if Contractor is found guilty of a criminal violation of HIPAA. The County may terminate this Agreement if a finding or stipulation that the Contractor has violated any standard or requirement of HIPAA, or other security or privacy laws is made in any administrative or civil proceeding in which the Contractor is a party or has been joined. County will consider the nature and seriousness of the violation in deciding whether or not to terminate the Agreement.

22. Assistance in Litigation or Administrative Proceedings Contractor shall make itself and any subcontractors, employees or agents assisting Contractor in the performance of its obligations under this Agreement, available to the County at no cost to the County to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against the County, its directors, officers or employees based upon claimed violation of HIPAA, or the HIPAA regulations, which involves inactions or actions by the Contractor, except where Contractor or its subcontractor, employee or agent is a named adverse party.

23. No Third-Party Beneficiaries
Nothing express or implied in the terms and conditions of this Exhibit is intended to confer, nor shall anything herein confer, upon any person other than the County or Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.

24. Interpretation
The terms and conditions in this Exhibit shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, and the HIPAA regulations. The parties agree that any ambiguity in the terms and conditions of this Exhibit shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HITECH Act and the HIPAA regulations.

25. Conflict
In case of a conflict between any applicable privacy or security rules, laws, regulations or standards the most stringent shall apply. The most stringent means that safeguard which provides the highest level of protection to PHI from unauthorized disclosure. Further, Contractor must comply within a reasonable period of time with changes to these standards that occur after the effective date of this Agreement.

26. Regulatory References
A reference in the terms and conditions of this Exhibit to a section in the HIPAA regulations means the section as in effect or as amended.

27. Survival
The respective rights and obligations of Contractor under Section 3, Item D of Exhibit, Part I, Responsibilities of Contractor, shall survive the termination or expiration of this Agreement. 252 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 15 of 21 ends

11. No Waiver of Obligations
No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion.

12. Audits, Inspection and Enforcement
From time to time, and subject to all applicable federal and state privacy and security laws and regulations, the County may conduct a reasonable inspection of the facilities, systems, books and records of Contractor to monitor compliance with this Exhibit. Contractor shall promptly remedy any violation of any provision of this Exhibit. The fact that the County inspects, or fails to inspect, or has the right to inspect, Contractor’s facilities, systems and procedures does not relieve Contractor of its responsibility to comply with this Exhibit. The County's failure to detect a non-compliant practice, or a failure to report a detected non-compliant practice to Contractor does not constitute acceptance of such practice or a waiver of the County's enforcement rights under this Agreement, including this Exhibit.

13. Due Diligence
Contractor shall exercise due diligence and shall take reasonable steps to ensure that it remains in compliance with this Exhibit and is in compliance with applicable provisions of HIPAA, the HITECH Act and the HIPAA regulations, and that its agents, subcontractors and vendors are in compliance with their obligations as required by this Exhibit.

14. Term
The Term of this Exhibit shall extend beyond the termination of the Agreement and shall terminate when all County PHI is destroyed or returned to the County, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(I), and when all County PI and PII is destroyed in accordance with Attachment A.

15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, Contractor shall return or destroy all County PHI, PI and PII that Contractor still maintains in any form, and shall retain no copies of such PHI, PI or PII. If return or destruction is not feasible, Contractor shall notify the County of the conditions that make the return or destruction infeasible, and the County and Contractor shall determine the terms and conditions under which Contractor may retain the PHI, PI or PII. Contractor shall continue to extend the protections of this Exhibit to such County PHI, PI and PII, and shall limit further use of such data to those purposes that make the return or destruction of such data infeasible. This provision shall apply to County PHI, PI and PII that is in the possession of subcontractors or agents of Contractor.

Part IV: Contractor Data Security Requirements

1. General Controls
Contractor shall preserve and shall ensure that its sub-consultants or vendors preserve, the confidentiality, integrity, and availability of County data with administrative, technical and physical measures that conform to generally recognized industry standards and best practices that the selected firm then applies to its own processing environment. Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes 253 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 16 of 21 ends

and updates to operating systems and applications as provided by Contractor and/or its subconsultants or vendors. Contractor agrees to, and shall ensure that its sub-consultants or venders, comply with County’s current and future information security policies, standards, procedures, and guidelines.

28. Designation of Individual(s) Responsible for information Privacy and Security A. Security Officer:

Contractor shall designate a qualified individual, (HIPAA Security Officer), to implement and oversee its data security program. The individual shall be responsible for, and knowledgeable about, carrying out the requirements of this Special Terms and Conditions Exhibit, ensuring Contractor compliance with all provisions of the HIPAA Security Rule (45 CFR 164.300 et. seq.), and for communicating about privacy and security matters with the County.

B. Privacy Officer:

Contractor shall designate a qualified individual, (HIPAA Privacy Officer), to implement and oversee its information privacy program. The individual shall be responsible for, knowledgeable about, and trained in, carrying out the requirements of this Special Terms and Conditions Exhibit, ensuring Contractor compliance with all applicable state and federal information privacy laws (including but not limited to HIPAA, WIC 5328, 42 CFR Part 2, California Medical Information Act, etc.), and for communicating about privacy and security matters with the County.

C. The individual designated to the above roles may be the same individual so long as they are qualified and able to effectively perform the duties of both designations.

D. Any individual(s) designated as the Privacy Officer and/or Security Officer, must attend a Basic Privacy Compliance Academy course offered by the Health Care Compliance Association (HCCA) and obtain, within six (6) months of appointment, a “Certified in Healthcare Privacy Compliance” certification from the Health Care Compliance Association. Certification must be maintained continuously while designated in the role.

Alternate training and certification may be considered equivalent if approved at the sole discretion of the County Privacy & Security Officer.

29. Personnel Controls
A. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of the County, or access or disclose County PHI or PI must complete information privacy and security training, at least annually, at Contractor's expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following termination of this Agreement.

B. Employee Discipline. Appropriate sanctions must be applied against workforce members who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment where appropriate. 254 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 17 of 21 ends

C. Confidentiality Statement. All persons that will be working with County PHI or PI must sign a confidentiality statement that includes, at a minimum, General Use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to County PHI or PI. The statement must be renewed annually. The Contractor shall retain each person’s written confidentiality statement for County inspection for a period of six (6) years following termination of this Agreement.

D. Background Check. Before a member of the workforce may access County PHI or PI, a background screening of that worker must be conducted. The screening should be commensurate with the risk and magnitude of harm the employee could cause, with more thorough screening being done for those employees who are authorized to bypass significant technical and operational security controls. The Contractor shall retain each workforce member’s background check documentation for a period of three (3) years.

30. Technical Security Controls
A. Workstation/Laptop encryption. All workstations and laptops that store County PHI or PI either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by the County Privacy and Security Office.

C. Minimum Necessary. Only the minimum necessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.

Page 18 of 21 ends

password. Passwords are not to be shared. Passwords must be at least eight characters and must be a non-dictionary word. Passwords must not be stored in readable format on the computer. Passwords must be changed at least every 90 days, preferably every 60 days.

I. System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity.

L. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user authentications, enforcing the principle of least privilege.

31. Audit Controls
A. System Security Review. Contractor must ensure audit control mechanisms that record and examine system activity are in place. All systems processing and/or storing County PHI or PI must have at least an annual system risk assessment/security review which provides 256 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 19 of 21 ends

assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews should include vulnerability scanning tools.

B. Log Reviews. All systems processing and/or storing County PHI or PI must have a routine procedure in place to review system logs for unauthorized access.

32. Business Continuity/Disaster Recovery Controls
A. Emergency Mode Operation Plan. Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of County PHI or PI held in an electronic format in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than 24 hours.

33. Paper Document Controls
A. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information.

County PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

B. Escorting Visitors. Visitors to areas where County PHI or PI is contained shall be escorted and County PHI or PI shall be kept out of sight while visitors are in the area.

C. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as cross cut shredding and pulverizing.

D. Removal of Data. Only the minimum necessary County PHI or PI may be removed from the premises of the Contractor except with express written permission of the County.

County PHI or PI shall not be considered “removed from the premises” if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.
257 of 280
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)

Page 20 of 21 ends

Part V: Provisions for Access to County Electronic Health Records System (Applies to contractors that have access to County E.H.R. system)

A. Contractor shall only use the EHR system to support clients served pursuant to a contract with the County.

B. Contractor and Contractor staff shall only access the EHR and Protected Health Information for the purpose of providing healthcare services.

C. Contractor shall ensure that staff will not use or disclose Protected Health Information other than as permitted or as required by law or this Agreement.

Page 21 of 21 ends

J. Contactor shall comply with all other information privacy and security provisions as articulated in this Agreement and exhibits.

ROHNERT PARK EXPRESSWAY

EAST COTATI AVENUE
Laurel Drive (one way)
Zelkova Lane
Juniper Lane
service road
service road
South Entrance
General Parking
General Parking
Parking &
Information
Center Donald & Maureen Campus Map Green Music Center
Schroeder Hall
Music Education Bldg.

Facilities
Services
Bldg 29
General Parking General Parking
Joan & Sanford I.

Weill Hall
GMC services road
Trione Courtyard
Copeland Creek
North Entrance
Pool
Pool
Pool
Lake
Fieldhouse
Prelude
Gymnasium
Wine Spectator
Learning Center
International
Hall
Stevenson Hall
Nichols Hall
Carson Hall Zinfandel
Classrooms
Health Center
Art
ETC
Chalk Hill
Children’s
School
Harvest
Room
The Vineyard
Viognier Green
Valley
Room Carneros
Salazar Hall
Recreation Center
Darwin Hall
Ives Hall
Person
Theatre
Student Center
Cooperage Cellars
Barrel Room
Library
Schulz
Information
Center
Toast
QUAD
Bacon & Eggs
Pre-Collegiate
Programs
Mail Room
Facilities
Warehouse
Baseball Clubhouse
Observatory
Tennis Courts
Laura Gale
Field
Commencement
Lawn
Sauvignon Green
Sauv Quad
Lake
Alumni
Grove
The
Arbor
Athletic Fields
Butterfly
Garden
Lake
Boiler
Plant
Seawolf Plaza
Parking &
Information
Center
Soccer
Softball Baseball
Track
Alumni Amphitheater
General Parking
General
Parking
Reserved Parking
Reserved
Parking
General Parking General
Parking
General
Parking
McCabe
Plaza
Casentino
Room
Chenin Blanc
Chablis
Claret
Sangiovese
Meritage Sauterne
Chateau
Verdot
Warehouse
Riesling
Flora
Barbera
Chardonnay
Sirah
Marsanne
Grenache
Alicante
Burgundy
Colombard
Piemonte
Fume
Blanc
Mosel Veneto
Provence
Alsace
Bordeaux Madeira
Medoc
Rhone Rioja Savoie
Trentino
Merlot Gamay
Tokay
Traminer
Semillion
Pinot
Muscat
B-V meeting room

TUSCANY VILLAGE

SAUVIGNON VILLAGE

VERDOT VILLAGE

ZINFANDEL VILLAGE

CABERNET VILLAGE

BEAUJOLAIS VILLAGE
Veterans’
Memorial
Holocaust
& Genocide
Memorial
Lot E
Lot N
Lot O
Lot D
Lot C
Lot B
Lot A
Bldg 17A
/ CAPS
38 Vietnam Veterans’
Memorial
Green Music Center
Schroeder Hall
Weill Hall
Schroeder Hall
University Police
Green Music Center
Pre-Collegiate Programs
Parking Permit Machine
Bus Stop
Campus Tours
(Salazar Hall)
Technology High School
(Salazar Hall)
University Police
707-644-4444
For emergencies, dial 911
1 Alumni Grove
2 Anthropological
Studies Center
Beaujolais Village
4 5 Bookstore
Cabernet Village
7 6
8 Carson Hall
10 Children’s School
11 12 Darwin Hall
12 14
Environmental
Technology Center
13 15
Facilities Services
14 16
Fieldhouse
15 17 Gymnasium
19 International Hall 19
20 23 Nichols Hall
23 24 Observatory
24 25 Parking & Information
Center
25 28 Recreation Center
28 29 Salazar Hall
29 Sauvignon Village
30 31
Shulz Information Center
32 31
33 Stevenson Hall
33 34 Student Center
34 35 Student Health Center
35 Library Galleries
(Shulz Info Center)
Person Theatre
University Gallery
(Art Building)
Visual and Performing Arts
Tuscany Village
37 39
Verdot Village
38 41 Wine Spectator Learning
Center
41 Zinfandel Village
42 Lobo’s Pizza & Pub
34 Overlook
The Kitchens
Weyden + Brewster
SIP
Charlie Brown’s Café
9 Prelude
36 Toast
27 1
2 3
5 7
8 10
16 17
40 21
22 26
Parking
(General & Residence Halls)
Holocaust & Genocide
Memorial Grove
Vietnam Veterans’
Memorial
R1 - R12
Residence Hall
Parking Lots
Lot A - Lot O General/Reserved
Parking Lots
Lot J
18 21 Lakes
3 Art Building
4 Beaujolais Village
6 Cabernet Village
11 Cooperage
13 18 Holocaust & Genocide
Memorial Grove
22 Library
(Shulz Info Center)
26 Person Theatre
30 Sauvignon Village
32 37 Tuscany Village
39 Verdot Village
9 Charlie Brown’s Café
36 Toast
27 Prelude
Technology High School
(Salazar Hall)
20 Ives Hall
40 Weill Hall
Dining
Memorials
Residence Halls
Sonoma State University is Smoke & Tobacco Free
Inside Student Center:
25 3
16 22
26 4
7 30
37 39
42 42 Zinfandel Village
9 27
36 34
38 18
31 40
1/9/2020
Lot F
Lot G Lot H
Lot L Lot M
Lot
41 Inside Wine Spectator
Learning Center
Stomping Grounds
41 43 Bldg 17A / CAPS
43 44
44 Chalk Hill
260 of 280
Cotati City Council
Agenda Staff Report
Item type: REGULAR AGENDA (ACTION)
To: City Council
Subject: UPDATE ON THE LA PLAZA WATER FOUNTAIN
Date: September 8, 2026
Written by: Damien O'Bid, City Manager
Recommendation
It is recommended that the City Council receive an update on the planned removal of the decommissioned water fountain in La Plaza Park and provide direction to staff, if any.

Background
In 1971, the Cotati Public Works Department built the decorative water fountain in La Plaza Park. For many years, this water fountain has been out of service, initially as a water savings measure during drought years but eventually because it no longer functioned. Once it was permanently out of service, the standing water in the basin became a mosquito breeding issue as well as a potential drowning hazard for small children. As a result, the City filled the basins with soil. However, the fountain is now very old and poses a safety hazard for people that regularly climb onto it.

In the adopted 2019 Parks Master Plan, the fountain was one of the park elements explicitly slated for removal, as described in the narrative for La Plaza Park, attached.

Analysis/Discussion
Beginning in October 2026, PG&E will begin work in La Plaza park to replace an aging high pressure gas main that runs through the park. The alignment of the gas line will require trenching and heavy equipment immediately adjacent to the water fountain, which is likely to damage and destabilize the feature.

Given the prior intent to remove the water fountain from the park and the immediately adjacent destabilizing work, the staff are intending to direct PG&E to remove the fountain and 261 of 280
surrounding asphalt in the course of their work and restore the area as turf to match the surrounding area. This will implement the direction in the Park Master Plan, remove a potentially hazardous feature, and free up space in the park for the many events throughout the year.

The primary ad-hoc use of the feature is as a seat (on the lower tier) and as a location to place the Christmas tree during the holiday. However, there are a variety of benches, tables, and other features that are used for seating throughout the park, so staff do not believe that this informal seating needs to be replaced at this time. However, in the Park Master Plan, additional seating and other features are planned to compliment the planned improvements, rather than placed throughout the park without intent, where they often obstruct event set up or general activities.

For the Christmas tree, a new tier or stand will be required to maintain the current height.

Financial Considerations
There is no cost impact with removing the water fountain and surrounding asphalt and restoring the area, as this would be performed by PG&E as part of their gas main replacement work. Staff anticipate some minor costs (expected to be less than $2,000) for either purchase of a new tier for the Christmas tree or construction of a temporary stand for the holidays. This additional cost is not expected to require a budget adjustment, as they are planned to come from the general operations already budgeted. As such, no appropriations or budget adjustments are being requested.

Environmental Issues
This action is found to qualify for a Class 1 Categorical Exemption under CEQA Section 15301 in that the project consists of the operation, repair, maintenance, permitting, leasing, licensing, or minor alteration of existing public or private structures, facilities, mechanical equipment, or topographical features, involving negligible or no expansion of the existing or former use. 262 of 280

CONCEPT PROPOSAL
30 LA PLAZA PARK
La Plaza Park, one of the most heavily used parks within the City of Cotati, recently underwent a lighting renovation. Adding lighting to the park was a high priority for City Council and residents to improve safety and expand to potential nighttime usage.

The Parks Capital Plan proposes enhancements with a larger group picnic area near the existing playground structure at La Plaza Park. The group picnic area includes updated tables and benches.

The other existing picnic areas are proposed to be updated and include ADA accessibility to the tables.

The existing playground is proposed to be surrounded by a 3’ tall fence to keep children inside the playground boundaries and to prevent them from running into the street. The playground is also proposed to add more play equipment, musical in nature, to celebrate City of Cotati’s musical heritage.

Lastly, age-varied swings should be added to the playground area.

More practical facilities, such as bike racks and three-tiered drinking fountains, have been proposed in the park. The old fountain feature and old planters are proposed to be removed, as they are limited in function, located in awkward locations for the best use of park space and are not handicap accessible.

The plaques are proposed to be consolidated from around the park on a seat wall surrounding the playground.

The Demonstration Garden and Rose Garden are not proposed for any improvements as part of this conceptual master planning process.

In the northeast, a new pathway, more rural in nature, and seat walls are proposed to bring pedestrians into the previously unused areas.

Overall, La Plaza Park is proposed to receive significant upgrades to the existing features of the park, to make the features more useable and engaging.
*Plan graphics are representative of proposed improvements. City of Cotati reserves the right to change proposed improvements and elements.

EXISTING PROPOSED TOTAL
TOT-LOT/PLAYGROUND 1 (2-12)YRS 1 (2-12)YRS (FENCED) 1(2-12)YRS (FENCED) 1 SWING SET/PLAYGROUND 2 (2-12)YRS 1 (2-12)YRS(MUSICAL) 1 (2-12)YRS(MUSICAL) 2 AMPHITHEATER/STAGE 11
LIGHTING 7 7
BENCHES 3 8 11 4
PICNIC TABLES 4 4 5
TRASH(T)RECYCLE(R) 5 1 66
RESTROOMS 1 1
FOUNTAIN FEATURE 1 1
BIKE RACKS 2 27
OPEN GRASS AREA 1 1
MONUMENT SIGNS 1 1
DRINKING FOUNTAIN 1 18
WALKWAYS Y ‐‐ 9
NO.

SITE AMENITIES QUANTITY

DESCRIPTION

Page 1 ends

263 of 280

LA PLAZA PARK

CONCEPT PROPOSALS
2 MAP HERE
264 of 280
Cotati City Council
Agenda Staff Report
Item type: REGULAR AGENDA (ACTION)
To: City Council
Subject: AWARD OF 2026/2027 PAVEMENT PRESERVATION

PROJECT
Date: September 8, 2026
Written by: Colby Quiggle,
Recommendation
It is recommended the City Council of the City of Cotati adopt a resolution approving the award of a construction contract for the 2026/2027 Pavement Preservation Project (Project) to Graham Contractors, Inc.; approving an amendment to the Professional Services Agreement with Green Valley Consulting Engineers for Construction Management and Inspection services; approving a $50,000 budget amendment; and authorizing the City Manager to execute the agreements, amendments, and any necessary change orders within the approved Project budget.

Background
The City of Cotati performs annual pavement maintenance projects throughout the City. These projects involve multiple pavement preservation methods such as slurry seal, crack seal, and digouts. These projects are performed annually to ensure the City’s roads will be safe to drive on and pleasing to the eye for years to come. The location of each year’s project is determined by the Pavement Management Program (PMP), which provides strategies to prioritize the annual roadway projects based on their condition and treatment costs.

Analysis/Discussion
The City Council awarded the Design contract to Harris & Associates to design, prepare bid documents, and provide assistance through bidding. The design was completed, and the project was advertised with bids opened on September 1, 2026. Three bids were received with the low bid from Graham Contractors, Inc. for a total base bid of $328,736, which is 13% below the engineer’s estimate of $377,679. The low bid was evaluated and determined to be a responsive bid.
265 of 280
In August 2024, the City conducted a competitive Request for Proposals (RFP) process for construction management services and selected Green Valley Consulting Engineers based on the firm's demonstrated competence and professional qualifications. The selection was conducted consistent with Government Code § 4526 and the City's Procurement Policy.

Green Valley has continued to provide construction management services to the City under a Professional Services Agreement and has demonstrated a high level of performance and familiarity with City projects and procedures. Based on the original competitive selection process, the firm's continued demonstrated qualifications, and its performance for the City, staff determined that Green Valley remains qualified to provide these services. Green Valley provided a proposal for Construction Management and Inspection services for this Project in an amount not to exceed $77,598. Staff recommend amending the existing Professional Services Agreement to incorporate the current project scope and associated compensation.

Financial Considerations
The Fiscal Year 2026/27 Adopted Budget includes funding for the City's pavement preservation program. However, certain expenditures associated with the prior 2025/26 Street Project carried forward into Fiscal Year 2026/27 and reduced the current-year appropriations available for the 2026/2027 Pavement Preservation Project.

To provide sufficient budget authority to complete the Project, staff recommend a $50,000 budget amendment, utilizing remaining budget available from the prior fiscal year. The proposed budget amendment is included as an attachment to this staff report for City Council approval.

The anticipated Project costs are summarized below:

Item Amount
Design (expended since 7/1/26 and encumbered) $ 80,975
Construction Management $ 77,598
Construction $ 328,736
Contingency $ 10,000
Total $ 497,309
Environmental Issues
This action is found to qualify for a Class 2 Categorical Exemption under CEQA Section 15302 in that the project consists of replacement or reconstruction of existing structures and facilities where the new structure/facility will be located on the same site as the structure replaced and will have substantially the same purpose and capacity as the structure replaced. 266 of 280
RESOLUTION NO. (XX)
AWARD OF A CONSTRUCTION CONTRACT FOR THE 2026/2027 PAVEMENT

PRESERVATION PROJECT
WHEREAS, the City of Cotati performs annual pavement maintenance projects throughout the City using various pavement preservation methods to maintain safe and serviceable roadways; and
WHEREAS, the location and scope of each annual project are determined through the City's Pavement Management Program (PMP), and the 2026/2027 Pavement Preservation Project (Project) includes improvements to streets commonly known as the "L Section"; and WHEREAS, the City Council awarded the design contract to Harris & Associates to prepare the Project design and bid documents, and following completion of the design, the Project was advertised for construction bids, which were opened on September 1, 2026; and WHEREAS, three construction bids were received, with Graham Contractors, Inc. submitting the lowest responsive bid of $328,736, which is 13% below the engineer's estimate of $377,679; and
WHEREAS, in August 2024, the City competitively selected Green Valley Consulting Engineers for construction management services based on demonstrated competence and professional qualifications consistent with Government Code § 4526 and the City's Procurement Policy, and based on the firm's continued qualifications and performance for the City, staff recommends amending its existing Professional Services Agreement to include Construction Management and Inspection services for the Project in an amount not to exceed $77,598; and WHEREAS, the city staff requested, and Green Valley Consulting Engineer’s provided, a proposal for Construction Management and Inspection services for the Project in an amount not to exceed $77,598, and City staff has reviewed the proposal and finds it to be fair and reasonable and recommends it for approval; and
WHEREAS, expenditures associated with the prior 2025/26 Street Project carried forward into Fiscal Year 2026/27, reducing available current-year appropriations, and a budget amendment of $50,000 utilizing remaining budget available from the prior fiscal year is necessary to provide sufficient budget authority for the Project; and WHEREAS, this action is found to qualify for a Class 2 Categorical Exemption under CEQA Section 15302 in that the project consists of replacement or reconstruction of existing structures and facilities where the new structure/facility will be located on the same site as the structure replaced and will have substantially the same purpose and capacity as the structure replaced
NOW THEREFORE BE IT RESOLVED, the City Council of the City of Cotati determines the following:

1. The recitals above are true and correct, and
267 of 280

2. Awards the construction contract for the 2026/2027 Pavement Preservation Project to Graham Contractors, Inc. in the amount of $328,736; and

3. Approves an amendment to the existing Professional Services Agreement with Green Valley Consulting Engineers to incorporate Construction Management and Inspection services for the Project in an amount not to exceed $77,598; and

4. Approves a budget amendment of $50,000, as set forth in the budget amendment attached to the staff report, to provide sufficient Fiscal Year 2026/27 appropriations for the Project; and

5. Authorizes the City Manager to execute the construction contract, Professional Services Agreement amendment, and any necessary change orders or amendments within the approved Project budget; and

6. Authorize the budgetary return of unused appropriations back to the originating funds upon completion and closeout of the Project.

IT IS HEREBY CERTIFIED that the foregoing resolution was duly adopted at a regular meeting of the City Council of the City of Cotati held on September 8, 2026, by the following vote, to wit:

Approved:___________________________
Mayor
Attest:______________________________
Kevin Patterson, City Clerk
Approved as to form:______________________________
City Attorney
268 of 280
101 116 CITY OF COTATI 1401 Willow Pass Road, Suite 500, Concord CA. 94520 www.WeAreHarris.com (925) 827-4900 City of Cotati 2026/2027 PAVEMENT PRESERVATION PROJECT TITLE SHEET AREA MAP CITY OF COTATI 2026/2027 PAVEMENT PRESERVATION PROJE VICINITY MAPPROJECT AREA Know what'sbelow. Callbefore you dig. R PA#097-2 Craig A.. Scott Digitally signed by Craig A.. Scott DN: C=US,, [email protected],, O=City of Cotati,, OU=Department of Public Works,, CN=""Craig A.. Scott "" Date: 2200226..008..007 007:445:228--007''0000'' 269 of 280 CITY OF COTATI 1401 Willow Pass Road, Suite 500, Concord CA. 94520 www.WeAreHarris.com (925) 827-4900 City of Cotati 2026/2027 PAVEMENT PRESERVATION PROJECT GENERAL NOTES AND ABBREVIATIONS GENERAL NOTES SIGNINGS, STRIPING AND PAVEMENT MARKINGS ABBREVIATIONS DUST CONTROL NOTES 270 of 280

CITY OF COTATI
1401 Willow Pass Road, Suite 500, Concord CA. 94520
www.WeAreHarris.com (925) 827-4900
City of Cotati
2026/2027 PAVEMENT PRESERVATION PROJECT

KEY MAP
PAVEMENT PRESERVATION 271 of 280

CITY OF COTATI
1401 Willow Pass Road, Suite 500, Concord CA. 94520
www.WeAreHarris.com (925) 827-4900
City of Cotati
2026/2027 PAVEMENT PRESERVATION PROJECT

CONSTRUCTION DETAILS
TYPICAL SECTIONS 272 of 280

CITY OF COTATI
1401 Willow Pass Road, Suite 500, Concord CA. 94520
www.WeAreHarris.com (925) 827-4900
City of Cotati
2026/2027 PAVEMENT PRESERVATION PROJECT

CONSTRUCTION DETAILS

SLURRY SEAL DIG-OUTS AND QUANTITIES
TABLE 1: SLURRY SEAL QUANTITIES - TREATMENT AREA AND STRIPING TABLE 2: LORETTO AVE DIGOUT
TABLE 3: OLD REDWOOD HWY DIGOUTS
273 of 280

CITY OF COTATI
1401 Willow Pass Road, Suite 500, Concord CA. 94520
www.WeAreHarris.com (925) 827-4900
City of Cotati
2026/2027 PAVEMENT PRESERVATION PROJECT

CONSTRUCTION DETAILS
T-CUT TRENCH AC PATCH LOCATIONS 274 of 280
Bidder #1 Bidder #2 Bidder #3
Item # Quantity Unit Unit Cost Budget Unit Cost Budget Unit Cost Budget Unit Cost Budget Base Bid
Mobilization 1 LS $16,000.00 $16,000.00 $28,405.00 $28,405.00 $55,000.00 $55,000.00 $35,920.00 $35,920.00 Traffic Controls & Construction Area Signs 1 LS $19,000.00 $19,000.00 $25,531.00 $25,531.00 $38,500.00 $38,500.00 $77,655.00 $77,655.00 Storm Water Pollution Control Program 1 LS $10,000.00 $10,000.00 $1,800.00 $1,800.00 $5,000.00 $5,000.00 $2,700.00 $2,700.00 Unsuitable Subgrade (Revocable if not used) 42 CY $98.00 $4,116.00 $250.00 $10,500.00 $1,225.00 $51,450.00 $1,296.00 $54,432.00 Slurry Seal 39,000 SY $4.60 $179,400.00 $3.76 $146,640.00 $2.84 $110,760.00 $3.15 $122,850.00 Crack Seal 1 LS $23,600.00 $23,600.00 $32,000.00 $32,000.00 $25,000.00 $25,000.00 $8,856.00 $8,856.00 4" HMA Base Repair 700 SF $16.00 $11,200.00 $29.00 $20,300.00 $37.02 $25,914.00 $34.56 $24,192.00 Install Crosswalk (Thermoplastic) 1,270 SF $10.50 $13,335.00 $12.00 $15,240.00 $12.30 $15,621.00 $12.96 $16,459.20 Install 4" Stripe (W) (Thermoplastic) 280 LF $2.70 $756.00 $6.00 $1,680.00 $6.15 $1,722.00 $6.48 $1,814.40 Install 12" Stripe (W) (Thermoplastic) 90 LF $10.50 $945.00 $12.00 $1,080.00 $12.30 $1,107.00 $12.96 $1,166.40 Install Caltrans Striping Detail 21 (Thermoplastic) 600 LF $4.20 $2,520.00 $3.00 $1,800.00 $3.10 $1,860.00 $3.24 $1,944.00 Install Caltrans Striping Detail 22 (Thermoplastic) 480 LF $4.20 $2,016.00 $4.00 $1,920.00 $4.10 $1,968.00 $4.32 $2,073.60 Install Caltrans Striping Detail 27B (Thermoplastic) 70 LF $2.30 $161.00 $2.00 $140.00 $2.05 $143.50 $2.16 $151.20 Install Pavement Marking White (Thermoplastic) 630 SF $13.00 $8,190.00 $12.00 $7,560.00 $12.30 $7,749.00 $12.96 $8,164.80 Install Blue Reflective Fire Hydrant Marker 20 EA $21.00 $420.00 $35.00 $700.00 $36.00 $720.00 $37.80 $756.00 Mill 3" T-Cut and Place 3" HMA 1,520 SF $34.00 $51,680.00 $22.00 $33,440.00 $22.00 $33,440.00 $20.52 $31,190.40 Base Bid Total $343,339.00 $328,736.00 $375,954.50 $390,325.00 Engineer's Estimate Graham Contractors Pavement Coatings VSS International

BID TAB SUMMARY SHEET
2026/2027 Street Preservation Project
Located in the City of Cotati
Bid Opening Date: 8/8/2026
Engineer's Estimate: $343,339
Engineer's Estimate plus 10% Contingency: $377,679
1 275 of 280
City of Cotati
Sonoma County, California
________________________________________________________________

NOTICE OF AWARD
Dated: September 8, 2026
To: Graham Contractors Inc.

David Graham
P.O. Box 26770
San Jose, California 95159
CONTRACT FOR: 2026-2027 Pavement Preservation Project
The Cotati City Council, at their meeting on September 8, 2026, awarded the subject project to Graham Contractors Inc., and authorized the City Manager to execute the construction contract for an amount not to exceed $328,736.

The construction contract will be sent to you via Docusign once the City has received the required documents. Please send your bonds, certificates of insurance, and Payee Data Record.

Also, please verify the name, title and e-mail of the person authorized to sign the construction agreement.

Once we have received the required bid and insurance documents, a pre-construction job conference is required and a Notice to Proceed will be issued. Your firm will be contacted regarding available dates for this conference.

I am looking forward to working with your firm, and to the successful completion of this project.

CITY OF COTATI,
A General Law City of the State of California
By: ___________________________________
Craig A. Scott, P.E
Director of Public Works/City Engineer
276 of 280
9/3/2026 2:07:25 PM Page 1 of 3
Budget Adjustment Register
Cotati, CA Adjustment Detail
Packet: GLPKT16088 - Streets Project Budget Rollforward 2025/26 - 2026/
Adjustment Number Budget Code Description Adjustment Date BA0000107 Adopted Budget for FY 2025… Move Budget to FY 2026/27 for 25/26 St. Project 6/30/2026 Summary Description: Move budget required to meet constructions costs incurred in FY 2026/27 but for Budgeted FY 2025/26 street improvement project.

Account Number Account Name Adjustment Description Before Adjustment After 101-19-81000-FND605 OTHER TRANSFER OUT-CAPITAL… Move Budget to FY 2026/27 for 25/26 St. Proje… 244,372.00 -50,000.00 194,372.00 June: -50,000.00
605-19-67000-49PWGL OPER TRANS IN - STREET IMPRV. Move Budget to FY 2026/27 for 25/26 St. Proje… -808,775.00 50,000.00 -758,775.00 June: 50,000.00
605-19-91300-49PWGL STREET IMPROVEMENTS Move Budget to FY 2026/27 for 25/26 St. Proje… 808,775.00 -50,000.00 758,775.00 June: -50,000.00
Adjustment Number Budget Code Description Adjustment Date BA0000108 Adopted Budget for FY 2026… Move Budget from FY 2025/26 for 25/26 St. Project 9/8/2026 Summary Description:

Account Number Account Name Adjustment Description Before Adjustment After 101-19-81000-FND605 OTHER TRANSFER OUT-CAPITAL… Move Budget from FY 2025/26 for 25/26 St. Pr… 179,699.00 50,000.00 229,699.00 September: 50,000.00
605-19-67000-49PWGL OPER TRANS IN - STREET IMPRV. Move Budget from FY 2025/26 for 25/26 St. Pr… -750,000.00 -50,000.00 -800,000.00 September: -50,000.00
605-19-91300-49PWGL STREET IMPROVEMENTS Move Budget from FY 2025/26 for 25/26 St. Pr… 750,000.00 50,000.00 800,000.00 September: 50,000.00
277 of 280
Budget Adjustment Register Packet: GLPKT16088 - Streets Project Budget Rollforward 2025/26 - 2026/ 9/3/2026 2:07:25 PM Page 2 of 3
Budget Budget Description Account Account Description After Budget Code Summary
Before Adjustment
2025-2026 Adopted Budget for FY 20… 101-19-81000-FND605 OTHER TRANSFER OUT-CAPITAL P… 244,372.00 -50,000.00 194,372.00 605-19-67000-49PWGL OPER TRANS IN - STREET IMPRV. -808,775.00 50,000.00 -758,775.00 605-19-91300-49PWGL STREET IMPROVEMENTS 808,775.00 -50,000.00 758,775.00 2025-2026 Total: 244,372.00 -50,000.00 194,372.00
2026-2027 Adopted Budget for FY 20… 101-19-81000-FND605 OTHER TRANSFER OUT-CAPITAL P… 179,699.00 50,000.00 229,699.00 605-19-67000-49PWGL OPER TRANS IN - STREET IMPRV. -750,000.00 -50,000.00 -800,000.00 605-19-91300-49PWGL STREET IMPROVEMENTS 750,000.00 50,000.00 800,000.00 2026-2027 Total: 179,699.00 50,000.00 229,699.00
Grand Total: 424,071.00 0.00 424,071.00
278 of 280
Budget Adjustment Register Packet: GLPKT16088 - Streets Project Budget Rollforward 2025/26 - 2026/ 9/3/2026 2:07:25 PM Page 3 of 3
Fund After
Fund Summary
Before Adjustment
Budget Code:2025-2026 - Adopted Budget for FY 2025/26 Fiscal: 2025-2026 101 244,372.00 -50,000.00 194,372.00
605 0.00 0.00 0.00
Budget Code 2025-2026 Total: 244,372.00 -50,000.00 194,372.00 Budget Code:2026-2027 - Adopted Budget for FY 2026/27 Fiscal: 2026-2027 101 179,699.00 50,000.00 229,699.00
605 0.00 0.00 0.00
Budget Code 2026-2027 Total: 179,699.00 50,000.00 229,699.00 Grand Total: 424,071.00 0.00 424,071.00
279 of 280
Cotati City Council
Agenda Staff Report
Item type: INFORMATION RECEIVED AFTER THE AGENDA WAS POSTED To: City Council
Subject: INFORMATION RECEIVED AFTER THE AGENDA WAS POSTED Date: September 8, 2026
Written by: Kevin Patterson, City Clerk
Recommendation
Information or written comments pertaining to this meeting, and which was received after the agenda was posted, is attached below.

Pursuant to City Council Policy 2025-03: City Council Rules section IV A., written Communications, interested persons or their authorized representative may address the Council by written communication on any matters concerning the City’s business, or any matters over which the Council has control.

1. To be considered for inclusion in the agenda packet, such written communication shall be delivered to the City Clerk no later than 11:00 a.m. of the Wednesday the week preceding the regular Council meeting for which such written communication is intended.

2. If received after the above date and time, but no later than noon the day before the meeting, written communications received by the City Clerk shall be posted on the website by the end of that day and notification provided to the electronic Agenda mailing list by the end of the day. All written communications received by the City Clerk by 5 pm on the City Council meeting day shall be made available to the City Council and public at the City Council meeting.

City Council Policy 2025-03 is available at the online meeting portal at www.cotaticity.gov or by request from the City Clerk at 707-665-3622 or [email protected]. 280 of 280

Cotati City CouncilSeptember 8, 2026

Cotati City Council
September 8, 2026