Item No.
TO: HONORABLE MAYOR AND MEMBERS OF THE CITY COUNCIL
FROM: OFFICE OF THE CITY MANAGER
BY: JAMES MCQUEEN DIRECTOR OF HUMAN RESOURCES
D ATE: JUNE 25, 2024
SUBJECT: APPROVAL OF AGREEMENTS FOR TRANSITION OF ADMINISTRATION OF THE CITY’S RETIREMENT HEALTH SAVINGS PLAN
EXECUTIVE SUMMARY
The City Council will consider approving the necessary agreements to transition the administration of the City’s retirement health savings plan to Voya Retirement Insurance and Annuity Company. The retiree health savings plan allows employees to defer income tax on retirement savings into future years. The current administrator of the City’s plan is Total Administrative Services Corporation (TASC).
RECOMMENDATIONS
That the City Council:
Authorize the City Manager or his designee, to execute the necessary agreements to transfer the administration of the City’s Retirement Health Savings Plan to Voya Retirement Insurance and Annuity Company.
BACKGROUND
Under Section 401(h) of the Internal Revenue Code, government entities may sponsor a retiree medical plan, to allow employees to defer income tax on retirement savings into future years. The City’s current benefit offerings allow employees the ability to cash out a portion of unused sick time up to established maximums upon retirement. These funds are then deposited into the City’s retirement health savings plan to be used to pay for qualifying medical expenses.
The current administrator of the City’s plan is Total Administrative Services Corporation (TASC). TASC has been the administrator of the City’s plan since March of 2018 when the City transitioned from the prior record keeper for this plan. At the time, the City also transitioned to a new administrator of the City’s Deferred Compensation Plan, Voya.
Voya did not offer administrative service for health savings plans requiring the services to be provided by another record keeper with whom Voya had an administrative relationship, such as TASC.
2 TRANSITION OF THE ADMINISTRATION OF THE CITY’S RETIREMENT HEALTH SAVINGS PLAN JUNE 25, 2024
PAGE 2
ANALYSIS
Recently, Voya notified the City that it has began providing administrative services for health savings plans. The transition of the administration of the plan from TASC to Voya will benefit the participants in the plan by having the administration of the City’s existing deferred compensation plan and retirement health savings accounts under the same administrator. This will allow participants to access information regarding all City retirement accounts in a single location. The new platform from Voya also provides an improved single sign-on web experience and participant website page for their Retirement Health Savings account, as well as an easier and more efficient experience in paying for qualified medical expenses using their debit card. The Support Services offered to retirees will also improve.
The current fees for the services associated with the administration of the health savings plan are paid directly by the participants in the plan. The fee structure is an asset-based fee of 0.35% on mutual fund investments only, plus an annual administrative fee of $30 for each participant account (collected $2.50 per month). Fees will not be impacted by this transition as Voya is matching the existing fee structure.
CITY COUNCIL PRIORITIES
Fiscal Responsibility
FISCAL IMPACT
There are no fiscal impacts.
ATTACHMENTS
Attachment A: Section 115 Trust Agreement
Attachment B: Employer Services Agreement
SECTION 115 TRUST AGREEMENT
GOVERNMENTAL EMPIJOYERS
(Non-ERISA)
by and betu'een
The City of Downey
EMPLOYER
and
VOy A INSTITUTIONAL TRUST CONIPANY
SECTION 115 TRUST AGREEMENT
GOVERN\IE'N’TAL ENiPI,OYERS
(Non-ERISA )
Version date 10-6-2022
ATTACHMENT A
function. The Employer shall be solely responsible for ensuring the compliance of the Plan and Trust with the applicable sections of the Code, and the Trustee may assume, unless advised to the contrary, that the Plan is qualified and that the Trust is entitled to tax exemption. It is intended that this Trust Agreement be construed so that no disqualified benefit (within the meaning of Section 4976 of the Code) be provided hereunder.
SECTION 2 -AUTHORITIES
2.1 Authority to Execute Agreement. The Employer hereby certifies that it has the power and authority to enter into this Trust Agreement on behalf of the Plan. The person signing below as a representative of the Employer warrants, as an individual, that he/she is an authorized representative of the Employer, his/her signature is genuine and the person indicated is authorized to sign.
2.2 Authorized Parties. The Employer shall concurrently with the execution of this Trust Agreement, furnish Trustee Affiliate or its designee, as the agent of the Trustee, with a written list of the names, signatures, and extent of authority of all persons authorized to direct the Trustee and otherwise act on behalf of the Employer under the terms of the Plan. Such persons designated by the Employer to act on its behalf hereunder are "Authorized Parties". The Trustee and its agents shall be entitled to rely on and shall be fully protected in acting upon directions, instructions, and any information provided by an Authorized Party until notified in writing by the Employer of a change of the identity or extent of authority of an Authorized Party.
2.3 Authorized Instructions. All directions and instructions to the Trustee from an Authorized Party ("Authorized Instructions") shall be sent to Trustee Affiliate or its designee, as the agent of the Trustee, in writing, transmitted by mail (including electronic mail) or by facsimile according to Trustee Affiliate' s established procedures. The Trustee and its agents shall be entitled to rely on and shall be fully protected in acting in accordance with all such directions and instructions which it reasonably believes to have been given by an Authorized Party and in failing to act in the absence thereof.
SECTION 3 -POWERS OF THE TRUSTEE
3.1 General Powers of the Trustee. In administering the Trust Fund, the Trustee shall be specifically authorized to:
(a)In accordance with the Authorized Instructions, receive, hold, maintain custody of and disburse assets of the Trust Fund;
(b)Hold securities or other Plan property in book entry form or through another agent or nominee, including without limitation in an omnibus account arrangement, provided that the Trustee's records clearly indicate that such securities or other property are held for the exclusive benefit of the Plan and its participants and beneficiaries;
-4-
(c)Appoint domestic agents, including but not limited to Truste e Affiliate, sub-trustees, sub-custodians or depositories (including affiliates of the Trustee) as to part or all of the Trust Fund, except that the indicia of ownership of any asset of the Trust Fund shall not be held outside the jurisdiction of the District Courts of the United States unless in compliance with applicable law and regulation; (d)Collect income payable to and dividends or other distributions due to the Trust Fund and sign on behalf of the Plan any declarations, affidavits, and certificates of ownership required to collect income and principal payments, and if requested by the Employer, sign required governmental filings:
(e)Until Authorized Instructions have been received, hold the assets of the Trust Fund uninvested, or invest the assets of the Trust Fund in bank accounts of any bank;
(f)Commence or defend suits or legal proceedings and represent the Trust Fund in all suits or legal proceedings in any court or before any other body or tribunal as the Trustee shall deem necessary to protect the Trust Fund provided, however, that the Trustee shall not be obligated to do so unless it has been indemnified by the Employer and the Plan against all expenses and liabilities sustained in connection with such action; (g)Employ suitable agents and legal counsel, who may be counsel for the Employer. The Trustee shall be entitled to rely on and may act upon advice of counsel on all matters, and, if the use of such counsel is authorized by the Employer, the Trustee shall be without liability for any action reasonably taken or omitted pursuant to such advice;
(h)Make, execute and deliver any and all documents, agreements or other instruments in writing as is necessary or desirable for the accomplishment of any of the powers and duties in this Trust Agreement;
(i)Exercise all proxy voting rights relating to mutual funds or other securities held in the Trust Fund in accordance with board/management recommendation; and (j)Generally take any action, whether or not expressly authorized, which the Trustee may deem necessary or desirable for the fulfillment of its duties hereunder.
3.2 Power to Do All Necessary Acts. To the extent not inconsistent with the express provisions hereof, enumeration of any power herein shall not be by way of limitation, but shall be cumulative and construed as full and complete power in favor of the Trustee. In addition to the authority specifically granted herein, the Trustee shall have such power to do all acts as may be deemed necessary for full and complete management of the Trust Fund and appropriate to carry out the purposes of the Trust Fund, and shall further have all powers and authorities conferred upon trustees by the laws of the state of Connecticut. -5-
SECTION 4 -INVESTMENT OF THE TRUST FUND
4.1 Selection of Investments; Prohibition on Investment Advice. The Trustee shall have no discretion over the investment of the Trust Fund, no responsibility for the selection of the investment options for the Plan, and shall not render investment advice to any person in connection with the investment options available thereunder. Except to the extent required by applicable law, the Trustee shall have no duty or responsibility to review, initiate action, or make recommendations regarding the Trust Fund and the Trustee shall retain assets until it receives Authorized Instructions from the Employer regarding disposal of them. The Employer shall have all power over and responsibility for the management, disposition, and investment of the Trust Fund, and the Trustee shall comply with Authorized Instructions of the Employer concerning the Trust Fund. The Employer represents to the Trustee that it shall not issue Authorized Instructions that violate the terms of the Plan and the Trust Agreement or that are prohibited by applicable law. The Trustee shall have no duty or responsibility for (a) selecting or providing advice with respect to the selection of any investment options offered under the Plan, (b)determining or reviewing any securities or other property purchased for or held by the Plan, or (c) providing advice with respect to the purchase, retention, redemption, or sale of any securities or other property for the Plan. In the event the Employer has selected particular investment options into which Plan assets previously invested with another investment provider are to be invested (a procedure known as "mapping"), the Trustee shall have no responsibility for the selection or investment of such assets in such investment options.
4.2 Authorized Instructions. The Employer shall have the exclusive right, in accordance with the provisions of the Plan, to direct the investment by the Trustee of all amounts allocated to this Trust Fund among the investment options available under the Plan. All Authorized Instructions provided to the Trustee by the Employer shall be timely furnished. In making any investment of the Trust Fund, the Trustee shall be entitled to rely on such Authorized Instructions furnished to it by the Employer in accordance with the Employer's approved rules and proc edures, and shall be under no duty to make any inquiry or investigation with respect thereto. If the Trustee receives any contribution under the Plan that is not accompanied by Authorized Instructions directing its investment, the Trustee or its agents may hold uninvested or return all or a portion of such contribution without liability for loss of income or appreciation pending receipt of an Authorized Instruction.
SECTION 5 -REPORTING AND RECORDKEEPING
5.1 Records and Reports. The Trustee shall keep accurate records of all amounts received by and disbursed from the Trust Fund and the investments and other transactions of the Trust Fund for at least six years following the date of such transaction. The Trustee shall provide a report of the assets of the Trust Fund to the Employer from time to time, but at least annually.
The Trustee may rely on the fair market value of the property of the Trust Fund as reported to it by authorized parties, and the Trustee shall be fully protected in relying on such values. -6-
5.3 employer, that is exempt from federal income tax under Code Section 115. The Trustee shall not recognize any assignment or alienation of benefits unless an Authorized Instruction is received.
8.2 Governing Law. This Agreement shall be construed in accordance with and governed by the laws of the State of California.
8.3 Necessary Parties. The Trustee reserves the right to seek a judicial or administrative determination as to its proper course of action under this Trust Agreement.
Nothing contained herein will be construed or interpreted to deny the Trustee or the Employer the right to have the Trustee's account judicially determined. To the extent permitted by law, only the Trustee and the Employer shall be necessary parties in any application to the courts for an interpretation of this Trust Agreement or for an accounting by the Trustee, and no participant under the plan or other person having an interest in the Trust Agreement, including the Trust Fund, shall be entitled to any notice or service or process. Any final judgment entered in such an action or proceeding shall, to the extent permitted by law, be conclusive upon all persons. The Employer shall indemnify the Trustee for any costs incurred by the Trustee in seeking such judgment.
8.4 Notices. Generally, all day to day correspondence regarding the administration of the Trust Fund shall be conducted between the Employer and Trustee Affiliate, or its designee, as agent of the Trustee.
Other notices and other communications hereunder shall be in writing and shall be sufficient if delivered by hand or if sent mail, postage prepaid, or other reputable overnight delivery service, addressed:
(a)If to the Trustee:
Melissa McAuliffe
Vice President, Voya Retirement Insurance and Annuity Company One Orange Way, C3N
Windsor, CT 06095-4774
with a copy to:
J.Denise Jackson
President
Voya Institutional Trust Company
One Orange Way, C4R
Windsor, Connecticut 06095-4475
(b)If to the Employer:
The City of Downey
11111 Brookshire Avenue
Downey, CA 90241
The parties may by like notice, designate any future or different address to which subsequent notices shall be sent. Any notice shall be deemed given when received.
8.5 No Third Party Beneficiaries. The provisions of this Trust Agreement are intended to benefit only the parties hereto, their respective successors and assigns, and participants and their beneficiaries under the Plan. There are no other third party beneficiaries.
8.6 Execution in Counterparts. This Trust Agreement may be executed in any number of counterparts, each of which shall be deemed an original and said counterparts shall constitute but one and the same instru ment and may be sufficiently evidenced by one counterpart. A signed copy of this Trust Agreement delivered by facsimile, e-mail or other means of electronic transmission shall be deemed to have the same legal effect as delivery of an original signed copy of this Trust Agreement.
IN WITNESS WHEREOF, the parties hereto have executed this Trust Agreement as of the effective date set forth above.
The City of Downey
By:--------
Name: ROGER BRADLEY
Title: CITY MANAGER
APPROVED AS TO FORM: The City of Downey By �?w.fJ
Name: JOHN FUNK
Title: CITY ATTORNEY
ATTEST:
BY:---------------------------
MARIA ALICIA DUARTE, CITY CLERK
Voya Institutional Trust Company By: 9, £Jhi,u �
Name: cf De 11 i ,r C , 1/i c,/(.5 M1.
Title: ? r l 5 1' c:f.e n .+-
EMPLOYER SERVICES AGREEMENT
BY AND BETWEEN
VOYA RETIREMENT INSURANCE AND ANNUITY
COMPANY
AND
THE CITY OF DOWN EV ("EMPLOYER")
Effective Date: September 1, 2024
ATTACHMENT B
This EMPLOYER SERVICES AGREE MENT (the "Agreement") is effective as of September 1, 2024 (the "Effective Date"), between Voya Retirement Insurance and Annuity Company ("Voya"), a corporation organized and existing under the laws of the State of Connecticut, directly and on behalf of its Affiliates, and The City of Downey ("Employer"). Voya and Employer are each referred to as a "Party" and collectively as the "Parties" under this Agreement.
WITNESS ETH:
WHEREAS, the Employer sponsors a Health Reimbursement Arrangement, as identified on Exhibit A, that is qualified under Sections 105 and 106 of the Internal Revenue Code of 1986; and WHEREAS, the Employer wishes to engage Voya as an administrative service provider to facilitate the administration of the HRA by providing administrative services; and WHEREAS, Voya agrees to provide the services set forth in this Agreement; and WHEREAS, the Parties desire to enter into an agreement to set forth their respective rights, duties and obligations with respect to the delivery of such services.
NOW, THEREFORE, in consideration or the mutual promises and covenants contained herein, it is hereby agreed as follows: 2
Section 1 -Definitions
When these terms are capitalized in the Agreement they have the meanings set forth below. The words may be singular or plural.
"Account" means the participant's HRA (as defined below) administered using the Application or Services. "Affiliate" means entities that currently exist or are later acquired that, directly or indirectly, (i) control, (ii) are controlled by, or (iii) are under common control with Voya or the Employer. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through the ownership or voting securities, by contract, or otherwise. "Application" means the web-based software application(s) and supporting services described in the Application Exhibit(s) attached hereto. For purposes of this Agreement, the singular "Application" refers to all web-based software applications to which the Employer and/or the Participant is granted access. "ERISA" means the Employee Retirement Income Security Act of 1974, as amended, and its associated regulations.
"HRA" means Health Reimbursement Account or Arrangement sponsored by the Employer. "IRC" means the Internal Revenue Code of 1986, as amended from time to time, and the regulations promulgated thereunder.
"IRS" means the Internal Revenue Service.
"Participant" means a person who has established and maintains an Account under the HRA. It is the Employer's sole responsibility to notify Voya when a Participant becomes eligible to make claims for reimbursements pursuant to Section 6.1.
"PHI" shall have the same meaning as the term "protected health information" in45C.F.R. § 160.103, as applied to the information created, received, maintained or transmitted by Voya or its subcontractors from or on behalf of the HRA.
"Service Fees" shall include the fees set forth in Exhibit C to the Agreement. "Services" means administrative services as set forth on the Exhibit(s) that assist with processing and administration of Accounts and/or benefit plans/programs and includes the business processes used to deliver the Services.
"Systems" means the systems Voya owns or makes available to Employer to facilitate the transfer of information in connection with this Agreement.
Section 2 � Services
Section 2.1 Services. Voya, its Affiliates and its designated subcontractors will pertorm Services for the HRA as described herein in Exhibit 8. All rights granted to, and all benefits received by, the Employer pursuant to this Agreement will extend to Employe r's Affiliates.
Section 2.2 Voya's Provision of Services. Voya has subcontracted with (1) Benefit Plan Administrative Services ("SPAS") to provide systems, plan administration, contribution processing, and recordkeeping for the Services; and (2) WEX Health to provide claims processing technology and related services ("WEX"). In addition to BPAS and WEX, Voya may enter into one or more subcontracting agreements in connection with the performance of the 3 Services under this Agreement (together with BPAS and WEX, each, a "Subcontractor," and collectively, the "Subcontractors"). Voya may also substitute another subcontractor for BPAS and/or WEX by providing advance written notice to Employer. Voya shall remain responsible for the performance of any Subcontractor. All references to Voya in this Agreement and Exhibits shall be deemed to include a Subcontractor unless otherwise specifically noted.
Section 3 -Employee Benefit Plans
Section 3.1 Responsibility for the Employer's HRA. Any references in this Agreement to Voya "administering" the HRA or the Accounts are descriptive only and do not confer upon Voya anything beyond certain agreed upon ministerial duties being provided by Voya . Employer accepts total responsibility for its HRA for purposes of this Agreement, including its benefit design and compliance with any laws that apply to Employer or the HRA.
Section 3.2 Employer Initiated HRA Changes. Employer must provide Voya with written notice of any changes to the Employer's HRA within sixty (60) calendar days prior to the effective date of the change to allow Voya to determine if such change will alter the Services Voya provides under this Agreement. Any material change in the Services must be mutually agreed to in writing by the Parties. For the avoidance of doubt, any changes to the HRA that do not alter the Services or Service Fees hereunder may be agreed to by the Parties via electronic communication, or such other form of written communication to which the Parties agree. Voya will notify Employer if (i) the change increases Voya's cost of providing Services under this Agreement or (ii) Voya is reasonably unable to implement or administer the change. If the Parties cannot agree to a new Service Fee within thirty (30) days of the notice of the change, or if Voya notifies the Employer that Voya is unable to reasonably implement or administer the change, Voya shall have no obligation to implement or administer the change.
Section 3.3 HRA Consistent with this Agreement. By entering into this Agreement, Employer certifies that Voya's Services will not conflict with the terms of any plan document, summary plan description, insurance policy, group funding agreement, or other applicable documents governing the HRA.
Section 3.4 Employee Communications. Before distributing any communications describing the HRA, Employer will provide Voya with copies of any such communications that refer to Voya or the Services prior to distributing these materials to Employer's employees or third parties. Voya will provide any corrections or comments to the Employer in writing within a commercially reasonable time period after receipt. Employer agrees to amend the materials or communications if the references to Voya are not accurate, or any provision is not consistent with this Agreement or the Services that Voya is providing. Voya will not be bound by any communication that has not been reviewed and approved by Voya.
Section 3.5 Affiliated Employers. Employer represents that Employer and any of Employer's Affiliates covered under the HRA make up a single "controlled group" as defined by Section 1563 of the IRC and the regulations thereunder. Employer agrees to provide Voya with a list of Employer's Affiliates covered under the Plan upon request.
Section 4 -Employer's Responsibilities
Section 4.1 Information Employer Provides to Voya. Employer will inform Voya which of Employer's employees, their dependents and/or other persons are Participants. This information must be accurate and provided to Voya in a timely manner and in the format and specifications prescribed by Voya. Employer agrees to provide Voya (or cause Employer's vendor to provide Voya) with all information that Voya reasonably requires to provide Employer's Participants with the 4 Services as described in accordance with Exhibit B. Employer will notify Voya of any change to this information as soon as reasonably possible. Voya will be entitled to rely on the most current information in Voya's possession regarding eligibility of Participants in paying benefits from the Accounts and providing other Services under this Agreement. Voya shall not be responsible or liable for acts or omissions made in reliance on erroneous data provided by the Employer or any other person, including any Participant, or for the failure of Employer to perform its obligations under this Agreement. Any retroactive eligibility changes which impact claims for benefits from the Account will be mutually agreed upon by the Parties. If Voya agrees to make retroactive eligibility changes, additional reasonable Service Fees may apply, as mutually agreed. The Employer shall also ensure payroll data processors provide timely, accurate and complete data files in the prescribed electronic data file format and method specified by Voya or a Subcontractor, as applicable, in accordance with the Operating Procedures set forth in Exhibit D.
Section 4.2 Employer as Plan Administrator. The Employer or its delegate will exercise all discretion, control and authority with respect to the disposition of the HRA plan assets and the available benefits under the HRA.
Section 4.3 Employer's Administrative Responsibilities. The Employer shall ensure that any plan documents and any other documentation, as applicable, relating to the HRA are appropriately completed, are in compliance with HRA requirements and all applicable law, and are appropriately and timely adopted. The Employer shall provide Voya with a current copy of such documents governing the administration of the HRA. The Employer shall be responsible for distributing summary plan descriptions, summaries of material modifications and all other plan documentation to Participants and other individuals on a timely basis. If the Employer chooses to use the Health Reimbursement Account specimen plan document provided by Voya, then it is the Employer's responsibility to ensure that the specimen plan document complies with applicable state law.
Employer acknowledges that Voya (and its affiliates and subcontractors) are not authorized to provide legal or tax advice and no service, communication or other act or omission by Voya should be construed as legal or tax advice.
Section 4.4 Notices to Participants. Employer will give Participants the information and documents they need to obtain benefits under the Plan within a reasonable period of time before benefits under the Plan begins. In the event this Agreement is terminated, Employer will notify all Participants that the Services Voya is providing under this Agreement are discontinued. Employer agrees that if it becomes unable to pay claims as they become due in accordance with this Agreement, it will promptly notify participants.
Section 4.5 Escheatment. Employer is solely responsible for complying with all applicable abandoned property or escheat laws, making any required payments, and filing any required reports.
Voya shall provide its standard reports to Employer in order to support Employer's escheatment process, if applicable.
Section 4.6 Tax Reporting. If applicable, Employer is solely responsible for any W-2 and any other tax reporting to the IRS regarding any Account. Voya and its Affiliates do not assume any respons ibility for compliance with federal or state laws, including federal tax laws and regulations, applicable to the Employer or the HRA.
Section 4.7 Employer Direction. In the course of providing the Services, Voya may receive written or oral instructions or directions from representatives of the Employer, including its legal counsel (hereinafter collectively referred to as "Employer Direc tions"), concerning the provision of Services. Employer Directions may include, but shall not be limited to, (i) approval of Voya's choice of methodology or ap pro ach to providing the Services; (ii) interpretation of any provision of the HRA; (iii) instructions concerning compliance with applicable laws and regulations; (iv} instructions concerning compliance with subpoenas or other legal process; and (v) notices concerning adjudication of Participants' claims for 5 benefits. Exhibits Band C and the elections made by the Employer in the HRA Questionnaire shall be deemed to be a standing Employer Direction.
Section 4.8 Reliance. Voya may rely upon and comply with any Employer Direction in performing its obligations under this Agreement. If and to the extent that Voya acts or fails to act as a result of reasonable reliance upon any Employer Direction or any information, data, document or instrument supplied by Employer or a Participant, Voya shall be relieved of any liability arising therefrom and such act or failure to act shall not constitute a default, breach or nonperformance of any warranty or obligation of Voya contained in this Agreement; provided, however, that Voya shall not be relieved of any liability arising out of or resulting from dishonest, fraudulent, or criminal acts of Voya's employees, acting alone or in collusion with others. If Voya requests instruction or direction from Employer and does not receive a Employer Direction in a timely manner, Voya shall be deemed not to have breached this Agreement with respect to any act or failure to act undertaken in good faith relating to the instructions reque sted.
Section 4.9 Conflict with Agreement. If any Employer Direction is inconsistent with or conflicts with any provision of this Agreement, Voya may, at its discretion, require that such Employer Direction be confirmed in writing (via email or otherwise) by an authorized representative of Employer.
Section 5-Investment Options
Section 5.1 Selection of Investment Options. Employer shall be solely responsible for the selection of all investment options available to Participants in the HRA. Voya shall have no responsibil ity or discretion under the terms of this Agreement for the prudence, selection or oversight of any investment options avail able to Participants in the HRA. Employer acknowledges and agrees that (i) all investment information or investment materials that may be provided to Employer are provided to enable Employer to independently assess available options and make investment decisions for the Plans and (ii) the provision of any such information or materials is not intended to constitute nor should it be construed as the provision of investment advice or investment recommendations by Voya with respect to any investment option that Employer may consider making available under the Plans. Participants shall have the ability to choose their investment allocations and to make participant-directed transfers between investment options, subject to any limitations of the investment platform.
Section 5.2 Investment Advice. Neither Voya nor any of its Affiliates is an investment advice fiduciary (as defined under ERISA, as applicable, or applicable state law) with respect to the Participants nor will Voya or its Affiliates provide any investment advice to the Participants or be responsible or liable for the investment decisions of the Participants. Voya is not giving, and shall not be deemed to have given, the Employer or a Participant legal, tax, or financial advice concerning any of the matters relating to this Agreement or the HRA.
Section 5.3. Modifications to Investment Options. In order to confirm an investment option selected by the Employer can be record kept, the addition or removal of any investment option to the Plan requires at least sixty (60) calendar days advance written notice of the proposed change in a format prescribed for the process. The change must be mutually agreed and will be made in accordance with a mutually agreed upon schedule for implementing the change. In the event the investment option is not currently traded by the investment platform, the investment option will be made available to implement within sixty (60) days after the execution of a new fund agreement between the Subcontractor and the mutual fund company. The Employer is responsible for reviewing all requirements and restrictions imposed by the mutual fund company and verifying that requirements and restrictions will be met. 6 Section 6 -Services and Error Correction
Section 6.1 Employer Eligibility Determinations. As set forth in Section 4.1, the Employer, in its sole discretion, shall determine which individuals are eligible to participate in the HRA and shall provide Voya with timely, accurate, and complete initial and ongoing enrollment and eligibility data in the electronic data file format prescribed by Voya. Such information shall include, but is not limited to, the number and names of individuals eligible for and covered under the HRA, eligibility for making claims for benefits, and any other information determined by Voya to be necessary to provide the Services. Voya shall process initial and ongoing enrollment and eligibility data submitted by the Employer in the format and specifications prescribed by Voya during the implementation process.
Voya shall also process enrollment data and benefit elections submitted by the Employer through proper methods established by Voya. The Employer shall provide timely notifications regarding a Participant's eligibility to make claims for benefits.
Section 6.2 Voya's Responsibilities. Voya shall provide certain Services in connection with the HRA. Accordingly, the Employer authorizes Voya to use Voya's standard procedures for the provision of Services that have been designed to ensure that the administration of the HRA. Voya shall not have discretionary authority or discretionary controls respecting any aspect of plan administration or the management of any trust fund and shall not have authority to exercise, nor exercise, any control respecting management and shall not render investment advice with respect to any money or other property of any trust fund.
Section 6.3 Business Associate Agreement. All handling and processing of PHI shall be subject to and comply with the Business Associate Ag reement attached herein as Exhibit E ("BAA"). In the event of a con flict between the terms and conditions of the BAA and the terms and conditions of this Agreement, the terms and conditions of the BAA shall govern. Voya sh all, with respect to any PHI: {1) comply with the BAA; (2) make no attempt to identify PHI that has been fully or partially de-identified (such as encoded data); and (3) not contact the individuals to whom the PHI pertains except to the extent it is permitted to do so under this Agreement or the BAA.
Section 6.4 Claims Processing. Voya shall process reimbursement claims and appeals in the manner required under the Plan document, or to the extent a claims procedure is not provided for in the Plan document, Voya's claims procedure. Voya is not responsible for processing any appeal of any claim beyond the first level appeal. The Employer is responsible for accepting the auto adjudication procedures to be used in connection with certain payments to be made using the stored value card technology. Voya will process payments of claims and other requests for payment according to requirements specified by IRS regulations. Neither Voya nor its Affiliates have any discretionary authority or control relating to the administration of any Employee Benefit Plan.
Section 6.5 Payments. Voya shall issue payments for HRA-eligible expenses on behalf of a Participant directly to the health provider or shall issue a reimbursement payment for HRA-eligible expenses through either check or direct deposit to the Participant, as directed by the Participant.
Voya will process debit card transactions and authorize payments made directly to approved payees (e.g., health care providers, drugstores or qualifying merchants) via a debit ca rd, if requested by the Employer.
Section 6.6 Services/Changes. The Services provided by Voya are generally described in Exhibit B.
Any changes to such Services require the written consent of both Parties.
Section 6.7 Error Correction.
6.7.1 Voya Error. Voya shall promptly notify Employer after becoming aware of an error resulting from the acts or omissions of Voya's computer system malfunctions, its staff errors or otherwise caused by Voya's negligent acts. Voya shall make a good faith effort to correct any such error as soon as reasonably 7 practicable after identification of the error and, where applicable, Employer's determination or approval of the correction to be applied to such error. Voya processes investment instructions on an "omnibus" or aggregated basis. If Voya's correction of a Voya processing error results in a loss to the HRA or its Participants, Voya will absorb the loss. If any gain results in connection with the correction of a Voya processing error, Voya will net any such gain against other losses absorbed by Voya and retain any resulting net gain as a component of its compensation for transaction processing services, including its agre ement to make Plan and Participant Accounts whole for losses resulting from Voya processing errors.
6.7.2 Employer Error. Employer shall promptly notify Voya after becoming aware of an error resulting from the acts or omissions of Employer, its agents or third parties, or otherwise caused by the negligent acts of Employer, its agents or third parties. Voya will attempt to correct such errors at Employer's expense, which shall be agreed upon by the parties in advance and also be subject to Voya's receipt of all data reasonably necessary to make such correction.
Section 6.8 Errors of Other Service Providers� Voya shall bear no obligation or responsibility for liability, claims, damages, costs and expenses caused by, arising from or related to any act or omission including, but not limited to, errors, mistakes, willful misconduct, bad faith, fraud, negligent acts or omissions of any trustee, custodian, broker/dealer, insurance company, mutual fund company, third party administrator, prior recordkeeper or any other entity that provides, or has provided, services to the Plan.
Section 7 -Service Fees
Section 7.1 Service Fees. Participant will pay for Voya's Services in accordance with the Serva! Fees listed in Exhibit C. In addition to the Service Fees specified in Exhibit C, upon prior written notice, Employer shall also pay Voya any additional fee that is authorized by a provision elsewhere in this Agreement if applicable.
Section 7 .2 Changes in Service Fees. Voya shall have the right to change the Service Fees with reasonable advanced written notice to Employer (i) any time there are changes made to this Agreement or the provisions of the HRA that affect the Service Fees, or (ii) when there are changes in laws or regulations that affect the Services Voya are providing, or will be required to provide, under this Agreement.
Any new Service Fee required by such change will be effective as of the date the changes occur. Voya will provide Employer with a new Exhibit C that wilt replace the existing Exhibit C or an amendment stating the new Service Fees. If Employer does not agree to any change in Service Fees, then Employer may terminate this Agreement upon written notice. Such termination must be sent by Employer within thirty (30)days after Employer receives written notice of the new Service Fees and the Employer's written notice must state when such termination shall become effective. Employer must still pay any Service Fees due for the periods during which the Agreement is in effect.
Section 8 -Funding Benefits
Section 8.1 Funding of Benefits. Employer is solely responsible for transmitting the Account contributions on a schedule and in the form to be agreed upon by the Parties as set forth on Exhibit D.
Employer shall cause the funds to be deposited into or credited to the Account of each Particip ant and provide accompanying data, which accurately indicates each Account (and Account source, as applicable) that will be funded or credited and the dollar amount to be funded or credited to each such Account (and Account source, as applicable). Any payroll deduction or other contributions to a funded Account shall be contributed directly to the Account of the Participant pursuant to the Employer's direction. Employer will provide clear instructions regarding crediting amounts to each Participant's Account. In the event that Employer's instructions are unclear or ambiguous, a reasonable interpretation of the instructions will be accepted. Neither Voya nor its Affiliates or Subcontractors shall have any 8 liability for any funds not received or for any errors in crediting Accounts based on the data provided by Employer
Section 9 -Term of the Agreement
Section 9.1 Term. This Agreement shall commence on September 1, 2024 and continue until terminated as set forth in Section 10 (the 'Term").
Section 10-Termination
Section 10.1 Termination Events.
10.1.1 Either Party may terminate this Agreement immediately upon notice to the other Party, if the other Party (i) materially breaches this Agreement, and fails to remedy such breach within sixty (60) days after receiving notice of the breach from the other Party; (ii) materially breaches this Agreement in a manner that, upon mutual agreement of the Parties, cannot be remedied; (iii) commences bankruptcy or dissolution proceedings, has a receiver appointed for a substantial part of its assets, or ceases to operate in the ordinary course of business.
10.1.2 Voya may terminate this Agreement immediately upon notice to Employer if Employer fails to provide the required funds for payment of benefits under the terms of this Agreement.
10.1.3 Either party may terminate this Agreement immediately upon notice to the other Party if any state or other jurisdiction prohibits a Party from administering the Accounts under the terms of this Agreement; or imposes a material penalty on Employer or Voya, and such penalty is based on the administrative Services specified in this Agreement. In such case, the Party may immediately discontinue the Agreement's application in such state or jurisdiction. Notice must be given to the other Party when reasonably practical. The Agreement will continue to apply in all other states or jurisdi ctions, or as otherwise specified in this Agreement.
Section 10.2 Termination for Convenience. A Party may terminate this Agreement, in whole or in part, for convenience, upon ninety (90) days' written notice to the other Party.
Section 10.3 Cooperation with Transfer. In the event of any termination of this Agreement, Voya shall cooperate with Employer in the transfer of Voya's obligations hereunder to a replacement service provider ("Transition Assistance"). Unless otherwise agreed, Employer shall compensate Voya and shall reimburse Voya for all out-of-pocket expenses incurred in providing Transition Assistance as mutually agreed to by the Parties.
Section 11 -Records and Information
Section 11.1 Records. Voya will keep records relating to the Services Voya provides under this Agreement for as long as Voya is required to do so by law.
Section 11.2 Access to Information. If Employer needs information in Voya's possession for lawful or legitimate purposes other than an audit, Voya will provide Employer access to such information, if it is legally permitted to do so and the information relates to Voya's Services under this Agreement, provided the Employer gives Voya reasonable advance notice and an explanation of the need for such information.
Employer represents that Employer has reasonable proce dures in place for handling PHI, as required by law. Employer will only use or disclose PHI as permitted under this Agreement or by applicable Jaws.
Voya will provide information only while this Agreement is in effect and for a period of six (6) months after the Agreement terminates, unless Employer demonstrates that the information is required by law. Voya 9 also will provide reasonable access to information to an entity providing Plan administrative services or consulting services to Employer to enable such entity to provide Plan administrative services or provide consulting services to the Employer, as the case may be, upon the request of the Employer. Before Voya provides PHI to such entity, the parties (i.e. entities that provide Plan administrative services or provide consulting services to Employer), must sign a mutually agreed-upon confidentiality agreement, on te rms reasonably acceptable to the Parties.
Section 11.3 Voya's Knowledge. Except as expressly set forth herein, this Agreement will not be construed to transfer or assign any of Voya's rights or proprietary interests in any materials, knowledge, processes, methodologies, formats, or other types of intellectual property that are possessed and owned by Voya prior to the time it begins to provide Services hereunder and independent of the performance of Services hereunder.
Section 11.4 Proprietary Business Information. Each Party will limit the use of the other's Proprietary Business Information to only the information required to administer the Accounts, to perform under this Agreement, or as otherwise permitted under this Agreement. Neither Party will disclose the other's Proprietary Business Information to any person or entity other than to the disclosing Party's employees, subcontractors, or representatives needing access to such information to administer the Accounts, to perform under this Agreement, or as otherwise permitted under this Agreement, except that Voya's financial Proprietary Business Information cannot be disclosed to any third party without Voya 's express written consent. This provision shall survive the termination of this Agreement.
Section 11.5 Publicity and Use of Voya/Employer Content. The Parties will not use the other Party's or their Affiliates' names, trademarks, trade names, service marks, logos, or other brand marks (collectively the "Marks") without the other's prior writt en approval, which may be withheld in that Party's sole discretion. The Parties will instruct all Personnel of this prohibition. Each Party acknowledges that the Marks and all rights therein bel ong exclusively to the original Party and their Affiliates, and that this Agreement does not confer upon the other Party any rights, goodwill, or other interest in the other Party's Marks. Each Party recognizes the validity of the Marks and will not at any time (i) contest, impair, or jeopardize in any way the other Party's and their Affiliates' right, title, and interest in and to the Marks; (ii) cause the validity or enforceability of the Marks or their ownership thereof to be called into question; or (iii)invalidate, impair, tarnish, disparage, degrade, dilute, or injure the Marks (or the goodwill associated therewith) or the reputation of the other Party or their Affiliates. Each Party will not, and will cause all their Personnel not to, make any "case study," testimonial, press release, or other public announcement regarding this Agreement or any activities performed hereunder. If a Party requires the use of the other Party's Marks in order to provide Services under this Agreement, the other Party grants a limited, revocable, non-transferable, non-exclusive license to use the Marks solely as required to provide Services as further described herein. The Marks may be used and displayed only in the form approved by the Party in writing, which may be amended from time to time. If applicable, the Party may provide written branding standards and requirements with respect to the use of its Marks, and the other Party will comply with all such branding standards and requirements. Upon the termination or expiration of this Agreement or the earlier request of a Party, the other Party will return all Marks to or destroy them, as directed.
Section 11.6 PHI. The Parties' obligations with respect to the use and disclosure of PHI are outlined in the Business Associate Addendum attached to this Agreement as Exhibit E.
Section 12 -System Access
Section 12.1 System Access. Voya grants Employer the nonexclusive, nontransferable right to access and use the functionalities containe d within the Systems, under the terms specifie d in this Agre ement. Employer agrees that all rights, title, and interest in the Systems and all rights in patents, copyrights, trademarks, and trade secrets encompassed in the Systems will remain Voya's. To obtain access to the Systems, Employer will obtain, and be responsible for 10 maintaining, at no expense to Voya, the hardware, software, and Internet browser requirements Voya provides to Employer, including any amendments thereto. Employer will be responsible for obtaining an Internet Service Provider or other access to the Internet. Employer will not (i) access Systems or use, copy, reproduce, modify, or excerpt any Systems documentation provided by Voya in order to access or utilize Systems, for purposes other than as expressly permitted under this Agreement or (ii) share, transfer or lease Employer's right to access and use Systems, to any other person or entity that is not a Party to this Agreement without Voya's consent. Employer may designate any third party to access Systems on Employer's behalf, provided the third party agrees to these terms and conditions of System s access and Employer assumes joint responsibility for such access.
Section 12.2 Security Procedures. Employer will use commercially reasonable physical and software-based measures to protect the pa sswords and user IDs provided by Voya for access to and use of any web site provided in connection with the services. Employer shall use commercially reasonable anti-virus software, intrusion detection and preve ntion system, secure file transfer and connectivity protocols designed to protect any email and confidential communications provided to Voya, and maintain appropriate logs and monitoring of system activity. Employer shall notify Voya within a reaso nable timeframe of any (a) unauthorized access or damage, including damage caused by computer viruses resulting from direct access connection, to the System, and (b) misuse and/or unauthorized disclosure of passwords and user IDs provided by Voya which impact the System.
Section 12.3 System Access Termination. Voya reserves the right to (i) terminate any Employer's System access in the event that such Employer user fails to accept the hardware, software and browser requirements provided by Voya, including any amendments thereto; and (ii) terminate any Employer administrative user's System access (but not Participants' system access) immediately on the date Voya reas onably determines that Employer or a third party designated by Employer to access the Systems on Employer's behalf has materially breached any provision of this Agreement.
With respect to subs ection (ii) above, Employer's Systems access will be reinstated immediately if Voya determines, in its reasonable discretion, that Employer has corrected the problem, provided reasonable assurances that the material breach is not likely to reoccur and is in alignment with ap plicable laws and regulations. If Voya terminates Employe r's System access, pursuant to subsection (ii) above, Voya will provide an alternative to accessing the data that Employer would have accessed through the System. Employer's System access will terminate upon termination of this Agreement. Upon any of the termination events described in this Agreement, Employer agrees to cease all use of Systems, and Voya will deactivate Employer's identification numbers, passwords, and access to the System as soon as administratively fea sible.
Section 13 -Indemnification
Voya shall indemnify and hold harmless Employer from and against third-party claims resulting solely from or arising out of Voya's negligence or willful misconduct relating to the Services provided hereunder. Voya's obligation to indemnify Employer will only apply if Employer notifies Voya promptly, in writing, as to any such claim for which indemnification is sought and gives Voya the right, upon being notified, to exclusively control and direct the investigation, preparation, defen se, trial and settlement of each such claim so long as Voya continues to diligently pursue such defense or settlement. Employer shall not, without Voya's prior written consent (not to be unreasonably withheld, conditioned or delayed), settle, compromise, or consent to the entry of any judgement in any pending or threated claim, action, or proceeding in respect of which indem nification is sought under this Agreement. Employer will reasonably cooperate with Voya in the defense and/or settlement of any such claim.
Except as expressly prohibited by applicable law, Employer shall indemnify and hold harmless Voya, its Affiliates, assigns, directors, officers, employees, agents, and its Subcontractors (the 11 "Voya Parties") from and against claims resulting from or arising out of breach of this Agreement by Employer or its employees including with respect to negligence or willful misconduct, employment-related decisions, or any claims or liabilities relating to work status, compensation, tax, insurance, or benefits by Employer's employees under this Agreement. This includes any third-party claims brought against Voya Parties as the claims administrator, or due to the Employer's failure to act in accordance with applicable provisions of the IRC and associated gu idance issued by the IRS with respect to the HRA, including, but not limited to, any reporting requirement; and/or claims against Voya Parties relating to the HRA utilized by Employer's employees. Employer's obligation to indemnify Voya Parties will only apply if the Voya Party notifies Employer promptly, in writing, as to any such claim and gives Employer the right to control and direct the investigation, preparation, defense, trial and settlement of each such claim. Voya Parties will reasonably cooperate with Employer in the defense and/or settlement of any such claim. The indemnification obligations of a Voya Party and Employer shall terminate upon the expiration of the Agreement except as to any matter concerning which a claim has been asserted by notice to the other Party by at the time of such expiration or within the applicable statute of limitation after the effective date of Agreement termination.
Section 14 -Confidential Information
Section 14.1 Voya Data Security Addendum. The Parties acknowledge that Voya has a Data Security Addendum in place as attached hereto in Exhibit F, which shall govern the treatment of Conf idential Information (as such ter m is defined in Exhibit F). Voya reserves the right to modify the Data Security Addendum in whole or in part at any time and without prior notice to the Employer. Voya shall provide an updated Data Security Addendum to the Employer upon request. For purposes of the Data Security Addendum, the "Client" is the Employer.
Section 15 -Limitations on Liability
SECTION 15.1 INDIRECT DAMAGES. SUBJECT TO THE EXCLUSIONS SET FORTH BELOW, AND TO
THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY,
ITS AFFILIATES OR PERSONNEL BE LIABLE FOR ANY INCIDENTAL, CONSEQUENTIAL, SPECIAL,
EXEMPLARY, PUNITIVE OR OTHER INDIRECT DAMAGES ARISING OUT OF OR RELATED TO THIS
AGREEMENT, REGARDLESS OF THE CAUSE OF ACTION, WH ETHER IN CONTRACT, TORT OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUC H DAMAGES.
SECTION 15.2 CUMULATIVE LIABILITY. SUBJECT TO THE EXCLUSIONS SET FORTH BELOW, AND
TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE TOTAL CUMULATIVE
LIABILITY OF EACH PARTY, ITS AFFILIATES AND PERSONNEL ARISING OUT OF OR RELATED TO
THIS AGREEMENT, REGARDLESS OF THE CAUSE OF ACTION, WHETHER IN CONTRACT, TORT OR
OTHERWISE AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, SHALL BE LIMITED
TO THE TOTAL FEES PAID BY EMPLOYER TO VOYA FOR THE SERVICES SET FORTH HEREIN DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO ANY LIABILITY. THE EXISTENCE OF ONE OR MORE CLAIMS OR SUITS SHALL NOT ENLARGE THIS LIMIT.
SECTION 15.3 EXCLUSIONS. THE LIMITATIONS ON LIABILITY SET FORTH ABOVE SHALL NOT APPLY TO, OR LIMIT THE LIABILITY OF A PARTY, ITS AFFILIATES OR PERSONNEL FOR: (A) A MATERIAL BREACH OF ITS CONFIDENTIALITY AND SECURITY OBLIGATIONS; (B) ITS INDEMNIFICATION AND DEFENSE OBLIGATIONS UNDER THIS AGREEMENT; OR (C) GROSS NEGLIGENCE, FRAUD, OR WILLFUL OR INTENTIONAL MISCONDUCT.
12 Section 16- General Provisions
Section 16.1 Independent Contractor Relationship. Voya is an independent contractor of Employer, and this Agreement will not be construed as creating a relationship of employment, agency, partnership, joint venture, or any other form of legal association. Neither Party has any power to bind the other Party or to assume or to create any obligation or responsibility on behalf of the other Party or in the other Party's name.
Section 16.2 Assignment. No Party may, without the prior written consent of the other Party, assign any of its rights or delegate any of its duties under this Agreement. Any attempted assignment without the other Party's consent will be void and invalid. Notwithstanding the foregoing, Voya may assign its duties under this Agreement to a Subcontractor without prior written consent of the Employer. Employer may, upon written notice to Voya and at no additional charge to Employer, assign this Agreement to an Employer Affiliate; to any entity that acquires all or substantially all of Employer's assets or capital stock or results from one or more mergers or initial public offerings or any other corporate reorganization; or to the purchaser of any Employer Affiliate, including the purchaser of any division, department, or line of business of such Employer Affiliate.
Section 16.3 Severability. If a court of competent jurisdiction finds any provision of this Agreement invalid or unenforceable in any circumstances, such provision will be enforced to the maximum extent permissible, and the remainder of this Agreement, and the application of such provision in any other circumstances, will not be affected thereby.
Section 16.4 Governing Law. This Agreement will be governed by, construed, and enforced in accordance with the laws of the State of California, excluding its principles of conflicts of law. The Parties hereby irrevocably and unconditionally consent to the exclusive jurisdiction of the courts of the State of California and the courts of the United States of America located in the State of California for any actions, suits, or proceedings arising out of or relating to this Agreement and the transactions contemplated hereby (and each Party agrees not to commence any action, suit, or proceeding relating hereto except in such courts), and further agree that service of any process. summons, notice, or document by U.S. registered mail, return receipt requested to the address set forth above, will be effective service of process for any action, suit, or proceeding brought against a Party in any such court. The Parties agree that the Uniform Computer Inf ormation Transactions Act or any version thereof adopted by any state in any form ("UCITA") will not apply to this Agreement. To the extent that UCITA is applicable, the Parties agree to opt out of the applicability of UCITA pursuant to the opt-out provision(s) contained therein. THE
PARTIES HEREBY WAIVE TRIAL BY JURY IN ANY ACTION, SUIT, PROCEEDING, OR
COUNTERCLAIM BROUGHT BY EITHER OF THEM AGAINST THE OTHER PARTY HERETO IN ANY MATTERS ARISING OUT OF OR IN ANY WAY CONNECTED WITH THIS AGREEMENT.
Section 16.5 Dispute Resolution. All disputes between the Parties arising out of this Agreement will first be submitted for informal resolution between the designated officers of Employer and Voya. If the Parties are still unable to reconcile their differences, they may seek relief from a court of competent jurisdiction. The foregoing will not be construed to prohibit either Party from directly seeking injunctive relief without first complying with this Section.
Section 16.6 Construction of Agreement. This Agreement will not be presumptively construed for or against either Party. Section titles are for convenience only. As used in this Agreement, "will" means the same thing as "shall," and the words "include," "includes," and "including," will always be construed as if followed by the words "without limitation."
Section 16. 7 Changes and Modifications. The terms and conditions of this Agreement and any other documents referenced herein may not be amended, waived, or modified, except in a writing signed by authorized representatives of both Parties or as otherwise provided in this Agreement. 13
Section 16.8 Survival. Those provisions of this Agreement that, by their nature, are intended to survive the termination or expiration of this Agreement will remain in full force and effect following the termination or expiration of this Agreement. Such provisions include Term and Termination; Payment; Intellectual Property Rights and Reports; Confidential Information Indemnification; Exclusion of Damages and Remedies; Non-Solicitation; and Governing Law; Venue -Entire Agreement.
Section 16.9 Waiver/Consent. Failure by either Party to exercise or enforce any right under this Agreement, no matter how long the same may continue, will not be deemed a waiver of such right by such Party. No waiver of any pr ovision of, or consent to any breach of, this Agreement will be deemed a waiver of any other provision of, or consent to any subsequent breach of, this Agreement.
A Party's consent to or approval of an act or omission on any one occasion will n ot be deemed a consent to or approval of said act or omission on any subsequent occasion, or a consent to or approval of any other act or omission on the same or any subsequent occasion. To be effective, a Party's waiver of any right or remedy must be documented in a writing signed by the waiving Party.
Section 16.10 No Third Party Beneficiaries. Nothing in this Agreement will confer any right, remedy, or obligation upon anyone other than Employer, the Employer's Affiliates, Voya, and Voya's Affiliates.
Section 16.11 Notices. All notices relating to this Agreement must be in writing and must reference this Agreement. Such notices will be deemed sufficient if sent (i) by postage-prepaid registered or certified U.S. mail, then five business days after sending; or (ii) by commercial courier, then at the time of receipt confirmed by the recipient to the courier on delivery. All notices to a Party will be sent to its address set forth below, or to such other address as may be designated by that Party by notice to the other Party. lfto Voya:
Voya Retirement Insurance and
Annuity Company
Attn: Law Department
One Orange Way
Windsor, Connecticut 06095
If to Employer:
The City of Downey
11111 Brookshire Avenue
Downey, CA 90241
With copy to:
Voya Financial, Inc.
Employee Benefits
250 Marquette Avenue
Sute 900
Minneapolis, MN 55401
With copy to:
Shuster Advisory
Group, LLC
155N. Lake Ave, Suite
500
Pasadena, CA 91101
Section 16.12 Counterparts. This Agreement may be executed in one or more counterparts, each of which will be deemed an original, and atl of which together const itute a single agreement.
Section 16.13 Force Majeure. Except for payment obligations hereunder, a Party's failure to perform any of its obligations under this Agreement shall be excused if and to the extent such failure arises out of causes beyond the reasonable control of the nonperforming Party. Such causes may include, but are not restricted to, (i) acts of God or the public enemy, acts of the government in either its sovereign or contractual capacity, acts of terrorism or war, fires or other loss of facilities, floods, epidemics, quarantine restrictions, strikes, freight embargoes, failure of a common carrier, breach of contract by suppliers or others, computer downtime, telephone system outage, delays or failures of access involving the Internet, World Wide Web or similar services including network traffic and configuration problems therewith, or 14 unusually severe weather, labor disputes, and call demand in excess of telephone capacity or operator capacit y and similar occurrences; or (ii) the acts or omissions of the other Party, including in the case of Voya, its reliance upon the Employer's or information, data documents or instruments provided by Employer or any Participant, provided, however, that in every such case the failure to perform must be beyond the reasonable control of the non-performing Party.
Section 16.14 Entire Agreement. This Agreement, including all exhibits and documents referenced herein, constitutes the entire agreement between the Parties with respect to the subject matter hereof, and supersedes and replaces all other prior agreements, communications, and understandings (written and oral) regarding its subject matter. Terms and conditions on or attached to quotes, Employer Purchase Orders, or preprinted forms will be of no force or effect, even if acknowledged or accepted by Employer.
Print Name Gavin Gruenberg Print Title Vice President
The City of Downey
By _______________ _ Authorized Signature Print Nam e __ R _O_G_E _R _B _RAD _L_E _Y ____ _Print T itl e ___ c_I _T _Y _MAN _A _G _E _R ____ _ Approved as to Form
By U?&fJ Authori,§(l Signature
Print Name __ J_o_H_N_F_UN_K ______ _ Print Title ___ c_I_T_Y_A_T_T_o_RN_E_Y ____ _ Attest
By _______________ _ Authorized Signature MARIA ALICIA DUARTE Print Name ____________ _ CITY CLERK Print Title ____________ _ 15
EXHIBIT A -HEAL TH REIMBURSEMENT ACCOUNT PLAN NAME(S)
THE CITY OF DOWNEY RHS PLAN
16 EXHIBIT B -SERVICES
This Exhibit B is attached to and made a part of the Employer Services Agreement between Voya and Employer. If not otherwise defined, capitalized terms in this Exhibit A have the same meaning as in the Employer Services Agreement.
Overview of the Plan Services
Under the Plan, Voya provides administrative, customer and recordkeeping services to Employer and the Participants in connection with the Accounts. These services include:
General:
•Implementation of web-based Application and supporting services, including periodic updating with changes in status, connecting Participants to Accounts through the Application. •Prepare Plan document and Trust document, if applicable, for Employer approval. Employer is responsible for ensuring that any documents provided by Voya comply with applicable law. •Completing enrollment set up and ongoing Account maintenance of Participants on the Application.
•Provide standard communication and education material to participants and Employers. •Provide Employer Portal with access to summary and detailed plan level reporting. Custom reports available upon request, and may be subject to an additional fee. •Provide HRA Participant Portal for access to Account information and transactional capabilities for plan investments and claims reimbursements.
•Provide a toll-free call center to support HRA plan-related questions from both participants and employers
•Provide participants instructions for online Account registration to the HRA Participant portal. •Electronic delivery (referred to as "Go Green") and posting of participant quarterly statements, confirmations, and other notices in the HRA Participant Portal. Participants may opt out of electronic delivery in the HRA Participant Portal and elect to receive documents via U.S. mail subject to an additional monthly fee.
•Provide instructions and requirements to Employer regarding payroll and census process, contribution submission, funding transmittal instructions, and any other applicable Employer responsibilities. Information is included in Attachment D (Operating Procedures). •Posting of Plan contributions received from Employer in accordance with the requirements in Attachment D (Operating Procedures) to each Participant's Account. •Update participant-level demographic, Account information, and employment status changes for active Participants using data provided by the Employer. •Update participant�Ievel demographic and account information for Participants who have been identified as terminated by the Employer, using data provided by the Participant. 17 •Provide Participants, upon eligibility for medical expense reimbursements, with access to a debit card as a payment method, if requested by Employer.
•Processing reimbursement claims and first-level appeals in the manner required under the Plan document, or to the extent a claims procedure is not provided for in the Plan document, Voya's claims procedure, as applicable.
•Receiving and adjudicating for payment, claims and other requests for payment in accordance with IRS guidance regarding substantiation, the terms of the Accounts, and any written claim procedures or other practices established by the Employer and communicated to Voya. •Perform discrimination testing, if elected by the Employer, to assist Employer in complying with federal qualifications for HRAs. Employer shall provide all information necessary to complete such testing. Should the HRA plan fail any applicable nondiscrimination tests, the Employer must provide direction on corrective actions for the plan.
•Prepare signature ready IRS Form 990 Series and disclosure forms, as required 18 EXHIBIT C -FEES
This schedule applies for the term of the contract and may be updated at the time of renewal.
Fees are based on standard communications and file formats. Any special mailings, file modifications. plan rebuilds (changes to the plan once implementation has been completed) or custom reporting may be assessed an additional fee. Fees also reflect that the current administrator will facilitate outstanding claims reimbursement requests.
Direct Compensation
Annual Asset Based Fee: This fee is deducted in monthly installments from each Participant's Account.
Annual Asset Based Fee: 0.35%
This fees applies on: □All investment options, including Voya Fixed Account OR
l2?J Mutual fund investment options only
Annual Per Participant Fee: This fee is deducted in monthly installments from each Participant's Account.
Annual Per Participant Fee Actively Employed (Non-claims active) Participants : $30.00 Annual Per Participant Fee for Terminated/Separated from Service (Claims Active) Participants:
$30.00
Ancillary Participant Fees:
Replacement Debit Cards: $0.00 (no charge for replacement cards) •Two initial debit cards are provided at no tee
Participant Election of Mailed Statements: $0.50 per month deducted from each Participant's Account
•Electronic delivery of statements, confirmations, and notices are provided at no fee Debit Card Customization-Employer Fees:
•Co-br anded Debit Card: $500 one-time charge•Private label card: $3,000 one-time charge and $0.50 per card at time of fulfillment (requires minimum order of 10,000 cards)
19 Indirect Compensation
Fund Revenue and Float: Voya, an Affiliate or Subcontractor has entered into contracts with certain investment funds and fund service providers (the "Funds") pursuant to which such Funds compensate Voya, an Affiliate or Subcontractor, as applicable, for administrative and sub-transfer agency functions performed by Voya, an Affiliate or Subcontractor. Any fund revenue payable by the Funds shall be paid to Voya, an Affiliate or Subcontractor, as applicable. In addition, one or more bank accounts may be established, either directly or through a custodian or other Subcontractor, to hold (i) contributions pending investment direction and/or (ii) amounts pending distribution from the HRA. Any earnings credited to a Voya, an Affiliate or Subcontractor based on amounts held in the Accounts ("float") shall constitute a part of overall compensation for the Services.
20 EXHIBIT D -OPERA TING PROCEDURES
Subcontractor (and to the extent applicable, Voya) shall coordinate with the Employer and the Employer's payroll vendor, as necessary, to initiate electronic reporting of contributions, using the standard file layout provided and in accordance with operating procedures. Once Subcontractor begins to receive electronic reporting of contributions, contribution processing may begin. The following steps must be completed to initiate each contribution to the Plan:
Submission of Contribution Data: 1.Employer submits contribution data through Subcontractor's secure file transfer method for the payroll application.
2.Subcontractor processes contribution data received.
3.Contribution data must be received in Good Order in order for contributions to be processed.
Verification of Contribution Data:
1.Subcontractor will send a notification to Employer via email to the Payroll Contact the Employer has identified for the Plan stating that the payroll data is ready for approval. Upon receipt of notification, Employer must log into the payroll tool to review contribution totals and electronically sign-off/approve verifying the integrity of the contribution data provided for the contributions.
2.ln addition, by signing-off and approving the contribution data, the Employer signifies to Subcontractor that contribution funds have been made available for Subcontractor to complete the transaction.
3.Employer's electronic sign-off/approval of contribution data must be received by Subcontractor for contributions to be processed.
Transmittal of Funds:
1.Employer may wire funds to the Omnibus Trading Account at Community Bank, N.A. or make use of the ACH Debit Policy for deposit to the Omnibus Trading Account. Any funds remitted must include the 6-digit BPAS assigned Plan Identification Number ("BPANbr") and indicate the pay period for which the funds are remitted.
Automated Debit Policy. If the Employer authorizes to initiate debit entries in connection with contributions and other payments made to the Plan, as directed by the Employer, through an Automated Clearing House ("ACH") electronic funds transfer from the account set up for this purpose, such account shall be designated by the Employer on a "BPAS ACH Authorization" form. Employer may subsequently designate another bank account by directing in writing or such other medium as may be acceptable to Subcontractor. Employer will be responsible for submitting contributions and other payment data via electronic means acceptable to Subcontractor. Employer also directs that the Employer's completed ACH Authorization, or subsequent direction acceptable to Subcontractor which supersedes the original, shall serve as authorization to the bank indicated by the Employer to accept any such debit entries initiated to the designated bank account. Employer agrees that it shall be solely responsible for ensuring that Subcontractor is in receipt of the information necessary to initiate and effectuate the transfer of funds pursuant to this instruction and that the bank account designated by the Employer now or in the future, contains sufficient funds to satisfy the ACH request. Further, Employer agrees and acknowledges that
1.If it should fail to make sufficient funds available in its bank account for ACH purposes, Subcontractor reserves the right to reverse these new contribution trades in Participants' accounts, 2) these purchases will not be considered "plan assets" until the funds have actually been delivered to Subcontractor, and 3) if the Employer fails to deliver settlement proceeds, Employer will assume full responsibility for resolving this matter with plan participants, including any financial restitution.
2.Funds held in the Omnibus Trade Account are the property of the Employer. Once the money is transferred (invested) the funds become the property of the Plan.
3.Funds must be received in Good Order for contributions to be processed.
The Trade Date for the processing of contributions will not exceed two (2) business days from Supplie r's receipt of valid census information, approved verification data and funding in Good Order. 21
Processing Of Contributions:
Trade Date
Contributions will be processed after receipt by Subcontractor in Good Order on a Business Day. Good Order requirement includes Employer's Verification of Contribution Data, as outlined above, and the amount of the contribution must be equal to the amount of the verified contribution data. If Employer's Verification of Contribution Data is completed before 3:30PM ET and correct funding is received before 4:00 PM ET, Subcontractor shall use its best efforts to trade contributions received in Good Order effective that Business Day.
Transactions will be priced at Trade Date's NAV, provided that Subcontractor receives the Participating Fund's prices (NAVs) for Trade Date prior to 6:30 p.m. ET. (At times the funds may encounter heavy trading or system malfunctions and may not provide NAV in a timely manner). Subcontractor will transmit transactions over the System to the Participating Funds (or their transfer agent) on Trade Date. However, the Trade Date for contributions may be up to two (2) Business days after receipt by Subcontractor.
Subcontractor will use its best efforts to affect transactions based in fund trading restrictions and custodial timing after receipt of transaction instructions. Instructions received on a day that is not a business day shall be deemed to have been received as of the first business day thereafter. A "Business day" is a day on which the Subcontractor, the New York Stock Exchange, and all other entities contracted by Voya to provide trade execution and settlement are open for business.
Subcontractor will not be responsible or have any liability for any loss or diminution in value that may occur if transactions are not executed due to (i) circumstances not within Subcontractor's or Voya's control or (ii) a Holiday or close of business of Subcontractor, the New York Stock Exchange, or any other entities contracted by Voya to provide trade execution and settlement.
Wire Date
Subcontractor will cause funds representing result of transactions traded to be wired to the fund(s) the morning following Trade Date. Subcontractor or its designee is solely responsible for the coordination with each Fund of the wire transfer or deposit of funds for the purchase and redemption of fund shares and will ensure that payment occurs on a timely basis in order to obtain Trade Date's NAV. The Funds' inability to accept or receive deposit of funds goes beyond Subcontractor's responsibility.
Changes to Operating Procedures:
This Exhibit D, Operating Procedures, may be subject to change. Any changes shall be communicated to the Employer at least thirty (30) calendar days in advance of the change. 22 EXHIBIT E -BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (the "BAA"), effective on the last signature date below, is incorporated into and made part of the (Employer Services Agreement] (the "Agreement") by and between The City of Downey ("Covered Entity") and Voya Retirement Insurance and Annuity Company ("Voya"). Covered Entity and Voya may be referred to individually as a "Party" or collectively as the "Parties."
WHEREAS, Covered Entity and Voya have entered the Agreement dated September 1, 2024 in connection with which Voya is required to provide assurances that Voya will appropriately safeguard all health information protected under the Privacy Rule and Security Rule (as defined below) that is disclosed by, or created or received by, Voya on behalf of such Covered Entity; NOW, THEREFORE, and in consideration for the mutual benefit provided to each Party under the Agreement, the Parties agree as follows:
1.BACKGROUND AND PURPOSE. The Parties have entered into, and may in the future enter into, one or more written agreements, that require Voya to create, receive, maintain and/or transmit "protected health information" (the "Underlying Contract(s)"), as the term is defined under 45 C.F.R. § 160.103 but is limited to the protected health information that Voya creates, receives, maintains, or transmits from or on behalf of the Covered Entity as the Covered Entity's "Business Associate" as defined at 45 C.F.R. § 160.103 ("PHI"). Such PHI is subjectto protection under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), Title XIII, Subtitle D, of the American Recovery and Reinvestment Act of 2009 (P.L. 111-5), known as the Health Information Technology for Economic and Clinical Health Act, as amended (the "HITECH Act"), and the implementing regulations for HIPAA and the HITECH Act, including, without limitation, the Standards for Privacy of Individually Identifiable Health Information, set forth at 45 C.F.R. Part 160 and Part 164 (Subparts A and E) (the "Privacy Rule"), the Security Standards for the Protection of Electronic Protected Health Information, set forth at 45 C.F.R. Part 160 and Part 164 (Subparts A and C) (the "Security Rule"), the Standards for Electronic Transactions, set forth at 45 C.F. R.
Parts 160 and 162 (the "Electronic Transactions Rule"), and the Breach Notification for Unsecured Protected Health Information, set forth at 45 C.F.R. Parts 160 and 164 (Subpart D) (the "Breach Notification Rule"), as such implementing regulations may have been or may in the future be amended from time to time (the Privacy Rule, the Security Rule, the Electronic Transactions Rule and the Breach Notification Rule, as amended from time to time, are referred to collectively as the "Rules") (HIPAA, the HITECH Act, and the Rules, collectively, the "HIPAA Laws").
This BAA shall supplement and/or amend the Agreement only with respect to Voya's Use, Disclosure, and creation of PHI under the Underlying Contract(s) to allow Covered Entity to comply with the HIPAA Laws. Except as so supplemented and/or amended, the terms of the Agreement shall continu e unchanged and shall apply with full force and effect to govern the matters addressed in this BAA and in the Agreement.
DEFINITIONS. Unless otherwise defined in this BAA, all capitalized terms used in this BAA have the meanings given in the HIPAA Laws.
2.VOYA'S OBLIGATIONS WITH RESPECT TO PHI.
2.1 Permitted Uses and Disclosures of PHI. Except as otherwise specified in this BAA, Voya may make any and all Uses and Disclosures of PHI necessary to perform its obligations under the Underlying Contract(s), or as Required by Law. Unless otherwise limited herein, Voya may, as a Business Associate of Covered Entity:
(a)Provide Data Aggregation services relating to the Health Care Operations of the Covered Entity;
(b)Use or Disclose PHI as Required by Law;
23 (c)De-identify any and all PHI obtained by Voya under this BAA in accordance with the de-identification requirements of the Privacy Rule guidance issued by the Secretary from time to time, and use and disclose such de-identified data for any ofVoya's purposes in a manner solely determined by Voya, for an indefinite period including beyond the termination of this BAA or the Underlying Contract. This BAA shall not apply to such de-identified data, the de-identified data will cease to be considered the confidential information or property of the Covered Entity including pursuant to any Underlying Contract.
(d)Use or Disclose PHI for the proper management and administration, such as audits and for other compliance requests from federal or state agencies, of Voya or to carry out the legal responsibilities ofVoya, pursuant to 45 C.F.R. §164.504(e)(4). provided that (i) such Use or Disclosure is Required by Law, (ii) Voya obtains reasonable assurances from the person or entity which does not qualify as a subcontractor that is a Business Associate under the Rules and to which Voya discloses PHI for such purposes permitted under this Section 3.1 (d) that such PHI will be held confidentially, Used or further Disclosed only as required by law or the purpose for which it was disclosed to such person or entity, and that such third party shall notify Voya of any instances of which the third party is aware in which the confidentiality of the PHI received pursuant to this provision has been or third party reasonably believes has been breached.
Under no circumstances may Voya Use or further Disclose PHI in a manner that would violate the HIPAA Laws if done by the Covered Entity.
2.2 Voya's Obligations. With regard to its Use and/or Disclosure of PHI, Voya agrees to:
(a)Use or Disclose only the minimum necessary PHI to perform or fulfill a specific function required or permitted hereunder, in accordance with the HIPAA Laws as stated in 45 CFR 164.502(b) and 45 CFR 164.514.
(b)Not Use or Disclose PHI other than as permitted or required by this BAA or as Required By Law.
(c)Use appropriate safeguards and with respect to PHI transmitted by or maintained in Electronic Media, comply with subpart C of 45 C.F.R. Part 164 regarding provisions of the Security Rule applicable to such information, to prevent the Use or Disclosure of PHI other than as provided for by this BAA.
(d)Ensure that any subcontractor that is a Business Associate, as included in the definition of Business Associate at 45 C.F.R. 160.103, (each a "Subcontractor") enters into an agreement or similar arrangement which complies with the HIPAA Laws requirements for agreements between "Business Associates" and "Covered Entities", as each term is used under the HIPAA Laws, and subject to restrictions and limitations at least as restrictive as those imposed upon Voya in this BAA.
(e)Within thirty (30) days of receiving a written request from Covered Entity, make available to the Covered Entity such PHI necessary for Covered Entity to comply with its obligations under 45 C.F.R. § 164.524 in responding to an Individual's request for access to his or her PHI where Voya maintains PHI in a Designated Record Set. In the event any individual requests access to PHI directly from Voya, Voya shall within ten (10) business days forward such request to Covered Entity. Any denials of access to the PHI requested shall be the exclusive responsibility of the Covered Entity.
(f)Within thirty (30) days of receiving a written request from Covered Entity, make available to the Covered Entity such PHI necessary for Covered Entity to comply with its obligations under 45 C.F. R. § 164.526 in responding to an Individual's requestfor amendment and Voya shall incorporate any amendments to the PHI as directed or instructed by Covered Entity in accordance with 45 C.F.R. § 164.526 where Voya maintains PHI in the Designated Record Set. 24 In the event any Individual requests an amendment to PHI directly from Voya, Voya shall within ten (10) business days forward such request to Covered Entity. (g)Within forty-five (45) days of receiving a written request from Covered Entity, make available to the Covered Entity the information required for the Covered Entity to provide an accounting of disclosures of PHI as required by the Privacy Rule. ln the event the request for an accounting is delivered directly to Voya, Voya shall within thirty (30) business days forward such request to the Covered Entity. Voya shall retain its records regarding Uses and Disclosures of PHI that are required to be maintained in a Designated Record Set for no less than six (6) years following the termination of this BAA.
(h)To the extent that Voya carries out Covered Entity's obligation(s) under Subpart E of 45 C.F.R. Part 164, Voya shall comply with the HIPAA Laws that apply to the Covered Entity in performance of such obligation(s), as required under 45 C. F.R. § 164.504(e)(2)(ii)(H). (i)Promptly notify the Covered Entity of Voya's receipt of any request for production or subpoena of PHI, in connection with any governmental investigation or governmental or civil proceeding. If the Covered Entity decides to challenge the validity of or assume responsibility for responding to such request or subpoena, Voya shall reasonably cooperate with the Covered Entity in connection therewith.
U)Make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAALaws.
(k)Use reasonable commercial efforts to mitigate any harmful effect that is known to Voya of a Use or Disclosure of PHI by Voya in violation of the requirements of this BAA. (1)Voya agrees to use appropriate safeguards to prevent any unauthorized or unlawful Use, access or Disclosure of the PHI, including but not limited to any Use, access or Disclosure not provided for by this BAA. Voya shall implement administrative, physical and technical safeguards required by the HIPAA Laws and comply with the policies, procedures and documentation requirements of the Security Rule.
(m)Report promptly and without unreasonable delay to Covered Entity any Use or Disclosure of PHI not provided for or permitted by this BAA and any Breach or Successful Security Incident, but in no event no more than sixty (60) days after it is discovered. Such notification shall include the inf ormation required under 45 C.F.R. § 164.410. "Successful Security Incident" shall mean any Security Incident that results in the unauthorized use, access, disclosure, modification or destruction of electronic PHI.
3.OBLIGATIONS OF COVERED ENTITY.
3.1 Covered Entity agrees to timely notify Voya, in writing, of any arrangements of the Covered Entity including any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR §164.520 that may impact in any manner the Use and/or Disclosure of that PHI by Voya under this BAA.
3.2 Covered Entity further agrees not to request Voya to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity, except to the extent that Voya will use or disclose Protected Health Information for the management and administration and legal responsibilities of the Voya.
3.3 Covered Entity shall notify Voya of any changes in, or revocation of, the permission by an Individual to Use or Disclose his or her Protected Health Information, to the extent that such changes may affect Voya's Use or Disclosure of Protected Health Information.
3.4 Covered Entity shall notify Voya of any restriction on the Use or Disclosure of 25 Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Voya's Use or Disclosure of Protected Health Information.
3.5 Covered Entity shall disclose to Voya only the minimum amount of Protected Health Information necessary to allow Voya to fulfill its obligations to Covered Entity under the Underlying Contract.
4.TERM. This BAA shall commence as of the Effective Date and expire, unless earlier terminated pursuant to Section 5 hereof, at such time as the Underlying Contract(s) is terminated or expires and Voya returns or destroys PHI in accordance with the terms of this BAA.
5.TERMINATION. Should a Party become aware of a material breach of this BAA, including without limitation a pattern of activity or practice that constitutes a breach of a material term of this BAA, the non breaching Party shall provide the breaching Party with written notice of such breach in sufficient detail to enable the breaching Party to understand the specific nature of the breach. The non-breaching Party shall be entitled to immediately terminate this BAA and the Underlying Contract associated with such breach if, after the non-breaching Party provides such notice of breach to the breaching Party, the breaching Party fails to cure the breach within a reasonable time period not to exceed thirty (30) days from the breaching Party's receipt of such notice; provided, however, the non-breaching Party shall have the discretion to agree to such longer cure period based on the nature of the breach involved and subject to the HIPAA Laws.
6.RETURN OR DESTRUCTION OF PHI. Upon the expiration or termination of this BAA and/or the Underlying Contract(s), Voya, with respect to PHI received from Covered Entity, or created, maintained or received by Voya on behalf of Covered Entity, including any and all PHI in the possession of Voya's Subcontractors and such third parties permitted to receive such PHI under and in accordance with the terms of this BAA and the HIPAA Laws, shall:
(a)Retain only that PHI which is necessary for Voya to continue its proper management and administration or to carry out its legal responsibilities; (b)Return to Covered Entity or destroy, as agreed to by Covered Entity, the remaining PHI that Voya still maintains in any form;
(c)Continue to use appropriate safeguards and comply with the Security Rule with respect to PHI transmitted by or maintained in Electronic Media to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Voya retains the PHI; (d)Not Use or Disclose the PHI retained by Voya other than for the purposes for which such PHI was retained and subject to the same conditions set forth in Section 2 hereof which applied prior to termination;
(e)Return to Covered Entity or destroy, as agreed to by Covered Entity, the PHI retained by Voya when it is no longer needed by Voya for its proper management and administration or to carry out its legal responsibilities; and
(f)Where the return or destruction of PHI is infeasible, Voya shall notify Covered Entity in a writing of sufficient specificity of the circumstances which make such return or destruction infeasible, and upon acceptance and agreement by Covered Entity, Voya shall continue to extend the protections of this BAA to such PHI and limit further use or disclosure of PHI to those purposes which make the return or destruction infeasible, for as long as Voya retains the PHI.
7.MISCELLANEOUS.
7.1 Survival. The respective rights and obligations of Voya and Covered Entity under this BAA which by their nature shall survive this BAA shall survive the expiration or termination of this BAA 26 indefinitely, including without limitation Section 6.
7.2 Interpretation. The terms of this BAA shall prevail in the case of any conflict with the terms of any Underlying Contract to the extent necessary to allow Covered Entity to comply with the HIPAA Laws.
Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Entity and Voya to comply with the HIPAA Laws. The citations to the HIPAA Laws in several paragraphs of this BAA are for reference only and shall not be relevant in interpreting any provision of this BAA. 7 .3 No Third Party Beneficiaries. Nothing in this BAA shall confer upon any person other than the Parties and their respective successors or assigns. any rights, remedies, obligations, or liabilities whatsoever.
7.4 Amendment. This BAA constitutes the entire agreement between the Parties with respect to PHI, and may not be modified, nor will any provision be waived or amended, except in a writing duly signed by authorized representatives of the Parties.
7.5 Waiver. A waiver with respect to one event will not be construed as continuing, or as a bar or waiver of any right or remedy as to subsequent events.
7.6 Changes in the HlPAA Laws. To the extent that any relevant provision of the HIPAA Laws is materially amended in a manner that changes the obligations of Voya or Covered Entities, the Parties agree to negotiate in good faith appropriate amendment(s) to this BAA to give effect to those revised obligations.
7.7 Governing Law. The Parties hereby agree that this BAA shall be governed by, and in construed in accordance with, the laws of Connecticut, without giving effect to its conflicts of laws principles, and the Parties hereby submit themselves to the jurisdiction and venue of the federal and state courts of Connecticut.
7.8 Regulatory References. A reference in this BAA to a section of the Code of Federal Regulations, the Privacy Rule, the Security Rule, or to another section of HIPAA means the section, as amended from time to time.
7.9 Notices. All notices and communications required by this BAA shall be in writing. Such notices and commu nications shall be given in one of the following forms: (i) by delivery in person; (ii) by a nationally-recognized, next-day courier service; (iii) by first-class, registered or certified mail, postage prepaid; or (iv) by electronic mail to the address that each party specifies in writing.
7.1 O Confidentiality. The terms of this BAA shall remain confidential except as described hereunder and in the Underlying Contract, except that Voya may disclose the terms of this BAA to entities that Voya reasonably believes are other Business Associates of Covered Entity.
7.11 Severability. The invalidity or unenforceability of any provisions of this BAA shall not affect the validity or enforceability of any other provision of this BAA or the Underlying Contract, which shall remain in full force and effect
7.12 Construction and Interpretation. The section headings contained in this BAA are for reference purposes only and shall not in any way affect the meaning or interpretation of this BAA. This BAA has been negotiated by the parties at arm's-length and each of them has had an opportunity to modify the language of the BAA. Accordingly, the BAA shall be treated as having been drafted equally by the parties, and the language shall be construed as a whole and according to its fair meaning. Any presumption or principle that the language is to be construed against any party shall not apply. This BAA may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement.
7.13 Entire Agreement. This BAA constitutes the entire and full agreement between the Parties with respect to the subject matter hereof and supersedes and replaces any previous version of this agreement.
27 IN WITNESS WHEREOF, each of the undersigned has caused this BM to be duly executed in its name and on its behalf.
The City of Downey (Covered Entity)
By: __ ____,,....,...,,=--==�-==-----Print Name: ROGER BRADLEY Print Title: CITY MANAGER D�a 6/25/2024
APPROVED AS TO FORM:
BY: Orf__,�
JOi�:;� CITY ATTORNEY
ATTEST:
BY: MARIA ALICIA DUARTE, CITY CLERK
28 Voya Retirement Insurance and Annuity
Company
By: �e�Print �e:Gavin�
Print Title: Vice President
Date: June 12, 2024
EXHIBIT F-DATA SECURITY ADDENDUM
1.Def initions.
"Affected Persons" means Client's and its Affiliate's former and current employees whose Personal Information ("Pl") may have been disclosed or compromised as a result of an Information Security Incident.
"Affiliates" means any entities that, now or in the future, control, are controlled by, or are under common control with Client. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through ownership, voting securities, contract, or otherwise.
"Confidential Information" means (a) non-public inform ation concerning the Disclosing Party, its affiliates, and their respective businesses, products, processes, and services, including technical, marketing, agent, customer, financial, personnel, and planning information; (b) Pl; (c) trade secrets; and (d) any other information that is marked confidential or which, under the circumstances surrounding disclosure, the Non-Disclosing Party should know is treated as confidential by the Disclosing Party. Except with respect to Pl, which will be treated as Confidential Information under all circumstances, Confidential Information witl not include (A) information lawfully obtained or developed by the Non-Disclosing Party independently of the Disclosing Party's Confidential Information and without breach of any obligation of confidentiality; or (B) information that enters the public domain without breach of any obligation of confidentiality. All Confidential Information will remain the property of the Disclosing Party. "Information Security Incident" means any breach of security or cyber security incident impacting Voya that has a reasonable likelihood of (a) resulting in the loss or unauthorized access, use or disclosure of Client Pl; (b} materially affecting the normal operation of Voya; or (c) preventing Voya from complying with all of the privacy and security requirements set forth in this Agreement. "Law" means all U.S. and non-U.S. laws, ordinances, rules, regulations, declarations, decrees, directives, legislative enactments and governmental authority orders and subpoenas. "Personal Information (Pl}" means any information or data that (a) identifies an individual, including by name, signature, address, telephone number or other unique identifier; (b) can be used to identify or authenticate an individual, including passwords, PINs, biometric data, unique identification numbers (e.g., Social Security numbers), answers to security questions or other personal identifiers; (c) is "non-public personal information" as defined in the Gramm-Leach-Bliley Act 15 U.S.C. § 6809(4) or "protected health information" as defined in 45 C.F.R. § 160.103; (d) is an account number or credit card number or debit card number, in combination with any required security code, access code, or password, that would permit access to an individual's financial account; or (e) is "Personal Information" as defined in The California Consumer Privacy Act of 2018 (Cal. Civ. Code Division 3, Part 4, Title 1.81.5). "Services" means the services that Voya provides to Client pursuant to this Agreement. "Voya Personnel" means Voya's employees and subcontractors engaged in the performance of Services.
2.Data Security.
2.1. Security Standards and Controls.
29 (a) (b) (i) (ii) (i) (ii) (iii) (iv) (v) (vi) (vii) Voya will establish and maintain:
administrative, technical, and physical safeguards against the destruction, loss, or alteration of confidential Information; and
Appropriate security measures to protect Confidential Information, which measures meet or exceed the requirements of all applicable Laws relating to personal information security.
In addition, Voya will implement and maintain the following information security controls:
Privileged access rights will be restricted and controlled; An inventory of assets relevant to the lifecycle of information will be maintained; Network security controls will include, at a minimum, firewall and intrusion prevention services;
Detection, prevention and recovery controls to protect against malware will be implemented;
Information about technical vulnerabilities of Voya's information systems will be obtained and evaluated in a timely fashion and appropriate measures taken to address the risk;
Detailed event logs recording user activities, exceptions, faults, access attempts, operating system logs, and information security events will be produced, retained and regularly reviewed as needed; and Development, testing and operational environments will be separated to reduce the risks of unauthorized access or changes to the operational environment.
2.2. Information Security Policies. Voya wilt implement and maintain written policies, standards or procedures that address the following areas:
(a)Information security;
(b)Data governance and classification;
( c)Access controls and identity management;
(d) Asset management;(e)Business continuity and disaster recovery planning and resources; ( f)Capacity and performance planning;
(g)Systems operations and availabilityconcems;
(h)Systems and network security;
(i)Systems and application development, quality assurance and change management;(j) Physical security and environmental controls; (k)Customer data privacy;
(I)Patch management;
(m)Maintenance, monitoring and analysis of security auditlogs; (n)Vendor and third party service provider management;and (o)Incident response, including clearly defined roles and decision making authority and a logging and monitoring framework to allow the isolation of an incident.
2.3. Subcontractors. Voya will implement and maintain policies and procedures to ensure the security of Confidential Information and related systems that are accessible to, or held by, third party service providers. Voya will not allow any third parties to access Voya's systems or store or process sensitive data, unless such third parties have entered into written contracts with Voya that require, at a minimum, the following:
(a)The use of encryption to protect sensitive Pl in transit, and the use of encryption or other mitigating controls to protect sensitive Pl at rest; (b)Prompt notice to be provided in the event of a cyber security incident; ( c)The ability of Voya or its agents to perform information security assessments; and Cd) Representations and warranties concerning adequate information security. 30 2.4. Encryption Standards, Multifactor Authentication and Protection of Confidential Information. (a)Voya will implement and maintain cryptographic controls for the protection of Confidential Information, including the following:
(i)Use of an encryption standard equal to or better than the industry standards included in applicable National Institute for Standards and Technology Special Publications (or such higher encryption standard required by applicable Law) to protect Confidential Information at rest and in transit over un-trusted networks; (ii)Use of cryptographic techniques to provide evidence of the occurrence or nonoccurrence of an event or action;
(iii)Use of cryptographic techniques to authenticate users and other system entities requesting access to or transacting with system users, entities and resources; and
(iv)Development and implementation of policies on the use, protection and lifetime of cryptographic keys through their entirelifecycle.
(b)In addition to the controls described in clause ( a) above, Voya will:
(i)Implement multi-factor authentication for all remote access to Voya's networks; (ii)Ensure that no Client Pl is (A) placed on unencrypted removable media, mobile devices, computing equipment or laptops or (B) stored outside the United States;and
(iii)Ensure that media containing Confidential Information is protected against unauthorized access, misuse or corruption during transport.
2.5. Information Security Roles and Responsibilities. Voya will employ personnel adequate to manage Voya's information security risks and perform the core cyber security functions of identify, protect, detect, respond and recover. Voya will designate a qualified employee to serve as its Chief Information Security Officer ("CISO") responsible for overseeing and implementing its information security program and enforcing its information security policies. Voya will define roles and responsibilities with respect to information security, including by identifying responsibilities for the protection of individual assets, for carrying out specific information security processes, and for information security risk management activities, including acceptance of residual risks. These responsibilities should be supplemented, where appropriate, with more detailed guidance for specific sites and information processing facilities.
2.6. Segregation of Duties. Voya must segregate duties and areas of responsibility in order to reduce opportunities for unauthorized modification or misuse of Voya's assets and ensure that no single person can access, modify or use assets without authorization or detection. Controls should be designed to separate the initiation of an event from its authorization. lf segregation is not reasonably possible, other controls such as monitoring of activities, audit trails and management supervision should be utilized. Development, testing, and operational environments should be separated to reduce the risks of unauthorized access or changes to the operational environment.
2.7. Information Security Awareness, Education and Training. Voya will provide regular information security education and training to all Voya Personnel, as relevant for their job function. In addition, Voya will provide mandatory training to information security personnel and require key information security personnel to stay abreast of changing cyber security threats and countermeasures.
31 2.8.
2.9 Vulnerability Assessments. Voya will conduct monthly vulnerability assessments that meet the following criteria: (a)All production servers and network devices must be scanned at least monthly;All vulnerabilities must be rated;(b)(c) (d) (e) All vulnerability remediation must be prioritized based on risk; All tools used for scanning must have signatures updated at least monthly with the latest vulnerability data; and, Voya will implement and maintain a formal process for tracking and resolving issues in a timely fashion.
Penetration Testing. If any Services to be provided by Voya include the hosting or support of one or more externally facing applications that can be used to access systems that store or process Client data, the terms of this Section will apply. (a)At least once every 12 months during the Term and prior to any major changesbeing moved into production, Voya will conduct a Valid Penetration Test {asdefined below} on each internet facing application described above. As usedherein, a "Valid Penetration Test" means a series of tests performed by a teamof certified professionals, which tests mimic real-world attack scenarios on theinformation system under test and include, without limitation, the following:
(i)Information-gathering steps and scanning forvulnerabilities; (ii)Manual testing of the system for logical flaws, configuration flaws, orprogramming flaws that impact the system's ability to ensure theconfidentiality, integrity, or availability of Client's information assets; (iii)System-compromise steps;
(iv)Escalation-of-privilege steps; and
(v)Assignment of a rating for each issue based on the level of potential riskexposure to Client's brand or information assets.(b)Upon Client's request, Voya will provide to Client an executive summary of anymaterial issues or vulnerabilities identified by the most recent Valid PenetrationTest along with the scope of systems tested. The report may be redacted toensure confidentiality.
2.10 Physical and Environmental Security. Voya will ensure that all sites are physically secure, including the following:
and
(a)Sound perimeters with no gaps where a break-in could easily occur; (b )Exterior roof, walls and flooring of solid construction and all external doors suitableprotected against unauthorized access with control mechanismssuch as locks, bars, alarms, etc.; (c)All doors and windows to operational areas locked when unattended;(d)Equipment protected from power failures and other disruptions caused by failures insupporting utilities;(e)Closed-circuit television cameras at site entry/ exit points; badge readings atall site entry points, or other means to prevent unauthorized access; (ij Visitor sign-in/ mandatory escort at site; and
(g)With respect to remote work environments, if the foregoing controls are not present,then Voya will use commercially reasonable efforts to mitigate any increased riskassociated with such remote work environments, by, for example, limiting the typesof access and functional roles eligible for a remote work environment, restrictingaccess to a virtual private network (vpn} or virtual desktop infrastructure (vdi),providing formal guidance and standards for workspace security, and enhancing 32 data protection controls such as data masking, logging and monitoring.
2.11 Information Security Incident Notification.
(a)In the event of any Information Security Incident, Voya will, at its sole expense promptly (and in any event within 72 hours after Voya confirms an Information Security Incident) report such Information Security Incident to Client by sending an email to Client Contact Information, summarizing in reasonable detail the effect on Client, if known, and designating a single point of contact at Voya who will be:
(i)Available to Client for information and assistance related to the Information Security Incident; investigate such Information Security Incident, perform a root cause analysis, develop a corrective action plan and take all necessary corrective actions; (ii)Mitigate, as expeditiously as possible, any harmful effect of such Information Security Incident and cooperate with Client in any reasonable and lawful efforts to prevent, mitigate, rectify and remediate the effects of the Information Security Incident; (iii)Provide a written report to Client containing all information necessary for Client to determine compliance with all applicable laws, including the extent to which notification to affected persons or to government or regulatory authorities is required; and (iv)Cooperate with Client in providing any filings, communications, notices, press releases or reports related to such Information Security Incident.
(b)In addition to the other indemnification obligations of Voya set forth in this Agreement, Voya will indemnify, defend and hold harmless Client from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorneys' fees, arising out of or relating to any Information Security Incident, which may include, without limitation:
(i)Expenses incurred to provide notice to Affected Persons and to law-enforcement agencies, regulatory bodies or other third parties as required to comply with law; (ii)Expenses related to any reasonably anticipated and commercially recognized consumer data breach mitigation efforts, including, but not limited to, costs associated with the offering of credit monitoring or a similar identify theft protection or mitigation product for a period of at least twelve (12) months or such longer time as is required by applicable laws or any other similar protective measures designed to mitigate any damages to the Affected Persons; and
(iv)Fines or penalties that Client pays to any governmental or regulatory authority under legal or regulatory order as a result of the Information Security Incident.
2.12. Risk Assessments. Upon Client's request no more than once per year, Voya will complete an industry standard information security questionnaire and provide relevant Service Organization Control ("SOC") audit reports, when available. Voya's standard security requirements are set forth in Exhibit A. Voya represents and warrants that, as of the Effective Date, the statements in Exhibit A are true and correct in all material respects.
3.Privacy and PII
3.1. With respect to any Pl, Voya will:
(a)Comply with the Voya Privacy Notice at www.voya.com/privacy-notice; (b)Retain, use, process and disclose all Pl accessed, obtained or produced by Voya only to perform its obligations under this Agreement and as specifically permitted by this Agreement, or as otherwise instructed by Client, and not for any otherpurpose; (c)Refrain from selling such Pl or using such Pl for any other purpose, including for its own commercial benefit;
(ct) Treat all Pl as Confidential Information;
33 (e)Comply with the provisions of this Agreement to return, store or destroy the Pl; and(f)Comply with all applicable Laws with respect to processing of Pl.
Voya hereby certifies to Client that it understands the restrictions and obligations set forth above and will ensure that Voya and all Voya Personnel comply with the same.
3.2 As needed to comply with applicable Laws concerning the processing of Pl or personal information security, or to the extent required by any changes in such Laws or the enactment of new Laws, the Parties agree to work cooperatively and in good faith to amend this Agreement in a mutually agreeable and timely manner, or to enter into further mutually agreeable agreements in an effort to comply with any such Laws applicable to the Parties. If the Parties cannot so agree, or if Voya cannot comply with the new or additional requirements, Client may terminate this Agreement upon written notice to Voya.
4.Confidential Information.
4.1. 4.2.
4.3. Confidential Information. Either Party ("Disclosing Party") may disclose Confidential Information to the other Party ("Non-Disclosing Party") in connection with thisAgreement.
Use and Disclosure of Confidential Information. The Non-Disclosing Party agrees that it will disclose the Disclosing Party's Confidential Information only to its employees, agents, consultants, and contractors who have a need to know and are bound by obligations of confidentiality no less restrictive than those contained in this Agreement. In addition, Voya agrees that it will use the Disclosing Party's Confidential Information only for the purposes of performing its obligations under this Agreement. The Non-Disclosing Party will use all reasonable care in handling and securing the Disclosing Party's Confidential Information and will employ all security measures used for its own proprietary information of similar nature. These confidentiality obligations will not restrict any disclosur e of Confidential Information required by Law or by order of a court, regulatory authority or governmental agency; provided, that the Non-Disclosing Party will limit any such disclosure to the information actually required to be disclosed. Notwithstanding anything to the contrary, Client may fully comply with requests for information from regulators of Client and the Client Affiliates.
Treatment of Confidential Information Following Termination. Promptly following the termination or expiration of this Agreement, or earlier if requested by the Disclosing Party, the Non-Disclosing Party will return to the Disclosing Party any and all physical and electronic materials in the NonDisclosing Party's possession or control containing the Disclosing Party's Confidential Information. The materials must be delivered via a secure method and upon such media as may be reasonably required by the Disclosing Party.
Alternatively, with the Disclosing Party's prior written consent, the Non-Disclosing Party may permanently destroy or delete the Disclosing Party's Confidential Information and, if requested, will promptly certify the destruction or deletion in writing to the Disclosing Party. Notwithstanding the foregoing, if the Non-Disclosing Party, due to requirements of applicable Law, must retain any of the Disclosing Party's Confidential Information, or is unable to permanently destroy or delete the Disclosing Party's Confidential Information as permitted above within 60 days after termination of this Agreement, the Non-Disclosing Party will so notify the Disclosing Party in writing, and the Parties will confirm any extended period needed for permanent destruction or deletion of the Disclosing Party's Confidential Information. All Confidential Information in the Non-Disclosing Party's possession or control will continue to be subject to the confidentiality provisions of this Agreement. The methods used to destroy and delete the Confidential Information must ensure that no Confidential Information remains readable and cannot be 34 4.4
4.5. 5.
reconstructed so to be readable. Destruction and deletion must also comply with the following specific requirements:
Hard copy
Electronic tangible media, such as disks and ta es
ard drive or similar storage device
Shredding, pulverizing, burning, or other ermanent destruction method Destruction or erasure of the media Storage frame metadata removal to hide the
organizational structure that combines disks
into usable volumes and physical
destruction of the media with a Certificate of
Destruction COD
Period of Confidentiality. The restrictions on use, disclosure, and reproduction of Confidential Information set forth in this Section will, with respect to Pl and Confidential Information that constitutes a "trade secret" (as that term is defined under applicable Law), be perpetual, and will, with respect to other Confidential Information, remain in full force and effect during the term of this Agreement and for three years following the termination or expiration of this Agreement.
Injunctive Relief. The Parties agree that the breach, or threatened breach, of any of the confidentiality provisions of this Agreement may cause irreparable harm without adequate remedy at law. Upon any such breach or threatened breach, the Disclosing Party will be entitled to injunctive relief to prevent the Non-Disclosing Party from commencing or continuing any action constituting such breach, without having to post a bond or other security and without having to prove the inadequacy of other available remedies. Nothing in this Section will limit any other remedy available to eitherParty.
Cyber Liability Insurance. During the Term, Voya will, at its own cost and expense, obtain and maintain in full force and effect, with financially sound and reputable insurers, cyber liability insurance to cover Voya's obligations under this Addendum. Upon execution of the Agreement, Voya will provide Client with a certificate of insurance evidencing the following coverage and amount with such insurer:
Risk Covered: Network Security (a.k.a. Cyber/lT)
Limits: $50,000,000
6.Disaster Recovery and Business Continuity Plan. Voya maintains, and will continue to maintain throughout the Term, (a) a written disaster recovery plan ("Disaster Recovery Plan"), which Disaster Recovery Plan is designed to maintain Client's access to services and prevent the unintended Joss or destruction of Client data; and (b) a written business continuity plan ("BCP") that permits Voya to recover from a disaster and continue providing services to customers, including Client, within the recovery time objectives set forth in the BCP. Upon Client's reasonable request, Voya will provide Client with evidence of disaster recovery test date and result outcome.
35 ,,. FC-2
i::c.2. 1
::c.2.2
r:c -2.2A
i:: C-2.28
C-2.2C
Exhibit A
Security Requirements
Voya implements and maintains an inventory list and assigns ownership for all computing assets including, but not limited to, hardware and software used in the accesillg ,storage processing, or transmission of Client Pl.
Voya reviews and updates the inventory list of assets for correctness and completeness at least once every 12 months and updates the inventory list as changes are made to the compting assets.
Data Privacy ·and Confldentiahty -��-==t���. :-����:;i�. :'. y
•. � : :-:4��1�� Voya'lil maintain an lrormation and Risk M anageme'1 policy that i S"eviewed and app rted by management at least annually.
Voya protects the privacy and confidentiality of all Client Pl received, disclosed, created, or otherwise in Voya's possession by complying with the following requirements:
Such information is encrypted at rest on mobile devices (including motle storage devices) portable computers, and in transit over un-trusled networks with an encryption standard equal lo or better than Advanced Encryption Standard (AES) 256 bit encryption or such h:lh eiencryption standarcteQ uirecby aoolicable law.
All hardcopy document53nd remvable media arEf)hysically protected from unathorized disclosure by locking them in a lockable cabinet or safe when not in use and ensuring that appropriate shipping methods (tamper-proof packaging sent by special courier with signatures) are employed whenever the need tq>hys icay transport such documents and removable media arises.
All med· 1a 1�abeled and securely lored i reccord anCeNith Voya pticies. • .... 1
� C-2.20 All Eectronic media is secure! )Sanitized od elroyed whe n ndon ger reqired in accojance with FC-3:
�c -3.1
C -3.2
C -3.3
industry standards.
Configuration Management
Voya implements and mamtams accurate and completa:onfiguration details (e.g.)nfrastructure Bi.11ld Standards) for all computing assets used in accessing, storing, processing, or transmitting Client Pl.
Voya reviews configuration details of the computing assets at least once every 12 months to validate that no unauthorized changes have been made to the assets.
Voya updates the configuration details of all computing assets used to access, process, store, or transmit Client Pl as configuration changes take place.
FC-4: Operating Procedures and Respons,bihlles
C-4.1
C-4.2
Voya implements and maintain s opE0tional proceures for informati orprocessin g'acilitie !and designres specific roles or personnel responsible for managing andnaintaini ng the quality and security of such facilities, including, but not limited to, formal handover of activity, status updates, operational problems, escalation procedures and reports on current responsibilities.
Voya IT policies and standards document the policies and procedures for job scheduling processes and tools.
Voya pdates the 013rational procedu res as banges take pla c€13nd perform s a compreensi ve reiew and update of the procedures at least onCEBvery 2fears .
FC-5: Security Awareness and Training
36 !
Voya performs pre-employment background checks, including criminal history for 7 years, credit score and history (if applicable), credentials verification (if applicable), and educational background.
Voya implements and maintains a documented security awareness program for all Voya Personnel which covers access to Client Pl.
Voya's security awareness program includes security requirements, acceptable use of computing assets, legal responsibilities, and business controls, as well as training in the correct use of informaUon rocessin facilities and h sical securi controls.
Voya ensures that all Voya Personnel complete security awareness training prior to being provided access to Client Pl and at least annually thereafter. Voya provides mandatory annual training programs that include security awareness training to all Personnel.
UA-j;, Llser Acc�ss Controls _
UA-1.1
UA-1.2
UA-1.2A
UA-1.2B
UA-1.2C
UA-1.20
UA-1.2E
UA-1.2F
Voya implements and maintains identity management system(s) and authentication process(es) for all systems that access, process, store, or transmit Client PL Voya ensures that the following user access controls are in place:
The "Least Privilege• concept is implemented ensuring no user has more privileges than they require in performing their assigned duties.
Users requiring elevated privileges as a normal part of their job responsibilities have a regular, non-privileged account to perform regular business functions.
All users have an individual account which cannot be shared Account Names/IDs are constructed not to reveal the privilege level of the account or position of the account holder.
System-or application-level service accounts are owned by a member of management or an IT system administration delegate and only have the
privileges necessary to function as required by the application, system, or database for which the account has been created.
Automated processes disable access upon 24 hours of termination and initiate manager review on employee position changes, in accordance with Voya policies.
UA-2i .. : �.,.._ Access Control Management
----..i. ... -� ---UA-2.1
UA-2.2
UA-2.3
UA-2.3A
�A-2.38
lJA-2.3C
UA-2.3D
Voya maintains a comprehensive physical security program. Access to Voya facilities is restricted and logs are maintained for all access. Physical security and environmental controls are present in Voya buildinQS.
Voya ensures that access to systems that access, process, store, or transmit Client Pl is limited to only those personnel who have been specifically authorized to have access in accordance with the users' assigned job responsibilities.
Voya ensures that accounts for systems that access, process, store, or transmit Client Pl are controlled in the following manner:
Users must provide a unique ID and Password for access to systems. Access to applications/systems is limited to a need-to-know basis, and is enforced through role based access controls.
Accounts are protected on computing assets by screen-savers that are configured with an inactivity time-out of not more than 15 minutes.
Accounts are locked after no more than 5 consecutive failed logon attempts, depending upon the system and platform.
Accounts remain locked until unlocked by an Administrator or through an approved and secure end-user self-service process.
37 UA-2.3E
UA2.4
Acco uts arEreviewed on q:>eriodic and regul aibasis to ensurahat the account is still required, access is appropriate, and the account is assigned to the aooropriate user .
Voya ensures that wireless mobile devices are secured against threats coming from these wireless networks and wireless connections are required to be encrypted.
UA-3· User Access Management
A-3.1 Voya ensures that passwords for all accounts on systems that access, process, store, or transmit Client Pl are configured and managed in accordance with industry standards:
UA-4. lnformauon Access Restricllon
Voya implements information access restrictions on all systems used to access, process, store, or transmit Client Information.
Voy a ensure she following Information Access Restricti ons aren place Access to underlying operating,ystem sand application feature ghat th e usedoes not reqire access to in the performance of their assigned responsibilities are sltitly controlled.
Accesso source::ode and libraries are restricted to only thos endividuals wh dl avE'bee n specifically approved to have access. A person who develops code changes cannot be the same person who migrates the code change into production.
Access betwe erOevel oprnet, Test, and Production environments aretrictly controlled . The version management system provides segregation of code, data and environments.
Temporary privileg ed access to production data is granted to authorized personnel based on job function for emergency support and only via access control and o in securi tools Voya implements and manages ctormal processor ensring that all computer system ghat access, process, store, or transmit Client Pl are protected and configured as follows prior to and while remaining in a production status:
Systems aressi ged to arasset own erwithi rWoya's o;ianization .
Systems are locatedn a data cell er or snilarty couolled envi ronmet with appropriate physical security mechanisms and environmental controls to ensure systems are protected from theft, vandalism, unplanned outages, or other intentional or unintentional hazards.
Al I sJte ms anronfig ure to meeVoya standard s,nonitored to ensurea compliant state, and patched as required to maintain a high degree of security. Issues found to be out of compliance are requu'ed to be tracked to closure.
Systems are configu red with commercially available and licensed anti-virus software which is set to perform active scans, perform scans of uploaded or downloaded data/files/web content, and is pda led on at least on a di!y basis.
System clocks are configured to synbron· 1ze.vith a reptable time sourOO:e.g., NTP).
Systems display a waring bann edo � individuals duri ngh eogo n processhat indicates oly authorized users may access the system.
Systems that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods. 38 P$-1.1H
PS-1.1I
All high and medium vulnerability and risk issues identified are remediated utilizing a risk based approach and in alignment with application team code release schedules.
Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor systems.
PS-2: -: 'Network Security
PS-2.1
PS-2.1A
D$-2.18
PS-2.1C
PS-2.1D
PS-2.1E
DS-2.1F
PS-2.1G
PS-2.1H
PS-2.1I
To ensure systems accessing, processing, storing, or transmitting Client Pl are protected from network related threats, Voya implements the following network security controls prior to connecting any network component to a production network and for the duration that the component remains in a production status.
Networks are constructed using a defense-in-depth architecture, are terminated at a firewall where there are connections to external networks, and are routinely scanned for unapproved nodes and networks.
Business-to-Business {82B) and Third Party network connections (Trusted) to systems accessing, processing, storing, or transmitting Client Pl are permitted only after a rigorous risk assessment and formal approval by Voya management.
Network connections from un-trusted sources to internal resources are not permitted at anytime.
Network components (switches, routers, load balancers, etc.) are located in a data center or a secure area or facilitv.
Voya systems are configured to provide only essential capabilities and restrict the use of any unneeded functions, ports, protocols and services.
Intrusion detection/prevention technologies, firewalls, and proxy technologies are implemented, monitored and managed to ensure only authorized and approved traffic is allowed within and between seoments of the network.
Internal Voya wireless networks are configured with the most robust security standards available, including but not limited to, 802.11i/n, strong authentication, IP/MAC address filtering, firewall protection, and intrusion detection/prevention.
Wireless networks are not used to access Client Information unless the information is encrypted at either the file or transoort level.
Network components that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.
Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor network components.
PS-3: G eneric Applicat ion and Database Secunty
PS-3.1
PS-3.1A
PS-3.18
PS-3.1C
Voya implements and maintains an application security certification and assurance process that ensures that all applications that access, process, store, or transmit Client Pl provide the followinq:
Application and database design ensures security, accuracy, completeness, timelin ess, and authentication/authorization of inputs, processing, and outputs.
All data inputs are validated for invalid characters, out of range values, invalid command sequences, exceeding data limits, etc. prior to being accepted for production. Voya implements static source code analysis tools to validate data inputs.
Application source code developed in house by Voya is protected through the use of a source code repository that ensures version and access control. The version management system provides segregation of code, data and environments. 39 DS-3.10
=>S-3.1E
PS-3.1F
PS-3.1G
PS-3.1H
PS-4:
S-4.1
S-4.1A
S-4.18
S-4. 1C
S-4.10
S-4.1E
S-4.1 F
S-41G
S-4.1 H
Applications and databases are tested for security robustness and corrective measures are applied prior to the application being placed into a production environment. All systems are configured toneet Voya standards, monitored to ensure compliance state, and patched as required to maintain a high degree of security.
Applications and databases are implemented into a production environment with minimal privileges and critical configuration files and storage subsystems are protected from unauthorized access.
Applications and databases that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.
Voya ensures that Consumer/Internet facing applications have been designed and implemented using multi-factor authentication architecture. Web sessions require the use of an HTTPS (encrypted) connection, as well as authorization to approved data and services.
Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor applications and databases.
Workstat10n and Mobile Devices Security (End UserDevices) Voya ensures that the following security controls have been implemented and are maintained to protect Client Pl accessed, processed, stored, or transmitted on workstations and mobile devices.
Workstations are located in a physically secure environment with mechanisms in place to prevent unauthorized personnel from accessing data stored on the device, reconfiguring the BIOS or system components, or from booting the device from unauthorized media. Portable devices are cong ured for bool:lp eorypti on.
Laptops/portable computers and other mobile devices are assigned to an owner who is responsible for physically securing the device at all times, and the owner of the device must receive adequate awareness training on mobile device physical securi
Portable devices are configured for boot-up encryption. All laptop hard drives are encrypted using AES 256. Any device deemed "remote" requires hard drive encyp tion.
All workstations, laptops/portable computers and other mobile devices (where applicable) are configured with commercially available and licensed anti-virus software which is set to perform active scans, to perform scans of uploaded or downloaded data/files/web corent, and is dated on at lease dail basis.
All workstations, laptops/portable computers and otheimobile devices (where �plicable) are configured with a commercially available and licensed operating system, patched according to manufacturer's recommendations, hardened
according to best industry practices and standards and configured so that regular users do not have adminii'ative nvil es.
Laptops/portablex>mputers and other mobile devices (where appli cale) ar a;onfigured with ersonal firewll technol
Workstations I ap:ips/portable computers and other mbile devices (whe r£B pplicable) display a warning banner to all individuals during the logon process that indicates that or)I authorized users mJ access the �stem or device.
Voya implements and maintain s processesor recoering laptops/portable computers:md mobile d evices from terminated Voya Personnel.
Voya imple mnts ad raintai mbackup and restore procedures to ensurahat all Cli em Pl received, disclosed, created, ootherwi se in the possession of Voya is appropriately protected agaI ·nst loss. 40 PS-5.2
PS-5.3
PS-6:
PS-6.1
PS-6.2
::>S-6.2A
DS-6.28
DS-6.2C
�S-6.2D
ITR-1: .. TR-1.1
Voya ensures that backups are securely stored and storage systems are physically and logically protected.
Voya implements a backup and availability schedule to meet business and regulatory requirements.
Remote Network Access Controls
Voya implements and maintains a remote network access control strategy or process.
Voya ensures the following remote network access controls are in place:
Users requiring remote access are appropriately authorized by Voya management.
Remote access connections are established through the use of Virtual Private Networking {VPN) or secure VOi mechanisms that provide transmission security, encryption and connection timeout (e.g. split-tunneling disabled.)
Only Voya approved and controlled {managed) computing devices are used when remotely accessing (where applicable} Voya's computing environments where Client Pl is held. Any device deemed "remote" requires data encryption. Encrypted communications are required for alt remote connections.
Users are thoroughly authenticated using multi-factor authentication prior to being provided remote access. -•1Ullh
Architecture
Voya ensures that the architecture of computing environments where Client Pl is accessed, processed, stored, or transmitted incorporates reasonable industry best practices for authentication/authorization, monitoring/management, network design, connectivit y design, firewall and intrusion prevention technologies and storage and backup ca abilities • ITR-2: Hardware and Software In fr astructure Resilience • • . • • .
TR-2.1
TR-2.2
Voya ensures all hardware and software components classified with an availability rating of ·critical' used in the accessing, processing, storage, or transmission of Client Pl is:
•Identified and cataloged
•Supported by the manufacturer of the component (or if developed in-house, follows Voya's SDLC Policy which includes quality/security)
•Applications and systems classified as A4 may be designed with high availability features and have no single point offailure
•Reviewed on a regular basis for capacity implications (at minimum once every 12months) Voya maintains Business Continuity Plans to address business unit and departmental actions to be undertaken before, during and after an incident or disaster. Voya's Disaster Recovery Plan addresses the recovery and availability of systems and data.
ITR-3: Capacity Assurance
TR-3.1 Voya ensures that computing environments used to access, process, store, or transmit Client Pl are assessed for capacity and performance on a periodic basis (at minimum once every 12 months) and appropriate corrective actions are taken to make the environment sufficientl robust enou h to rform its stated mission.
Voya implements and maintains a change control process to ensure that all changes lo the environment where Client Pl is accessed, processed, stored, or transmitted is strictly documented, assessed for impact, and approved by personnel authorized by Voya to provide approval for such changes, thoroughly tested, accepted by management, and tracked. 41 M-1.2 Voya implements an emergenc�ha nge cotrol proces&o manage bange s-equired i n an emergency situation where a computing system is down or there are imminent threats/risk& o critical systems involving Client Pl.
CM-2 ·Separation of Environ ments
M-2.1
CM-2.2
M-1.2
M-1.3
M t4
Voya maintain s physically and/or logically separate development, test, and production computing environments. Development, testing, and acceptance environments are separate from the production environment.
V oya ensure&ha Clien tlata used for development or testing purposes is completely depersonalized/desensitized of confidential values prior to entering a development or test environment. Data is depersonalized in non-production controlled environments for testing purposes with required approvals. Pl elements are required to be depersonalized in non-productionenvironments.
Voya implements and ma1nti=.uns a secu'nty event monitoring process and associated mechanisms to ensure events on computing systems, networks, and applications that can impact the security level of that asset or the data residing therein are detected in as close to real-time as possible for those assets used to access, process, store, or transmit Client Pl.
Voya implements and maintains an incident management process to ensure that all events with a potential security impact are identified, investigated, contained, remediated and'eported to Clieneffectively and in aimely manner.
Voyaias implemented monitorin g coa ol &hat provide real-ti me otification rof evets reted to loss of confidentialit , the uile ri , or the ava1labili of s stems.
Event logs (audit trails) are,tored for analysi s purposeior aninimum period of 3 years.
SM-2: Technical State Compliance
Voya ensures c01puti nganvi ronmets that access, process,sto re, or transrit Client PII are coonual ly in compliance with quality and security requirements including, but not limited to, authentication/authorization, monitoring/management, network design, connectivity design, firewall and intrusion prevention technologies, and storage and backup ca ab1libes.
Voya ensuresT Risk M anagemeMacilitates risk assessmentrof iform ation technology processes and procedures in accordance with the annual IT Risk Assessment Plan approved by the IT/Privacy Risk Committee. Risk Assessment
results are communicated to maagemen I for awareness and resolution or risk acceptance of findin s based on mana ement's risk a elite.
Voya impl emem and mintains 11lnerability and penetration testing (Ethical Hacking) processes to ensure the computing environment where Client PII is accessed, processed, stored, or transmitted is continually protected from internal and external security threats.
Voya impl ements and malntains a process for vulnerability scanning on at least a monthly basis and ensures ssues are remediated, utilizing a risk based approach within a reasonable timeframe.
Penetration testing (Ethical Hacking) of Internet facing systems or systems exposed to un-trusted networks is conducted prior to the system being deployed into a production status, after any significant changes, and then at least once every 12 months thereafter. 42