STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT ASTATEMENT OF WORK 1. Contract Description A. SHI International Corp. (hereinafter referred to as the “Contractor”) agrees to provide the California Department of Technology (hereinafter referred to as the “State,” “CDT,” and/or the “Licensee”) with Microsoft Online Subscriptions. As part of this Statewide Enterprise Licensing Agreement (Agreement), which consists of all the documents set forth in the Order of Precedence in Section 2 below, the Contractor must: 1) Provide Microsoft Online Subscriptions to M365 G5 Government Community Cloud (GCC) offerings and any additional GCC add-ons as detailed in the Exhibit C-1 Cost Worksheet. 2) Provide option(s) for State of California entities and local government agencies such as counties and cities (“Customer Affiliates”) to standardize Microsoft Security, Compliance and Communications transacted using the M365 G5 GCC offerings and any add-ons. 3) Create a new enrollment with Microsoft Security, Compliance and Communications, using the M365 G5 offering, and including options for adding Microsoft “additional GCC product” online services during a five (5) year term. 4) Discounts for State entity Customer Affiliates will differ from those of Local government Customer Affiliates in years one (1) and two (2) of this Agreement. B. The Microsoft Online Services Subscriptions will be provided by the manufacturer, Microsoft. C. Customer Affiliates will reserve approved subscriptions/licenses directly from the Microsoft 365 Admin Center (MAC). D. Under the terms of this Agreement, each Customer Affiliate will be their own tenant. E. Terms and Conditions of Department of General Services (DGS) Software Cooperative Agreement (SCA), County of Riverside Request for Quote (RFQ) #ITARC-00532, and Microsoft Master Agreement #8084445 shall apply to this Agreement though the life of its term subject to the Order of Precedence set forth in Section 2 below. 2. Modifications and Clarifications to the DGS PD 402-ITGP Cloud (REV. 02/20/2025) A. Section 3 of the DGS PD 402-ITGP Cloud (REV. 02/20/2025) are hereby deleted in their entirety and replaced with the following: Section 3: ORDER OF PRECEDENCE In the event of any inconsistency or conflict between the sections, exhibits, attachments, specifications, or provisions comprising the Contract, the following order of precedence shall apply:
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(a) These GSPD – ITGP (Cloud) (except in the instances herein where the provision contains “Unless otherwise specified in the Statement of Work” (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in these GSPD – ITGP (Cloud)); (b) Contract form(s), i.e., Purchase Order STD 65, Standard Agreement STD 213, FI$Cal generated Purchase Order, etc., and any amendments; (c) Other Special Provisions (except in the instances therein where the provision contains “Unless otherwise specified in the Statement of Work” (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in the applicable Special Provisions); (d) CDT’s Statement of Work (SOW), as an exhibit, including any specifications incorporated by reference herein; (e) Cost worksheets; (f) Other work description, work authorization or exhibit issued by Users; (g) DGS SCA Agreement and any amendments thereto; (h) County of Riverside RFQ # ITARC-00532; (i) Microsoft Master Agreement #8084445; and (j) All other Contractor’s or Service Provider’s attachments included in Contract and/or incorporated in Contract by reference (e.g., end User license agreements, acceptable use policies, service guides, product specific terms and conditions). 3. Clarifications to the DGS SLP, DGS SCA, and County of Riverside Request for Quote (RFQ) #ITARC-00532A. For the avoidance of doubt, notwithstanding Section 9.4 of the County of Riverside RFQ #ITARC-00532, Order of Precedence in the DGS SCA, or any other provision to the contrary, the Order of Precedence in Section 2 of this Statement of Work shall apply to this Agreement. B. For the avoidance of doubt, termination of the County of Riverside Agreement #ITARC-00532, Microsoft Master Agreement Number 8084445, or DGS SCA does not automatically terminate this Agreement and will remain in full force and effect. Any modifications to this Agreement will be documented through an amendment as set forth in the DGS PD 402-ITGP Cloud (REV. 02/20/2025). 4. Third Party Solutions Contractor shall not provide, integrate, resell, access, or make available to the State or Customer Affiliate any third-party services, solutions, tools, platforms, or products (including open-source or hosted services) (“Third Party Solutions”) in connection with the Microsoft Online Subscriptions to M365 G5 GCC offerings and additional Microsoft GCC add-ons as detailed in the Exhibit C-1 Cost Worksheet unless such Third Party Solutions are expressly approved in writing by CDT Information Technology Program Management (“CDT ITPM”) and are subject to the terms and conditions of this Agreement. Contractor shall not structure its performance, delivery model, or technical architecture in a manner that circumvents the STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
applicability of this Agreement to any services, solutions, or products provided to the State or Customer Affiliates. Contractor shall not add any Third Party Solutions or Third Party Solution SKUs to its product/service catalog. For avoidance of doubt, no third party terms shall apply to the State or Customer Affiliates unless expressively agreed in a written amendment signed by CDT. Any approved Third Party Solutions shall comply with the security, confidentiality, data protection, audit and other obligations of this Agreement. Any breach of this section by Contractor shall constitute a material breach of this Agreement. 5.TermA. The term of this Agreement shall be five (5) years. Agreement start date is 4/1/2026, with an expiration date of 3/31/2031. B. The effective date of this enrollment will be 4/1/2026 and processed by Microsoft and available for use in Customer Affiliate portals. The anniversary date schedule shall be as follows: 1stanniversary is 4/1/2027. 2ndanniversary is 4/1/2028. 3rdanniversary is 4/1/2029. 4thanniversary is 4/1/2030. 6. Licensee Site/Location The “Licensee Site” shall mean site where CDT or its Customer Affiliate tenants operate or control the use or access to Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons. CDT or its Customer Affiliate tenants may change the Licensee Site to another location located within the United States without incurring additional charges. 7. License Type Annual Software as a Service (SaaS) Subscription for Microsoft Online Subscriptions to M365 G5 GCC and any additional GCC add-ons. 8. Installed on All online services associated with this Agreement will run out of the manufacturer’s data centers. 9. True-Ups A. CDT ITPM may request, in writing, for Contractor to add any additional Microsoft products and support services to the product/services catalog, as needed. The addition of new Microsoft products and support services will be upon mutual written consent of Contractor and CDT ITPM and may not require a formal amendment to the Agreement. For clarity, Customer Affiliates or Contractor shall not add any new or additional Microsoft products or support services to the product/services catalog without prior written approval of CDT ITPM.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
B. Throughout the term of the Agreement, Customer Affiliate may add the quantity of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons that the Customer Affiliate procured under the current purchase order (PO). Upon request by Customer Affiliate, CDT may issue an amended PO to decrement the quantity of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons that the Customer Affiliate procured under the current PO. C. Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons are price protected (fixed prices throughout the term of the Agreement) and shall be priced by the Contractor at the price set forth in Exhibit C-1 Cost Worksheet and for the add-ons the price is set forth in the product/service catalog. D. The Contractor shall work collectively with Microsoft to promptly resolve any issues CDT or Customer Affiliates are experiencing with their reservations. E. The Contractor shall provide CDT an annual report sixty (60) days before each anniversary date (set forth in Section 5.B above) of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons added and decremented during the current PO. F. CDT will perform true-ups to add or true-downs to decrement Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons counts once a year (prior to the anniversary date, which is defined in Section 5.B above). 1) Contractor to provide Customer Affiliates with budgetary quote for annual reconciliation sixty (60) days prior to each anniversary date. 2) Contractor shall process the true-ups or true-downs prior to each anniversary date (set forth in Section 5.B above) and submit an email confirmation of such to CDT. 3) Contractor shall not accept or process any new reservations for Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons in the thirty (30) days prior to the expiration of the Agreement (03/31/2031). G. The Contractor shall process certain requests for add-ons for Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons throughout the term of each PO for the following scenarios: 1) Time sensitive promotional part number and/or SKUs, which require invoicing by a certain date to be valid. 2) Time sensitive orders that are associated with End Customer Investment Funds (ECIF). 3) Limited situations where the normal true-up/reconciliation window could negatively impact a special negotiation with CDT or Customer Affiliates.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
10.Notices All notices required by, or relating to, this Agreement shall be in writing and shall be sent to the parties of this Agreement as set below unless changed from time to time, in which event each party shall notify the other in writing, by e-mail communication: State Agency Contractor ManufacturerCDT SHI International Corp. MicrosoftAttn: IT Program Management Jason Goudie John RobinsonAddress: PO Box 1810Rancho Cordova, CA 95741PO Box 952121Dallas, TX 75395-2121 N/APhone: N/A 435-301-2383 (916) 369-3630E-mail:[email protected]@[email protected] [email protected] Responsibilities A. CDT will designate a Contract Manager to whom all Contractor communication may be addressed and who has the authority to act on all aspects of the service. This person may review the Agreement and associated documents with the Contractor to ensure understanding of the responsibilities of both parties. B. CDT will provide timely review and approval of information and documentation provided by the Contractor to perform its obligations. C. Upon execution of this Agreement, CDT will provide a STD 65 master purchase order for the Contract total amount and term. CDT will subsequently issue FI$Cal POs to the Contractor for each Customer Affiliate tenant. 12.Contractor Responsibilities A. Contractor to provide a dedicated staff/team with clearly identified roles, responsibilities, and list primary and back-up support. B. The Contractor shall designate a primary and secondary contact person to whom all Agreement/PO communications may be addressed and who has the authority to act on all aspects of the services. C. The Contractor shall provide a path of escalation for all communication and Agreement/PO related matters. D. The Contractor shall ensure dedicated staff are available during State business hours of 7:30 AM, PT to 5:30 PM, PT. E. The Contractor shall promptly respond (within 2 business days) in efforts to resolve Customer Affiliate issues encountered while reserving Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons via the MAC.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
F. The Contractor shall promptly work with the Customer Affiliate and Microsoft to reverse any unauthorized Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons reservations to prevent charges. If a Customer Affiliate reserves a license from the MAC not on the approved product/service catalog, the Contractor will facilitate its immediate cancellation to ensure no costs are incurred. G. The Contractor shall provide written notice to CDT of any change in the part number, product SKU number, description of the SKUs in the product/service catalog. H. The Contractor shall provide written notice to CDT regarding any updates to products within the product/service catalog that incorporate Generative Artificial Intelligence (GenAI) in accordance with DGS PD 402-ITGP Cloud (REV. 02/20/2025). I. The Contractor must adhere to invoicing requirements listed in Exhibit B. J. The Contractor shall invoice CDT separately for each Customer Affiliate tenant. K. The Contractor shall provide CDT with written e-mail confirmation upon receipt of PO or PO amendment. L. Any documents requiring electronic signature shall be sent to CDT ([email protected])and not Customer Affiliate. M. Following execution of this Agreement, the Contractor will schedule a kickoff meeting within 5-10 business days with CDT to discuss CDT billing and invoicing requirements and develop a plan for collaboration and streamlining of billing and invoicing procedures. N. The Contractor shall not offer or discuss any new Microsoft product or non-GCC Add-Ons not listed on the pre-approved product/service catalog with Customer Affiliates without prior approval from the CDT Contract Manager. 13.Maintenance/Technical Support The Contractor shall ensure that maintenance and support is provided by the manufacturer, Microsoft, throughout the term of this Agreement. Web Support: https://admin.microsoft.com/ 14.Problem Escalation A. The parties acknowledge that certain technical and project-related problems or issues may arise and that each party shall bring such matters to the immediate attention of the other party when identified. Known problems or issues shall be reported in regular weekly status reports or meetings. However, there may be instances where the severity of the problem justifies escalated reporting. To this extent, the State's Primary Contact will determine the next level of severity and notify the appropriate State and Manufacturer personnel. The personnel notified, and the time period taken to report the problem or issue, shall be at a level commensurate with the severity of the problem or issue. B. The State personnel include, but are not limited to the following:
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
First Level: CDT Contract Manager Second Level: CDT Branch Chief Third Level: CDT Deputy Director C. The Contractor personnel include, but are not limited to the following: First Level: Name: Jason Goudie Title: Microsoft Account Executive, Public Sector Sales, CA Email: [email protected] Number: 435-301-2383. Second Level: Name: Stephen Dean Title: District Manager – Microsoft, Public Sector Sales Email: [email protected] Contact Number: 512-702-5720. Third Level: Name: Matt OLeary Title: Vice President – Microsoft, Public Sector Sales Email: [email protected] Number: 206-390-4361. D. The Manufacturer personnel include, but are not limited to the following: First Level: Name: John Robinson Title: Sr. Commercial Executive Email: [email protected] Contact Number: 916-369-3630. Second Level: Name: Jennifer Rucker Title: Director of Sales Email: [email protected] Contact Number: 916-503-5117. Third Level: Name: Madison O’Kane Title: Director of Commercial SLED Licensing Email: [email protected] Number: 425-538-2123. 15.Amendments Consistent with the terms and conditions of the original solicitation, and upon mutual consent, CDT and the Contractor may execute amendments to this Agreement for changes to add available products per the most current SCA pricelist posted on the Cal eProcure website for quantity, money and/or time. No additional products or services can be added to this Agreement. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, and agreed upon by both parties and approved, as required. No verbal understanding or agreement not incorporated into the Agreement is binding on any of the parties.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
16. Advertising of Data In accordance with the General Provisions (DGS PD 402-ITGP Cloud (REV. 02/20/2025)), the Contractor and Microsoft are not authorized to use, sell, resell, package or repackage, or publicly display any information or data without the express written approval of the State. This restriction includes keyword searching or data mining of State data. Advertising is not allowed in any of these services or to any of the contacts associated with these services. 17. Federal Tax Administration RequirementsCDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least forty-five (45) calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075. Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately per the Cloud Computing Services - General Provisions – Information Technology (402-ITGP), clause 16.3, Termination for Default. In conformation with IRS Publication 1075, Contractor must comply with these terms. 18. Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act (33 U.S.C. 1251-1388) The Contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT BBUDGET DETAIL AND PAYMENT PROVISIONS 1.Payment and InvoicingA. Payment will be made annually in advance for the subscription year and upon receipt of a correct invoice. Invoices may be submitted on or after the first day of the term referenced in the executed PO. The invoice shall include booking confirmation of the CDT order per each environment; including but not limited to, the Contract number, the individual Customer PO number, the Customer Department, the EA/Tenant ID/number, the product name, Part/SKU number, unit cost, extended cost, code (if applicable), must reference a specific PO line item, term dates and include PO amendment number if applicable; and shall reference the Agency Order Number and the Microsoft Enterprise License Agreement (MELA) Software Cooperative Agreement (SCA) number SCA-24-70-0003U. B. Submit your invoice using only one of the following options: 1) Send via U.S. mail in TRIPLICATE to: California Department of Technology Administration Division – Accounting Office P. O. Box 1810 Rancho Cordova, CA 95741 OR 2) Submit electronically at: [email protected] C. If there is a change in cost to a license, or if the start date for licenses is changed so that it impacts pricing (i.e., term and activation of licenses falls after the 2nd of the month, and so billing begins the following month), the Contractor must provide product pricing change update and quote to the Customer Affiliate so that an amendment can be executed to the Customer Affiliate’s PO, to reflect the correct pricing. D. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq. 2. Budget Contingency Clause A. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this contract and Contractor shall not be obligated to perform any provisions of this contract. B. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Contract with no liability STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
occurring to the State or offer a contract amendment to the Contractor to reflect the reduced amount.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT C COST WORKSHEET DETAILS The Contractor shall submit a completed Attachment 1B (Exhibit C-1) Cost Worksheet, attached to the Request For Offer (RFO). The Contractor must adhere to the following: A. Subscriptions of the FromSA M365 G5 SKU will renew using the M365 G5 FromSA Renewal SKU. Subscriptions renewing from the M365 G5 Full SKU will renew as M365 G5 Full. B. Incremental additional M365 G5 GCC licenses added to enrollments for participating Customer Affiliates from day one (1) shall be priced at “Full” pricing, which is different from the “Full” pricing for those subscriptions that are renewing from “Full” subscriptions on 4/1/2026. C. All future new enrollments for M365 G5 GCC shall qualify for “Full” pricing. D. Pricing for true-ups will be equivalent to new enrollment pricing for all approved products. E. Pricing shall not exceed the negotiated discounts. F. Pricing for all Microsoft products offered under this Agreement shall be price protected throughout the term of this Agreement. G. The December 2025 price list will be the basis to determine final pricing. H. All pricing in Attachment 1B (Exhibit C-1) Cost Worksheet must be to two decimal points only. Any pricing that exceeds two decimal points will be rounded down to the nearest cent. I. Information Worker (IW) in Attachment 1B (Exhibit C-1) Cost Worksheet refers to worker licensed with M365 G5 and each Customer Affiliate has a unique number of IWs. J. For pricing purposes of items in Attachment 1B (Exhibit C-1) Cost Worksheet with IW threshold/eligibility conditions, each Customer Affiliate’s IW total shall be treated as a separate and independent quantity. K. For any new Microsoft products added to the product/service catalog after the execution of this Agreement, Contractor must provide a margin above Contractor’s cost from Microsoft (represented as a percentage), which will not be exceeded when such new Microsoft products are offered to Customer Affiliates.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT DGENERAL PROVISIONS These provisions are hereby incorporated by reference. The provisions are revised and effective 2/20/2025 for the Cloud and Non-Cloud. Cloud Computing Services – General Provisions (DGS PD 402-ITGP Cloud (REV. 02/20/2025)) https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT E SPECIAL PROVISIONS These provisions are hereby incorporated by reference. The provisions are revised and effective January 2025 for the GenAI Special Provisions. Generative AI (GENAI) Special Provisions https://cdt.ca.gov/wp-content/uploads/2025/02/GenAI-Special-Provisions-January-2025.pdf STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT F SPECIAL TERMS AND CONDITIONS TO SAFEGUARD FEDERAL TAX INFORMATION Federal statute, regulations and guidelines require that all contracts for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes include the provisions contained in this exhibit. Contractor agrees to comply with 26 United States Code (U.S.C) §6103(n), 26 Code of Federal Regulations (C.F.R) §301.6103(n)-1(a)(2) and (d), and Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021), Section 2.C.8., 2.C.9, and Exhibit 7) and all applicable conditions and restrictions as may be prescribed by the IRS by regulation, published rules or procedures, or written communication to the contractor. Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021) https://www.irs.gov/pub/irs-pdf/p1075.pdf EXHIBIT 7 - SAFEGUARDING CONTRACT LANGUAGE I. PERFORMANCE In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements: (1) All work will be performed under the supervision of the contractor. (2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS. (3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited. (4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material. (5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method. (7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI. (8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS. (9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI. (10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract. (11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and 202 obligated to the agency under this contract. (12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI. (13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein. II. CRIMINAL/CIVIL SANCTIONS (1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. (2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1. (3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements. III. INSPECTION The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements. IRS Publication 1075 (Rev. 11/2021) Section 2.C.8, Control over Processing through 2.C.9, Service Level Agreements (SLA) 2.C.8 Controls Over Processing STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
The agency must establish adequate controls to prevent disclosing FTI to other state agencies, tax or non-tax, or to political subdivisions, such as cities or counties, for any purpose, including tax administration, absent explicit written IRS authority granted under IRC § 6103(p)(2)(B). Processing of FTI in an electronic media format including removable media, microfilms, photo impressions or the conversion to other formats (including tape reformatting or duplication, reproduction or conversion to digital images or hard copy printout) will be performed as indicated in the environments listed in 2.C.8.1 and 2.C.8.2. 2.C.8.1 Agency-owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews. 2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities Recipients of FTI are permitted to use a shared facility but only in a manner that does not allow access to FTI by employees, agents, representatives, or contractors of other agencies using the shared facility. For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes contractors and subcontractors. Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply; for example, human services agencies administering benefit eligibility programs may not allow contractors or sub-contractors, including consolidated data center contractors, access to any FTI. The agency must include, as appropriate, the requirements specified in Exhibit 7, Safeguarding Contract Language. The agency, as well as its contractor, sub-contractor and shared sites that receive, process, store, access, protect and/or transmit FTI, are subject to Safeguard reviews. These requirements also apply to releasing electronic media to a private contractor, sub-contractor or other agency office, even if the purpose is merely to erase the old media for reuse. 2.C.9 Service Level Agreements (SLA) Agencies using support functions, including, but not limited to, consolidated data centers, shared print facilities, and disaster recovery sites, must implement appropriate controls to ensure the protection of FTI. This includes a service level agreement (SLA) between the agency authorized to receive FTI and support functions. The SLA must cover the following: The agency with authority to receive FTI is responsible for ensuring the protection of all FTI received. The state support function shares responsibility for safeguarding FTI. The Exhibit 7 language must be included in the SLA between the recipient agency and support functions and in all contracts involving contractors or sub-contractors hired by the state support function.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
The SLA provides written notification to the state support function’s management that they are bound by the provisions of Publication 1075, relative to protecting all FTI within their possession or control. The SLA shall detail the IRS’s right to inspect state support function facilities and operations receiving, processing, storing, accessing, protecting and/or transmitting FTI under this agreement to assess compliance with requirements defined in IRS Publication 1075. The SLA shall specify that IRS’s right of inspection includes the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. The SLA shall detail the state support function’s responsibilities to address corrective action recommendations to resolve findings of noncompliance identified by IRS inspections. The agency will conduct an internal inspection of the state support function every 18 months, as described in Section 2.D.3, Internal Inspections. Multiple agencies sharing a state support function such as a consolidated data center may partner together to conduct a single, comprehensive internal inspection. However, care must be taken to ensure agency representatives do not gain unauthorized access to other agencies’ FTI during the internal inspection. The employees from the state support function with access to or use of FTI, including system administrators and programmers, must: 1. Meet the background check requirements defined in Background Investigation Minimum Requirements and 2. Receive disclosure awareness training and sign a confidentiality statement, prior to initial access to or use of FTI, as well as annually thereafter. These provisions also extend to any contractors or sub-contractors hired by the state support function that have authorized access to or use of FTI. The specific data breach incident reporting procedures for all state support function employees, contractors and sub-contractors must be covered. The required disclosure awareness training must include a review of these procedures. Responsibilities must be identified for coordination of the 45-day notification of the use of contractors or sub-contractors with access to FTI. Require a formal sanction process for individuals covered by the SLA for failing to comply with established FTI security policies and procedures. Notification of designated agency personnel is required within 72 hours when the formal sanction is a proposed disciplinary or adverse action involving an unauthorized access or disclosure of FTI and must include the date the unauthorized access or disclosure of FTI occurred.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
Generally, consolidated data centers are operated either by a separate state agency (e.g., Department of Information Services) or by a private contractor or sub-contractor. If an agency is considering transitioning to either a state-owned or private vendor consolidated data center, the Office of Safeguards strongly suggests the agency submit a request for discussions with Safeguards as early as possible in the decision making or implementation planning process. The purpose of these discussions is to ensure the agency remains compliant with safeguarding requirements during the transition to the consolidated data center. Disclosure awareness training videos produced by the IRS can be found at: https://www.irs.gov/privacy-disclosure/irs-disclosure-awareness-videos REFERENCES 26 U.S.C. §6103(n) Confidentiality and disclosure of returns and return information (n) Certain other Persons Pursuant to regulations prescribed by the Secretary, returns and return information may be disclosed to any person, including any person described in section 7513(a), to the extent necessary in connection with the processing, storage, transmission, and reproduction of such returns and return information, the programming, maintenance, repair, testing, and procurement of equipment, and the providing of other services, for purposes of tax administration.26 C.F.R. §301.6103(n)-1 Disclosure of returns and return information in connection with written contracts or agreements for the acquisition of property or services for tax administration purposes. (a) General rule. (1) Pursuant to the provisions of section 6103(n) of the Internal Revenue Code and subject to the conditions of this section, officers and employees of the Treasury Department, a State tax agency, the Social Security Administration, or the Department of Justice, are authorized to disclose returns and return information (as defined in section 6103(b)) to any person (including, in the case of the Treasury Department, any person described in section 7513(a)), or to an officer or employee of the person, for purposes of tax administration (as defined in section 6103(b)(4)), to the extent necessary in connection with a written contract or agreement for the acquisition of - (i) Equipment or other property; or (ii) Services relating to the processing, storage, transmission, or reproduction of returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services. (2) Any person, or officer or employee of the person, who receives returns or return information under paragraph (a)(1) of this section, may - (i) Further disclose the returns or return information to another officer or employee of the person whose duties or responsibilities require the returns or return information for a purpose described in this paragraph (a); or STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(ii) Further disclose the returns or return information, when authorized in writing by the Internal Revenue Service (IRS), to the extent necessary to carry out the purposes described in this paragraph (a). Disclosures may include disclosures to an agent or subcontractor of the person, or officer or employee of the agent or subcontractor.(3)An agent or subcontractor, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a)(2)(ii) of this section, may further disclose the returns or return information to another officer or employee of the agent or subcontractor whose duties or responsibilities require the returns or return information for a purpose described in this paragraph (a). (4) Any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under this paragraph (a), may, subject to the provisions of § 301.6103(p)(2)(B)-1 (concerning disclosures by a Federal, State, or local agency, or its agents or contractors), further disclose the returns or return information for a purpose authorized, and subject to all applicable conditions imposed, by section 6103.(b) Limitations. (1) Disclosure of returns or return information in connection with a written contract or agreement for the acquisition of property or services described in paragraph (a) of this section will be treated as necessary only if the performance of the contract or agreement cannot otherwise be reasonably, properly, or economically carried out without the disclosure. (2) Disclosure of returns or return information in connection with a written contract or agreement for the acquisition of property or services described in paragraph (a) of this section shall be made only to the extent necessary to reasonably, properly, or economically perform the contract. For example, disclosure of returns or return information to employees of a contractor for purposes of programming, maintaining, repairing, or testing computer equipment used by the IRS or a State tax agency shall be made only if the services cannot be reasonably, properly, or economically performed without the disclosure. If it is determined that disclosure of returns or return information is necessary, and if the services can be reasonably, properly, or economically performed by disclosure of only parts or portions of a return or if deletion of taxpayer identity information (as defined in section 6103(b)(6)) reflected on a return would not seriously impair the ability of the employees to perform the services, then only the parts or portions of the return, or only the return with taxpayer identity information deleted, may be disclosed. (c) Penalties. Any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a) of this section, is subject to the civil and criminal penalty provisions of sections 7431, 7213, and 7213A for the unauthorized inspection or disclosure of the returns or return information. (d) Notification requirements. Any person, or agent or subcontractor of the person, who receives returns or return information under paragraph (a) of this section shall provide written notice to his, her, or its officers and employees receiving the returns or return information that - STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(1)Returns or return information disclosed to the officer or employee may be used only for a purpose and to the extent authorized by paragraph (a) of this section and that the officer or employee is subject to the civil and criminal penalty provisions of sections 7431, 7213, and 7213A for the unauthorized inspection or disclosure of the returns or return information; (2) Further inspection of any returns or return information for a purpose or to an extent not authorized by paragraph (a) of this section constitutes a misdemeanor, punishable upon conviction by a fine of as much as $1,000, or imprisonment for as long as 1 year, or both, together with costs of prosecution; (3) Further disclosure of any returns or return information for a purpose or to an extent not authorized by paragraph (a) of this section constitutes a felony, punishable upon conviction by a fine of as much as $5,000, or imprisonment for as long as 5 years, or both, together with the costs of prosecution;(4) Further inspection or disclosure of returns or return information by any person who is not an officer or employee of the United States for a purpose or to an extent not authorized by paragraph (a) of this section may result also in an award of civil damages against that person in an amount not less than $1,000 for each act of unauthorized inspection or disclosure; or the sum of actual damages sustained by the plaintiff as a result of the unauthorized inspection or disclosure plus, in the case of a willful inspection or disclosure or an inspection or disclosure that is the result of gross negligence, punitive damages. In addition, costs and reasonable attorneys fees may be awarded; and (5) A conviction for an offense referenced in paragraph (d)(2) or (3) of this section shall, in addition to any other punishment, result in dismissal from office or discharge from employment if the person convicted is an officer or employee of the United States. (e) Safeguards. (1) Any person, or agent or subcontractor of the person, who may receive returns or return information under paragraph (a) of this section, shall agree, before disclosure of any returns or return information to the person, agent, or subcontractor, to permit an inspection by the IRS of his, her, or its site or facilities.(2) Any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a) of this section, shall comply with all applicable conditions and requirements as the IRS may prescribe from time to time (prescribed requirements) for the purposes of protecting the confidentiality of returns and return information and preventing any disclosure or inspection of returns or return information in a manner not authorized by this section. (3) The terms of any written contract or agreement for the acquisition of property or services as described in paragraph (a) of this section shall provide, or shall be amended to provide, that any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a) of this section, shall comply with the prescribed requirements. Any contract or agreement shall be made available to the IRS before execution of the contract or agreement. For purposes of this paragraph (e)(3), a written contract or agreement shall include any contract or agreement STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
between a person and an agent or subcontractor of the person to provide the property or services described in paragraph (a) of this section. (4) If the IRS determines that any person, or officer, employee, agent or subcontractor of the person, or officer or employee of the agent or subcontractor, who receives returns or return information under paragraph (a) of this section, has failed to, or does not, satisfy the prescribed requirements, the IRS, consistent with the regulations under section 6103(p)(7), may take any actions it deems necessary to ensure that the prescribed requirements are or will be satisfied, including - (i) Suspension of further disclosures of returns or return information by the IRS to the State tax agency, the Social Security Administration, or the Department of Justice, until the IRS determines that the conditions and requirements have been or will be satisfied; (ii) Suspension of further disclosures by the Treasury Department otherwise authorized by paragraph (a) of this section; and (iii)Suspension or termination of any duty or obligation arising under a contract or agreement with the Treasury Department. (f)Definitions. For purposes of this section - (1) The term Treasury Department includes the IRS, the Office of the Chief Counsel for the IRS, and the Office of the Treasury Inspector General for Tax Administration; (2) The term State tax agency means an agency, body, or commission described in section 6103(d); and (3) The term Department of Justice includes offices of the United States Attorneys. (g) Effective date. This section is applicable on June 5, 2007. 26 U.S.C. §7213. Unauthorized disclosure of information (a) Returns and return information (1) Federal employees and other persons It shall be unlawful for any officer or employee of the United States or any person described in section 6103(n) (or an officer or employee of any such person), or any former officer or employee, willfully to disclose to any person, except as authorized in this title, any return or return information (as defined in section 6103(b)). Any violation of this paragraph shall be a felony punishable upon conviction by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution, and if such offense is committed by any officer or employee of the United States, he shall, in addition to any other punishment, be dismissed from office or discharged from employment upon conviction for such offense. (2) State and other employees STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
It shall be unlawful for anyperson(not described in paragraph (1)) willfully to disclose to any person, except as authorized in this title, any return or return information (as defined insection 6103(b)) acquired by him or anotherpersonunder subsection (d), (i)(1)(C), (3)(B)(i), or (7)(A)(ii), (k)(10), (13), (14), or (15), (l)(6), (7), (8), (9), (10), (12), (15), (16), (19), (20), or (21) or (m)(2), (4), (5), (6), or (7) of section 6103 or under section 6104(c). Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution. (3) Other persons It shall be unlawful for any personto whom any return or return information (as defined in section 6103(b)) is disclosed in a manner unauthorized by this title thereafter willfully to print or publish in any manner not provided by law any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution. (4) Solicitation It shall be unlawful for any personwillfully to offer any item of material value in exchange for any return or return information (as defined in section 6103(b)) and to receive as a result of such solicitation any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution. (5) Shareholders It shall be unlawful for any person to whom a return or return information (as defined in section 6103(b)) is disclosed pursuant to the provisions of section 6103(e)(1)(D)(iii) willfully to disclose such return or return information in any manner not provided by law. Any violation of this paragraph shall be a felony punishable by a fine in any amount not to exceed $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution. (b) Disclosure of operations of manufacturer or producer Any officer or employee of the United States who divulges or makes known in any manner whatever not provided by law to any personthe operations, style of work, or apparatus of any manufacturer or producer visited by him in the discharge of his official duties shall be guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than $1,000, or imprisoned not more than 1 year, or both, together with the costs of prosecution; and the offender shall be dismissed from office or discharged from employment. (c) Disclosures by certain delegates of Secretary All provisions of law relating to the disclosure of information, and all provisions of law relating to penalties for unauthorized disclosure of information, which are applicable in respect of any function under this title when performed by an officer or employee of the Treasury Department STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
are likewise applicable in respect of such function when performed by anypersonwho is a “delegate” within the meaning of section 7701(a)(12)(B). (d) Disclosure of software Any person who willfully divulges or makes known software (as defined in section 7612(d)(1)) to anyperson in violation of section 7612 shall be guilty of a felony and, upon conviction thereof, shall be fined not more than $5,000, or imprisoned not more than 5 years, or both, together with the costs of prosecution. (e) Cross references (1) Penalties for disclosure of information by preparers of returns For penalty for disclosure or use of information by preparers of returns, see section 7216. (2) Penalties for disclosure of confidential information For penalties for disclosure of confidential information by any officer or employee of the United States or any department or agency thereof, see 18 U.S.C. 1905. 26 U.S.C. §7213A. Unauthorized inspection of returns or return information (a) Prohibitions (1) Federal employees and other persons It shall be unlawful for— (A) any officer or employee of the United States, or (B) any person described in subsection (l)(18) or (n) of section 6103or an officer or employee of any such person, willfully to inspect, except as authorized in this title, any return or return information. (2) State and other employees It shall be unlawful for any person (not described in paragraph (1)) willfully to inspect, except as authorized in this title, anyreturn or return information acquired by such person or anotherperson under a provision of section 6103referred to in section 7213(a)(2) or under section 6104(c). (b) Penalty (1) In general Any violation of subsection (a) shall be punishable upon conviction by a fine in any amount not exceeding $1,000, or imprisonment of not more than 1 year, or both, together with the costs of prosecution.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(2) Federal officers or employeesAn officer or employee of the United States who is convicted of any violation of subsection (a) shall, in addition to any other punishment, be dismissed from office or discharged from employment. (c) Definitions For purposes of this section, the terms “inspect”, “return”, and “return information” have the respective meanings given such terms by section 6103(b).26 U.S.C. §7431. Civil damages for unauthorized inspection or disclosure of returns and return information (a) In general (1) Inspection or disclosure by employee of United States If any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103, such taxpayer may bring a civil action for damages against the United States in a district court of the United States. (2) Inspection or disclosure by a person who is not an employee of United States If any person who is not an officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103 or in violation of section 6104(c), such taxpayer may bring a civil action for damages against such person in a district court of the United States. (b) Exceptions No liability shall arise under this section with respect to any inspection or disclosure— (1) which results from a good faith, but erroneous, interpretation of section 6103, or (2) which is requested by the taxpayer. (c) Damages In any action brought under subsection (a), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of— (1) the greater of— (A) $1,000 for each act of unauthorized inspection or disclosure of a return or return information with respect to which such defendant is found liable, or (B) the sum of— (i) the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure, plus STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(ii) in the case of a willfulinspectionor disclosure or aninspectionor disclosure which is the result of gross negligence, punitive damages, plus (2) the costs of the action, plus (3) in the case of a plaintiff which is described in section 7430(c)(4)(A)(ii), reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party (as determined under section 7430(c)(4)). (d) Period for bringing action Notwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at any time within 2 years after the date of discovery by the plaintiff of the unauthorized inspection or disclosure. (e) Notification of unlawful inspection and disclosure. If any person is criminally charged by indictment or information with inspection or disclosure of a taxpayer’s return or return information in violation of— (1) paragraph (1) or (2) of section 7213(a), (2) section 7213A(a), or (3) subparagraph (B) of section 1030(a)(2) of title 18, United States Code, the Secretary shall notify such taxpayer as soon as practicable of such inspection or disclosure. The Secretary shall also notify such taxpayer if the Internal Revenue Service or a Federal or State agency (upon notice to the Secretary by such Federal or State agency) proposes an administrative determination as to disciplinary or adverse action against an employee arising from the employee’s unauthorized inspection or disclosure of the taxpayer’s return or return information.The notice described in this subsection shall include the date of the unauthorizedinspection or disclosure and the rights of the taxpayer under such administrative determination. (f) Definitions For purposes of this section, the terms “inspect”, “inspection”, “return”, and “return information” have the respective meanings given such terms by section 6103(b). (g) Extension to information obtained under section 3406For purposes of this section— (1) any information obtained under section 3406(including information with respect to any payee certification failure under subsection (d) thereof) shall be treated as return information, and (2) any inspectionor use of such information other than for purposes of meeting any requirement under section 3406or (subject to the safeguards set forth in section 6103) for purposes permitted under section 6103 shall be treated as a violation of section 6103. For purposes of subsection (b), the reference to section 6103 shall be treated as including a reference to section 3406. (h) Special rule for information obtained under section 6103(k)(9) STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
For purposes of this section, any reference to section 6103shall be treated as including a reference to section 6311(e).
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
ATTACHMENT 1HIPAA BUSINESS ASSOCIATE AGREEMENT If Customer is a Covered Entity or a Business Associate and includes Protected Health Information in Customer Data or FastTrack Data, execution of a license agreement that includes the Online Services Terms (“Agreement”) will incorporate the terms of this HIPAA Business Associate Agreement (“BAA”) into that Agreement. If there is any conflict between a provision in this BAA and a provision in the Agreement, this BAA will control. 1. Definitions. Except as otherwise defined in this BAA, capitalized terms shall have the definitions set forth in HIPAA, and if not defined by HIPAA, such terms shall have the definitions set forth in the Agreement. “Breach Notification Rule” means the Breach Notification for Unsecured Protected Health Information Final Rule. “Business Associate” shall have the same meaning as the term “business associate” in 45 CFR § 160.103 of HIPAA. “Covered Entity” shall have the same meaning as the term “covered entity” in 45 CFR § 160.103 of HIPAA. “Customer”, for this BAA only, means Customer and its Affiliates. “FastTrack Data” means all data, including all text, sound, video, or image files, and software, that are provided to Microsoft by or on behalf of Customer for Microsoft’s performance of the FastTrack Services. “FastTrack Services” means the onboarding and migration services for Office 365 Services specified as being in scope for this BAA on the FastTrack Center BAA site at http://aka.ms/FastTrackBAA (or successor site) that are provided to Customer by Microsoft in connection with Customer’s subscription for Office 365 Services, excluding services that are performed using third-party software or software that is not hosted by Microsoft. “HIPAA” collectively means the administrative simplification provision of the Health Insurance Portability and Accountability Act enacted by the United States Congress, and its implementing regulations, including the Privacy Rule, the Breach Notification Rule, and the Security Rule, as amended from time to time, including by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act and by the Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule. “Microsoft Online Services”, for this BAA only, means Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics 365 Core Services, Microsoft Intune Online Services, Microsoft Power Platform Core Services, and/or Microsoft Cloud App Security, each as defined in the “Data Protection Terms” section of the Online Services Terms incorporated into the Agreement; Microsoft Healthcare Bot; and any additional Azure online services and U.S. Government online services listed as in scope for this BAA on the Microsoft Trust Center at https://www.microsoft.com/en-us/trustcenter/Compliance/HIPAA (or successor site); excluding Previews. “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
“Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103 of HIPAA, provided that it is limited to such protected health information that is received by Microsoft from, or created, received, maintained, or transmitted by Microsoft on behalf of, Customer (a) through the use of the Microsoft Online Services or (b) for Microsoft’s performance of the FastTrack Services. “Security Rule” means the Security Standards for the Protection of Electronic Protected Health Information. 2.Permitted Uses and Disclosures of Protected Health Information.a. Performance of the Agreement for Microsoft Online Services. Except as otherwise limited in this BAA, Microsoft may Use and Disclose Protected Health Information for, or on behalf of, Customer as specified in the Agreement; provided that any such Use or Disclosure would not violate HIPAA if done by Customer, unless expressly permitted under paragraph b of this Section. b. Management, Administration, and Legal Responsibilities. Except as otherwise limited in this BAA, Microsoft may Use and Disclose Protected Health Information for the proper management and administration of Microsoft and/or to carry out the legal responsibilities of Microsoft, provided that any Disclosure may occur only if: (1) Required by Law; or (2) Microsoft obtains written reasonable assurances from the person to whom the Protected Health Information is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed to the person, and the person notifies Microsoft of any instances of which it becomes aware in which the confidentiality of the Protected Health Information has been breached. 3. Responsibilities of the Parties with Respect to Protected Health Information. a. Microsoft’s Responsibilities. To the extent Microsoft is acting as a Business Associate, Microsoft agrees to the following: (i) Limitations on Use and Disclosure. Microsoft shall not Use and/or Disclose the Protected Health Information other than as permitted or required by the Agreement and/or this BAA or as otherwise Required by Law. Microsoft shall not disclose, capture, maintain, scan, index, transmit, share or Use Protected Health Information for any activity not authorized under the Agreement and/or this BAA. Neither Microsoft Online Services nor FastTrack Services shall use Protected Health Information for any advertising, Marketing or other commercial purpose of Microsoft or any third party. Microsoft shall not violate the HIPAA prohibition on the sale of Protected Health Information. Microsoft shall make reasonable efforts to Use, Disclose, and/or request the minimum necessary Protected Health Information to accomplish the intended purpose of such Use, Disclosure, or request. (ii) Safeguards. Microsoft shall: (1) use reasonable and appropriate safeguards to prevent inappropriate Use and Disclosure of Protected Health Information other than as provided for in this BAA; and (2) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.
STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(iii)Reporting.Microsoft shall report to Customer: (1) any Use and/or Disclosure ofProtected Health Information that is not permitted or required by this BAA of which Microsoft becomes aware; (2) any Security Incident of which it becomes aware, provided that notice is hereby deemed given for Unsuccessful Security Incidents and no further notice of such Unsuccessful Security Incidents shall be given; and/or (3) any Breach of Customer’s Unsecured Protected Health Information that Microsoft may discover (in accordance with 45 CFR § 164.410 of the Breach Notification Rule). Notification of a Breach will be made without unreasonable delay, but in no event more than five (5) business days after Microsoft’s determination of a Breach. Taking into account the level of risk reasonably likely to be presented by the Use, Disclosure, Security Incident, or Breach, the timing of other reporting will be made consistent with Microsoft’s and Customer’s legal obligations. For purposes of this Section, “Unsuccessful Security Incidents” mean, without limitation, pings and other broadcast attacks on Microsoft’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, Use, or Disclosure of Protected Health Information. Notification(s) under this Section, if any, will be delivered to contacts identified by Customer pursuant to Section 3b(ii) (Contact Information for Notices) of this BAA by any means Microsoft selects, including through e-mail. Microsoft’s obligation to report under this Section is not and will not be construed as an acknowledgement by Microsoft of any fault or liability with respect to any Use, Disclosure, Security Incident, or Breach. (iv) Subcontractors. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2) of HIPAA, Microsoft shall require its Subcontractors who create, receive, maintain, or transmit Protected Health Information on behalf of Microsoft to agree in writing to: (1) the same or more stringent restrictions and conditions that apply to Microsoft with respect to such Protected Health Information; (2) appropriately safeguard the Protected Health Information; and (3) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule. Microsoft remains responsible for its Subcontractors’ compliance with obligations in this BAA. (v) Disclosure to the Secretary. Microsoft shall make available its internal practices, records, and books relating to the Use and/or Disclosure of Protected Health Information received from Customer to the Secretary of the Department of Health and Human Services for purposes of determining Customer’s compliance with HIPAA, subject to attorney-client and other applicable legal privileges. Microsoft shall respond to any such request from the Secretary in accordance with the Section titled “Disclosure of Customer Data” in the Agreement. (vi) Access. If Microsoft maintains Protected Health Information in a Designated Record Set for Customer, then Microsoft, at the request of Customer, shall within fifteen (15) days make access to such Protected Health Information available to Customer in accordance with 45 CFR § 164.524 of the Privacy Rule. (vii) Amendment. If Microsoft maintains Protected Health Information in a Designated Record Set for Customer, then Microsoft, at the request of STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
Customer, shall within fifteen (15) days make available such Protected Health Information to Customer for amendment and incorporate any reasonably requested amendment in the Protected Health Information in accordance with 45 CFR § 164.526 of the Privacy Rule. (viii) Accounting of Disclosure. Microsoft, at the request of Customer, shall within fifteen (15) days make available to Customer such information relating to Disclosures made by Microsoft as required for Customer to make any requested accounting of Disclosures in accordance with 45 CFR § 164.528 of the Privacy Rule. (viii)Performance of a Covered Entity’s Obligations. To the extent Microsoft is to carry out a Covered Entity obligation under the Privacy Rule, Microsoft shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligation. b. Customer Responsibilities. (i) No Impermissible Requests. Customer shall not request Microsoft to Use or Disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate). (ii) Contact Information for Notices. Customer hereby agrees that any reports, notification, or other notice by Microsoft pursuant to this BAA may be made electronically. Customer shall provide contact information as follows (or as Microsoft may specify from time to time): (1) the Azure Security Center for Microsoft Azure Core Services, (2) [email protected] for other Azure or U.S. Government online services in scope for this BAA, and (3) the Message Center in the Admin Center for other Microsoft Online Services. Contact information (a) for Microsoft Azure Core Services must include the security contact information required on the Azure Security Center, (b) for other Azure or U.S. Government online services in scope for this BAA must include name of individual(s) to be contacted, title of individual(s) to be contacted, e-mail address of individual(s) to be contacted, name of Customer organization, and, if available, Customer’s contract number, subscriber identification number, and Microsoft Online Direct Routing Domain (MODRD) (e.g. “contoso.onmicrosoft.com”), and (c) for other Microsoft Online Services must include information required for the Message Center Privacy reader role in the Admin Center. Customer shall ensure that such contact information remains up to date during the term of this BAA. Failure to submit and maintain as current the aforementioned contact information may delay Microsoft’s ability to provide Breach notification under this BAA. (iii) Safeguards and Appropriate Use of Protected Health Information. Customer is responsible for implementing appropriate privacy and security safeguards to protect its Protected Health Information in compliance with HIPAA. Without limitation, it is Customer’s obligation to: 1) Not include Protected Health Information in: (1) information Customer submits to technical support personnel through a technical support request or to community support forums; and (2) Customer’s address book or STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
directory information. In addition, Microsoft does not act as, or have the obligations of, a Business Associate under HIPAA with respect to Customer Data or FastTrack Data once it is sent to or from Customer outside Microsoft Online Services or FastTrack Services over the public Internet, or if Customer fails to follow applicable instructions regarding physical media transported by a common carrier. 2) Implement privacy and security safeguards in the systems, applications, and software Customer controls, configures, and uploads into the Microsoft Online Services or uses in connection with the FastTrack Services. 4.Applicability of BAA.This BAA is applicable to Microsoft Online Services and FastTrack Services. Microsoft may, from time to time, (a) include additional Microsoft online services on the Microsoft Trust Center and/or in the “Data Protection Terms” section of the Online Services Terms incorporated into the Agreement or additional FastTrack Services on the FastTrack Center BAA site, and (b) update the definition of Microsoft Online Services and FastTrack Services in this BAA accordingly, and such updated definitions will apply to Customer without additional action by Customer. It is Customer’s obligation to not store or process in an online service, or provide to Microsoft for performance of a professional service, protected health information (as that term is defined in 45 CFR § 160.103 of HIPAA) until this BAA is effective as to the applicable service. 5. Term and Termination. a. Term. This BAA shall continue in effect until the earlier of (1) termination by a Party for breach as set forth in Section 5b, below, or (2) expiration of Customer’s Agreement. b. Termination for Breach. Upon written notice, either Party immediately may terminate the Agreement and this BAA if the other Party is in material breach or default of any obligation in this BAA. Either party may provide the other a thirty (30) calendar day period to cure a material breach or default within such written notice. c. Return, Destruction, or Retention of Protected Health Information Upon Termination. Upon expiration or termination of this BAA, Microsoft shall return or destroy all Protected Health Information in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If it is not feasible to return or destroy any portions of the Protected Health Information upon termination of this BAA, then Microsoft shall extend the protections of this BAA, without limitation, to such Protected Health Information and limit any further Use or Disclosure of the Protected Health Information to those purposes that make the return or destruction infeasible for the duration of the retention of the Protected Health Information. 6. Miscellaneous. a. Interpretation. The Parties intend that this BAA be interpreted consistently with their intent to comply with HIPAA and other applicable federal and state law. Except where this BAA conflicts with the Agreement, all other terms and conditions of the STATE OF CALIFORNIA SHI INTERNATIONAL CORP. DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
Agreement remain unchanged. Any captions or headings in this BAA are for the convenience of the Parties and shall not affect the interpretation of this BAA. b.BAAs; Waiver.This BAA may not be modified or amended except in a writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, as a bar to, or as a waiver of any right or remedy as to subsequent events. c. No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything in this BAA confer, upon any person other than the Parties, and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever. d. Severability. In the event that any provision of this BAA is found to be invalid or unenforceable, the remainder of this BAA shall not be affected thereby, but rather the remainder of this BAA shall be enforced to the greatest extent permitted by law. e. No Agency Relationship. It is not intended that an agency relationship (as defined under the Federal common law of agency) be established hereby expressly or by implication between Customer and Microsoft under HIPAA or the Privacy Rule, Security Rule, or Breach Notification Rule. No terms or conditions contained in this BAA shall be construed to make or render Microsoft an agent of Customer.