Agenda packet, regular meeting — San Mateo City Council, September 18, 2023 (part 2 of 3)

9 0
1 5
ARTICLE 17 - MISCELLANEOUS

17.01 Cumulative Remedies
A. The duties and obligations imposed by this Contract and the rights and remedies available hereunder to the parties hereto are in addition to, and are not to be construed in any way as a limitation of, any rights and remedies available to any or all of them which are otherwise imposed or available by Laws or Regulations, by special warranty or guarantee, or by other provisions of the Contract. The provisions of this paragraph will be as effective as if repeated specifically in the Contract Documents in connection with each particular duty, obligation, right, and remedy to which they apply.

17.02 Limitation of Damages
A. Neither Owner, RPR, nor any of their officers, directors, members, partners, employees, agents, consultants, or subcontractors, shall be liable to Contractor for any claims, costs, losses, or damages sustained by Contractor on or in connection with any other project or anticipated project.

17.03 No Waiver
A. A party’s non-enforcement of any provision shall not constitute a waiver of that provision, nor shall it affect the enforceability of that provision or of the remainder of this Contract.

17.04 Survival of Obligations
A. All representations, indemnifications, warranties, and guarantees made in, required by, or given in accordance with the Contract, as well as all continuing obligations indicated in the Contract, will survive final payment, completion, and acceptance of the Work or termination or completion of the Contract or termination of the services of Contractor.

17.05 Contractor’s Certifications
A. Contractor certifies that it has not engaged in corrupt, fraudulent, collusive, or coercive practices in competing for or in executing the Contract.

17.06 Controlling Law and Venue
A. This Contract is to be governed by the law of the state of California and, in the event of litigation, venue will be in the County of San Mateo.

17.07 Notices
A. All notices shall be in writing, and delivered in person, or transmitted by certified mail, postage prepaid. Notices required to be given to Owner or Contractor shall be addressed as appears in the signature block at the end of this Contract.

17.08 No Partnership or Agency
A. Nothing in this Contract nor in the contract documents shall be deemed to constitute a partnership in law between Owner and Contractor, or any subcontractor, to constitute either party as an agent of the other for any purpose; or to entitle either party to commit or bind the other in any manner unless expressly agreed upon in the contract documents.

120 of 493

This document is a MODIFIED version of EJCDC® C-522, Copyright © 2016 by the National Society of Professional Engineers, American Council of Engineering Companies, and American Society of Civil Engineers, or is based in part on excerpts from copyrighted EJCDC documents. Those portions of the text that originated in copyrighted EJCDC documents remain subject to the copyright.

Page 21 of 34 ends

9 0
1 5

17.09 Severability
A. If any part or provision of the contract documents is determined by any court to be illegal, invalid, or unenforceable, in whole or in part, the contract documents shall continue to be valid as to its other provisions and the remainder of the affected provision, unless it can be concluded from the circumstances that, in the absence of the provisions found to be null and void, the parties would not have entered into the contract documents. The parties shall use all reasonable efforts to replace any and all provisions or parts found to be null and void with provisions that are valid under the applicable law and come closest to their original intention.

17.10 Waiver
A. None of the following shall operate as a waiver of any provision of the contract documents, or of any power herein reserved by the Owner, or any right to damages herein provided: 1) inspection by the Owner or its authorized agents or representatives; 2) any order or certificate for payment, or any payment for, or acceptance of the whole or any party of the work by the Owner; 3) an extension of time; or 4) any position taken by the Owner or its authorized agents or representatives.

17.11 Warranty
A. Contractor warrants and guarantees that the materials and equipment provided shall be at least of the quality specified and new unless otherwise required or permitted by the contract documents and, if no quality is specified, then the materials and equipment shall be of commercial grade, suitable for heavy public use in facilities of similar size and complexity,, that the work performed hereunder will be free from defects, and that the work will conform to the requirements of the contract documents.

121 of 493

Page 22 of 34 ends

9 0
1 5
IN WITNESS WHEREOF, Owner and Contractor have signed this Contract.

This Contract will be effective on __________________ (which is the Effective Date of the Contract).

OWNER: CONTRACTOR:

By: Brad B. Underwood By: Young Kang
Title: Public Works Director Title: President
Address for giving notices: Address for giving notices:
330 West 20th Avenue 783 Phillips Drive
San Mateo, CA 94403 City of Industry, CA 91748
License No.: CA License # 858483
(where applicable)

APPROVED AS TO FORM
Linh Nguyen
Assistant City Attorney

122 of 493

EXHIBIT A
CONTRACTOR’S PROPOSAL

123 of 493

124 of 493

125 of 493

126 of 493

127 of 493

128 of 493

129 of 493

130 of 493

EXHIBIT B

INSURANCE REQUIREMENTS FOR CONSTRUCTION CONTRACTS
ARTICLE 18 - MINIMUM SCOPE AND LIMIT OF INSURANCE

18.01 Contractor shall procure and maintain for the duration of the contract, and for five (5) years thereafter, insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Contractor, his agents, representatives, employees, or subcontractors.

18.02 Coverage shall be at least as broad as:

A. Commercial General Liability (CGL): Insurance Services Office (ISO) Form CG 00 01 covering CGL on an “occurrence” basis, including products and completed operations, property damage, bodily injury and personal & advertising injury with limits no less than $5,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this project/location (ISO CG 25 03 or 25 04) or the general aggregate limit shall be twice the required occurrence limit.

B.Automobile Liability: Insurance Services Office Form CA 0001 covering Code 1 (any auto), with limits no less than $5,000,000 per accident for bodily injury and property damage.

C.Workers’ Compensation insurance as required by the State of California, with Statutory Limits, and Employers’ Liability insurance with a limit of no less than $1,000,000 per accident for bodily injury or disease.

D.Builder’s Risk (Course of Construction) insurance utilizing an “All Risk” (Special Perils) coverage form, with limits equal to the completed value of the project and no coinsurance penalty provisions.

E.Surety Bonds as described below.

F.Professional Liability (if Design/Build), with limits no less than $2,000,000 per occurrence or claim, and $2,000,000 policy aggregate.

G.Contractors’ Pollution Legal Liability and/or Asbestos Legal Liability and/or Errors and Omissions (if project involves environmental hazards) with limits no less than $1,000,000 per occurrence or claim, and $2,000,000 policy aggregate.

18.03 If the contractor maintains broader coverage and/or higher limits than the minimums shown above, the City requires and shall be entitled to the broader coverage and/or the higher limits maintained by the contractor. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to the City.

18.04 Self-Insured Retentions. Self-insured retentions must be declared to and approved by the City. At the option of the City, either: the contractor shall cause the insurer shall to reduce or eliminate such self-insured retentions as respects the City, its officers, officials, employees, and volunteers; or the Contractor shall provide a financial guarantee satisfactory to the City guaranteeing payment of losses and related investigations, claim administration, and defense expenses. The

131 of 493

policy language shall provide, or be endorsed to provide, that the self-insured retention may be satisfied by either the named insured or City.

ARTICLE 19 - OTHER INSURANCE PROVISIONS

19.01 The insurance policies are to contain, or be endorsed to contain, the following provisions:

A.The City, its officers, officials, employees, and volunteers are to be covered as additional insureds on the CGL policy with respect to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts, or equipment furnished in connection with such work or operations and automobiles owned, leased, hired, or borrowed by or on behalf of the Contractor. General liability coverage can be provided in the form of an endorsement to the Contractor’s insurance (at least as broad as ISO Form CG 20 10, CG 11 85 or both CG 20 10, CG 20 26, CG 20 33, or CG 20 38; and CG 20 37 forms if later revisions used).

B. For any claims related to this project, the Contractor’s insurance coverage shall be primary insurance coverage at least as broad as ISO CG 20 01 04 13 as respects the City, its officers, officials, employees, and volunteers. Any insurance or self-insurance maintained by the City, its officers, officials, employees, or volunteers shall be excess of the Contractor’s insurance and shall not contribute with it.

C. Each insurance policy required by this clause shall provide that coverage shall not be canceled, except with notice to the City.

19.02 Builder’s Risk (Course of Construction) Insurance A. Contractor may submit evidence of Builder’s Risk insurance in the form of Course of Construction coverage. Such coverage shall name the City as a loss payee as their interest may appear.

B. If the project does not involve new or major reconstruction, at the option of the City, an Installation Floater may be acceptable. For such projects, a Property Installation Floater shall be obtained that provides for the improvement, remodel, modification, alteration, conversion or adjustment to existing buildings, structures, processes, machinery and equipment. The Property Installation Floater shall provide property damage coverage for any building, structure, machinery or equipment damaged, impaired, broken, or destroyed during the performance of the Work, including during transit, installation, and testing at the City’s site.

19.03 Claims Made Policies
A. If any coverage required is written on a claims-made coverage form:

1. The retroactive date must be shown, and this date must be before the execution date of the contract or the beginning of contract work.

2. Insurance must be maintained, and evidence of insurance must be provided, for at least five (5) years after completion of contract work.

3. If coverage is cancelled or non-renewed, and not replaced with another claims-made policy form with a retroactive date prior to the contract effective, or start of work date, the Contractor must purchase extended reporting period coverage for a minimum of five (5) years after completion of contract work.

132 of 493

4. A copy of the claims reporting requirements must be submitted to the City for review.

5. If the services involve lead-based paint or asbestos identification/remediation, the Contractors Pollution Liability policy shall not contain lead-based paint or asbestos exclusions. If the services involve mold identification/remediation, the Contractors Pollution Liability policy shall not contain a mold exclusion, and the definition of Pollution shall include microbial matter, including mold.

19.04 Acceptability of Insurers
A. Insurance is to be placed with insurers authorized to conduct business in the state with a current A.M. Best rating of no less than A: VII, unless otherwise acceptable to the City.

19.05 Waiver of Subrogation
A.Contractor hereby agrees to waive rights of subrogation which any insurer of Contractor may acquire from Contractor by virtue of the payment of any loss. Contractor agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation. The Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the City for all work performed by the Contractor, its employees, agents and subcontractors.

19.06 Verification of Coverage
A. Contractor shall furnish the City with original Certificates of Insurance including all required amendatory endorsements (or copies of the applicable policy language effecting coverage required by this clause) and a copy of the Declarations and Endorsement Page of the CGL policy listing all policy endorsements to City before work begins. However, failure to obtain the required documents prior to the work beginning shall not waive the Contractor’s obligation to provide them. The City reserves the right to require complete, certified copies of all required insurance policies, including endorsements, required by these specifications, at any time.

19.07 Subcontractors
A. Contractor shall require and verify that all subcontractors maintain insurance meeting all requirements stated herein, and Contractor shall ensure that City is an additional insured on insurance required from subcontractors. For CGL coverage, subcontractors shall provide coverage with a form at least as broad as CG 20 38 04 13.

19.08 Surety Bonds.

A. Contractor shall provide the following Surety Bonds:

1. Performance Bond

2. Payment Bond

3. Maintenance Bond
B. The Payment Bond and the Performance Bond shall be in a sum equal to the contract price.

If the Performance Bond provides for a one-year warranty a separate Maintenance Bond is not necessary. If the warranty period specified in the contract is for longer than one year a Maintenance Bond equal to 10% of the contract price is required. Bonds shall be duly executed by a responsible corporate surety, authorized to issue such bonds in the State of California and secured through an authorized agent with an office in California.

133 of 493

19.09 Special Risks or Circumstances.

A. City reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other circumstances.

134 of 493

ATTACHMENT 3 - EXISTING PHOTOS (TYPICAL AT BOTH RESTROOMS)

EXTERIOR EXTERIOR

INTEIOR INTERIOR

135 of 493

INTERIOR INTERIOR

136 of 493

CITY OF SAN MATEO
4 4
2 1

CITY OF SAN MATEO
Agenda Report
City Hall
330 W. 20th Avenue
San Mateo CA 94403
www.cityofsanmateo.org
Agenda Number: 10 Section Name: CONSENT CALENDAR Account Number: 21-4678 File ID: 23-7888 TO: City Council
FROM: Alex Khojikian, City Manager
PREPARED BY: Public Works Department
MEETING DATE: September 18, 2023
SUBJECT:
41st Ave/Pacific Blvd Trash Capture Project – Agreement and Appropriation RECOMMENDATION:

Adopt a Resolution to approve a cooperative agreement with Caltrans; accept and appropriate funding from Caltrans in the amount of $630,000 for the design and construction of the 41st Ave/Pacific Blvd Trash Capture Project; and authorize the Public Works Director to execute the agreement in substantially the form presented.

BACKGROUND:

The 41st Ave/Pacific Blvd Trash Capture Project (Project) is part of the City’s plan to achieve compliance with the San Francisco Bay Regional Water Quality Control Board’s (RWQCB) Municipal Regional Stormwater Permit. The permit requires the City to reduce trash and litter discharge by 100%, relative to 2009 baseline values, by June 30, 2025. The City is currently at 77.3% trash capture reduction through existing trash capture devices, source control measures, creek and shoreline cleanup efforts, and other control mechanisms. The Project will provide approximately 5% additional trash capture reduction and support the City’s efforts to remain compliant with permit requirements.

Caltrans, under its statewide stormwater permit, is also required to comply with trash reduction requirements and has partnered with the City of San Mateo on previous projects that benefitted each agency’s goals. This includes installation of trash capture devices at Poplar-Dore, Coyote Point Pump Station, and Poplar at the Golf Course. The Project will treat runoff from the City and portions of Caltrans’ right-of-way on El Camino Real. Pending final approval of the Project by the RWQCB, Caltrans will contribute $630,000 of funding toward the Project, which will be managed and administered by the City of San Mateo. There are no matching requirements. The City will fund the project implementation costs up front, with the $630,000 from Caltrans being provided to City on a reimbursement basis.

The 41st Ave/Pacific Blvd Trash Capture Project is estimated to cost approximately $630,000 and is anticipated to be completed by Summer 2025. The final schedule will be dependent on environmental permits that will need to be obtained from the appropriate regulatory agencies. Based on the above, staff recommends for City Council to adopt a resolution approving a cooperative agreement with Caltrans and accept and appropriate funding from Caltrans to the Project.

BUDGET IMPACT:

The 41st Ave/Pacific Blvd Trash Capture Project was not included in the Fiscal Year 2023-24 Capital Budget. Acceptance and appropriation of the $630,000 in funding from Caltrans to the Project, the Fiscal Year 2023-24 Capital Budget will increase by this amount and there will be sufficient funding available for the project costs and staff time associated with this project. No additional funding or local match is required. Expenses for this project will be reimbursed through the Caltrans funding.

137 of 493

CITY OF SAN MATEO
4 4
2 1
ENVIRONMENTAL DETERMINATION:

Entering into a cooperative agreement and the receipt of funds from Caltrans is not a project subject to CEQA, because it is an organizational or administrative activity that will not result in direct or indirect physical changes in the environment. (CEQA Guidelines Section 15378(b)(5).) The CEQA clearance requirements for the Project will be determined during the design phase, and prior to construction of the Project.

NOTICE PROVIDED
All meeting noticing requirements were met.

ATTACHMENTS
Att 1 – Proposed Resolution
Att 2 – Agreement

STAFF CONTACT
Elton Yee, Associate Engineer
[email protected]
(650) 522-7320

138 of 493

8 9
9 2

CITY OF SAN MATEO
RESOLUTION NO. ______ (2023)

AUTHORIZING A COOPERATIVE IMPLEMENTATION AGREEMENT WITH CALTRANS TO RECEIVE GRANT FUNDS IN THE AMOUNT OF $630,000 TO CONSTRUCT THE 41ST AVE/PACIFIC BLVD TRASH CAPTURE PROJECT AND APPROPRIATING $630,000 TO THE PROJECT WHEREAS, the City of San Mateo (City) has adopted the Project identified as the 41 st Ave/Pacific Blvd Trash Capture Project (Project); and
WHEREAS, the City’s Project will treat stormwater in the concrete channel on Pacific Blvd, south of 41st Ave, as well as incorporate a gross solid screening device to capture trash and debris from the Basin; and
WHEREAS, the State of California Department of Transportation (Caltrans) owns property that is in the Basin and stormwater from it will flow into the Project facilities; and WHEREAS, Caltrans and the City, pursuant to California Streets and Highways Code (SHC) Sections 114 and 130, will enter into a Cooperative Agreement for improvements to the State Highway System (SHS) as a watershed stakeholder within the City’s jurisdiction; and WHEREAS, Caltrans has agreed to contribute an amount not to exceed $630,000 to the City to construct the Project facilities, within the regional area under the jurisdiction of the City to comply with the Total Maximum Daily Load (TMDL) as required by the National Pollution Discharge Elimination Permit Order 2022-0033-DWQ.

NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF SAN MATEO, CALIFORNIA, HEREBY RESOLVES THAT:

1. Entering into a cooperative agreement with Caltrans and the receipt of funds from Caltrans is not a project subject to CEQA, because it is an organizational or administrative activity that will not result in direct or indirect physical changes in the environment. (CEQA Guidelines Section 15378(b)(5).)

2. The City Council of the City of San Mateo agrees to enter into a Cooperative Implementation Agreement with Caltrans and to receive grant funds from Caltrans in the amount of $630,000 to construct the 41st Ave/Pacific Blvd Trash Capture Project.

3. An appropriation of $630,000 to the 41 st Ave/Pacific Blvd Trash Capture Project budget in the Capital Projects Fund is authorized.

139 of 493

City of San Mateo
CIA No. D43CIASM003

Page 1 of 12 ends

COOPERATIVE IMPLEMENTATION AGREEMENT

THIS AGREEMENT, ENTERED INTO EFFECTIVE ON ______________, (the EFFECTIVE DATE) is between the State of California acting by and through its Department of Transportation, referred to herein as CALTRANS and the City of San Mateo, a body politic and a municipal corporation (chartered City) of the State of California, referred to herein as AGENCY. CALTRANS and AGENCY are together referred to as PARTIES.

RECITALS

1. CALTRANS and AGENCY, pursuant to California Streets and Highways Code (SHC) Sections 114 and 130, are authorized to enter into a Cooperative Agreement for improvements to the State Highway System (SHS) as a watershed stakeholder within AGENCY’s jurisdiction.

2. As per Attachment D of the Caltrans National Pollutant Discharge Elimination Permit Order 2022-0033-DWQ (NPDES Permit), Section 5.1 and/or Attachment E, Section 3 of the NPDES Permit, CALTRANS and AGENCY may collaboratively implement the NPDES Permit requirements as they have been identified as stakeholders in the Total Maximum Daily Load (TMDL) or contain Significant Trash Generating Areas (STGA) for 41 st
Ave/Pacific Blvd Trash Capture Project (hereinafter referred to as “PROJECT”).

CALTRANS has agreed to contribute an amount not to exceed six hundred and thirty thousand Dollars ($630,000) to AGENCY for AGENCY to construct the PROJECT, within the regional area under the jurisdiction of AGENCY to comply with the TMDL or to treat STGAs. The NPDES Permit (including Attachments D and E) is located at:
www.waterboards.ca.gov/water_issues/programs/stormwater/caltrans.html

3. AGENCY has agreed to implement the PROJECT subject to the terms and conditions of this Agreement including all documents attached hereto that are incorporated herein and hereby made a part of this Agreement (collectively referred to as the AGREEMENT).

4. AGENCY will be responsible for all management, maintenance and operations, including costs of the constructed PROJECT.

5. For NPDES Permit compliance, CALTRANS will claim acreage-based PROJECT pollutant waste load reductions granted by the San Francisco Regional Water Quality Control Board for the PROJECT equal to the percentage of total PROJECT cost contributed by CALTRANS or the waste load allocation assigned to CALTRANS for the PROJECT watershed, whichever is less. CALTRANS intends to use the PROJECT waste load reductions to demonstrate equivalent load reductions required to meet its TMDL waste load allocations.

6. Cooperative implementation has the following advantages: cooperative implementation (i) allows for water quality improvement projects off the ROW, at locations that may otherwise have space, access, or safety limitations within the ROW; (ii) provides for the involvement of local watershed partners who have an interest and expertise in the best way to protect, manage, and enhance water quality in the watershed; (iii) allows for implementation of Best Management Practices (BMPs) and other creative solutions not

140 of 493

City of San Mateo
CIA No. D43CIASM003

Page 2 of 12 ends

typically available to CALTRANS; (iv) allows for larger watershed-scale projects; and (v) leverages resources from other entities.

7. All services performed by AGENCY pursuant to this AGREEMENT are intended to be performed in accordance with all applicable Federal, State and AGENCY laws, ordinances, and regulations, and with CALTRANS published manuals, policies, and procedures. In case of a conflict between Federal, State and AGENCY laws, ordinances, or regulations, the order of precedence applicability of these laws shall be Federal, State and then AGENCY laws and regulations, respectively.

8. CALTRANS share of PROJECT funding is as follows:

FUND TITLE FUND SOURCE DOLLAR AMOUNT
SHA State of California $630,000

141 of 493

City of San Mateo
CIA No. D43CIASM003

Page 3 of 12 ends

SECTION I

All sections of this AGREEMENT including the recitals are enforceable.

1. AGENCY has agreed to implement the PROJECT in accordance with Attachment II- SCOPE SUMMARY. The SCOPE SUMMARY that is attached to and made a part of this AGREEMENT defines in detail the PROJECT’s scope of work, description, schedule, location and budget.

2. AGENCY will be responsible for all management, maintenance and operations, including costs of the constructed PROJECT.

3. AGENCY will develop and construct the PROJECT in accordance with the applicable laws, policies, practices, procedures and standards. This applies to all procurements, including land acquisitions, licenses and permits.

4. AGENCY shall prepare initial engineering and geotechnical assessments, and detailed design as well as acquire environmental reviews and right of way (ROW) needed for the PROJECT.

This work is equivalent to CALTRANS process of Project Initiation Document (PID), Project Approval & Environmental Document (PA&ED) and Plans, Specification and Estimate (PS&E). AGENCY will pay for, coordinate, prepare, obtain, implement, renew, and amend all permits needed to complete the PROJECT. AGENCY will prepare CEQA environmental documentation to meet California Environmental Quality Act (CEQA) requirements.

5. AGENCY will advertise, open bids, award, and approve the construction contract in accordance with the California Public Contract Code and the California Labor Code and will be responsible for the administration, acceptance, and final documentation of the construction contract.

6. CALTRANS shall reimburse AGENCY for actual costs of the PROJECT not exceeding the amount set forth in Section 8 below.

7. CALTRANS shall have the right to inspect the PROJECT work to be performed hereunder at any time during its progress and to make final inspection upon completion thereof. Failure of CALTRANS to object within 30 days after final inspection shall indicate satisfactory performance of this AGREEMENT by AGENCY.

8. The total amount CALTRANS will reimburse to AGENCY pursuant to this AGREEMENT shall not exceed $630,000 (“Contract Sum”). Costs incurred by AGENCY for PROJECT work under this AGREEMENT in excess of the Contract Sum will be borne by AGENCY. It is understood and agreed that this AGREEMENT fund limit is an estimate and that CALTRANS will only reimburse the cost of services actually rendered as authorized by the CALTRANS Contract Manager or designee at or below the fund limitation amount set forth in this AGREEMENT and in accordance with the Budget included in Attachment II.

9. All administrative draft and administrative final reports, studies, materials, and documentation relied upon, produced, created or utilized for the PROJECT will be held in confidence to the extent permitted by law, and where applicable, the provisions of California Government Code section 7921.505 shall govern the disclosure of such documents in the event said documents are shared between the PARTIES. Parties will not distribute, release, or share said documents with anyone without prior written consent of the

142 of 493

City of San Mateo
CIA No. D43CIASM003

Page 4 of 12 ends

party authorized to release said documents except: (i) to employees, agents, and consultants who require access to complete the work described within this AGREEMENT; or (ii) where release is required or authorized by law.

10. HM-1 is defined as hazardous material (including but not limited to hazardous waste) that requires removal and disposal pursuant to Federal or State law, whether it is disturbed by the PROJECT or not. HM-2 is defined as hazardous material (including but not limited to hazardous waste) that may require removal and disposal pursuant to Federal or State law, only if disturbed by the PROJECT.

11. CALTRANS, independent of the PROJECT costs, is responsible for any HM-1 found within existing CALTRANS ROW. CALTRANS will undertake HM-1 management activities with minimum impact to the PROJECT schedule and will pay all costs associated with HM-1 management activities.

12. CALTRANS has no responsibility for management activities or costs associated with HM- 1 found outside the CALTRANS existing ROW. AGENCY, independent of PROJECT costs, is responsible for any HM-1 found within PROJECT limits outside existing CALTRANS ROW, and will pay, or cause to be paid, all costs associated with HM-1 management activities. AGENCY will undertake, or cause to be undertaken, HM-1 management activities with minimum impact to the PROJECT schedule.

13. If HM-2 is found within the limits of the PROJECT, the AGENCY responsible for advertisement, award, and administration (AAA) of the PROJECT construction contract will be responsible for HM-2 management activities. Any management activity cost associated with HM-2 is a PROJECT construction cost.

14. This AGREEMENT may only be amended or modified by mutual written agreement of the PARTIES.

143 of 493

City of San Mateo
CIA No. D43CIASM003

Page 5 of 12 ends

SECTION II- GENERAL PROVISIONS

1. TERMINATION
A. This AGREEMENT may be terminated by the PARTIES upon mutual written agreement.

In the event of a termination CALTRANS will reimburse AGENCY all allowable, authorized, and non-cancelable obligations and costs incurred by AGENCY prior to the termination.

B. CALTRANS reserves the right to terminate this AGREEMENT before the AGENCY awards the PROJECT construction contract or begins to do project work. CALTRANS will reimburse AGENCY reasonable, allowable, authorized and non-cancelled costs up to the date of termination that are attributable to the PROJECT.

C. This AGREEMENT will terminate upon completion of PROJECT when all PARTIES have met all scope, cost, and schedule commitments included in this AGREEMENT and have signed a closure statement, which is a document signed by the PARTIES that verifies the completion of PROJECT, except that all indemnification, document retention, audit, claims, environmental commitment, pending legal challenge, hazardous material, operation, maintenance and ownership provisions of this AGREEMENT will remain in effect until terminated or modified by mutual written agreement.

D. AGENCY has sixty (60) days after the date this AGREEMENT is terminated or expires, or such other time agreed upon in writing by the PARTIES, to submit invoices to CALTRANS to make final allowable payments for PROJECT costs in accordance with the terms of this AGREEMENT. Failure to submit invoices within this period may result in a waiver by AGENCY of its right to reimbursement of expended costs.

2. BUDGET CONTINGENCY CLAUSE
All obligations of CALTRANS under the terms of this AGREEMENT are subject to the appropriation of resources by the Legislature, and the State Budget Act authority. It is mutually agreed that if the State Legislature does not appropriate sufficient funds for the program, this AGREEMENT shall be amended if possible to reflect any reduction in funds, but nothing herein obligates the PARTIES to provide additional funding or proceed if sufficient funding is unavailable.

3. ALLOWABLE COST, PAYMENTS AND INVOICING
A. The method of payment for this AGREEMENT will be based on actual allowable costs.

CALTRANS will reimburse AGENCY for expended actual allowable direct costs and indirect costs, including, but not limited to labor costs, employee benefits, travel (overhead is reimbursable only if the AGENCY has an approved indirect costs allocation plan) and contracted consultant services costs incurred by AGENCY in performance of the PROJECT work, not to exceed the Contract Sum of the PROJECT.

B. Reimbursement of AGENCY expenditures will be authorized only for those allowable costs actually incurred by AGENCY in the performance of the PROJECT work. AGENCY must not only have incurred the expenditures on or after the EFFECTIVE DATE of this

144 of 493

City of San Mateo
CIA No. D43CIASM003

Page 6 of 12 ends

AGREEMENT and before the date it is terminated or expires, but must have also paid for those costs to claim any reimbursement.

C. PARTIES will agree upon CALTRANS’ annual reimbursement of the PROJECT costs, throughout its duration. Total reimbursement will not exceed the Contract Sum (as defined in Section I above). The encumbered funds are to be expended and invoiced to CALTRANS by AGENCY by May 1 of the third fiscal year from the fiscal year CALTRANS encumbered them. Any funds encumbered, but not expended by the end of the third fiscal year, will not be reimbursed to AGENCY by CALTRANS.

D. Travel, per diem, and third-party contract reimbursements are PROJECT costs only after those hired by AGENCY to participate in the PROJECT incur and pay those costs.

Payments for travel and per diem will not exceed the rates paid rank and file state employees under current California Department of Human Resources rules current at the EFFECTIVE DATE of this AGREEMENT.

E. CALTRANS will reimburse AGENCY for all allowable PROJECT costs no more frequently and no later than monthly in arrears and as promptly as CALTRANS fiscal procedures permit upon receipt of itemized signed invoices. Invoices shall reference this AGREEMENT Number and shall be signed and submitted electronically to the Contract Manager at the following address:
[[email protected]] cc: [email protected]

If electronic submittal is not possible, mail invoice to:

California Department of Transportation
Division of Environmental Analysis – Fiscal Analysis Unit, MS 27 1120 N Street, Sacramento, CA 95814-5680
F. Invoices shall include the following information:
1) Invoice Cover Sheet The invoice cover sheet summarizes the previous, current and total amounts billed for the AGREEMENT. Details included on the cover sheet are:
a. “INVOICE” near top of page
b. Invoice Date
c. Contract Number (D43CIAxx000x)
d. Invoice Number [minimum format: City Initials-3-digit Invoice Number (XXX- 001)]
e. Billing period (performance period), specified with beginning and ending dates (towards top of page). All work performed must be during the billing period.

Invoice billing periods must not overlap.
f. Brief description of the work performed
g. Summary of total dollar amount billed to date
i. Previous month invoice balance
ii. Amount billed this month
iii. Total amount billed including current invoice amount h. Total amount due
i. Summary of charges

145 of 493

City of San Mateo
CIA No. D43CIASM003

Page 7 of 12 ends

i. AGENCY (municipality) labor costs
ii. Sub-Vendor labor costs (consultant)
iii. Sub-vendor direct costs (materials, equipment, miscellaneous itemized costs)
iv. Other direct costs
j. Discounts (if applicable)
k. Remittance information including name and address [MUST match Payee Data Record Declaration of Business Location (Form FA-204) submitted at contract execution or on file]
l. AGENCY Contract Manager’s name, address and phone number m. AGENCY Contract Manager’s signature and signature block n. CALTRANS Contract Manager’s name and address
o. CALTRANS Contract Manager’s signature block.
2) Invoice and Supports
All invoice charges must match the rates on the contract cost proposal and personnel request. (Changes in billing rates must be approved before billing.) The CALTRANS’ Contract Manager must be provided invoices or other documentation with sufficient detail to verify the charges are allowable under this AGREEMENT with sufficient support to allow them to verify charges. Supporting documentation, such as receipts, is required for all costs included on the invoice that are not for hourly or sub-contract labor.

AGENCY labor charges need to show person’s name, hours worked, billing rate and brief description of work performed. Supporting documents (timesheet or payroll report) need to be provided. These documents need to include:
a. Name (first and last)
b. Hours charged
c. Brief description -- identify the work is for the project funded by the Cooperative Implementation Agreement
d. Month, day and year of the charges (must be within the billing period) e. Worker and supervisor’s signatures (Exceptions can be made for electronic timesheets.) All overtime must be approved in advance by the CALTRANS Contract Manager.

Direct costs (such as material costs, vehicle rental) are reimbursable. These costs need to be verified, therefore, a copy of the receipt, paid purchase order or other documentation that shows the items and cost needs to be attached to the invoice.

AGENCY personnel travel costs may be reimbursed according to the Consultant and Contractor travel guidelines located on the CALTRANS’ website at:
www.dot.ca.gov/hq/asc/travel/ch12/1consultant.htm
. The Travel Expense Claim (TEC)
form is available at: www.dot.ca.gov/hq/asc/travel/ch5/1tec.htm.

Subcontractor costs are reimbursed after providing a copy of the paid invoice. This invoice needs to show that the AGENCY contract manager reviewed and approved the

146 of 493

City of San Mateo
CIA No. D43CIASM003

Page 8 of 12 ends

payment. CALTRANS requires its vendors to submit proof of costs incurred, such as timesheet or payroll records, travel reimbursement form (that includes the reason and dates for travel) with receipts, receipts for materials, lab services or other items) and CALTRANS assumes the AGENCY has similar requirements that are documented. 3) Progress Reports
Each invoice needs to be accompanied by a progress report for the billing period. This report includes:
a. Work performed during the billing period (can be in a bullet format) b. Contract progress estimate -- percentage of work completed (not dollar based) c. Work anticipated during the next billing cycle (can be in a bullet format) d. Total amount spent during the billing period (AGENCY personnel, AGENCY direct costs, subcontractor costs and total)
e. Total amount spent to date (AGENCY, subcontractor, total) f. CIA not to exceed amount
g. Percentage of Cooperative Implementation Agreement (CIA) funds used to date. [Total (AGENCY and subcontractor)/CIA not to exceed amount)]

4. COST PRINCIPLES
A. If PARTIES fund any part of PROJECT with state or federal funds, each PARTY will comply, and will ensure that any sub-recipient, contractor or subcontract hired to participate in PROJECT will comply with the federal cost principles and administrative requirements of 2 CFR, Part 200. These principles and requirements apply to all funding types included in this AGREEMENT.

B. Any PROJECT costs for which AGENCY has received payment or credit that are determined by subsequent audit to be unallowable under 2 CFR, Part 200, and/or Title 48, Chapter 1, Part 31, are subject to repayment by AGENCY to CALTRANS. Should AGENCY fail to reimburse moneys due CALTRANS within thirty (30) days of discovery or demand, or within such other period as may be agreed in writing between the PARTIES hereto, CALTRANS is authorized to intercept and withhold future payments due AGENCY from CALTRANS.

C. The PARTIES will maintain and make available to each other all PROJECT related documents, including financial data, during the term of this AGREEMENT. PARTIES will retain all PROJECT-related records for three (3) years after the final payment voucher.

5. INDEMNIFICATION
Neither CALTRANS nor any officer or employee thereof is responsible for any injury, damage, or liability occurring by reason of anything done or omitted to be done by AGENCY, its contractors, sub-contractors, and/or its agents under or in connection with any work, authority, or jurisdiction conferred upon AGENCY under this AGREEMENT. It is understood and agreed that AGENCY, to the extent permitted by law, will defend, indemnify, and save harmless CALTRANS and all of its officers and employees from all claims, suits, or actions of every name, kind, and description brought forth under, but not limited to, tortious, contractual,

147 of 493

City of San Mateo
CIA No. D43CIASM003

Page 9 of 12 ends

inverse condemnation, or other theories and assertions of liability occurring by reason of anything done or omitted to be done by AGENCY, its contractors, sub-contractors, and/or its agents under this AGREEMENT.

6. RETENTION OF RECORDS/AUDITS
A. AGENCY, its contractors, subcontractors and sub-recipients shall establish and maintain an accounting system and records that properly accumulate and segregate incurred PROJECT costs. The accounting system of AGENCY, its contractors, all subcontractors, and sub- recipients shall conform to Generally Accepted Accounting Principles (GAAP), shall enable the determination of incurred costs at interim points of completion, and shall provide support for reimbursement payment vouchers or invoices. All books, documents, papers, accounting records and other supporting papers and evidence of performance under this AGREEMENT of AGENCY, its contractors, subcontractors and sub-recipients connected with PROJECT performance under this AGREEMENT shall be maintained for a minimum of three (3) years from the date of final payment to AGENCY and shall be held open to inspection, copying, and audit by representatives of CALTRANS, the California State Auditor, and auditors representing the federal government during business hours with appropriate notice. Copies thereof will be furnished by AGENCY, its contractors, its subcontractors and sub-recipients upon receipt of any request made by CALTRANS or its agents. In conducting an audit of the costs under this AGREEMENT, CALTRANS will rely to the maximum extent possible on any prior audit of AGENCY pursuant to the provisions of State and AGENCY law. In the absence of such an audit, any acceptable audit work performed by AGENCY’s external and internal auditors may be relied upon and used by CALTRANS when planning and conducting additional audits.

B. AGENCY, its sub-recipients, contractors, and subcontractors will permit access to all records of employment, employment advertisements, employment application forms, and other pertinent data and records by the State Fair Employment Practices and Housing Commission, or any other AGENCY of the State of California designated by CALTRANS, for the purpose of any investigation to ascertain compliance with this AGREEMENT.

C. This AGREEMENT shall be subject to a pre-award audit prior to execution of the AGREEMENT to ensure AGENCY has an adequate financial management system in place to accumulate and segregate reasonable, allowable and allocable costs.

D. CALTRANS, the state auditor, and the Federal Government, (if the PROJECT utilizes federal funds), will have access to all PROJECT-related records held by AGENCY or by any party hired by AGENCY to participate in PROJECT.

E. The examination of any records will take place in the offices and locations where said records are generated and/or stored and will be accomplished during reasonable hours of operation.

F. Upon completion of the final audit, AGENCY has thirty (30) calendar days to refund or invoice as necessary in order to satisfy the obligation of the audit.

148 of 493

City of San Mateo
CIA No. D43CIASM003

Page 10 of 12 ends

7. DISPUTES
A. PARTIES will first attempt to resolve AGREEMENT disputes at the PROJECT team level.

If they cannot resolve the dispute themselves, the CALTRANS Chief Environmental Engineer and the executive officer of AGENCY will attempt to negotiate a resolution.

B. If PARTIES do not reach a resolution, AGENCY’s legal counsel will initiate mediation.

PARTIES agree to participate in mediation in good faith and will share equally in its costs.

C. Neither the dispute nor the mediation process relieves PARTIES from full and timely performance of the PROJECT in accordance with the terms of this AGREEMENT.

However, if either PARTY stops fulfilling PROJECT obligations, the other PARTY may seek equitable relief to ensure that the PROJECT continues.

D. Except for equitable relief, no PARTY may file a civil complaint until after mediation, or 45 calendar days after filing the written mediation request, whichever occurs first.

E. PARTIES will file any civil complaints in the Superior Court of the county in which the CALTRANS district office signatory to this AGREEMENT resides or in the Superior Court of the county in which the PROJECT is physically located. The prevailing PARTY will be entitled to an award of all costs, fees, and expenses, including reasonable attorney fees as a result of litigating a dispute under this AGREEMENT or to enforce the provisions of this article including equitable relief.

F. Additional Dispute Remedies. PARTIES maintain the ability to unanimously pursue alternative or additional dispute remedies if a previously selected remedy does not achieve resolution.

8. RELATIONSHIP OF PARTIES
It is expressly understood that this AGREEMENT is an agreement executed by and between two independent governmental entities and is not intended to, and shall not be construed to, create the relationship of agent, servant, employee, partnership, joint venture or association, or any other relationship whatsoever other than that of an independent party.

9. NOTIFICATION OF PARTIES
A. AGENCY: Elton Yee, Associate Engineer, eyee@cit yofsanmateo.org , (650) 522-7320.

B. CALTRANS: Ken Johansson, acting Chief Environmental Engineer, (916) 956-8170.

C. All notices herein provided to be given, or which may be given, by either party to the other, shall be deemed to have been fully given when made in writing and received by the PARTIES at their respective addresses:

City of San Mateo
Public Works Department
Attention: Elton Yee
330 West 20
th Avenue
San Mateo, CA 94403
California Department of Transportation
Division of Environmental Analysis - MS 27

149 of 493

City of San Mateo
CIA No. D43CIASM003

Page 11 of 12 ends

Attention: Ken Johansson
1120 N Street, Sacramento, CA 95814-5680

150 of 493

City of San Mateo
CIA No. D43CIASM003

Page 12 of 12 ends

SECTION III ATTACHMENTS
The following attachments are incorporated into and are made a part of this AGREEMENT by this reference and attachment.

I. AGENCY Resolution, Certification of Approval, order, motion, ordinance or other similar document from the local governing body authorizing execution of the AGREEMENT.

II. Scope of Work, Description, Schedule, Location and Budget .

SECTION IV- SIGNATURES
Signatories may execute this AGREEMENT through individual signature pages provided that each signature is an original. This AGREEMENT is not fully executed until all original signatures are attached. PARTIES are empowered by California Streets and Highways Code (SHC) sections 114 and 130 to enter into this AGREEMENT and have delegated to the undersigned the authority to execute this AGREEMENT on behalf of the respective agencies and covenant to have followed all the necessary legal requirements to validly execute this AGREEMENT.

STATE OF CALIFORNIA CITY OF SAN MATEO DEPARTMENT OF TRANSPORTATION

Signature: Signature:

Print Name: KEN JOHANSSON Print Name: BRAD UNDERWOOD
Title: Stormwater Coordinator Title: Public Works Director Date: Date:

Signature: Signature:

Print Name: KEN JOHANSSON Print Name:

Title: Assistant Chief, Division of
Environmental Analysis
Title:

Date: Date:

Signature: :

Print Name: JEREMY KETCHUM
Title: Chief, Division of
Environmental Analysis

Date:

151 of 493

CITY OF SAN MATEO
RESOLUTION NO. ______ (2023)

AUTHORIZING ENTERING INTO A COOPERATIVE IMPLEMENTATION AGREEMENT WITH CALTRANS TO RECEIVE GRANT FUNDS IN THE AMOUNT OF $630,000 TO CONSTRUCT THE 41ST AVE/PACIFIC BLVD TRASH CAPTURE PROJECT AND AN APPROPRIATION OF $630,000 TO THE

PROJECT
WHEREAS, the City of San Mateo (City) has adopted the Project identified as the 41st Ave/Pacific Blvd Trash Capture Project (Project); and
WHEREAS, the City’s Project will treat stormwater in the concrete channel on Pacific Blvd, south of 41st Ave, as well as incorporate a gross solid screening device to capture trash and debris from the Basin; and
WHEREAS, the State of California Department of Transportation (Caltrans) owns property that is in the Basin and stormwater from it will flow into the Project facilities; and WHEREAS, Caltrans and the City, pursuant to California Streets and Highways Code (SHC) Sections 114 and 130, will enter into a Cooperative Agreement for improvements to the State Highway System (SHS) as a watershed stakeholder within the City’s jurisdiction; and WHEREAS, Caltrans has agreed to contribute an amount not to exceed $630,000 to the City to construct the Project facilities, within the regional area under the jurisdiction of the City to comply with the Total Maximum Daily Load (TMDL) as required by the National Pollution Discharge Elimination Permit Order 2022-0033-DWQ;

NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF SAN MATEO, CALIFORNIA, HEREBY RESOLVES THAT:

3. An appropriation of $ 630,000 to the 41 st Ave/Pacific Blvd Trash Capture Project budget in the Capital Projects Fund is authorized.

152 of 493

Agency
Department
Project Name
Scope of Work/Description
Location
Est. Design Begin: September 2023
Est. Design End: December 2024
Est. Construction Begin: April 2025
Est. Construction End: June 2025
Design/Permitting: $130,000
Construction: $400,000
Construction Contingency: $100,000
TOTAL $630,000
41st Ave/Pacific Blvd Trash
Capture Project
Estimated Capital Cost
3975 Pacific Blvd, San Mateo CA 94403
City of San Mateo
Public Works
41st Ave/Pacific Blvd Trash Capture Project
Installation of Gross Solids Removal Device (GSRD), such as those manufactured by Roscoe Moss, Inc, in the concrete box channel directly downstream of where the underground culvert daylights. The GSRD device will be attached to a low flow weir or headwall and trash will be diverted into the linear-radial screen type of certified full capture device.

Maintenance will be conducted via a vacuum-assisted truck though a maintenance hatch.

The project will capture runoff from 199 acres, of which 6.8 acres are within Caltrans Right- of-Way and 2.6 acres are significant trash generating areas (STGA).

Schedule

153 of 493

CONCEPTUAL DESIGN - POTENTIAL LARGE FULL TRASH SYSTEM PROJECT Countywide Large Full Trash Capture Feasibility Evaluation October 2022
Project ID: SM101
Project Name: Pacific Boulevard, South of 41st
Project Location: City of San Mateo (37.5318, -122.29)
(Project also drains land area in the City of Belmont)
Site/Device Information
Proposed Device Type: Gross Solids Removal Device (GSRD) Project Description: Installation of GSRD device, such as those manufactured by Roscoe Moss, Inc, in the concrete box channel directly downstream of where the underground culvert daylights. This design would be similar to the City project currently under design near the Poplar Creek Golf Course. The GSRD device will be attached to a low flow weir or headwall and trash will be diverted into the linear-radial screen type of certified full capture device. Maintenance will be conducted via a vacuum-assisted truck though a maintenance hatch.

Site Specific Considerations:
• Gated location prevents public access/vandalism; fencing around the channel would need to be improved
• Existing pavement is suitable for maintenance equipment • Overhead utilities do not appear to impede maintenance at the site • Construction of full capture device would appear to have minimal hydraulic impact Comments/Notes: Project will require coordination with: 1) the property owner where the device is located; and 2) SF Bay Regional Water Board, which oversees water quality certification programs for creeks/channels in the Bay Area.

Drainage Area Information
Total Drainage Area: 199 acres
Caltrans Right-of-Way in Drainage Area: 6.5 acres
1-yr/1-hr Peak Flow (modeled): 52 cfs
# Small Full Trash Capture Devices that could be removed if Large Full Trash System is Constructed: San Mateo - 1
Total Municipal Trash Reduction Benefit
(New Benefit/Benefit from Replacement of Small Devices) • City of San Mateo – 5% (4.7%/0.2%)
Preliminary Cost Estimate
Design/Permitting
Construction
Construction Contingency
$50,000/$80,000
$400,000
$100,000
Total Capital $630,000
Annual Operation/Maintenance $7,500/yr
Proposed Project Location
Looking Downstream
Looking Upstream
San Mateo
Belmont
Roscoe Moss GSRD
Example Gross Solids Removal Device

154 of 493

$+
k
!
j
Laurel Creek
Creek or Channel
Caltrans Right-of-Way
k
!
j Proposed Device Location
Proposed Device Drainage Area
Stormdrain Catch Basin
$+ Stormdrain Outfall
Stormdrain Line
0 500 1,000
Feet
EOA, Inc. 5/4/23

155 of 493

#
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"
$
$
$
$
^_
Source: Esri, Maxar, GeoEye, Earthstar Geographics, CNES/Airbus DS, USDA, USGS, AeroGRID, IGN, and the GIS User Community, Esri, HERE, Garmin, (c) OpenStreetMap contributors, and the GIS user community ¯
0 750 1,500 2,250 3,000375
Feet
SR-82 City of San Mateo - SM1011
Legend
Trash Generation Rating (2022)
^_ Device Location
Drainage Area
$ Discharge Point
" Inlets
# Outfalls
City of San Mateo Boundary
Low (4.18 ac)
Moderate (2.65 ac)

156 of 493

23 157 of 493

24 158 of 493

25 159 of 493

26 160 of 493

1 Elton Yee
From: Yan, Qi@Waterboards <[email protected]>
Sent: Thursday, May 25, 2023 11:32 AM
To: Reid Bogert; Johansson, Kenneth H@DOT; Lichten, Keith@Waterboards; Jack Johnson; Jimmy H. Vo; Sven Edlund; Elton Yee; Chris Sommers; Rowley, Brian J@DOT; Martono, Wilfung@DOT; Takhar, Hardeep@DOT; Switzer, Steven; Chen, Terrence Cc: Chowdhury, Shaila K@DOT; Beauduy, Derek@Waterboards Subject: Re: San Mateo/Caltrans FTC Opp
EXTERNAL EMAIL. Links/attachments may not be safe.

Hello all,

Thank you for the City's and Caltrans' efforts to develop this trash control cooperative implementation project.

This email gives the Water Board’s acceptance of the cooperative trash capture project proposal described in your email below. Our approval of this cooperative project is also conditioned on submittal of the following information by the City and/or Caltrans once project planning and design is finalized, and prior to construction:

 Map(s) delineating the area draining to the trash capture devices. Maps should identify the areas and trash generation rating of Caltrans and municipal ROW to be controlled for trash by the device.  GIS mapping and/or as-built plans showing the storm drain system draining to the trash capture device. Storm drain information should correspond with the drainage area maps.  Breakdown of Caltrans and City’s ROW acres controlled by the device and the trash generation rating of those areas.
 Final design plans and calculations.
 Confirmation that the device meets the requirements of MRP Provision C.10 and is on the State Board list of approved trash capture devices.
 Final project agreements between Caltrans and the City. These should include identification of the party responsible for ongoing operation and maintenance of the device once installed. If operation/maintenance responsibilities are not described in the final agreements, provide this information as a separate document.

Please let us know if you have any questions or if there are significant changes to the project as the planning and design process moves forward.

Thanks,

Qi Yan, PhD
Water Resource Control Engineer
San Francisco Bay Regional Water Quality Control Board

(510) 622-2329

161 of 493

CITY OF SAN MATEO
4 3
8 7

CITY OF SAN MATEO
Agenda Report
City Hall
330 W. 20th Avenue
San Mateo CA 94403
www.cityofsanmateo.org
Agenda Number: 11 Section Name: CONSENT CALENDAR Account Number: 10-2313 File ID: 23-7827 TO: City Council
FROM: Alex Khojikian, City Manager
PREPARED BY: Human Resources Department
MEETING DATE: September 18, 2023
SUBJECT:

Deferred Compensation Program – Agreements
RECOMMENDATION:

Approve two agreements with Voya Retirement Insurance and Annuity Company Plan for Retiree Health Reimbursements Services at no additional cost.

BACKGROUND:

On March 16, 2015, the City Council approved a service agreement with Voya Financial Retirement Solutions (VOYA) to provide the City’s deferred compensation program for employees and retirees. The original agreement between the City of San Mateo and VOYA was for a five-year term from May 1, 2015 to April 30, 2020 with three 1-year extension options.

The Deferred Compensation Committee was formed in 2016 and consists of representatives from Human Resources, Finance, miscellaneous employees, safety employees, and retirees. The committee’s purpose is to monitor the ongoing plan compliance and benefits of the Deferred Compensation Plan, and it unanimously decided to begin a renegotiation process with VOYA.

After analyzing the results of the services questionnaire, we sent the results to VOYA and, with the recommendation from our insurance broker, we were satisfied with the enhancements VOYA proposed regarding their record-keeping, employee education, and customer services. They also offered a slightly lower overall fee for our employees. On July 20, 2020, Council authorized amendments to the agreement with VOYA Financial Retirement Solutions that extended services from May 1, 2020 to April 30, 2025. The amendment included a resolution to adopt the use of an alternative purchasing procedure.

VOYA also provides Health Reimbursement Account services by outsourcing it to Total Administrative Services Corporation (TASC). In the past few years, TASC has been underperforming and VOYA has resolved to discontinue TASC services. VOYA has also moved forward with a new in-house platform to provide these services in-house. The committee requests to allow VOYA to provide the Health Reimbursement Account services through their new platform. The two attached agreements reflect the change from VOYA outsourcing these services to TASC to now providing these services in-house.

BUDGET IMPACT:

There is no budget impact for approving these two agreements with VOYA Financial Retirement Solutions. The service costs are paid by the plan participants.

162 of 493

CITY OF SAN MATEO
4 3
8 7
ENVIRONMENTAL DETERMINATION:

This agreement approval is not a project subject to CEQA, because it is an organizational or administrative activity that will not result in direct or indirect physical changes in the environment. (CEQA Guidelines Section 15378(b)(5).)

NOTICE PROVIDED
All meeting noticing requirements were met.

ATTACHMENTS
Att 1 - Agreement for the 457 Plan
Att 2 - Agreement for the 401a Plan
Att 3 - VOYA 2020 Amendment- 457(b) Deferred Compensation Plan Att 4 - VOYA 2015 Administrative Services Agreement

STAFF CONTACT
Lorena Vargas, Senior Human Resource Analyst
[email protected]
(650) 522-7267

163 of 493

1 EMPLOYER SERVICES AGREEMENT

BY AND BETWEEN

VOYA RETIREMENT INSURANCE AND ANNUITY

COMPANY
AND
CITY OF SAN MATEO 501(c)(9) VEBA (“EMPLOYER”)
Effective Date: January 1, 2024

164 of 493

2 This EMPLOYER SERVICES AGREEMENT (the "Agreement'') is effective as of January 1, 2024 (the "Effective Date"), between Voya Retirement Insurance and Annuity Company ("Voya"), a corporation organized and existing under the laws of the State of Connecticut, directly and on behalf of its Affiliates, and City of San Mateo 501(c)(9) VEBA ("Employer"). Voya and Employer are each referred to as a "Party" and collectively as the "Parties" under this Agreement.

WITNESSETH:

WHEREAS, the Employer sponsors a Health Reimbursement Arrangement, as identified on Exhibit A, that is qualified under Sections 105 and 106 of the Internal Revenue Code of 1986; and WHEREAS, the Employer wishes to engage Voya as an administrative service provider to facilitate the administration of the HRA by providing administrative services; and WHEREAS, Voya agrees to provide the services set forth in this Agreement; and WHEREAS, the Parties desire to enter into an agreement to set forth their respective rights, duties and obligations with respect to the delivery of such services.

NOW, THEREFORE, in consideration or the mutual promises and covenants contained herein, it is hereby agreed as follows:

165 of 493

3 Section 1 – Definitions
When these terms are capitalized in the Agreement they have the meanings set forth below. The words may be singular or plural.
“Account” means the participant’s HRA (as defined below) administered using the Application or Services.
“Affiliate” means entities that currently exist or are later acquired that, directly or indirectly, (i) control, (ii) are controlled by, or (iii) are under common control with Voya or the Employer. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through the ownership or voting securities, by contract, or otherwise. “Application” means the web-based software application(s) and supporting services described in the Application Exhibit(s) attached hereto. For purposes of this Agreement, the singular “Application” refers to all web-based software applications to which the Employer and/or the Participant is granted access. “ERISA” means the Employee Retirement Income Security Act of 1974, as amended, and its associated regulations.
“HRA” means Health Reimbursement Account or Arrangement sponsored by the Employer. “IRC” means the Internal Revenue Code of 1986, as amended from time to time, and the regulations promulgated thereunder.
“IRS” means the Internal Revenue Service.
“Participant” means a person who has established and maintains an Account under the HRA. It is the Employer’s sole responsibility to notify Voya when a Participant becomes eligible to make claims for reimbursements pursuant to Section 6.1.
“PHI” shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, as applied to the information created, received, maintained or transmitted by Voya or its subcontractors from or on behalf of the HRA.
“Service Fees” shall include the fees set forth in Exhibit C to the Agreement. “Services” means administrative services as set forth on the Exhibit(s) that assist with processing and administration of Accounts and/or benefit plans/programs and includes the business processes used to deliver the Services.
“Systems” means the systems Voya owns or makes available to Employer to facilitate the transfer of information in connection with this Agreement.

Section 2 - Services
Section 2.1 Services. Voya, its Affiliates and its designated subcontractors will perform Services for the HRA as described herein in Exhibit B. All rights granted to, and all benefits received by, the Employer pursuant to this Agreement will extend to Employer's Affiliates.

166 of 493

4 enter into one or more subcontracting agreements in connection with the performance of the Services under this Agreement (together with BPAS and WEX, each, a “Subcontractor,” and collectively, the “Subcontractors”). Voya may also substitute another subcontractor for BPAS and/or WEX by providing advance written notice to Employer. Voya shall remain responsible for the performance of any Subcontractor. All references to Voya in this Agreement and Exhibits shall be deemed to include a Subcontractor unless otherwise specifically noted.

Section 3 - Employee Benefit Plans
Section 3.1 Responsibility for the Employer’s HRA. Any references in this Agreement to Voya "administering” the HRA or the Accounts are descriptive only and do not confer upon Voya anything beyond certain agreed upon ministerial duties being provided by Voya. Employer accepts total responsibility for its HRA for purposes of this Agreement, including its benefit design and compliance with any laws that apply to Employer or the HRA.

Section 3.2 Employer Initiated HRA Changes . Employer must provide Voya with written notice of any changes to the Employer’s HRA within sixty (60) calendar days prior to the effective date of the change to allow Voya to determine if such change will alter the Services Voya provides under this Agreement. Any material change in the Services must be mutually agreed to in writing by the Parties. For the avoidance of doubt, any changes to the HRA that do not alter the Services or Service Fees hereunder may be agreed to by the Parties via electronic communication, or such other form of written communication to which the Parties agree. Voya will notify Employer if (i) the change increases Voya’s cost of providing Services under this Agreement or (ii) Voya is reasonably unable to implement or administer the change. If the Parties cannot agree to a new Service Fee within thirty (30) days of the notice of the change, or if Voya notifies the Employer that Voya is unable to reasonably implement or administer the change, Voya shall have no obligation to implement or administer the change.

Section 3.3 HRA Consistent with this Agreement. By entering into this Agreement, Employer certifies that Voya’s Services will not conflict with the terms of any plan document, summary plan description, insurance policy, group funding agreement, or other applicable documents governing the HRA.

Section 3.4 Employee Communications. Before distributing any communications describing the HRA, Employer will provide Voya with copies of any such communications that refer to Voya or the Services prior to distributing these materials to Employer’s employees or third parties. Voya will provide any corrections or comments to the Employer in writing within a commercially reasonable time period after receipt. Employer agrees to amend the materials or communications if the references to Voya are not accurate, or any provision is not consistent with this Agreement or the Services that Voya is providing. Voya will not be bound by any communication that has not been reviewed and approved by Voya.

Section 3.5 Affiliated Employers. Employer represents that Employer and any of Employer's Affiliates covered under the HRA make up a single "controlled group" as defined by Section 1563 of the IRC and the regulations thereunder. Employer agrees to provide Voya with a list of Employer's Affiliates covered under the Plan upon request.

Section 4 - Employer's Responsibilities
Section 4.1 Information Employer Provides to Voya. Employer will inform Voya which of Employer's employees, their dependents and/or other persons are Participants. This information must be accurate and provided to Voya in a timely manner and in the format and specifications prescribed by Voya. Employer agrees to provide Voya (or cause Employer's vendor to provide Voya)

167 of 493

5 with all information that Voya reasonably requires to provide Employer's Participants with the Services as described in accordance with Exhibit B. Employer will notify Voya of any change to this information as soon as reasonably possible. Voya will be entitled to rely on the most current information in Voya's possession regarding eligibility of Participants in paying benefits from the Accounts and providing other Services under this Agreement. Voya shall not be responsible or liable for acts or omissions made in reliance on erroneous data provided by the Employer or any other person, including any Participant, or for the failure of Employer to perform its obligations under this Agreement. Any retroactive eligibility changes which impact claims for benefits from the Account will be mutually agreed upon by the Parties. If Voya agrees to make retroactive eligibility changes, additional reasonable Service Fees may apply, as mutually agreed. The Employer shall also ensure payroll data processors provide timely, accurate and complete data files in the prescribed electronic data file format and method specified by Voya or a Subcontractor, as applicable, in accordance with the Operating Procedures set forth in Exhibit D.

Section 4.2 Employer as Plan Administrator. The Employer or its delegate will exercise all discretion, control and authority with respect to the disposition of the HRA plan assets and the available benefits under the HRA.

Section 4.3 Employer’s Administrative Responsibilities . The Employer shall ensure that any plan documents and any other documentation, as applicable, relating to the HRA are appropriately completed, are in compliance with HRA requirements and all applicable law, and are appropriately and timely adopted. The Employer shall provide Voya with a current copy of such documents governing the administration of the HRA. The Employer shall be responsible for distributing summary plan descriptions, summaries of material modifications and all other plan documentation to Participants and other individuals on a timely basis. If the Employer chooses to use the Health Reimbursement Account specimen plan document provided by Voya, then it is the Employer’s responsibility to ensure that the specimen plan document complies with applicable state law.

Employer acknowledges that Voya (and its affiliates and subcontractors) are not authorized to provide legal or tax advice and no service, communication or other act or omission by Voya should be construed as legal or tax advice.

Section 4.4 Notices to Participants. Employer will give Participants the information and documents they need to obtain benefits under the Plan within a reasonable period of time before benefits under the Plan begins. In the event this Agreement is terminated, Employer will notify all Participants that the Services Voya is providing under this Agreement are discontinued. Employer agrees that if it becomes unable to pay claims as they become due in accordance with this Agreement, it will promptly notify participants.

Section 4.5 Escheatment. Employer is solely responsible for complying with all applicable abandoned property or escheat laws, making any required payments, and filing any required reports.

Voya shall provide its standard reports to Employer in order to support Employer’s escheatment process, if applicable.

Section 4.6 Tax Reporting. If applicable, Employer is solely responsible for any W-2 and any other tax reporting to the IRS regarding any Account. Voya and its Affiliates do not assume any responsibility for compliance with federal or state laws, including federal tax laws and regulations, applicable to the Employer or the HRA.

168 of 493

6 subpoenas or other legal process; and (v) notices concerning adjudication of Participants’ claims for benefits. Exhibits B and C and the elections made by the Employer in the HRA Questionnaire shall be deemed to be a standing Employer Direction.

Section 4.8 Reliance. Voya may rely upon and comply with any Employer Direction in performing its obligations under this Agreement. If and to the extent that Voya acts or fails to act as a result of reasonable reliance upon any Employer Direction or any information, data, document or instrument supplied by Employer or a Participant, Voya shall be relieved of any liability arising therefrom and such act or failure to act shall not constitute a default, breach or nonperformance of any warranty or obligation of Voya contained in this Agreement; provided, however, that Voya shall not be relieved of any liability arising out of or resulting from dishonest, fraudulent, or criminal acts of Voya’s employees, acting alone or in collusion with others. If Voya requests instruction or direction from Employer and does not receive a Employer Direction in a timely manner, Voya shall be deemed not to have breached this Agreement with respect to any act or failure to act undertaken in good faith relating to the instructions requested.

Section 4.9 Conflict with Agreement. If any Employer Direction is inconsistent with or conflicts with any provision of this Agreement, Voya may, at its discretion, require that such Employer Direction be confirmed in writing (via email or otherwise) by an authorized representative of Employer.

Section 5 – Investment Options
Section 5.1 Selection of Investment Options. Employer shall be solely responsible for the selection of all investment options available to Participants in the HRA. Voya shall have no responsibility or discretion under the terms of this Agreement for the prudence, selection or oversight of any investment options available to Participants in the HRA. Employer acknowledges and agrees that (i) all investment information or investment materials that may be provided to Employer are provided to enable Employer to independently assess available options and make investment decisions for the Plans and (ii) the provision of any such information or materials is not intended to constitute nor should it be construed as the provision of investment advice or investment recommendations by Voya with respect to any investment option that Employer may consider making available under the Plans. Participants shall have the ability to choose their investment allocations and to make participant-directed transfers between investment options, subject to any limitations of the investment platform.

Section 5.2 Investment Advice . Neither Voya nor any of its Affiliates is an investment advice fiduciary (as defined under ERISA, as applicable, or applicable state law) with respect to the Participants nor will Voya or its Affiliates provide any investment advice to the Participants or be responsible or liable for the investment decisions of the Participants. Voya is not giving, and shall not be deemed to have given, the Employer or a Participant legal, tax, or financial advice concerning any of the matters relating to this Agreement or the HRA.

Section 5.3. Modifications to Investment Options. In order to confirm an investment option selected by the Employer can be recordkept, the addition or removal of any investment option to the Plan requires at least sixty (60) calendar days advance written notice of the proposed change in a format prescribed for the process. The change must be mutually agreed and will be made in accordance with a mutually agreed upon schedule for implementing the change. In the event the investment option is not currently traded by the investment platform, the investment option will be made available to implement within sixty (60) days after the execution of a new fund agreement between the Subcontractor and the mutual fund company. The Employer is responsible for reviewing all requirements and restrictions imposed by the mutual fund company and verifying that requirements and restrictions will be met.

Section 6 – Services and Error Correction

169 of 493

7 Section 6.1 Employer Eligibility Determinations . As set forth in Section 4.1, the Employer, in its sole discretion, shall determine which individuals are eligible to participate in the HRA and shall provide Voya with timely, accurate, and complete initial and ongoing enrollment and eligibility data in the electronic data file format prescribed by Voya. Such information shall include, but is not limited to, the number and names of individuals eligible for and covered under the HRA, eligibility for making claims for benefits, and any other information determined by Voya to be necessary to provide the Services. Voya shall process initial and ongoing enrollment and eligibility data submitted by the Employer in the format and specifications prescribed by Voya during the implementation process.

Voya shall also process enrollment data and benefit elections submitted by the Employer through proper methods established by Voya. The Employer shall provide timely notifications regarding a Participant’s eligibility to make claims for benefits.

Section 6.2 Voya’s Responsibilities . Voya shall provide certain Services in connection with the HRA. Accordingly, the Employer authorizes Voya to use Voya’s standard procedures for the provision of Services that have been designed to ensure that the administration of the HRA. Voya shall not have discretionary authority or discretionary controls respecting any aspect of plan administration or the management of any trust fund and shall not have authority to exercise, nor exercise, any control respecting management and shall not render investment advice with respect to any money or other property of any trust fund.

Section 6.3 Business Associate Agreement. All handling and processing of PHI shall be subject to and comply with the Business Associate Agreement attached herein as Exhibit E ("BAA"). In the event of a conflict between the terms and conditions of the BAA and the terms and conditions of this Agreement, the terms and conditions of the BAA shall govern. Voya shall, with respect to any PHI: (1) comply with the BAA; (2) make no attempt to identify PHI that has been fully or partially de-identified (such as encoded data); and (3) not contact the individuals to whom the PHI pertains except to the extent it is permitted to do so under this Agreement or the BAA.

Section 6.4 Claims Processing . Voya shall process reimbursement claims and appeals in the manner required under the Plan document, or to the extent a claims procedure is not provided for in the Plan document, Voya’s claims procedure. Voya is not responsible for processing any appeal of any claim beyond the first level appeal. The Employer is responsible for accepting the auto adjudication procedures to be used in connection with certain payments to be made using the stored value card technology. Voya will process payments of claims and other requests for payment according to requirements specified by IRS regulations. Neither Voya nor its Affiliates have any discretionary authority or control relating to the administration of any Employee Benefit Plan.

Section 6.5 Payments. Voya shall issue payments for HRA-eligible expenses on behalf of a Participant directly to the health provider or shall issue a reimbursement payment for HRA-eligible expenses through either check or direct deposit to the Participant, as directed by the Participant.

Voya will process debit card transactions and authorize payments made directly to approved payees (e.g., health care providers, drugstores or qualifying merchants) via a debit card, if requested by the Employer.

Section 6.6 Services/Changes. The Services provided by Voya are generally described in Exhibit B.

Any changes to such Services require the written consent of both Parties.

Section 6.7 Error Correction.

170 of 493

8 approval of the correction to be applied to such error. Voya processes investment instructions on an “omnibus” or aggregated basis. If Voya’s correction of a Voya processing error results in a loss to the HRA or its Participants, Voya will absorb the loss. If any gain results in connection with the correction of a Voya processing error, Voya will net any such gain against other losses absorbed by Voya and retain any resulting net gain as a component of its compensation for transaction processing services, including its agreement to make Plan and Participant Accounts whole for losses resulting from Voya processing errors.

6.7.2 Employer Error. Employer shall promptly notify Voya after becoming aware of an error resulting from the acts or omissions of Employer, its agents or third parties, or otherwise caused by the negligent acts of Employer, its agents or third parties. Voya will attempt to correct such errors at Employer’s expense, which shall be agreed upon by the parties in advance and also be subject to Voya’s receipt of all data reasonably necessary to make such correction.

Section 6.8 Errors of Other Service Providers . Voya shall bear no obligation or responsibility for liability, claims, damages, costs and expenses caused by, arising from or related to any act or omission including, but not limited to, errors, mistakes, willful misconduct, bad faith, fraud, negligent acts or omissions of any trustee, custodian, broker/dealer, insurance company, mutual fund company, third party administrator, prior recordkeeper or any other entity that provides, or has provided, services to the Plan.

Section 7 - Service Fees
Section 7.1 Service Fees. Participant will pay for Voya's Services in accordance with the Service Fees listed in Exhibit C. In addition to the Service Fees specified in Exhibit C, upon prior written notice, Employer shall also pay Voya any additional fee that is authorized by a provision elsewhere in this Agreement if applicable.

Any new Service Fee required by such change will be effective as of the date the changes occur. Voya will provide Employer with a new Exhibit C that will replace the existing Exhibit C or an amendment stating the new Service Fees. If Employer does not agree to any change in Service Fees, then Employer may terminate this Agreement upon written notice. Such termination must be sent by Employer within thirty (30) days after Employer receives written notice of the new Service Fees and the Employer’s written notice must state when such termination shall become effective. Employer must still pay any Service Fees due for the periods during which the Agreement is in effect.

Section 8 – Funding Benefits
Section 8.1 Funding of Benefits. Employer is solely responsible for transmitting the Account contributions on a schedule and in the form to be agreed upon by the Parties as set forth on Exhibit D.

Employer shall cause the funds to be deposited into or credited to the Account of each Participant and provide accompanying data, which accurately indicates each Account (and Account source, as applicable) that will be funded or credited and the dollar amount to be funded or credited to each such Account (and Account source, as applicable). Any payroll deduction or other contributions to a funded Account shall be contributed directly to the Account of the Participant pursuant to the Employer’s direction. Employer will provide clear instructions regarding crediting amounts to each Participant’s Account. In the event that Employer’s instructions are unclear or ambiguous, a reasonable interpretation of the instructions will be accepted. Neither Voya nor its Affiliates or Subcontractors shall have any

171 of 493

9 liability for any funds not received or for any errors in crediting Accounts based on the data provided by Employer
Section 9 – Term of the Agreement
Section 9.1 Term. This Agreement shall commence on January 1, 2024, and, unless sooner terminated as set forth in this Section 10, shall continue for an initial term of Five (5) years (“Initial Term”). Following the expiration of the Initial Term, this Agreement shall automatically renew for subsequent 5-year periods unless either the Employer or Voya provides written notice to the other party of its intent not to renew this Agreement at least ninety (90) calendar days before the end of the then current term. The Initial Term and any renewal terms constitute the “Term.”
Section 10 – Termination
Section 10.1 Termination Events.

10.1.1 Either Party may terminate this Agreement immediately upon notice to the other Party, if the other Party (i) materially breaches this Agreement, and fails to remedy such breach within sixty (60) days after receiving notice of the breach from the other Party; (ii) materially breaches this Agreement in a manner that, upon mutual agreement of the Parties, cannot be remedied; (iii) commences bankruptcy or dissolution proceedings, has a receiver appointed for a substantial part of its assets, or ceases to operate in the ordinary course of business.

10.1.2 Voya may terminate this Agreement immediately upon notice to Employer if Employer fails to provide the required funds for payment of benefits under the terms of this Agreement.

10.1.3 Either party may terminate this Agreement immediately upon notice to the other Party if any state or other jurisdiction prohibits a Party from administering the Accounts under the terms of this Agreement; or imposes a material penalty on Employer or Voya, and such penalty is based on the administrative Services specified in this Agreement. In such case, the Party may immediately discontinue the Agreement’s application in such state or jurisdiction. Notice must be given to the other Party when reasonably practical. The Agreement will continue to apply in all other states or jurisdictions, or as otherwise specified in this Agreement.

Section 10.2 Termination for Convenience. At any time following the Initial Term, either the Employer or Voya may terminate this Agreement upon at least ninety (90) calendar days’ advance written notice to the other party. The Employer and Voya may also mutually agree in writing to terminate this Agreement at any time.

Section 10.3 Cooperation with Transfer. In the event of any termination of this Agreement, Voya shall cooperate with Employer in the transfer of Voya’s obligations hereunder to a replacement service provider (“Transition Assistance”). Unless otherwise agreed, Employer shall compensate Voya and shall reimburse Voya for all out-of-pocket expenses incurred in providing Transition Assistance as mutually agreed to by the Parties.

Section 11 – Records and Information
Section 11.1 Records. Voya will keep records relating to the Services Voya provides under this Agreement for as long as Voya is required to do so by law.

Section 11.2 Access to Information. If Employer needs information in Voya’s possession for lawful or

172 of 493

10 legitimate purposes other than an audit, Voya will provide Employer access to such information, if it is legally permitted to do so and the information relates to Voya’s Services under this Agreement, provided the Employer gives Voya reasonable advance notice and an explanation of the need for such information.

Employer represents that Employer has reasonable procedures in place for handling PHI, as required by law. Employer will only use or disclose PHI as permitted under this Agreement or by applicable laws.

Voya will provide information only while this Agreement is in effect and for a period of six (6) months after the Agreement terminates, unless Employer demonstrates that the information is required by law. Voya also will provide reasonable access to information to an entity providing Plan administrative services or consulting services to Employer to enable such entity to provide Plan administrative services or provide consulting services to the Employer, as the case may be, upon the request of the Employer. Before Voya provides PHI to such entity, the parties (i.e. entities that provide Plan administrative services or provide consulting services to Employer), must sign a mutually agreed-upon confidentiality agreement, on terms reasonably acceptable to the Parties.

Section 11.3 Voya’s Knowledge. Except as expressly set forth herein, this Agreement will not be construed to transfer or assign any of Voya’s rights or proprietary interests in any materials, knowledge, processes, methodologies, formats, or other types of intellectual property that are possessed and owned by Voya prior to the time it begins to provide Services hereunder and independent of the performance of Services hereunder.

Section 11.4 Proprietary Business Information. Each Party will limit the use of the other’s Proprietary Business Information to only the information required to administer the Accounts, to perform under this Agreement, or as otherwise permitted under this Agreement. Neither Party will disclose the other’s Proprietary Business Information to any person or entity other than to the disclosing Party’s employees, subcontractors, or representatives needing access to such information to administer the Accounts, to perform under this Agreement, or as otherwise permitted under this Agreement, except that Voya’s financial Proprietary Business Information cannot be disclosed to any third party without Voya’s express written consent. This provision shall survive the termination of this Agreement.

Section 11.5 Publicity and Use of Voya/Employer Content. The Parties will not use the other Party’s or their Affiliates’ names, trademarks, trade names, service marks, logos, or other brand marks (collectively the “Marks”) without the other’s prior written approval, which may be withheld in that Party’s sole discretion. The Parties will instruct all Personnel of this prohibition. Each Party acknowledges that the Marks and all rights therein belong exclusively to the original Party and their Affiliates, and that this Agreement does not confer upon the other Party any rights, goodwill, or other interest in the other Party’s Marks. Each Party recognizes the validity of the Marks and will not at any time (i) contest, impair, or jeopardize in any way the other Party’s and their Affiliates’ right, title, and interest in and to the Marks; (ii) cause the validity or enforceability of the Marks or their ownership thereof to be called into question; or (iii) invalidate, impair, tarnish, disparage, degrade, dilute, or injure the Marks (or the goodwill associated therewith) or the reputation of the other Party or their Affiliates. Each Party will not, and will cause all their Personnel not to, make any “case study,” testimonial, press release, or other public announcement regarding this Agreement or any activities performed hereunder. If a Party requires the use of the other Party’s Marks in order to provide Services under this Agreement, the other Party grants a limited, revocable, non-transferable, non-exclusive license to use the Marks solely as required to provide Services as further described herein. The Marks may be used and displayed only in the form approved by the Party in writing, which may be amended from time to time. If applicable, the Party may provide written branding standards and requirements with respect to the use of its Marks, and the other Party will comply with all such branding standards and requirements. Upon the termination or expiration of this Agreement or the earlier request of a Party, the other Party will return all Marks to or destroy them, as directed.

Section 11.6 PHI. The Parties’ obligations with respect to the use and disclosure of PHI are outlined in the Business Associate Addendum attached to this Agreement as Exhibit E.

173 of 493

11 Section 12 – System Access
Section 12.1 System Access. Voya grants Employer the nonexclusive, nontransferable right to access and use the functionalities contained within the Systems, under the terms specified in this Agreement. Employer agrees that all rights, title, and interest in the Systems and all rights in patents, copyrights, trademarks, and trade secrets encompassed in the Systems will remain Voya’s. To obtain access to the Systems, Employer will obtain, and be responsible for maintaining, at no expense to Voya, the hardware, software, and Internet browser requirements Voya provides to Employer, including any amendments thereto. Employer will be responsible for obtaining an Internet Service Provider or other access to the Internet. Employer will not (i) access Systems or use, copy, reproduce, modify, or excerpt any Systems documentation provided by Voya in order to access or utilize Systems, for purposes other than as expressly permitted under this Agreement or (ii) share, transfer or lease Employer’s right to access and use Systems, to any other person or entity that is not a Party to this Agreement without Voya’s consent. Employer may designate any third party to access Systems on Employer’s behalf, provided the third party agrees to these terms and conditions of Systems access and Employer assumes joint responsibility for such access.

Section 12.2 Security Procedures. Employer will use commercially reasonable physical and software-based measures to protect the passwords and user IDs provided by Voya for access to and use of any web site provided in connection with the services. Employer shall use commercially reasonable anti-virus software, intrusion detection and prevention system, secure file transfer and connectivity protocols designed to protect any email and confidential communications provided to Voya, and maintain appropriate logs and monitoring of system activity. Employer shall notify Voya within a reasonable timeframe of any (a) unauthorized access or damage, including damage caused by computer viruses resulting from direct access connection, to the System, and (b) misuse and/or unauthorized disclosure of passwords and user IDs provided by Voya which impact the System.

Section 12.3 System Access Termination. Voya reserves the right to (i) terminate any Employer’s System access in the event that such Employer user fails to accept the hardware, software and browser requirements provided by Voya, including any amendments thereto; and (ii) terminate any Employer administrative user’s System access (but not Participants’ system access) immediately on the date Voya reasonably determines that Employer or a third party designated by Employer to access the Systems on Employer’s behalf has materially breached any provision of this Agreement.

With respect to subsection (ii) above, Employer’s Systems access will be reinstated immediately if Voya determines, in its reasonable discretion, that Employer has corrected the problem, provided reasonable assurances that the material breach is not likely to reoccur and is in alignment with applicable laws and regulations. If Voya terminates Employer’s System access, pursuant to subsection (ii) above, Voya will provide an alternative to accessing the data that Employer would have accessed through the System. Employer’s System access will terminate upon termination of this Agreement. Upon any of the termination events described in this Agreement, Employer agrees to cease all use of Systems, and Voya will deactivate Employer’s identification numbers, passwords, and access to the System as soon as administratively feasible.

174 of 493

12 unreasonably withheld, conditioned or delayed), settle, compromise, or consent to the entry of any judgement in any pending or threated claim, action, or proceeding in respect of which indemnification is sought under this Agreement. Employer will reasonably cooperate with Voya in the defense and/or settlement of any such claim.

Except as expressly prohibited by applicable law, Employer shall indemnify and hold harmless Voya, its Affiliates, assigns, directors, officers, employees, agents, and its Subcontractors (the “Voya Parties”) from and against claims resulting from or arising out of breach of this Agreement by Employer or its employees including with respect to gross negligence or willful misconduct, employment-related decisions, or any claims or liabilities relating to work status, compensation, tax, insurance, or benefits by Employer’s employees under this Agreement. This includes any third-party claims brought against Voya Parties as the claims administrator, or due to the Employer's failure to act in accordance with applicable provisions of the IRC and associated guidance issued by the IRS with respect to the HRA, including, but not limited to, any reporting requirement; and/or claims against Voya Parties relating to the HRA utilized by Employer's employees. Employer's obligation to indemnify Voya Parties will only apply if the Voya Party notifies Employer promptly, in writing, as to any such claim and gives Employer the right to control and direct the investigation, preparation, defense, trial and settlement of each such claim. Voya Parties will reasonably cooperate with Employer in the defense and/or settlement of any such claim. The indemnification obligations of a Voya Party and Employer shall terminate upon the expiration of the Agreement except as to any matter concerning which a claim has been asserted by notice to the other Party by at the time of such expiration or within the applicable statute of limitation after the effective date of Agreement termination.

Section 14 - Confidential Information
Section 14.1 Voya Data Security Addendum. The Parties acknowledge that Voya has a Data Security Addendum in place as attached hereto in Exhibit F, which shall govern the treatment of Confidential Information (as such term is defined in Exhibit F). Voya reserves the right to modify the Data Security Addendum in whole or in part at any time and without prior notice to the Employer. Voya shall provide an updated Data Security Addendum to the Employer upon request. For purposes of the Data Security Addendum, the “Client” is the Employer.

Section 15 – Limitations on Liability
SECTION 15.1 INDIRECT DAMAGES. SUBJECT TO THE EXCLUSIONS SET FORTH BELOW, AND TO

THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY,

ITS AFFILIATES OR PERSONNEL BE LIABLE FOR ANY INCIDENTAL, CONSEQUENTIAL, SPECIAL,

EXEMPLARY, PUNITIVE OR OTHER INDIRECT DAMAGES ARISING OUT OF OR RELATED TO THIS

AGREEMENT, REGARDLESS OF THE CAUSE OF ACTION, WHETHER IN CONTRACT, TORT OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

SECTION 15.2 CUMULATIVE LIABILITY. SUBJECT TO THE EXCLUSIONS SET FORTH BELOW, AND

TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE TOTAL CUMULATIVE

LIABILITY OF EACH PARTY, ITS AFFILIATES AND PERSONNEL ARISING OUT OF OR RELATED TO

THIS AGREEMENT, REGARDLESS OF THE CAUSE OF ACTION, WHETHER IN CONTRACT, TORT OR

OTHERWISE AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, SHALL BE LIMITED

TO THE TOTAL FEES PAID BY EMPLOYER TO VOYA FOR THE SERVICES SET FORTH HEREIN DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO ANY LIABILITY. THE EXISTENCE OF ONE OR MORE CLAIMS OR SUITS SHALL NOT ENLARGE THIS LIMIT.

SECTION 15.3 EXCLUSIONS. THE LIMITATIONS ON LIABILITY SET FORTH ABOVE SHALL NOT APPLY TO, OR LIMIT THE LIABILITY OF A PARTY, ITS AFFILIATES OR PERSONNEL FOR: (A) A MATERIAL BREACH OF ITS CONFIDENTIALITY AND SECURITY OBLIGATIONS; (B) ITS INDEMNIFICATION AND DEFENSE OBLIGATIONS UNDER THIS AGREEMENT; OR (C) GROSS NEGLIGENCE, FRAUD, OR

175 of 493

13 WILLFUL OR INTENTIONAL MISCONDUCT.

Section 16 – General Provisions
Section 16.1 Independent Contractor Relationship. Voya is an independent contractor of Employer, and this Agreement will not be construed as creating a relationship of employment, agency, partnership, joint venture, or any other form of legal association. Neither Party has any power to bind the other Party or to assume or to create any obligation or responsibility on behalf of the other Party or in the other Party’s name.

Section 16.2 Assignment. No Party may, without the prior written consent of the other Party, assign any of its rights or delegate any of its duties under this Agreement. Any attempted assignment without the other Party’s consent will be void and invalid. Notwithstanding the foregoing, Voya may assign its duties under this Agreement to a Subcontractor without prior written consent of the Employer. Employer may, upon written notice to Voya and at no additional charge to Employer, assign this Agreement to an Employer Affiliate; to any entity that acquires all or substantially all of Employer’s assets or capital stock or results from one or more mergers or initial public offerings or any other corporate reorganization; or to the purchaser of any Employer Affiliate, including the purchaser of any division, department, or line of business of such Employer Affiliate.

Section 16.3 Severability. If a court of competent jurisdiction finds any provision of this Agreement invalid or unenforceable in any circumstances, such provision will be enforced to the maximum extent permissible, and the remainder of this Agreement, and the application of such provision in any other circumstances, will not be affected thereby.

Section 16.4 Governing Law. This Agreement will be governed by, construed, and enforced in accordance with the laws of the State of California, excluding its principles of conflicts of law. The Parties hereby irrevocably and unconditionally consent to the exclusive jurisdiction of the courts of the State of California and the courts of the United States of America located in the State of California for any actions, suits, or proceedings arising out of or relating to this Agreement and the transactions contemplated hereby (and each Party agrees not to commence any action, suit, or proceeding relating hereto except in such courts), and further agree that service of any process, summons, notice, or document by U.S. registered mail, return receipt requested to the address set forth above, will be effective service of process for any action, suit, or proceeding brought against a Party in any such court. The Parties agree that the Uniform Computer Information Transactions Act or any version thereof adopted by any state in any form (“UCITA”) will not apply to this Agreement. To the extent that UCITA is applicable, the Parties agree to opt out of the applicability of UCITA pursuant to the opt-out provision(s) contained therein. THE

PARTIES HEREBY WAIVE TRIAL BY JURY IN ANY ACTION, SUIT, PROCEEDING, OR

COUNTERCLAIM BROUGHT BY EITHER OF THEM AGAINST THE OTHER PARTY HERETO IN ANY MATTERS ARISING OUT OF OR IN ANY WAY CONNECTED WITH THIS AGREEMENT.

Section 16.5 Dispute Resolution. All disputes between the Parties arising out of this Agreement will first be submitted for informal resolution between the designated officers of Employer and Voya. If the Parties are still unable to reconcile their differences, they may seek relief from a court of competent jurisdiction. The foregoing will not be construed to prohibit either Party from directly seeking injunctive relief without first complying with this Section.

Section 16.6 Construction of Agreement. This Agreement will not be presumptively construed for or against either Party. Section titles are for convenience only. As used in this Agreement, “will” means the same thing as “shall,” and the words “include,” “includes,” and “including,” will always be construed as if followed by the words “without limitation.”
Section 16.7 Changes and Modifications. The terms and conditions of this Agreement and any other

176 of 493

14 documents referenced herein may not be amended, waived, or modified, except in a writing signed by authorized representatives of both Parties or as otherwise provided in this Agreement.

Section 16.8 Survival. Those provisions of this Agreement that, by their nature, are intended to survive the termination or expiration of this Agreement will remain in full force and effect following the termination or expiration of this Agreement. Such provisions include Term and Termination; Payment; Intellectual Property Rights and Reports; Confidential Information Indemnification; Exclusion of Damages and Remedies; Non-Solicitation; and Governing Law; Venue – Entire Agreement.

Section 16.9 Waiver/Consent. Failure by either Party to exercise or enforce any right under this Agreement, no matter how long the same may continue, will not be deemed a waiver of such right by such Party. No waiver of any provision of, or consent to any breach of, this Agreement will be deemed a waiver of any other provision of, or consent to any subsequent breach of, this Agreement.

A Party’s consent to or approval of an act or omission on any one occasion will not be deemed a consent to or approval of said act or omission on any subsequent occasion, or a consent to or approval of any other act or omission on the same or any subsequent occasion. To be effective, a Party’s waiver of any right or remedy must be documented in a writing signed by the waiving Party.

Section 16.10 No Third Party Beneficiaries. Nothing in this Agreement will confer any right, remedy, or obligation upon anyone other than Employer, the Employer’s Affiliates, Voya, and Voya’s Affiliates.

Section 16.11 Notices. All notices relating to this Agreement must be in writing and must reference this Agreement. Such notices will be deemed sufficient if sent (i) by postage-prepaid registered or certified U.S. mail, then five business days after sending; or (ii) by commercial courier, then at the time of receipt confirmed by the recipient to the courier on delivery. All notices to a Party will be sent to its address set forth below, or to such other address as may be designated by that Party by notice to the other Party.

If to Voya: With copy to:

Voya Retirement Insurance and
Annuity Company
Attn: Law Department
One Orange Way
Windsor, Connecticut 06095
Voya Financial, Inc.

Employee Benefits
20 Washington Ave. S.

Minneapolis, MN 55401
If to Employer: With copy to:

City of San Mateo 501(c)(9) VEBA
330 W. 20th Avenue
San Mateo, CA 94403

Section 16.12 Counterparts. This Agreement may be executed in one or more counterparts, each of which will be deemed an original, and all of which together constitute a single agreement.

177 of 493

15 restrictions, strikes, freight embargoes, failure of a common carrier, breach of contract by suppliers or others, computer downtime, telephone system outage, delays or failures of access involving the Internet, World Wide Web or similar services including network traffic and configuration problems therewith, or unusually severe weather, labor disputes, and call demand in excess of telephone capacity or operator capacity and similar occurrences; or (ii) the acts or omissions of the other Party, including in the case of Voya, its reliance upon the Employer’s or information, data documents or instruments provided by Employer or any Participant, provided, however, that in every such case the failure to perform must be beyond the reasonable control of the non-performing Party.

Section 16.14 Entire Agreement. This Agreement, including all exhibits and documents referenced herein, constitutes the entire agreement between the Parties with respect to the subject matter hereof, and supersedes and replaces all other prior agreements, communications, and understandings (written and oral) regarding its subject matter. Terms and conditions on or attached to quotes, Employer Purchase Orders, or preprinted forms will be of no force or effect, even if acknowledged or accepted by Employer.

VOYA RETIREMENT INSURANCE AND ANNUITY COMPANY
By
Authorized Signature
Print Name
Print Title
City of San Mateo 501(c)(9) VEBA
By
Authorized Signature
Print Name
Print Title

178 of 493

18 EXHIBIT A – HEALTH REIMBURSEMENT ACCOUNT PLAN NAME(S) CITY OF SAN MATEO 501(C)(9) VEBA

179 of 493

18 EXHIBIT B – SERVICES
This Exhibit B is attached to and made a part of the Employer Services Agreement between Voya and Employer. If not otherwise defined, capitalized terms in this Exhibit A have the same meaning as in the Employer Services Agreement.

Overview of the Plan Services
Under the Plan, Voya provides administrative, customer and recordkeeping services to Employer and the Participants in connection with the Accounts. These services include:

General:
•Implementation of web-based Application and supporting services, including periodic updating with changes in status, connecting Participants to Accounts through the Application. •Prepare Plan document and Trust document, if applicable, for Employer approval. Employer is responsible for ensuring that any documents provided by Voya comply with applicable law. •Completing enrollment set up and ongoing Account maintenance of Participants on the Application. •Provide standard communication and education material to participants and Employers. •Provide Employer Portal with access to summary and detailed plan level reporting. Custom reports available upon request, and may be subject to an additional fee. •Provide HRA Participant Portal for access to Account information and transactional capabilities for plan investments and claims reimbursements.
•Provide a toll-free call center to support HRA plan-related questions from both participants and employers •Provide participants instructions for online Account registration to the HRA Participant portal. •Electronic delivery (referred to as “Go Green”) and posting of participant quarterly statements, confirmations, and other notices in the HRA Participant Portal. Participants may opt out of electronic delivery in the HRA Participant Portal and elect to receive documents via U.S. mail subject to an additional monthly fee.
•Provide instructions and requirements to Employer regarding payroll and census process, contribution submission, funding transmittal instructions, and any other applicable Employer responsibilities. Information is included in Attachment D (Operating Procedures).
•Posting of Plan contributions received from Employer in accordance with the requirements in Attachment D (Operating Procedures) to each Participant’s Account.
•Update participant-level demographic, Account information, and employment status changes for active Participants using data provided by the Employer.
•Update participant-level demographic and account information for Participants who have been identified as terminated by the Employer, using data provided by the Participant. •Provide Participants, upon eligibility for medical expense reimbursements, with access to a debit card as a payment method, if requested by Employer.

180 of 493

19 •Processing reimbursement claims and first-level appeals in the manner required under the Plan document, or to the extent a claims procedure is not provided for in the Plan document, Voya’s claims procedure, as applicable.
•Receiving and adjudicating for payment, claims and other requests for payment in accordance with IRS guidance regarding substantiation, the terms of the Accounts, and any written claim procedures or other practices established by the Employer and communicated to Voya. •Perform discrimination testing, if elected by the Employer, to assist Employer in complying with federal qualifications for HRAs. Employer shall provide all information necessary to complete such testing. Should the HRA plan fail any applicable nondiscrimination tests, the Employer must provide direction on corrective actions for the plan.
•Prepare signature ready IRS Form 990 Series and disclosure forms, as required

181 of 493

20 EXHIBIT C – FEES
This schedule applies for the term of the contract and may be updated at the time of renewal.

Fees are based on standard communications and file formats. Any special mailings, file modifications, plan rebuilds (changes to the plan once implementation has been completed) or custom reporting may be assessed an additional fee. Fees also reflect that the current administrator will facilitate outstanding claims reimbursement requests.

Direct Compensation
Annual Asset Based Fee: This fee is deducted in monthly installments from each Participant’s Account.

Annual Asset Based Fee: 0.10%
This fees applies on:
☐ All investment options, including Voya Fixed Account OR
☒ Mutual fund investment options only
Annual Per Participant Fee: This fee is deducted in monthly installments from each Participant’s Account.

Annual Per Participant Fee Actively Employed (Non-claims active) Participants : $30.60 Annual Per Participant Fee for Terminated/Separated from Service (Claims Active) Participants:
$30.60
Ancillary Participant Fees:

Replacement Debit Cards: There is no fee for replacement debit cards •Two initial debit cards are provided at no fee
Participant Election of Mailed Statements: $0.50 per month deducted from each Participant’s Account
•Electronic delivery of statements, confirmations, and notices are provided at no fee Debit Card Customization- Employer Fees:
•Co-branded Debit Card: $500 one-time charge
•Private label card: $3,000 one-time charge and $0.50 per card at time of fulfillment (requires minimum order of 10,000 cards)
Indirect Compensation
Fund Revenue and Float: Voya, an Affiliate or Subcontractor has entered into contracts with certain investment funds and fund service providers (the “Funds”) pursuant to which such Funds compensate

182 of 493

21 Voya, an Affiliate or Subcontractor, as applicable, for administrative and sub-transfer agency functions performed by Voya, an Affiliate or Subcontractor. Any fund revenue payable by the Funds shall be paid to Voya, an Affiliate or Subcontractor, as applicable. In addition, one or more bank accounts may be established, either directly or through a custodian or other Subcontractor, to hold (i) contributions pending investment direction and/or (ii) amounts pending distribution from the HRA. Any earnings credited to a Voya, an Affiliate or Subcontractor based on amounts held in the Accounts (“float”) shall constitute a part of overall compensation for the Services.

183 of 493

22 EXHIBIT D – OPERATING PROCEDURES
Subcontractor (and to the extent applicable, Voya) shall coordinate with the Employer and the Employer’s payroll vendor, as necessary, to initiate electronic reporting of contributions, using the standard file layout provided and in accordance with operating procedures. Once Subcontractor begins to receive electronic reporting of contributions, contribution processing may begin. The following steps must be completed to initiate each contribution to the Plan:

Submission of Contribution Data:

1. Employer submits contribution data through Subcontractor’s secure file transfer method for the payroll application.

2. Subcontractor processes contribution data received.

3. Contribution data must be received in Good Order in order for contributions to be processed.

Verification of Contribution Data:

1. Subcontractor will send a notification to Employer via email to the Payroll Contact the Employer has identified for the Plan stating that the payroll data is ready for approval. Upon receipt of notification, Employer must log into the payroll tool to review contribution totals and electronically sign-off/approve verifying the integrity of the contribution data provided for the contributions.

2. In addition, by signing-off and approving the contribution data, the Plan Sponsor signifies to Subcontractor that contribution funds have been made available for Subcontractor to complete the transaction.

3. Employer’s electronic sign-off/approval of contribution data must be received by Subcontractor for contributions to be processed.

Transmittal of Funds:

1. Employer may wire funds to the Omnibus Trading Account at Community Bank, N.A. or make use of the ACH Debit Policy for deposit to the Omnibus Trading Account. Any funds remitted must include the 6- digit BPAS assigned Plan Identification Number (“BPANbr”) and indicate the pay period for which the funds are remitted.

Automated Debit Policy. If the Employer authorizes to initiate debit entries in connection with contributions and other payments made to the Plan, as directed by the Employer, through an Automated Clearing House (“ACH”) electronic funds transfer from the account set up for this purpose, such account shall be designated by the Employer on a “BPAS ACH Authorization” form. Employer may subsequently designate another bank account by directing in writing or such other medium as may be acceptable to Subcontractor. Employer will be responsible for submitting contributions and other payment data via electronic means acceptable to Subcontractor. Employer also directs that the Employer’s completed ACH Authorization, or subsequent direction acceptable to Subcontractor which supersedes the original, shall serve as authorization to the bank indicated by the Employer to accept any such debit entries initiated to the designated bank account.

Employer agrees that it shall be solely responsible for ensuring that Subcontractor is in receipt of the information necessary to initiate and effectuate the transfer of funds pursuant to this instruction and that the bank account designated by the Employer now or in the future, contains sufficient funds to satisfy the ACH request. Further, Employer agrees and acknowledges that

1. If it should fail to make sufficient funds available in its bank account for ACH purposes, Subcontractor reserves the right to reverse these new contribution trades in Participants’ accounts, 2) these purchases will not be considered “plan assets” until the funds have actually been delivered to Subcontractor, and 3) if the Employer fails to deliver settlement proceeds, Employer will assume full responsibility for resolving this matter with plan participants, including any financial restitution.

2. Funds held in the Omnibus Trade Account are the property of the Employer. Once the money is transferred (invested) the funds become the property of the Plan.

3. Funds must be received in Good Order for contributions to be processed.

The Trade Date for the processing of contributions will not exceed two (2) business days from Supplier's receipt of valid census information, approved verification data and funding in Good Order.

184 of 493

23 Processing Of Contributions:

Trade Date
Contributions will be processed after receipt by Subcontractor in Good Order on a Business Day. Good Order requirement includes Employer’s Verification of Contribution Data, as outlined above, and the amount of the contribution must be equal to the amount of the verified contribution data. If Employer’s Verification of Contribution Data is completed before 3:30PM ET and correct funding is received before 4:00 PM ET, Subcontractor shall use its best efforts to trade contributions received in Good Order effective that Business Day.

Transactions will be priced at Trade Date's NAV, provided that Subcontractor receives the Participating Fund's prices (NAVs) for Trade Date prior to 6:30 p.m. ET. (At times the funds may encounter heavy trading or system malfunctions and may not provide NAV in a timely manner). Subcontractor will transmit transactions over the System to the Participating Funds (or their transfer agent) on Trade Date. However, the Trade Date for contributions may be up to two (2) Business days after receipt by Subcontractor.

Subcontractor will use its best efforts to affect transactions based in fund trading restrictions and custodial timing after receipt of transaction instructions. Instructions received on a day that is not a business day shall be deemed to have been received as of the first business day thereafter. A “Business day” is a day on which the Subcontractor, the New York Stock Exchange, and all other entities contracted by Voya to provide trade execution and settlement are open for business.

Subcontractor will not be responsible or have any liability for any loss or diminution in value that may occur if transactions are not executed due to (i) circumstances not within Subcontractor’s or Voya’s control or (ii) a Holiday or close of business of Subcontractor, the New York Stock Exchange, or any other entities contracted by Voya to provide trade execution and settlement.

Wire Date
Subcontractor will cause funds representing result of transactions traded to be wired to the fund(s) the morning following Trade Date. Subcontractor or its designee is solely responsible for the coordination with each Fund of the wire transfer or deposit of funds for the purchase and redemption of fund shares and will ensure that payment occurs on a timely basis in order to obtain Trade Date's NAV. The Funds' inability to accept or receive deposit of funds goes beyond Subcontractor’s responsibility.

Changes to Operating Procedures:

This Exhibit D, Operating Procedures, may be subject to change. Any changes shall be communicated to the Employer at least thirty (30) calendar days in advance of the change.

185 of 493

24 EXHIBIT E - BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (the “BAA”), effective on the last signature date below, is incorporated into and made part of the [Employer Services Agreement] (the “Agreement”) by and between City of San Mateo 501(c)(9) VEBA (“Covered Entity”) and Voya Retirement Insurance and Annuity Company (“Voya”). Covered Entity and Voya may be referred to individually as a “Party” or collectively as the “Parties.”
WHEREAS, Covered Entity and Voya have entered the Agreement dated TBD in connection with which Voya is required to provide assurances that Voya will appropriately safeguard all health information protected under the Privacy Rule and Security Rule (as defined below) that is disclosed by, or created or received by, Voya on behalf of such Covered Entity;
NOW, THEREFORE, and in consideration for the mutual benefit provided to each Party under the Agreement, the Parties agree as follows:

1.BACKGROUND AND PURPOSE. The Parties have entered into, and may in the future enter into, one or more written agreements, that require Voya to create, receive, maintain and/or transmit “protected health information” (the “Underlying Contract(s)”), as the term is defined under 45 C.F.R. § 160.103 but is limited to the protected health information that Voya creates, receives, maintains, or transmits from or on behalf of the Covered Entity as the Covered Entity’s “Business Associate” as defined at 45 C.F.R. § 160.103 (“PHI”). Such PHI is subject to protection under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), Title XIII, Subtitle D, of the American Recovery and Reinvestment Act of 2009 (P.L. 111-5), known as the Health Information Technology for Economic and Clinical Health Act, as amended (the “HITECH Act”), and the implementing regulations for HIPAA and the HITECH Act, including, without limitation, the Standards for Privacy of Individually Identifiable Health Information, set forth at 45 C.F.R. Part 160 and Part 164 (Subparts A and E) (the “Privacy Rule”), the Security Standards for the Protection of Electronic Protected Health Information, set forth at 45 C.F.R. Part 160 and Part 164 (Subparts A and C) (the “Security Rule”), the Standards for Electronic Transactions, set forth at 45 C.F.R.

Parts 160 and 162 (the “Electronic Transactions Rule”), and the Breach Notification for Unsecured Protected Health Information, set forth at 45 C.F.R. Parts 160 and 164 (Subpart D) (the “Breach Notification Rule”), as such implementing regulations may have been or may in the future be amended from time to time (the Privacy Rule, the Security Rule, the Electronic Transactions Rule and the Breach Notification Rule, as amended from time to time, are referred to collectively as the “Rules”) (HIPAA, the HITECH Act, and the Rules, collectively, the “HIPAA Laws”).

This BAA shall supplement and/or amend the Agreement only with respect to Voya’s Use, Disclosure, and creation of PHI under the Underlying Contract(s) to allow Covered Entity to comply with the HIPAA Laws. Except as so supplemented and/or amended, the terms of the Agreement shall continue unchanged and shall apply with full force and effect to govern the matters addressed in this BAA and in the Agreement.

DEFINITIONS. Unless otherwise defined in this BAA, all capitalized terms used in this BAA have the meanings given in the HIPAA Laws.

2.VOYA’S OBLIGATIONS WITH RESPECT TO PHI.

2.1 Permitted Uses and Disclosures of PHI. Except as otherwise specified in this BAA, Voya may make any and all Uses and Disclosures of PHI necessary to perform its obligations under the Underlying Contract(s), or as Required by Law. Unless otherwise limited herein, Voya may, as a Business Associate of Covered Entity:
(a) Provide Data Aggregation services relating to the Health Care Operations of the Covered Entity;
(b) Use or Disclose PHI as Required by Law;

186 of 493

25 (c) De-identify any and all PHI obtained by Voya under this BAA in accordance with the de-identification requirements of the Privacy Rule guidance issued by the Secretary from time to time, and use and disclose such de-identified data for any of Voya’s purposes in a manner solely determined by Voya, for an indefinite period including beyond the termination of this BAA or the Underlying Contract. This BAA shall not apply to such de-identified data, the de-identified data will cease to be considered the confidential information or property of the Covered Entity including pursuant to any Underlying Contract.

(d) Use or Disclose PHI for the proper management and administration, such as audits and for other compliance requests from federal or state agencies, of Voya or to carry out the legal responsibilities of Voya, pursuant to 45 C.F.R. §164.504(e)(4), provided that (i) such Use or Disclosure is Required by Law, (ii) Voya obtains reasonable assurances from the person or entity which does not qualify as a subcontractor that is a Business Associate under the Rules and to which Voya discloses PHI for such purposes permitted under this Section 3.1(d) that such PHI will be held confidentially, Used or further Disclosed only as required by law or the purpose for which it was disclosed to such person or entity, and that such third party shall notify Voya of any instances of which the third party is aware in which the confidentiality of the PHI received pursuant to this provision has been or third party reasonably believes has been breached.

Under no circumstances may Voya Use or further Disclose PHI in a manner that would violate the HIPAA Laws if done by the Covered Entity.

2.2 Voya’s Obligations. With regard to its Use and/or Disclosure of PHI, Voya agrees to:
(a) Use or Disclose only the minimum necessary PHI to perform or fulfill a specific function required or permitted hereunder, in accordance with the HIPAA Laws as stated in 45 CFR 164.502(b) and 45 CFR 164.514.
(b) Not Use or Disclose PHI other than as permitted or required by this BAA or as Required By Law.
(c) Use appropriate safeguards and with respect to PHI transmitted by or maintained in Electronic Media, comply with subpart C of 45 C.F.R. Part 164 regarding provisions of the Security Rule applicable to such information, to prevent the Use or Disclosure of PHI other than as provided for by this BAA.
(d) Ensure that any subcontractor that is a Business Associate, as included in the definition of Business Associate at 45 C.F.R. 160.103, (each a “Subcontractor”) enters into an agreement or similar arrangement which complies with the HIPAA Laws requirements for agreements between “Business Associates” and “Covered Entities”, as each term is used under the HIPAA Laws, and subject to restrictions and limitations at least as restrictive as those imposed upon Voya in this BAA.
(e) Within thirty (30) days of receiving a written request from Covered Entity, make available to the Covered Entity such PHI necessary for Covered Entity to comply with its obligations under 45 C.F.R. § 164.524 in responding to an Individual’s request for access to his or her PHI where Voya maintains PHI in a Designated Record Set. In the event any individual requests access to PHI directly from Voya, Voya shall within ten (10) business days forward such request to Covered Entity. Any denials of access to the PHI requested shall be the exclusive responsibility of the Covered Entity.
(f) Within thirty (30) days of receiving a written request from Covered Entity, make available to the Covered Entity such PHI necessary for Covered Entity to comply with its obligations under 45 C.F.R. § 164.526 in responding to an Individual’s request for amendment and Voya shall incorporate any amendments to the PHI as directed or instructed by Covered Entity in accordance with 45 C.F.R. § 164.526 where Voya maintains PHI in the Designated Record Set. In the event any

187 of 493

26 Individual requests an amendment to PHI directly from Voya, Voya shall within ten (10) business days forward such request to Covered Entity.
(g) Within forty-five (45) days of receiving a written request from Covered Entity, make available to the Covered Entity the information required for the Covered Entity to provide an accounting of disclosures of PHI as required by the Privacy Rule. In the event the request for an accounting is delivered directly to Voya, Voya shall within thirty (30) business days forward such request to the Covered Entity. Voya shall retain its records regarding Uses and Disclosures of PHI that are required to be maintained in a Designated Record Set for no less than six (6) years following the termination of this BAA.
(h) To the extent that Voya carries out Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Voya shall comply with the HIPAA Laws that apply to the Covered Entity in performance of such obligation(s), as required under 45 C.F.R. § 164.504(e)(2)(ii)(H). (i) Promptly notify the Covered Entity of Voya’s receipt of any request for production or subpoena of PHI, in connection with any governmental investigation or governmental or civil proceeding. If the Covered Entity decides to challenge the validity of or assume responsibility for responding to such request or subpoena, Voya shall reasonably cooperate with the Covered Entity in connection therewith.
(j) Make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Laws.
(k) Use reasonable commercial efforts to mitigate any harmful effect that is known to Voya of a Use or Disclosure of PHI by Voya in violation of the requirements of this BAA. (l) Voya agrees to use appropriate safeguards to prevent any unauthorized or unlawful Use, access or Disclosure of the PHI, including but not limited to any Use, access or Disclosure not provided for by this BAA. Voya shall implement administrative, physical and technical safeguards required by the HIPAA Laws and comply with the policies, procedures and documentation requirements of the Security Rule.
(m) Report promptly and without unreasonable delay to Covered Entity any Use or Disclosure of PHI not provided for or permitted by this BAA and any Breach or Successful Security Incident, but in no event no more than sixty (60) days after it is discovered. Such notification shall include the information required under 45 C.F.R. § 164.410. “Successful Security Incident” shall mean any Security Incident that results in the unauthorized use, access, disclosure, modification or destruction of electronic PHI.

3.OBLIGATIONS OF COVERED ENTITY.

3.1 Covered Entity agrees to timely notify Voya, in writing, of any arrangements of the Covered Entity including any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR § 164.520 that may impact in any manner the Use and/or Disclosure of that PHI by Voya under this BAA.

3.2 Covered Entity further agrees not to request Voya to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity, except to the extent that Voya will use or disclose Protected Health Information for the management and administration and legal responsibilities of the Voya.

3.3 Covered Entity shall notify Voya of any changes in, or revocation of, the permission by an Individual to Use or Disclose his or her Protected Health Information, to the extent that such changes may affect Voya’s Use or Disclosure of Protected Health Information.

3.4 Covered Entity shall notify Voya of any restriction on the Use or Disclosure of

188 of 493

27 Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Voya’s Use or Disclosure of Protected Health Information.

3.5 Covered Entity shall disclose to Voya only the minimum amount of Protected Health Information necessary to allow Voya to fulfill its obligations to Covered Entity under the Underlying Contract.

4.TERM. This BAA shall commence as of the Effective Date and expire, unless earlier terminated pursuant to Section 5 hereof, at such time as the Underlying Contract(s) is terminated or expires and Voya returns or destroys PHI in accordance with the terms of this BAA.

5.TERMINATION. Should a Party become aware of a material breach of this BAA, including without limitation a pattern of activity or practice that constitutes a breach of a material term of this BAA, the non- breaching Party shall provide the breaching Party with written notice of such breach in sufficient detail to enable the breaching Party to understand the specific nature of the breach. The non-breaching Party shall be entitled to immediately terminate this BAA and the Underlying Contract associated with such breach if, after the non-breaching Party provides such notice of breach to the breaching Party, the breaching Party fails to cure the breach within a reasonable time period not to exceed thirty (30) days from the breaching Party’s receipt of such notice; provided, however, the non-breaching Party shall have the discretion to agree to such longer cure period based on the nature of the breach involved and subject to the HIPAA Laws.

6.RETURN OR DESTRUCTION OF PHI. Upon the expiration or termination of this BAA and/or the Underlying Contract(s), Voya, with respect to PHI received from Covered Entity, or created, maintained or received by Voya on behalf of Covered Entity, including any and all PHI in the possession of Voya’s Subcontractors and such third parties permitted to receive such PHI under and in accordance with the terms of this BAA and the HIPAA Laws, shall:
(a) Retain only that PHI which is necessary for Voya to continue its proper management and administration or to carry out its legal responsibilities; (b) Return to Covered Entity or destroy, as agreed to by Covered Entity, the remaining PHI that Voya still maintains in any form;
(c) Continue to use appropriate safeguards and comply with the Security Rule with respect to PHI transmitted by or maintained in Electronic Media to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Voya retains the PHI; (d) Not Use or Disclose the PHI retained by Voya other than for the purposes for which such PHI was retained and subject to the same conditions set forth in Section 2 hereof which applied prior to termination;
(e) Return to Covered Entity or destroy, as agreed to by Covered Entity, the PHI retained by Voya when it is no longer needed by Voya for its proper management and administration or to carry out its legal responsibilities; and
(f) Where the return or destruction of PHI is infeasible, Voya shall notify Covered Entity in a writing of sufficient specificity of the circumstances which make such return or destruction infeasible, and upon acceptance and agreement by Covered Entity, Voya shall continue to extend the protections of this BAA to such PHI and limit further use or disclosure of PHI to those purposes which make the return or destruction infeasible, for as long as Voya retains the PHI.

7.MISCELLANEOUS.

7.1 Survival. The respective rights and obligations of Voya and Covered Entity under this BAA which by their nature shall survive this BAA shall survive the expiration or termination of this BAA indefinitely, including without limitation Section 6.

189 of 493

28 7.2 Interpretation. The terms of this BAA shall prevail in the case of any conflict with the terms of any Underlying Contract to the extent necessary to allow Covered Entity to comply with the HIPAA Laws.

Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Entity and Voya to comply with the HIPAA Laws. The citations to the HIPAA Laws in several paragraphs of this BAA are for reference only and shall not be relevant in interpreting any provision of this BAA.

7.3 No Third Party Beneficiaries. Nothing in this BAA shall confer upon any person other than the Parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

7.4 Amendment. This BAA constitutes the entire agreement between the Parties with respect to PHI, and may not be modified, nor will any provision be waived or amended, except in a writing duly signed by authorized representatives of the Parties.

7.5 Waiver. A waiver with respect to one event will not be construed as continuing, or as a bar or waiver of any right or remedy as to subsequent events.

7.6 Changes in the HIPAA Laws. To the extent that any relevant provision of the HIPAA Laws is materially amended in a manner that changes the obligations of Voya or Covered Entities, the Parties agree to negotiate in good faith appropriate amendment(s) to this BAA to give effect to those revised obligations.

7.7 Governing Law. The Parties hereby agree that this BAA shall be governed by, and in construed in accordance with, the laws of Connecticut, without giving effect to its conflicts of laws principles, and the Parties hereby submit themselves to the jurisdiction and venue of the federal and state courts of Connecticut.

7.8 Regulatory References. A reference in this BAA to a section of the Code of Federal Regulations, the Privacy Rule, the Security Rule, or to another section of HIPAA means the section, as amended from time to time.

7.9 Notices. All notices and communications required by this BAA shall be in writing. Such notices and communications shall be given in one of the following forms: (i) by delivery in person; (ii) by a nationally-recognized, next-day courier service; (iii) by first-class, registered or certified mail, postage prepaid; or (iv) by electronic mail to the address that each party specifies in writing.

7.10 Confidentiality. The terms of this BAA shall remain confidential except as described hereunder and in the Underlying Contract, except that Voya may disclose the terms of this BAA to entities that Voya reasonably believes are other Business Associates of Covered Entity.

7.11 Severability. The invalidity or unenforceability of any provisions of this BAA shall not affect the validity or enforceability of any other provision of this BAA or the Underlying Contract, which shall remain in full force and effect

7.12 Construction and Interpretation. The section headings contained in this BAA are for reference purposes only and shall not in any way affect the meaning or interpretation of this BAA. This BAA has been negotiated by the parties at arm’s-length and each of them has had an opportunity to modify the language of the BAA. Accordingly, the BAA shall be treated as having been drafted equally by the parties, and the language shall be construed as a whole and according to its fair meaning. Any presumption or principle that the language is to be construed against any party shall not apply. This BAA may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement.

7.13 Entire Agreement. This BAA constitutes the entire and full agreement between the Parties with respect to the subject matter hereof and supersedes and replaces any previous version of this agreement.

IN WITNESS WHEREOF, each of the undersigned has caused this BAA to be duly executed in its

190 of 493

29 name and on its behalf.

City of San Mateo 501(c)(9) VEBA
(Covered Entity)
By:

Print Name:

Print Title:

Date:

Voya Retirement Insurance and Annuity
Company
By:

Print Name:

Print Title:

Date:

191 of 493

30 EXHIBIT F – DATA SECURITY ADDENDUM

1. Definitions.
“Affected Persons” means Client’s and its Affiliate’s former and current employees whose Personal Information (“PI”) may have been disclosed or compromised as a result of an Information Security Incident.
“Affiliates” means any entities that, now or in the future, control, are controlled by, or are under common control with Client. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through ownership, voting securities, contract, or otherwise. “Confidential Information” means (a) non-public information concerning the Disclosing Party, its affiliates, and their respective businesses, products, processes, and services, including technical, marketing, agent, customer, financial, personnel, and planning information; (b) PI; (c) trade secrets; and (d) any other information that is marked confidential or which, under the circumstances surrounding disclosure, the Non- Disclosing Party should know is treated as confidential by the Disclosing Party. Except with respect to PI, which will be treated as Confidential Information under all circumstances, Confidential Information will not include (A) information lawfully obtained or developed by the Non- Disclosing Party independently of the Disclosing Party’s Confidential Information and without breach of any obligation of confidentiality; or (B) information that enters the public domain without breach of any obligation of confidentiality. All Confidential Information will remain the property of the Disclosing Party.
“Information Security Incident” means any breach of security or cyber security incident impacting Voya that has a reasonable likelihood of (a) resulting in the loss or unauthorized access, use or disclosure of Client PI; (b) materially affecting the normal operation of Voya; or (c) preventing Voya from complying with all of the privacy and security requirements set forth in this Agreement.
“Law” means all U.S. and non-U.S. laws, ordinances, rules, regulations, declarations, decrees, directives, legislative enactments and governmental authority orders and subpoenas.
“Personal Information (PI)” means any information or data that (a) identifies an individual, including by name, signature, address, telephone number or other unique identifier; (b) can be used to identify or authenticate an individual, including passwords, PINs, biometric data, unique identification numbers (e.g., Social Security numbers), answers to security questions or other personal identifiers; (c) is “non-public personal information” as defined in the Gramm-Leach-Bliley Act 15 U.S.C. § 6809(4) or “protected health information” as defined in 45 C.F.R. § 160.103; (d) is an account number or credit card number or debit card number, in combination with any required security code, access code, or password, that would permit access to an individual’s financial account; or (e) is “Personal Information” as defined in The California Consumer Privacy Act of 2018 (Cal.

Civ. Code Division 3, Part 4, Title 1.81.5).

192 of 493

31 “Services” means the services that Voya provides to Client pursuant to this Agreement. “Voya Personnel” means Voya’s employees and subcontractors engaged in the performance of Services.

2. Data Security.

2.1. Security Standards and Controls.
(a) Voya will establish and maintain:
(i) administrative, technical, and physical safeguards against the destruction, loss, or alteration of confidential Information; and (ii) Appropriate security measures to protect Confidential Information, which measures meet or exceed the requirements of all applicable Laws relating to personal information security.
(b) In addition, Voya will implement and maintain the following information security controls:
(i) Privileged access rights will be restricted and controlled; (ii) An inventory of assets relevant to the lifecycle of information will be maintained;
(iii) Network security controls will include, at a minimum, firewall and intrusion prevention services;
(iv) Detection, prevention and recovery controls to protect against malware will be implemented;
(v) Information about technical vulnerabilities of Voya’s information systems will be obtained and evaluated in a timely fashion and appropriate measures taken to address the risk;
(vi) Detailed event logs recording user activities, exceptions, faults, access attempts, operating system logs, and information security events will be produced, retained and regularly reviewed as needed; and
(vii) Development, testing and operational environments will be separated to reduce the risks of unauthorized access or changes to the operational environment.

2.2. Information Security Policies. Voya will implement and maintain written policies, standards or procedures that address the following areas:
(a) Information security;
(b) Data governance and classification;
(c) Access controls and identity management;
(d) Asset management;
(e) Business continuity and disaster recovery planning and resources; (f) Capacity and performance planning;
(g) Systems operations and availability concerns;
(h) Systems and network security;
(i) Systems and application development, quality assurance and change management;
(j) Physical security and environmental controls;
(k) Customer data privacy;
(l) Patch management;
(m) Maintenance, monitoring and analysis of security audit logs; (n) Vendor and third party service provider management; and

193 of 493

32 (o) Incident response, including clearly defined roles and decision making authority and a logging and monitoring framework to allow the isolation of an incident.

2.3. Subcontractors. Voya will implement and maintain policies and procedures to ensure the security of Confidential Information and related systems that are accessible to, or held by, third party service providers. Voya will not allow any third parties to access Voya’s systems or store or process sensitive data, unless such third parties have entered into written contracts with Voya that require, at a minimum, the following:
(a) The use of encryption to protect sensitive PI in transit, and the use of encryption or other mitigating controls to protect sensitive PI at rest; (b) Prompt notice to be provided in the event of a cyber security incident; (c) The ability of Voya or its agents to perform information security assessments; and
(d) Representations and warranties concerning adequate information security.

2.4. Encryption Standards, Multifactor Authentication and Protection of Confidential Information.
(a) Voya will implement and maintain cryptographic controls for the protection of Confidential Information, including the following:
(i) Use of an encryption standard equal to or better than the industry standards included in applicable National Institute for Standards and Technology Special Publications (or such higher encryption standard required by applicable Law) to protect Confidential Information at rest and in transit over un-trusted networks; (ii) Use of cryptographic techniques to provide evidence of the occurrence or nonoccurrence of an event or action;
(iii) Use of cryptographic techniques to authenticate users and other system entities requesting access to or transacting with system users, entities and resources; and
(iv) Development and implementation of policies on the use, protection and lifetime of cryptographic keys through their entire lifecycle. (b) In addition to the controls described in clause (a) above, Voya will:
(i) Implement multi-factor authentication for all remote access to Voya’s networks;
(ii) Ensure that no Client PI is (A) placed on unencrypted removable media, mobile devices, computing equipment or laptops or (B) stored outside the United States; and
(iii) Ensure that media containing Confidential Information is protected against unauthorized access, misuse or corruption during transport.

2.5. Information Security Roles and Responsibilities. Voya will employ personnel adequate to manage Voya’s information security risks and perform the core cyber security functions of identify, protect, detect, respond and recover. Voya will designate a qualified employee to serve as its Chief Information Security Officer (“CISO”) responsible for overseeing and implementing its information security program and enforcing its information security policies. Voya will define roles and

194 of 493

33 responsibilities with respect to information security, including by identifying responsibilities for the protection of individual assets, for carrying out specific information security processes, and for information security risk management activities, including acceptance of residual risks. These responsibilities should be supplemented, where appropriate, with more detailed guidance for specific sites and information processing facilities.

2.6. Segregation of Duties. Voya must segregate duties and areas of responsibility in order to reduce opportunities for unauthorized modification or misuse of Voya’s assets and ensure that no single person can access, modify or use assets without authorization or detection. Controls should be designed to separate the initiation of an event from its authorization. If segregation is not reasonably possible, other controls such as monitoring of activities, audit trails and management supervision should be utilized. Development, testing, and operational environments should be separated to reduce the risks of unauthorized access or changes to the operational environment.

2.7. Information Security Awareness, Education and Training. Voya will provide regular information security education and training to all Voya Personnel, as relevant for their job function. In addition, Voya will provide mandatory training to information security personnel and require key information security personnel to stay abreast of changing cyber security threats and countermeasures.

2.8. Vulnerability Assessments. Voya will conduct monthly vulnerability assessments that meet the following criteria:
(a) All production servers and network devices must be scanned at least monthly; (b) All vulnerabilities must be rated;
(c) All vulnerability remediation must be prioritized based on risk; (d) All tools used for scanning must have signatures updated at least monthly with the latest vulnerability data; and,
(e) Voya will implement and maintain a formal process for tracking and resolving issues in a timely fashion.

2.9 Penetration Testing. If any Services to be provided by Voya include the hosting or support of one or more externally facing applications that can be used to access systems that store or process Client data, the terms of this Section will apply. (a) At least once every 12 months during the Term and prior to any major changes being moved into production, Voya will conduct a Valid Penetration Test (as defined below) on each internet facing application described above. As used herein, a “Valid Penetration Test” means a series of tests performed by a team of certified professionals, which tests mimic real-world attack scenarios on the information system under test and include, without limitation, the following:
(i) Information-gathering steps and scanning for vulnerabilities; (ii) Manual testing of the system for logical flaws, configuration flaws, or programming flaws that impact the system’s ability to ensure the confidentiality, integrity, or availability of Client’s information assets;
(iii) System-compromise steps;
(iv) Escalation-of-privilege steps; and

195 of 493

34 (v) Assignment of a rating for each issue based on the level of potential risk exposure to Client’s brand or information assets. (b) Upon Client’s request, Voya will provide to Client an executive summary of any material issues or vulnerabilities identified by the most recent Valid Penetration Test along with the scope of systems tested. The report may be redacted to ensure confidentiality.

2.10 Physical and Environmental Security. Voya will ensure that all sites are physically secure, including the following:
(a) Sound perimeters with no gaps where a break-in could easily occur; (b) Exterior roof, walls and flooring of solid construction and all external doors suitable protected against unauthorized access with control mechanisms
such as locks, bars, alarms, etc.;
(c) All doors and windows to operational areas locked when unattended;
(d) Equipment protected from power failures and other disruptions caused by failures in supporting utilities;
(e) Closed-circuit television cameras at site entry/ exit points; badge readings at
all site entry points, or other means to prevent unauthorized access; and
(f) Visitor sign-in/ mandatory escort at site; and
(g) With respect to remote work environments, if the foregoing controls are not present, then Voya will use commercially reasonable efforts to mitigate any increased risk associated with such remote work environments, by, for example, limiting the types of access and functional roles eligible for a remote work environment, restricting access to a virtual private network (vpn) or virtual desktop infrastructure (vdi), providing formal guidance and standards for workspace security, and enhancing data protection controls such as data masking, logging and monitoring.

2.11 Information Security Incident Notification.
(a) In the event of any Information Security Incident, Voya will, at its sole expense promptly (and in any event within 72 hours after Voya confirms an Information Security Incident) report such Information Security Incident to Client by sending an email to Client Contact Information, summarizing in reasonable detail the effect on Client, if known, and designating a single point of contact at Voya who will be:
(i) Available to Client for information and assistance related to the Information Security Incident; investigate such Information Security Incident, perform a root cause analysis, develop a corrective action plan and take all necessary corrective actions;
(ii) Mitigate, as expeditiously as possible, any harmful effect of such Information Security Incident and cooperate with Client in any reasonable and lawful efforts to prevent, mitigate, rectify and remediate the effects of the Information Security Incident;
(iii) Provide a written report to Client containing all information necessary for Client to determine compliance with all applicable laws, including the extent to which notification to affected persons or to government or regulatory

196 of 493

35 authorities is required; and
(iv) Cooperate with Client in providing any filings, communications, notices, press releases or reports related to such Information Security Incident. (b) In addition to the other indemnification obligations of Voya set forth in this Agreement, Voya will indemnify, defend and hold harmless Client from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorneys’ fees, arising out of or relating to any Information Security Incident, which may include, without limitation:
(i) Expenses incurred to provide notice to Affected Persons and to law- enforcement agencies, regulatory bodies or other third parties as required to comply with law;
(ii) Expenses related to any reasonably anticipated and commercially recognized consumer data breach mitigation efforts, including, but not limited to, costs associated with the offering of credit monitoring or a similar identify theft protection or mitigation product for a period of at least twelve (12) months or such longer time as is required by applicable laws or any other similar protective measures designed to mitigate any damages to the Affected Persons; and
(iv) Fines or penalties that Client pays to any governmental or regulatory authority under legal or regulatory order as a result of the Information Security Incident.

2.12. Risk Assessments. Upon Client’s request no more than once per year, Voya will complete
an industry standard information security questionnaire and provide relevant Service Organization Control (“SOC”) audit reports, when available. Voya’s standard security requirements are set forth in Exhibit A. Voya represents and warrants that, as of the Effective Date, the statements in Exhibit A are true and correct in all material respects.

3. Privacy and PII

3.1. With respect to any PI, Voya will:
(a) Comply with the Voya Privacy Notice at www.voya.com/privacy-notice; (b) Retain, use, process and disclose all PI accessed, obtained or produced by Voya only to perform its obligations under this Agreement and as specifically permitted by this Agreement, or as otherwise instructed by Client, and not for any other purpose;
(c) Refrain from selling such PI or using such PI for any other purpose, including for its own commercial benefit;
(d) Treat all PI as Confidential Information;
(e) Comply with the provisions of this Agreement to return, store or destroy the PI; and
(f) Comply with all applicable Laws with respect to processing of PI.

Voya hereby certifies to Client that it understands the restrictions and obligations set forth above and will ensure that Voya and all Voya Personnel comply with the same.

3.2 As needed to comply with applicable Laws concerning the processing of PI or personal information security, or to the extent required by any changes in such Laws or the enactment of new Laws, the Parties agree to work cooperatively and

197 of 493

36 in good faith to amend this Agreement in a mutually agreeable and timely manner, or to enter into further mutually agreeable agreements in an effort to comply with any such Laws applicable to the Parties. If the Parties cannot so agree, or if Voya cannot comply with the new or additional requirements, Client may terminate this Agreement upon written notice to Voya.

4. Confidential Information.

4.1. Confidential Information. Either Party (“Disclosing Party”) may disclose Confidential Information to the other Party (“Non-Disclosing Party”) in connection with this Agreement.

4.2. Use and Disclosure of Confidential Information. The Non-Disclosing Party agrees that it will disclose the Disclosing Party’s Confidential Information only to its employees, agents, consultants, and contractors who have a need to know and are bound by obligations of confidentiality no less restrictive than those contained in this Agreement. In addition, Voya agrees that it will use the Disclosing Party’s Confidential Information only for the purposes of performing its obligations under this Agreement. The Non-Disclosing Party will use all reasonable care in handling and securing the Disclosing Party’s Confidential Information and will employ all security measures used for its own proprietary information of similar nature.

These confidentiality obligations will not restrict any disclosure of Confidential Information required by Law or by order of a court, regulatory authority or governmental agency; provided, that the Non-Disclosing Party will limit any such disclosure to the information actually required to be disclosed. Notwithstanding anything to the contrary, Client may fully comply with requests for information from regulators of Client and the Client Affiliates.

4.3. Treatment of Confidential Information Following Termination. Promptly following the termination or expiration of this Agreement, or earlier if requested by the Disclosing Party, the Non-Disclosing Party will return to the Disclosing Party any and all physical and electronic materials in the Non-Disclosing Party’s possession or control containing the Disclosing Party’s Confidential Information. The materials must be delivered via a secure method and upon such media as may be reasonably required by the Disclosing Party.

Alternatively, with the Disclosing Party’s prior written consent, the Non-Disclosing Party may permanently destroy or delete the Disclosing Party’s Confidential Information and, if requested, will promptly certify the destruction or deletion in writing to the Disclosing Party. Notwithstanding the foregoing, if the Non- Disclosing Party, due to requirements of applicable Law, must retain any of the Disclosing Party’s Confidential Information, or is unable to permanently destroy or delete the Disclosing Party’s Confidential Information as permitted above within 60 days after termination of this Agreement, the Non- Disclosing Party will so notify the Disclosing Party in writing, and the Parties will confirm any extended period needed for permanent destruction or deletion of the Disclosing Party’s Confidential Information. All Confidential Information in the Non-Disclosing Party’s possession or control will continue to be subject to the confidentiality provisions of this Agreement. The methods used to destroy and delete the Confidential Information must ensure that no Confidential Information remains readable and cannot be reconstructed so to be readable. Destruction and deletion must also comply with the following specific requirements:

198 of 493

37 MEDIUM DESTRUCTION METHOD
Hard copy Shredding, pulverizing, burning, or
other permanent destruction method
Electronic tangible media, such
as disks and tapes
Destruction or erasure of the media
Hard drive or similar storage device Storage frame metadata removal to hide the organizational structure that
combines disks into usable volumes
and physical
destruction of the media with a
Certificate of Destruction (COD)

4.4 Period of Confidentiality. The restrictions on use, disclosure, and reproduction of Confidential Information set forth in this Section will, with respect to PI and Confidential Information that constitutes a “trade secret” (as that term is defined under applicable Law), be perpetual, and will, with respect to other Confidential Information, remain in full force and effect during the term of this Agreement and for three years following the termination or expiration of this Agreement.

4.5. Injunctive Relief. The Parties agree that the breach, or threatened breach, of any of the confidentiality provisions of this Agreement may cause irreparable harm without adequate remedy at law. Upon any such breach or threatened breach, the Disclosing Party will be entitled to injunctive relief to prevent the Non-Disclosing Party from commencing or continuing any action constituting such breach, without having to post a bond or other security and without having to prove the inadequacy of other available remedies. Nothing in this Section will limit any other remedy available to either Party.

5. Cyber Liability Insurance. During the Term, Voya will, at its own cost and expense, obtain and maintain in full force and effect, with financially sound and reputable insurers, cyber liability insurance to cover Voya’s obligations under this Addendum. Upon execution of the Agreement, Voya will provide Client with a certificate of insurance evidencing the following coverage and amount with such insurer:

Risk Covered: Network Security (a.k.a.

Cyber/IT) Limits: $50,000,000

6. Disaster Recovery and Business Continuity Plan. Voya maintains, and will continue to maintain throughout the Term, (a) a written disaster recovery plan (“Disaster Recovery Plan”), which Disaster Recovery Plan is designed to maintain Client’s access to services and prevent the unintended loss or destruction of Client data; and (b) a written business continuity plan (“BCP”) that permits Voya to recover from a disaster and continue providing services to customers, including Client, within the recovery time objectives set forth in the BCP. Upon Client’s reasonable request, Voya will provide Client with evidence of disaster recovery test date and result outcome.

199 of 493

38 Exhibit A
Security Requirements
FC: Foundation Controls
FC-1: Information Asset Management
FC-1.1 Voya implements and maintains an inventory list and assigns ownership for all computing assets including, but not limited to, hardware and software used in the accessing, storage, processing, or transmission of Client PI.

FC-1.2 Voya reviews and updates the inventory list of assets for correctness and completeness at least once every 12 months and updates the inventory list as changes are made to the computing assets.

FC-2: Data Privacy and Confidentiality
FC-2.1 Voya will maintain an Information and Risk Management policy that is reviewed and approved by management at least annually.

FC-2.2 Voya protects the privacy and confidentiality of all Client PI received, disclosed, created, or otherwise in Voya’s possession by complying with the following requirements:

FC-2.2A Such information is encrypted at rest on mobile devices (including mobile storage devices), portable computers, and in transit over un-trusted networks with an encryption standard equal to or better than Advanced Encryption Standard (AES) 256 bit encryption or such higher encryption standard required by applicable law.

FC-2.2B All hardcopy documents and removable media are physically protected from unauthorized disclosure by locking them in a lockable cabinet or safe when not in use and ensuring that appropriate shipping methods (tamper-proof packaging sent by special courier with signatures) are employed whenever the need to physically transport such documents and removable media arises.

FC-2.2C All media is labeled and securely stored in accordance with Voya policies.

FC-2.2D All electronic media is securely sanitized or destroyed when no longer required in accordance with industry standards.

FC-3: Configuration Management
FC-3.1 Voya implements and maintains accurate and complete configuration details (e.g., Infrastructure Build Standards) for all computing assets used in accessing, storing, processing, or transmitting Client PI.

FC-3.2 Voya reviews configuration details of the computing assets at least once every 12 months to validate that no unauthorized changes have been made to the assets.

FC-3.3 Voya updates the configuration details of all computing assets used to access, process, store, or transmit Client PI as configuration changes take place.

FC-4: Operating Procedures and Responsibilities

200 of 493

39 FC-4.1 Voya implements and maintains operational procedures for information processing facilities and designates specific roles or personnel responsible for managing and maintaining the quality and security of such facilities, including, but not limited to, formal handover of activity, status updates, operational problems, escalation procedures and reports on current responsibilities.

Voya IT policies and standards document the policies and procedures for job scheduling processes and tools.

FC-4.2 Voya updates the operational procedures as changes take place and performs a comprehensive review and update of the procedures at least once every 2 years.

FC-5: Security Awareness and Training

201 of 493

40 FC-5.1 Voya performs pre-employment background checks, including criminal history for 7 years, credit score and history (if applicable), credentials verification (if applicable), and educational background.

FC-5.2 Voya implements and maintains a documented security awareness program for all Voya Personnel which covers access to Client PI.

FC-5.3 Voya’s security awareness program includes security requirements, acceptable use of computing assets, legal responsibilities, and business controls, as well as training in the correct use of information processing facilities and physical security controls.

FC-5.4 Voya ensures that all Voya Personnel complete security awareness training prior to being provided access to Client PI and at least annually thereafter. Voya provides mandatory annual training programs that include security awareness training to all Personnel.

UA: User Access Controls
UA-1: User Access Controls
UA-1.1 Voya implements and maintains identity management system(s) and authentication process(es) for all systems that access, process, store, or transmit Client PI.

UA-1.2 Voya ensures that the following user access controls are in place:

UA-1.2A The “Least Privilege” concept is implemented ensuring no user has more privileges than they require in performing their assigned duties.

UA-1.2B Users requiring elevated privileges as a normal part of their job responsibilities have a regular, non-privileged account to perform regular business functions.

UA-1.2C All users have an individual account which cannot be shared UA-1.2D Account Names/IDs are constructed not to reveal the privilege level of the account or position of the account holder.

UA-1.2E System- or application-level service accounts are owned by a member of management or an IT system administration delegate and only have the privileges necessary to function as required by the application, system, or database for which the account has been created.

UA-1.2F Automated processes disable access upon 24 hours of termination and initiate manager review on employee position changes, in accordance with Voya policies.

UA-2: Access Control Management
UA-2.1 Voya maintains a comprehensive physical security program. Access to Voya facilities is restricted and logs are maintained for all access. Physical security and environmental controls are present in Voya buildings.

UA-2.2 Voya ensures that access to systems that access, process, store, or transmit Client PI is limited to only those personnel who have been specifically authorized to have access in accordance with the users’ assigned job responsibilities.

UA-2.3 Voya ensures that accounts for systems that access, process, store, or transmit Client PI are controlled in the following manner:

UA-2.3A Users must provide a unique ID and Password for access to systems. Access to applications/systems is limited to a need-to-know basis, and is enforced through role based access controls.

UA-2.3B Accounts are protected on computing assets by screen-savers that are configured with an inactivity time-out of not more than 15 minutes.

UA-2.3C Accounts are locked after no more than 5 consecutive failed logon attempts, depending upon the system and platform.

UA-2.3D Accounts remain locked until unlocked by an Administrator or through an approved and secure end-user self-service process.

202 of 493

41 UA-2.3E Accounts are reviewed on a periodic and regular basis to ensure that the account is still required, access is appropriate, and the account is assigned to the appropriate user.

UA2.4 Voya ensures that wireless mobile devices are secured against threats coming from these wireless networks and wireless connections are required to be encrypted.

UA-3: User Access Management
UA-3.1 Voya ensures that passwords for all accounts on systems that access, process, store, or transmit Client PI are configured and managed in accordance with industry standards:

UA-4: Information Access Restriction
UA-4.1 Voya implements information access restrictions on all systems used to access, process, store, or transmit Client Information.

UA-4.2 Voya ensures the following Information Access Restrictions are in place:

UA-4.2A Access to underlying operating systems and application features that the user does not require access to in the performance of their assigned responsibilities are strictly controlled.

UA-4.2B Access to source code and libraries are restricted to only those individuals who have been specifically approved to have access. A person who develops code changes cannot be the same person who migrates the code change into production.

UA-4.2C Access between Development, Test, and Production environments are strictly controlled.

The version management system provides segregation of code, data and environments.

UA-4.2D Temporary privileged access to production data is granted to authorized personnel based on job function for emergency support and only via access control and logging security tools.

PS: Platform Security Controls
PS-1: Computer System Security (Servers and Multi-user System sonly) PS-1.1 Voya implements and manages a formal process for ensuring that all computer systems that access, process, store, or transmit Client PI are protected and configured as follows prior to and while remaining in a production status:

PS-1.1A Systems are assigned to an asset owner within Voya's organization.

PS-1.1B Systems are located in a data center or similarly controlled environment with appropriate physical security mechanisms and environmental controls to ensure systems are protected from theft, vandalism, unplanned outages, or other intentional or unintentional hazards.

PS-1.1C All systems are configured to meet Voya standards, monitored to ensure a compliant state, and patched as required to maintain a high degree of security.

Issues found to be out of compliance are required to be tracked to closure.

PS-1.1D Systems are configured with commercially available and licensed anti-virus software which is set to perform active scans, perform scans of uploaded or downloaded data/files/web content, and is updated on at least on a daily basis.

PS-1.1E System clocks are configured to synchronize with a reputable time source (e.g., NTP).

PS-1.1F Systems display a warning banner to all individuals during the logon process that indicates only authorized users may access the system.

PS-1.1G Systems that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

203 of 493

42 PS-1.1H All high and medium vulnerability and risk issues identified are remediated utilizing a risk based approach and in alignment with application team code release schedules.

PS-1.1I Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor systems.

PS-2: Network Security
PS-2.1 To ensure systems accessing, processing, storing, or transmitting Client PI are protected from network related threats, Voya implements the following network security controls prior to connecting any network component to a production network and for the duration that the component remains in a production status.

PS-2.1A Networks are constructed using a defense-in-depth architecture, are terminated at a firewall where there are connections to external networks, and are routinely scanned for unapproved nodes and networks.

PS-2.1B Business-to-Business (B2B) and Third Party network connections (Trusted) to systems accessing, processing, storing, or transmitting Client PI are permitted only after a rigorous risk assessment and formal approval by Voya management.

Network connections from un- trusted sources to internal resources are not permitted at any time.

PS-2.1C Network components (switches, routers, load balancers, etc.) are located in a data center or a secure area or facility.

PS-2.1D Voya systems are configured to provide only essential capabilities and restrict the use of any unneeded functions, ports, protocols and services.

PS-2.1E Intrusion detection/prevention technologies, firewalls, and proxy technologies are implemented, monitored and managed to ensure only authorized and approved traffic is allowed within and between segments of the network.

PS-2.1F Internal Voya wireless networks are configured with the most robust security standards available, including but not limited to, 802.11i/n, strong authentication, IP/MAC address filtering, firewall protection, and intrusion detection/prevention.

PS-2.1G Wireless networks are not used to access Client Information unless the information is encrypted at either the file or transport level.

PS-2.1H Network components that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

PS-2.1I Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor network components.

PS-3: Generic Application and Database Security
PS-3.1 Voya implements and maintains an application security certification and assurance process that ensures that all applications that access, process, store, or transmit Client PI provide the following:

PS-3.1A Application and database design ensures security, accuracy, completeness, timeliness, and authentication/authorization of inputs, processing, and outputs.

PS-3.1B All data inputs are validated for invalid characters, out of range values, invalid command sequences, exceeding data limits, etc. prior to being accepted for production. Voya implements static source code analysis tools to validate data inputs.

PS-3.1C Application source code developed in house by Voya is protected through the use of a source code repository that ensures version and access control. The version management system provides segregation of code, data and environments.

204 of 493

43 PS-3.1D Applications and databases are tested for security robustness and corrective measures are applied prior to the application being placed into a production environment. All systems are configured to meet Voya standards, monitored to ensure compliance state, and patched as required to maintain a high degree of security.

PS-3.1E Applications and databases are implemented into a production environment with minimal privileges and critical configuration files and storage subsystems are protected from unauthorized access.

PS-3.1F Applications and databases that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

PS-3.1G Voya ensures that Consumer/Internet facing applications have been designed and implemented using multi-factor authentication architecture. Web sessions require the use of an HTTPS (encrypted) connection, as well as authorization to approved data and services.

PS-3.1H Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor applications and databases.

PS-4: Workstation and Mobile Devices Security (End User Devices) PS-4.1 Voya ensures that the following security controls have been implemented and are maintained to protect Client PI accessed, processed, stored, or transmitted on workstations and mobile devices.

PS-4.1A Workstations are located in a physically secure environment with mechanisms in place to prevent unauthorized personnel from accessing data stored on the device, reconfiguring the BIOS or system components, or from booting the device from unauthorized media. Portable devices are configured for boot-up encryption.

PS-4.1B Laptops/portable computers and other mobile devices are assigned to an owner who is responsible for physically securing the device at all times, and the owner of the device must receive adequate awareness training on mobile device physical security.

PS-4.1C Portable devices are configured for boot-up encryption. All laptop hard drives are encrypted using AES 256. Any device deemed "remote" requires hard drive encryption.

PS-4.1D All workstations, laptops/portable computers and other mobile devices (where applicable) are configured with commercially available and licensed anti-virus software which is set to perform active scans, to perform scans of uploaded or downloaded data/files/web content, and is updated on at least a daily basis.

PS-4.1E All workstations, laptops/portable computers and other mobile devices (where applicable) are configured with a commercially available and licensed operating system, patched according to manufacturer’s recommendations, hardened according to best industry practices and standards and configured so that regular users do not have administrative privileges.

PS-4.1F Laptops/portable computers and other mobile devices (where applicable) are configured with personal firewall technology.

PS-4.1G Workstations, laptops/portable computers and other mobile devices (where applicable) display a warning banner to all individuals during the logon process that indicates that only authorized users may access the system or device.

PS-4.1H Voya implements and maintains processes for recovering laptops/portable computers and mobile devices from terminated Voya Personnel.

PS-5: Backup and Restore
PS-5.1 Voya implements and maintains backup and restore procedures to ensure that all Client PI received, disclosed, created, or otherwise in the possession of Voya is appropriately protected against loss.

205 of 493

44 PS-5.2 Voya ensures that backups are securely stored and storage systems are physically and logically protected.

PS-5.3 Voya implements a backup and availability schedule to meet business and regulatory requirements.

PS-6: Remote Network Access Controls
PS-6.1 Voya implements and maintains a remote network access control strategy or process.

PS-6.2 Voya ensures the following remote network access controls are in place:

PS-6.2A Users requiring remote access are appropriately authorized by Voya management.

PS-6.2B Remote access connections are established through the use of Virtual Private Networking (VPN) or secure VDI mechanisms that provide transmission security, encryption and connection timeout (e.g. split-tunneling disabled.) PS-6.2C Only Voya approved and controlled (managed) computing devices are used when remotely accessing (where applicable) Voya’s computing environments where Client PI is held. Any device deemed "remote" requires data encryption.

Encrypted communications are required for all remote connections.

PS-6.2D Users are thoroughly authenticated using multi-factor authentication prior to being provided remote access.

ITR: IT Resilience Controls
ITR-1: Architecture
ITR-1.1 Voya ensures that the architecture of computing environments where Client PI is accessed, processed, stored, or transmitted incorporates reasonable industry best practices for authentication/authorization, monitoring/management, network design, connectivity design, firewall and intrusion prevention technologies and storage and backup capabilities.

ITR-2: Hardware and Software Infrastructure Resilience
ITR-2.1 Voya ensures all hardware and software components classified with an availability rating of “critical” used in the accessing, processing, storage, or transmission of Client PI is:
•Identified and cataloged
•Supported by the manufacturer of the component (or if developed in- house, follows Voya’s SDLC Policy which includes quality/security) •Applications and systems classified as A4 may be designed with high availability features and have no single point of failure •Reviewed on a regular basis for capacity implications (at minimum once every 12 months)
ITR-2.2 Voya maintains Business Continuity Plans to address business unit and departmental actions to be undertaken before, during and after an incident or disaster. Voya’s Disaster Recovery Plan addresses the recovery and availability of systems and data.

ITR-3: Capacity Assurance
ITR-3.1 Voya ensures that computing environments used to access, process, store, or transmit Client PI are assessed for capacity and performance on a periodic basis (at minimum once every 12 months) and appropriate corrective actions are taken to make the environment sufficiently robust enough to perform its stated mission.

CM: Change Management Controls
CM-1: Change Management Process
CM-1.1 Voya implements and maintains a change control process to ensure that all changes to the environment where Client PI is accessed, processed, stored, or transmitted is strictly documented, assessed for impact, and approved by personnel authorized by Voya to provide approval for such changes, thoroughly tested, accepted by management, and tracked.

206 of 493

45 CM-1.2 Voya implements an emergency change control process to manage changes required in an emergency situation where a computing system is down or there are imminent threats/risks to critical systems involving Client PI.

CM-2: Separation of Environments
CM-2.1 Voya maintains physically and/or logically separate development, test, and production computing environments. Development, testing, and acceptance environments are separate from the production environment.

CM-2.2 Voya ensures that Client data used for development or testing purposes is completely depersonalized/desensitized of confidential values prior to entering a development or test environment. Data is depersonalized in non-production controlled environments for testing purposes with required approvals. PI elements are required to be depersonalized in non- production environments.

SM: Security Monitoring Controls
SM-1: Security Event Monitoring and Incident Management SM-1.1 Voya implements and maintains a security event monitoring process and associated mechanisms to ensure events on computing systems, networks, and applications that can impact the security level of that asset or the data residing therein are detected in as close to real-time as possible for those assets used to access, process, store, or transmit Client PI.

SM-1.2 Voya implements and maintains an incident management process to ensure that all events with a potential security impact are identified, investigated, contained, remediated, and reported to Client effectively and in a timely manner.

SM-1.3 Voya has implemented monitoring controls that provide real-time notifications of events related to loss of confidentiality, the integrity, or the availability of systems.

SM-1.4 Event logs (audit trails) are stored for analysis purposes for a minimum period of 3 years.

SM-2: Technical State Compliance
SM-2.1 Voya ensures computing environments that access, process, store, or transmit Client PII are continually in compliance with quality and security requirements including, but not limited to, authentication/authorization, monitoring/management, network design, connectivity design, firewall and intrusion prevention technologies, and storage and backup capabilities.

SM-2.2 Voya ensures IT Risk Management facilitates risk assessments of information technology processes and procedures in accordance with the annual IT Risk Assessment Plan approved by the IT/Privacy Risk Committee. Risk Assessment results are communicated to management for awareness and resolution or risk acceptance of findings based on management’s risk appetite.

SM-3: Security and Penetration Testing
SM-3.1 Voya implements and maintains vulnerability and penetration testing (Ethical Hacking) processes to ensure the computing environment where Client PII is accessed, processed, stored, or transmitted is continually protected from internal and external security threats.

SM-3.2 Voya implements and maintains a process for vulnerability scanning on at least a monthly basis and ensures issues are remediated, utilizing a risk based approach within a reasonable timeframe.

SM-3.3 Penetration testing (Ethical Hacking) of Internet facing systems or systems exposed to un- trusted networks is conducted prior to the system being deployed into a production status, after any significant changes, and then at least once every 12 months thereafter.

207 of 493

1 EMPLOYER SERVICES AGREEMENT

BY AND BETWEEN

VOYA RETIREMENT INSURANCE AND ANNUITY

COMPANY
AND
CITY OF SAN MATEO 401(h) HRA (“EMPLOYER”)
Effective Date: January 1, 2024

208 of 493

2 This EMPLOYER SERVICES AGREEMENT (the "Agreement'') is effective as of January 1, 2024 (the "Effective Date"), between Voya Retirement Insurance and Annuity Company ("Voya"), a corporation organized and existing under the laws of the State of Connecticut, directly and on behalf of its Affiliates, and City of San Mateo 401(h) HRA ("Employer"). Voya and Employer are each referred to as a "Party" and collectively as the "Parties" under this Agreement.

WITNESSETH:

WHEREAS, Section 401(h) of the Internal Revenue Code of 1986 (the “Code”) permits a qualified pension plan to provide for payment of benefits for sickness, accident, hospital and medical expenses for retired employees, their spouses and dependents under a separate retiree medical account; WHEREAS, the Employer sponsors a Code Section 401(a) pension plan with a 401(h) retiree medical account, as identified on Exhibit A (the “401(h) Program”); and WHEREAS, the Employer wishes to engage Voya as an administrative service provider to facilitate the administration of the 401(h) Program by providing administrative services; and WHEREAS, Voya agrees to provide the services set forth in this Agreement; and WHEREAS, the Parties desire to enter into an agreement to set forth their respective rights, duties and obligations with respect to the delivery of such services.

NOW, THEREFORE, in consideration or the mutual promises and covenants contained herein, it is hereby agreed as follows:

209 of 493

3 Section 1 – Definitions
When these terms are capitalized in the Agreement they have the meanings set forth below. The words may be singular or plural.
“Account” means the individual participant’s 401(h) account administered using the Application or Services.
“Affiliate” means entities that currently exist or are later acquired that, directly or indirectly, (i) control, (ii) are controlled by, or (iii) are under common control with Voya or the Employer. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through the ownership or voting securities, by contract, or otherwise. “Application” means the web-based software application(s) and supporting services described in the Application Exhibit(s) attached hereto. For purposes of this Agreement, the singular “Application” refers to all web-based software applications to which the Employer and/or the Participant is granted access. “ERISA” means the Employee Retirement Income Security Act of 1974, as amended, and its associated regulations.
“IRC” means the Internal Revenue Code of 1986, as amended from time to time, and the regulations promulgated thereunder.
“IRS” means the Internal Revenue Service.
“Participant” means a person who has established and maintains an Account under the 401(h) Program.

It is the Employer’s sole responsibility to notify Voya when a Participant becomes eligible to make claims for reimbursements pursuant to Section 6.1.
“PHI” shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, as applied to the information created, received, maintained or transmitted by Voya or its subcontractors from or on behalf of the 401(h) Program.
“Service Fees” shall include the fees set forth in Exhibit C to the Agreement. “Services” means administrative services as set forth on the Exhibit(s) that assist with processing and administration of Accounts and/or benefit plans/programs and includes the business processes used to deliver the Services.
“Systems” means the systems Voya owns or makes available to Employer to facilitate the transfer of information in connection with this Agreement.

Section 2 - Services
Section 2.1 Services. Voya, its Affiliates and its designated subcontractors will perform Services for the 401(h) Program as described herein in Exhibit B. All rights granted to, and all benefits received by, the Employer pursuant to this Agreement will extend to Employer's Affiliates.

Section 2.2 Voya’s Provision of Services. Voya has subcontracted with (1) Benefit Plan Administrative Services (“BPAS”) to provide systems, plan administration, contribution processing, and recordkeeping for the Services; and (2) WEX Health to provide claims processing technology and related services (“WEX”). In addition to BPAS and WEX, Voya may enter into one or more subcontracting agreements in connection with the performance of the Services under this Agreement (together with BPAS and WEX, each, a “Subcontractor,” and

210 of 493

4 collectively, the “Subcontractors). Voya may also substitute another subcontractor for BPAS and/or WEX by providing advance written notice to Employer. Voya shall remain responsible for the performance of any Subcontractor. All references to Voya in this Agreement and Exhibits shall be deemed to include a Subcontractor unless otherwise specifically noted.

Section 3 - Employee Benefit Plans
Section 3.1 Responsibility for the Employer’s 401(h) Program. Any references in this Agreement to Voya "administering” the 401(h) Program or the Accounts are descriptive only and do not confer upon Voya anything beyond certain agreed upon ministerial duties being provided by Voya.

Employer accepts total responsibility for its 401(h) Program for purposes of this Agreement, including its benefit design and compliance with any laws that apply to Employer or the 401(h) Program.

Section 3.2 Employer Initiated Changes . Employer must provide Voya with written notice of any changes to the Employer’s 401(h) Program within sixty (60) calendar days prior to the effective date of the change to allow Voya to determine if such change will alter the Services Voya provides under this Agreement. Any material change in the Services must be mutually agreed to in writing by the Parties. For the avoidance of doubt, any changes to the 401(h) Program that do not alter the Services or Service Fees hereunder may be agreed to by the Parties via electronic communication, or such other form of written communication to which the Parties agree. Voya will notify Employer if (i) the change increases Voya’s cost of providing Services under this Agreement or (ii) Voya is reasonably unable to implement or administer the change. If the Parties cannot agree to a new Service Fee within thirty (30) days of the notice of the change, or if Voya notifies the Employer that Voya is unable to reasonably implement or administer the change, Voya shall have no obligation to implement or administer the change.

Section 3.3 401(h) Program Consistent with this Agreement. By entering into this Agreement, Employer certifies that Voya’s Services will not conflict with the terms of any plan document, summary plan description, insurance policy, group funding agreement, or other applicable documents governing the 401(h) Program.

Section 3.4 Employee Communications. Before distributing any communications describing the 401(h) Program, Employer will provide Voya with copies of any such communications that refer to Voya or the Services prior to distributing these materials to Employer’s employees or third parties.

Voya will provide any corrections or comments to the Employer in writing within a commercially reasonable time period after receipt. Employer agrees to amend the materials or communications if the references to Voya are not accurate, or any provision is not consistent with this Agreement or the Services that Voya is providing. Voya will not be bound by any communication that has not been reviewed and approved by Voya.

Section 3.5 Affiliated Employers. Employer represents that Employer and any of Employer's Affiliates covered under the 401(h) Program make up a single "controlled group" as defined by Section 1563 of the IRC and the regulations thereunder. Employer agrees to provide Voya with a list of Employer's Affiliates covered under the Plan upon request.

211 of 493

5 Services as described in accordance with Exhibit B. Employer will notify Voya of any change to this information as soon as reasonably possible. Voya will be entitled to rely on the most current information in Voya's possession regarding eligibility of Participants in paying benefits from the Accounts and providing other Services under this Agreement. Voya shall not be responsible or liable for acts or omissions made in reliance on erroneous data provided by the Employer or any other person, including any Participant, or for the failure of Employer to perform its obligations under this Agreement. Any retroactive eligibility changes which impact claims for benefits from the Account will be mutually agreed upon by the Parties. If Voya agrees to make retroactive eligibility changes, additional reasonable Service Fees may apply, as mutually agreed. The Employer shall also ensure payroll data processors provide timely, accurate and complete data files in the prescribed electronic data file format and method specified by Voya or a Subcontractor, as applicable, in accordance with the Operating Procedures set forth in Exhibit D.

Section 4.2 Employer as Plan Administrator. The Employer or its delegate will exercise all discretion, control and authority with respect to the disposition of the 401(h) Program plan assets and the available benefits under the 401(h) Program.

Section 4.3 Employer’s Administrative Responsibilities . The Employer shall ensure that any plan documents and any other documentation, as applicable, relating to the 401(h) Program are appropriately completed, are in compliance with its requirements and all applicable law, and are appropriately and timely adopted. The Employer shall provide Voya with a current copy of such documents governing the administration of the 401(h) Program. The Employer shall be responsible for distributing summary plan descriptions, summaries of material modifications and all other plan documentation to Participants and other individuals on a timely basis. Employer acknowledges that Voya (and its affiliates and subcontractors) are not authorized to provide legal or tax advice and no service, communication or other act or omission by Voya should be construed as legal or tax advice.

Section 4.5 Escheatment. Employer is solely responsible for complying with all applicable abandoned property or escheat laws, making any required payments, and filing any required reports.

Voya shall provide its standard reports to Employer in order to support Employer’s escheatment process, if applicable.

Section 4.7 Employer Direction. In the course of providing the Services, Voya may receive written or oral instructions or directions from representatives of the Employer, including its legal counsel (hereinafter collectively referred to as “Employer Directions”), concerning the provision of Services. Employer Directions may include, but shall not be limited to, (i) approval of Voya’s choice of methodology or approach to providing the Services; (ii) interpretation of any provision of the 401(h) Program; (iii) instructions concerning compliance with applicable laws and regulations; (iv) instructions concerning compliance with subpoenas or other legal process; and (v) notices concerning adjudication of Participants’ claims for benefits. Exhibits B and C and the elections made by the Employer in the 401(h) Program Questionnaire shall be deemed to be a standing Employer Direction.

212 of 493

6 Section 4.8 Reliance. Voya may rely upon and comply with any Employer Direction in performing its obligations under this Agreement. If and to the extent that Voya acts or fails to act as a result of reasonable reliance upon any Employer Direction or any information, data, document or instrument supplied by Employer or a Participant, Voya shall be relieved of any liability arising therefrom and such act or failure to act shall not constitute a default, breach or nonperformance of any warranty or obligation of Voya contained in this Agreement; provided, however, that Voya shall not be relieved of any liability arising out of or resulting from dishonest, fraudulent, or criminal acts of Voya’s employees, acting alone or in collusion with others. If Voya requests instruction or direction from Employer and does not receive a Employer Direction in a timely manner, Voya shall be deemed not to have breached this Agreement with respect to any act or failure to act undertaken in good faith relating to the instructions requested.

Section 5 – Investment Options
Section 5.1 Selection of Investment Options. Employer shall be solely responsible for the selection of all investment options available to Participants in the 401(h) Program. Voya shall have no responsibility or discretion under the terms of this Agreement for the prudence, selection or oversight of any investment options available to Participants in the 401(h) Program. Employer acknowledges and agrees that (i) all investment information or investment materials that may be provided to Employer are provided to enable Employer to independently assess available options and make investment decisions for the Plans and (ii) the provision of any such information or materials is not intended to constitute nor should it be construed as the provision of investment advice or investment recommendations by Voya with respect to any investment option that Employer may consider making available under the Plans.

Participants shall have the ability to choose their investment allocations and to make participant-directed transfers between investment options, subject to any limitations of the investment platform.

Section 6 – Services and Error Correction
Section 6.1 Employer Eligibility Determinations . As set forth in Section 4.1, the Employer, in its sole discretion, shall determine which individuals are eligible to participate in the 401(h) Program

213 of 493

7 and shall provide Voya with timely, accurate, and complete initial and ongoing enrollment and eligibility data in the electronic data file format prescribed by Voya. Such information shall include, but is not limited to, the number and names of individuals eligible for and covered under the 401(h) Program, eligibility for making claims for benefits, and any other information determined by Voya to be necessary to provide the Services. Voya shall process initial and ongoing enrollment and eligibility data submitted by the Employer in the format and specifications prescribed by Voya during the implementation process. Voya shall also process enrollment data and benefit elections submitted by the Employer through proper methods established by Voya. The Employer shall provide timely notifications regarding a Participant’s eligibility to make claims for benefits.

Section 6.2 Voya’s Responsibilities . Voya shall provide certain Services in connection with the 401(h) Program. Accordingly, the Employer authorizes Voya to use Voya’s standard procedures for the provision of Services that have been designed to ensure that the administration of the 401(h) Program. Voya shall not have discretionary authority or discretionary controls respecting any aspect of plan administration or the management of any trust fund and shall not have authority to exercise, nor exercise, any control respecting management and shall not render investment advice with respect to any money or other property of any trust fund.

Section 6.5 Payments. Voya shall issue payments for eligible expenses on behalf of a Participant directly to the health provider or shall issue a reimbursement payment for eligible expenses through either check or direct deposit to the Participant, as directed by the Participant. Voya will process debit card transactions and authorize payments made directly to approved payees (e.g., health care providers, drugstores or qualifying merchants) via a debit card, if requested by the Employer.

Section 6.6 Services/Changes. The Services provided by Voya are generally described in Exhibit B.

Any changes to such Services require the written consent of both Parties.

Section 6.7 Error Correction.

6.7.1 Voya Error. Voya shall promptly notify Employer after becoming aware of an error resulting from the acts or omissions of Voya’s computer system malfunctions, its staff errors or otherwise caused by Voya’s negligent acts. Voya shall make a good faith effort to correct any such error as soon as reasonably practicable after identification of the error and, where applicable, Employer’s determination or approval of the correction to be applied to such error. Voya processes investment instructions on an “omnibus” or aggregated basis. If Voya’s correction of a Voya processing error results in a loss to the 401(h) Program or its Participants, Voya will absorb the loss. If any gain results in connection with the correction of a Voya processing error, Voya will net any such gain against other losses absorbed by

214 of 493

8 Voya and retain any resulting net gain as a component of its compensation for transaction processing services, including its agreement to make Plan and Participant Accounts whole for losses resulting from Voya processing errors.

Section 7.2 Changes in Service Fees. Voya shall have the right to change the Service Fees with reasonable advanced written notice to Employer (i) any time there are changes made to this Agreement or the provisions of the 401(h) Program that affect the Service Fees, or (ii) when there are changes in laws or regulations that affect the Services Voya are providing, or will be required to provide, under this Agreement. Any new Service Fee required by such change will be effective as of the date the changes occur. Voya will provide Employer with a new Exhibit C that will replace the existing Exhibit C or an amendment stating the new Service Fees. If Employer does not agree to any change in Service Fees, then Employer may terminate this Agreement upon written notice. Such termination must be sent by Employer within thirty (30) days after Employer receives written notice of the new Service Fees and the Employer’s written notice must state when such termination shall become effective. Employer must still pay any Service Fees due for the periods during which the Agreement is in effect.

215 of 493

9 Section 9.1 Term. This Agreement shall commence on January 1, 2024, and, unless sooner terminated as set forth in this Section 10, shall continue for an initial term of Five (5) years (“Initial Term”).

Following the expiration of the Initial Term, this Agreement shall automatically renew for subsequent 5- year periods unless either the Employer or Voya provides written notice to the other party of its intent not to renew this Agreement at least ninety (90) calendar days before the end of the then current term. The Initial Term and any renewal terms constitute the “Term.” Section 10 – Termination
Section 10.1 Termination Events.

10.1.2 Voya may terminate this Agreement immediately upon notice to Employer if Employer fails to provide the required funds for payment of benefits under the terms of this Agreement.

Section 11 – Records and Information
Section 11.1 Records. Voya will keep records relating to the Services Voya provides under this Agreement for as long as Voya is required to do so by law.

Section 11.2 Access to Information. If Employer needs information in Voya’s possession for lawful or legitimate purposes other than an audit, Voya will provide Employer access to such information, if it is legally permitted to do so and the information relates to Voya’s Services under this Agreement, provided the Employer gives Voya reasonable advance notice and an explanation of the need for such information.

Employer represents that Employer has reasonable procedures in place for handling PHI, as required by

216 of 493

10 law. Employer will only use or disclose PHI as permitted under this Agreement or by applicable laws.

Section 11.6 PHI. The Parties’ obligations with respect to the use and disclosure of PHI are outlined in the Business Associate Addendum attached to this Agreement as Exhibit E.

Section 12 – System Access
Section 12.1 System Access. Voya grants Employer the nonexclusive, nontransferable right to access and use the functionalities contained within the Systems, under the terms specified in

217 of 493

11 this Agreement. Employer agrees that all rights, title, and interest in the Systems and all rights in patents, copyrights, trademarks, and trade secrets encompassed in the Systems will remain Voya’s. To obtain access to the Systems, Employer will obtain, and be responsible for maintaining, at no expense to Voya, the hardware, software, and Internet browser requirements Voya provides to Employer, including any amendments thereto. Employer will be responsible for obtaining an Internet Service Provider or other access to the Internet. Employer will not (i) access Systems or use, copy, reproduce, modify, or excerpt any Systems documentation provided by Voya in order to access or utilize Systems, for purposes other than as expressly permitted under this Agreement or (ii) share, transfer or lease Employer’s right to access and use Systems, to any other person or entity that is not a Party to this Agreement without Voya’s consent. Employer may designate any third party to access Systems on Employer’s behalf, provided the third party agrees to these terms and conditions of Systems access and Employer assumes joint responsibility for such access.

Section 13 – Indemnification
Voya shall indemnify and hold harmless Employer from and against third-party claims resulting solely from or arising out of Voya’s gross negligence or willful misconduct relating to the Services provided hereunder. Voya’s obligation to indemnify Employer will only apply if Employer notifies Voya promptly, in writing, as to any such claim for which indemnification is sought and gives Voya the right, upon being notified, to exclusively control and direct the investigation, preparation, defense, trial and settlement of each such claim so long as Voya continues to diligently pursue such defense or settlement. Employer shall not, without Voya’s prior written consent (not to be unreasonably withheld, conditioned or delayed), settle, compromise, or consent to the entry of any judgement in any pending or threated claim, action, or proceeding in respect of which indemnification is sought under this Agreement. Employer will reasonably cooperate with Voya in the defense and/or settlement of any such claim.

218 of 493

12 Except as expressly prohibited by applicable law, Employer shall indemnify and hold harmless Voya, its Affiliates, assigns, directors, officers, employees, agents, and its Subcontractors (the “Voya Parties”) from and against claims resulting from or arising out of breach of this Agreement by Employer or its employees including with respect to gross negligence or willful misconduct, employment-related decisions, or any claims or liabilities relating to work status, compensation, tax, insurance, or benefits by Employer’s employees under this Agreement. This includes any third-party claims brought against Voya Parties as the claims administrator, or due to the Employer's failure to act in accordance with applicable provisions of the IRC and associated guidance issued by the IRS with respect to the 401(h) Program, including, but not limited to, any reporting requirement; and/or claims against Voya Parties relating to the 401(h) Program utilized by Employer's employees. Employer's obligation to indemnify Voya Parties will only apply if the Voya Party notifies Employer promptly, in writing, as to any such claim and gives Employer the right to control and direct the investigation, preparation, defense, trial and settlement of each such claim. Voya Parties will reasonably cooperate with Employer in the defense and/or settlement of any such claim. The indemnification obligations of a Voya Party and Employer shall terminate upon the expiration of the Agreement except as to any matter concerning which a claim has been asserted by notice to the other Party by at the time of such expiration or within the applicable statute of limitation after the effective date of Agreement termination.