G
RANT AGREEMENT FOR
KEEP PEOPLE HOUSED (KPH) – SONOMA
WITH THE COMMITTEE ON THE SHELTERLESS (COTS)
(PO F002819/V004387)
T
his Agreement is made this ____ day of _____________, 2024 by and between the CITY OF SANTA ROSA (“City”) and COMMITTEE ON THE SHELTERLESS, a California non-profit corporation (“Contractor”).
RE
CITALS
A. T
he City, in partnership with the County of Sonoma (“County”), the City of Petaluma (“Petaluma”), and All Home (a Bay Area organization), developed a regional homelessness prevention pilot program (Keep People Housed (“KPH”) – Sonoma). All Home’s prevention model pairs rapid, flexible financial assistance with housing stabilization services and legal aid referrals for people facing eviction and prioritizes households with income below 50% of Area Median Income (AMI) using an on-line platform developed and maintained by Bay Area Community Services (BACS).
B. O
n May 29, 2024, City issued a Request for Proposals (RFP) for a contractor to serve as Lead Provider to operate KPH – Sonoma. Following this process, Contractor was selected as the operator of KPH – Sonoma.
C. Cit
y wishes to fund the Program using City, County, and Petaluma funds, pursuant to a separate Agreement between the City of Santa Rosa, the County of Sonoma, and the City of Petaluma for Funding of a Homelessness Prevention Pilor Program, Keep People Housed (KPH) – Sonoma, for Fiscal Years 2024- 2025 and 2025-2026 (“Funding Agreement”).
D. T
he parties have negotiated the terms pursuant to which Contractor will operate and the City will fund KPH – Sonoma (“Program”) and have herein reduced such terms to writing.
AG
REEMENT
1. SCOPE OF SERVICES
C
ontractor shall, in a manner satisfactory to City, administer and conduct the Program described in Exhibit A (“Scope of Services”).
2. TERM OF AGREEMENT
T
he term of this Agreement shall commence on October 1, 2024 and shall end on June 30, 2026.
Exhibit B
3. GRANT
A. Notwithstanding any other provision of this Agreement, Program funding from City to Contractor shall not exceed One Million Three Hundred Thousand ($1,300,000) for the period of October 1, 2024, through June 30, 2026, for costs reasonably related to the administration of the Program subject to approval of the Funding Agreement. In the event County and Petaluma fail to approve funding for the Program or there is a reduction in anticipated funding for the Program, parties shall discuss the impact to the Scope of Services. All Home will provide a match of philanthropic funds up to $2,600,000 to be secured under a separate agreement between All Home and the Contractor.
B. The City’s Chief Financial Officer is authorized to pay all proper claims for funds from the Grant Award from Fund 1209 and Key 340707. Subject to the appropriation of additional funding by the City Council, County, and Petaluma, City and Contractor may amend this Agreement to fund the Program for subsequent years.
C. Contractor shall use Grant Award funds exclusively for purposes of administering the Program, in accordance with the Scope of Services in Exhibit A, and as determined by the City.
D. Payments by City to Contractor shall be made monthly in arrears based on the Budget in Exhibit B and upon the proper documentation of expenditures, as determined by the City’s Director of Housing and Community Services (Director). On or before the fifteenth day of each month, Contractor shall submit an invoice to City for the prior month. The Director will review each invoice and may deny reimbursement where: 1) an expenditure is not in furtherance of administering the Program or improperly documented; or 2) where Contractor has not provided Program services in accordance with the Scope of Services in Exhibit A. Invoices submitted after 30 days shall include acceptable written justification for the delay. The Director may deny reimbursement or demand additional information if the Director determines, in the Director’s sole discretion, that Contractor’s written justification for delayed submittal of invoices is not acceptable.
E. I n the event that the Director determines that Contractor is not fully providing the Program Scope of Services identified in Exhibit A, the Director shall have the right to reduce the Grant Award, unless the failure to provide the Scope of Services is beyond Contractor’s control. The exercise by the Director of City’s rights under this provision shall not be construed as a waiver by City of any other right or remedy.
4. INSURANCE
Contractor shall maintain in full force and effect all of the insurance coverage described in, and in accordance with, Attachment One, “Insurance
Requirements” which is attached hereto and hereby incorporated and made part of this Agreement by this reference. Maintenance of the insurance coverage as set forth in Attachment One is a material element of this Agreement and a material part of the consideration provided by Contractor in exchange for City’s agreement to make the payments prescribed hereunder. Failure by Contractor to (i) maintain or renew coverage, (ii) provide City notice of any changes, modifications, or reductions in coverage, or (iii) provide evidence of renewal, may be treated by City as a material breach of this Agreement by Contractor, whereas City shall be entitled to all rights and remedies at law or in equity, including but not limited to immediate termination of this Agreement. Notwithstanding the foregoing, any failure by Contractor to maintain required insurance coverage shall not excuse or alleviate Contractor from any of its other duties or obligations under this Agreement. In the event Contractor, with approval of City pursuant to Section 10 below, retains or utilizes any subcontractors in the provision of any services under this Agreement, Contractor shall assure that any such subcontractor has first obtained, and shall maintain, all of the insurance coverage requirements set forth in the Insurance Requirements in Attachment One.
5. INDEMNITY/LIABILITY
Contractor shall, to the fullest extent permitted by law, indemnify, protect, defend and hold harmless City, and its employees, officials and agents (“Indemnified Parties”) from all claims, demands, costs or liability (including liability for claims, suits, actions, arbitration proceedings, administrative proceedings, regulatory proceedings, losses, expenses or costs of any kind, interest, defense costs, and expert witness fees), that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of Contractor, its officers, employees, volunteers or agents, in said performance of services under this Agreement, excepting only liability arising from the sole negligence, active negligence or intentional misconduct of City. If there is a possible obligation to indemnify, Contractor’s duty to defend exists regardless of whether it is ultimately determined that there is no obligation to indemnify.
6. INDEPENDENT CONTRACTOR
The parties intend that Contractor, in performing services specified in Exhibit A, shall act as an independent contractor and shall have control of its work and the manner in which it is performed. It shall be free to contract for similar services to be performed for other employers while it is under contract with City. Contractor is not to be considered an agent or employee of City and is not entitled to participate in any pension plan, medical, or dental plans, or any other benefit provided by City for its employees.
7. SUCCESSORS AND ASSIGNS
City and Contractor each bind itself, its partners, successors, legal representatives, and assigns to the other party to this Agreement and to the
partners, successors, legal representatives and assigns of such other party with respect to all promises and agreements contained herein.
8. FINANCIAL REQUIREMENTS/AUDITS/REPORTING
A. Contractor shall be accountable to City for all City funds requested by and disbursed to Contractor or its subcontractors from the Grant Award under this Agreement.
B. Contractor shall maintain a full set of books on a double entry basis in accordance with generally accepted accounting principles (GAAP), procedures, and regulations as deemed necessary by City. Such records shall be maintained by qualified personnel and completed in a timely manner.
C. Contractor shall, at all times during normal business hours and as often as City may deem necessary, make available to City or its representatives for examination all of Contractor’s or subcontractor’s records with respect to all matters covered by this Agreement and shall permit City or its representatives to audit, examine and make excerpts or transcripts from such records, and to make audits of all documents and conditions relating to this Agreement.
D. Contractor shall permit and facilitate observation and inspection of Program services and records at Contractor’s principal office and work site by City, its employees, auditors, representatives, and public authorities during reasonable business hours.
E. Contractor shall either establish a separate bank account for all funding received from City under this Agreement or practice full fund accounting.
Contractor shall not commingle the funds provided under this Agreement with any other funds, revenue or monies.
F. Contractor shall maintain all records related to the performance of this Agreement during the term of this Agreement and for a period of five (5) years after completion of all services hereunder.
G. Authorized representatives of City may perform fiscal monitoring of Contractor’s record keeping and reporting to assure compliance with this Agreement.
H. Prior to the commencement of the Program, Contractor shall enter into written agreements with all subcontractors performing Program services under this Agreement and shall include therein the terms in subsections B through G of this Section 8. Contractor shall submit all such subcontracts to City for its review and approval prior to the commencement of the Program.
9. BUDGET
Any requested modification to the line items of the Budget shall be reviewed and approved by the Director prior to the expenditures of funds detailed in the requested modification. Budget modifications shall not alter: 1) the Scope of Services; or 2) the total grant award under Section 3.
10. SUBCONTRACTS
A. Any subcontract funded under this Agreement shall be submitted to the Director for review and approval prior to its execution.
B. Any subcontract funded under this Agreement shall be subject to the terms and conditions of this Agreement.
11. CONFLICT OF INTEREST
A. Section 42 of the City Charter and the City’s Conflict of Interest Code expressly apply to this Agreement. Contractor shall be responsible for ensuring compliance with this provision.
B. Contractor shall inform Director of staffing changes at the executive/management level and changes in the membership of its Board of Directors within 30 days of such changes.
12. PUBLICITY
During the term of this Agreement and for one year thereafter, Contractor shall acknowledge City’s contribution to the Program in all publicity regarding the Program, including but not limited to, website and social media, flyers, press releases, posters, brochures, public service announcements, interviews, and newspaper articles. The words "City of Santa Rosa” shall be explicitly stated in any and all pieces of publicity, with respect to the Program.
Upon request, City staff shall assist Contractor in generating publicity for the Program. Contractor agrees to cooperate with City staff in any City-generated publicity or promotional activities related to the Program.
13. RELIGIOUS ACTIVITY PROHIBITED
Contractor agrees that the Grant Amount will not be used for religious activities, to promote religious interests, or for the benefit of a religious organization.
14. NON SOLICITATION CLAUSE
Contractor warrants that it has not employed or retained any company or
persons, other than a bona fide employee working solely for Contractor, to solicit or secure this Agreement and that it has not paid or agreed to pay any company or person other than a bona fide employee working solely for Contractor, any fee, commission, percentage, brokerage fee, gifts, or any other consideration, contingent upon or resulting from the award or making of this Agreement. For breach or violation of this warranty, City shall have the right to rescind this Agreement without liability or, at its discretion, reduce the grant award under this Agreement, or otherwise recover the full amount of such fee, commission, percentage brokerage fee, gift or contingent fee.
15. FIXED ASSETS
For purposes of this Agreement, a fixed asset is any physical item, excluding real property, having a cost in excess of $300.00 and a usable life of three years or more.
Contractor’s annual report to City, pursuant to Section 17(C), shall include invoices and receipts of payment for all fixed assets purchased in furtherance of carrying out the Scope of Services outlined in Exhibit A. If at any time Contractor discontinues the Program, at any time during or after the Agreement period, all fixed assets purchased or acquired by Contractor having a cost in excess of $300.00 and a usable life of one year or more revert back to City.
16. PUBLICATION RIGHTS COPYRIGHTS AND DATA OWNERSHIP
A. The copyright to any reports, papers, forms, or other materials or documents that are created in connection with the services performed under this Agreement, except communications, shall vest in City unless otherwise authorized in writing by City.
B. All reports, documents, forms, photographs, maps, data and any other materials developed, collected or prepared by Contractor pursuant to this Agreement, except communications, shall be the exclusive property of City unless written waiver is executed by City.
C. Publication rights to any documents or materials produced for publication to the general public are to be reserved by City.
D. Both written and oral releases are considered to be within the context of publication. However, there is no intention to limit discussion of the Program with small technical groups or lectures to employees or students. Lectures to other groups which describe the Program but disclose neither data nor results are permissible without advance approval from the City.
E. City reserves a royalty-free nonexclusive and irrevocable right to reproduce, publish or otherwise use, and to authorize others to use the work developed pursuant to this Agreement, for governmental purposes.
17. PROGRAM MONITORING AND EVALUATION
A. Purpose
City shall monitor and evaluate Contractor’s effectiveness and timely compliance with the provisions of this Agreement and the effective and efficient achievement of Program objectives.
Contractor shall appoint a representative to be available to City for consultation and assistance during the performance of this Agreement.
During the effective term of this Agreement, Contractor shall undertake continuous quantitative and qualitative evaluation of the Scope of Services and shall make regular written reports to City.
B. Responsibilities of City
City shall monitor and evaluate the Program’s effectiveness and administration, including Contractor’s effectiveness and timely compliance with the provisions of this Grant Agreement.
C. Responsibilities of Contractor
Contractor shall submit monthly reports to the City, utilizing the Monthly Status Report form in Exhibit C. These monthly reports shall be submitted by the 15th day of the month following the close of the month which document the activities of the previous month consistent with the Scope of Services as more fully set forth in Exhibit A. The monthly reports shall be compiled into an annual cumulative report and submitted to the City by the Contractor at the end of each fiscal year, no later than July 31st. In the event financial or reporting issues are identified by City or through a compliance review by City, Contractor may be required to reimburse the City for funds that were expended on ineligible activities. Consistent with Section 3(C), the activities eligible for payment with Grant Award funds in accordance with this Grant Agreement shall be determined by the City.
D. Homeless Management Information System
Contractor must be in good standing in collecting and entering current, accurate, and comprehensive data that reflects the homeless prevention and intervention services delivered by Contractor into the Homeless Management Information System (HMIS), as defined by HUD, as a condition of funding under this Agreement. HMIS requirements are further described in Exhibit D.
18. FAIR HOUSING AND EQUAL OPPORTUNITY CERTIFICATIONS
A. Civil Rights Act of 1964 (Title VI)
Title VI of the Civil Rights Act of 1964 (42 U.S.C. §§ 2000d et seq.; P.L. 88- 352) and regulations pursuant thereto (Title 24 CFR § 1) states that no person in the United States shall, on the basis of race, color, or national origin, be excluded from participation in, be denied the benefits of, or otherwise be subjected to discrimination under any program or activity receiving Federal financial assistance extended to Contractor. This assurance shall obligate Contractor, or in the case of any transfer, the transferee, for the period during which the real property and structure(s) are used for a purpose for which the Federal financial assistance is extended or for another purpose involving the provision of similar services or benefits.
B. Fair Housing Act of 1968
The Fair Housing Act (42 U.S.C. §§ 3601-3620; P.L. 90-284) states that it is the policy of the United States to provide, within constitutional limitations, for fair housing throughout the United States and prohibits any person from discriminating in the sale or rental of housing, the financing of housing, or the provision of brokerage services, including in any way making unavailable or denying a dwelling to any person, because of race, color, religion, sex, national origin, handicap or familial status. Contractor shall administer all programs and activities assisted under this Agreement in a manner to affirmatively further the policies of the Fair Housing Act.
C. Executive Order 11063 -- Equal Opportunity in Housing
Executive Order 11063, as amended by Executive Order 12259, and regulations pursuant thereto (24 CFR § 107), prohibits discrimination because of race, color, creed, sex, or national origin in the sale, leasing, rental or other disposition of residential property and related facilities (including land to be developed for residential use), or in the use or occupancy thereof, if such property and related facilities are provided with Federal financial assistance.
D. Section 109 of the Housing and Community Development Act of 1974
Section 109 of the Housing and Community Development Act of 1974 states that no person in the United States shall on the basis of race, color, national origin, or sex be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity funded in whole or in part with funds made available under this title.
Section 109 further provides that any prohibition against discrimination on the basis of age under the Age Discrimination Act of 1975 (42 U.S.C. §§ 6101 et seq.) or with respect to an otherwise qualified handicapped person as
provided in section 504 of the Rehabilitation Act of 1973 (29 U.S.C. §794) shall also apply to any program or activity funded in whole or in part with funds made available pursuant to Section 109.
E. Executive Order 13166 - Limited English Proficiency
The Limited English Proficiency (LEP) Guidelines, based upon Title VI of the Civil Rights Act of 1964 (24 CRF 1.4 Executive Order 13166) requires recipients of federal funding to provide language translation or interpreter services to its clients and potential clients who are limited in English proficiency.
A person with Limited English Proficiency (LEP) is a person who does not speak English as their primary language and who has a limited ability to read, write, speak or understand English. Affirmative steps must be taken to communicate with people who need services or information in a language other than English. A policy must be developed to serve applicants, participants, and/or persons eligible for housing assistance and support services.
Contractor must analyze the various kinds of contacts it has with the public, to assess language needs and decide what reasonable steps should be taken.
In order to determine the level of access needed by LEP persons, the following four factors must be balanced:
1. the number or proportion of LEP persons eligible to be served or likely to be applying for program services;
2. the frequency with which LEP persons utilize these programs and services;
3. the nature and importance of the program, activity, or service provided; and
4. the benefits from providing LEP services, and the resources available and costs to the CDC for those services.
Balancing these four factors will ensure meaningful access by LEP persons to critical services while not imposing undue burdens on the Contractor.
Contractor shall develop and implement a LEP policy consistent with the above guidelines and provide City with copies of its LEP Policy.
F. Section 504 of the Rehabilitation Act of 1973 and Americans with Disabilities Act of 1990
Section 504 of the Rehabilitation Act of 1973, as amended, prohibits discrimination based on handicap in federally assisted and conducted programs and activities. In performance of this Agreement, Contractor shall perform all services described herein in compliance with all applicable federal, state and local laws, rules, regulations, and ordinances, including but not
limited to Rehabilitation Act of 1973 (29 U.S.C. § 794) and the Americans With Disabilities Act (ADA) of 1990, (42 U.S.C. §§ 12101, et seq.), and any regulations and guidelines issued pursuant to the ADA, which generally prohibits discrimination against individuals with disabilities and may require reasonable accommodations.
G. Age Discrimination Act of 1975
The Age Discrimination Act of 1975, as amended, prohibits discrimination because of age in programs and activities receiving Federal financial assistance.
H. Executive Orders 11625, 12432, 12138 - Minority and Women Owned Business Opportunities
These Executive Orders state that program participants shall take affirmative action to encourage participation by businesses owned and operated by minority groups and women.
19. DRUG-FREE WORKPLACE
Contractor acknowledges that pursuant to the Federal Drug-Free Workplace Act of 1989, the unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited on Contractor’s premises. Contractor agrees that any violation of this prohibition by Contractor, its employees, agents, or assigns will be deemed a material breach of this Agreement.
20. ASSIGNMENT
Contractor shall not assign any rights or duties under this Agreement to a third party without the express written consent of City.
21. MODIFICATION
This Agreement shall not be modified except in writing executed by both parties.
The City Manager, or designee, is authorized to approve and execute amendments to this Agreement on behalf of the City.
22. TERMINATION OF AGREEMENT
A. City may terminate this Agreement for convenience upon ten (10) days’ written notice to Contractor. Upon such notice, Contractor shall immediately suspend all services under this Agreement.
B. City may terminate this Agreement immediately for cause, which shall include as example but not as a limitation:
1. Failure, for any reason, of Contractor to fulfill, in a timely and proper manner, its obligations under this Agreement including compliance with City, State, and Federal laws and regulations and applicable directives;
2. Failure to meet the performance standards contained in other sections of this Agreement;
3. Improper use or reporting of funds provided under this Agreement;
4. Suspension, termination or modification of any of the sources of funds upon which City planned to fund this Agreement;
5. Any event, (whether natural, social, political or financial) which is beyond the control of City and which results in a change in the funds available to City, or which triggers a need by City to reallocate funding to Contractor.
C. In connection with the provisions of subsections A and B above, Contractor understands that City has based its overall allocation of funds to Contractor on the basis of current budgeting requirements and the execution of the Funding Agreement. It is therefore agreed that during the term of this Agreement, should all or any part of the funding available to City be reduced in any amount whatsoever, or should be faced with unusual or unexpected natural, social, political or financial events which diminish City’s ability to fund agreements with Contractor and other recipients, or which events generate additional needs in the community, then City shall have the right to review and reallocate the amount of funding to be advanced to Contractor under this Agreement. On any of the occurrences described above, City may terminate all or any part of the remaining funding due to Contractor under this Agreement. City shall have the sole discretion to determine whether there is a need to reallocate or terminate funding to Contractor, as well as the sole discretion to determine the amount of the reduction and reallocation.
D. Should such a reduction in funding occur, City shall notify Contractor as soon as reasonably practicable after City has made the determination of the need to reconsider its funding allocation. Should there be a modification of this Agreement, the modification shall take effect upon notice from City to Contractor in writing. All other terms and conditions of the Agreement shall remain in effect.
23. LAWS, REGULATIONS, FEES, TAXES
A. Contractor shall carry out its responsibilities pursuant to this Agreement in accordance with all applicable Federal, State and Local laws and all policies, procedures, regulations and requirements as the federal government, State, and City from time to time prescribe. Contractor shall obtain all necessary licenses, permits, permissions, rights of entry, and approvals necessary for the operation of the Trailer.
B. Contractor shall comply with Title VI of the Civil Rights Act of 1964 (24 CFR §§ 1 et seq.) which states that no person shall, on the grounds of race, color, or national origin, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any Program or activity receiving Federal financial assistance.
C. Contractor shall pay all fees and taxes as required by law.
24. NOTICES
Except as otherwise specifically provided in this Agreement, any notice, submittal or communication required or permitted to be served on a party hereto, may be served by personal delivery to the person or the office of the person identified below. Service may also be made by mail, by placing first-class postage affixed thereto, and addressed as indicated below, and depositing said envelope in the United States mail to:
CITY: CONTRACTOR:
Department of Housing and Community
Services
Committee on the
Shelterless
90 Santa Rosa Avenue PO Box 2744
Santa Rosa, California, 95404 Petaluma, CA, 94953
25. ENTIRE AGREEMENT
This agreement is the entire Agreement between the parties.
26. INCORPORATION OF ATTACHMENT AND EXHIBITS
The attachment and exhibits to this Agreement are incorporated and made part of this Agreement, subject to the terms and provisions herein.
27. SIGNATURES REQUIRED FOR CORPORATIONS
If this Agreement is entered into by a corporation, it shall be signed by two corporate officers, one from each of the following two groups: a) the chairman of the board, president or any vice-president; b) the secretary, any assistant secretary, chief financial officer, or any assistant treasurer. The title of the corporate officer shall be listed under the signature.
28. COUNTERPARTS AND ELECTRONIC SIGNATURES
This Agreement and future documents relating thereto may be executed in two or more counterparts, each of which will be deemed an original and all of which together constitute one Agreement. Counterparts and/or signatures delivered by facsimile, pdf or City-approved electronic means have the same force and effect as the use of a manual signature. Both City and Contractor wish to permit this Agreement and future documents relating thereto to be electronically signed in accordance with applicable federal and California law. Either Party to this Agreement may revoke its permission to use electronic signatures at any time for future documents by providing notice pursuant to the Agreement. The Parties agree that electronic signatures, by their respective signatories are intended to authenticate such signatures and to give rise to a valid, enforceable, and fully effective Agreement. The City reserves the right to reject any signature that cannot be positively verified by the City as an authentic electronic signature.
[SIGNATURES APPEAR ON NEXT PAGE]
///
///
IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of this date and year first above written.
Attachments:
Attachment One: Insurance Requirements
Exhibit A: Scope of Services
Exhibit B: Budget
Exhibit C: Monthly Status Report Form
Exhibit D: Homeless Management Information System (HMIS)
CONTRACTOR
Committee on the Shelterless
By _______________________________
Name: ____________________________
Title: _____________________________
By _______________________________
Name: ____________________________
Title: _____________________________
Taxpayer ID # 68-0176855
CITY OF SANTA ROSA
A Municipal Corporation
By ______________________________
Name: Megan Basinger
Title: Housing & Community Services
Director
APPROVED AS TO FORM
By______________________________
Office of the City Attorney
Attachment One to Grant Agreement
Form approved by the City Attorney 4-14-14
ATTACHMENT ONE
INSURANCE REQUIREMENTS FOR
GRANT AGREEMENTS
A. Insurance Policies: Contractor shall, at all times during the terms of this Agreement, maintain and keep in full force and effect, the following policies of insurance with minimum coverage as indicated below and issued by insurers with AM Best ratings of no less than A-:VI or otherwise acceptable to the City.
Insurance
Minimum
Coverage Limits
Additional Coverage Requirements
1. Commercial
general liability
$ 1 million per
occurrence
Coverage must be at least as broad as ISO CG
00 01 and must include completed operations
coverage. If insurance applies separately to a
project/location, aggregate may be equal to per
occurrence amount. Coverage may be met
by a combination of primary and umbrella
or excess insurance but umbrella and
excess shall provide coverage at least as
broad as specified for underlying coverage.
Coverage shall not exclude subsidence.
$ 2 million
aggregate
2. Business auto
coverage
$ 1 million ISO Form Number CA 00 01 covering any auto
(Code 1), or if Contractor has no owned autos,
hired, (Code 8) and non-owned autos (Code 9),
with limit no less than $ 1 million per accident
for bodily injury and property damage.
3. Professional
liability (E&O)
$ 1 million per
claim
Contractor shall provide on a policy form
appropriate to profession. If on a claims made
basis, Insurance must show coverage date
prior to start of work and it must be maintained
for three years after completion of work.
$ 1 million
aggregate
4. Workers’
compensation and
employer’s liability
$ 1 million As required by the State of California, with Statutory Limits and Employer’s Liability
Insurance with limit of no less than $ 1 million
per accident for bodily injury or disease. The
Workers’ Compensation policy shall be
endorsed with a waiver of subrogation in favor
of the City for all work performed by the
Contractor, its employees, agents and
subcontractors.
B. Endorsements:
1. All policies shall provide or be endorsed to provide that c overage shall not be canceled, except after prior written notice has been provided to the City in accordance with the policy provisions.
Attachment One to Grant Agreement
Form approved by the City Attorney 4-14-14
2. Liability, umbrella and excess policies shall provide or be endorsed to provide the following:
a. For any claims related to this project, Contractor’s insurance coverage shall be primary and any insurance or self-insurance maintained by City shall be excess of the Contractor’s insurance and shall not contribute with it; and, b. The City of Santa Rosa, its officers, agents, employees and volunteers are to be covered as additional insureds on the CGL policy . General liability coverage can be provided in the form of an endorsement to Contractor’s insurance at least as broad as ISO Form CG 20 10 11 85 or if not available, through the addition of both CG 20 10 and CG 20 37 if a later edition is used.
C. Verification of Coverage and Certificates of Insurance: Contractor shall furnish City with original certificates and endorsements effecting coverage required above.
Certificates and endorsements shall make reference to policy numbers. All certificates and endorsements are to be received and approved by the City before work commences and must be in effect for the duration of the Agreement. The City reserves the right to require complete copies of all required policies and endorsements.
D. Other Insurance Provisions:
1. No policy required by this Agreement shall prohibit Contractor from waiving any right of recovery prior to loss. Contractor hereby waives such right with regard to the indemnitees.
2. All insurance coverage amounts provided by Contractor and available or applicable to this Agreement are intended to apply to the full extent of the policies.
Nothing contained in this Agreement limits the application of such insurance coverage. Defense costs must be paid in addition to coverage amounts.
3. Policies containing any self -insured retention (SIR) provision shall provide or be endorsed to provide that the SIR may be satisfied by either Contractor or City.
Self-insured retentions above $10,000 must be approved by City. At City’s option, Contractor may be required to provide financial guarantees.
4. Sole Proprietors must provide a representation of their Workers’ Compensation Insurance exempt status.
5. City reserves the right to modify these insurance requirements while this Agreement is in effect, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.
Exhibit A
Exhibit A: Scope of Services
Keep People Housed (KPH) – Sonoma
KPH – Sonoma is a targeted homelessness prevention program intended to serve Sonoma County residents with incomes at or below 50% of the Area Median Income (AMI) at high-risk of experiencing homelessness due to recent financial or other hardships. Households are prioritized using an on-line technology platform, including an evidence-based assessment tool, developed and maintained by All Home and Bay Area Community Services (BACS).
Contractor shall serve as the Lead Provider for the larger KPH-Sonoma collaborative comprised of partner agencies (“Local Hubs”) to ensure the provision of services throughout Sonoma County. Contractor shall also serve as the Local Hub for the South County subregion with the following agencies serving as Local Hubs in the remaining subregions:
• Central/Santa Rosa: Community Support Network
• West County: West County Community Services
• North County: Reach for Home
• Sonoma Valley: HomeFirst
As the Lead Provider, Contractor shall serve as the primary point of contact for the KPH – Sonoma collaborative, including with BACS for the on-line platform; sole administrator of financial assistance payments provided to landlords; oversee subcontracted services provided via Local Hubs; and submit all reports to the City on services provided.
Services to be provided under KPH – Sonoma are as follows:
A) Flexible Financial Payments
Contractor shall provide flexible financial payments to clients prioritized by the KPH – Sonoma assessment tool and applicable threshold score. Payment amounts should be individualized based on need to help clients remain housed and support their housing and financial stability. Contractor shall endeavor to provide flexible financial payments in the form of rental assistance paid directly to the landlord, though rental assistance may be paid directly to the household if the situation requires it. Additionally, flexible financial payments may cover housing-related expenses, if and to the extent the situation requires (e.g., utilities, medical bills, food, application or credit check fees for the purpose of accessing housing, security deposits, etc.). Housing-related expenses should be covered based on need, including the household’s simultaneous need to pay their rent.
Exhibit A
B) Wrap-Around Services
Contractor and/or subcontractors shall provide housing-focused services and/or referrals to clients who need or request such support (e.g., clients receiving more than one month of flexible financial payments). Wrap-around services should be individualized for each client and take a flexible, hands-on approach to problem- solving. This approach must demonstrate racial equity and meet the needs of the target populations, including but not limited to:
• People who have previously experienced homelessness or who have been at- risk of homelessness
• People with issues related to mental health, chronic health, or substance use • People with disabilities
• People who identify as BIPOC (Black, Indigenous, and people of color) • People living in poverty
This includes assisting clients in navigating and removing their housing access barriers and improving financial stability. Additional services or referrals offered should include other stabilizing supports such as employment resources, childcare, financial coaching and literacy, and tenant’s rights education. The ultimate outcome of these services is to assist at-risk residents in retaining, or accessing and maintaining, stable housing, as well as build their housing stability over time. This may include a housing stability plan depending on the needs of each household.
C) Legal Supports
Contractor and/or subcontractors shall provide legal/mediation support to clients to help remove barriers to affordable and stable housing, as well as those facing eviction, by referral to Sonoma County Legal Aid, which has been subcontracted to provide these services with funds provided by All Home to Contractor under a separate grant agreement.
D) Outreach and Referral
As many community members requiring assistance may be unaware of available services to assist with their housing stability needs, Contractor and/or subcontractors shall conduct outreach to the target populations listed above and to community partners to promote awareness of KPH – Sonoma.
Exhibit A
The Planned Outputs and Indicators are based on funding from the City and All Home
Planned Output
• 350 to 400 households will receive flexible financial assistance to assist with rent and/or other housing-related expenses. Financial assistance will be coupled with supportive services and legal referrals to promote housing retention and financial stability.
• Contractor will engage clients and elicit feedback to incorporate in program planning and implementation.
Planned Indicator
• 85% of households served will remain stably housed for at least 6 months after receiving prevention services.
• 85% of households will remain stably housed for at least 12 months after receiving prevention services.
Exhibit B
Exhibit B: Budget
Keep People Housed (KPH) – Sonoma
Salaries and Benefits $374,600
Operating Costs $36,900
Partner Agencies/Local Hubs Costs $865,900
Indirect Costs $22,600
Total $1,300,000
Direct Financial Assistance and Legal Services will be funded under All Home’s agreement with COTS
Agency Name:
Program Title:
Term:
MONTH
REPORTING DUE DATE:
1. SUBREGION
2. ADULTS AND CHILDREN
3. RACE/ETHNICITY DETERMINATION:
EXHIBIT C: MONTHLY STATUS REPORT
KEEP PEOPLE HOUSED (KPH) ‐ SONOMA
(Committee on the Shelterless (COTS)
Total Households 0
Other multi‐racial
Client doesn't know
Client prefers not to answer
Total Households
ADULT/CHILDREN CUMULATIVE
Adults
Please include a brief narrative of 100 words or less on your program’s progress including any outreach efforts to target populations and community partners:
Each month should be reported cumulative (or for the month if requested below) beginning October 1st, and ending through the last date of the month for which the report is being submitted.
Instructions: An entry is required in every yellow cell. Once data has been entered, the cell will revert to white. You may need to enter 0 to indicate no applicable response. There should be no yellow cells when report is submitted to the City.
Reporting is required as a condition of funding. The CITY will receive monthly updates based on the information provided in this report (and for HMIS participants as it compares to the HMIS reports). Reports may be submitted electronically. Submit all back‐up data for numbers provided in reports.
COTS
KPH ‐ Sonoma
October 1, 2024 to June 30, 2026
October 2024
Children
RACE/ETHNICITY CUMULATIVE
America Indian, Alaka Native, or Indigenous
Asian or Asian American
Black, African American, African
Native Hawaiin or Pacific Islander
Hispanic/Latina/e/o
Middle Eastern or North African
November 15, 2024
West County
Sonoma Valley
Total households must match cumulative total household served.
North County
South County
Total Number of Households Assisted (This Month & Cumulative) TOTAL HOUSEHOLDS THIS MONTH
(New) CUMULATIVE
Households Served
Total households must match cumulative total household served.
Total Households 0
SUBREGION CUMULATIVE
0 Race/Ethnicity information must be collected from all households. Total households must match cumulative total household served.
Central/Santa Rosa
White
Exhibit C Page 1 of 2
Yes
Cumulative
Actual
Outcomes
Cumulative
Actual
Outcomes
Cumulative
Actual
Outcomes
Cumulative
Percentage
N/A
N/A
Date:
Signature:
Types of Service Provided
Rental Assistance
Security Deposit Assistance
Utility Payment Assistance
Other Flexible Financial Assistance
Referral to Legal Services
Total No. of Participants Households
CUMULATIVE
0 INCOME LEVEL
Below 30%
31% to 50%
This report has been created using the project’s HMIS data:
If HMIS data has not been used, indicate the data source:
(Enter Yes or No)
5. PLANNED OUTPUTS:
Please complete the table below indicating the actual number of project households who have achieved Cumulative outcomes. (type/print)
Title:
(type/print)
Name of Person Preparing Report:
(type/print)
6. PLANNED INDICATORS:
Please include a brief narrative on the process for engaging clients and how feedback is incorporated into program planning and implementation:
Project Quantitative Measure Text
(Planned Indicators)
85% of households served will remain stably housed for at least 12 months after receiving prevention services.
Total households that received prevention services 6 months prior Total households that received prevention services 12 months prior 12 Months Prior Of these, total confirmed remain stably housed
Begin reporting for the following indicator on the April 2025 monthly status report. Prior to April 2025 report, list actual outcomes as "N/A".
Begin reporting for the following indicator on the October 2025 monthly status report. Prior to October 2025 report, list actual outcomes as "N/A". 85% of households served will remain stably housed for at least 6 months after receiving prevention services.
Income information must be collected from all households. Total households must match cumulative total household served.
4. INCOME DETERMINATION:
Please include a brief summary of any specific feedback received from any clients this month. Please include any response or anticipated changes in response to this feedback Please complete the table below indicating the actual number of project households who have achieved Cumulative outcomes.
Project Quantitative Measure Text (Planned Outputs)
350‐400 households will receive flexible financial assistance to assist with rent and/or other housing‐related expenses coupled with supportive services and legal referrals to promote housing retention and financial stability.
Contractor will engage clients and elicit feedback to incorporate in program planning and implementation.
Other Asisstance
October‐23
6 Months Prior
Of these, total confirmed remain stably housed
April‐24
Exhibit C Page 2 of 2
Exhibit D
County of Sonoma
2024
EXHIBIT D: Homeless Management Information System
Homeless Management Information System
As stated in the Sonoma County Homeless Management Information System Participant Agreement, Contractor must be in “good standing” in collecting and entering current, accurate, and comprehensive data that reflects the homeless program services delivered by Contractor into the County’s Efforts to Outcomes (EtO) Homeless Management Information System (HMIS) licensed by Social Solutions Group as a condition of funding under this Agreement.
1. HMIS Good Standing: G ood Standing is defined as timely data entry; and complete and accurate data reflective of the Participant’s status at Intake, Update, and Exit; and as defined by the prevailing HMIS Data Standards. a. Timely data entry: Unless otherwise approved in writing and attached to this Agreement, entry of data into EtO HMIS within five (5) business days of the event that generated the data co llection (i.e., Participant Intake, Entry, Update, and/or Exit from the Program) is required. If Participant is enrolled in Program for longer than one year annual updates are required. b. Accurate and Complete Data:
i. All homeless Partici pant data for Covered Homeless Organizations will be entered into the EtO HMIS unless approved in writing and attached to this Agreement.
ii. 95% of all HUD or Sonoma County defined mandated data points are supplied (fields do NOT reflect a “Null”, “Don’t Know or Refused” or “Data Not Collected” value).
iii. The HUD Data Quality reports (required quarterly for each homeless program) will always reflect a 95% or higher data completeness and quality result.
c. Data Collection Methodology: Contract or shall adhere to the most current HMIS Data Standards and Sonoma County HMIS Lead designed program workflow(s) for each homeless program type.
2. User Training: All Users of the EtO HMIS will receive general HMIS User Training and Security and Ethics prior to receiving login credentials to the HMIS.
Additionally, all HMIS Users shall receive updated Security and Ethics training annually. Contractor shall report Users departing their HMIS role for any reason within 24 hours of their departure for removal of user from the HMIS.
3. Required Quarterly Reporting: Contractor shall utilize data from the following
Exhibit D
County of Sonoma
2024
reports as the basis for quarterly report submissions and include those reports with their submission:
a. HUD Data Quality Report for the program being reported with a data range from the start of the fiscal year to the end of the required reporting period (cumulative).
b. HUD Annual Performance Report for the program.
4. HMIS Financial Match and Other Financial Requirement: Contractor agrees to pay the calculated fair share portion of the McKinney-Vento required funding match within 60 days of billing by the County. Contractor also agrees to provide the County with leveraging information within 30 days of request.
5. Homeless Count Participation: Contra ctor will take part in annual sheltered Homeless Count by maintaining accurate and up-to-date data in good standing and being responsive to the Sonoma County Homeless Coalition and HMIS Coordinators’ requests for current and accurate information prior to and after the Homeless Count. Contractor will take part in the annual unsheltered Homeless Count by assigning staff to assist in the Count process and by making facilities and other Contractor resources available to support the Count commensurate to the size of the Contractor’s homelessness program.
Coordinated Entry
Contractor shall fully participate in the Sonoma County Coordinated Entry System (CES). Full participation is defined as adherence to all Sonoma County Coordinated Entry System Policies and Procedures which includes:
1. Referring homeless participants direct ly to CES for screening and assessment,
2. Communicating about program referra l placement and/or reasons for declining participants.
3. Determination of participant referral s will be completed within three (3) business days or less.
4. For housing programs, Contra ctor will accept referrals from the CES. Rejections of referrals shall only be for reasons permissible in the Sonoma County Coordinated Entry System Policies and Procedures.
5. For Emergency Shelter and Street Outreach services, Contractor will assess and enroll participants into the CES within three (3) days of entering the program.
Exhibit D
County of Sonoma
2024
Privacy and Security of Personal and Personally Identifiable Information (Tasseff Privacy Version No. 6 Version 2024 May 15)
The Department of Housing and Urban Development (HUD) requires user of the Homeless Management Information System (HMIS) to implement safeguards designed to protect the personal information (PI) and personally identifiable information (PII) that the user maintains. To support that effort, HUD adopted regulations similar to the Privacy and Security Rules under the Health Insurance Portability and Account ability Act of 1996 (HIPAA). In addition to complying with HUD regulations, contractors and subcontractors are obligated to protect all other PI, PII, or Sensitive PII (hereinafter identified as Protected Information) obtained on behalf of the City pursuant to this agreement consistent with the California Information Practices Act of 1977 (California Civil Code §§ 1798 et seq.).
The purpose of this section is to set forth Contractor’s privacy and security obligations with respect to Protected Information that Contractor may create, receive, maintain, use, or disclose on behalf of the City pursuant to this Agreement.
The terms used in this Exhibit, but not otherwise defined, shall have the same meanings as those terms have in the above referenced statute and Agreement. Any reference to statutory, regulatory, or contractual language shall be consistent with such language as in effect or as amended.
The provisions of this Exhibit are supplemental to provisions of the Sonoma County Homeless Management Information System Participant Agreement. Contractor must comply with both the Participation Agreement and this Exhibit. Any conflicts in the language of the agreements shall favor the provision that protects the data better, mitigates vulnerabilities and incidents better, and/or more fully reports breaches.
1. Definitions
a. “Breach” shall have the meaning given to such term under in HIPAA 45 CFR §164.402 – Definitions.
b. “Breach of the security of the syst em” shall have the meaning given to such term under the California Information Practices Act, Civil Code § 1798.29(d).
c. “County PI” shall mean Personal Information, as defined below, accessed in a database maintained by the County, received by Contractor from the County, or acquired or created by Contractor in connection with performing the functions, activities and services specified in this Agreement on behalf of the City.
d. “Personally Identifiable Information” (PII) refers to information that can be used to distinguish or trace an individual's identity, such as name, social security number, and biometric records; individually or when combined with other personal or identifying information that is linked or linkable to a
Exhibit D
County of Sonoma
2024
specific individual, such as date and place of birth, mother’s maiden name, etc.
Some examples of PII include name, date of birth (DOB), email address, mailing address, medical history, family relationships, vehicle identifiers including license plates, unique names, certificate, license, telephone and/or other specific reference numbers and/or any information that can directly identify an individual.
e. “Personal Information” (PI) shall have the meaning given to such term in California Civil Code § 1798.3(a).
f. “Required by law” means a mandate contained in law that compels an entity to make a use or disclosure of PI or PII that is enforceable in a court of law.
This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand.
It also includes Medicare conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
g. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PI, or confidential data utilized in complying with this Agreement; or interference with system operations in an information system that processes, maintains or stores PI.
h. “Sensitive Personally Identifiable Informa tion” (SPII) is PII that, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone data elements.
Some examples of SPII include biometric information (e.g., DNA, iris images, fingerprint, and photographic facial images), Social Security Number (SSN), account numbers, and any other unique identifying number (e.g., Federal Housing Administration [FHA] case number, driver's license number, or financial account number, etc.). Other data elements such as citizenship or immigration status; medical information; ethnic, religious, and account passwords, in conjunction with the identity of an individual (directly or indirectly inferred), are also SPII.
2. Terms of Agreement
a. Permitted Uses and Disclosures of County PI and PII by Contractor Except as otherwise indicated in this Exhibit, Contractor may use or disclose Protected Information only to perform functions, activities or services for or
Exhibit D
County of Sonoma
2024
on behalf of the City pursuant to the te rms of this Agreement provided that such use or disclosure would not violate this agreement. b. Responsibilities of Contractor
Contractor agrees:
i. Safeguards. To implement appropriate and reasonable administrative, technical, and physical safeguards to protect the security, confidentiality and integrity of Protected Information, to protect against anticipated threats or hazards to the security or integrity of Protected Information, and to prevent use or disclosure of Protected Information other than as provided for by this Agreement. Contractor shall develop and maintain a written information privacy and security program that include
administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, which incorporate the requirements of this Exhibit. Contractor will provide City with its current policies upon request.
ii. General Privacy Controls. No t to use or disclose Protected Information other than as permi tted or required by this Agreement or as required by applicable state and federal law.
1. The Contractor and its employees, agents, or subcontractors shall protect from unauthorized disclosure any Protected Information.
2. The Contractor and its employees, agents, or subcontractors shall not use any Protected Information for any purpose other than carrying out the Contractor's obligations under this Agreement.
3. The Contractor shall not di sclose any Protected Information to anyone other than City except as permitted by this
Agreement, authorized by the person who is the subject of Protected Information, or permitted by state and/or federal regulation.
iii. General Security Controls. Cont ractor and its subcontractors or vendors shall take all steps necessary to ensure the continuous security of all computerized data systems containing Protected Information, and to protect paper documents containing
Protected Information. These steps shall include, at a minimum:
Exhibit D
County of Sonoma
2024
1. Complying with and ensuring it s subcontractors or vendors comply with all the data system security precautions listed in this Exhibit including all documents incorporated by
reference; and,
2. As applicable for the Cont ractor’s information systems, providing a level and scope of security that is at least comparable to the level and scope of security established by the Office of Management and Budget in OMB Circular No.
A-130, Appendix III- Security of Federal Automated
Information Systems, which sets forth guidelines for
automated information systems in Federal agencies; and
3. Preserving and ensuring its subcontractors or vendors preserve, the confidentiality, integrity, and availability of Protected Information with administrative, technical and physical measures that conform to generally recognized
industry standards and best practices that contractor then applies to its own processing environment.
Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes and updates to operating systems and applications as provided by Contractor and/or its subcontractors or vendors. Contractor agrees to, and shall ensure that its subcontractors or venders, comply with City’s and County’s current and future information security policies, standards, procedures, and guidelines.
iv. Personnel Controls. Contractor shall implement the
following personnel controls:
1. Employee Training. All workfo rce members who assist in the performance of functions or activities on behalf of the City, or access or disclose Protected Information must complete
information privacy and security training, at least annually, at Contractor's expense. Traini ng shall emphasize the high level of sensitivity and protection of SPII. Each workforce member who receives information privacy and security
training must sign a certification, indicating the member’s name and the date on which the training was completed.
These certifications must be retained for a period of six (6) years following termination of this Agreement.
2. Employee Discipline. Appropria te sanctions must be applied against workforce members who fail to comply with privacy
Exhibit D
County of Sonoma
2024
policies and procedures or any provisions of these
requirements, including termination of employment where appropriate.
3. Confidentiality Statement. All persons that will be working with County PHI or PI must sign a confidentiality statement that includes, at a minimum, General Use, Security and
Privacy Safeguards, Unacceptable Use, and Enforcement
Policies. The statement must be signed by the workforce member prior to access to County PHI or PI. The statement must be renewed annually. The C ontractor shall retain each person’s written confidentiality statement for County
inspection for a period of six (6) years following termination of this Agreement.
4. Background Check. Before a member of the workforce may access County PHI or PI, a background screening of that worker must be conducted. The screening should be
commensurate with the risk and magnitude of harm the
employee could cause, with more thorough screening being done for those employees who are authorized to bypass
significant technical and operational security controls. The Contractor shall retain each workforce member’s background check documentation for a period of three (3) years.
v. System Security Review. Cont ractor must ensure audit control mechanisms that record and examine system activity are in place. Contractor must conduct and document a system risk assessment/security review on all systems processing and/or storing County PHI or PI. The assessment/security review must be performed a minimum of every two years, must review
whether administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection, must identify system security risks, and must document risk findings. Reviews should include vulnerability scanning tools.
vi. Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of Protected Information by Contractor or its subcontractors in violation of this Exhibit.
vii. Contractor’s Agents and Subcont ractors. To impose the same restrictions and conditions set forth in this Exhibit on any subcontractors or other agents with whom Contractor
subcontracts any activities under this Agreement that involve the disclosure of Protected Information to the subcontractor.
Exhibit D
County of Sonoma
2024
viii. Cooperation with City and County. With respect to Protected Information, to cooperate with and assist the City and County to the extent necessary to ensure the City’s and County’s compliance with the applicable terms of HUD regulations and the California Information Protection Act.
ix. Designation of an Individua l Responsible Privacy and for Security. Contractor shall designate an individual to oversee its data security program who shall be responsible for carrying out the information security requirements of this Special Terms and Conditions document. Contractor shall designate an
individual to oversee its information privacy program who shall be responsible for carrying out the information privacy requirements of this Special Terms and Conditions document.
The individual designated to these roles may be the same individual so long as they are qualified and able to effectively perform the duties of both designations.
x. Privacy & Security Audits . Contractor will accommodate and upon reasonable notice by County, work County and/or its subcontractors to submit to a random information privacy & security audit. This is to ensure that Contractor’s information privacy and security practices comply with contractual
obligations, this Exhibit, and related state and federal regulations. Contractor shall ensure that its sub-contractors or vendors comply with these same requirements.
xi. Availability of Informati on to City and County. To make Protected Information available to the City and County for purposes of oversight, inspection, amendment, and response to requests for records, injunctions, judgments, and orders for production of County Protected Information. Upon request by City, Contractor shall provide City with a list of all employees, contractors and agents who have access to Protected
Information, including employees, contractors and agents of its subcontractors.
xii. Confidentiality of Alcohol and Drug Abuse Patient Records.
Contractor agrees to comply with all confidentiality
requirements set forth in Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2. Contractor is aware that criminal penalties may be imposed for a violation of these confidentiality requirements. A ll information subject to 42 CFR Part 2 shall be considered Sensitive Personally Identifiable Information.
Exhibit D
County of Sonoma
2024
c. Data Security Requirements
Contractor agrees to implement the following:
i. Workstation/Laptop encryption. All workstations and laptops that store County PHI or PI either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as Advanced Encryption Standard
(AES). The encryption solution must be full disk unless approved by the County Privacy and Security Office.
ii. Minimum Necessary. Only the minimum necessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.
iii. Antivirus software. All wor kstations, laptops and other systems that process and/or store County PHI or PI must install and actively use comprehensive anti- virus software solution with automatic updates scheduled at least daily.
iv. Patch Management. All workstat ions, laptops and other systems that process and/or store County PHI or PI must have critical security patches applied, with system reboot if necessary. There must be a documented patch management process which
determines installation timeframe based on risk assessment and vendor recommendations. At a ma ximum, all applicable patches must be installed within 30 days of vendor release. Applications and systems that cannot be patched within this time frame due to significant operational reasons must have compensatory controls implemented to minimize risk until the patches can be installed.
Applications and systems that cannot be patched must have compensatory controls implemented to minimize risk, where possible.
v. Data Destruction. If Protect ed Information is stored on a local device or server, when no longer needed, all Protected
Information must be wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7 Pass) standard, or by
degaussing. Media may also be physically destroyed in
accordance with NIST Special Publication 800-88. Other
methods require prior written permission of the County Privacy and Security Office.
System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity. vi. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user
Exhibit D
County of Sonoma
2024
authentications, enforcing the principle of least privilege. vii. Transmission encryption. All dat a transmissions of County PHI or PI outside the secure internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as AES. Encryption c an be end-to-end at the network level, or the data files containing County PHI can be encrypted.
This requirement pertains to any type of County PHI or PI in motion such as website access, file transfer, and E-Mail. viii. Intrusion Detection. All syst ems involved in accessing, holding, transporting, and protecting County PHI or PI that are
accessible via the Internet must be protected by a
comprehensive intrusion detection and prevention solution. d. Paper Document Controls
i. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information. County PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.
ii. Escorting Visitors. Visitors to areas where Count y PHI or PI is contained shall be escorted and Count y PHI or PI shall be kept out of sight while visitors are in the area.
iii. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as crosscut shredding and pulverizing.
iv. Removal of Data. Only the minimum necessary County PHI or PI may be removed from the premises of the Contractor
except with express written permission of the City. County PHI or PI shall not be considered "removed from the premises" if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.
v. Faxing. Faxes containing Coun ty PHI or PI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax. vi. Mailing. Mailings containing C ounty PHI or PI shall be sealed and secured from damage or inappropriate viewing of such PHI or PI to the extent possible. Mailings which include 500 or more individually identifiable records of County PHI or PI in a single
Exhibit D
County of Sonoma
2024
package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of the County to use another method is obtained.
e. Breaches and Security Incidents. During the term of this Agreement, Contractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps:
i. Initial Notice to the City and C ounty. (1) To notify the City and County immediately by telephone call plus email or fax upon the discovery of a breach of Protected Information in electronic media or in any other media if the Protected Information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon discovery of a suspected security incident involving Protected Information. (2) To notify the City and County within 24 hours (1 hour if SSA data) by email of the discovery of any suspected security incident, intrusion or unauthorized access, use or disclosure of Protected Information in violation of this Agreement or this Exhibit, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer or other agent of Contractor.
Notice shall be provided to the County Privacy and Security Officer by calling (707) 565-4703, and emailing DHS-
Privacy&[email protected].
ii. Prompt Action. Upon discove ry of a breach or suspected security incident, intrusion, or unauthorized access, use, or disclosure of County PHI, Contractor shall take prompt
corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment.
Contractor shall also take any action required by applicable Federal and State laws and regulations.
iii. Initial Investigation and Invest igation Report. Contractor shall immediately investigate such suspected security incident, security incident, breach, or unauthorized access, use, or disclosure of PHI within 24 hours of the discovery. Contractor shall submit a report to the City and County containing all relevant information known at the time.
Complete Report. To provide a complete report of the
Exhibit D
County of Sonoma
2024
investigation to the City and to the County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include an assessment of all known factors relevant to a determination of whether a breach occurred. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the City or County requests information in addition to that provided in the Initial Report or Complete Report, Contractor shall make reasonable efforts to provide the City or County with such information. If, because of the circumstances of the incident, Contractor needs more than ten (10) working days from the discovery to submit a Complete Report, the County may grant a reasonable extension of time, in which case Contractor shall submit periodic updates until the Complete Report is submitted. If necessary, a Supplemental Report may be used to submit revised or additional information after the Complete Report is submitted The County will review and approve the determination of whether a breach occurred, whether individual notifications are required, and the Contractor’s corrective action plan.
iv. Responsibility for Reporting of Breaches. If the cause of a breach of Protected Information is attributable to Contractor or its agents, subcontractors or vendors, Contractor is responsible for all required reporting of the breach as specified in CIPA, § 1798.29(a) – (d) and California SIMM 5340-C
(https://cdt.ca.gov/wp- content/uploads/2021/02/SIMM_5340-C-
1.pdf). Contractor shall bear all co sts of required notifications to individuals as well as any costs associated with the breach. The County Privacy and Security Officer shall approve the time, manner and content of any such notifications and their review and approval must be obtained before the notifications are made. The County will provi de its review and approval
expeditiously and without unreasonable delay. If Contractor has reason to believe that duplicate reporting of the same breach or incident may occur because its subcontractors, agents or vendors may report the breach or incident to the County in addition to Contractor, Contractor shall notify the County, and the County and Contractor may take appropriate action to prevent duplicate reporting.
v. County Contact Information. To direct communications to the above referenced County staff, the Contractor shall initiate contact as indicated herein. The City reserves the right to make changes to the contact information below by giving written notice
Exhibit D
County of Sonoma
2024
to the Contractor. Said changes shall not require an amendment to this Addendum or the Agreement to which it is incorporated.
Sonoma County Privacy Officer
1450 Neotomas Avenue, Suite 200
Santa Rosa CA 95405
Office: 707-565-4703
Message: 707-565-5703
Email: DHS-Privacy&[email protected]