CITY OF SANTA ROSA
GRANT AGREEMENT FOR
KEEP PEOPLE HOUSED (KPH) – SONOMA
WITH COMMITTEE ON THE SHELTERLESS (COTS)
(PO F002819/V004387)
This First Amendment to Grant Agreement Number F002819, dated October 1, 2024 (Agreement) is made as of this day of 2026 by and between the CITY OF SANTA ROSA (“City”) and COMMITTEE ON THE SHELTERLESS, a California non-profit corporation (“Contractor”).
RECITALS
A. The City, in partnership with the County of Sonoma (County), the City of Petaluma (Petaluma), and All Home (a Bay Area organization), developed a regional homelessness prevention pilot program (Keep People Housed (KPH) – Sonoma). All Home’s prevention model pairs rapid, flexible financial assistance with housing stabilization services and legal aid referrals for people facing eviction and prioritizes households with income below 50%of Area Median Income (AMI) using an on-line platform developed and maintained by Bay Area Community Services (BACS).
B. On May 29, 2024, City issued a Request for Proposals (RFP) for a contractor to serve as Lead Provider to operate KPH – Sonoma. Following this process, Contractor was selected as the operator of KPH – Sonoma.
C. On September 26, 2024, City and Contractor entered into a Grant Agreement for the Program for the period October 1, 2024 to June 30, 2026 using City, County,
and Petaluma funds, pursuant to a separate Funding Agreement between the jurisdictions.
D. The County and P
etaluma will execute separate agreements with Contractor for KPH – Sonoma for Fiscal Year 2026/2027.
E. City and Contractor now desire to amend the Grant Agreement for the purpose of extending the time of performance for an additional fiscal year (Fiscal Year 2026/2027) and increasing compensation in the amount of $250,000 using Local Funds.
F. The Parties have negotiated upon the terms pursuant to which Contractor will continue to provide such services and have reduced such terms to writing.
Exhibit A
AMENDMENT
NOW, THEREFORE, the parties agree to amend the Agreement as follows:
1. Section 1: Scope of Services
Exhibit A-Scope of Services is replaced by Exhibit A-1 to this Amendment
2. Section 2. Term of Agreement
Section 2 is amended to read as follows:
“The term of this Agreement shall commence on October 1, 2024 and shall end on June 30, 2027.”
3. Section 3: Grant
Exhibit A-Scope of Services is replaced by Exhibit A-1 to this Amendment Section 3(A) is amended to read as follows:
“Notwithstanding any other provision of this Agreement, Program funding from City to Contractor shall not exceed One Million Five Hundred Fifty Thousand ($1,550,000) for the period of October 1, 2024, through June 30, 2027, for costs reasonably related to the administration of the Program.” Section 3(D) is amended to read as follows:
“Payments by City to Contractor shall be made monthly in arrears based on the Budget in Exhibit B-1 and upon the proper documentation of expenditures, as determined by the City’s Director of Housing and Community Services (Director) or their designee. On or before the twentieth day of each month, Contractor shall submit an invoice to City for the prior month. The Director or their designee will review each invoice and may deny reimbursement where: 1) an expenditure is not in furtherance of administering the Program or improperly documented; or 2) where Contractor has not provided Program services in accordance with the Scope of Services in Exhibit A. Invoices submitted after 30 days shall include acceptable written justification for the delay. The Director may deny reimbursement or demand additional information if the Director determines, in the Director’s sole discretion, that Contractor’s written justification for delayed submittal of invoices is not acceptable.”
4. Section 15: Fixed Assets
Section 15 is amended to read as follows:
“For purposes of this Agreement, a fixed asset is any physical item, excluding real property, having a cost in excess of $300.00 and a usable life of one year or more.
Contractor’s annual report to City shall include invoices and receipts of payment for all fixed assets purchased. If at any time Contractor discontinues the Program, at any time during or after the Agreement period, all fixed assets purchased or acquired by Contractor having a cost in excess of $300.00 and a usable life of one year or more shall revert back to City, at the sole discretion of the City. Contractor shall fully cooperate with City following termination, expiration, or discontinuance to ensure that all fixed assets are transferred and delivered in a prompt and timely manner in order to minimize disruption to services.”
5. Section 17: Program Monitoring and Evaluation
Section 17(C) is amended to read as follows:
“Contractor shall submit quarterly reports, substantiating that the Program is operating in compliance with all the requirements of this Agreement. The quarterly reports shall be submitted to City by October 15, January 15, April 15, and July 15 of each year as more fully set forth in Exhibit C-1. In the event financial or reporting issues are identified by City or through a compliance review by City, Contractor may be required to reimburse the City for funds that were expended on ineligible activities.”
Section 17(D) is amended to read as follows:
“Contractor shall remain in good standing with respect to the collection and entry of current, accurate, and complete data reflecting the homeless prevention and intervention services provided under this Agreement into the Homeless Prevention Platform (HPP) developed by BACS Prevention Platform, Inc. (BPPI).
Use of the Homeless Management Information System (HMIS) is not required as a condition of funding under this Agreement. If Contractor elects to utilize HMIS, applicable HMIS requirements are set forth in Exhibit D-1.”
All other terms of the Agreement shall remain in full force and effect.
[SIGNATURES APPEAR ON NEXT PAGE]
///
///
Executed as of the day and year first above stated.
Attachments:
Exhibit A-1: Scope of Services
Exhibit B-1: Budget
Exhibit C-1: Quarterly Status Report Form
Exhibit D-1: Homeless Management Information System (HMIS)
CONTRACTOR
Committee on the Shelterless
By _______________________________
Name: Mark Krug
Title: Board President
By _______________________________
Name: Stefanie Giani
Title: Treasurer
Taxpayer ID # 68-0176855
CITY OF SANTA ROSA
A Municipal Corporation
By ______________________________
Name: Megan Basinger
Title: Housing & Community Services Director
APPROVED AS TO FORM
By______________________________
Office of the City Attorney
Exhibit A-1
Exhibit A-1: Scope of Services
Keep People Housed (KPH) – Sonoma
KPH – Sonoma is a targeted homelessness prevention program intended to serve Sonoma County residents with incomes at or below 50% of the Area Median Income (AMI) at high-risk of experiencing homelessness due to recent financial or other hardships. Households are prioritized using an on-line technology platform, including an evidence-based assessment tool, developed and maintained by All Home and Bay Area Community Services (BACS).
Contractor shall serve as the Lead Provider for the larger KPH-Sonoma collaborative comprised of partner agencies (“Local Hubs” in each subregion) to ensure the provision of services throughout Sonoma County. Subregions will include: Central/Santa Rosa, West County, North County, South County, and Sonoma Valley. Contractor may serve as the Local Hub for no more than three subregions.
As the Lead Provider, Contractor shall serve as the primary point of contact for the KPH – Sonoma collaborative, including with BACS for the on-line platform; sole administrator of financial assistance payments provided to landlords; oversee subcontracted services provided via Local Hubs; and submit all reports to the City on services provided.
Services to be provided under KPH – Sonoma are as follows:
A) Flexible Financial Payments
Contractor shall provide flexible financial payments to clients prioritized by the KPH – Sonoma assessment tool and applicable threshold score. Payment amounts should be individualized based on need to help clients remain housed and support their housing and financial stability. Contractor shall endeavor to provide flexible financial payments in the form of rental assistance paid directly to the landlord, though rental assistance may be paid directly to the household if the situation requires it. Additionally, flexible financial payments may cover housing-related expenses, if and to the extent the situation requires (e.g., utilities, medical bills, food, application or credit check fees for the purpose of accessing housing, security deposits, etc.). Housing-related expenses should be covered based on need, including the household’s simultaneous need to pay their rent.
Exhibit A-1
B) Wrap-Around Services
Contractor and/or subcontractors shall provide housing-focused services and/or referrals to clients who need or request such support (e.g., clients receiving more than one month of flexible financial payments). Wrap-around services should be individualized for each client and take a flexible, hands-on approach to problem- solving. This approach must demonstrate racial equity and meet the needs of the target populations, including but not limited to:
People who have previously experi enced homelessness or who have been at- risk of homelessness
People with issues related to mental health, chronic health, or substance use People with disabilities
People who identify as BIPOC (B lack, Indigenous, and people of color) People living in poverty
This includes assisting clients in navigating and removing their housing access barriers and improving financial stability. Additional services or referrals offered should include other stabilizing supports such as employment resources, childcare, financial coaching and literacy, and tenant’s rights education. The ultimate outcome of these services is to assist at-risk residents in retaining, or accessing and maintaining, stable housing, as well as build their housing stability over time. This may include a housing stability plan depending on the needs of each household.
C) Legal Supports
Contractor and/or subcontractors shall provide legal/mediation support to clients to help remove barriers to affordable and stable housing, as well as those facing eviction, by referral to Sonoma County Legal Aid, which will remain subcontracted to provide these services.
D) Outreach and Referral
As needed, Contractor and/or subcontractors shall conduct outreach to the target populations listed above and to community partners to promote awareness of KPH – Sonoma.
Exhibit A-1
Planned Outputs
1,200 households annually will apply for homelessness prevention assistance through Program;
300 households annually will be referred to subcontracted Legal Aid services; 200 households annually will receive flexible financial assistance to assist with rent and/or other housing-related expenses. Financial assistance will be coupled with supportive services and legal referrals to promote housing retention and financial stability;
Average household assistance w ill not exceed $4,000; and Contractor will engage clients and elicit feedback to incorporate in program planning and implementation.
Planned Indicators
Participants that identify as BIPOC will receive assistance at levels equal to or exceeding that of non-BIPOC participants;
85% of households served will remain st ably housed for at least 6 months after receiving prevention services; and
85% of households will remain stably housed for at least 12 mont hs after receiving prevention services.
Exhibit B-1
Exhibit B-1: Budget
Keep People Housed (KPH) – Sonoma
Salaries and Benefits $502,187.77
Non-Personnel Operating Costs $60,672.26
Indirect Costs (15%) $29,239.97
Subcontracted Local Hub Services $892,900.00
Subcontracted Legal Aid Services $65,000
Total $1,550,000
Agency Name:
Program Title:
Term:
Quarter:
1. Please include a brief narrative of 50 words or less on your program’s progress:
FY Cumulative Cumulative FY Cumulative Cumulative
FY Cumulative Cumulative FY Cumulative Cumulative
1. SUBREGION/HOUSEHOLD TYPE
FY Cumulative Cumulative FY Cumulative Cumulative
00 0 0
FY Cumulative Cumulative FY Cumulative Cumulative
00 0 0
Single Person HHs
Multi-Person HHs
Total Households
Households Requiring Translation Services
Referrals to Legal Aid
SANTA ROSACOUNTYWIDE
%
%%
TOTAL HOUSEHOLDS
FINANCIAL ASSISTANCE PROVIDED (Dollar Amounts)
SUBREGION
COUNTYWIDE APPLIED
HOUSEHOLD (HH)
TYPE
EXHIBIT C-1: QUARTERLY STATUS REPOR
T
KEEP PEOPLE HOUSED (KPH) - SONOMA
Reporting is required as a condition of funding. The CITY will receive quarterly updates based on the information provided in this report (and for HMIS participants as it compares to the HMIS reports). Reports may be submitted electronically. Submit all back-up data for numbers provided in reports. Cumulative outcomes should be reported for the period beginning October 1, 2024 and ending through the quarter for which the report is being submitted. Fiscal Year outcomes should be reported for the period beginning July 1, 2025 and ending through the quarter for which the report is being submitted.
Instructions: An entry is required in every yellow cell. Once data has been entered, the cell will revert to white. You may need to enter 0 to indicate no applicable response. There should be no yellow cells when report is submitted to the City.
2. Total Number of Households Applied and Assisted
Committee on the Shelterless (COTS)
KPH - Sonoma
October 1, 2024 to June 30, 2027
Q1: July 1, 2026 - September 30, 2026
COUNTYWIDE SERVED
SANTA ROSA APPLIED
%
COUNTYWIDE SANTA ROSA
TOTAL Assistance Provided
Average Household Assistance Amount
Central/Santa Rosa
North County
Sonoma Valley
South County
West County
Total households applied must match total household applied above. Total households served must match total household served above.
Total Households
COUNTYWIDE APPLIED
Households Applied
Households Served
Exhibit C-1 Page 1 of 4
2. HOUSEHOLD COMPOSITION
3. RACE/ETHNICITY DETERMINATION
FY Cumulative
COUNTYWIDE
SERVED % SANTA ROSA
SERVED %
0 0
INCOME LEVEL
COUNTYWIDE SERVED
FY Cumulative Cumulative
0Total No. of Participants Households 0
5. PLANNED OUTPUTS:
Below 30%
31% to 50%
Utility Deposit/Payment
Legal Services
TYPES OF SERVICE PROVIDED
White
Total Households 0
4. INCOME DETERMINATION:
Income information must be collected from all households. Total households must match cumulative total household served.
Client prefers not to answer
Native Hawaiian or Pacific Islander
Middle Eastern or North African
0 Total Services Provided
Back Rent
Car Repair
First Month Rent
Future Rent
Medical Bill
Moving Costs
Security Deposit
Utility Arrears
Black, African American, African
Hispanic/Latina/e/o
Client doesn't know
Other multi-racial
America Indian, Alaska Native, or
Asian or Asian American
Adults
ADULT/CHILDREN COUNTYWIDE SERVED
FY Cumulative Cumulative
RACE/ETHNICITY COUNTYWIDE SERVED
FY Cumulative Cumulative
Children
Total participants 0
Race/Ethnicity information must be collected from all households. Total households must match cumulative total household served. 0 RACE/ETHNICITY FY Cumulative
Other multi-racial
America Indian, Alaska Native, or
Total Households 0
COUNTYWIDE APPLIED
Native Hawaiian or Pacific Islander
Middle Eastern or North African
White
Hispanic/Latina/e/o
Client doesn't know
Client prefers not to answer
Asian or Asian American
Black, African American, African
Exhibit C-1 Page 2 of 4
Cumulative
COUNTYWIDE
SERVED % SANTA ROSA
SERVED %
0 0
Countywide
Actual Outcomes
Utility Arrears
Utility Deposit/Payment
Legal Services
Total Services Provided
Back Rent
Car Repair
First Month Rent
Future Rent
Medical Bill
Moving Costs
Security Deposit
200 households annually will receive flexible financial assistance to assist with rent and/or other housing-related expenses.
Financial assistance will be coupled with supportive services and legal referrals to promote housing retention and financial stability (FY)
Contractor will engage clients and elicit feedback to incorporate in program planning and implementation.
Please include a brief narrative on the process for engaging clients and how feedback is incorporated into program planning and implementation:
Please include a brief summary of any specific feedback received from any clients this month. Please include any response or anticipated changes in response to this feedback.
TYPES OF SERVICE PROVIDED
300 households annually will be referred to subcontracted Legal Aid services (FY) 1,200 households annually will apply for homelessness prevention assistance through Program Average household assistance will not exceed $4,000
Please complete the table below indicating the actual number of project households who have achieved Cumulative or FY Cumulative outcomes.
Project Quantitative Measure Text (Planned Outputs)
Exhibit C-1 Page 3 of 4
Cumulative
Actual Outcomes
Cumulative
Percentage
Yes
Date:
Signature:
This report has been created using BACS HPP data:
6. PLANNED INDICATORS:
Please complete the table below indicating the actual number of project households who have achieved Cumulative outcomes.
Project Quantitative Measure Text
(Planned Indicators)
(type/print)
(Enter Yes or No)
Name of Person Preparing Report:
Of these, total households that provided survey response Of these, total households that provided survey response Of these, total confirmed remain stably housed
Total households (Santa Rosa only) that received prevention services 12 months prior
Of these, total confirmed remain stably housed
(type/print) (type/print)
Title:
Of these, total confirmed remain stably housed
85% of households served will remain
stably housed for at least 6 months after
receiving prevention services.
Total BIPOC households (Countywide) that applied for prevention services (FY) Total Non-BIPOC households (Countywide) that applied for prevention services (FY) Total Non-BIPOC households (Countywide) that received prevention services (FY) Participants that identify as BIPOC will
receive assistance at levels equal to or
exceeding that of non-BIPOC participants
Total households (Countywide) that received prevention services 6 months prior Total BIPOC households (Countywide) that received prevention services (FY) Total households (Santa Rosa only) that received prevention services 6 months prior
85% of households served will remain
stably housed for at least 6 months after
receiving prevention services.
Total households (Countywide) that received prevention services 12 months prior Of these, total households that provided survey response Of these, total households that provided survey response Of these, total confirmed remain stably housed
Exhibit C-1 Page 4 of 4
Exhibit D-1 Page 1 of 11
Exhibit D-1
Homeless Management Information System and Coordinated Entry
Homeless Management Information System
As stated in the Sonoma County Homeless Management Information System Participant Agreement, Contractor must be in “good standing” in collecting and entering current, accurate, and comprehensive data that reflects the homeless program services delivered by Contractor into County’s Efforts to Outcomes (EtO) Homeless Management Information System (HMIS) licensed by Social Solutions Group as a condition of funding under this Agreement.
1. HMIS Good Standing: Good Standing is defined as timely data entry as well as complete and accurate data reflective of the Participant’s status at Intake, Update, and Exit, as defined by the prevailing HMIS Data Standards.
a. Timely data entry: Unless otherwise a pproved in writing and attached to this Agreement, entry of data into EtO HMIS within five (5) business days of the event that generated the data collection (i.e., Participant Intake, Entry, Update, and/or Exit from the Program) is required. If Participan t is enrolled in Program for longer than one-year, annual updates are required.
b. Accurate and Complete Data
i. All homeless Participant data for Covered Homeless Organizations shall be entered into the EtO HMIS unless approved in writing and attached to this Agreement.
ii. 95% of all HUD or Sonoma County-defined mandated data points are supplied (fields do NOT reflect a “Null”, “Don’t Know or Refused”, or “Data Not Collected” value).
iii. The HUD Data Quality reports (required quarterly for each homeless program) shall always reflect a 95% or higher data completeness and quality result. c. Data Collection Methodology: Contractor sha ll adhere to the most current HMIS Data Standards and County of Sonoma HMIS Lead designed program workflow(s) for each homeless program type.
2. User Training: All Users of the EtO HMIS shall receive general HMIS User Training and Security and Ethics prior to receiving login credentials to the HMIS. Additionally, all HMIS Users shall receive updated Security and Ethics training annually. Contractor shall report Users departing their HMIS role for any reason within 24 hours of their departure for removal of User from the HMIS.
3. Required Quarterly Reporting: C ontractor shall utilize data from the following reports as the basis for quarterly report submissions and include those reports with its submission:
a. HUD Data Quality Report for the program being reported with a data range from the start of the fiscal year to the end of the required reporting period (cumulative) b. HUD Annual Performance Report for the program
4. HMIS Financial Match and Other Financial Requirement: Contractor agrees to pay the calculated fair share portion of the McKinney-Vento-required funding match within 60 days
Exhibit D-1 Page 2 of 11
of billing by County. Contractor also agrees to provide County with leveraging information within 30 days of request.
5. Homeless Count Participation: Contractor sh all take part in annual sheltered Homeless Count by maintaining accurate and up-to-date data in good standing and being responsive to the Sonoma County Homelessness Coalition (formally: Continuum of Care) and HMIS Coordinators’ requests for current and accurate information prior to and after the Homeless Count. Contractor shall take part in the annual unsheltered Homeless Count by assigning staff to assist in the Homeless Count process and by making facilities and other Contractor resources available to support the Homeless Count commensurate to the size of Contractor’s homelessness program.
Coordinated Entry
Contractor shall fully participate in the Sonoma County Coordinated Entry System (CES). Full participation is defined as adherence to all Sonoma County Coordinated Entry System Policies and Procedures, which includes:
1. Referring homeless participants directly to CES for screening and assessment
2. Communicating about program referral placement and/or reasons for declining participants
3. Determining participant referrals shall be completed within three (3) business days or less.
4. For housing programs, Contractor accepting referrals from the CES. Rejections of referrals shall be only for reasons permissible in the Sonoma County Coordinated Entry System Policies and Procedures.
5. For Emergency Shelter and Street Outreach services, Contractor assessing and enrolling participants into the CES within three (3) days of entering the program.
Exhibit D-1 Page 3 of 11
Privacy and Security of Personal and Personally Identifiable Information (STC No. 6 – Tasseff Version 2024 May 15)
1. Recitals
a. The Department of Housing and Urban Development (HUD) requires user of the Homeless Management Information System (HMIS) to implement safeguards designed to protect the personal information (PI) and personally identifiable information (PII) that the user maintains. To support that effort, HUD adopted regulations similar to the Privacy and Security Rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In addition to complying with HUD regulations, contractors and subcontractors are obligated to protect all other PI, PII, or Sensitive PII (hereinafter identified as Protected Information) obtained on behalf of County pursuant to this agreement consistent with the California Information Practices Act of 1977 (California Civil Code §§ 1798 et seq.). b. The purpose of this Exhibit is to set forth Contractor’s privacy and security obligations with respect to Protected Information that Contractor may create, receive, maintain, use, or disclose on behalf of County pursuant to this Agreement. c. The terms used in this Exhibit, but not otherwise defined, shall have the same meanings as those terms have in the above referenced statute and Agreement. Any reference to statutory, regulatory, or contractual language shall be consistent with such language as in effect or as amended.
d. The provisions of this Exhibit are supplemental to provisions of the Continuum of Care HMIS Participation Agreement. Contractor must comply with both the Participation agreement and this Exhibit. Any conflicts in the language of the agreements shall favor the provision that protects the data better, mitigates vulnerabilities and incidents better, and/or more fully reports breaches.
2. Definitions
a. “Breach” shall have the meaning given to such term under in HIPAA 45 CFR § 164.402 – Definitions.
b. “Breach of the security of the system” shall have the meaning given to such term under the California Information Practices Act, Civil Code § 1798.29(d). c. “County PI” shall mean Personal Information, as defined below, accessed in a database maintained by County, received by Contractor from County, or acquired or created by Contractor in connection with performing the functions, activities and services specified in this Agreement on behalf of County. d. “Personally Identifiable Information” (PII) refers to information that can be used to distinguish or trace an individual's identity, such as name, social security number, and biometric records; individually or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.
Some examples of PII include name, date of birth (DOB), email address, mailing address, medical history, family relationships, vehicle identifiers including license
Exhibit D-1 Page 4 of 11
plates, unique names, certificate, license, telephone and/or other specific reference numbers and/or any information that can directly identify an individual. e. “Personal Information” (PI) shall have the meaning given to such term in California Civil Code § 1798.3(a).
f. “Required by law” means a mandate contained in law that compels an entity to make a use or disclosure of PI or PII that is enforceable in a court of law. This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand. It also includes Medi care conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
g. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PI, or confidential data utilized in complying with this Agreement; or interference with system operations in an information system that processes, maintains, or stores PI. h. “Sensitive Personally Identifiable Information” (SPII) is PII that, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone data elements.
Some examples of SPII include biometric information (e.g., DNA, iris images, fingerprint, and photographic facial images), Social Security Number (SSN), account numbers, and any other unique identifying number (e.g., Federal Housing Administration [FHA] case number, driver’s license number, or financial account number, etc.). Other data elements such as citizenship or immigration status; medical information; ethnic, religious, and account passwords, in conjunction with the identity of an individual (directly or indirectly inferred), are also SPII.
3. Terms of Agreement
a. Permitted Uses and Disclosures of County PI and PII by Contractor Except as otherwise indicated in this Exhibit, Contractor may use or disclose Protected Information only to perform functions, activities or services for or on behalf of County pursuant to the terms of this Agreement provided that such use or disclosure would not violate this agreement.
b. Responsibilities of Contractor
Contractor agrees:
i. Safeguards. To implement appropriate a nd reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of Protected Information, to protect against anticipated threats or hazards to the security or integrity of Protected Information, and to prevent use or disclosure of Protected Information other than as provided for by this Agreement. Contractor
Exhibit D-1 Page 5 of 11
shall develop and maintain a written information privacy and security program that include administrative, technical, and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, which incorporate the requirements of this Exhibit. Contractor shall provide County with its current policies upon request.
ii. General Privacy Controls. Not to use or disclose Protected Information other than as permitted or required by this Agreement or as required by applicable state and federal law.
1. Contractor and its employees, agents, or subcontractors shall protect from unauthorized disclosure any Protected Information.
2. Contractor and its employees, agents, or subcontractors shall not use any Protected Information for any purpose other than carrying out Contractor's obligations under this Agreement.
3. Contractor shall not disclose any Protected Information to anyone other than County except as permitted by this Agreement, authorized by the person who is the subject of Protected Information, or permitted by state and/or federal regulation.
iii. General Security Controls. Contractor and its sub-contractors or vendors shall take all steps necessary to ensure the continuous security of all computerized data systems containing Protected Information, and to protect paper documents containing Protected Information. These steps shall include, at a minimum:
1. Complying with and ensuring its sub-contractors or vendors comply with all the data system security precautions listed in this Exhibit including all documents incorporated by reference; and,
2. As applicable for Contractor’s information systems, providing a level and scope of security that is at least comparable to the level and scope of security established by the Office of Management and Budget in OMB Circular No. A-130, Appendix III- Security of Federal Automated Information Systems, which sets forth guidelines for automated information systems in federal agencies; and
3. Preserving and ensuring its sub-contractors or vendors preserve, the confidentiality, integrity, and availability of Protected Information with administrative, technical, and physical measures that conform to generally recognized industry standards and best practices that contractor then applies to its own processing environment.
Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes, and updates to operating systems and applications as provided by Contractor and/or its sub-contractors or vendors. Contractor agrees to, and sha ll ensure that its sub-contractors or venders, comply with County’s current and future information security policies, standards, procedures, and guidelines.
Exhibit D-1 Page 6 of 11
iv. Personnel Controls. Contractor shall implement the following personnel controls.
1. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of County, or access or disclose Protected Information must complete information privacy and security training, at least annually, at Contractor's expense. Training shall emphasize the high level of sensitivity and protection of Sensitive Personally Identifiable Information. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following termination of this Agreement.
2. Employee Discipline. Appropriate sa nctions must be applied against workforce members who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment where appropriate.
3. Confidentiality Statement. All person s that will be working with County PHI or PI must sign a confidentiality statement that includes, at a minimum, General Use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to County PHI or PI. The statement must be renewed annually. Contractor sh all retain each person’s written confidentiality statement for County inspection for a period of six (6) years following termination of this Agreement.
4. Background Check. Before a member of the workforce may access County PHI or PI, a background screening of that worker must be conducted. The screening should be commensurate with the risk and magnitude of harm the employee could cause, with more thorough screening being done for those employees who are authorized to bypass significant technical and operational security controls. Contr actor shall retain each workforce member’s background check documentation for a period of three (3) years. v. System Security Review. Contractor must ensure audit control mechanisms that record and examine system activity are in place. Contractor must conduct and document a system risk assessment/security review on all systems processing and/or storing County PHI or PI. The assessment/security review must be performed a minimum of every two years, must review whether administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection, must identify system security risks, and must document risk findings. Reviews should include vulnerability scanning tools. vi. Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of Protected Information by Contractor or its subcontractors in violation of this Exhibit.
Exhibit D-1 Page 7 of 11
vii. Contractor’s Agents and Subcontractors. To impose the same restrictions and conditions set forth in this Exhibit on any subcontractors or other agents with whom Contractor subcontracts any activities under this Agreement that involve the disclosure of Protected Information to the subcontractor. viii. Cooperation with County. With respect to Protected Information, to cooperate with and assist County to the extent necessary to ensure County’s compliance with the applicable terms of HUD regulations and the California Information Protection Act.
ix. Designation of an Individual Responsible Privacy and for Security
1. Contractor shall designate an individual to oversee its data security program who shall be responsible for carrying out the information security requirements of this Special Terms and Conditions document.
2. Contractor shall designate an individual to oversee its information privacy program who shall be responsible for carrying out the information privacy requirements of this Special Terms and Conditions document.
3. The individual designated to the above roles may be the same individual so long as they are qualified and able to effectively perform the duties of both designations.
x. Privacy & Security Audits. Contract or shall accommodate and upon reasonable notice by Sonoma County, work with Sonom a County and/or its subcontractors to submit to a random information privacy & security audit. This is to ensure that Contractor’s information privacy and security practices comply with contractual obligations, this Exhibit, and related state and federal regulations.
Contractor shall ensure that its sub-contractors or vendors comply with these same requirements.
xi. Availability of Information to County. To make Protec ted Information available to County for purposes of oversight, inspection, amendment, and response to requests for records, injunctions, judgments, and orders for production of County Protected Information. Upon request by County, Contractor shall provide County with a list of all employees, contractors and agents who have access to Protected Information, including employees, contractors and agents of its subcontractors.
xii. Confidentiality of Alcohol and Drug Abuse Patient Records. Contractor agrees to comply with all confidentiality requirements set forth in Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2. Contractor is aware that criminal penalties may be imposed for a violation of these confidentiality requirements. All information subject to 42 CFR Part 2 shall be considered Sensitive Personally Identifiable Information.
c. Data Security Requirements
Contractor agrees to implement the following:
i. Workstation/Laptop encryption. All workst ations and laptops that store County PHI or PI either directly or temporarily must be encrypted using a FIPS 140-2
Exhibit D-1 Page 8 of 11
certified algorithm which is 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by County Privacy and Security Office.
ii. Minimum Necessary. Only the minimum n ecessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.
iii. Antivirus software. All workstations, la ptops and other systems that process and/or store County PHI or PI must install and actively use comprehensive anti- virus software solution with automatic updates scheduled at least daily. iv. Patch Management. All workstations, la ptops and other systems that process and/or store County PHI or PI must have critical security patches applied, with system reboot if necessary. There mu st be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable patches must be installed within 30 days of vendor release. Applications and systems that cannot be patched within this time frame due to significant operational reasons must have compensatory controls implemented to minimize risk until the patches can be installed. Applications and system s that cannot be patched must have compensatory controls implemented to minimize risk, where possible. v. Data Destruction. If Protected Informati on is stored on a local device or server, when no longer needed, all Protected Information must be wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7 Pass) standard, or by degaussing. Media may also be physica lly destroyed in accordance with NIST Special Publication 800-88. Othe r methods require prior written permission of County Privacy and Security Office.
vi. System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity.
vii. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user authentications, enforcing the principle of least privilege.
viii. Transmission encryption. All data trans missions of County PHI or PI outside the secure internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128 bit or higher, such as AES. Encryption can be end-to-end at the network level, or the data files containing County PHI can be encrypted. This requirement pertains to any type of County PHI or PI in motion such as website access, file transfer, and E-Mail.
ix. Intrusion Detection. All sy stems involved in accessing, holding, transporting, and protecting County PHI or PI that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.
Exhibit D-1 Page 9 of 11
d. Paper Document Controls
i. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office.
Unattended means that information is not being observed by an employee authorized to access the information. Count y PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.
ii. Escorting Visitors. Visitors to areas wh ere County PHI or PI is contained shall be escorted and County PHI or PI shall be kept out of sight while visitors are in the area.
iii. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as crosscut shredding and pulverizing. iv. Removal of Data. Only the minimum n ecessary County PHI or PI may be removed from the premises of Contractor except with express written permission of County. County PHI or PI shall no t be considered “removed from the premises” if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.
v. Faxing. Faxes containing County PHI or PI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax. vi. Mailing. Mailings containing County PHI or PI shall be sealed and secured from damage or inappropriate viewing of such PHI or PI to the extent possible.
Mailings which include 500 or more individually identifiable records of County PHI or PI in a single package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of County to use another method is obtained.
e. Breaches and Security Incidents. During the term of this Agreement, Contractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps:
i. Initial Notice to County. (1) To not ify County immediately by telephone call plus email or fax upon the discovery of a breach of Protected Information in electronic media or in any other media if the Protected Information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon discovery of a suspected security incident involving Protected Information. (2) To notify County within 24 hours (one (1) hour if SSA data) by email or fax of the discovery of any suspected security incident, intrusion, or unauthorized access, use or disclosure of Protected Information in violation of this Agreement or this Exhibit, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer, or other agent of Contractor.
Exhibit D-1 Page 10 of 11
Notice shall be provided to County Privacy and Security Officer by calling 707-565-4703, and emailing DHS-Privacy&[email protected]. ii. Prompt Action. Upon discovery of a breach or suspected security incident, intrusion, or unauthorized access, use, or disclosure of County PHI, Contractor shall take prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment. Contractor shall also take any action required by applicable federal and state laws and regulations. iii. Initial Investigation and Investigation Report. Contractor shall immediately investigate such suspected security incident, security incident, breach, or unauthorized access, use, or disclosure of PHI within 24 hours of the discovery.
Contractor shall submit a report to County containing all relevant information known at the time.
Complete Report. To provide a complete report of the investigation to County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include an assessment of all known factors relevant to a determination of whether a breach occurred.
The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If County requests informati on in addition to that provided in the Initial Report or Complete Report, Contractor shall make reasonable efforts to provide County with such information. If, because of the circumstances of the incident, Contractor needs more than ten (10) working days from the discovery to submit a Complete Report, County may grant a reasonable extension of time, in which case Contractor shall submit periodic updates until the Complete Report is submitted. If necessary, a Supplemental Re port may be used to submit revised or additional information after the Complete Report is submitted County shall review and approve the determination of whether a breach occurred, whether individual notifications are required, and Contractor’s corrective action plan. iv. Responsibility for Reporting of Breaches. If the cause of a breach of Protected Information is attributable to Contractor or its agents, subcontractors or vendors, Contractor is responsible for all required reporting of the breach as specified in CIPA, § 1798.29(a) – (d) and California SIMM 5340-C (https://cdt.ca.gov/wp- content/uploads/2021/02/SIMM_5340-C-1.pdf). Contractor shall bear all costs of required notifications to individuals as well as any costs associated with the breach. The County Privacy and Security Officer shall approve the time, manner, and content of any such notifications and their review and approval must be obtained before the notifications are made. County shall provide its review and approval expeditiously and without unreasonable delay. If Contractor has reason to believe that duplicate reporting of the same breach or incident may occur because its subcontractors, agents or vendors may report the breach or incident to County in addition to Contractor, Contractor shall notify County, and County and Contractor may take appropriate action to prevent duplicate reporting. v. County Contact Information. To direct communications to the above referenced County staff, Contractor shall initiate contact as indicated herein. County
Exhibit D Page 11 of 11
reserves the right to make changes to the contact information below by giving written notice to Contractor. Said changes shall not require an amendment to this Addendum or the Agreement to which it is incorporated.
Sonoma County Privacy Officer
1450 Neotomas Avenue, Suite 200
Santa Rosa CA 95405
Office: 707-565-4703
Message: 707-565-5703
Email: DHS-Privacy&[email protected]