Form approved by the City Attorney 5-2025 Page 1 of 13
OPERATING AGREEMENT FOR THE
SAFE PARKING PROGRAM
CATHOLIC CHARITIES OF THE DIOCESE OF SANTA ROSA
DBA CATHOLIC CHARITIES OF NORTHWEST CALIFORNIA
(PO F000999/V001972)
This Agreement is made this 1st day of July, 2026 by and between the CITY OF SANTA ROSA (City) and CATHOLIC CHARITIES OF THE DIOCESE OF SANTA ROSA DBA CATHOLIC CHARITIES OF NORTHWEST CALIFORNIA, a California non-profit corporation (Contractor).
RECITALS
A. On December 7, 2021, Council approved Catholic Charities as the operator of the Safe Parking Program (Program) and the City executed the initial Operating Agreement for the Program for the period January 1, 2022, to December 31, 2022 (Year One) with an option to extend for the period January 1, 2023 to December 31, 2023 (Year Two).
B. The City and Contractor continued to extend operations through June 30, 2026 via a series of agreements using Federal American Rescue Plan Act (ARPA) Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Sonoma County Community Development Commission funds, State of California’s Encampment Resolution Funding (ERF), Opioid Settlement Proceeds, and local funds.
C. The Program, located in a portion of t he City-owned parking lot at 55 Stony Point Road, is a housing-focused, low-barrier site providing up to 50 parking spaces for persons experiencing homelessness to safely park their vehicle or RV with access to basic services, such as food, sanitation and shower facilities, and wrap-around services targeted at ending their homelessness.
D. City desires to retain the services of Contractor to operate the Program pursuant to this Agreement and wishes to fund the Program using Measure O and Homeless Housing, Assistance and Prevention (HHAP) funds awarded by the County of Sonoma Department of Health Services (DHS) and local funds.
E. The Parties have negotiated upon the terms pursuant to which Contractor will operate the Program and have reduced such terms to writing.
AGREEMENT
1. SCOPE OF SERVICES
Contractor shall, in a manner satisfactory to City, administer and conduct the Program described in Exhibit A (“Scope of Services”). Contractor is required to report deviations from budget or Scope of Services.
Exhibit B
Form approved by the City Attorney 5-2025 Page 2 of 13
2. TERM OF AGREEMENT
The term of this Agreement shall commence on July 1, 2026 and shall end on June 30, 2027.
3. GRANT
A. Notwithstanding any other provision of this Agreement, Program funding from City to Contractor shall not exceed one million dollars ($1,000,000) for the period of July 1, 2026, through June 30, 2027. The funding includes $979,040 from the County of Sonoma DHS and $20,960 from local funds. The City’s Chief Financial Officer is authorized to pay all proper claims in an amount not to exceed $1,000,000 from Key 42143/Fund 1209.
B. Payments by City to C ontractor shall be made monthly in arrears based on the Budget in Exhibit B and upon the proper documentation of expenditures.
On or before the fifteenth day of each month, Contractor shall submit an invoice to City for the prior month. The Director of Housing and Community Services (Director) or designee will review each invoice and may deny reimbursement where: 1) an expenditure is questionable or improperly documented; or 2) where Contractor has not provided Program services.
Invoices submitted after 30 days shall include acceptable written justification for the delay.
C. In the event that the Director determines that Contractor is not fully providing the Program services identified in Exhibit A, he shall have the right to reduce the grant award, unless the failure to provide services is beyond Contractor’s control. The exercise by the Director of City’s rights under this provision shall not be construed as a waiver by City of any other right or remedy.
4. INSURANCE
Contractor shall maintain in full force and effect all of the insurance coverage described in, and in accordance with, Attachment One, “Insurance Requirements” which is attached hereto and hereby incorporated and made part of this Agreement by this reference. Maintenance of the insurance coverage as set forth in Attachment One is a material element of this Agreement and a material part of the consideration provided by Contractor in exchange for City’s agreement to make the payments prescribed hereunder. Failure by Contractor to (i) maintain or renew coverage, (ii) provide City notice of any changes, modifications, or reductions in coverage, or (iii) provide evidence of renewal, may be treated by City as a material breach of this Agreement by Contractor, whereas City shall be entitled to all rights and remedies at law or in equity, including but not limited to immediate termination of this Agreement. Notwithstanding the foregoing, any failure by Contractor to maintain required insurance coverage shall not excuse or alleviate Contractor from any of its other duties or obligations under this Agreement. In the event Contractor, with approval of City pursuant to Form approved by the City Attorney 5-2025 Page 3 of 13
Section 10 below, retains or utilizes any subcontractors in the provision of any services under this Agreement, Contractor shall assure that any such subcontractor has first obtained, and shall maintain, all of the insurance coverage requirements set forth in the Insurance Requirements in Attachment One.
5. INDEMNITY/LIABILITY
Contractor shall, to the fullest extent permitted by law, indemnify, protect, defend and hold harmless City, and its employees, officials and agents (“Indemnified Parties”) from all claims, demands, costs or liability (including liability for claims, suits, actions, arbitration proceedings, administrative proceedings, regulatory proceedings, losses, expenses or costs of any kind, interest, defense costs, and expert witness fees), that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of Contractor, its officers, employees, volunteers or agents, in said performance of services under this Agreement, excepting only liability arising from the sole negligence, active negligence or intentional misconduct of City. If there is a possible obligation to indemnify, Contractor’s duty to defend exists regardless of whether it is ultimately determined that there is no obligation to indemnify.
6. INDEPENDENT CONTRACTOR
The parties intend that Contractor, in performing services herein specified, shall act as an independent contractor and shall have control of its work and the manner in which it is performed. It shall be free to contract for similar services to be performed for other employers while it is under contract with City. Contractor is not to be considered an agent or employee of City and is not entitled to participate in any pension plan, medical, or dental plans, or any other benefit provided by City for its employees.
7. SUCCESSORS AND ASSIGNS
City and Contractor each bind itself, its partners, successors, legal representatives, and assigns to the other party to this Agreement and to the partners, successors, legal representatives and assigns of such other party with respect to all promises and agreements contained herein.
8. FINANCIAL REQUIREM ENTS/AUDITS/REPORTING
A. Contractor shall be accountable to Cit y for all City funds requested by and disbursed to Contractor or its subcontractors under this Agreement.
B. Contractor shall maintain a full set of books on a double entry basis in accordance with generally accepted accounting principles (GAAP), procedures, and regulations as deemed necessary by City. Such records shall be maintained by qualified personnel and completed in a timely manner.
Form approved by the City Attorney 5-2025 Page 4 of 13
C. Contractor shall, at all times dur ing normal business hours and as often as may deem necessary, make available to their representatives for examination City, all or subcontractor’s records with respect to all matters covered by this Agreement and shall permit these representatives to audit, examine and make excerpts or transcripts from such records, and to make audits of all documents and conditions relating to this Agreement.
D. Contractor shall permit and facilitat e observation and inspection of Program services and records at Contractor’s principal office and work site by City, its employees, auditors, representatives, and public authorities during reasonable business hours.
E. Contractor shall eit her establish a separate bank account for all funding received from City under this Agreement or practice full fund accounting.
Contractor shall not commingle the funds provided under this Agreement with any other funds, revenue or monies.
F. Contractor shall maintain all reco rds related to the performance of this Agreement during the term of this Agreement and for a period of five (5) years after completion of all services hereunder.
G. Authorized representat ives of City may perform fiscal monitoring of Contractor’s record keeping and reporting to assure compliance with this Agreement.
H. Prior to the commencement of the Program, Contractor shall enter into written agreements with all subcontractors performing Program services under this Agreement and shall include therein the terms in subsections B through G of this Section 8. Contractor shall submit all such subcontracts to City for its review and approval prior to the commencement of the Program.
9. BUDGET
Any requested modification to the line items of the Budget shall be reviewed and approved by the Director prior to the expenditures of funds detailed in the modification. Budget modifications shall not alter: 1) the Scope of Services; or 2) the total grant award under Section 3.
10. SUBCONTRACTS
A. Any subcontract funded under this Ag reement shall be submitted to the Director for review and approval prior to its execution.
B. Any subcontract funded under this Agr eement shall be subject to the terms and conditions of this Agreement.
Form approved by the City Attorney 5-2025 Page 5 of 13
11. CONFLICT OF INTEREST
A. Section 42 of the Cit y Charter and the City’s Conflict of Interest Code expressly apply to this Agreement. Contractor shall be responsible for ensuring compliance with this provision.
B. Contractor shall inform Direc tor of staffing changes at the executive/management level and changes in the membership of its Board of Directors within 30 days of such changes.
12. PUBLICITY
During the term of this Agreement and for one year thereafter, Contractor shall acknowledge City’s contribution to the Program in all publicity regarding the Program, including but not limited to, website and social media, flyers, press releases, posters, brochures, public service announcements, interviews, and newspaper articles. The words "City of Santa Rosa” shall be explicitly stated in any and all pieces of publicity, with respect to the Program.
Upon request, City staff shall assist Contractor in generating publicity for the Program. Contractor agrees to cooperate with City staff in any City-generated publicity or promotional activities related to the Program.
13. RELIGIOUS ACTIVITY PROHIBITED
Contractor agrees that the Grant Amount will not be used for religious activities, to promote religious interests, or for the benefit of a religious organization.
14. NON SOLICITATION CLAUSE
Contractor warrants that it has not employed or retained any company or persons, other than a bona fide employee working solely for Contractor, to solicit or secure this Agreement and that it has not paid or agreed to pay any company or person other than a bona fide employee working solely for Contractor, any fee, commission, percentage, brokerage fee, gifts, or any other consideration, contingent upon or resulting from the award or making of this Agreement. For breach or violation of this warranty, City shall have the right to rescind this Agreement without liability or, at its discretion, reduce the grant award under this Agreement, or otherwise recover the full amount of such fee, commission, percentage brokerage fee, gift or contingent fee.
15. FIXED ASSETS
For purposes of this Agreement, a fixed asset is any physical item, excluding real property, having a cost in excess of $300.00 and a usable life of one year or more.
Form approved by the City Attorney 5-2025 Page 6 of 13
Contractor’s annual report to City shall include invoices and receipts of payment for all fixed assets purchased. If at any time Contractor discontinues the Program, at any time during or after the Agreement period, all fixed assets purchased or acquired by Contractor having a cost in excess of $300.00 and a usable life of one year or more shall revert back to City, at the sole discretion of the City. Contractor shall fully cooperate with City following termination, expiration, or discontinuance to ensure that all fixed assets are transferred and delivered in a prompt and timely manner in order to minimize disruption to services.
16. PUBLICATION RIGHTS COPYR IGHTS AND DATA OWNERSHIP
A. The copyright to any reports, papers, forms, or other materials or documents that are created in connection with the services performed under this Agreement shall vest in City unless otherwise authorized in writing by City.
B. All reports, documents, forms, photographs, maps, data and any other materials developed, collected or prepared by Contractor pursuant to this Agreement shall be the exclusive property of City unless written waiver is executed by City.
C. Publication rights to any documents or materials produced are to be reserved by City.
D. Both written and oral releases are considered to be within the context of publication. However, there is no intention to limit discussion of the Program with small technical groups or lectures to employees or students. Lectures to other groups which describe the Program but disclose neither data nor results are permissible without advance approval.
E. City reserves a royalty-free nonexclusiv e and irrevocable right to reproduce, publish or otherwise use, and to authorize others to use the work developed pursuant to this Agreement, for governmental purposes.
17. PROGRAM MONITORI NG AND EVALUATION
A. Purpose
Contractor shall be monitored and evaluated in terms of its effectiveness and timely compliance with the provisions of this Agreement and the effective and efficient achievement of Program objectives.
Contractor shall appoint a representative to be available to City for consultation and assistance during the performance of this Agreement.
Each year this Agreement is in effect, Contractor shall undertake continuous quantitative and qualitative evaluation of the Scope of Services and shall Form approved by the City Attorney 5-2025 Page 7 of 13
make written quarterly reports to City utilizing the Quarterly Status Report form in Exhibit C. The quarterly reports shall be submitted to City by October 15, January 15, April 15, and July 15 as more fully set forth in Exhibit C.
B. Responsibilities of City
City shall monitor and evaluate the Program.
C. Responsibilities of Contractor
Contractor shall submit quarterly reports, substantiating that the Program is operating in compliance with all the requirements of this Agreement. In the event financial or reporting issues are identified by City or through a compliance review by City, Contractor may be required to reimburse the City for funds that were expended on ineligible activities.
D. Homeless Management Information System
Contractor must be in good standing in collecting and entering current, accurate, and comprehensive data that reflects the homeless prevention and intervention services delivered by Contractor into the Homeless Management Information System (HMIS), as defined by HUD, as a condition of funding under this Agreement. HMIS requirements are further described in Exhibit D.
18. FAIR HOUSING AND EQUAL OPPORTUNITY CERTIFICATIONS
A. Civil Rights Act of 1964 (Title VI)
Title VI of the Civil Rights Act of 1964 (42 U.S.C. §§ 2000d et seq.; P.L. 88- 352) and regulations pursuant thereto (Title 24 CFR § 1) states that no person in the United States shall, on the basis of race, color, or national origin, be excluded from participation in, be denied the benefits of, or otherwise be subjected to discrimination under any program or activity receiving Federal financial assistance extended to Contractor. This assurance shall obligate Contractor, or in the case of any transfer, the transferee, for the period during which the real property and structure(s) are used for a purpose for which the Federal financial assistance is extended or for another purpose involving the provision of similar services or benefits.
B. Fair Housing Act of 1968
The Fair Housing Act (42 U.S.C. §§ 3601-3620; P.L. 90-284) states that it is the policy of the United States to provide, within constitutional limitations, for fair housing throughout the United States and prohibits any person from discriminating in the sale or rental of housing, the financing of housing, or the provision of brokerage services, including in any way making unavailable or denying a dwelling to any person, because of race, color, religion, sex, Form approved by the City Attorney 5-2025 Page 8 of 13
national origin, handicap or familial status. Contractor shall administer all programs and activities assisted under this Agreement in a manner to affirmatively further the policies of the Fair Housing Act.
C. Executive Order 11063 -- Equal Opportunity in Housing
Executive Order 11063, as amended by Executive Order 12259, and regulations pursuant thereto (24 CFR § 107), prohibits discrimination because of race, color, creed, sex, or national origin in the sale, leasing, rental or other disposition of residential property and related facilities (including land to be developed for residential use), or in the use or occupancy thereof, if such property and related facilities are provided with Federal financial assistance.
D. Section 109 of the Housing and Community Development Act of 1974
Section 109 of the Housing and Community Development Act of 1974 states that no person in the United States shall on the basis of race, color, national origin, or sex be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity funded in whole or in part with funds made available under this title.
Section 109 further provides that any prohibition against discrimination on the basis of age under the Age Discrimination Act of 1975 (42 U.S.C. §§ 6101 et seq.) or with respect to an otherwise qualified handicapped person as provided in section 504 of the Rehabilitation Act of 1973 (29 U.S.C. §794) shall also apply to any program or activity funded in whole or in part with funds made available pursuant to Section 109.
E. Executive Order 13166 - Li mited English Proficiency
The Limited English Proficiency (LEP) Guidelines, based upon Title VI of the Civil Rights Act of 1964 (24 CRF 1.4 Executive Order 13166) requires recipients of federal funding to provide language translation or interpreter services to its clients and potential clients who are limited in English proficiency.
A person with Limited English Proficiency (LEP) is a person who does not speak English as their primary language and who has a limited ability to read, write, speak or understand English. Affirmative steps must be taken to communicate with people who need services or information in a language other than English. A policy must be developed to serve applicants, participants, and/or persons eligible for housing assistance and support services.
Contractor must analyze the various kinds of contacts it has with the public, to assess language needs and decide what reasonable steps should be taken.
In order to determine the level of access needed by LEP persons, the Form approved by the City Attorney 5-2025 Page 9 of 13
following four factors must be balanced:
1. the number or proportion of LEP persons eligible to be served or likely to be applying for program services;
2. the frequency with which LEP per sons utilize these programs and services;
3. the nature and impor tance of the program, activity, or service provided; and
4. the benefits from providing LEP serv ices, and the resources available and costs to the CDC for those services.
Balancing these four factors will ensure meaningful access by LEP persons to critical services while not imposing undue burdens on the Contractor.
Contractor shall develop and implement a LEP policy consistent with the above guidelines and provide City with copies of its LEP Policy.
F. Section 504 of the Re habilitation Act of 1973 and Americans with Disabilities Act of 1990
Section 504 of the Rehabilitation Act of 1973, as amended, prohibits discrimination based on handicap in federally assisted and conducted programs and activities. In performance of this Agreement, Contractor shall perform all services described herein in compliance with all applicable federal, state and local laws, rules, regulations, and ordinances, including but not limited to Rehabilitation Act of 1973 (29 U.S.C. § 794) and the Americans With Disabilities Act (ADA) of 1990, (42 U.S.C. §§ 12101, et seq.), and any regulations and guidelines issued pursuant to the ADA, which generally prohibits discrimination against individuals with disabilities and may require reasonable accommodations.
G. Age Discrimination Act of 1975
The Age Discrimination Act of 1975, as amended, prohibits discrimination because of age in programs and activities receiving Federal financial assistance.
H. Executive Orders 11625, 12432, 12138 - Minority and Women Owned Business Opportunities
These Executive Orders state that program participants shall take affirmative action to encourage participation by businesses owned and operated by minority groups and women.
19. DRUG-FREE WORKPLACE
Contractor acknowledges that pursuant to the Federal Drug-Free Workplace Act of 1989, the unlawful manufacture, distribution, dispensation, possession, or use Form approved by the City Attorney 5-2025 Page 10 of 13
of a controlled substance is prohibited on Contractor’s premises. Contractor agrees that any violation of this prohibition by Contractor, its employees, agents, or assigns will be deemed a material breach of this Agreement.
20. ASSIGNMENT
Contractor shall not assign any rights or duties under this Agreement to a third party without the express written consent of City.
21. MODIFICATION
This Agreement shall not be modified except in writing executed by both parties.
The City Manager, or designee, is authorized to approve and execute amendments to this Agreement on behalf of the City.
22. TERMINATION OF AGREEMENT
A. City may terminate this Agreement for convenience upon ten (10) days’ written notice to Contractor. Upon such notice, Contractor shall immediately suspend all services under this Agreement.
B. City may terminate this Agreement imm ediately for cause, which shall include as example but not as a limitation:
1. Failure, for any reason, of Contract or to fulfill, in a timely and proper manner, its obligations under this Agreement including compliance with City, State, and Federal laws and regulations and applicable directives;
2. Failure to meet the performance st andards contained in other sections of this Agreement;
3. Improper use or reporting of f unds provided under this Agreement;
4. Suspension, termination or modifica tion of any of the sources of funds upon which City planned to fund this Agreement;
5. Any event, (whether natural, social, political or financial) which is beyond the control of City and which results in a change in the funds available to City, or which triggers a need by City to reallocate funding to Contractor.
C. In connection with the provisions of subsections A and B above, Contractor understands that City has based its overall allocation of funds to Contractor on the basis of current budgeting requirements. It is therefore agreed that during the term of this Agreement, should all or any part of the funding available to City be reduced in any amount whatsoever, or should be faced with unusual or unexpected natural, social, political or financial events which diminish City’s ability to fund agreements with Contractor and other recipients, Form approved by the City Attorney 5-2025 Page 11 of 13
or which events generate additional needs in the community, then City shall have the right to review and reallocate the amount of funding to be advanced to Contractor under this Agreement. On any of the occurrences described above, City may terminate all or any part of the remaining funding due to Contractor under this Agreement. City shall have the sole discretion to determine whether there is a need to reallocate or terminate funding to Contractor, as well as the sole discretion to determine the amount of the reduction and reallocation.
D. Should such a reduction in funding occu r, City shall notify Contractor as soon as reasonably practicable after City has made the determination of the need to reconsider its funding allocation. Should there be a modification of this Agreement, the modification shall take effect upon notice from City to Contractor in writing. All other terms and conditions of the Agreement shall remain in effect.
23. LAWS, REGULATIONS, FEES, TAXES
A. Contractor shall carry out its respons ibilities pursuant to this Agreement in accordance with all applicable Federal, State and Local laws and all policies, procedures, regulations and requirements as the federal government, State, and City from time to time prescribe. Contractor shall obtain all necessary licenses, permits, permissions, rights of entry, and approvals necessary for the operation of the Trailer.
B. Contractor shall comply with Title VI of the Civil Rights Act of 1964 (24 CFR §§ 1 et seq.) which states that no person shall, on the grounds of race, color, or national origin, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any Program or activity receiving Federal financial assistance.
C. Contractor shall pay all fees and taxes as required by law.
24. NOTICES
Except as otherwise specifically provided in this Agreement, any notice, submittal or communication required or permitted to be served on a party hereto, may be served by personal delivery to the person or the office of the person identified below. Service may also be made by mail, by placing first-class postage affixed thereto, and addressed as indicated below, and depositing said envelope in the United States mail to:
CITY: CONTRACTOR:
Department of Housing
and Communit
y Services
Catholic Charities of
Northwest California
90 Santa Rosa Avenue P.O. Box 4900
Santa Rosa, California, 95404 Santa Rosa, California, 95402 Form approved by the City Attorney 5-2025 Page 12 of 13
25. ENTIRE AGREEMENT
This agreement is the entir e Agreement between the parties.
26. INCORPORATION OF ATTACHMENT AND EXHIBITS
The attachment and exhibits to this Agreement are incorporated and made part of this Agreement, subject to the terms and provisions herein.
27. SIGNATURES REQUIRED FOR CORPORATIONS
If this Agreement is entered into by a corporation, it shall be signed by two corporate officers, one from each of the following two groups: a) the chairman of the board, president or any vice-president; b) the secretary, any assistant secretary, chief financial officer, or any assistant treasurer. The title of the corporate officer shall be listed under the signature.
28. COUNTERPARTS AND ELECTRONIC SIGNATURES
This Agreement and future documents relating thereto may be executed in two or more counterparts, each of which will be deemed an original and all of which together constitute one Agreement. Counterparts and/or signatures delivered by facsimile, pdf or City-approved electronic means have the same force and effect as the use of a manual signature. Both City and Contractor wish to permit this Agreement and future documents relating thereto to be electronically signed in accordance with applicable federal and California law. Either Party to this Agreement may revoke its permission to use electronic signatures at any time for future documents by providing notice pursuant to the Agreement. The Parties agree that electronic signatures, by their respective signatories are intended to authenticate such signatures and to give rise to a valid, enforceable, and fully effective Agreement. The City reserves the right to reject any signature that cannot be positively verified by the City as an authentic electronic signature.
[SIGNATURES APPEAR ON NEXT PAGE]
///
///
Form approved by the City Attorney 5-2025 Page 13 of 13
IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of this date and year first above written.
Attachments:
Attachment One: Insurance Requirements
Exhibit A: Scope of Services
Exhibit B: Budget
Exhibit C: Quarterly Status Report Form
Exhibit D: Homeless Management Information System (HMIS)
CONTRACTOR
Catholic Charities of the Diocese of Santa
Rosa DBA Catholic Charities of Northwest
California
By _______________________________
Name: Jennielynn Holmes
Title: CEO
Taxpayer ID # 94-2479393
CITY OF SANTA ROSA
A Municipal Corporation
By ______________________________
Name: Megan Basinger
Title: Housing & Community Services
Director
APPROVED AS TO FORM
By______________________________
Office of the City Attorney
Attachment One to Grant Agreement
Form approved by the City Attorney 4-14-14
ATTACHMENT ONE
INSURANCE REQUIREMENTS FOR
GRANT AGREEMENTS
A. Insurance Policies: Contractor shall, at all times during the terms of this Agreement, maintain and keep in full force and effect, the following policies of insurance with minimum coverage as indicated below and issued by insurers with AM Best ratings of no less than A-:VI or otherwise acceptable to the City.
Insurance
Minimum
Coverage Limits
Additional Coverage Requirements
1. Commercial
general liability
$ 1 million per
occurrence
Coverage must be at least as broad as ISO CG
00 01 and must include completed operations
coverage. If insurance applies separately to a
project/location, aggregate may be equal to per
occurrence amount. Coverage may be met
by a combination of primary and umbrella
or excess insurance but umbrella and
excess shall provide coverage at least as
broad as specified for underlying coverage.
Coverage shall not exclude subsidence.
$ 2 million
aggregate
2. Business auto
coverage
$ 1 million ISO Form Number CA 00 01 covering any auto
(Code 1), or if Contractor has no owned autos,
hired, (Code 8) and non-owned autos (Code 9),
with limit no less than $ 1 million per accident
for bodily injury and property damage.
3. Professional
liability (E&O)
$ 1 million per
claim
Contractor shall provide on a policy form
appropriate to profession. If on a claims made
basis, Insurance must show coverage date
prior to start of work and it must be maintained
for three years after completion of work.
$ 1 million
aggregate
4. Workers’
compensation and
employer’s liability
$ 1 million As required by the State of California, with Statutory Limits and Employer’s Liability
Insurance with limit of no less than $ 1 million
per accident for bodily injury or disease. The
Workers’ Compensation policy shall be
endorsed with a waiver of subrogation in favor
of the City for all work performed by the
Contractor, its employees, agents and
subcontractors.
5. Cyber liability or
network security
and privacy liability
insurance
$ 2 million per
claim
$ 2 million
aggregate
Coverage shall be sufficiently broad to
respond to the duties and obligations in this
agreement with limit no less than $ 2 million
per claim or occurrence, $ 2 million per
aggregate.
Attachment One to Grant Agreement
Form approved by the City Attorney 4-14-14
Cyber Liability coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by the Consultant in this agreement and shall include, but not be limited to, claims involving security breach, system failure, data recovery, business interruption, cyber extortion, social engineering, infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, and alteration of electronic information. The policy shall provide coverage for breach response costs (including notification costs), regulatory fines and penalties as well as credit monitoring expenses. If the insurance is on a Claims-Made basis, the retroactive date shall be no later than the commencement of the work. Coverage applicable to the work performed under this Agreement shall be continued for two (2) years after completion of the work. Such continuation coverage may be provided by one of the following: (1) renewal of the existing policy; (2) an extended reporting period endorsement; or (3) replacement insurance with a retroactive date no later than the commencement of the work under this Agreement.
B. Endorsements:
1. All policies shall provide or be endorsed to provide that c overage shall not be canceled, except after prior written notice has been provided to the City in accordance with the policy provisions.
2. Liability, umbrella and excess policies shall provide or be endorsed to provide the following:
a. For any claims related to this project, Contractor’s insurance coverage shall be primary and any insurance or self-insurance maintained by City shall be excess of the Contractor’s insurance and shall not contribute with it; and, b. The City of Santa Rosa, its officers, agents, employees and volunteers are to be covered as additional insureds on the CGL policy . General liability coverage can be provided in the form of an endorsement to Contractor’s insurance at least as broad as ISO Form CG 20 10 11 85 or if not available, through the addition of both CG 20 10 and CG 20 37 if a later edition is used.
C. Verification of Coverage and Certificates of Insurance: Contractor shall furnish City with original certificates and endorsements effecting coverage required above.
Certificates and endorsements shall make reference to policy numbers. All certificates and endorsements are to be received and approved by the City before work commences and must be in effect for the duration of the Agreement. The City reserves the right to require complete copies of all required policies and endorsements.
D. Other Insurance Provisions:
1. No policy required by this Agreement shall prohibit Contractor from waiving any right of recovery prior to loss. Contractor hereby waives such right with regard to the indemnitees.
2. All insurance coverage amounts provided by Contractor and available or applicable to this Agreement are intended to apply to the full extent of the policies.
Attachment One to Grant Agreement
Form approved by the City Attorney 4-14-14
Nothing contained in this Agreement limits the application of such insurance coverage. Defense costs must be paid in addition to coverage amounts.
3. Policies containing any self -insured retention (SIR) provision shall provide or be endorsed to provide that the SIR may be satisfied by either Contractor or City.
Self-insured retentions above $10,000 must be approved by City. At City’s option, Contractor may be required to provide financial guarantees.
4. Sole Proprietors must provide a representation of their Workers’ Compensation Insurance exempt status.
5. City reserves the right to modify these insurance requirements while this Agreement is in effect, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.
Exhibit A Page 1 of 3
EXHIBIT A: SCOPE OF SERVICES
SAFE PARKING PROGRAM
FISCAL YEAR 2026/2027
The Safe Parking Program (Program) is a housing-focused, low-barrier site providing up to 50 parking spaces in alignment with the Homelessness Solutions Strategic Plan. The overarching goal of the Program is to provide members of the community who are experiencing vehicular homelessness a place to safely park their vehicle or RV with direct access to basic services as well as wrap-around services targeted at ending their homelessness. The Program provides a safe and secure environment for participants with the goal of moving them into housing as rapidly as possible. Additionally, the Program is meant to lessen the impacts of homelessness on the broader community.
Contractor will provide a number of services, including but not limited to the following:
Administration of the Program per City requirements, including, without limitation, hours of operation, security, site layout, ADA compliance, fire, life/safety, health, welfare, and environmental requirements as well as infectious disease and disaster preparedness safety protocols;
Operate 24/7 with up to 50 safe parking spaces, staffed by 12-hour Participant Advocates and 12-hour security.
Coordination with Homeless Outreach Services Team (HOST) and the City Encampment Team to screen and enroll individuals identified for the Program at an offsite location;
Sanitary facilities (portable toilets, handwashing stations, showers), waste management services, meals, and other services essential to meeting basic needs, including transportation;
Assessment and enrollment in Coordinated Entry for linkage to County-wide housing services;
Case management services to ensure housing-focused intervention as well as connection to public benefit programs, health, mental health and drug treatment services, and job training or employment opportunities, including coordinating additional supports and case management services;
Assist participants with documentation required to obtain housing (identification/driver’s license) and with vehicle/RV compliance (driver’s license, registration, insurance) to ensure transportation to work and appointments; and Regular meetings with City and/or participants to address any issues that may arise including facilities issues, conflict resolution, and service needs.
The Program staffing model will include the following positions to ensure a housing- focused intervention:
Behavioral Health Clinician: Clinician is licensed with the California Board of Behavioral Sciences and responsible for providing comprehensive behavioral health support to participants with the goal of increasing their mental wellbeing and ability to live independent, healthy lives in the community.
Exhibit A Page 2 of 3
Case Managers: Case Managers focused on obtaining housing for those on their caseloads. Once they help the individual obtain housing, they will then prepare them for a successful transition into housing (furniture, crisis planning, etc.). For individuals that exit to permanent housing, the Case Manager will work to ensure participants retain housing and connecting them to resources to ensure that the reason they were originally brought into homelessness is addressed. Participant Advocates: Participant Advocates will be on site 12 hours a day.
They will handle all operational needs and will be responsible for having housing- focused conversations with participants within their first 14 days. Participant Advocates will be responsible for ensuring operational safety as well as updating all housing lists with new ads off Craigslist and other housing opportunities.
The Program will achieve the following planned outputs and indicators.
Planned Outputs
100 individuals will receive in terim shelter via the Program; Maintain a parking space utilization rate at or above 95%; and Contractor will engage cli ents and elicit feedback to incorporate in program planning and implementation.
Planned Indicators
100% of participants that stayed longer than 30 days will be offered housing- focused case management services;
80% of participants that stayed longer than 30 days will engage in housing- focused case management services;
At least 25% of participants that stayed longer than 30 days will be assigned to a housing navigation case manager’s caseload;
15% of exits from t he Program will be to temporary housing destinations; 25% of exits from the Progr am will be to permanent housing; Participants that identify as Black, Indigenous, and people of color (BIPOC) will exit to permanent housing at levels equal to or exceeding that of non-BIPOC participants;
80% of current participants that are head of households will maintain active enrollment in the Sonoma County Coordinated Entry System (CES), as measured last day of each quarter;
80% of participants who exited to permanent housing will remain permanently housed at 6 months and 12 months post exit as measured by participants that complete the housing retention survey; and
Contractor will maintain an agency-wide re turn to homelessness rate of less than 5% as measured by re-entry to any homeless services program in HMIS.
At a minimum, outcomes should meet or exceed the Sonoma County Homeless Coalition (formerly the Continuum of Care (CoC)) system performance measures.
Exhibit A Page 3 of 3
The maximum length of stay in the Program is limited to six (6) months and may be extended on a case-by-case basis to be determined by Contractor in consultation with the City. Participants are required to sign a Participant Agreement outlining Program rules focused on ensuring the health and safety of participants and staff (Contractor and City), including but not limited to a Good Neighbor Policy, participation in case management, monthly vehicle inspections, length of stay, and disposition of abandoned property (personal belongings and passenger vehicles/RVs).
Exhibit B Page 1 of 1
EXHIBIT B: BUDGET
SAFE PARKING PROGRAM
Fiscal Year 2026/2027
Expenses Budget Amounts
Salaries and Benefits $374,463
Food Management $42,000
Telecommunications $7,320
Utilities $45,737
Supplies $3,480
Miscellaneous $6,340
Sanitary Services $96,000
Site Costs $30,000
Security $246,000
Indirect Costs (15%) $127,700
Total County-Funded Expenses $979,040
Salaries and Benefits $18,226
Indirect Costs (15%) $2,734
Total City-Funded Expenses $20,960
Total Operating Budget $1,000,000
Agency Name:
Program Title:
Term:
Quarter:
3. Race/Ethnicity Determination
Total persons must match cumulative total unduplicated participants served.
EXHIBIT C: QUARTERLY STATUS REPORT
SAFE PARKING PROGRAM
Reporting is required as a condition of funding. The CITY will receive quarterly updates based on the information provided in this report (and for HMIS participants as it compares to the HMIS reports). Reports may be submitted electronically. Submit all back-up data for numbers provided in reports. Each quarter should be reported cumulative (or for the quarter if requested below) beginning July 1st and ending through the quarter for which the report is being submitted.
1. Please include a brief narrative of 50 words or less on your program’s progress:
Instructions: An entry is required in every yellow cell. Once data has been entered, the cell will revert to white. You may need to enter 0 to indicate no applicable response. There should be no yellow cells when report is submitted to the City.
2. Total Number of Participants Assisted (This Quarter & Cumulative) Black, African American, African
Race/Ethnicity information must be collected from all participants. Must match cumulative HMIS report provided.
INDIVIDUALS THIS QUARTER CUMULATIVE
Participants Served & Sheltered
Participants Housed
Number of participants served must match quarterly and cumulative HMIS reports provided. 0 Over 80%
Total Persons
Catholic Charities of the Diocese of Santa Rosa
Safe Parking Program
July 1, 2026 to June 30, 2027
Q1: July 1, 2026 - September 30, 2026
Asian or Asian American
Hispanic/Latina/e/o
INCOME LEVEL
Below 30%
31% to 50%
51% to 80%
CUMULATIVE
Other multi-racial
Income information must be collected from all participants. Must match cumulative HMIS report provided.
RACE/ETHNICITY
American Indian, Alaka Native, or Indigenous
CUMULATIVE
0 4. Income Determination:
Client doesn't know
Client prefers not to answer
Total Persons
Total persons must match cumulative total unduplicated participants served.
Middle Eastern or North African
Native Hawaiian or Pacific Islander
White
Exhibit C Page 1 of 3
Cumulative average
# of parking spaces
utilized each night
Total # of BIPOC
participants
that exited
Total # of
participants that
exited
6. Cumulative Exits:
Maintain a parking space utilization rate at or above 95%.
Must match
cumulative total
participants served.
0%
Cumulative AVG
Total exits from Program
0 PROJECT QUANTITATIVE MEASURE TEXT
100 individuals will receive interim shelter via the Program Please include a brief summary of any specific feedback received from any clients during this quarter. Please include any response or anticipated changes in response to this feedback.
Please include a brief narrative on the process for engaging clients and how feedback is incorporated into program planning and implementation:
5. Planned Outputs:
CUMULATIVE
OUTCOMES ACHIEVED
At least 25% of participants that stayed longer than 30 days will be assigned to a housing navigation case manager’s caseload
# of participants assigned to a housing
navigation case manager's caseload
# of participants exited to temporary
destination meant for habitation or
institutional setting other than
detention facilities.
Total current participants that are head
of households, as measured last day of
the quarter
Total participants that stayed longer
than 30 days (includes stayers and
leavers)
Total # of exits
7. Planned Indicators:
Total # of participants that exited to
temporary housing or institutional
setting (non-detention)
Total # of participants exited to
permanent housing
100% of participants that stayed longer than 30 days will be offered housing-focused case management services
# of participants offered housing-
focused case management services
# of participants in caseload exited to
permanent housing destination
PROJECT QUANTITATIVE MEASURE TEXT CUMULATIVE
OUTCOME ACHIEVED
CUMULATIVE
PERCENTAGE
80% of participants that stayed longer than 30 days will engage in housing-focused case management services
# of participants engaged in housing-
focused case management services
15% of exits from the Program will be to temporary
housing destinations
25% of exits from the Program will be to permanent
housing
Exhibit C Page 2 of 3
Full Name Date
Title Signature
Report Completed By:
Contractor will maintain an agency-wide return to
homelessness rate of less than 5% as measured by re-
entry to any homeless services program in the Sonoma
County Homeless Management Information System
(HMIS).
Agency-Wide Return to Homelessness Rate provided by Sonoma County HMIS Coordinator for the 12 month period ending the last date of the quarter.
Participants that identify as BIPOC will exit to permanent housing at levels equal to or exceeding that of non-BIPOC participants.
# of BIPOC participants that exited to
permanent housing
# of non-BIPOC participants that exited
to permanent housing
80% of participants who exited to permanent housing will remain permanently housed at 12 months post exit as
measured by participants that complete the housing
retention survey.
Total households that exited to
permanent housing 12 months prior
and completed housing retention
survey
Of these, total confirmed remain stably
housed
80% of current participants that are head of households will maintain active enrollment in the Sonoma County
Coordinated Entry System (CES), as measured last day of each quarter
# of current participants that are head
of households that are actively enrolled
in Sonoma County CES
80% of participants who exited to permanent housing will remain permanently housed at 6 months post exit as
measured by participants that complete the housing
retention survey.
Total households that exited to
permanent housing 6 months prior and
completed housing retention survey
Of these, total confirmed remain stably
housed
Exhibit C Page 3 of 3
Exhibit D Page 1 of 11
Exhibit D
Homeless Management Information System and Coordinated Entry
Homeless Management Information System
As stated in the Sonoma County Homeless Management Information System Participant Agreement, Contractor must be in “good standing” in collecting and entering current, accurate, and comprehensive data that reflects the homeless program services delivered by Contractor into County’s Efforts to Outcomes (EtO) Homeless Management Information System (HMIS) licensed by Social Solutions Group as a condition of funding under this Agreement.
1. HMIS Good Standing: Good Standing is defined as timely data entry as well as complete and accurate data reflective of the Participant’s status at Intake, Update, and Exit, as defined by the prevailing HMIS Data Standards.
a. Timely data entry: Unless otherwise approved in writing and attached to this Agreement, entry of data into EtO HMIS within five (5) business days of the event that generated the data collection (i.e., Participant Intake, Entry, Update, and/or Exit from the Program) is required. If Participant is enrolled in Program for longer than one-year, annual updates are required.
b. Accurate and Complete Data
i. All homeless Participant data for Covered Homeless Organizations shall be entered into the EtO HMIS unless approved in writing and attached to this Agreement.
ii. 95% of all HUD or Sonoma County-defined mandated data points are supplied (fields do NOT reflect a “Null”, “Don’t Know or Refused”, or “Data Not Collected” value).
iii. The HUD Data Quality reports (required quarterly for each homeless program) shall always reflect a 95% or higher data completeness and quality result. c. Data Collection Methodology: Contractor shall adhere to the most current HMIS Data Standards and County of Sonoma HMIS Lead designed program workflow(s) for each homeless program type.
2. User Training: All Users of the EtO HMIS shall receive general HMIS User Training and Security and Ethics prior to receiving login credentials to the HMIS. Additionally, all HMIS Users shall receive updated Security and Ethics training annually. Contractor shall report Users departing their HMIS role for any reason within 24 hours of their departure for removal of User from the HMIS.
3. Required Quarterly Reporting: Contractor shall utilize data from the following reports as the basis for quarterly report submissions and include those reports with its submission:
a. HUD Data Quality Report for the program being reported with a data range from the start of the fiscal year to the end of the required reporting period (cumulative) b. HUD Annual Performance Report for the program
4. HMIS Financial Match and Other Financial Requirement: Contractor agrees to pay the calculated fair share portion of the McKinney-Vento-required funding match within 60 days
Exhibit D Page 2 of 11
of billing by County. Contractor also agrees to provide County with leveraging information within 30 days of request.
5. Homeless Count Participation: Contractor shall take part in annual sheltered Homeless Count by maintaining accurate and up-to-date data in good standing and being responsive to the Sonoma County Homelessness Coalition (formally: Continuum of Care) and HMIS Coordinators’ requests for current and accurate information prior to and after the Homeless Count. Contractor shall take part in the annual unsheltered Homeless Count by assigning staff to assist in the Homeless Count process and by making facilities and other Contractor resources available to support the Homeless Count commensurate to the size of Contractor’s homelessness program.
Coordinated Entry
Contractor shall fully participate in the Sonoma County Coordinated Entry System (CES). Full participation is defined as adherence to all Sonoma County Coordinated Entry System Policies and Procedures, which includes:
1. Referring homeless participants directly to CES for screening and assessment
2. Communicating about program referral placement and/or reasons for declining participants
3. Determining participant referrals shall be completed within three (3) business days or less.
4. For housing programs, Contractor accepting referrals from the CES. Rejections of referrals shall be only for reasons permissible in the Sonoma County Coordinated Entry System Policies and Procedures.
5. For Emergency Shelter and Street Outreach services, Contractor assessing and enrolling participants into the CES within three (3) days of entering the program.
Exhibit D Page 3 of 11
Privacy and Security of Personal and Personally Identifiable Information (STC No. 6 – Tasseff Version 2024 May 15)
1. Recitals
a. The Department of Housing and Urban Development (HUD) requires user of the Homeless Management Information System (HMIS) to implement safeguards designed to protect the personal information (PI) and personally identifiable information (PII) that the user maintains. To support that effort, HUD adopted regulations similar to the Privacy and Security Rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In addition to complying with HUD regulations, contractors and subcontractors are obligated to protect all other PI, PII, or Sensitive PII (hereinafter identified as Protected Information) obtained on behalf of County pursuant to this agreement consistent with the California Information Practices Act of 1977 (California Civil Code §§ 1798 et seq.). b. The purpose of this Exhibit is to set forth Contractor’s privacy and security obligations with respect to Protected Information that Contractor may create, receive, maintain, use, or disclose on behalf of County pursuant to this Agreement. c. The terms used in this Exhibit, but not otherwise defined, shall have the same meanings as those terms have in the above referenced statute and Agreement. Any reference to statutory, regulatory, or contractual language shall be consistent with such language as in effect or as amended.
d. The provisions of this Exhibit are supplemental to provisions of the Continuum of Care HMIS Participation Agreement. Contractor must comply with both the Participation agreement and this Exhibit. Any conflicts in the language of the agreements shall favor the provision that protects the data better, mitigates vulnerabilities and incidents better, and/or more fully reports breaches.
2. Definitions
a. “Breach” shall have the meaning given to such term under in HIPAA 45 CFR § 164.402 – Definitions.
b. “Breach of the security of the system” shall have the meaning given to such term under the California Information Practices Act, Civil Code § 1798.29(d). c. “County PI” shall mean Personal Information, as defined below, accessed in a database maintained by County, received by Contractor from County, or acquired or created by Contractor in connection with performing the functions, activities and services specified in this Agreement on behalf of County. d. “Personally Identifiable Information” (PII) refers to information that can be used to distinguish or trace an individual's identity, such as name, social security number, and biometric records; individually or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.
Some examples of PII include name, date of birth (DOB), email address, mailing address, medical history, family relationships, vehicle identifiers including license
Exhibit D Page 4 of 11
plates, unique names, certificate, license, telephone and/or other specific reference numbers and/or any information that can directly identify an individual. e. “Personal Information” (PI) shall have the meaning given to such term in California Civil Code § 1798.3(a).
f. “Required by law” means a mandate contained in law that compels an entity to make a use or disclosure of PI or PII that is enforceable in a court of law. This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand. It also includes Medicare conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
g. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PI, or confidential data utilized in complying with this Agreement; or interference with system operations in an information system that processes, maintains, or stores PI. h. “Sensitive Personally Identifiable Information” (SPII) is PII that, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone data elements.
Some examples of SPII include biometric information (e.g., DNA, iris images, fingerprint, and photographic facial images), Social Security Number (SSN), account numbers, and any other unique identifying number (e.g., Federal Housing Administration [FHA] case number, driver’s license number, or financial account number, etc.). Other data elements such as citizenship or immigration status; medical information; ethnic, religious, and account passwords, in conjunction with the identity of an individual (directly or indirectly inferred), are also SPII.
3. Terms of Agreement
a. Permitted Uses and Disclosures of County PI and PII by Contractor Except as otherwise indicated in this Exhibit, Contractor may use or disclose Protected Information only to perform functions, activities or services for or on behalf of County pursuant to the terms of this Agreement provided that such use or disclosure would not violate this agreement.
b. Responsibilities of Contractor
Contractor agrees:
i. Safeguards. To implement appropriate and reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of Protected Information, to protect against anticipated threats or hazards to the security or integrity of Protected Information, and to prevent use or disclosure of Protected Information other than as provided for by this Agreement. Contractor
Exhibit D Page 5 of 11
shall develop and maintain a written information privacy and security program that include administrative, technical, and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, which incorporate the requirements of this Exhibit. Contractor shall provide County with its current policies upon request.
ii. General Privacy Controls. Not to use or disclose Protected Information other than as permitted or required by this Agreement or as required by applicable state and federal law.
1. Contractor and its employees, agents, or subcontractors shall protect from unauthorized disclosure any Protected Information.
2. Contractor and its employees, agents, or subcontractors shall not use any Protected Information for any purpose other than carrying out Contractor's obligations under this Agreement.
3. Contractor shall not disclose any Protected Information to anyone other than County except as permitted by this Agreement, authorized by the person who is the subject of Protected Information, or permitted by state and/or federal regulation.
iii. General Security Controls. Contractor and its sub-contractors or vendors shall take all steps necessary to ensure the continuous security of all computerized data systems containing Protected Information, and to protect paper documents containing Protected Information. These steps shall include, at a minimum:
1. Complying with and ensuring its sub-contractors or vendors comply with all the data system security precautions listed in this Exhibit including all documents incorporated by reference; and,
2. As applicable for Contractor’s information systems, providing a level and scope of security that is at least comparable to the level and scope of security established by the Office of Management and Budget in OMB Circular No. A-130, Appendix III- Security of Federal Automated Information Systems, which sets forth guidelines for automated information systems in federal agencies; and
3. Preserving and ensuring its sub-contractors or vendors preserve, the confidentiality, integrity, and availability of Protected Information with administrative, technical, and physical measures that conform to generally recognized industry standards and best practices that contractor then applies to its own processing environment.
Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes, and updates to operating systems and applications as provided by Contractor and/or its sub-contractors or vendors. Contractor agrees to, and shall ensure that its sub-contractors or venders, comply with County’s current and future information security policies, standards, procedures, and guidelines.
Exhibit D Page 6 of 11
iv. Personnel Controls. Contractor shall implement the following personnel controls.
1. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of County, or access or disclose Protected Information must complete information privacy and security training, at least annually, at Contractor's expense. Training shall emphasize the high level of sensitivity and protection of Sensitive Personally Identifiable Information. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following termination of this Agreement.
2. Employee Discipline. Appropriate sanctions must be applied against workforce members who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment where appropriate.
3. Confidentiality Statement. All persons that will be working with County PHI or PI must sign a confidentiality statement that includes, at a minimum, General Use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to County PHI or PI. The statement must be renewed annually. Contractor shall retain each person’s written confidentiality statement for County inspection for a period of six (6) years following termination of this Agreement.
4. Background Check. Before a member of the workforce may access County PHI or PI, a background screening of that worker must be conducted. The screening should be commensurate with the risk and magnitude of harm the employee could cause, with more thorough screening being done for those employees who are authorized to bypass significant technical and operational security controls. Contractor shall retain each workforce member’s background check documentation for a period of three (3) years. v. System Security Review. Contractor must ensure audit control mechanisms that record and examine system activity are in place. Contractor must conduct and document a system risk assessment/security review on all systems processing and/or storing County PHI or PI. The assessment/security review must be performed a minimum of every two years, must review whether administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection, must identify system security risks, and must document risk findings. Reviews should include vulnerability scanning tools. vi. Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of Protected Information by Contractor or its subcontractors in violation of this Exhibit.
Exhibit D Page 7 of 11
vii. Contractor’s Agents and Subcontractors. To impose the same restrictions and conditions set forth in this Exhibit on any subcontractors or other agents with whom Contractor subcontracts any activities under this Agreement that involve the disclosure of Protected Information to the subcontractor. viii. Cooperation with County. With respect to Protected Information, to cooperate with and assist County to the extent necessary to ensure County’s compliance with the applicable terms of HUD regulations and the California Information Protection Act.
ix. Designation of an Individual Responsible Privacy and for Security
1. Contractor shall designate an individual to oversee its data security program who shall be responsible for carrying out the information security requirements of this Special Terms and Conditions document.
2. Contractor shall designate an individual to oversee its information privacy program who shall be responsible for carrying out the information privacy requirements of this Special Terms and Conditions document.
3. The individual designated to the above roles may be the same individual so long as they are qualified and able to effectively perform the duties of both designations.
x. Privacy & Security Audits. Contractor shall accommodate and upon reasonable notice by Sonoma County, work with Sonoma County and/or its subcontractors to submit to a random information privacy & security audit. This is to ensure that Contractor’s information privacy and security practices comply with contractual obligations, this Exhibit, and related state and federal regulations.
Contractor shall ensure that its sub-contractors or vendors comply with these same requirements.
xi. Availability of Information to County. To make Protected Information available to County for purposes of oversight, inspection, amendment, and response to requests for records, injunctions, judgments, and orders for production of County Protected Information. Upon request by County, Contractor shall provide County with a list of all employees, contractors and agents who have access to Protected Information, including employees, contractors and agents of its subcontractors.
xii. Confidentiality of Alcohol and Drug Abuse Patient Records. Contractor agrees to comply with all confidentiality requirements set forth in Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2. Contractor is aware that criminal penalties may be imposed for a violation of these confidentiality requirements. All information subject to 42 CFR Part 2 shall be considered Sensitive Personally Identifiable Information.
c. Data Security Requirements
Contractor agrees to implement the following:
i. Workstation/Laptop encryption. All workstations and laptops that store County PHI or PI either directly or temporarily must be encrypted using a FIPS 140-2
Exhibit D Page 8 of 11
certified algorithm which is 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by County Privacy and Security Office.
ii. Minimum Necessary. Only the minimum necessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.
iii. Antivirus software. All workstations, laptops and other systems that process and/or store County PHI or PI must install and actively use comprehensive anti- virus software solution with automatic updates scheduled at least daily. iv. Patch Management. All workstations, laptops and other systems that process and/or store County PHI or PI must have critical security patches applied, with system reboot if necessary. There must be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable patches must be installed within 30 days of vendor release. Applications and systems that cannot be patched within this time frame due to significant operational reasons must have compensatory controls implemented to minimize risk until the patches can be installed. Applications and systems that cannot be patched must have compensatory controls implemented to minimize risk, where possible. v. Data Destruction. If Protected Information is stored on a local device or server, when no longer needed, all Protected Information must be wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7 Pass) standard, or by degaussing. Media may also be physically destroyed in accordance with NIST Special Publication 800-88. Other methods require prior written permission of County Privacy and Security Office.
vi. System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity.
vii. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user authentications, enforcing the principle of least privilege.
viii. Transmission encryption. All data transmissions of County PHI or PI outside the secure internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128 bit or higher, such as AES. Encryption can be end-to-end at the network level, or the data files containing County PHI can be encrypted. This requirement pertains to any type of County PHI or PI in motion such as website access, file transfer, and E-Mail.
ix. Intrusion Detection. All systems involved in accessing, holding, transporting, and protecting County PHI or PI that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.
Exhibit D Page 9 of 11
d. Paper Document Controls
i. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office.
Unattended means that information is not being observed by an employee authorized to access the information. County PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.
ii. Escorting Visitors. Visitors to areas where County PHI or PI is contained shall be escorted and County PHI or PI shall be kept out of sight while visitors are in the area.
iii. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as crosscut shredding and pulverizing. iv. Removal of Data. Only the minimum necessary County PHI or PI may be removed from the premises of Contractor except with express written permission of County. County PHI or PI shall not be considered “removed from the premises” if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.
v. Faxing. Faxes containing County PHI or PI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax. vi. Mailing. Mailings containing County PHI or PI shall be sealed and secured from damage or inappropriate viewing of such PHI or PI to the extent possible.
Mailings which include 500 or more individually identifiable records of County PHI or PI in a single package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of County to use another method is obtained.
e. Breaches and Security Incidents. During the term of this Agreement, Contractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps:
i. Initial Notice to County. (1) To notify County immediately by telephone call plus email or fax upon the discovery of a breach of Protected Information in electronic media or in any other media if the Protected Information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon discovery of a suspected security incident involving Protected Information. (2) To notify County within 24 hours (one (1) hour if SSA data) by email or fax of the discovery of any suspected security incident, intrusion, or unauthorized access, use or disclosure of Protected Information in violation of this Agreement or this Exhibit, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer, or other agent of Contractor.
Exhibit D Page 10 of 11
Notice shall be provided to County Privacy and Security Officer by calling 707-565-4703, and emailing DHS-Privacy&[email protected]. ii. Prompt Action. Upon discovery of a breach or suspected security incident, intrusion, or unauthorized access, use, or disclosure of County PHI, Contractor shall take prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment. Contractor shall also take any action required by applicable federal and state laws and regulations. iii. Initial Investigation and Investigation Report. Contractor shall immediately investigate such suspected security incident, security incident, breach, or unauthorized access, use, or disclosure of PHI within 24 hours of the discovery.
Contractor shall submit a report to County containing all relevant information known at the time.
Complete Report. To provide a complete report of the investigation to County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include an assessment of all known factors relevant to a determination of whether a breach occurred.
The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If County requests information in addition to that provided in the Initial Report or Complete Report, Contractor shall make reasonable efforts to provide County with such information. If, because of the circumstances of the incident, Contractor needs more than ten (10) working days from the discovery to submit a Complete Report, County may grant a reasonable extension of time, in which case Contractor shall submit periodic updates until the Complete Report is submitted. If necessary, a Supplemental Report may be used to submit revised or additional information after the Complete Report is submitted County shall review and approve the determination of whether a breach occurred, whether individual notifications are required, and Contractor’s corrective action plan. iv. Responsibility for Reporting of Breaches. If the cause of a breach of Protected Information is attributable to Contractor or its agents, subcontractors or vendors, Contractor is responsible for all required reporting of the breach as specified in CIPA, § 1798.29(a) – (d) and California SIMM 5340-C (https://cdt.ca.gov/wp- content/uploads/2021/02/SIMM_5340-C-1.pdf). Contractor shall bear all costs of required notifications to individuals as well as any costs associated with the breach. The County Privacy and Security Officer shall approve the time, manner, and content of any such notifications and their review and approval must be obtained before the notifications are made. County shall provide its review and approval expeditiously and without unreasonable delay. If Contractor has reason to believe that duplicate reporting of the same breach or incident may occur because its subcontractors, agents or vendors may report the breach or incident to County in addition to Contractor, Contractor shall notify County, and County and Contractor may take appropriate action to prevent duplicate reporting. v. County Contact Information. To direct communications to the above referenced County staff, Contractor shall initiate contact as indicated herein. County
Exhibit D Page 11 of 11
reserves the right to make changes to the contact information below by giving written notice to Contractor. Said changes shall not require an amendment to this Addendum or the Agreement to which it is incorporated.
Sonoma County Privacy Officer
1450 Neotomas Avenue, Suite 200
Santa Rosa CA 95405
Office: 707-565-4703
Message: 707-565-5703
Email: DHS-Privacy&[email protected]