Attachment 1
Attachment 1
Attachment 1
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(a) These GSPD – ITGP (Cloud) (except in the instances herein where the provision contains “Unless otherwise specified in the Statement of Work” (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in these GSPD – ITGP (Cloud)); (b) Contract form(s), i.e., Purchase Order STD 65, Standard Agreement STD 213, FI$Cal generated Purchase Order, etc., and any amendments; (c) Other Special Provisions (except in the instances therein where the provision contains “Unless otherwise specified in the Statement of Work” (or similar phrase), the provisions specified in the Statement of Work shall take precedence over the provisions referenced in the applicable Special Provisions);
(d) CDT’s Statement of Work (SOW), as an exhibit, including any specifications incorporated by reference herein;
(e) Cost worksheets;
(f) Other work description, work authorization or exhibit issued by Users; (g) DGS SCA Agreement and any amendments thereto;
(h) County of Riverside RFQ # ITARC-00532;
(i) Microsoft Master Agreement #8084445; and
(j) All other Contractor’s or Service Provider’s attachments included in Contract and/or incorporated in Contract by reference (e.g., end User license agreements, acceptable use policies, service guides, product specific terms and conditions).
3. Clarifications to the DGS SLP, DGS SCA, and County of Riverside Request for Quote (RFQ) #ITARC-00532
A. For the avoidance of doubt, notwithstanding Section 9.4 of the County of Riverside RFQ #ITARC-00532, Order of Precedence in the DGS SCA, or any other provision to the contrary, the Order of Precedence in Section 2 of this Statement of Work shall apply to this Agreement.
B. For the avoidance of doubt, termination of the County of Riverside Agreement #ITARC-00532, Microsoft Master Agreement Number 8084445, or DGS SCA does not automatically terminate this Agreement and will remain in full force and effect.
Any modifications to this Agreement will be documented through an amendment as set forth in the DGS PD 402-ITGP Cloud (REV. 02/20/2025).
4. Third Party Solutions
Contractor shall not provide, integrate, resell, access, or make available to the State or Customer Affiliate any third-party services, solutions, tools, platforms, or products (including open-source or hosted services) (“Third Party Solutions”) in connection with the Microsoft Online Subscriptions to M365 G5 GCC offerings and additional Microsoft GCC add-ons as detailed in the Exhibit C-1 Cost Worksheet unless such Third Party Solutions are expressly approved in writing by CDT Information Technology Program Management (“CDT ITPM”) and are subject to the terms and conditions of this Agreement. Contractor shall not structure its performance, delivery model, or technical architecture in a manner that circumvents the Attachment 1
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
B. Throughout the term of the Agreement, Customer Affiliate may add the quantity of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add- ons that the Customer Affiliate procured under the current purchase order (PO). Upon request by Customer Affiliate, CDT may issue an amended PO to decrement the quantity of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add- ons that the Customer Affiliate procured under the current PO.
C. Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add- ons are price protected (fixed prices throughout the term of the Agreement) and shall be priced by the Contractor at the price set forth in Exhibit C-1 Cost Worksheet and for the add-ons the price is set forth in the product/service catalog.
D. The Contractor shall work collectively with Microsoft to promptly resolve any issues CDT or Customer Affiliates are experiencing with their reservations.
E. The Contractor shall provide CDT an annual report sixty (60) days before each anniversary date (set forth in Section 5.B above) of Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons added and decremented during the current PO.
F. CDT will perform true-ups to add or true-downs to decrement Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons counts once a year (prior to the anniversary date, which is defined in Section 5.B above). 1) Contractor to provide Customer Affiliates with budgetary quote for annual reconciliation sixty (60) days prior to each anniversary date. 2) Contractor shall process the true-ups or true-downs prior to each anniversary date (set forth in Section 5.B above) and submit an email confirmation of such to CDT. 3) Contractor shall not accept or process any new reservations for Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons in the thirty (30) days prior to the expiration of the Agreement (03/31/2031).
G. The Contractor shall process certain requests for add-ons for Microsoft Online Subscriptions to M365 G5 GCC offerings and any additional GCC add-ons throughout the term of each PO for the following scenarios:
1) Time sensitive promotional part number and/or SKUs, which require invoicing by a certain date to be valid.
2) Time sensitive orders that are associated with End Customer Investment Funds (ECIF).
3) Limited situations where the normal true-up/reconciliation window could negativel y impact a special negotiation with CDT or Customer Affiliates.
Attachment 1
Attachment 1
Attachment 1
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
16. Advertising of Data
In accordance with the General Provisions (DGS PD 402-ITGP Cloud (REV. 02/20/2025)), the Contractor and Microsoft are not authorized to use, sell, resell, package or repackage, or publicly display any information or data without the express written approval of the State. This restriction includes keyword searching or data mining of State data. Advertising is not allowed in any of these services or to any of the contacts associated with these services.
17. Federal Tax Administration Requirements
CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least forty-five (45) calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075.
Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately per the Cloud Computing Services - General Provisions – Information Technology (402-ITGP), clause 16.3, Termination for Default. In conformation with IRS Publication 1075, Contractor must comply with these terms.
18. Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act (33 U.S.C. 1251-1388)
The Contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT B
BUDGET DETAIL AND PAYMENT PROVISIONS
1. Payment and Invoicing
A. Payment will be made annually in advance for the subscription year and upon receipt of a correct invoice. Invoices may be submitted on or after the first day of the term referenced in the executed PO. The invoice shall include booking confirmation of the CDT order per each environment; including but not limited to, the Contract number, the individual Customer PO number, the Customer Department, the EA/Tenant ID/number, the product name, Part/SKU number, unit cost, extended cost, code (if applicable), must reference a specific PO line item, term dates and include PO amendment number if applicable; and shall reference the Agency Order Number and the Microsoft Enterprise License Agreement (MELA) Software Cooperative Agreement (SCA) number SCA-24-70-0003U.
B. Submit your invoice using only one of the following options:
1) Send via U.S. mail in TRIPLICATE to:
California Department of Technology
Administration Division – Accounting Office
P. O. Box 1810
Rancho Cordova, CA 95741
OR
2) Submit electronically at: [email protected]
C. If there is a change in cost to a license, or if the start date for licenses is changed so that it impacts pricing (i.e., term and activation of licenses falls after the 2nd of the month, and so billing begins the following month), the Contractor must provide product pricing change update and quote to the Customer Affiliate so that an amendment can be executed to the Customer Affiliate’s PO, to reflect the correct pricing.
D. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.
2. Budget Contingency Clause
A. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this contract and Contractor shall not be obligated to perform any provisions of this contract.
B. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of thi s program, the State shall have the option to either cancel this Contract with no liabilit y Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
occurring to the State or offer a contract amendment to the Contractor to reflect the reduced amount.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT C
COST WORKSHEET DETAILS
The Contractor shall submit a completed Attachment 1B (Exhibit C-1) Cost Worksheet, attached to the Request For Offer (RFO). The Contractor must adhere to the following:
A. Subscriptions of the FromSA M365 G5 SKU will renew using the M365 G5 FromSA Renewal SKU. Subscriptions renewing from the M365 G5 Full SKU will renew as M365 G5 Full.
B. Incremental additional M365 G5 GCC licenses added to enrollments for participating Customer Affiliates from day one (1) shall be priced at “Full” pricing, which is different from the “Full” pricing for those subscriptions that are renewing from “Full” subscriptions on 4/1/2026.
C. All future new enrollments for M365 G5 GCC shall qualify for “Full” pricing.
D. Pricing for true-ups will be equivalent to new enrollment pricing for all approved products.
E. Pricing shall not exceed the negotiated discounts.
F. Pricing for all Microsoft products offered under this Agreement shall be price protected throughout the term of this Agreement.
G. The December 2025 price list will be the basis to determine final pricing.
H. All pricing in Attachment 1B (Exhibit C-1) Cost Worksheet must be to two decimal points only.
Any pricing that exceeds two decimal points will be rounded down to the nearest cent.
I. Information Worker (IW) in Attachment 1B (Exhibit C-1) Cost Worksheet refers to worker licensed with M365 G5 and each Customer Affiliate has a unique number of IWs.
J. For pricing purposes of items in Attachment 1B (Exhibit C-1) Cost Worksheet with IW threshold/eligibility conditions, each Customer Affiliate’s IW total shall be treated as a separate and independent quantity.
K. For any new Microsoft products added to the product/service catalog after the execution of this Agreement, Contractor must provide a margin above Contractor’s cost from Microsoft (represented as a percentage), which will not be exceeded when such new Microsoft products are offered to Customer Affiliates.
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT D
GENERAL PROVISIONS
These provisions are hereby incorporated by reference. The provisions are revised and effective 2/20/2025 for the Cloud and Non-Cloud.
Cloud Computing Services – General Provisions (DGS PD 402-ITGP Cloud (REV. 02/20/2025)) https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document- Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT E
SPECIAL PROVISIONS
These provisions are hereby incorporated by reference. The provisions are revised and effective January 2025 for the GenAI Special Provisions.
Generative AI (GENAI) Special Provisions
https://cdt.ca.gov/wp-content/uploads/2025/02/GenAI-Special-Provisions-January-2025.pdf Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
EXHIBIT F
SPECIAL TERMS AND CONDITIONS TO SAFEGUARD FEDERAL TAX INFORMATION Federal statute, regulations and guidelines require that all contracts for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes include the provisions contained in this exhibit.
Contractor agrees to comply with 26 United States Code (U.S.C) §6103(n), 26 Code of Federal Regulations (C.F.R) §301.6103(n)-1(a)(2) and (d), and Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021), Section 2.C.8., 2.C.9, and Exhibit 7) and all applicable conditions and restrictions as may be prescribed by the IRS by regulation, published rules or procedures, or written communication to the contractor.
Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021) https://www.irs.gov/pub/irs-pdf/p1075.pdf EXHIBIT 7 - SAFEGUARDING CONTRACT LANGUAGE
I. PERFORMANCE
In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:
(1) All work will be performed under the supervision of the contractor. (2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.
(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited. (4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.
(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.
(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.
(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.
(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI. (10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.
(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and 202 obligated to the agency under this contract.
(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.
(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.
II. CRIMINAL/CIVIL SANCTIONS
(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.
(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1. (3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.
(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 ( see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure ). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. ( See Section 10 ) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.
III. INSPECTION
The IRS and the Agency, with 24-hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.
IRS Publication 1075 (Rev. 11/2021) Section 2.C.8, Control over Processing through 2.C.9, Service Level Agreements (SLA)
2.C.8 Controls Over Processing
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
It shall be unlawful for any person (not described in paragraph (1)) willfully to disclose to any person, except as authorized in this title, any return or return information (as defined in section 6103(b)) acquired by him or another person under subsection (d), (i)(1)(C),
(3)(B)(i), or (7)(A)(ii), (k)(10), (13), (14), or (15), (l)(6), (7), (8), (9), (10), (12), (15), (16), (19), (20), or (21) or (m)(2), (4), (5), (6), or (7) of section 6103 or under section 6104(c). Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.
(3) Other persons
It shall be unlawful for any person to whom any return or return information (as defined in section 6103(b)) is disclosed in a manner unauthorized by this title thereafter willfully to print or publish in any manner not provided by law any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.
(4) Solicitation
It shall be unlawful for any person willfully to offer any item of material value in exchange for any return or return information (as defined in section 6103(b)) and to receive as a result of such solicitation any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.
(5) Shareholders
It shall be unlawful for any person to whom a return or return information (as defined in section 6103(b)) is disclosed pursuant to the provisions of section 6103(e)(1)(D)(iii) willfully to disclose such return or return information in any manner not provided by law. Any violation of this paragraph shall be a felony punishable by a fine in any amount not to exceed $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution. (b) Disclosure of operations of manufacturer or producer Any officer or employee of the United States who divulges or makes known in any manner whatever not provided by law to any person the operations, style of work, or apparatus of any manufacturer or producer visited by him in the discharge of his official duties shall be guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than $1,000, or imprisoned not more than 1 year, or both, together with the costs of prosecution; and the offender shall be dismissed from office or discharged from employment.
(c) Disclosures by certain delegates of Secretary
All provisions of law relating to the disclosure of information, and all provisions of law relating to penalties for unauthorized disclosure of information, which are applicable in respect of any function under this title when performed by an officer or employee of the Treasury Department Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
are likewise applicable in respect of such function when performed by any person who is a “delegate” within the meaning of section 7701(a)(12)(B). (d) Disclosure of software
Any person who willfully divulges or makes known software (as defined in section 7612(d)(1)) to any person in violation of section 7612 shall be guilty of a felony and, upon conviction thereof, shall be fined not more than $5,000, or imprisoned not more than 5 years, or both, together with the costs of prosecution.
(e) Cross references
(1) Penalties for disclosure of information by preparers of returns
For penalty for disclosure or use of information by preparers of returns, see section 7216.
(2) Penalties for disclosure of confidential information
For penalties for disclosure of confidential information by any officer or employee of the
United States or any department or agency thereof, see 18 U.S.C. 1905. 26 U.S.C. §7213A. Unauthorized inspection of returns or return information (a) Prohibitions
(1) Federal employees and other persons
It shall be unlawful for—
(A) any officer or employee of the United States, or
(B) any person described in subsection (l)(18) or (n) of section 6103 or an officer or employee of any such person, willfully to inspect, except as authorized in this title, any return or return information.
(2) State and other employees
It shall be unlawful for any person (not described in paragraph (1)) willfully to inspect, except as authorized in this title, any return or return information acquired by such person or another person under a provision of section 6103 referred to in section 7213(a)(2) or under section 6104(c).
(b) Penalty
(1) In general
Any violation of subsection (a) shall be punishable upon conviction by a fine in any amount not exceeding $1,000, or imprisonment of not more than 1 year, or both, together with the costs of prosecution.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(2) Federal officers or employees
An officer or employee of the United States who is convicted of any violation of subsection (a) shall, in addition to any other punishment, be dismissed from office or discharged from employment.
(c) Definitions
For purposes of this section, the terms “ inspect”, “return”, and “ return information ” have the respective meanings given such terms by section 6103(b). 26 U.S.C. §7431. Civil damages for unauthorized inspection or disclosure of returns and return information
(a) In general
(1) Inspection or disclosure by employee of United States If any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103, such taxpayer may bring a civil action for damages against the United States in a district court of the United States.
(2) Inspection or disclosure by a person who is not an employee of United States If any person who is not an officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103 or in violation of section 6104(c), such taxpayer may bring a civil action for damages against such person in a district court of the United States. (b) Exceptions
No liability shall arise under this section with respect to any inspection or disclosure—
(1) which results from a good faith, but erroneous, interpretation of section 6103, or
(2) which is requested by the taxpayer.
(c) Damages
In any action brought under subsection (a), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of—
(1) the greater of—
(A) $1,000 for each act of unauthorized inspection or disclosure of a return or return information with respect to which such defendant is found liable, or
(B) the sum of—
(i) the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure, plus
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(ii) in the case of a willfulinspection or disclosure or an inspection or disclosure which is the result of gross negligence, punitive damages, plus
(2) the costs of the action, plus
(3) in the case of a plaintiff which is described in section 7430(c)(4)(A)(ii), reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party (as determined under section 7430(c)(4)).
(d) Period for bringing action
Notwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at any time within 2 years after the date of discovery by the plaintiff of the unauthorized inspection or disclosure. (e) Notification of unlawful inspection and disclosure. If any person is criminally charged by indictment or information with inspection or disclosure of a taxpayer’s return or return information in violation of—
(1) paragraph (1) or (2) of section 7213(a),
(2) section 7213A(a), or
(3) subparagraph (B) of section 1030(a)(2) of title 18, United States Code, the Secretary shall notify such taxpayer as soon as practicable of such inspection or disclosure. The Secretary shall also notify such taxpayer if the Internal Revenue Service or a Federal or State agency (upon notice to the Secretary by such Federal or State agency) proposes an administrative determination as to disciplinary or adverse action against an employee arising from the employee’s unauthorized inspection or disclosure of the taxpayer’s return or return information. The notice described in this subsection shall include the date of the unauthorizedinspection or disclosure and the rights of the taxpayer under such administrative determination.
(f) Definitions
For purposes of this section, the terms “ inspect”, “inspection”, “return”, and “ return information” have the respective meanings given such terms by section 6103(b). (g) Extension to information obtained under section 3406For purposes of this section— (1) any information obtained under section 3406 (including information with respect to any payee certification failure under subsection (d) thereof) shall be treated as return information, and
(2) any inspection or use of such information other than for purposes of meeting any requirement under section 3406 or (subject to the safeguards set forth in section 6103) for purposes permitted under section 6103 shall be treated as a violation of section 6103.
For purposes of subsection (b), the reference to section 6103 shall be treated as including a reference to section 3406.
(h) Special rule for information obtained under section 6103(k)(9) Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
For purposes of this section, any reference to section 6103 shall be treated as including a reference to section 6311(e).
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
ATTACHMENT 1
HIPAA BUSINESS ASSOCIATE AGREEMENT
If Customer is a Covered Entity or a Business Associate and includes Protected Health Information in Customer Data or FastTrack Data, execution of a license agreement that includes the Online Services Terms (“Agreement”) will incorporate the terms of this HIPAA Business Associate Agreement (“BAA”) into that Agreement. If there is any conflict between a provision in this BAA and a provision in the Agreement, this BAA will control.
1. Definitions.
Except as otherwise defined in this BAA, capitalized terms shall have the definitions set forth in HIPAA, and if not defined by HIPAA, such terms shall have the definitions set forth in the Agreement.
“Breach Notification Rule” means the Breach Notification for Unsecured Protected Health Information Final Rule.
“Business Associate” shall have the same meaning as the term “business associate” in 45 CFR § 160.103 of HIPAA.
“Covered Entity” shall have the same meaning as the term “covered entity” in 45 CFR § 160.103 of HIPAA.
“Customer”, for this BAA only, means Customer and its Affiliates. “FastTrack Data” means all data, including all text, sound, video, or image files, and software, that are provided to Microsoft by or on behalf of Customer for Microsoft’s performance of the FastTrack Services.
“FastTrack Services” means the onboarding and migration services for Office 365 Services specified as being in scope for this BAA on the FastTrack Center BAA site at http://aka.ms/FastTrackBAA (or successor site) that are provided to Customer by Microsoft in connection with Customer’s subscription for Office 365 Services, excluding services that are performed using third-party software or software that is not hosted by Microsoft. “HIPAA” collectively means the administrative simplification provision of the Health Insurance Portability and Accountability Act enacted by the United States Congress, and its implementing regulations, including the Privacy Rule, the Breach Notification Rule, and the Security Rule, as amended from time to time, including by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act and by the Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule.
“Microsoft Online Services”, for this BAA only, means Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics 365 Core Services, Microsoft Intune Online Services, Microsoft Power Platform Core Services, and/or Microsoft Cloud App Security, each as defined in the “Data Protection Terms” section of the Online Services Terms incorporated into the Agreement; Microsoft Healthcare Bot; and any additional Azure online services and U.S.
Government online services listed as in scope for this BAA on the Microsoft Trust Center at https://www.microsoft.com/en-us/trustcenter/Compliance/HIPAA (or successor site); excluding Previews.
“Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
“Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103 of HIPAA, provided that it is limited to such protected health information that is received by Microsoft from, or created, received, maintained, or transmitted by Microsoft on behalf of, Customer (a) through the use of the Microsoft Online Services or (b) for Microsoft’s performance of the FastTrack Services.
“Security Rule” means the Security Standards for the Protection of Electronic Protected Health Information.
2. Permitted Uses and Disclosures of Protected Health Information. a. Performance of the Agreement for Microsoft Online Services. Except as otherwise limited in this BAA, Microsoft may Use and Disclose Protected Health Information for, or on behalf of, Customer as specified in the Agreement; provided that any such Use or Disclosure would not violate HIPAA if done by Customer, unless expressly permitted under paragraph b of this Section. b. Management, Administration, and Legal Responsibilities. Except as otherwise limited in this BAA, Microsoft may Use and Disclose Protected Health Information for the proper management and administration of Microsoft and/or to carry out the legal responsibilities of Microsoft, provided that any Disclosure may occur only if: (1) Required by Law; or (2) Microsoft obtains written reasonable assurances from the person to whom the Protected Health Information is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed to the person, and the person notifies Microsoft of any instances of which it becomes aware in which the confidentiality of the Protected Health Information has been breached.
3. Responsibilities of the Parties with Respect to Protected Health Information.
a. Microsoft’s Responsibilities. To the extent Microsoft is acting as a Business Associate, Microsoft agrees to the following:
(i) Limitations on Use and Disclosure. Microsoft shall not Use and/or Disclose the Protected Health Information other than as permitted or required by the Agreement and/or this BAA or as otherwise Required by Law. Microsoft shall not disclose, capture, maintain, scan, index, transmit, share or Use Protected Health Information for any activity not authorized under the Agreement and/or this BAA. Neither Microsoft Online Services nor FastTrack Services shall use Protected Health Information for any advertising, Marketing or other commercial purpose of Microsoft or any third party. Microsoft shall not violate the HIPAA prohibition on the sale of Protected Health Information. Microsoft shall make reasonable efforts to Use, Disclose, and/or request the minimum necessary Protected Health Information to accomplish the intended purpose of such Use, Disclosure, or request.
(ii) Safeguards. Microsoft shall: (1) use reasonable and appropriate safeguards to prevent inappropriate Use and Disclosure of Protected Health Information other than as provided for in this BAA; and (2) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.
Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
(iii) Reporting. Microsoft shall report to Customer: (1) any Use and/or Disclosure of Protected Health Information that is not permitted or required by this BAA of which Microsoft becomes aware; (2) any Security Incident of which it becomes aware, provided that notice is hereby deemed given for Unsuccessful Security Incidents and no further notice of such Unsuccessful Security Incidents shall be given; and/or (3) any Breach of Customer’s Unsecured Protected Health Information that Microsoft may discover (in accordance with 45 CFR § 164.410 of the Breach Notification Rule). Notification of a Breach will be made without unreasonable delay, but in no event more than five (5) business days after Microsoft’s determination of a Breach. Taking into account the level of risk reasonably likely to be presented by the Use, Disclosure, Security Incident, or Breach, the timing of other reporting will be made consistent with Microsoft’s and Customer’s legal obligations.
For purposes of this Section, “Unsuccessful Security Incidents” mean, without limitation, pings and other broadcast attacks on Microsoft’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, Use, or Disclosure of Protected Health Information. Notification(s) under this Section, if any, will be delivered to contacts identified by Customer pursuant to Section 3b(ii) (Contact Information for Notices) of this BAA by any means Microsoft selects, including through e-mail. Microsoft’s obligation to report under this Section is not and will not be construed as an acknowledgement by Microsoft of any fault or liability with respect to any Use, Disclosure, Security Incident, or Breach.
(iv) Subcontractors. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2) of HIPAA, Microsoft shall require its Subcontractors who create, receive, maintain, or transmit Protected Health Information on behalf of Microsoft to agree in writing to: (1) the same or more stringent restrictions and conditions that apply to Microsoft with respect to such Protected Health Information; (2) appropriately safeguard the Protected Health Information; and (3) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.
Microsoft remains responsible for its Subcontractors’ compliance with obligations in this BAA.
(v) Disclosure to the Secretary . Microsoft shall make available its internal practices, records, and books relating to the Use and/or Disclosure of Protected Health Information received from Customer to the Secretary of the Department of Health and Human Services for purposes of determining Customer’s compliance with HIPAA, subject to attorney-client and other applicable legal privileges. Microsoft shall respond to any such request from the Secretary in accordance with the Section titled “Disclosure of Customer Data” in the Agreement.
(vi) Access. If Microsoft maintains Protected Health Information in a Designated Record Set for Customer, then Microsoft, at the request of Customer, shall within fifteen (15) days make access to such Protected Health Information available to Customer in accordance with 45 CFR § 164.524 of the Privacy Rule. (vii) Amendment. If Microsoft maintains Protected Health Information in a Designated Record Set for Customer, then Microsoft, at the request of Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
Customer, shall within fifteen (15) days make available such Protected Health Information to Customer for amendment and incorporate any reasonably requested amendment
in the Protected Health Information in accordance with 45 CFR § 164.526 of the Privacy Rule.
(viii) Accounting of Disclosure. Microsoft, at the request of Customer, shall within fifteen (15) days make available to Customer such information relating to Disclosures made by Microsoft as required for Customer to make any requested accounting of Disclosures in accordance with 45 CFR § 164.528 of the Privacy Rule.
(viii)Performance of a Covered Entity’s Obligations. To the extent Microsoft is to carry out a Covered Entity obligation under the Privacy Rule, Microsoft shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligation.
b. Customer Responsibilities.
(i) No Impermissible Requests. Customer shall not request Microsoft to Use or Disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate).
(ii) Contact Information for Notices. Customer hereby agrees that any reports, notification, or other notice by Microsoft pursuant to this BAA may be made electronically. Customer shall provide contact information as follows (or as Microsoft may specify from time to time): (1) the Azure Security Center for Microsoft Azure Core Services, (2) [email protected] for other Azure or U.S. Government online services in scope for this BAA, and (3) the Message Center in the Admin Center for other Microsoft Online Services.
Contact information (a) for Microsoft Azure Core Services must include the security contact information required on the Azure Security Center, (b) for other Azure or U.S. Government online services in scope for this BAA must include name of individual(s) to be contacted, title of individual(s) to be contacted, e-mail address of individual(s) to be contacted, name of Customer organization, and, if available, Customer’s contract number, subscriber identification number, and Microsoft Online Direct Routing Domain (MODRD) (e.g. “contoso.onmicrosoft.com”), and (c) for other Microsoft Online Services must include information required for the Message Center Privacy reader role in the Admin Center. Customer shall ensure that such contact information remains up to date during the term of this BAA. Failure to submit and maintain as current the aforementioned contact information may delay Microsoft’s ability to provide Breach notification under this BAA.
(iii) Safeguards and Appropriate Use of Protected Health Information.
Customer is responsible for implementing appropriate privacy and security safeguards to protect its Protected Health Information in compliance with HIPAA. Without limitation, it is Customer’s obligation to:
1) Not include Protected Health Information in: (1) information Customer submits to technical support personnel through a technical support request or to community support forums; and (2) Customer’s address book or Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
directory information. In addition, Microsoft does not act as, or have the obligations of, a Business Associate under HIPAA with respect to Customer Data or FastTrack Data once it is sent to or from Customer outside Microsoft Online Services or FastTrack Services over the public Internet, or if Customer fails to follow applicable instructions regarding physical media transported by a common carrier.
2) Implement privacy and security safeguards in the systems, applications, and software Customer controls, configures, and uploads into the Microsoft Online Services or uses in connection with the FastTrack Services.
4. Applicability of BAA.
This BAA is applicable to Microsoft Online Services and FastTrack Services. Microsoft may, from time to time, (a) include additional Microsoft online services on the Microsoft Trust Center and/or in the “Data Protection Terms” section of the Online Services Terms incorporated into the Agreement or additional FastTrack Services on the FastTrack Center BAA site, and (b) update the definition of Microsoft Online Services and FastTrack Services in this BAA accordingly, and such updated definitions will apply to Customer without additional action by Customer. It is Customer’s obligation to not store or process in an online service, or provide to Microsoft for performance of a professional service, protected health information (as that term is defined in 45 CFR § 160.103 of HIPAA) until this BAA is effective as to the applicable service.
5. Term and Termination.
a. Term. This BAA shall continue in effect until the earlier of (1) termination by a Party for breach as set forth in Section 5b, below, or (2) expiration of Customer’s Agreement.
b. Termination for Breach. Upon written notice, either Party immediately may terminate the Agreement and this BAA if the other Party is in material breach or default of any obligation in this BAA. Either party may provide the other a thirty (30) calendar day period to cure a material breach or default within such written notice.
c. Return, Destruction, or Retention of Protected Health Information Upon Termination. Upon expiration or termination of this BAA, Microsoft shall return or destroy all Protected Health Information in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If it is not feasible to return or destroy any portions of the Protected Health Information upon termination of this BAA, then Microsoft shall extend the protections of this BAA, without limitation, to such Protected Health Information and limit any further Use or Disclosure of the Protected Health Information to those purposes that make the return or destruction infeasible for the duration of the retention of the Protected Health Information.
6. Miscellaneous.
a. Interpretation. The Parties intend that this BAA be interpreted consistently with their intent to comply with HIPAA and other applicable federal and state law. Except where this BAA conflicts with the Agreement, all other terms and conditions of the Attachment 1
STATE OF CALIFORNIA SHI INTERNATIONAL CORP.
DEPARTMENT OF TECHNOLOGY PO 25-0198737/ SC 25-0198737
Agreement remain unchanged. Any captions or headings in this BAA are for the convenience of the Parties and shall not affect the interpretation of this BAA. b. BAAs; Waiver. This BAA may not be modified or amended except in a writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, as a bar to, or as a waiver of any right or remedy as to subsequent events.
c. No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything in this BAA confer, upon any person other than the Parties, and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.
d. Severability. In the event that any provision of this BAA is found to be invalid or unenforceable, the remainder of this BAA shall not be affected thereby, but rather the remainder of this BAA shall be enforced to the greatest extent permitted by law. e. No Agency Relationship. It is not intended that an agency relationship (as defined under the Federal common law of agency) be established hereby expressly or by implication between Customer and Microsoft under HIPAA or the Privacy Rule, Security Rule, or Breach Notification Rule. No terms or conditions contained in this BAA shall be construed to make or render Microsoft an agent of Customer.
Attachment 1
Attachment 1