HomeMy WebLinkAboutDSHS Agreement 1863-31751STATE OF WASHINGTON
DEPARTMENT OF SOCIAL AND HEALTH SERVICES
REHABILITATION ADMINISTRATION
1115 Washington Street• PO Box 45720 • O~vmpia, WA 98504
Kittitas County Sheriff's Office
ATTN: Paula Hector
205 W 5th Ave, Suite 1 Jail
Ellensburg, WA 98926
(360) 902-8499 • FAX (360) 902-8108
July 20, 2018
RE: Department of Social and Health Services
Contract Number 1863-31751
Dear Paula Hector,
Enclosed is a fully executed copy of the above-referenced contract between Kittitas County and the
Department of Social and Health Services, Juvenile Rehabilitation.
If you have any questions regarding this contract, please feel free to call me at (360) 902-8087 or via e-
mail at hontadr@dshs.wa .gov.
Sincerely,
Del Hontanosas
Grants and Contracts Manager
Enclosures
RECEIVED
JUL 2 4 2018
KITTITAS COUNTY SHERIFF
ACCOUNTING
COUNTY DSHS Agreement Number --~" PROGRAM AGREEMENT 1863-31751 EP'AR: OF
01\L&.HMLTH
SER.VICES Jail Services 18 years and older
This Program Agreement is by and between the State of Washington Administration or Division
Department of Social and Health Services (DSHS) and the County identified Agreement Number
below, and is issued in conjunction with a County and DSHS Agreement On County Agreement Number General Terms and Conditions, which is incorporated by reference.
DSHS ADMINISTRATION DSHS DIVISION DSHS INDEX NUMBER DSHS CONTRACT CODE
Rehabilitation Administration Division of Community 1225 S000CC-63
ProQrams
DSHS CONTACT NAME AND TITLE DSHS CONTACT ADDRESS
Barbara Kraemer 082
FAS PO Box45720
Olympia, WA 98504
DSHS CONTACT TELEPHONE I DSHS CONTACT FAX I DSHS CONTACT E-MAIL
(360)902-0765 {360)902-8108 kraembj@dshs.wa.gov
COUNTY NAME COUNTY ADDRESS
Kittitas County 205 W 5th Ave Ste1 Jail
Kittitas Co. Sheriffs Office Ellensbura. WA 98926
COUNTY FEDERAL EMPLOYER IDENTIFICATION COUNTY CONTACT NAME
NUMBER
Paula Hoctor
COUNTY CONTACT TELEPHONE I COUNTY CONTACT FAX I COUNTY CONTACT E-MAIL
{509) 962-7617 {509) 962-7037 paula.hoctor@co.kittitas.wa.us
IS THE COUNTY A SUBRECIPIENT FOR PURPOSES OF THIS PROGRAM CFDA NUMBERS
AGREEMENT?
No
PROGRAM AGREEMENT START DATE I PROGRAM AGREEMENT END DATE MAXIMUM PROGRAM AGREEMENT AMOUNT
07/01/2018 06/30/2019 $20,000.00
EXHIBITS. When the box below is marked with an X, the following Exhibits are attached and are incorporated into this
County Program Agreement by reference:
~ Exhibits (specify): Exhibit A-Data Security Requirements and Exhibit B Statement of Work
The terms and conditions of this Contract are an integration and representation of the final, entire a:nd exclusive
understanding between the parties superseding and merging all previous agreements, writings, and communications , oral
or otherwise, regarding the subject matter of this Contract. The parties signing below represent that they have read and
understand this Contract, and have the authority to execute this Contract. This Contract shall be binding on DSHS only
upon signature bv DSHS .
COUNTY SIGNATURE(S)
~})~
DSHS SIGNATURE
~J D~ -'--
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011)
PRINTED NAME(S) AND 11TLE(S) DATE(S) SIGNED
Gev, c:...-01\-{'I A-, Stte-,..,i-,c~ h/ 2.,~/21J/f'
PRINTED NAME AND TITLE DATE SIGNED
Del R. Hontanosas '?(r/tq; Grants and Contract Manager
RECEIVED
KITTITAS COUNTY SHERIFF
ACCOUNTING
Page 1
Special Terms and Conditions
DATED this .J,n{day of+-U+lt ... U-~....._ ___ , 2018.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011)
BOARD OF COUNTY COMMISSIONERS
KITTITAS COUNTY, WASHINGTON
:::-:,.,, t
8a1:1Hitetwet, 1ssioner
L~GS-==--·---
f
Page 2
Special Terms and Conditions
1 . Definitions. The words and phrases listed below, as used in this Contract, shall each have the
following definitions:
a. JR means Juvenile Rehabilitation within the Rehabilitation Administration.
b. JR Bulletins/Policies means the JR Administrative Policies, which direct JR expectations.
c. "Limited Access" means supervised access to a juvenile(s) that is the result of the person's
regularly scheduled activities or work duties.
d. "Regular Access" means unsupervised access to a juvenile(s), for more than a nominal amount of
time, that is the result of the person's regularly scheduled activities or work duties.
2. Purpose. The purpose of this Contract is for the Sheriff of the Kittitas County Corrections Center to
provide detention services at the Kittitas County Corrections Center, for Juvenile Rehabilitation (JR)
youth eighteen {18) years old or older committed to Juvenile Rehabilitation that are accepted for
admittance at the direction of JR.
3. Statement of Work. The Contractor shall provide the services and staff, and otherwise do all things
necessary for or incidental to the performance of work, as set forth in Exhibit B: Statement of Work-
Jail Services for 18 year and older committed to JR.
4. Consideration. Total consideration payable to Contractor for satisfactory performance of the work
under this Contract is up to a maximum of $20,000, including any and all expenses, and shall be based
upon the Exhibit A State of Work -Jail Services 18 years and older committed to JR.
5. Background Checks and Sexual Misconduct.
a. Background Check/Criminal History-In accordance with Chapters 388-700 WAC {JR-Practices &
Procedures), 72.05 RCW {Children & Youth Services) 43.20A RCW (DSHS) and by the terms of
this contract, Contractor and each of its employees, subcontracto rs, and/or volunteers who may or
will have regular access to any client/juvenile must be cleared through a JR approved criminal
history and background check. In addition, Contractor, each of their employees, subcontractors,
and/or volunteers, who may or will have limited access to any client/juvenile, may be required to be
cleared through a JR approved criminal history and background check.
By execution of this contract, Contractor affirms that Contractor, each of its employees,
subcontractors, and/or volunteers, who may or will have regular access have not been convicted of
any of the following:
(1) Any felony sex offense as defined in 9.94A.030 RCW (Sentencing Reform Act-Definitions) and
9A.44.130 RCW (Sex Offenses);
(2) Any crime specified in Chapter 9A.44 RCW (Sex Offenses) when the victim was a juvenile in
the custody of or under the jurisdiction of JR; or
(3) Any violent offense as defined in 9.94A.030 RCW (Sentencing Reform Act-Definitions).
Contractor must require that current employees, volunteers, and contracted service providers who
are authorized for regular access to a juvenile( s) report any guilty plea or conviction of any of the
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 3
Special Terms and Conditions
above offenses. The report must be made to the person's supervisor within seven (7) days of
conviction and any person who have reported a guilty plea or conviction for one or more of these
offenses must not have regular access to any offender. Contractor shall also document
background checks/criminal history clearances for monitoring purposes.
b. Sexual Misconduct -13.40.570 RCW (Sexual miscon duct by state empl oyees , contracto rs) states
that when the Secretary has reasonable cause to beli eve tha t sexu al intercourse or sexu al contact
between the employee of a contractor and an offender has occurred, the Secretary shall require
the employee of a contractor to be immediately removed from any employment position which
would permit the employee to have any access to any offender.
By execution of this contract, contr actor affirms that contractor, each of its employees,
subcontractors, and/or volunteers are knowledgeable about the requirements of 13.40.570 RCW
(Sexual misconduct by state employees, contractors) and of the crimes included in 9A.44 RCW
(Sex Offenses).
In addition, the Secretary shall disqualify for employment with a contractor in any position with
access to an offender, any person:
(1) Who is found by the department, based on a preponderance of the evidence, to have had
sexual intercourse or sexual contact with the offender: or
(2) Convicted of any crime specified in chapter 9A.44 RCW (Sex Offenses) when the victim was an
offender
If any actions are taken under 13.40.570 RCW, subsections (3) or (4), the Contractor must
demonstrate to the Secretary they have greatly redu ced the likel ihood that any of its employees,
volunteers, or subcontractors could have sexual intercourse or sexual contact wi th any offender.
The contract shall not be renewed unless the Secretary determines significant progress has been
made.
6 . Compliance with DSHS and JR Policies and Standards.
a. In addition to the governing Federal and State laws and regulations, the Contractor shall comply
with all applicable DSHS and RA Bulleti ns/Policies .
b. In case of conflict or inconsistency between the aforementioned, the higher standard of compliance
shall prevail.
c. Records created or obtained during a youth's stay and/or maintained as a part of the youth's case
files are JR juvenile records, and subject to the same confidentiality guidelines establ ished in
statute, to include but not be limited to, RCW13.40. DSHS shall have access to all records related
to a JR youth upon request.
7 . Federal Prison Rape Elimination Act.
In accordance with the Federal Prison Rape Elimination Act (PREA) of 2003, 28 CFR Part 115,
http://www.ojp.usdoj .gov/proqrams/pdfs/prea final rule .pdf
Subpart A, the Contractor sha ll :
a. Adopt and be in compliance with the PREA standards for preventing, detecti ng and responding to
sexual misconduct in adult prisons and jail.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011 ) Page4
Special Terms and Conditions
b. Provide the RA contract monitoring to ensure that the contractor is in compliance with the PREA
standards.
8. Billing and Payment.
a. The contracted activities shall be paid up to the amount specified for the deliverables identified in
the Statement of Work and payment shall be made upon receipt of the deliverable. JR shall not
make payment for any deliverable not completed in accordance to the specifications identified in
this contract.
a. DSHS shall pay the Contractor upon acceptance by DSHS of a properly completed A-19 Invoice
Voucher. The invoice shall describe and document the following:
(1) Date and time period of service(s) performed;
\
(2) Name or other client identifier; and
(3) Description of work performed
b. Payment shall be considered timely if made by DSHS within 30 days after the receipt of the
properly completed invoice.
c. Payment shall be sent to the Contractor's address at:
Kittitas County Sheriff's Office
307 W Umptanum Road
Ellensburg, WA 98926
d. The Contractor accepts the DSHS payment as the sole and complete payment for the services
provided under this contract.
e. DSHS shall not reimburse the Contractor for authorized services not provided to clients, or for
services provided which are not authorized or are not provided in accordance with paragraph 2,
"St~tement of Work." If DSHS pays the Contractor for services authorized but not provided by the
Contractor in accordance with this Contract's ~statement of Work," the amount paid shall be
considered to be an overpayment.
f. If this Contract is terminated for any reason, DSHS shall pay for only those services authorized and
provided through the date of termination.
9. Disputes. Either the Contractor or JR may initiate a dispute claim for consideration by the other party,
as it relates to the terms of this Contract, or to the services provided by the Contractor under the terms
of this Contract. In accordance with the JR dispute resolution process, attempts to resolve disputes
shall initially be addressed and be resolved at the lowest level possible between the Contractor and the
JR organization, which initiated the contract. Upon verbal or written request from the Contractor, JR
shall provide the Contractor a copy of the JR dispute resolution process within 5 working days of the
request.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 5
Special Terms and Conditions
Exhibit A-Data Security Requirements
1. Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following
definitions:
a. ''AES " means the Advanced Encryption Standard , a specification of Federal Information Processing
Standards Publications for the encryption of electronic data issued by th e National Institute of
Standards and Technology (http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf).
b. "Authorized Users(s)" means an individual or individuals with a business need to access DSHS
Confidential Information, and who has or have been authorized to do so.
c. "Business Associate Agreement" means an agreement between DSHS and a contractor who is
receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability
and Accountability Act of 1996. The agreement establishes permitted and required uses and
disclosures of protected health information (PHI) in accordance with HIPAA requirements and
provides obligations for business associates to safeguard the information.
d. "Category 4 Data" is data that is confidential and requires special handling due to statutes or
regulations that require especially strict protection of the data and from which especially serious
consequences may aris~ in the event of any compromise of such data. Data classified as Category
4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability
Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and
Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights
and Privacy Act (FERPA), 20 U.S.C. §12329; 34 CFR Part 99; Internal Revenue Service
Publication 1075 (https://www.irs.gov/pub/irs-pdf/p1075.pdf); Substance Abuse and Mental Health
Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records,
42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20.
e. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a
network outside the control of the Contractor. Physical storage of data in the cloud typically spans
multiple servers and often multiple locations. Cloud storage can be divided between consumer
grade storage for personal files and enterprise grade for companies and governmental entities.
Examples of consumer grade storage would include iTunes, Dropbox, Box.com, and many other
entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and
Rackspace.
f. "Encrypt" means to encode Confidential Information into a format that can only be read by those
possessing a "key"; a password, digital certificate or other mechanism available only to authorized
users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for
asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must
be used if available.
g. "FedRAMP" means the Federal Risk and Authorization Management Program (see
www.fedramp.gov), which is an assessment and authorization process that federal government
agencies have been directed to use to ensure security is in place when accessing Cloud computing
products and services.
h. "Hardened Password" means a string of at least eight characters containing at least three of the
following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and
special characters such as an asterisk, ampersand, or exclamation point.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 6
Special Terms and Conditions
i. "Mobile Device" means a computing device, typ ically smaller than a notebook , which r uns a m0bile
operating syste m, such as 1OS, And roid , or Win dows Phone . Mobile Devices include smart'phones ,
most tablets , and other form factors.
j. "Multi-factor Authentication" means controlling access to computers and other IT resources by
requiring two or more pieces of evidence that the user is who they claim to be . These pieces of
evidence consist of something the user knows , such as a password or PIN; something the user has
such as a key card, smart card, or physical token; and something the user is, a biometric identifier
such as a fingerprint, facial scan, or retina l scan. "PIN" means a personal identificati on number, a
series of numbers which act as a password for a device. Since PINs are typically only four to six
characters, PINs are usually used in conjunction with another factor of authentication, such as a
fingerprint.
k. "Portable Device" means any computing device with a small form factor, desi gned to be transported
fr0m place t0 place. Portable devices are primarily b~ttery powered devices with base computing
resources in the form of a processor, memory, storage, and network access. Ex amples include, but
are not limited to , mobi le phones, tablets, arid laptops. Mobile Device is a subset of Portable
Device.
I. "Portable Media" means any machine readable media that may routinely be stored or moved
independently of computing devices. Examples include magnetic tapes, optical discs (CDs or
DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that
have been removed from a computing device.
m. "Secure Area " means an area to which only authorized representatives of the entity possessin g the
Confidential l hformatlon have access, and access is controlled throu·gh use of a key, card key,
combination lock, or comparable mechanism. Secure Areas may Include buildings, rooms or
locked storage containers (such as a filing cabi net or desk drawer) within a room, as long as
acces s to the Confid ential Informati on is not available to unauthorized personnel. In otherwise
Secure Areas, such as an offite wit h restri cted access , the Data must be secured in such a way as
to pre vent access by non -authorized staff such as ja nitorial or fa cility security staff, when
autho rized Contracto r staff are not present to ensure that non-authorized staff cannot access it.
n. "Trusted Network" means a network operated and maintained by the Contractor, which includes
security controls sufficient to protect DSHS Data on that network. Controls would include a firewall
between any other networks, access control lists on networking devices such as routers and
switches, and other such mechanisms wh ich protect the confidentiality, integrity, and availabil ity of
the Data .
o. "Unique User ID" means a string of cha racters that identifies a specific user and which, in
co njunction with a password, passphrase or other mechanism , authenticates a user to an
information system.
2 . Authority. The security requirements described in this document reflect the applicable requ irements
of Standard 141 .10 (https://ocio:wa .gov/policies ) of the Office of the Chief Information Officer for the
state of Washington , and of the DSHS Information Security Policy and Standards Manual. Reference
material related to these r equirements can be found here: https://www.dsbs.wa .gov/fsa/central-
contract-services/keeplng -dshs-client-information-private-and-se.cure, wh ich is a site developed by the
DSHS Information Security Office and hosted by DSHS Central Contracts and Leg-al Services .
3. Administrative Controls. The Contractor must have the following controls in place :
a. A documented securi ty policy governing the secure use of its computer network and systems, and
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011 ) Pa ge 7
Special Terms and Conditions
which defines sanctions that may be applied to Contractor staff for violating that policy.
b . If the Data shared under this agreement is classified as Category 4, the Contractor must be aware
of and compliant with the applicable legal or regulatory requirements for that Category 4 Data.
c. If Confidential Information shared under this agreemen t is classified as Category 4, the Contractor
must have a documented risk assessment for the system(s) housing the Category 4 Data.
4. Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to
authorized staff, the Contractor must:
a. Have documented policies and procedures governing access to systems with the shared Data.
b . Restrict access through administrative, physical, and technical controls to authorized staff.
c. Ensure that user accounts are unique and that any gi ven user account logon ID and password
combination is known only to the one employee to whom that account is ass ign ed. For purpose.s of
non-repudiation, it must always be possible to dete rm in e which emp loyee pe rformed a given action
on a system housing the Data based solely on the log'on ID use d to perform the acti on.
d. Ensure that only authorized users are capable of accessing the Data.
e. Ensure that an employee's access to the Data is removed immediately:
(1) Upon suspected compromise of the user credentials.
(2) When their employment, or the contract under which the Data is made available to them, is
terminated.
(3) When they no longer need access to the Data to fulfill the requirements of the contract.
f. Ha ve a process to periodi cally review and verify that only authorized users have access to systems
co nta ining DSHS C on fi de ntial Information.
g . When accessing the Data from within the Contractor's network (the Data stays within the
Contractor's network at all times), enforce password and logon requirements for users within the
Contractor's network, including:
(1) A minimum length of 8 characters, and containing at least three of the following character
classes: uppercase letters, lowercase letters, numerals, and special characters such as an
asterisk, ampersand, or exclamation point.
(2) That a password does not contain a user's name, logon ID, or any form of their full name.
(3) That a password does not consist of a single dictionary word. A password may be formed as a
passphrase which consists of multiple dictionary words.
(4) That passwords are significantly different from the previous four passwords. Passwords that
increment by simply adding a number are not considered significantly different.
h. When accessing Confidential Information from an external location (the Data will traverse the
Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce password
and logon requirements for users by employing measures including:
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 8
Special Terms and Conditions
(1) Ensuring mitigations applied to the system don't allow end-user modification.
(2) Not allowing the use of dial-up connections.
(3) Using industry standard protocols and solutions for remote access. Examples would include
RADIUS and Citrix.
(4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a
component within the Trusted Network. The traffic must be encrypted at all times while
traversing any network, including the Internet, which is not a Trusted Network.
(5) Ensu ring that th e re m ote access system prompts for re-authentication or performs automated
sessi on termina tion after no more t hem 30 minutes of inactivity.
(6) Ensuring use of Multi-factor Authentication to connect from the external end point to the internal
end point.
i. Passwords or PIN codes may meet a lesser standard if used in conjunction with another
authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token
(software, hardware, smart card, etc.) in that case:
{1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at
least one other authentication factor
(2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be
acceptable)
(3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be
acceptable)
j. If t he contract specifically all ows for the storage of Confidential Information on a Mobile Device,
passcod es used on the device m ust:
{1) Be a minimum of six alphanumeric characters.
(2) Contain at least three unique character classes (upper case, lower case, letter, number).
(3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or
abed 12 would not be acceptable.
k. Render the device unusable after a maximum of 10 failed logon attempts.
5. Protection of Data. The Contractor agrees to store Data on one or more of the following media and
protect the Data as described:
a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be
restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID
and Hardened Password or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards.
b. Network server disks. For Data stored on hard disks mounted on network servers and made
available through s hared fo lders·, acc~s s to the Data w ill be restricted to Au thorized Users through
the use of access co ntrol lists w hich will g ra nt access o nly after t he Autho rized User has
aL1thenticc:1ted to the network us.In g a Unique Use r ID and Hardened Password or other
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 9
Special Terms and Conditions
authentication mechanisms which provide equa l or greater se c urity, such as biometrics or smart
cards. Data on disks mounted to such servers must be located in an area which is accessible only
to auth orized perso nnel ,_w ith access controlled through use of a key, card key, combinatl on lock, or
compa rabl e mecha nism.
For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as
long as the disks remain in a Secure Area and otherwise meet the requirements listed in the above
para graph. Destruction of the Data, as outli ned below in Section 8 Data Dispos ition , may be
defe rred until the disks are ret ired, replaced , or otherwise taken out of the Secu re A rea.
c. Optical discs (CDs or DVDs) in local workstation optical disc d rives. Data provided by DSHS
on optical discs which will be used in local workstation o ptica l disc d rives and wh ich will not be
tran sported out of a Secu re Area. When not in use for the contracted purpose, such discs must be
Stored in a Secure Area. Workstations which access DSHS Data on optical discs must be located
in an area which is accessible only to authorize d pers onnel, with access controlled through use of a
key, card key, combination lock, or comparable mechanism.
d. Optical d iscs (CDs o r DVDs) in drives or jukeboxes attached to servers. Data provided by
DSHS on optical discs which w ill be attac he d to network servers and which will not be transported
out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through
the use of access control lists which wm grant access only after the Authorized User has
authenticated to the network using a Unique User ID and Hardened Password or other
authentication mechanisms which provide equal or greater security, such as biometrics or smart
cards. Data on discs attached to such servers m ust be located in an area which is accessible only
to auth orized personnel, with access controlled through use of a key, card key, combi nation lock, or
compa rabl e mechanism.
e . Paper documents. Any paper records must be protected by stori ng the records in a Secure Area
which is on ly accessible to authorized personnel. When not in use, such records must be stored in
a Secure A rea .
f . Remote Acces s. Access to and use of the Data over the State Go vernmen tal Network (SGN) or
Secure Access Was hingto n (SAW) will be controlled by DSHS staff who w ill issue authentication
credentials (e .g. a Unique Us er ID and Hardened Password) to Authorized Users on Contractor's
staff. Contractor will notify DSHS staff i mmediately whe n~ve r an Authorized User in possess ion of
such crede ntials is terminated ot otherwise leaves the e mplo y of the Cont ractor, and whenever an
Authorized User's duties change such that the A uthorized User no longer requires access to
perform work for this Contract.
g. Data storage on portable devices or media.
(1) Except where otherwise specified herein, DSHS Data shall not be stored by the Contractor on
portab le d evices or m edia unless specifica lly authorized with in t he terms and conditions of the
Contra ct. If so authorize.d, the Data shall be given the followi ng protectio ns:
(a) Encrypt the Data .
(b) Control access to devi ces with a Un ique User ID and Hardened Password or stronger
authe ntication me thod such as a ph ysical token Qr bi ometrics .
(c) Manually lock devices whenever they are left unattended and set devices to lock
aut0matica lly after a period of inactivity, if this feature is available . Maximum period of
inactivity is 20 min utes.
DSHS Cen tral Contract Services
5048CF County Program Agre ement (11-22-2011) Page 10
Special Terms and Conditions
(d) Apply administrative and physical security controls to Portable Devices and Portable Media
by:
i. Keeping them in a Secure Area when not in use,
ii. Using check-in/check-out procedures when they are shared, and
iii. Taking frequent inventories.
(2) When being transported outside of a Secure Area, Portable Devices and Portable Media with
DSHS Confidential Information must be under the physical control of Contractor staff with
authorization to access the Data, even if the Data is encrypted.
h. Data stored for backup purposes.
(1) DSHS Confidential Information may be stored on Portable Media as part of a Contractor's
existing, documenteq backup process for business continuity or disaster recovery purposes.
Such storage is authorized untU such time as that media would be reused dllrihg the course of
normal backup operations. If backup m~dia is retired while DSHS Confidential Information still
exists upon it, such media will be destroyed at that time in accordance with the disposition
requirements bel0w In Section 8 Data Disposition.
(2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media,
etc.) as part of a Contractor's existing, documented bacl<up process for business continuity or
disaster recovery purposes. If so , such media will be protected as otherwise described in this
exhibit. If this media is retired while DSHS 'Confidential Information still exists upon it, the data
will be destroyed at that time in accordance with the disposition requirements below in Section 8
Data Disposition.
i. Cloud storage. DSHS Confidential Information requires protections equal to or greater than those
specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DSHS nor
the Contractor has control of the environment in which the Data is stored. For this reason:
(1) DSHS Data will not be stored in any consumer grade Cloud solution, unless all of the following
conditions are met:
(a) Contractor has written procedures in place governing use of the Cloud storage and
Contractor attests in writing that all such procedures will be uniformly followed.
(b) The Data will be Encrypted while within the Contractor network.
(c) The Data will remain Encrypted during transmission to the Cloud.
(d) The Data will remain Encrypted at all times while residing within the Cloud storage solution.
( e) The Contractor will possess a decryption key for the Data, and the decryption key will be
possessed only by the Contractor and/or DSHS.
(f) The Data will not be downloaded to non-authorized systems, meaning systems that are not
on either the DSHS or Contractor networks.
(g) The Data will not be decrypted until downloaded onto a computer within the control of an
Authorized User and within either the DSHS or Contractor's network.
DSHS Central Contract SeNices
5048CF County Program Agreement (11-22-2011) Page 11
Special Terms and Conditions
(2) Data will not be stored on an Enterprise Cloud storage solution unless either:
(a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to
all of the requirements within this exhibit; or,
(b) The Cloud storage solution used is FedRAMP certified.
(3) If the Data includes protected health Information co vered by the Health Insurance Portab ility
and Accountablllty Act (HIPAA), the Cloud provid er must sign a Business Associate Agreement
prior to Data being stored in their Cloud solution.
6. System Protection. To prevent compromise of systems which contain DSHS Data or through which
that Data passes:
a. Systems containing DSHS Data must have all security patches or hotfixes applied within 3 months
of being made available.
b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been
applied within the required timeframes.
c. Systems containing DSHS Data shall have an Anti-Malware application, if available, installed.
d. Anti-Malware software shall be kept up to date. The prod uct, its anti-virus engine, and any malware
database the system uses, will be no more than one update behind curren t.
7. Data Segregation.
a. DSHS Data must be segregated or otherwise distinguishable from non-DSHS data. This is to
ensure that when no longer needed by the Contractor, all DSHS Data can be identified for return or
destruction. It also aids in determining whether DSHS Data has or may have been compromised in
the event of a security breach. As such, one or more of the following methods will be used for data
segregation.
(1) DSHS Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no
non-DSHS Data. And/or,
(2) DSHS Data will be stored in a logical container on electronic media, such as a partition or folder
dedicated to DSHS Data. And/or,
(3) DSHS Data will be stored in a database which will contain no non-DSHS data. And/or,
(4) DSHS Data will be stored within a database and will be distinguishable from non-DSHS data by
the value of a specific field or fields within database records.
(5) When stored as physical paper documents, DSHS Data will be physically segregated from non-
DSHS data in a drawer, folder, or other container.
b. When it is not feasib le or practical to seg regate DSHS Data from non-DSHS data, t hen both the
DSHS Data and the non-DSHS data with whi~h it is commingled must be protecte d as described in
this exhibit.
8. Data Disposition. When the contracted work has been complet ed or when the Data i's no longer
needed, except as noted above in Section 5.b, Data shall be returned to DSHS or destroyed . Media on
which Data may be stored and associated acceptable methods of destruction are c;1s follows :
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 12
Special Terms and Conditions
Data stored on: Will be destroyed by :
Server or workstation hard disks, or Using a "wipe" utility which will overwrite the Data at
least three (3) times using either random or single
Removable media (e.g. floppies, USB flash drives, character data, or
portable hard disks) excluding optical discs
Degaussing sufficiently to ensure that the Data
cannot be reconstructed, or
Physica ll y destroyi nQ the dis k
Paper documents with sensitive or Confidential Recycling through a contracted firm, provided the
Information contract with the recycler assures that the
confidentiality of Data will be protected.
Paper documents containing Confidential Information On-site s hredd ing, pulping, or incineration
requiring special handling (e.g. protected health
information)
Optical discs (e.g. CDs or DVDs) Incineration, shredding, or completely defacing the
readable surface with a coarse abrasive
Mag netic ta pe Deg aussi ng, incinerating or cros scut s hredding
9 . Notification of Compromise or Potential Compromise. The compromise or potential compromise
of DSHS s hared Dat a must be reported to the DSHS Co ntact designated In the Contract w ithin one (1)
business d ay of discovery. If no DSHS Contact is designated in t he Contract, then the notifi cation
must be reported to the DSHS Privacy Officer at dshsprivacyofficer@dshs.wa.gov. Contractor must
also take actions to mitigate the risk of loss and comply with any notification or other requirements
imposed by law or DSHS.
10 . Data shared with Subcontractors. If DSHS Data provided under this Contract is to be shared with a
subcontractor, the Contract with the subcontractor must include all of the data security provisions within
this Contract and within any amendments, attachments, or exhibits within this Contract. If the
Contractor cannot protect the Data as articulated within this Contract, then the contract with the sub-
Contractor must be submitted to the DSHS Contact specified for this contract for review and approval.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 13
Special Terms and Conditions
Exhibit B
STATEMENT OF WORK
JAIL SERVICES FOR YOUTH 18 YEARS and OLDER COMMITTED TO THE JR
1. Services Provided.
a. The purpose of this Statement of Work is for the Sheriff of the Kittitas County to provide
detention services at the Kittitas County Corrections Center, for Ju venil e Rehabilitation (JR)
youth eighteen (18) years old or older that are accepted for admittance at the direction of the
JR.
b. Dete nti on Services shall include custody, supervision, and routine care for all JR youth eighteen
(18) years old, or older that are accepted for admittance. Such JR youth shall be housed within
the Kittitas County Corrections Center.
c. The Sheriff of the Kittitas County Corrections Center is primarily responsible for the operation of
the Kittitas County Corrections Center.
d. Any JR youth housed at the Kittitas County Corrections Center under the terms of this
agreement shall be subject to all rules and regulations governing other inmates housed in the
Kittitas County Corrections Center.
2. Kittitas County Corrections Center Responsibilities.
a. The Sheriff of the Kittitas County Corrections Center has no obligation whatsoever, at any time,
to accept JR youth.
b. Only when the Sheriff of the Ki ttitas County Corrections Center determines, at his sole
discretion, that space exists in the Kittitas County Corrections Center to house JR youth, does
he have the obligation to consider accepting RA youth.
c. Once the Sheriff of the Kittitas County Corrections Center accepts a JR youth, upon a lwo~day
notice, he may request that JR pick up such youth and reloc;at e him/her to another loc ation or
facility not under control of the Sheriff of the Kittitas County Corrections Center.
d. JR youth shall receive such medical, psychiatric and dental treatment as may be neces·sary to
safeguard their health while housed in the Kittitas County Co rrections Center, to the extent
required by applicable laws and regulations. Kittitas County shall provide or arrange for the
providing of such medical, psychiatric and dental services. Except for routine minor medical
services, JR shall pay Kittitas County Sheriff's office for any and all costs associated with the
delivery of any emergency, major medical and/or outside medical service provided to JR youth.
e. Should conditions of an unusual nature occur making it impractical or undesirable to continue to
house JR youth, the Sheriff of the Kittitas County Corrections Center may suspend or restrict
the use of the facility by giving written notice to JR.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 14
Special Terms and Conditions
f. The Sheriff of the Kittitas County Corrections Center may move the youth from the Kittitas
County Correction Center to another suitab le l0 cation for housing i n the event of an emergency
su ch as fire, earthquake, or catastroph e, or cond iti ons presenting imminent danger t o the safgty
of the youth . The Sheriff of the Kittitas Cou nty Corrections Center agrees to notify JR, prior to .
the move as circumstances permit or as so on as possible thereafter, of the location at w hich the
JR youth is being held.
g. In t he event any JR youth s hall escape from the custody of the Kittitas County Corrections
Center, the Kittitas County sha ll use all reasonab le mea ns to recapture the youth. T he escape
shall be reported immediately to JR. A ny costs incurred by Klt!itas Co unty In conju nction with
r~capt ur ing the youth shall be chargeab le to a nd borne by J R.
3. JR Responsibilities.
a. JR shall at all ti mes, exeept as may be provided to the contrary herein, be responsible for the
delivery and re taking of RA youth·.
b. JR shall be responsible for transporting youth from the Kittitas County Corrections Center to the
following:
(1) Court,
(2) Medical appointments, and
(3) Hospital stays.
c. In an emergency, Kittitas County Corrections Center staff may provide transport duties but will
be relieved as soon as possible by JR staff.
d. JR shall have access, at all times with 24-hou r noti ce an d approval, to the Kittitas County
Correctio ns Cente r for the purpose of inspecting th e faci lities and visiti ng any of its youth
co nfined therein un der the terms of this agre ement.
4. Compliance.
a. The County shall comply with a ll app licabl e Federal and State laws, pertinent WACs and
RC Ws, JR bulletlns 1 and othe r rules, regu la tions and pu bl ica tions id e nti fied throughout the
Sta tement of W o rk.
b. In case of conflict or inconsistency between the aforementioned, the higher standard of
compliance shall prevail.
c. If the County utilizes subcontractors for the provisio n of services under this cont ract, the County
must notify JR in writing and maintain suffici ent documen tation to verify that the subcont ra ctors
meet all the requirements under this contract. In no event shall the existence of a subcontract
release or reduce the liability of the County for any breach of performance. Su bcontractors
shall be th e agent of the County and agree to hold JR harmless for acts or omi ssions of the
subcontractors.
d. The County shall assist the JR to perform reviews of sites where services are delivered at
regular intervals using agreed upon forms and methods.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 15
Special Terms and Conditions
5. Billing.
a. The contracted activiti es sh all be paid up to the amount spe cified for the de liverables identified
in the Statement of W ork a nd payment shall be made upon recei pt of the deliverable . JR shall
not make payment for any deliverable not completed to RA's satisfaction.
b. The County shall be paid $6 1.H0 per billable day through termin ation of this contract. A billable
day wlll be those days that the youth spends the night in the detention facility. The County shall
provide JR with at least 30-day's h.otice of any rate changes; an d any rate change must be
modified by a written amendment signed by both parties.
c. The County shall submit an A-19 Invoice Voucher to RA each month for services provided,
detailing client names and jail detention dates /times.
d. Th e ·county shall accept th is payme nt as sole and complete remuneration for services provided
to offen ders under this con tract. Thi s does no t pre clude the County fro m seeki ng othe r funding
sources.
e. The Cou nty shall u se thes e funds to supp le ment, not supplant, the am ount of federa l, state,
and loca l funds oth erwise expend ed for th e servi ces provided under th is agreement.
f . Under no circumstances shall the County bill twice for the same service.
g. Payment shall be considered timely if made by DSHS within 30 days after the receipt of the
properly completed invoice.
h. Payment shall be sent to the Contractor's address on page one of this Contract.
i. DSHS shall not pay the Contractor for authorized services not provided to clients, or for services
provided which are not authorized or are not provided in accordance with the
"Statem ent .of Work." If DSHS pays the Contractor for servi ces authorized but not pro vided by
t he Con tractor in accordance with this Contract's "Statement of Work," the amount pai d shall be
considered to be an overpayment.
j. If this Cqntract is terminated for any reason , DSHS shall pay for only those services authorized
and provided throug h the date of termination.
6. Mailing Addresses.
All notices, billing s and corresp o nden ce among the parties to this agreement shall be sent to the
following addres_s ees at the foll owing ad dresses:
(1) Jail Commander:
(2) Sheriff:
DSHS Central Contract Services
50 48CF County Program Agreement(11-22-2011)
Paula Hoctor
Kittitas County Corrections Center
205 W 5th Avenue, Ste . 1/Jail
Ellensburg , WA 98926
Gene Dana
Kittitas County Sheriff's Office
307 W Umptanum Road
Ellensburg, WA 98926
Page 16
(3) JR:
Special Terms and Conditions
Lori Kesl
JR Region 1 Administrator
1626 West Boone Avenue
Spokane, WA 99201
Additionally, the Individuals listed hereinabove are each respectively designated to act as each
Party's representative for administering their respective obligations under the terms of this
agreement.
DSHS Central Contract Services
5048CF County Program Agreement (11-22-2011) Page 17