HomeMy WebLinkAbouti-ACT program agreementCOUNTY PROGRAM AGREEMENT
i-ACT Program Development
DCYF Agreement Number
2163-24529
y and between the State of Washington
Department of children, Youth & Families (DCYF) and the county identified
below, and is issued in conjunction with a county and DCyF Agreement on
General Terms and Conditions, which is inco
This Program Agreement is b
referencerporated b
Administration or Division
Agreement Number
County Agreement Number
DCYF ADMINISTRATION
Department of Children, Youth,
and Families
DCYF DIVISION
Children, Youth and Families
DCYF INDEX NUMBER
1225
DCYF CONTRACT CODE
2000cc-63
AND TITLE
-MAIL
Click here to enter text,
DCYF
WA
FAX DCYF
360 870-5727
wA 98504
karena.mc
DCYF
TACT TELEPHONE
1 '115 Washington St SE
DCYF CONTACT
Karena McGovern
Contract Specialist
Kittitas County
COUNTY FEDERAL IDENTIFICATI
NUMBER nc'l l'v 0
TY CONT
NAME
AX
Ellensb wA 98926
509 962-7516 T E-MAIL
katrina.mankus co.kittitas.wa.us
Katrina Mankus
NTY ADDRESS
COUNTY CO NAME
NTY CONTACT
Juvenile Court Services Department
205 West Sth Ave Suite 21'1
IS THE COUNTY A SUBRECIPICTr rOR
AGREEMENT?
No
I-URPU SES OF IHIS PROGRAM CFDA NUMBERS
Exhibits (specify): Exhibit A-Data Security Requirements; Exhibit B-Statement of WorkNo Exhibits.
PROG ENT EN M PROGRAM EMENT AMOENT S
EXHIBITS.When the box below is marked with an
County P rogram Agreement by reference
$33 261.00
X, the following Exhibits are attached and are incorporated into this
07t01t2021 06130t2023
writ a
andThe iti on thofcond Cont areract an ratio atl ndnteg on thof finalbrepresentat andntire SIVCexcluunderstandntheingrtiSUbetweepaandnpersedangmergUSaentmnpreviogreendcommngs,unicatio oralns,or theotherwise,SU atteardingreg thisof Contrbject act.The rtie S be OWpa resrgnng ththatpresent have read ndvtnderstanduthdavehthdContract,an uth orit to exe thcute isv Contra ct.Th S ontrac ct ha be bindin no DCYFs onlySUcDFre
NTY SIGNA
DCYF SI
E(S)
RE
(a"vI jvt Q.S"f-,..'4
r(5)PRINTED NAM AND
L C,A,r*{ a .<
DArE(S) SIGNED-
6-so'x1
DATE SIGNED
-Z *J,l
Department of Children, youth & Families
2017CF County program Agreement 6_24_20
Page 1
Special Terms and Conditions
1. Definitions. The words and phrases listed below, as used in this Contract, shall each have the
following definitions:
a. 'DCYF" means the Department of Children, youth, and Families.
b. 'i-ACT' means lndividual- Alternative Choice Training.
c. "Juvenile Rehabilitation" or "JR" means the Division under the Department of Children, youth, and
Families.
2. Purpose.
The purpose of this Contract is to provide for staff time to develop, train, and provide consultation to i-
ACT trainers providing the service.
3. Data Security Requirements - Exhibit A. The Contractor shall protect, segregate, and dispose ofdata from DCYF as described in Exhibit A.
4. Statement of Work - Exhibit B. The Contractor shall provide services and staff as described in theStatement of Work attached as Exhibit B.
5. Billing and Payment
a. The contracted activities shall be paid up to the amount specified for the deliverables identified inthe Statement oJ Work and payment shall be made upon receipt of the deliverable. JR shall notmake payment for any deliverable not completed in accordance to the specifications identified inthis Contract.
b' lnvoice shall be sentto the DCYF Program Contact listed in the Statement of Work.
c' DCYF shall pay the Contractor upon acceptance by DCYF of a properly completed A-1g lnvoiceVoucher' The invoice shall include any required documentation of the lervices delivered asspecified in the Statement of Work. Payment shall be sent to the Contractor's addres. on p"g" on"of this Contract.
d' Payment shall be considered timely if made by DCYF within 30 days after receipt of the propertycompleted invoice.
e' The contractor accepts the DCYF payment as the sole and complete payment for the servicesprovided under this Contract.
DCYF shall not reimburse the contractor for authorized services not provided to clients, or forservices provided which are not authorized or are not provideJ in accordance with Exhibit B:statement of work lf DCYF pays the contractor for services authorized but not provided by theContractor in accordance with this Contract's "statement orwork," the amount paid shall beconsidered to be an overpayment.
lf this contract is terminated for any reason, DCYF shall pay for only those services authorized andprovided through the date of termination.
g.
Department of Children, youth & Families
2017CF County program Agreement 6_24_20
Page 2
Special Terms and Conditions
6. Services Authorized as Needed
DCYF shall request services from the Contractor on an as-needed basis. This Contract does not
obligate DCYF to authorize services from the Contractor.
7. Payment Only for Authorized Services
DCYF shall pay the Contractor only for authorized services provided in accordance with this Contract.
lf this Contract is terminated for any reason, DCYF shall pay only for services authorized and provided
through the date of termination.
B. Funding Stipulations
a. lnformation for Federal Fundino. The Contractorshallcooperate in supplying any information to
DCYF that may be needed io determine DCYF or the client's eligibility for federatfunding.
b. Duplicate Billinq. The Contractor must not bill otherfunding sources forservices rendered under
this Contract which would result in duplicate billing to different funding sources for the same service.
Furthermore, the Contractor shall ensure that no subcontractor bills any other funding sources for
services rendered under this Contract, which would result in duplicate billing to differ6nt funding
sources for the same service.
c. No Federal Match. The Contractor shall not use funds payable under this Contract as match towardfederal funds without the prior written permission of DCyF.
d. Supplantina, The Contractor shall use these funds to supplement, not supplant the amount offederal, state and local funds othenrvise expended for services provided under this Contract.
9. Recovery of Fees for Noncompliance
ln the event the Contractor bills for services provided and is paid fees for services that DCyF later findswere either (a) 1ot delivered or (b) not delivered in accordance with applicable standards or therequirements of this Contract, DCYF shall have the right to recover the fees for those services from theContractor, and the Contractor shall fully cooperate during the recovery process.
10. Prohibition of Use of Funds for Lobbying Activities
The Contractor shall not use funds payable under the Contract for lobbying activities of any nature. TheContractor certifies that no state or federal funds payable under this Contrlct shall be paid'to anyperson or organization to influence, or attempt to influence, either direcfly or indirecly,'an officer'oremployee of any state or federal agency, or an officer or member of any state or federal legislative bodyor committee, regarding the award, amendment, modification, extension, oi t"na*al of a state orfederal contract or grant.
Any act by the Contractor in violation of this prohibition shall be grounds for termination of this Contract,at the sole discretion of DCYF, and shall subject contractor to such monetary and other penalties asmay be provided by law.
11. Gulturally Relevant Services
The contractor shall provide appropriate, accessible, and culturally relevant services to clients and theirfamilies' Service delivery shali be culturally
"orputuni and responsive to each client,s cultural beliefsand values' ethnic norms, language needs, and individual diffeiences. contractors are encouraged to
o"o,n,".lTl:?,ifflt-"rffrk-force that reflects the diversitv or tn"i, crienteie ";; il" community.
2017CF County Program Agreement 6_24-20 page 3
Special Terms and Conditions
12. Compliance Agreement
ln the event that DCYF identifies deficiencies in Contractor's performance under this Contract, DCYF
may, at its option, establish a Compliance Agreement. When presented with a Compliance Agreement,
Contractor agrees to undertake the actions specified in the plan within the timeframes given to correct
the deficiencies. Contractor's failure to do so shall be grounds for termination of this Contract.
13. Compliance with JR Policies and Standards.
a. ln addition to the governing Federal and State laws and regulations, the Contractor shall comply
with all DCYF and JR Rules and Policies as applicable to the services provided.
b. ln case of conflict or inconsistency between the aforementioned, the higher standard of compliance
shall prevail.
14. Administrative Records
The Contractor shall retain the following administrative records:
a. Fiscal records that shall substantiate costs charged to DCYF under this Contract;
b. Documentation of all audits, license reviews, contract monitoring reports, and corrective action
reports and actions taken. Documentation of all costs associated with service provided under this
Contract:
c. Recruitment policy which demonstrates that Contractor is an equal opportunity employer; and
d. Copy of the Contractor's Certificate of lnsurance and for each subcontractor.
15. Background Checks
a' This requirement applies to any employees, volunteers and subcontractors who may haveunsupervised access to children served under this contract.
b. ln accordance with chapters 388-700 wAc (JR-Practices & Procedures), 72.05 RCW (children &Youth Services), and by the terms of this Contract, Contractor and each of its employees,
subcontractors, and/or volunteers who may or will have regular access to any client/juvenile mustbe cleared through a JR approved criminal history and baCkground check. ln addition, Contractor,each of their employees, subcontractors, and/or volunteers, who may or will have limited access toany client/juvenile' may be required to be cleared through a JR approved criminal history andbackground check.
c. By execution of this Contract, Contractor affirms that Contractor, each of its employees,subcontractors, and/or volunteers, who may or will have regular access have not been convicted ofany of the following:
(1) Any felony sex offense as defined in 9.944.030 RCW (Sentencing Reform Act-Definitions) and9A.44.130 RCW (Sex Offenses);
(2) Any crime specified in chapter 9A.44 RCW (Sex offenses) when the victim was a juvenile in thecustody of or under the jurisdiction of JR; or
(3) Any violent offense as defined in 9.94A.030 RCW (sentencing Reform Act-Definitions)
Department of Children, youth & Families
2017CF County Program Agreement 6-24_20
Page 4
16
17.
Special Terms and Conditions
d. Contractor must require that current employees, volunteers, and contracted service providers who
are authorized for regular access to a juvenile(s) report any guilty pled or conviction of any of the
above offenses. The report must be made to the person's supervisor within seven (7) days of
conviction and any person who have reported a guilty plea or conviction for one or more of these
offenses must not have regular access to any offender. Contractor shall also document
background checks/crimi nal h istory clearances for mon itoring purposes.
Sexual Misconduct
a. Sexual Misconduct - 13.40.570 RCW (Sexual misconduct by state employees, contractors) states
that when the Secretary has reasonable cause to believe that sexual inteicourse or sexual contact
between the employee of a Contractor and an offender has occurred, the Secretary shall require theemployee of a Contractor to be immediately removed from any employment position which wouldpermit the employee to have any access to any offender.
b. By execution of this Contract, Contractor affirms that Contractor, each of its employees,
subcontractors, and/or volunteers are knowledgeable about the requirements oi ti.+O.SZO nCW(sexual misconduct by state employees, contractors) and of the crimes included in gA.44 RCW (sexOffenses).
c. ln addition, the Secretary shall disqualify for employment with a Contractor in any position withaccess to an offender, any person:
(1) Who is found by the department, based on a preponderance of the evidence, to have hadsexual intercourse or sexual contact with the offender; or
(2) Convicted of any crime specified in chapter 9A.44 RCW (Sex offenses) when the victim was anoffender
d. lf any actions are taken under 13.40.570 RCW, subsections (3) or (a), the Contractor mustdemonstrate to the Secretary they have greatly reduced the ljkelihool tn"t "ny of its employees,volunteers, or subcontractors could have sexual intercourse or sexual contaciwlth any offender.The Contract shall not be renewed unless the Secretary determines significant progress has beenmade.
PREA Requirements
The following Prison Rape Elimination Act (PREA) training and Criminal History Background Checkrequirements must be met if you are providing services tJyouth in a JR facility'anJ will have directunsupervised access to youth. The training iequirement only needs to be cohpleted once.
a' Participate and complete all Prison Rape Elimination Act (PREA) required trainings which shallconsist of the following:
(1) Review of JR's PREA poticy s.90, Apptying the PREA standards in JR;
(2) Review of the "JR Guide to the Prevention and Reporting sexual Misconduct,, brochure;
(3) View the National lnstitute of Corrections V ideo, Keeping Our Kids Safe: The prison Ra peElimination Act and Juvenile Justice , Parts 1 and 2 (approx. 23 minutes total ). Viewable viaYouTube link: NIC Keeping Kids Sa fe 7
the
; and
(4)
:^TS::H!"JJ,!}JF;*-EA "Volunteer/contractor Acknowtedgement compretion or rraining
Department of Children, youth & Families
2017CF County program Agreement 6-24-20
page 5
Special Terms and Conditions
b. Complete the "PREA Sexual Misconduct" Form (DCYF 20-296)
c. Provide the completed "PREA Sexual Misconduct" and "Volunteer/Contractor Acknowledgement
Completion of Training and Policy Review" forms to the JR Program Staff identified below or their
designee, for each staff having direct unsupervised contact with JR residents within JR's lnstitutions
or Community Facilities.
d. Complete a mandatory Criminal History Background Check at least every 5 years and a National
Fingerprint Criminal Records Background Check.
18. Subcontractor
lf the Contractor utilizes subcontractors for the provision of services under this Contract, the Contractor
must notify JR in writing and maintain sufficient documentation to verify that the subcontractors meet all
the requirements under this Contract, ln no event shall the existence of a subcontract release or
reduce the liability of the County for any breach of pedormance.
19. Monitoring
The County shall assist the JR to perform reviews of sites where services are delivered at regular
intervals using agreed upon forms and methods,
20. lnsurance
21.
a. DCYF certifies that it is self-insured under the State's self-insurance liability program, as provided
by RCW 4.92.130, and shall pay for losses for which it is found liable.
b. The Contractor certifies, by checking the appropriate box below, initialing to the left of the box
selected, and signing this Agreement, that:
W {rn"contractor is self-insured or insured through a risk pool and shail pay for losses
for which it is found liable; or
I fne Contractor maintains the types and amounts of insurance identified below and
shall, prior to the execution of this Agreement by DCYF, provide certificates of insurance
to that effect to the DCyF contact on page one of this Agreement.
*toincludecoVerageforbodilyinjury,property
damage, and contractual liability, with the following rhinimum limits-: Each Occurrence - $i,Oob,OOO;General Aggregate - $2,000,000. The policy shall include liability arising out of premises,
operations' independent contractors, products-completed operations, pJrsonal injury, advertisinginjury, and liabilityassumed underan insured contract. The State of Washington, DCyF, its ele|tedand appointed officials, agents, and employees shall be named as additional-insureds.
Resolution of Differences
ln the event of any differences between the parlies on matters related to the interpretation andimplementation of this Contract, the parties shall first attempt to resolve the difference informallybetween themselves at the local or regional level, by following the regional conflict resolution process.
lf the parties are unable to resolve their difference as stated above, then either party may submit arequest for dispute resotution as provided in the section Disputes below.
Department of Children, youth & Families
2017CF County Program Agreement 6-24-20
Page 6
Special Terms and Conditions
A copy of the regional conflict resolution process is available from the DCYF Contact person listed on
page 1 of this Contract.
22. Disputes
a. Either party who has a dispute concerning this Contract may submit a written request for dispute
resolution. The amount of any rate set by law, regulation, or DCYF policy is not disputable. A
party's written request for dispute resolution must include:
(1) A statement identifying the issue(s) in dispute; and
(2) Contractor's name, address and contract number.
b. The request must be mailed to the following address within thirty (30) calendar days after the party
could reasonably be expected to have knowledge of the issue, which is disputed.
c. A copy of the current DCYF's dispute resolution process is available at any time by written request.
d. Requests for dispute resolution or for a copy of the current DCYF's dispute resolution process
should be sent to:
Department of Children, Youth & Families
Attention Contracts Unit
P.O. Box 40983
Olympia, WA 98504-0983
23.
e' This dispute resolution process is the sole administrative remedy available under this Contract.
Emergency Management & Response
a' lt may be possible, that during the performance of this Contract, that DCyF or the State ofWashington could issue or declare a State of Emergency. Such an emergency could include, butnot be limited to:
(1) Pandemic;
(2) Public Health Emergency;
(3) Natural or manmade disaster; and / or
(a) Civil Unrest.
b' lf such a declaration is made, by DCYF or the state of washington, then DCyF may choose totemporarily modify the service delivery provisions of this contract. Those modifications will be timelimited and will be provided by your DcyF/JR program contact.
Department of Children, youth & Families
2017CF Counly program Agreement 6_24_20
Page 7
1
EXHIBIT A
DATA SECURITY REQUIREM ENTS
ORGANIZATION OF DATA SECURITY REQUIREMENTS
1. Definitions
2. Authority
3. Scope of Protection
4. Compliance with Laws, Rules, Regulations, and Policy5. Administrative Controls
6. Authorization, Authentication, and Access7. Protection of Data
B. Method of TransferL System Protection
10. Data Segregation
'1 1. Confidentiality Protection
12. Dala Disposition
13. Data shared with Subcontractors
14. Notification of Compromise or Potential Compromise
15. Breach of Data
'16. Public Disclosure
Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following
definitions:
a. 'AES' means the Advanced Encryption Standard, a specification of Federal lnformation processin g
standards Publications for the encryption of electronic data issued by the National lnstitute of
Standards and Technology (htto://nv ubs.nist.oov/n IPS/NIST FIP .197.odf)
b. "Authorized Users(s)" means an individual or individuals with a business need to access DCYFconfidential lnformation and who has been authorized to do so.
c' "Business Associate Agreement" means an agreement between DCYF and a contractor who isreceiving Data covered under the Privacy and Security Rules of the Health lnsurance portability
and Accountability Act of 1996. The agreement establishes permitted and required uses anddisclosures of protected health information (PHl) in accordance with HIpAA requirements andprovides obligations for business associates to safeguard the information.
d. "Category 4 Data" is data that is confidential and requires special handling due to statutes orregulations that require especially strict protection of the data and from whictr especially seriousconseq uences may arise in the event of any compromise of such data. Data classified as Category4 includes but is not limited to data protected by: the Health lnsurance Portability and Accounta[if ityAct (HIPAA), Pub' L. 104-19'1 as amended by t'he Health lnformation Tech;;tdi for Economic andClinical Health Aclof 2009 (HITECH), 45 CFR Parts 160 and 104; the Famity E?ucationat Rightsand Privacy Act (FERPA), 20 U.S.C. $12329; 34 CFR Part 99; lnternal Revenue ServicePublication 1075 (.ff!p-q,l]:t:t:ty..uL*rs-.gp:Jp^&In.:.p*d!J-pL-g]_5.p_d0; substance Abuse and Mentat HeatthServices Administration regulations on confiA;nt6n;6 oi"AiConol and Drug Abuse patient Records,42 CFR Parl'2; and/or Criminal Justice lnformation Services, 28 CFR pai ZO.
Department of Children, youth & Famijies
2017CF County Program Agreement 6-24_20
Page B
e. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a
network outside the control of the Contractor. Physical storage of data in the cloud typically spans
multiple servers and often multiple locations. Cloud storage can be divided between consumer
grade storage for personal files and enterprise grade for companies and governmental entities.
Examples of consumer grade storage would include iTunes, Dropbox, Box.com, and many other
entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace
f. "Confidential lnformation" means to encode Confidential lnformation into a format that can only be
read by those possessing a "key"; a password, digital certificate or other mechanism available only
to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or
2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard
(AES) must be used if available.
g. "Data" means DCYF's records, files, forms, information and other documents in electronic or hard
copy medium. "Data" includes, but is not limited to, Confidential lnformation, Category 4 Data,
Sensitive Personal lnformation, or Materials.
h. "Encrypt" means to encode Confidential lnformation into a format that can only be read by those
possessing a "key"; a password, digital certificate or other mechanism available only to authorized
users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2O4B bits for
asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must
be used if available.
L "FedRAMP" means the Federal Risk and Authorization Management Program (see
https://www.fedramp.gov/), which is an assessment and authorization process that federal
government agencies have been directed to use to ensure security is in place when accessing
Cloud computing products and services.
"Hardened Password" means a string of at least eight characters containing at least three of the
following four character classes: Uppercase alphabetic, lowercase atphabetic, numeral, and special
characters such as an asterisk, ampersand, or exclamation point.
"Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile
operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones,
most tablets, and other form factors.
"Multi-factor Authenticaiion" means controlling access to computers and other lT resources byrequiring two or more pieces of evidence that the user is who they claim to be. These pieces ofevidence consist of something the user knows, such as a password or PIN; something the user hassuch as a key card, slart card, or physical token; and something the ,sur ir, a biometric identifiersuch as a fingerprint, facial scan, or retinal scan. "PlN" means a personal identification number, aseries of numbers which act as a password for a device. Since PlNs are typically only four to sixcharacters, PlNs are usually used in conjunction with another factor of authenticition, such as afingerprint.
"Portable Device" means any computing device with a small form factor, designed to be transportedfrom place to place' Porlable devices are primarily battery powered devices,irith base computingresources in the form of a processor, memory, storage, and' network access. Examples include, butare not limited to, mobile phones, tablets, and laptop!. Mobile Device is a subset of portable
Device.
k.
m
Department of Children, youth & Families
2017CF County Program Agreement 6-24_20
Page g
n. "Portable Media" means any machine readable media that may routinely be stored or moved
independently of computing devices. Examples include magnetic tapes, optical discs (CDs or
DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have
been removed from a computing device.
o. "Physically Secure" means that access is restricted through physical means to authorized
individuals only.
p. "Secure Area" means an area to which only authorized representatives of the entity possessing the
Confidential lnformation have access, and access is controlled through use of a key, card key,
combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or
locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access
to the Confidential lnformation is not available to unauthorized personnel. ln otheruuise Secure
Areas, such as an office with restricted access, the Data must be secured in such a way as to
prevent access by non-authorized staff such as janitorial or facility security staff, when authorized
Contractor staff are not present to ensure that non-authorized staff cannot access it.
q. "Sensitive Personal lnformation" means personally identifying information including, but not limited
to: names, addresses, health information, GPS [Global Positioning System] coordinates, telephone
numbers, email addresses, social security numbers, driver's license numbers, or other personally
identifying information, and any financial identifiers.
r. "Staff' means the Contractor's directors, officers, employees, and agents who provide goods or
services pursuant to this Contract. "Staffl' also means Subcontractors' directors, officeri,
employees, and agents who provide goods or services on behalf of the Contractor. The term ,,Staff,
also means the Subcontractors'directors, officers, employees, and agents who provide goods or
services on behalf of the Subcontractor and Contractor.
s' Trusted Network" means a network operated and maintained by the Contractor, which includes
security controls sufficient to protect DCYF Data on that network. Controls would include a firewallbetween any other networks, access control lists on networking devices such as routers andswitches, and other such mechanisms which protect the confidlntiality, integrity, and availability ofthe Data.
t. "Unique User lD" means a string of characters that identifies a specific user and which, inconjunction with a password, passphrase or other mechanism, authenticates a user to aninformation system.
Authority' The security requirements described in this document reflect the applicable requirements ofstandard 141.10 (hltu*l:/"q"CI-?w_a*g9,yJpsXs*lps) of the office of the chief lnformaiion officer for the Stateof Washington, and of the DCYF lnformation Security Policy and Standards Manual.
2.
3
4
Scope of Protection. Applies to Confidential Information, Data, category 4 Data, sensitive personal
lnformation, and Materials related tothe subject matterotirris Contracitnat is delivered, received,used, shared, acquired, created, developed, revised, modified, or amended by DCyF, the Contractor,or Subcontractors.
compliance with Laws, Rules, Regulations, and Policies. For Confidential lnformation, Data,Category 4 Data, sensitive Personailnformation, and Materials that is delivered, received, used,shared, acquired, created, developed, revised, modified, oi amenoeo in connectlon with this Contractthe parties shall comply with the following:
Department of Children, youth & Families
2017CF County program Agreement 6_24_20
Page 10
a. All federal and state laws and regulations, as currently enacted or revised, regarding the protection,
security, and electronic interchange of Confidential lnformation, Data, Category 4 Data, Sensitive
Personal lnformation, and Materials; and
b. All federal and state laws and regulations, as currently enacted or revised, regarding the use,
disclosure, modification or loss of Confidential lnformation, Data, Category 4 Dala, Sensitive
Personal lnformation, and Materials.
5. Administrative Controls. The Contractor must have the following controls in place:
a. A documented security policy governing the secure use of its computer network, mobile devices,
portable devices, as well as, any form of paper/hard copy documents, and which defines sanctions
that may be applied to Contractor staff for violating that policy.
b. Security awareness training for all staff, presented annually, as follows:
(1). Contractor staff responsibilities under the Contractor's security policy,
(2). Contactor staff responsibilities as outlined under contract Exhibit A; and
(3). Must successfully complete the DCYF lnformation Security Awareness Training, which can be
taken on this web page: httpq:l/W-Wyv,dqvf.wA.govisitggldelault/files/pdf/Sgcuritv.:in-Contracts.pdl
6. Authorization, Authentication, and Access. ln order to ensure that access to the Data is limited to
authorized staff, the Contractor must:
a. Have documented policies and procedures that:
(1). Govern access to systems; and
(2). Govern access to paper/hard copy documents and files.
b. Restrict access through administrative, physical, and technical controls to authorized staff;
c. Ensure that user accounts are unique and that any given user account logon lD and password
combination is known only to the one staff member to whom that account is assigned. For
purposes of non-repudiation, it must always be possible to determine which stafimember
performed a given action on a system housing the Data based solely on the logon lD used to
perform the action;
d. Ensure that only authorized users are capable of accessing the Data;
e. Ensure that an employee's access to Data is removed within twenty-four (24) hours:
(1). Upon suspected compromise of the user credentials;
(2). When their employment, or the contract under which the Data is made available to them, is
terminated;
(3).When they no longer need access to the Data to fulfillthe requirements of the Contract; and
(a), when the staff member has been suspended from performing services under this Contract.
f. Have a process to review and verify, quarterly, that only authorized users have access to systems
Department of Children, Youth & Families
2017CF County Program Agreement 6-24-20 Page 11
containing Confidential lnformation, Data, Category 4 Dala, Sensitive Personal lnformation, or
Materials,
g. When accessing the Data from within the Contractor's network (the Data stays within the
Contractor's network at all times), enforce password and logon requirements for users within the
Contractor's network, including:
(1).A minimum length of eight (B) characters, and containing at least three of the following character
classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk,
ampersand, or exclamation point;
(2).That a password does not contain a user's name, logon lD, or any form of their full name;
(3).That a password does not consist of a single dictionary word. A password may be formed as a
passphrase which consists of multiple dictionary words; and
(4) That passwords are significantly different from the previous four (4) passwords. Passwords that
increment by simply adding a number are not considered significantly different.
h. When accessing Confidential lnformation, Data, Category 4Dala, Sensitive Personal lnformation,
and Materials from an external location (the Data will traverse the lnternet or othenvise travel
outside the Contractor's network), mitigate risk and enforce password and logon requirements for
users by employing measures that include:
(1). Ensuring mitigations applied to the system don't allow end-user modification;
(2). Not allowing the use of dial-up connections;
(3). Using industry standard protocols and solutions for remote access. Examples would include
RADIUS and Citrix,
(4). Encrypting all remote access traffic from the external workstation to Trusted Network or to a
component within the Trusted Network. The traffic must be encrypted at all times while
traversing any network, including the lnternet, which is not a Trusted Network;
(5). Ensuring that the remote access system prompts for re-authentication or performs automated
session termination after no more than fifteen (15) minutes of inactivity; and
(6)' Ensuring use of Multi-Factor Authentication to connect from the external end point to the internal
end point.
i' Passwords or PIN codes may meet a lesser standard if used in conjunction with another
authentication mechanism, such as a biometric (fingerprint, face reiognition, iris scan) or token(software, hardware, smart card, etc.) in that case:
(1)'The PIN or password must be at least five (5) letters or numbers when used in conjunction withat least one other authentication factor;
(2).Mustnotbecomprisedof allthesameletterornumber (11111,22222,aaaaa,wouldnotbe
acceptable); and
(3)'Must not contain a "run" of three or more consecutive numbers (1z3g8, 98743 would not beacceptable).
Department of Children, youth & Families
2017CF County Program Agreement 6-24-20
Page 12
7
j. lf the Contract specifically allows for the storage of Confidential lnformation on a Mobile Device,
passcodes used on the device must:
(1). Be a minimum of six (6) alphanumeric characters;
(2). Contain at least three unique character classes (upper case, lower case, letter, number); and
(3). Not contain more than a three consecutive character run. Passcodes consisting of (12345, or
abcd12 would not be acceptable).
k. Render the device unusable after a maximum of five (5) failed logon attempts.
Protection of Data. The Contractor agrees to store Data on one or more of the following media and
protect the Data as described:
Hard disk drives. For Data stored on localworkstation hard disks, access to the Data will be
restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User lD
and Hardened Password or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards.
Network server disks. For Data stored on hard disks mounted on network seryers and made
available through shared folders, access to the Data will be restricted to Authorized Users through
the use of access control lists which will grant access only after the Authorized User has
authenticated to the network using a Unique User lD and Hardened Password or other
authentication mechanisms which provide equal or greater security, such as biometrics or smartcards. Data on disks mounted to such servers must be located in an area which is accessible onlyto authorized personnel, with access controlled through use of a key, card key, combination lock, brcomparable mechanism.
a
b
c. Optical discs (CDs or DVDs) in localworkstation optical disc drives. Data provided by DCyFon optical discs which will be used in local workstation optical disc drives and which will noi betranspoded out of a Secure Area. When not in use for the contracted purpose, such discs must beStored in a Secure Area, Workstations which access Data on optical discs must be located in anarea which is accessible only to authorized personnel, with access controlled through use of a key,card key, combination lock, or comparable mechanism.
d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided byDCYF on optical discs which will be attached to network servers and which will not be transportedout of a Secure Area. Access to Data on these discs will be restricted to Authorized Users ifrrougfrthe use of access control lists which will grant access only after the Authorized User hasauthenticated to the network using a Unique User lD and Hardened password or otherauthentication mechanisms which provide equal or greater security, such as biometrics or smartcards' Dataondiscsattachedtosuchserversmus[belocatedinLnareawhichisaccessibleonly
to authorized personnel, with access controlled through use of a key, card key, combination lock, orcomparable mechanism.
e. Paper documents.
(1)' All paper documents must be protected by storing the records in a secure Area, with accesscontrolled through use of a key, card key, combinatio-n lock, or "orp"r"oru mechanism, uno *ni.r,is only accessible to authorized personnel.
(2)'when being transported outside of a Secure Area, paper documents must be under the physicalcontrol of contractor staff with authorization to access the Data.Department of Children, youth & Families
2017CF County Program Agreement 6-24-20 page .i3
(3). Paper documents will not be secured or stored in a motor vehicle any time a staff member is
away from the motor vehicle.
(4). Paper documents will be retained in a Secure Area, per the state of Washington records
retention req u irements.
f. Data storage on podable devices or media
('l). Except where otherwise specified herein, Data shall not be stored by the Contractor on portable
devices or media unless specifically authorized within the terms and conditions of the Contract.
lf so authorized, the Data shall be given the following protections:
(a). Encrypt the Data; and
(b). Control access to devices with a Unique User lD and Hardened Password or stronger
authentication method such as a physical token or biometrics; and
(c). Manually lock devices whenever they are left unattended and set devices to lock
automatically after a period of inactivity, if this feature is available. Maximum period of
inactivity is fifteen (15) minutes; and
(d). Apply administrative and physical security controls to Portable Devices and Portable Media
by:
i. Keeping them in a Secure Area when not in use;
ii. Using check-in/check-out procedures when they are shared; and
iii. Taking quarterly inventories.
(2).When being transported outside of a SecureArea, Portable Devices and Portable Media
with Data must be under the physical control of Contractor staff with authorization to access
the Data, even if the Data is encrypted. Portable Devices and Portable Media will not be
secured or stored within motor vehicles at any time the staff member is away from the motor
vehicle.
g. Data stored for backup purposes.
(1 ) DCYF Confidential lnformation may be stored on Portable Media as part of a Contractor's
existing, documented backup process for business continuity or disaster recovery purposes.
Such storage is authorized until such time as that media would be reused during the course of
normal backup operations. lf backup media is retired while DCYF Confidential information still
exists upon it, refer to Section j2 Dala Disposition.
(2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media,etc.) as part of a Contractor's existing, documented backup process for business continuity ordisaster recovery purposes. lf so, such media will be protected as othenvise described inifrisexhibit' lf this media is retired while DCYF Confidential lnformation still exists upon it, refertoSection 12 Data Disposition.
h' cloud storage. Data requires protections equal to or greater than those specified elsewhere withinthis exhibit. Cloud storage of Data is problematic as neither DCYF nor the Contractor has control ofthe environment in which the Data is stored. For this reason:
Department of Children, Youth & Families
2017CF County Program Agreement 6-24-20 Page 14
B.
I
(1).Data will not be stored in any consumergrade Cloud solution, unless all of thefollowing
conditions are met:
(a). Contractor has written procedures in place governing use of the Cloud storage and
Contractor attests in writing that all such procedures will be uniformly followed;
(b). The Data will be Encrypted while within the Contractor network;
(c). The Data will remain Encrypted during transmission to the Cloud;
(d).The Data will remain Encrypted at alltimes while residing within the Cloud storage solution;
(e).The Contractor will possess a decryption key for the Data, and the decryption key will be
possessed only by the Contractor and/or DCyF,
(f). The Data will not be downloaded to non-authorized systems, meaning systems that are not
on either the DCYF or Contractor networks;
(g).The Data will not be decrypted until downloaded onto a computeror porlable devise within
the control of an Authorized User and within either the DCYF or Contractor's network; and
(h).Access to the cloud storage requires Multi Factor Authentication or Two Step Authentication.
(2).Data will not be stored on an Enterprise Cloud storage solution unless either:
(a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing toall of the requirements within this exhibit; or
(b) The Cloud storage solution used is FedRAMp certified.
(3) lf the Data includes protected health information covered by the Health lnsurance portability andAccountability Act (HIPAA), the Cloud. provider must sign a Business Associate Agreement priorto Data being stored in their Cloud solution.
Method of Transfer.
a. All Data transfers to or from the Contractor shall only be made by using the secure data.wa.govportal provided by the state of Washington with login and hardened paisword security.
b. The contractor shall use an encrypted email account for ele ctronic submissions which containConfidential, and Personal lnformation , as defined in the General Terms and Conditionslnformation regarding encrypted email acco unts can be obtained at DCyF's website, located at:d /serv hitd d d
System Protection
that Data passes:
d
b
To prevent compromise of systems which contain DCyF Data or through which
Systems containing Data must have all security patches or hotfixes applied within three (3) monthsof being made available;
The contractor will have a method of ensuring that the requisite patches and hotfixes have beenapplied within the required timeframes;
c' Systems containing Data shall have an Anti-Malware application, if available, installed; andDepartment of Children, youth & Families
2017CF County Program Agreement 6-24-20
Page 15
d. Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware
database the system uses, will be no more than one update behind current.
10. Data Segregation
a. Data must be segregated or othenvise distinguishable from non-DCYF data. This is to ensure that
when no longer needed by the Contractor, all Data can be identified for return or destruction. lt also
aids in determining whether Data has or may have been compromised in the event of a security
breach. As such, one or more of the following methods will be used for data segregation.
(1). Data will be kept on media (e.9. hard disk, opticaldisc, tape, etc.)which willcontain no non-
DCYF Data; and/or;
(2). Data will be stored in a logical container on electronic media, such as a partition or folder
dedicated to Data; and/or;
(3). Data will be stored in a database which will contain no non-DCYF data; and/or;
(4). Data will be stored within a database and will be distinguishable from non-DCYF data by the
value of a specific field or fields within database records; and
(5). When stored as physical paper documents, Data will be physically segregated from non-DCYF
data in a drawer, folder, or other container.
11
b. When it is not feasible or practical to segregate Data from non-DCYF data, then both the Data and
the non-DCYF data with which it is commingled must be protected as described in this exhibit.
Confidentiality Protection. To safeguard confidentiality, and ensure that access to all Data is limited
to authorized staff, the Contractor must:
d.Ensure that the Contractor's Staff, Subcontractors, and the Subcontractors' Staff use Data solely for
the purposes of accomplishing the services set forth in this contract;
Ensure that no Data is released, disclosed, published, modified, transferred, sold, orotherwise
made known to unauthorized persons without the prior written consent of the individual named or as
othenvise authorized by law;
The Contractor shall not use, publish, transfer, sell or otherwise disclose any Confidential
lnformation of a minor except as provided by law or with the prior written consent of the minor,sparent, legal representative or guardian. lf a child is a dependent of Washington State, then prior
written consent must be obtained from DCyF; and
Require that the Contractor's Staff and Subcontractors' Staff having access to Data sign a
Statement of Confidentiality and Non-Disclosure Agreement (DCYF Form 03-3748), which can befoundatthiswebpage:M.Datashallnotbereleasediothe
Contractor's Staff person(s) or Subcontractors' StJfi person(s) until the following conditions havebeen met:
(1)' DCYF approves the Contractor's Staff person(s) or Subcontractors' Staff person(s), to work onthis Contract; and
(2).lf requested by DCYF, contractor must submit the signed original statement of confidentialityand Non-Disclosure Agreement, signed by the Staff perjon(s) or Subcontractors' Staff person(s).
Department of Children, Youth & Families
2017CF County Program Agreement 6-24-20
b.
c
d
Page 16
12.Data Disposition. Contractor is responsible to ensure that all Data, including paper and electronic
records, is retained pursuant to Washington State retention standards. Prior to the destruction of any
Data, the DCYF Contact specified for this contract, must be notified in writing and permission given in
writing to destroy any such Data. When the contracted work has been completed or when the Data is
no longer needed, Data shall be retained pursuant to the retention standards required by chapter 40.14
RCW, or returned to DCYF.
c. Once written permission to destroy Data has been granted by DCYF to the Contractor, the following
acceptable methods of destruction must be used:
Data stored on:Will be destroyed by:
Server or workstation hard disks, or
Removable media (e.9. floppies, USB flash
drives, portable hard disks) excluding optical
discs
Using a "wipe" utility which will overwrite the Data at
least three (3) times using either random or single
character data, or
Degaussing sufficiently to ensure that the Data
cannot be reconstructed, or
Physically destroying the disk
Paper documents with sensitive or
Confidential I nformation
Recycling through a contracted firm, provided the
contract with the recycler assures that the
confidential ity of Data will be protected
Paper documents containing Confidential
lnformation requiring special handling (e.g
protected health information)
On-site shredding, pulping, or incineration
Opticaldiscs (e.9. CDs or DVDs)ncineration, shredding, or completely defacing the
readable surface with a coarse abrasive
Ma netic ta Degaussing, incineratin g or crosscut shreddinq
b. lf any Data is required to be destroyed pursuantto this Section, within fifteen (15) calendardays
after completion of such destruction the Contractor shall complete and deliver to DCyF a signedcertification of Data Disposition, which can be found at this webpage:
h ttps ://www. d cyf .wa. g ov/foJms
13. Data shared with Subcontractors. lf Data provided underthis Contract is to be shared with asubcontractor, the Contract with the subcontractor must include all of the data security provisions withinthis contract and within any amendments, attachments, or exhibits within this contract. trtrecontractor cannot protect the Data as articulated within this contract, then the contract with thesubcontractor must be submitted to the DCYF Contact specified for this contract for review andapproval.
14' Notification of compromise or Potential Compromise. The compromise or potential compromise ofDCYF shared Data must be reported to the DCYF Contact designated in the Contractwithin one (1)business day of discovery. lf no DCYF Contact is designateO in tfre Contract, then the notification mustbe reported to the DCYF Privacy officer at: sleyfprjveEv-Ipjtics@d-qv-r-.rya'q.oy, contractor must also takeactions to mitigate the risk of loss and compiy ffih Snv"notiriCjiioii"Jr oirr?:r?equirements imposed bylaw or DCYF.
15' Breach of Data' ln the event of a breach by the contractor of this Exhibit and in addition to all otherDepartment of Children, youth & Famities
2017CF County Program Agreement 6-24-20 page 17
rights and remedies available to DCYF, DCYF may elect to do any of the following
a. Terminate the Contract;
b. Require that the Contractor return all Data to DCYF that was previously provided to the Contractor
by DCYF; or
c. Suspend the Contractor's access to accounts and other information.
16. Public Disclosure.
lf a third party requestor seeks information of the Contractor for DCYF Data, a copy of the
notice/request shall be emailed to DCYF by way of the DCYF Contracts and Procurement Office
email at dcvf,contra.gt*akbrgAgh@dcSl.wAg-o"._u within three calendar (3) days of third party request
b. DCYF Contracts and Procurement Office will respond to the Contractor on how to proceed with the
request within five (5) calendar days of receiving such notification.
Department of Children, youth & Families
2017CF County Program Agreement 6-24-20 Page 1B
'l
Exhibit B
STATEMENT OF WORK
lndividual - Alternative Choice Training (|-ACT)
Training and Consultation for County Juvenile Courts
Service Delivery
The Contractor shall provide to statewide |-ACT Trainers, by telephone or in-person, clinical
consultation services. Services shall include, but are not limited to:
a. Providing clinical consultation to |-ACT Trainers throughout the state;
b. Participating in and providing I-ACT Trainer training;
c. Monitoring by direct observation or video recordings of |-ACT sessions for adherence and
compliance to |-ACT program standards;
d. Reporting monitoring results to the JR Juvenile Court Program Administrator and to the statewide
WSART Quality Assurance Specialist on a monthly basis;
e. Providing assistance with individual I-ACT Trainers improvement plans; and
f. Participating in implementation and ongoing program development meetings.
Deliverables
a. Monthly Reporting
The Contractor shall provide monthly activity and monitoring summary reports to the JR JuvenileCourl Program Administrator.
b. Quarlerly / Annual Reporting
The Contractor on a quarterly basis shall provide the JR Juvenile Court Program Administrator andthe Statewide wSART Quality Assurance Specialist (OAS) a report that summarizes the followinginformation for all |-ACT Trainers served that quarter:'
(1) Number of |-ACT Trainers served;
(2) Number of |-ACT Trainers placed on lnformal lmprovement plans;
(3) Number of |-ACT Trainers who successfully completed their lnformal lmprovement plans;
(4) Number of |-ACT Trainers who did not complete or unsuccessfully completed their lnformallmprovement Plans and were referred to the WSART QAS for furiher action.
(5) Afinal annual summarywill be provided, summarizing items 1 -4 above.
2.
Department of Children, youth & Famities
2017CF County Program Agreement 6-24_20
Page 1 9
c. Outcome Reporting
The Contractor shall report to the JR Juvenile Court Program Administrator at the completion of
services to |-ACT Trainers the following information:
(1) The frequency of participation of each Juvenile Court's |-ACT Trainers participation in telephone
consultation;
(2) Any changes in the Juvenile Courts' i-ACT program.
3. Consideration
Total consideration payable to Contractor for satisfactory performance of the work under this Contract
is up to a maximum of $33,261.00 including any and all expenses, and shall be based on the following:
a. The maximum consideration payable for Fiscal Year 2022 is $16,235.00. Funds not expended in
Fiscal Year 2022 cannot be carried over to the following Fiscal Year.
b. The maximum consideration payable for Fiscal Year 2023 is $17,026.00. Funds not expended in
Fiscal Year 2023 cannot be carried overto the following Fiscal Year.
c. The Contractor shall be paid $50.27 per hour in SFy22 and $52.7g per hour in SFy23 for clinical
consultation services and payment shall be based upon the JR Juvenile Court program
Administrator receipt and approval of monthly summary report.
d. The Contractor shall only be reimbursed for travel costs pre-approved in writing by the JR Juvenile
Court Program Administrator.
4.DCYF/JR Program Contact
The Contractor shall notify the DCYF Program Contact listed below for any questions or issues relatedto services under this contract:
Cory Redman
Juvenile Court Programs Administrator
Juvenile Rehabilitation - He
360.480.1 194
-c-_q"{y,,19_dman@dsxl_,vt*q"'gp:^
Department of Children, youth & Families
2017CF County program Agreement 6_24_20
Page 20
ADOPTED this larY da yof 2021
BOARD OF COUNTY COMMISSIONERS
KITTITAS COUN ASHINGTON
atrman
o SI cz,Vice-Chairman
ABSENT
Cory Wright, Commissioner
AP D AS TO FORM
F>
Douglas R. M l, Deputy Prosecuting Attorney
h
A l\ill.l
t
n Cbrk
V6upu
of the Board- Julie Kjorsvik
ty Clerk of the Board- Mandy Buchholz
?a,3re1