Loading...
HomeMy WebLinkAboutKittitas County.2363-49714.ACT and EET Quality Assurance with Judge's SignatureDCYF Agreement Number COUNTY PROGRAM AGREEMENT F § ACT and EET Quality Assurance 2363-49714 This Program Agreement is by and between the State of Washington Administration or Division Department of Children, Youth & Families (DCYF) and the County identified Agreement Number below, and is issued in conjunction with a County and DCYF Agreement On General Terms and Conditions, which is incorporated by reference. County Agreement Number DCYF ADMINISTRATION DCYF DIVISION DCYF INDEX NUMBER DCYF CONTRACT CODE Department of Children, Youth, Children, Youth and Families 1225 2000CC-63 and Families DCYF CONTACT NAMEANDTITLE DCYF CONTACT ADDRESS Karena McGovern 1115 Washington St SE Contract Specialist Olympia, WA 98504 DCYF CONTACT TELEPHONE DCYF CONTACT FAX DCYF CONTACT E-MAIL 360 870-5727 Click here to Pnirer text. karena.mcgo\iern@dcyf.wa.gov COUNTY NAME COUNTYADDRESS Kittitas County Juvenile Court Services Department Juvenile Court Services Department 205 West 5th Ave Suite 211 Ellensbur , WA 98926 COUNTY FEDERAL EMPLOYER IDENTIFICATION COUN I YCONTACTNAME NUMBER Katrina Mankus COUNTYCONTACT TELEPHONE COUNTY CONTACT FAX COUNTY CONTACT E-MAIL (509) 962-7516 1 katrina.mankus@co.kittitas.wa.us IS THE COUNTY A SUBRECIPIENT FOR PURPOSES OF THIS PROGRAM CFDANUMBERS AGREEMENT? No PROGRAM AGREEMENT START DATE PROGRAM AGREEMENT END DATE MAXIMUM PROGRAM AGREEMENTAMOUNT 07/01/2023 1 06/30/2025 $46,401.00 EXHIBITS. When the box below is marked with an X, the following Exhibits are attached and are incorporated into this County Program Agreement by reference: Exhibits (specify): Exhibit A -Data Security Requirements; Exhibit BStatementofWork ❑ No Exhibits. The terms and conditions of this Contract are an integration and representation of the final, entire and exclusive understanding between the parties superseding and merging all previous agreements, writings, and communications, oral or otherwise, regarding the subject matter of this Contract. The parties signing below represent that they have read and understand this Contract, and have the authority to execute this Contract. This Contract shall be binding on DCYF only upon signature by DCYF. CO tGNATURES) PRINTED NAME(S)AND TITLE(S) DATE(S)SIGNED DCYF S GNATURE PRINTEDNAMEANDTITLE DATESIGNED Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 1 ADOPTED this day of 2023. BOARD OF COUNTY COMMISSIONERS KITTITAS COUNTY, WASHINGTON Cory Wright, Chairman Brett Wachsmith, Vice -Chairman Laura Osiadacz, Commissioner ATTEST: APPROVED AS TO FORM: Douglas R. Mitchell, Deputy Prosecuting Attorney ❑ Clerk of the Board- Julie Kjorsvik ❑ Deputy Clerk of the Board- Mandy Buchholz General Terms and Conditions 1. Definitions. The words and phrases listed below, as used in the Agreement, shall each have the following definitions: a. "Agreement" means this Departmentof Children Youth & Families (DCYF) County Agreement on General Terms and Conditions and any exhibits and other documents attached or incorporated by reference. Unless plainly inconsistent with context, the term "Agreement" includes and refers to all such agreements collectively. b. "CFR" means the Code of Federal Regulations. All references in this Agreement and any Program Agreement to CFR chapters or sectionsshall include any successor, amended, or replacement regulation. c. "County" means the political subdivision of the state of Washington named above performing services pursuanttothis Agreement and any Program Agreement. d. "County Representative" means an individual in the position of County Manager, County Administrator, County Executive, or other similar position which reports to the highest governing body responsible for the subject matter of the Agreement or applicable Program Agreement(s). e. DCYF Contracts Administrator" means the individual in the DCYF Contracts Department with oversight authority for the Department of Children Youth & Families statewide agency contracting procedures, or their appropriate designee. f. "DCYF Contracts Department' means the Department of Children Youth & Families statewide agency headquarters contracting office, or successor section or office. g. "DCYF Representative" meansanyDCYF employee who has been delegated contract -signing authority bythe DCYF Secretary or his/her designee. h. "Department of Children, Youth & Families" or "DCYF" means the Washington agency devoted exclusively to serve and support Washington state's youth and theirfamilies. i. "Debarment" means an action taken by a federal official to exclude a person or business entityfrom participating in transactions involving certain federal funds. j. "General Terms and Conditions" means the contractual provisions contained within this Agreement, which govern the contractual relationship between DCYF and the County, under the Program Agreements subsidiary to and incorporating therein by reference this Agreement. k. "Program Agreement" or "County Program Agreement" means a written agreement between DCYF and the County containing special terms and conditions, including a statement of work to be performed by the County and payment to be made by DCYF. This term may also refer to an agreement between DCYF and the County, which was transferred to DCYF by operation of law. I. "RCW" means the Revised Code of Washington. All references in this Agreement and any Program Agreement to RCW chapters or sections shall include any successor, amended, or replacement statute. m. "Secretary" means the individual appointed by the Governor, State of Washington, as the head of DCYF, or his/her designee. n. "Subcontract" means a separate Agreement between the County and an individual or entity ("Subcontractor') to perform all or a portion of the duties and obligations thatthe County shall perform pursuant to any Program Agreement. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 2 General Terms and Conditions o. "USC means the United States Code. All references in this Agreement and any Program Agreement to USC chapters or sections shall include any successor, amended, or replacement statute. p. "WAC' means the Washington Administrative Code. All references in this Agreement and any Program Agreement to WAC chapters or sections shall include any successor, amended, or replacement regulation. 2. Ame ndment. This Agreement, or any term or condition thereof, may be modified only by a written amendment signed by both parties. Only personnel authorized to bind each of the parties shall sign an amendment. 3. Assignment. Except as otherwise provided herein in Section 21, the County shall not assign rights or obligations derived from this Agreement or any Program Agreement to a third party without the prior, written consent of the DCYF Contracts Administrator and the written assumption of the County's obligations by the third party. 4. Billing Limitations. Unless otherwise specified in a Program Agreement, DCYF shall not pay any claims for services submitted more than twelve (12) months after the calendar month in which the services were performed. 5. Compliance with Applicable Law. At all times during the term of this Agreement and any Program Agreement, the County and DCYF shall comply with all applicable federal, state, and local laws, regulations, and rules, including but not limited to, nondiscrimination laws and regulations and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 6. County Ce rtification Regarding Ethics. By signing this Agreement, the County certifies that the County is in compliance with Chapter 42.23 RCW and shall comply with Chapter 42.23 RCW throughout the term of this Agreement and any Program Agreement. 7. Debarment Certification. The County, by signature to this Agreement, certifies that the County is not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participating in this Agreement or any Program Agreement by any federal department or agency. The County also agrees to include the above requirement in all subcontracts into which it enters. 8. Disputes. Both DCYF and the County ("Parties") agree to work in good faith to resolve all conflicts at the lowest level possible. However, if the Parties are not able to promptly and efficiently resolve, through direct informal contact, any dispute concerning the interpretation, application, or implementation of any section of the Agreement or applicable Program Agreement(s), either Party may reduce its description of the dispute in writing, and deliver it to the other Party for consideration. Once received, the assigned managers or designees of each Party will work to informally and amicably resolve the issue within five (5) business days. If the managers or designees are unable to come to a mutual ly acceptable decision within five (5) business days, they may agree to issue an extension to allowfor more time. If the dispute cannot be resolved by the managers or designees, the issue will be referred through each Agency's respective operational protocols, to the Secretaryof DCYF ("Secretary') and the County Representative or their deputy or designated delegate. Both Partieswill be responsible for submitting all relevant documentation, along with a short statement as to how they believe the dispute should be settled, to the Secretary and the County Representative. Upon receipt of the referral and relevant documentation, the Secretaryand County Representative will confer to consider the potential options for resolution, and to arrive at a decision wit hin fifteen (15) Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 3 General Terms and Conditions business days. The Secretary and County Representative may appoint a reviewteam, a facilitator, or both, to assist in the resolution of the dispute. If the Secretary and County Representative are unableto come to a mutually acceptable decision within fifteen (15) days, they may agree to issue an extension to allow for more time. Both Parties agree that, the existence of a dispute notwithstanding, the Parties will continue Wthout delay to carry out all respective responsibilities under theAgreement or applicable Program Agreement(s) that are not affected by the dispute. The final decision will be put in writing and will be signed by both the Secretary and County Representative. If the Agreement is active at the time of resolution and amendment of the Agreement is warranted for ongoing clarity, the Parties will execute an amendment to incorporate the final decision into the Agreement. If this dispute process is used, the resolution decision Wll be final and binding as to the matter reviewed and the dispute shall be settled in accordance with the terms of the decision. Notwithstanding the foregoing, each Party reserves the rightto litigate issues de novo in court. Entire Agreement. This Agreement and any Program Agreement, including all documents attached to or incorporated by reference into either, shall contain all the terms and conditions to be agreed upon by the parties. Upon execution of any Program Agreement, this Agreement shall be considered incorporated into that Program Agreement by reference. No other understandings or representations, oral or otherwise, regarding the subject matter of this Agreement or any Program Agreement shall be deemed to exist or bind the parties. 10. Governing Law and Venue. The laws of the state of Washington govern this Agreement. In the event of a lawsuit by the County against DCYF involving this Agreement or Program Agreement, venue shall be proper only in Thurston County, Washington. In the event of a lawsuit by DCYF againstthe County involving this Agreement or a Program Agreement, venue shall be proper only as provided in RCW 36.01.050. 11. Responsibility. Each party to this Agreement shall be responsible forthe negligence of its officers, employees, and agents in the performance of any Program Agreement. No party to this Agreement or any Program Agreement shall be responsible for the acts and/or omissions of entities or individuals not party to this Agreement and any Program Agreement. DCYF and the County shall cooperate in the defense of tort lawsuits, when possible. Both parties agree and understand that such cooperation may not be feasible in all circumstances. DCYF and the County agree to notify the attorneys of record in any tort lawsuit where both are parties if either DCYF or the County enters into settlement negotiations. It is understood that the notice shall occur prior to any negotiations, or assoon as possible thereafter, and the notice may be either written or oral. 12. Independent Status. For purposes of this Agreement and any Program Agreement, the County acknowledges that the County is not an officer, employee, oragent of DCYF orthe state of Washington. The County shall not hold out itself or any of its employees as, nor claim status as, an officer, employee, or agent of DCYF or the state of Washington. The County shall not claim for itself or its employees any rights, privileges, or benefitswhich would accrue to an employee of the state of Washington. The County shall indemnify and hold harmless DCYF from all obligations to pay or withhold federal or state taxes or contributions on behalf of the County or the County's employees. 13. Inspection. Either party may request reasonable access to the other party's records and place of business for the limited purpose of monitoring, auditing, and evaluating the otherparty's compliance with this Agreement, any Program Agreement, and applicable laws and regulations. During the term of any Program Agreement and for one (1) yearfollowing termination or expiration of the Program Agreement, the parties shall, upon receiving reasonable written notice, provide the other party with access to its place of business and to its records which are relevant to its compliance with this Agreement, any Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 4 General Terms and Conditions Program Agreement, and applicable laws and regulations. This provision shall not be construed to give either party access to the other party's records and place of business for any other purpose. Nothing herein shall be construed to authorize either party to possess or copy records of the other party. 14. Insurance. DCYF certifies that it is self -insured under the State's self-insurance liability program, as provided by RCW 4.92.130, and shall pay for losses for which it is found liable. The County certifies that it is self -insured, is a member of a risk pool, or maintains insurance coverage as required in any Program Agreements. The County shall pay for losses for which it is found liable. 15. Maintenance of Records. During the term of this Agreement and for six (6) years following termination or expiration of this Agreement, both parties shall maintain records sufficient to: a. Document performance of all acts required by law, regulation, or this Agreement; b. Demonstrate accounting procedures, practices, and records that sufficiently and properly document the County's invoices to DCYF and all expenditures made by the County to perform as required by this Agreement. 16. Operation of General Terms and Conditions. These General Terms and Conditions shall be incorporated by reference into each Program Agreement between the County and DCYF in effect on or after the start date of this Agreement. These General Terms and Conditions govern and apply only to work performed under Program Agreements between the parties. 17. Orderof Precedence. In the event of an inconsistency in this Agreement and any Program Agreement, unless otherwise provided herein, the inconsistency shall be resolved by giving precedence, in the following order, to: a. Applicable federal and state of Washington statutes and regulations; b. This Agreement; c. The ProgramAgreement(s). 18. Ownership of Material. Material created by the County and paid for by DCYF as a part of any Program Agreement shall be owned by DCYF and shall be "work made for hire" as defined by 17 USC§ 101. This material includes, but is not limited to: books; computer programs; documents; films; pamphlets; reports; sound reproductions; studies; surveys; tapes; and/ortraining materials. Material which the County uses to perform a Program Agreement but is not created for or paid for by DCYF is owned by the County and is not "work made for hire'; however, DCYF shall have a perpetual license to usethis material for DCYF internal purposes at no charge to DCYF, provided thatsuch license shall be limited to the extent which the County has a right to grant such a license. 19. Severability. The provisions of this Agreement and any Program Agreement are severable. If any court holds invalid any provision of this Agreement or a Program Agreement, including any provision of any document incorporated herein or therein by reference, that invalidity shall not affect the other provisions this Agreement or that Program Agreement. 20. Subcontracting. The County may subcontract services to be provided under a Program Agreement, unless otherwise specified in that Program Agreement. If DCYF, the County, and a subcontractor of the County are found by a jury or other trier of fad to be jointly and severally liable for personal injury damages arising from any act or omission underthis Agreement orany Program Agreement, then Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 5 General Terms and Conditions DCYF shall be responsible for its proportionate share, and the County shall be responsible for its proportionate share. Should a subcontractorto the County pursuant to a Program Agreement be unable to satisfy its joint and several liability, DCYF and the County shall share in the subcontractor's unsatisfied proportionate share in direct proportion to the respective percentage of their fault as found by the trier of fact. Nothing in this section shall be construed as creating a right orremedy of any kind or nature in any person or party other than DCYF and the County. This provision shall not apply in the event of a settlement by either DCYF or the County. 21. Subrecipients. a. General. If the County is a subrecipient of federal awards as defined by 2 CFR Part 200 and this Agreement, the County will: (1) Maintain records that identify, in its accounts, all federal awards received and expended and the federal programs under which they were received, by Catalog of Federal Domestic Assistance (CFDA) title and number, award number and year, name of the federal agency, and name of the pass -through entity; (2) Maintain internal controls that provide reasonable assurance that the County is managing federal awards in compliance with laws, regulations, and provisions of contracts or grant agreements that could have a material effecton each of its federal programs; (3) Prepare appropriate financial statements, including a schedule of expenditures of federal awards; (4) Incorporate 2 CFR Part 200, Subpart F audit requirements into all agreements between the County and its Subcontractors who are subrecipients; (5) Comply with the applicable requirements of 2 CFR Part 200, including any future amendments to 2 CFR Part 200, and any successor or replacement Office of Management and Budget (OMB) Circular or regulation; and (6) Comply with the Omnibus Crime Control and Safe streets Act of 1968, Title VI of the Civil Rights Act of 1964, Section 504 of the Rehabilitation Act of 1973, Title II of the Americans with Disabilities Act of 1990, Title IX of the Education Amendments of 1972, The Age Discrimination Act of 1975, and The Department of Justice Non -Discrimination Regulations, 28 C.F.R. Part 42, Subparts C.D.E. and G, and 28 C.F.R. Part 35 and 39. b. Single Audit Act Compliance. If the County is a subrecipient and expends $750,000 or more in federal awards from all sources in any fiscal year, the County will procure and pay for a single audit or a program -specific audit for that fiscal year. Upon completion of each audit, the County will: (1) Submit to the DCYF contact person the data collection form and reporting package specified in 2 CFR Part 200, Subpart F, reports required by the program -specific audit guide (if applicable), and a copy of any management letters issued by the auditor; (2) Follow-up and develop corrective action for all audit findings; in accordance with 2 CFR Part 200, Subpart F; prepare a "Summary Schedule of Prior Audit Findings' reporting the status of all audit findings included in the prior audits schedule of findings and questioned costs. c. Overpayments. If it is determined by DCYF, or during the course of a required audit, that the County has been paid unallowable costs under this or any Program Agreement, DCYF may require the County to reimburse DCYF in accordance with 2 CFR Part 200. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 6 General Terms and Conditions 22. Survivability. The terms and conditions contained in this Agreementor any Program Agreement which, by their sense and context, are intended to survive the expiration of a particular Program Agreement shall survive. Surviving terms include, but are notlimited to: Disputes, Responsibility, Inspection, Maintenance of Records, Ownership of Material, Subcontracting, Termination for Default, Termination Procedure, and Title to Property. 23. Termination Due to Change in Funding, Agreement Renegotiation or Suspension. If the funds DCYF relied upon to establish any Program Agreement are withdrawn, reduced or limited, or if additional or modified conditions are placed on such funding, afterthe effective date of this Agreement but prior to the normal completion of any Program Agreement: a. At DCYF's discretion, the Program Agreement maybe renegotiated under the revised funding conditions. b. Upon no less than fifteen (15) calendar days' advance written notice to County, DCYF may s uspend County's performance of any Program Agreementwhen DCYF determines that there is reasonable likelihood that the funding insufficiency may be resolved in a timeframe that would allow the County's performance to be resumed prior to the normal completion date of the Program Agreement. For purposes of this sub -section, "written notice" may include email. (1) During the period of suspension of performance, each party will inform the other of any conditions that may reasonably affect the potential for resumption of performance. (2) When DCYF determines that the funding insufficiency is resolved, it will give the County written notice to resume performance. Upon the receipt of this notice, the County will provide written notice to DCYF informing DCYF whether it can resume performance and, if so, the date of resumption. (3) If the County's proposed resumption date is not acceptableto DCYF and an acceptable date cannot be negotiated, DCYF may terminate the Program Agreement by giving written notice to the County. The parties agree thatthe Program Agreement will be terminated retroactive to the effective date of suspension. DCYF shall be liable only for payment in accordance with the terms of the Program Agreement for services rendered through the retroactive date of termination. c. DCYF may terminate the Program Agreement by providing at least fifteen (15) calendar days' advance written notice to the County. DCYF shall be liable only for payment in accordance with the terms of the Program Agreement for services rendered through the effective date of termination. No penalty shall accrue to DCYF in the event the termination option in this section is exercised. 24. Termination for Convenience. The DCYF Contracts Administrator, or appropriate designee, may terminate this Agreement or any Program Agreement in whole or in part for convenience by giving the County at least thirty (30) calendar days' written notice addressed to the County at the address shown on the cover page of the applicable agreement. The County may terminate th is Agreement and any Program Agreement for convenience by giving DCYF at least thirty (30) calendar days' written notice addressed to: DCYF Contracts Department, PO Box 45710, Olympia, Washington 98504-5710. 25. Te rmination f o r Default. a. The DCYF Contracts Adninistrator, or appropriate designee, may terminate this Agreement or any Program Agreement for default, in whole or in part, by written notice to the County, if DCYF has a reasonable basis to believe that the County has: Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 7 General Terms and Conditions (1) Failed to meet or maintain any requirement for contracting with DCYF; (2) Failed to perform under any provision of this Agreement or any Program Agreement; (3) Violated any law, regulation, rule, or ordinance applicable to this Agreement or any Program Agreement; or (4) Otherwise breached any provision or condition of this Agreement or any Program Agreement. b. Before the DCYF Contracts Administrator, ortheir appropriate designee, may terminate this Agreement or any Program Agreement for default, DCYF shall provide the County with written notice of the County's noncompliance with the agreement and provide the County a reasonable opportunity to correct the County's noncompliance. If the County does not correct the County's noncompliance within the period of time specified in the written notice of noncompliance, the DCYF Contracts Adrrnistrator, or appropriate designee, may then terminate the agreement. The DCYF Contracts Administrator may terminate the agreement for default without such written notice and without opportunity for correction if DCYF has a reasonable basis to believe that Client's health or safety is in jeopardy. c. The County may terminate this Agreement or any Program Agreement for default, in whole or in part, by written notice to DCYF, if the County has a reasonable basis to believe that DCYF has: (1) Failed to meet or maintain any requirement for contracting with the County; (2) Failed to perform under any provision of this Agreement or any Program Agreement; (3) Violated any law, regulation, rule, or ordinance applicable to this Agreement or any Program Agreement; and/or (4) Otherwise breached any provision orcondition of this Agreement or any Program Agreement. d. Before the County may terminate this Agreement orany Program Agreement fordefault, the County shall provide DCYF with written notice of DCYF's noncompliance with the agreement and provide DCYF a reasonable opportunity to correct DCYF's noncompliance. If DCYF does not correct DCYF's noncompliance within the period of time specified in the written notice of noncompliance, the County may then terminate the agreement. 26. Termination Procedure. The following provisions apply in the event this Agreement or any Program Agreement is terminated: a. The County shall cease to perform any services required by the Program Agreement as of the effective date of termination and shall comply with all reasonable instructions contained in the notice of termination which are related to the transfer of clients, distribution of property, and termination of services. b. The County shall promptly deliver to the DCYF contact person (or to his or her successor) listed on the first page of the Program Agreement, all DCYF assets (property) in the County's possession, including any material created under the Program Agreement. Upon failure to return DCYF property within fifteen (15) working days of the Program Agreement termination, the County shall be charged with all reasonable costs of recovery, including transportation. The County shall take reasonable steps to protect and preserve any property of DCYF that is in the possession of the County pending return to DCYF. Department of Chi Idren, Youth & Families 2017CF County Program Agreement 6-24-20 Page 8 General Terms and Conditions c. DCYF shall be liable for and shall pay for only those services authorized and provided through the effective date of termination. DCYF may pay an amount mutually agreed by the parties for partially completed work and services, if work products are useful to or usable by DCYF. If the DCYF Contracts Administrator terminates any Program Agreementfor default, DCYF may Withhold a sum from the final payment to the County that DCYF determines is necessary to protect DCYF against loss or additional liability occasioned by the alleged default. DCYF shall be entitled to all remedies available at law, in equity, or under the Program Agreement. If it is later determined that the County was not in default, or if the County terminated the Program Agreement for default, the County shall be entitled to all remedies available at law, in equity, or under the Program Agreement. 27. Treatment of Client Property. Unless otherwise provided in the applicable Program Agreement, the County shall ensure that any adult client receiving services from the County under Program Agreement has unrestricted access to the client's personal property. The County shall not interfere with any adult client's ownership, possession, or use of the client's property. The County shall provide clients under age eighteen (18) With reasonable access to their personal property that is appropriate to the client's age, development, and needs. Upon termination or completion of the Program Agreement, the County shall promptly release to the client and/or the client's guardian orcustodian all of the client's personal property. This section does not prohibit the County from implementing such lawful and reasonable policies, procedures and practices as the County deems necessary for safe, appropriate, and effective service delivery (for example, appropriately restricting clients' access to, or possession or use of, lawful or unlawful weapons and drugs). 28. Title to Property. Title to all property purchased or furnished by DCYF for use by the County during the term of a Program Agreement shall remain with DCYF. Title to all property purchased orfurnished by the County for which the County is entitled to reimbursement by DCYF under a Program Agreement shall pass to and vest in DCYF. The County shall take reasonable steps to protect and maintain all DCYF property in its possession against loss or damage and shall return DCYF property to DCYF upon termination or expiration of the Program Agreement pursuant to which it was purchased orfurnished, reasonable wear and tear excepted. 29. Waive r. Waiver of any breach or default on any occasion shall not be deemed to be a waiver of any subsequent breach ordefault. No waiver shall be construed to be a modification of the terms and conditions of this Agreement unless amended as set forth in Section 2, Amendment. Only the DCYF Contracts Administrator or designee has the authority to waive any term or condition of this Agreement on behalf of DCYF. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 9 Special Terms and Conditions 1. Definitions. Thewords and phrases listed below, as used in this Contract, shall each have the following definitions: a. "DCYF" means the Department of Children, Youth, and Families. b. "ACT" means Alternative Choice Training. c. "EET" means Education and Employment Training. d. "Juvenile Rehabilitation" or "JR" means the Division under the Department of Children, Youth, and Families. 2. Purpose. The purpose of this Contract is to provide for staff time to develop, train, and provide consultation to ACT trainers providing the service. 3. Data Security Requirements— Exhibit A. The Contractor shall protect, segregate, and dispose of data from DCYF as described in Exhibit A. 4. Statement of Work— Exhibit B. The Contractor shall provide services and staff as described in the Statement of Work attached as Exhibit B. 5. Billing and Payment a. The contracted activities shall be paid up to the amount specified for the deliverables identified in the Statement of Work and payment shall be made upon receipt of the deliverable. JR shall not make payment for any deliverable not completed in accordance to the specifications identified in this Contract. b. Invoice shall be sent to the DCYF Program Contact listed in the Statement of Work. c. DCYF will not be obligated to pay for services submitted more than three (3) months after the calendar month in which the services were performed. d. DCYF shall pay the Contractor upon acceptance by DCYF of a properly completed A-19 Invoice Voucher. The invoice shall include any required documentation of the services delivered as specified in the Statement of Work. Payment shall be sent to the Contractor's address on page one of this Contract. e. Payment shall be considered timely if made by DCYF within 30 days after receipt of the properly completed invoice. f. The Contractor accepts the DCYF payment as the sole and complete payment for the services provided under this Contract. g. DCYF shall not reimburse the Contractorfor authorized services not provided to clients, or for services provided which are not authorized or are not provided in accordance with Exhibit B: Statement of Work. If DCYF pays the Contractor for services authorized but not provided by the Contractor in accordance with this Contract's "Statement of Work," the amount paid shall be considered to be an overpayment. h. If this Contract is terminated for any reason, DCYF shall pay for only those services authorized and provided through the date of termination. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 10 Special Terms and Conditions 6. Services Authorized as Needed DCYF shall request services from the Contractor on an as -needed basis. This Contract does not obligate DCYF to authorize services,from the Contractor. Payment Only for Authorized Services DCYF shall pay the Contractor only for authorized services provided in accordance with this Contract. If this Contract is terminated for any reason, DCYF shall pay only for services authorized and provided through the date of termination. 8. Funding Stipulations a. Information for Federal Fundina. The Contractor shall cooperate in supplying any information to DCYF that may be needed to determine DCYF or the client's eligibility for federal funding. b. Duolicate Billing. The Contractor must not bill other funding sources for services rendered under this Contract which would result in duplicate billing to different funding sources for the same service. Furthermore, the Contractor shall ensure that no subcontractor bills any other funding sources for services rendered underthis Contract, which would result in duplicate billing to different funding sources for the same service. c. No Federal Match. The Contractor shall not use funds payable under this Contract as match toward federal funds without the prior written permission of DCYF. d. Supplanting. The Contractor shall use these funds to supplement, not supplant the amount of federal, state and local funds otherwise expended for services provided under this Contract. Recovery of Fees for Noncompliance In the event the Contractor bills for services provided and is paid fees for services that DCYF later finds were either (a) not delivered or (b) not delivered in accordance with applicable standards or the requirements of this Contract, DCYF shall have the right to recover the fees forthose services from the Contractor, and the Contractor shall fully cooperate during the recovery process. 10. Prohibition of Use of Funds for Lobbying Activities The Contractor shall not use funds payable underthe Contract for lobbying activities of any nature. The Contractor certifies that no state or federal funds payable underthis Contract shall be paid to any person or organization to influence, or attempt to influence, either directly or indirectly, an officer or employee of any state or federal agency, or an officer or member of any state or federal legislative body or committee, regarding the award, amendment, modification, extension, or renewal of a state or federal contract or grant. Any act by the Contractor in violation of this prohibition shall be grounds for termination of this Contract, at the sole discretion of DCYF, and shall subject Contractor to such monetary and other penalties as may be provided by law. 11. Culturally Relevant Services The Contractor shall provide appropriate, accessible, and culturally relevant services to clients and their families. Service delivery shall be culturally competent and responsive to each client's cultural beliefs and values, ethnic norms, language needs, and individual differences. Contractors are encouraged to employ a diverse workforce that reflects the diversityof their clientele and the community. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 11 Special Terms and Conditions 12. Compliance Agreement In the event that DCYF identifies deficiencies in Contractors performance under this Contract, DCYF may, at its option, establish a Compliance Agreement. When presented with a Compliance Agreement, Contractor agrees to undertake the actions specified in the plan within the timeframes given to correct the deficiencies. Contractors failure to do so shall be grounds for termination of this Contract. 13. Compliance with JR Policies and Standards. a. In addition to the governing Federal and State laws and regulations, the Contractor shall comply with all DCYF and JR Rules and Policies as applicable to the services provided. b. In case of conflict or inconsistency between the aforementioned, the higher standard of compliance shall prevail. 14. Administrative Records The Contractor shall retain the following administrative records: a. Fiscal records that shall substantiate costs charged to DCYF underth is Contract; b. Documentation of all audits, license reviews, contract monitoring reports, and corrective action reports and actions taken. Documentation of all costs associated with service provided under this Contract; c. Recruitment policy which demonstrates that Contractor is an equal opportunity employer; and d. Copy of the Contractor's Certificate of Insurance and for each subcontractor. 15. Background Checks a. This requirement applies to any employees, volunteers and subcontractors who may have unsupervised access to children served under this Contract. b. In accordance with Chapters 388-700 WAC (JR-Practices & Procedures), 72.05 RCW (Children & Youth Services), and by the terms of this Contract, Contractor and each of its employees, subcontractors, and/or volunteers who may or will have regular access to any client/juvenile must be cleared through a JR approved criminal history and background check. In addition, Contractor, each of their employees, subcontractors, and/or volunteers, who may or will have limited access to any client/juvenile, may be required to be cleared through a JR approved criminal history and background check. c. By execution of this Contract, Contractor affirms that Contractor, each of its employees, subcontractors, and/or volunteers, who may or will have regular access have not been convicted of any of the following: (1) Any felony sex offense as defined in 9.94A.030 RCW (Sentencing Reform Act -Definitions) and 9A.44.130 RCW (Sex Offenses); (2) Any crime specified in Chapter 9A.44 RCW (Sex Offenses) when the victim was a juvenile in the custody of or under the jurisdiction of JR; or (3) Any violent offense as defined in 9.94A.030 RCW (Sentencing Reform Act -Definitions). Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 12 Special Terms and Conditions Contractor must require that current employees, volunteers, and contracted service providers who are authorized for regular access to a juvenile(s) report any guilty plea or conviction of any of the above offenses. The report must be made to the person's supervisor within seven (7) days of conviction and any person who have reported a guilty plea or conviction for one or more of these offenses must not have regular access to any offender. Contractor shall also document background checks/criminal history clearances for monitoring purposes. 16. Sexual Misconduct a. Sexual Misconduct - 13.40.570 RCW (Sexual misconduct by state employees, contractors) states that when the Secretary has reasonable cause to believe that sexual intercourse or sexual contact between the employee of a Contractor and an offender has occurred, the Secretary shall require the employee of a Contractor to be immediately removed from any employment position which would permit the employee to have any access to any offender. b. By execution of this Contract, Contractor affirms that Contractor, each of its employees, subcontractors, and/or volunteers are knowledgeable about the requirements of 13.40.570 RCW (Sexual misconduct by state employees, contractors) and of the crimes included in 9A.44 RCW (Sex Offenses). c. In addition, the Secretary shall disqualify for employment with a Contractor in any position with access to an offender, any person: (1) Who is found by the department, based on a preponderance of the evidence, to have had sexual intercourse or sexual contactwith the offender; or (2) Convicted of any crime specified in chapter 9A.44 RCW (Sex Offenses) when the victim was an offender d. If any actions are taken under 13.40.570 RCW, subsections (3) or (4), the Contractor must demonstrate to the Secretary they have greatly reduced the likelihood that any of its employees, volunteers, or subcontractors could have sexual intercourse or sexual contact with any offender. The Contract shall not be renewed unless the Secretary determines significant progress has been made. 17. Subcontractor If the Contractor utilizes subcontractors for the provision of services under this Contract, the Contractor must notify JR in writing and maintain sufficient documentation to verify that the subcontractors meet all the requirements under this Contract. In no event shall the existence of a subcontract release or reduce the liability of the County for any breach of performance. 18. Monitoring The County shall assist the JR to perform reviews of sites where services are delivered at regular intervals using agreed upon forms and methods. 19. Insurance a. DCYF certifies that it is self -insured under the State's self-insurance liability program, as provided by RCW 4.92.130, and shall pay for losses for which it is found liable. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 13 Special Terms and Conditions b. The Contractor certifies, by checking the appropriate box below, initialing to the left of the box selected, and signing this Agreement, that: ❑ The Contractor is self -insured or insured through a risk pool and shall pay for losses for which it is found liable: or ❑ The Contractor maintains the types and amounts of insurance identified belowand shall, prior to the execution of this Agreement by DCYF, provide certificates of insurance to that effect to the DCYF contact on page one of this Agreement. Commercial General Liability Insurance (CGL)— to include coverage for bodily injury, property damage, and contractual liability, with the following minimum limits: Each Occurrence - $1,000,000; General Aggregate- $2,000,000. The policy shall include liability arising out of premises, operations, independent contractors, products -completed operations, personal injury, advertising injury, and liability assumed under an insured contract. The State of Washington, DCYF, its elected and appointed officials, agents, and employees shall be named as additional insureds. 20. Resolution of Differences In the event of any differences between the parties on matters related to the interpretation and implementation of this Contract, the partiesshall first attempt to resolve the difference informally between themselves at the local or regional level, by following the regional conflict resolubon process. If the parties are unable to resolve theirdifference as stated above, then either party may submit a request for dispute resolution as provided in the Section Disputes below. A copy of the regional conflict resolution process is available from the DCYF Contact person listed on page 1 of this Contract. 21. Disputes a. Either party who has a dispute concerning this Contract may submit a written request for dispute resolution. The amount of any rate set by law, regulation, or DCYF policy is not disputable. A party's written request for dispute resolution must include: (1) A statement identifying the issue(s) in dispute; and (2) Contractor's name, address and contract number. b. The request must be mailed to the followng address Wthin thirty (30) calendar days after the party could reasonably be expected to have knowiedgeof the issue, which is disputed. c. A copy of the current DCYF's dispute resolution process is available at anytime by written request. d. Requests for dispute resolution or fora copy of the current DCYF's dispute resolution process should be sent to: Department of Children, Youth & Families Attention Contracts Unit P.O. Box 40983 Olympia, WA 98504-0983 e. This dispute resolution process is the sole administrative remedy available under this Contract. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 14 EXHIBIT A DATA SECURITY REQUIREMENTS ORGANIZATION OF DATA SECURITY REQUIREMENTS 1. Definitions 2. Authority 3. Scope of Protection 4. Data Classification 5. Compliance with Laws, Rules, Regulations, and Policy 6. Administrative Controls 7. Authorization, Authentication, and Access 8. Protection of Data 9. Method of Transfer 10. System Protection 11. Data Segregation 12. Confidentiality Protection 13. Data Disposition 14. Data shared with Subcontractors 15. Notification of Compromise or Potential Compromise 16. Breach of Data Definitions. Thewords and phrases listed below, as used in this Exhibit, shall each have the following definitions: a. "AES" means the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology (http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf). b. "Authorized Users(s)" means an individual or individuals with a business need to access DCYF Confidential Information, and who has been authorized to do so. c. "Cloud storage" means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iTunes, Dropbox, Boxcom, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace. d. "Confidential Information" means information that may be exempt from disclosure to the public or other unauthorized persons under either chapter42.56 RCW or other state or federal laws. Confidential Information includes, but is not limited to, Personal Information, agency source code or object code, and agency security data. "Confidential Information" also includes, but is not limited to, Category 3 and Category 4 Data as described in section 4 of this Exhibit (Exhibit A: Data Security Requirements), Personal Information, Materials, and Data. The definition of "Confidential Information" shall also include the definition described in section 1 (Definitions) of the General Terms and Conditions of this Contract. e. "Data' means DCYF's records, files, forms, information and other documents in electronic or hard copy medium. "Data" includes, but is not limited to, Confidential Information. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 15 f. "Encrypt" means to encode Confidential Information into a format that can only be read by those possessing a "key"; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. g. "FedRAMP" means the Federal Risk and Authorization Management Program (see httos://wvw✓.fedramp.gov/), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services. h. "Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. i. "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. "Multi -factor Authentication" means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PIN" means a personal identification number, a series of numbers which act as a password for a device. Since PINS are typically only four to six characters, PINS are usually used in conjunction with another factor of authentication, such as a fingerprint. k. "Personal Information" shall have the same meaning as described in RCW 42.56.590(10) and includes, but is not limited to, information protected under chapter 13.50 RCW, Health Care Information as that phrase is defined in RCW 70.02.010, personally identifiable information, and other information that relates to a person's name and the use or receipt of governmental services or other activities. I. "Portable Device" means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device. m. "Portable Media" means any machine-readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device. n. "Physically Secure" or "Physical Security' means that access is restricted through physical means to authorized individuals only. o. "Secure Area" means an area to which only authorized representatives of the entity possessing the Confidential Information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access to the Confidential Information is not available to unauthorized personnel. In otherwise Secure Areas, such as an office with restricted access, the Data must be secured in such away as to Depa rim ant of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 16 prevent access by non -authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non -authorized staff cannot access it. p. "Staff" means the Contractor's directors, officers, employees, and agents who provide goods or services pursuant to this Contract. "Staff also means Subcontractors' directors, officers, employees, and agents who provide goods or services on behalf of the Contractor. The term "Staff also means the Subcontractors' directors, officers, employees, and agents who provide goods or services on behalf of the Subcontractor and Contractor. q. "Trusted Network" means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DCYF Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data. r. "Unique User ID" means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. 2. Authority. The security requirements described in this contract reflect the applicable requirements of Standard 141.10 (https:Hocio.wa.gov/policies) of the Office of the Chief Information Officer for the state of Washington, and of the DCYF Information Security Policy and Standards Manual. 3. Scope of Protection The requirements described in this Contract apply to Confidential Information and Data related to the subject matter of this Contract that is delivered, received, used, shared, acquired, created, developed, revised, modified, or amended by DCYF, the Contractor, or Subcontractors. 4. Data Classification a. The Washington State Office of the Chief Information Officer (OCIO) has established policies that classify data into categories based on the data's sensitivity. The categories described in Section 4 of OCIO policy No. 141.10 are adopted and incorporated by reference in this Agreement. Pursuant to Section 4 of OCIO policy No. 141.10 the categories are as follows: (1) Category 1 —Public Information Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls. (2) Category 2 — Sensitive Information Sensitive information may not be specifically protected from disclosure by lawand is for official use only. Sensitive information is generally not released to the public unless specifically requested. (3) Category 3 — Confidential Information Confidential information is information that is specifically protected from either release or disclosure by law. This includes, but is not limited to: Department of Children, Youth & Families 2017CF County Pro gram Agreement 6-24-20 Page 17 (a) Personal information as defined in RCW 42.56.590 and RCW 19.255.10; (b) Information about public employees as defined in RCW 42.56.250; (c) Lists of individuals for commercial purposes as defined in RCW 42.56.070(9); and (d) Information about the infrastructure and security of computer and telecommunication networks as defined in RCW 42.56.420. (4) Category 4 — Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which: (a) Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements; and (b) Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions. 5. Compliance with Laws, Rules, Regulations, and Policies Confidential Information and Data that is delivered, received, used, shared, acquired, created, developed, revised, modified, or amended in connection with this Contract the parties shall comply with the following: (1) All federal and state laws and regulations, as currently enacted or revised, regarding the protection, security, and electronic interchange of Confidential Information and Data; and (2) All federal and state laws and regulations, as currently enacted or revised, regarding the use, disclosure, modification or loss of Confidential Information and Data. 6. Administrative Controls. a. The Contractor must have the following controls in place: (1) A documented security policy governing the secure use of its computer network, mobile devices, portable devices, as well as, any form of paper/hard copy documents. (2) Security awareness training for all staff, presented and documented annually, as follows: (a) Contractor staff responsibilities under the Contractor's security policy; (b) Contactor staff responsibilities as outlined under contract Exhibit A; and (c) Must successfully complete the DCYF Information Security Awareness Training, which can betaken on this web page: htt[2s://www.dcvf.wa. qov/sites/default/fileslpdf(Security n- Contracts pdf (3) Contractor may replace the DCYF Information Security Awareness training listed above with their own equivalent Information Awareness Training. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 18 Authorization, Authentication, and Access. a. In order to ensure that access to the Data is limited to authorized staff, the Contractor must comply with the following: (1) Have documented policies and procedures that: (a) Govern access to systems; and (b) Govern access to paper/hard copy documents and files. (2) Only allow access to Confidential Information through administrative, physical, and technical controls. (3) Ensure that user accounts are unique and that any given useraccount logon ID and password combination is known only to the one staff member to whom that account is assigned. For purposes of non -repudiation, it must always be possible to determine which staff member performed a given action on a system housing the Data based solely on the logon ID used to perform the action. (4) Ensure that only authorized users are capable of accessing the Data; (5) Ensure that an employee's access to Data is removed: (a) Within twenty-four (24) hours of an alleged compromise of the user credentials (b) Within 24 hours from when their employment, or the contract underwhich the Data is made available to them, is terminated; (c) Within 24 hours from when the employee or contractor no longer need access to the Data to fulfill the requirements of the Contract; and (d) Within 24 hours from when the staff member has been suspended from performing services under this Contract. (6) Have a process in place the requires quarterly reviews verifications that ensure only authorized users have access to systems containing Confidential Information. (7) The Contractor must require the following password and logon requirements for Authorized Users to access Data within the Trusted Network: (a)To access Data the Authorized User must be required to enter a Hardened Password; (b)The hardened password must not contain a user's name, logon ID, or any form of an individual's full name; (c)The hardened password must not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words; and (d)Hardened passwords are significantly different from the previous four (4) passwords. Hardened passwords that increment by simply adding a number are not considered significantly different. Department of Children, Youth & Families 2017CF County Program !Agreement 6-24-20 Page 19 (8) When accessing Confidential Information and Data from an external location (the Data will traverse the Internet or otherwise travel outside the Trusted network), mitigate risk and enforce hardened password and logon requirements for users by employing measuresthat include: (a) Ensuring mitigations applied to the system don't allow end -user modification; (b) Not allowing the use of dial -up connections; (c) Using industry standard protocols and solutions for remote access. Examples include secure VPN and Citrix; (d) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network; (e) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than thirty (30) minutes of inactivity; and (f) Ensuring the use of Multi -Factor Authentication (MFA) to connect from the external end point to the internal end point. (9) Hardened passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.). If a lesser standard is authorized underthis subsection, the PIN or password must: (a) Be at least five (5) letters or numbers when used in conjunction with at least one other authentication factor; (b) Not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable); and (c) Not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable). (10) If the Contract specifically allows for the storage of Confidential Information on a Portable Device, passwords used on the device must: (a) Be a minimum of six (6) alphanumeric characters; (b) Contain at least three unique character classes (uppercase, lower case, letter, number); (c) Not contain more than a three consecutive character run. Passcodes consisting of (12345, or abcd12 would not be acceptable); and (d) Render the device unusable after a maximum of five (5) failed logon attempts. 8. Protection of Data. a. The Contractor agrees to store Data on one or more of the following medial and protectthe Data as described: (1) Hard disk drives Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 20 Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. (2) Network server disks (a) Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. (b) Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. (3) Optical discs (CDs or DVDs) in local workstation optical disc drives (a) Data provided by DCYF on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area, when not in use for the contracted purpose, such discs must be Stored in a Secure Area. (b) Workstations that are capable of accessing Data from optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. (4) Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers (a) Data provided by DCYF on optical discs that will be attached to network servers will not be transported out of a Secure Area. (b) Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. (c) Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. (5) Paper documents (a) All paper documents must be protected by storing the records in a Secure Area, with access controlled through the use of a key, card key, combination lock, or comparable mechanism, and which is only accessible to authorized personnel. (b) When being transported outside of a Secure Area, paper documents must be under the physical control of Contractor staff with authorization to access the Data. (c) Paper documents will not be secured or stored in a motor vehicle any time a staff member is away from the motor vehicle. NOTE: The use of a lock box, other lockable storage containeror a non -lockable storage container stored in a vehicle does not override this requirement. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 21 (d) Paper documents will be retained in a Secure Area, per the State of Washington records retention requirements. (6) Data storage on portable devices or media (a) Except where otherwise described herein, Data shall not be stored by the Contractor on portable devices or media unless specifically authorized within the terms and conditions of the Contract. If so authorized, the Data shall be given the following protections: The Data must be Encrypted; Portable devices must be equipped with a Unique User ID and Hardened Password or stronger authentication method such as token or biometrics; iii. Portable devices must be manually locked whenever they are left unattended. The devices must be set to automatically lock after a period of no more than fifteen (15) minutes of inactivity; iv. Administrative and physical security controls must be applied to Portable Devices and Portable Media by: (A) Keeping them in a Secure Area when not in use; (B) Using check-in/check-out procedures when they are shared; and (C) Taking quarterly inventories. (b) When being transported outside of a Secure Area, Portable Devices and Portable Media with Data must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. (c) Portable Devices and Portable Media will not be secured or stored within motor vehicles at any time the staff member is away from the motor vehicle. (7) Data stored for backup purposes (a) DCYF Confidential Information maybe stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. i. Such storage is authorized until such time as that media would be reused during the course of normal backup operations. ii. If backup media is retired while DCYF Confidential Information still exists upon it, refer to Section 13 Data Disposition. (b) Data maybe stored on non -portable media (e.g. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. i. If so, such media will be protected as otherwise described in this exhibit. ii. If this media is retired while DCYF Confidential Information still exists upon it, refer to Section 13 Data Disposition. Department of Children, Youth R Families 2017CF County Program Agreem ent 6-24-20 Page 22 (8) Cloud storage (a) Data requires protections equal to or greater than those specified elsewhere within this Exhibit. (b) Cloud storage of Data is problematic as neither DCYF nor the Contractor has control of the environment in which the Data is stored. For this reason: i. Data must not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (A) The Contractor has written procedures in place governing use of the Cloud storage and by signing this contract, the Contractor atteststhat all such procedures will be uniformly followed; (B) The Data must be Encrypted while within the Contractor network; (C) The Data must remain Encrypted during transmission to the Cloud; (D) The Data must remain Encrypted at all times while residing within the Cloud storage solution; (E) The Contractor must possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DCYF; (F) The Data must not be downloaded to a non -authorized system. the only authorized systems are located on the DCYF network or Trusted networks; (G)The Data must not be decrypted until downloaded onto a computer or portable devise within the control of an Authorized User and within either the DCYF network or Trusted network; and (H) Access to the cloud storage requires Multi Factor Authentication. ii. Data must not be stored on an Enterprise Cloud storage solution unless either: (A) The Cloud storage provider is treated as any other Sub -Contractor, and agrees in writing to all of the requirements within this exhibit; or (B) The Cloud storage solution used is Fed RAMP certified; or (C) Contractor can attest that: 1. They have reviewed the data security policy of the cloud service provider; and 2. The cloud service provider meets requirements of Exhibit A in full or with limited exceptions. 9. Method of Transfer a. All Data transfers to or from the Contractor shall be made by using an approved solution that meets agency and state IT security standards. (1) Approved options include: Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 23 (a) SFT service provided Washington Technology Solutions (WaTech); or (b) The DCYF instance of Box.com. b. Any information containing sensitive data elements must be encrypted and password protected using a tool such as WinZip, 7zip, or something similar. c. An account is required to access either of the above solutions, you will need to make a request by contacting the contract contact listed on the cover page of this Agreement. d. Any other solution must be approved by the DCYF Information Security Office. To obtain approval, contact the contract contact listed on the cover page of this Agreement. Request must include the name of the solution, as well as, any information to help in the approval process. e. The Contractor must use a secure solution for electronic mail submissions which contain Confidential information, and Personal Information, as defined in the General Terms and Conditions. f. Information regarding receiving encrypted email from DCYF can be obtained at DCYF's website, located at: httos://www dcvf wa aov/services/child-welfare-providers/encrypted-email 10. System Protection. To prevent compromise of systems that contain DCYF Data or systems that Data passes through, the Contractor must: (1) Ensure all security patches or hotfixes applied Wthin three (3) months of being made available; (2) Have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes; (3) Ensure systems containing Data shall have an Anti-Malware application installed, if available; and (4) Ensure that Anti-Malware software is kept up to date. The product, its anti -virus engine, and any malware database the system uses, will be no more than one update behind current. 11. Data Segregation. Data must be segregated or otherWse distinguishable from non-DCYF data. This is to ensure that when no longer needed by the Contractor, all Data can be identified for return or destruction. It also aids in determining whether Data has or may have been compromised in the event of a security breach. b. The Contractor must use one or more of the following methods to segregate Data: (1) Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non- DCYF Data; and/or (2) Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to Data; and/or (3) Data will be stored in a database which will contain no non-DCYF data; and/or Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 24 (4) Data will be stored within a database and will be distinguishable from non-DCYF data by the value of a specific field or fields within database records; and (5) When stored as physical paper documents, Data will be physically segregated from non-DCYF data in a drawer, folder, or other container. c. When it is not feasible or practical to segregate Data from non-DCYF data, then both the Data and the non-DCYF data with which it is commingled must be protected as described in this exhibit. 12. Confidentiality Protection a. To safeguard confidentiality, and ensure thataccess to all Data is limited to authorized staff, the Contractor must: (1) Ensure that the Contractors Staff, Subcontractors, and the Subcontractors' Staff use Data solely for the purposes of accomplishing the services set forth in this Contract. (2) Ensure that no Data is released, disclosed, published, modified, transferred, sold, or otherwise made known to unauthorized persons without the prior written consent of the individual named or as otherwise authorized by law. (3) Not use, publish, transfer, sell or otherwise disclose any Confidential Information of a minor except as provided by lawor with the prior written consent of the minor's parent, legal representative or guardian. If a child is a dependent of Washington State, then prior written consent must be obtained from DCYF. (4) Require that the Contractor's Staff and Subcontractors' Staff having access to Data sign a Statement of Confidentiality and Non -Disclosure Agreement (DCYF Form 03-374B), that can be found at this webpage: https://www.dcyf.wa.gov/forms. Data shall not be released to the Contractor's Staff person(s) or Subcontractors' Staff person(s) until the following conditions have been met: (a) DCYF approves the Contractor's Staff person(s) or Subcontractors' Staff person(s), to work on this Contract; and (b) If requested by DCYF, Contractor must provide the original Statement of Confidentiality and Non -Disclosure Agreement, signed bythe Staff person(s) and Subcontractors' Staff person(s). 13. Data Disposition. a. The Contractor must ensure that all Data, including paper and electronic records, are retained pursuant to the Washington State retention standards. b. When the contracted work has been completed or when the Data is no longer needed, Data shall be retained pursuant to the retention standards required by chapter40.14 RCW, or returned to DCYF. c. Once the retention standard has passed, Contractors may destroy data as outlined below. (1) The following acceptable methods of destruction must be used: Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 25 Data stored on: Will be destroyed by: Server or workstation hard disks, or Using a "wipe" utility which will overwrite the Data at least three (3) times using either random or single Removable media (e.g. floppies, USB flash character data, or drives, portable hard disks) excluding optical discs Degaussing sufficiently to ensure that the Data cannot be reconstructed, or Physically destroying the disk Paper documents with Category 3 Recycling through a contracted firm, provided the Confidential Information contract with the recycler assures that the confidentiality of Data will be protected. Paper documents containing Category 4 On -site shredding, pulping, or incineration Confidential Information requiring special handling e. rotected health information Optical discs (e.g. CDs or DVDs) Incineration, shredding, or completely defacing the readable surface with a coarse abrasive Magnetic toe Degaussing, incinerating or crosscut shredding 14. Data shared with Subcontractors. a. If the Subcontractor cannot protect the Data described in this Contract, then the contract with the subcontractor must be submitted to the DCYF Contact specified for this contract for reviewand approval. b. The Contractor shall not share any Data with the Subcontractor until the Contractor receives such approval. 15. Notification of Compromise or Potential Compromise a. The Contractor shall notify DCYF by way of the Contracts and Procurement Office email at dcyf.contractdatabreach@dcyf.wa.gov within one (1) business day, after becoming aware of any potential, suspected, attempted or actual breach that has compromised or the potential to compromise DCYF shared Data. b. The Contractor shall take all necessary steps to mitigate the harmful effects of such breach of security. c. The Contractor agrees to defend, protect and hold harmless DCYF for any damages related to a breach of security by their staff. 16. Breach of Data a. In the event of a breach by the Contractor of this Exhibit and in addition to all other rights and remedies available to DCYF, DCYF may elect to do any of the following: (1) Require that the Contractor return all Data to DCYF that was previously provided to the Contractor by DCYF; and/or (2) Suspend the Contractor's access to accounts and other information; and/or (3) Terminate the Contract. Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page26 Exhibit B Statementof Work Alternative Choice Training (ACT) and Education and Employment Training (EET) Consultation for County Juvenile Courts Service Delivery a. The Contractor shall provide to statewide ACT Trainers, by telephone or in -person, clinical consultation services. Services shall include, but are not limited to: (1) Providing clinical consultation to ACT Trainers throughout the state; (2) Participating in and providing ACT Trainer training; (3) Monitoring by direct observation or video recordings of ACT sessions foradherence and compliance to ACT program standards; (4) Reporting monitoring results to the JR Juvenile Court Program Administrator and to the statewide ACT. Quality Assurance Specialist on a monthly basis; (5) Providing assistance Wth individual ACT Trainers improvement plans; and (6) Participating in implementation and ongoing program development meetings. b. The Contractor shall provide statewide program consultation and development for the EET program. Services shall include, but are not limited to: (1) Providing group and individual consultation to Education and Employment Specialists (EES) throughout the state; (2) Developing, participating, and providing EET training; (3) Monitoring by direct observation, video, or audio recordings of Job Readiness Training sessions, and individual EES sessions for adherence and compliance to EET program standards; (4) Reporting monitoring results to the JR EET Quality Assurance Specialist on a monthly basis; (5) Providing assistance with individual EES improvement plans; and (6) Participating in implementation and ongoing program development meetings. 2. Deliverables. a. Monthly Reporting The Contractor shall provide monthly activity and monitoring summary reports (ACT and EET) to the JR Juvenile Court Program Administrator. Department of Children, Youth& Families 2017CF County Program Agreement 6-24-20 Page 27 b. Quarterly Reporting The Contractor on a quarterly basis shall provide the JR Juvenile Court Program Administrator and the Statewide ACT Quality Assurance Specialist (QAS) a report that summarizes the following information for all ACT Trainers served that quarter: (1) Number of ACT Trainers served; (2) Number of ACT Trainers placed on Informal Improvement Plans; (3) Number of ACT Trainers who successfully completed their Informal Improvement Plans; (4) Number of ACT Trainers who did not complete or unsuccessfully completed their Informal Improvement Plans and were referred to the ACT QAS for further action. c. Outcome Reporting The Contractor shall report to the JR Juvenile Court Program Administrator at the completion of services to ACT Trainers the following information: (1) The frequency of participation of each Juvenile Court's ACT Trainers participation in telephone consultation; (2) Any changes in the Juvenile Courts' ACT program. 4. Consideration. Total consideration payable to Contractorfor satisfactory performance of the work under this Contract is up to a maximum of $46,401, including any and all expenses, and shall be based on the following: a. The maximum consideration payable for Fiscal Year 2024 is $22,869. Funds not expended in Fiscal Year 2023 cannot be carried over to the following Fiscal Year. b. The maximum consideration payable for Fiscal Year 2025 is $23,532. Funds notexpended in Fiscal Year 2024 cannot be carried over to the following Fiscal Year. c. The Contractor shall be paid $55.59 per hour in Fiscal Year 2024, and $57.26 per hour in Fiscal Year 2025 for clinical consultation services and payment shall be based upon the JR Juvenile Court Program Administrator receipt and approval of monthly summary report. d. The Contractor shall only be reimbursed fortravel costs pre -approved in writing by the JR Juvenile Court Program Administrator. 5. DCYF Program Contact. The Contractor shall notifythe DCYF Program Contact listed belowfor any questions or issues related to services under this contract: Cory Redman Juvenile Court Programs Administrator Juvenile Rehabilitation - HQ 360.480.1194 cory.redmanr@dcvfwa oov Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 28