Loading...
HomeMy WebLinkAboutFully Executed ContractBOARD OF COUNTY COMMISSIONERS COUNTY OF KITTITAS STATE OF WASHINGTON RESOLU TION NO.2026- l,A A RESOLUTION AUTHORIZING EXECUTION OF THE INTERLOCAL AGREEMENT BETWEEN THE WASHINGTON STATE DEPARTMENT OF CORRECTIONS AND KITTITAS COUNTY, WASHINGTON FOR THE HOUSING OF INMATES WHEREAS, RCW 39.34, the lnterlocal Cooperation Act, provides the capability for public agencies to cooperate by providing services and facilities for mutual advantage; and WHEREAS, the Washington State Department of Corrections wishes to designate the Kittitas County Jail as a place of confinement for the incarceration of one or more inmates laMully committed to its custody; and WHEREAS, Kittitas County is willing to accept and keep in its custody such inmate(s) in the Kittitas County Jail in exchange for Washington State Department of Corrections housing Kittitas County lnmates as mutually agreed upon by the parties; and WHEREAS, the governing bodies of each of the parties to the lnterlocal Agreement attached hereto have determined to extend this lnterlocal Agreement by action taken at a regular meeting; and NOW, THEREFORE, BE IT HEREBY RESOLVED, that the BOArd Of COUNTY Commissioners of Kittitas County, Washington authorizes the execution by the Sheriff of Kittitas County of an extension to the lnterlocal Agreement for the Housing of lnmates that is attached hereto, and incorporated herein by this reference, and which shall be forthwith filed with the Kittitas County Auditor pursuant to RCW 39'34.040. ADoPTED tnis 2 \ gT day of U 2026. BOARD cou COMMISSIONERS KITTI , WASHINGTON Co right, ChfgWilT mith, Vice-Chairman acz, Commissioner of the Board- Julie Kjorsvik (Deputy Clerk of the Board-It/anCy€,rcltffilz J D di Lare an i' RESOLUTION Washington State Department of Corrections K1,4078 'tt'tHiltss ltNll'lFrl\sslt'l\'lflE COlKlKlEtClflttOtNS C{OIvlilP'A\C1t' ("Compact" or ,,Agreement") is macle and entered into by and between the Washington State Department of Correctionq hereinafter referrec{ to as "WADOC," "DOC," or "Department," and Kittitas County, hereinafter refetred to as "County," pursuant to the artthority granted by Chapter 72.76 RCW. I,VHEREAS it is the purpose of this Compact to ma.cimize the use of existing resources and to provide aclequate facililies ancl programs for the confinement, care, treatment, and employment of Incarcerated Lrdivic{uals. Departrnent and Counly specifically find that the Agreement is necessary and desirable to provide aclequate housing and care or appropriate rehabilitation and heafment programs to the persons being trarrsferred. NOVV THEREFORE, in consideration of the terms and condihions contained herein, or attached and incorporated and made a part hereof, Department and County agree as follows: Article I DEFINITIONS Convictecl Felony lncarcerated tnclividual - A person r.vho has been convicted of a felony estatrlished by state la,,v ancl is eighteen years of age or older, or who is less than eighteen years of age, but lvhose case has been transferred by the appropriate juvenile cotrrt to a criminal court pttrsuant to RCW 13.40.110 or has been tried in a criminal court purstlant to RCW 13.04.030(1XeXv)' Extraorclinary Meclical Expense - Any medical expense beyond that rvhich is normally provicted by contract medical providers or other healrh care providers at the Facility of the Receiving ]urisdiction. Facility - Any state correctional institurtion, camp, or other unit established or authorized by lalv ttncter the jlrisc{iction of DOC; any jail, holcling, cletention, special detention, or correctional Facitity operated by County for the housing of aclLrlt Incarcerated Indir,'idtrals; or any contract Facility, operated" on behali of either Countv or DOC for the hottsing of adttlt lncarcerated h'rdividuals. lncarcerater-l Individual - A person r,rrho h.rs been charged lvitl'r and/or convicted of an offense established by applicable statute or ordinance' lncarcerated lnciividual Day - Any ctay an L'rcarcerated krdividual is in the custody oI the Receiving Jr.trisc{iction including the first day an Incarcerated tndividual is delivered to the Receiving Jurisdiction. An lncarcerated tndiviclual Day ends at midnight of the Incarcerated hdividural's release or retLlm to ilre custocly of the Sending |urisdiction. An L:rcarcerated Individual Day shall not include any day that is by state law the financial responsibility of the Receiving Jurisdiction or any other jurisdiction. Receiving jurisdicLion - Department or County, whichever is being sent an Incarcerated Individual from the other Party. Page 1 of 11.Washington State Depariment of Corrections K14078 26RAD Secretary - Sectetaty of DOC or his/her designee. Sending Jurisdiction - County or DOC, whichever has an hcarcerated hdividual that they want the other to house, Article II RIGHTS AND OBLIGATIONS All rights and obligations of the Parties to this Agreement shall be subject to and governed by the special terms and conditions contained in the text of this contract instrument and HIPAA AND DATA SECURITY REQUIREMENTS, attached hereto as Attachment A. Article III TERMOFTHE COMPACT Section 3.01 Term. The term of this Compact shall begin JuIy 01,2026, and continue until terninated as providecl below, Section 3,02 Termination. This Agreement may be terminated by any party, for cause/ non- appropriation of funds, or convenience, on thirty (30) days writtsr notice, delivered to the County Jail Director or the Contracts Administrator of DOQ as apptopriate, Within 30 days after the delivery of said notice, the Receiving lurisdiction/Sending Jurisdiction shall retake physicalcustody of their respective Incarcerated Individualsbeing housed atthe other's Facility pursuant to this Agreement, The requirement of written notice will not apply i-f the Receiving furisdiction/Sending Jurisdiction, in its sole discretio& determines the cause .for ternination creates an immediate threat to public safety, health, or welfate. Section 3,03 Termination Due to Unavailablllty of Funds. The payrnent of money by the Sending Jurisdiction under any ptovisions hereto is contingent upon lhe availability of funds appropriated to pay the sums purzuant to this Agreement. I-r the event funding for this Agreement becomes unavailable, withdrawn, reduced, insufficient, or limited in any way the Receiving ]urisdiction shall have ihe right to terminate this term of this Agreement without penalty and without the thirty (30) day notice period" except for services already provided. Section 3.04 Intrastate Conections Compact. The provisions of the Intrastate CorrectionsCompact, pursuant to RCW 72,76, are hereby made an integral part of this Compact and no ptovision of this Compact shall be construed io any manner inconsistent with historical intent and the provisions of the Intrastate Corrections Compact. Article IV SENDING JURISDICTION RESPONSIBILiTIES Wastrington State Department of Correcdons Page 2 of 11 26RAD K74078 Section 4.01 Incarcerated Individual Housing. The Receiving Jurisdiction shall conJine and supervise the Sending Jurisdiction Lrcarceraied Lrdividuals who are transferred to a Receiving Jurisdiction Facility purzuant to this Compact. No Incarcerated Individual shall be transferred until the Sending Jurisdiction has ensured that the Incarcerated Individual meets the Receiving ]urisdiction's screening aiteria. It is the understanding of the parties that providing available Facility space for the housing of the Sending furisdiction Incarcerated hdividuals is at the ReceivingJurisdiction's option. Nothing in this Compact shall be eonstrued to require the Receiving jurisdiction to provide space or to require the Sending ]urisdiction to present for confrnement any Sending furisdiction Incarcerated Individuals. Placement of the Sending furisdiction Lrcarcerated Individuals in the Facility may occrlr at any time alter the beginning oI the term of this Compact, Section 4.02 Delivery of Incarcerated Individuals. The $ending Iurisdiction, at its expense, will deliver lrcarcerated I:rdividual to the instihrtion designated by the Receiving ]urisdiction. Should the Incarcerated Individual fail to meet the screening criteria of the Receiving ]urisdiction or be rejected by the Receiving ]urisdiction for any other reasotr, the Sending ]urisdiction shall be responsible to retake the lncarcerated brdividual, The Sending Jurisdictionshall provide at least one set of the Incatcerated I-ndividual's personal clothing at the time of transfer, shall search tlrelncarcerated lrrdividual's clothing for contraband prior to the transfer, and shall store the Lrcarcerated Individual's personal property throughout the duration of the lncarcerated ftrdividual's incarceration unless other storage artangements are macle. Section 4.03 Return of Incarterated Individuals to SendingJurisdiction. 4.03.L The Sending jurisdiction may demand that its Irrcarcerated Brdividuals be returned to custody at the Sending Jurisdiction's Facility at any time. These transfers will be at the Sending furisdiction's expense and will be conducted with the Sending |urisdiction s staff or contracted staff at the Sending Jurisdiction's expense. 4.03.2 As soon as practicable, but not later than 7 days after receiving a request from the Receiving Jurisdiction to return an Incarcerated Individual, the Sending |urisdiction will accept custody at the Sending ]urisdiction Facility of any Incarcerated Individual whom the Receiving furisdiction reqlrests to be returned to the Sending |r"rrisdictionis custody, The Sending Jurisdiction's Iacarcerated Individual shall be teturned at the Sending [urisdiction's expense. 4.03.3 The Sending |urisdiction shall bear the cost should an Incarcerated Individual be refurned to the Sending |urisdiction as a result of any action by the Sending Jurisdiction or by a court of competent jurisdiction that prevents the Incarceratecl Lrdividual's confinement at the Receiving Jurisdiction-s Facitity. The Sendiag jurisdiction shall accept custody at its Facility immediately, under suchcircumstances 4,03.4 No Incarcerated Individuai who completes his or her sentence, is released by a court order, or is placed on probation or parole shall be released directly from the Receiving Washington State Department of Cortcctiotls Page 3 of 11 26RAD Kl4078 |urisdiction's Facility. Prior to releasing the Incarcerated trdividuaL fronr custody, the hrcarcerated Individual shall be retumed to the Sending Jurisdiction or to the custody of such iurisdiction as has agreed to take the Incarcerated Individual. These transfers will be at the Sending turisdictior/s expense. Section 4.04 Jurisdiction. The Sending Jurisdiction shall maintain jurisdiction over the transferred Incarcerated Individual. Secfion4.05 ScreeningCriteria. The Sending Jurisdictiorl prior to transfer of the Incarcerated Individual, shall ensure that the ReceivingJurisdiction screening criteria is met, Section 4.05 Notification of Sentencing Court. The $ending Jurisdiction, prior to transfer of the Incarcerated Individual, must notify the sentencing court(s) of the name, chargeg cause numbets, date and place of transfer of any ftrcarcerated Individual prior to transfet on a "form to be provided by the Department. Section 4,07 Records Furnished to Receiving jurisdictlon by Sending Jurisdiction. The Sending Jurisdiction must furnish the Receiving Jurisdiction with copies or summaries of the records relating io medical needs, behavior, and classification of the Incarcerated Individual upon transfer, These records must include: 1) a copy of the commitment order or orders legally authorizing the conjinement of the Incarcerated Individual; 2) a copy of the form notifying the sentencing court of the transfer; 3) a snmmary of the Incarcerated Individtral's criminal history, medical needs, behavioral problems, and other information relevant to the classification of the Incarcerated Individuaf and 4) a standard identification card which includes the fingerprints and a photograph of the Incarcerated Individual, Section 4.08 Public Records. The Sending Jurisdiction shall be responsible for disclosure of public records pertaining to the Incarcerated lndividual and any cosfs associated with disclosure of those records, unless the Receiving Jurisdiction generated those records, Section 4,09 Medical Care. The Sending Jurisdiction shall pay all extraordinary or emergency medicai expenses incurred by the Incarcerated Individual and will provide the Incarcerated Inclividual with at least a three-day supply of medication when the Incarcerated hrdividual is transferred to the Receivingfurisdiction. This includes payment of costs to transpori the hcarcerated Individual to and from medical appointments for medical care not available at the Facility. Section 4.10 Notification of Release Date. The Sending Jurisdiction shall calculate the Incarcerated Lrdividual's good time and notify the lncarcerated Inclividual of his/her release date. The Sending ]urisdiction shall notify the Receiving Jurisdictioo in writing, of the Incarcerated Individual's release c{ate, Washington State Departrnent of Cortections Page 4 of 11 25RAD K14078 Section 4.11 Notification of Coordinator. The Sending Jurisdiction shall notify the Receiving Jurisdiction of the Sending furisdiction coordinator responsible for administering the Compact, Should the coordinator be absent for an extendecl period of time, the coordinator shall arrange for, and notify the Receiving Jurisdiction in writing, of the alternate contact person during the coordinatot's absence, Section 4.12 Access to Courts. Receiving ]urisdicLion agrees to provide Sending furisdiction Incarcerated Individuals in Receiving ]urisdiction custody under lhis Compact meaningful access to the courts througl'r: (a) the use of court-appointed attorneys to satisfy their Sixth Arnendment right to counsel, (b) access to contracted attorneys provided by the Sending ]urisdictiory andior (c) access to legal resource materials at Receiving [urisdiction. Receiving Jurisdiction also agrees to provide the Sending Jurisdictior/s Incarcerated Individuals access to assigned or appointed attorneys in accordance with security and operating needs and consistent with access granted to Receiving |urisdiction Incarcerated hdividuals, 4.12,1, Sending Jurisdiction will appear and defend Receiving jurisdiction from any challenges to confinement or convictiory zuch as petitions under habeas corpus, Section 4.13 Reconciliation of Incarcerated Individual Days and Costs. When the two Parties to this Agreement transfer trcarcerated Individuals to each other, there shall be a reconciliation of the number of Incarcerated Individual Days accrued by each Party, If the number of Incarcerated Individual Days accrued by eadr Party is equal, no payment for Incarcerated Individual Days is necessary for the affected period except extraordinary medical, legal and ttansport costs. If the number of Incarcerated Individual days is not equal, the Party accruing the lesser number of Brcarcerated Individual Days may credit any obligation of fhe other Party against their future obligations or may bill the other Party for the excess ac$ued Incarcerated irrdividual Days at the daily rate set by the Office of Financial Management under RCW 70.48,440, unless the Parties have agreed to another rate for a particular transfer. Section 4.14 Transportation and Security. The Sending Jurisdiction shall provide transportation and security {or Incarcerated Individuals being transported to and from courtappearances, Section4.15 [nspections. The Sending Jurisdiction shall have the right to inspect and or audit the Receiving furisdiction's Faciiity at iis discretion, with or without advance notice, Article V RECETViNG JURISDICTION RESPONSDILITIES Section5.0l Supervlsion. The Receiving ]urisdicHon shall be responsible Ior the supervision of the Ircarcerated Individuals that it accepts into srstody ftom the Sendinglurisdiction. Washington State Department of Corrections Page 5 of 11 26RAD Kl4078 Section 5.02 Scrrening Criteria. The Receiving |trrisdiction shall establish screening criteria for the Incarcerated Ilrdividuals it will accept for transfer and will notify the Sending )urisdiction if the Incarcerated krdividtral does not meet the soeening criteria. Section 5.03 Orientation. Upon an Incarcerated Individual's arrival at a Receiving ftuisdiction Facility, the Receiving Iurisdiction shall provide an orientation fot the Incarcerated hdividual. This orientation must address the following conditions at the Receiving Jurisdiction Facility: 1) requirements to work; 2) Facility rules and disciplinary procedures; 3) medical care availability; 4) visitation rules. Section 5.04 Clothing. 6.L2.,1, The Receiving Jurisdiction will be responsible for laundering, repair, and replacement of t:carcerated Inctividual clothing during the Sending furisdiction Incarcerated Individual's incarceration at the Facility to enzure clean clothes and a minirnum of 1 set of clothing upon admission and with clean clothing and bedding on a weekly basis thereafter. 5.12.2 The Receiving Iurisdiction shall provide work clothing and equipment appropriate to the Incarcerated hrdividual's assignment. 6.123 The Receiving Jurisdiction shall ftirnish Incarcetated Individuals with climate appropriate outerwear. 6.L2,4 The Sending ]urisdiction Incarcerated hrdividuals retutned to the Sending ]urisdiction fiom the ReceivingJurisdictionlacility shall have the allotted amount of lrcarcerated Lndividual clothing authorized by the Sending Jurisdiction. Section 5.05 Transferable Items. The Receiving Jurisdiction shall provide to the Sending |urisdiction a list of allowable items that may be translerred with the Incarcerated Individual. Section 5.06 Medical Care, The Receiving Jruisdiction shall be responsible for providing tegular rnedical care, incl.uding prescription medications, to the Sending ]urisdiction Lrcarcerated lndividual at the Receiving furisdiction's expense, The Receiving ]urisdiction shall nofify the Sending Jurisdiction as far in advance as practicable prior to incurring costs as a tesult of extraordinary medical care. The Receiving furisdiction shall notify the Sending Jurisdiction as soon as practicable afJer an Incarcerated Individual teceives emergercy medical care. Section 5,07 Compensation for Work. Incarcerated Individuals transferred to a Receiving Jurisdiction Facility who participate in programs of Lrcarcerated lrdividual employment shall receive the same reimbursement, if any, as other Incarcerated trdividuals performing similat work. Washington State Department of Corrections Page 6 of 11 25RAD K74078 Only those Incarcerated Individuals who have been convicted may be reguired to work. Section 5.08 Rules. The Receiving Jurisdiction shall notify the Sending furisdiction Incarcerated hdividuals upon arrival of the rules of the jurisdiction and the specific rules of the Facility. lrcarcerated Individuals will be required to follow all rules of the Receiving Jurisdiction. Section S.fi)Discipline, The Receiving ]urisdiction shall provide disciplinary detention to the Sending Jurisdiction lncarcerated Individuals at the discretion of the Receiving ]urisdiction, The Receiving furisdiction may require the Sending Jurisdiction to retake any lncarcerated ]:rdividual found guilty of a seriousinfraction; similarly, the Reeeiving Juriscliction may require the Sending Jurisdiction to retake any Incatcerated trdividual whose behavior requires segregated or protective housing. Section 5,10 MonthlyReports. The Receiving |urisdiction institution housing the sending Jurisdiction Incarcerated Individuals shall provide montlrly repolts to each Sending |urisdiction on the number of Incarcerated hdivicluals housed for the Sending Jurisdiction under the Cornpact. Section 5.11 Notification of Coordinator. The Receiving furisdiction shal1 notily the Sending Jurisdiction of identity of the Receiving Jurisdiction coordinator responsible for administering the Compact. Should the coordinator be absent for an extended period of time, the coordinator shall arrange for, and notify the Sending |urisdiction in writing, of the alternate contact person during the coordinator's absence. Section 5.12 Legal Costs. The Receiving ]urisdiction shall bear legal costs relating to the defense of actions arising from events that occur at the Receiving ]urisdiction institution while the lrcatcerated Individual is in the Receiving Jurisdiction's custody. Section 5.13 Facility Operations. The Receiving jurisdictionls management of Lrcatcerated Individuals in the Facility shall be consistent with the management of other Incarcerated Individuals at the Facili$ and in accord.ance with current legal requirements. The Receiving |urisdiction sha1l maintain staffing levels at the Facility in sufficient numbers and rank to maintain the safety of the public, staff, and Incarcerated Individuals and to adequately carry out the provisions of this agreement. Section5.14 ReliglousOpportunity. The Receiving Jurisdiction shall provide adequate space and opportunity within the Facility for religious setvices, Section5,15 Telephone. Washington State Departmeni of Corrections Page 7 of 11 26RAD Kl4078 Access to telephone service comparable to that provided to brcarcerated Individuals by the Sending Jurisdiction shall be provided to all transferred Incarcerated Individuals, Section 5.16 RESERVED Section 5.17 RESERVED $ection 5.18 Section 5,19 Section 5.20 Section 5.21 Section 6.1 Washington State Department of Corrections Grievance Procedrrrea. Initial Sending ]urisdiction trcarcerated Lndividual grievances shall behandled by the Receiving ]urisdiction, consistent with the Receiving Jurisdiction's grievance procedures. The Sending ]urisdiction staff shall handle appeals or additional review of the Sending Jutisdiction ktcarcerated Irdividual grievances. Access to Courts. Tlre Sending |ruisdiction shall be responsible to provide meaningful access to the courts through: (a) the use of court appointed attorneys to satisfy their Sixth Amendment right to counsel, (b) contmcted attorneys, or (c) legal materials at the Receiving Facilify, If meaningfui access is to be provided througlr legal materials at the Facility, the Sending Jurisdiction shall oupplernent the Receiving fudsdiction's legal materials as required to meet constitutional needs of trcarcerated }rdividuals. The Receiving jurisdiction will provide the ftrcarcerated Individual opportunity io access to legal materials at the Facilityor to their attorney in accordance with security and operating needs and consistent with access granted to other Incarcerated hdividuals. Death of an Incarcerated Individual The Receiving Jurisdiction will immediately notify the Sending jurisdiction via telephone of any hrcarcerated lndividual death and shall have the death reviewed by the coroner of the local jurisdiction. The Receiving Jurisdiction shall also forward a certiJied copy of the death certiiicate, autopsy report Incarcerated Individual's file and medical records to the Sendinglurisdiction Escape of an Incatcerated Individual. The Receiving ]urisdiction will irnmediately notify the Sending |urisdiction via telephone of any Incarcerated Individual escape, The Receiving Jurisdiction shall aiso notify all local law en-forcement agencies of the escape. Article VI RECEIVING JURISDICTION EMPLOYEES Indep endent Contractor. Receiving Jurisdiction shall perform its duties hereunder as an independent contractor and not as an employee. Neither the Receiving Jurisdiction nor any agent or employee of the Receiving |urisdiction shall be deemed to be an agent or employee of the Sending furisdiction, The Receiving Jurisdiction shall pay, when due, all required employment taxes and ncome tax withholding including all Federal and State income tax and local head tax on any monies paid purzuant to this Compact. The Receiving jurisdiction Page I of11K74478 25RAD Section 6.2 Section 6.3 Sectlon 7.1 Section 7.2 Section 7.3 Section 7.4 Section 7.5 WashingtonState Department of Corrections shall have no authorization, express or implied to bind the Sending Jurisdiction to any agreements, liability or understanding except as expressly set forth herein. Personnel. The Receiving |urisdiction shall retain suffrcient personnel to deliver twenty- four (24) hours of care and supervision to Incarcerated Individuals, as well as administrative and support service personnel for the overall operation of the Facility, Prior to employment at the Facilitp applicants shall be subjected to a thorough background dreck, Tralning. Ttre Receiving lurisdiction will train all personnel of the Facility. The Receiving lurisdiction shall be responsible for all claims, damages, liability and court awards including costs, expenses and attorney fees incurred as a result of any action or omission of its employees, agents, subcontractors or assignees incurred in connection with training. Artide VII MISCELLANEOUS Existing State Law. This Compact shall not be construed to alter the legal responsibilities of the Sending and Receiving Jurisdictions with regard to the legal and fiscal responsibility for housing of Incarcerated Individuals under state law. Disputes. Disputes between the Sending and Receiving |urisdicHon$ may be submitted to arbitration if tkre Parties are unable to resolve any disputes arising hereunder. No disputes may be submitted to arbituation without the agreement of bothParties. Equal Employment Oppottunity. The Parties ascribe to the principles of equal employment opportunity. Neither is responsible for ensuring that the other is in compliance with equal employment $tatutes or policies. Invalidity and Severability. To the extent that this Compact may be executed and performance of the obligations of the parties may be accomplished within the intent of the Compact, the terms of this Compact are sevetal and should any terrn or provision hereof be declared invalid or become inoperative fot any reaso& such jnvalidity or failure shall not affect the valiclity of any other term or provision hereof. ftr the event that any provision of this Compact is held invalid, that provision shall be null and void. However, the validity of the remaining provisions of the Compact shall not be affected thereby. |urisdiction and Venue, The laws of the State of Washington and the rules and regulations issued pursuant thereto shall be applied in the interpretation, execution and enforcement of this Compact. Venue for any legal action related to the performance or interpretation of this Compact shall be in the Superlor Court in Thurston County, Washington. Page 9 oI 11K14078 26RAD Section 7.6 Section 7.7 Section 7.8 Section 8.1 8."1.4 Washlngton State Department of Corrections Compllance. The Department will ensure that all employees, vendors, and volunteers that have contact with either Party's Lncarcerated Individuals comply with all federal and state laws regarding sextral misconduct induding, but not limited to: 8.1.1 The Prison Rape Elimination Act of 2003 (PREA); 8.L.2 The standards for adult Prisons and Jails or Comrnunity Confinement Facilities; \,Vhichever is applicable, as promulgated by the US Attorney; and 8.1,3 Zero tolerance toward all forrns of sexual abuse and sexual harassment. The Department need not Require PREA Compliance by the County to maintain arrangements regarding temporary housing for the purpose of probation or parole violations or temporary transfers for court appearances or testimony. TREMAINDER OF THE PAGE INTENTIONALLY LEFT BLANK. SIGNATURE PAGE FOLIOWS.] Scope of Agreement, This Compact and any appendices or exhibits to it incorporate all the agreements/ covenants/ and understandings between the Parties. No prior agreement or understandings, verbal or otherwise, of the Parties or their agents shall be valid or enforceable unless embodied in this Compacl This Compact shall not be altered, changed or amended except by mutual consent of the Parties in writing. Compliance with Applicable Laws. The Parties shall at all times during the performance of their obligations of this Compact, shictly adhere to all applicable federal and state laws and regulations. Indemnification. Each Party agrees to be responsible and assume liability for its own wrongful and/or negligent acts or omissions or those of their officials, officers, agents or employees to the fullest extent require by law, and further agrees to save, indemnify, defen4 and hold the other Party(s) to the hrtrastate Compact harmless from any such liability. It is further provided that no liability shall attach bo the County by reason of entering into the Intrastate Compact except as expressly provided herein, Article VIII PREA - SEXUAL MISCONDUCT Page 10 of l1Kl4U78 26RAD THIS AGREEMENT, consisting of eleven (11) pages and one (1) attachment, is executed by the persons signing belorv rvho warrant that they have the authority to execttte the AGREEIvIENT' KITTITAS COUNTY WASHINGTON STATT, DEPARTNIENT OF CORRECTIONS Huntsinger, Daryl A. (DOC) (sts*K4 c.tA't ,t '/EE S (Printed Name)(Printed Name) Contracts Administrator6//Ett Digitally signed by Huntsinger, Daryl Date: A. (DOC) 2026.07.24 O9'.33:O7 -07' 00'C?r- (Signahrre) Daryl Huntsinger (Title) 7.zf .&( (Title) July 24,2026 (Date)(Date) Approved as to Form: This Agreement format rvas approved by the Office of the WashinBton State Attorney Cer1eral Washington State Department of Corrections Page 1l of 11K14078 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS Par-t 1: HIPAA Requirements 1. Definitions. a, "Bu$iness Associate," as used in this Agreement, means the "Contractor" and generally has the same meaning as the term "business associate" al45 CFR 1 60. 1 03. Any reference to Business Associate in this Agreement includes Business Associate's employees, agents, officers, Subcontractors, third party contractors, volunteers, or directors. b. "Business Associate Agreement" means this HIPAA Compliance section of the Agreement and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights. c. "Breach" means the acquisition, access, Lrse, or disclosure of Protected Health lnformation in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected Health lnformation, with the exclusions and exceptions listed in 45 CFR 164.402. d. "Covered Entity" means DOC, a Covered Entity as defined at 45 CFR 160.103, in its conduct of covered functions by its health care components. e. "Designated Record Sef' means a group of records maintained by or for a Covered Entity, that is: the medical and billing records about tndividuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used in whole or part by or for the Covered Entity to make decisions about lndividuals. f. "Electronic Protected Health lnformation (EPHI)'means Protected Health lnformation that is transmitted by electronic media or maintained in any medium described in the definition of electronic media at 45 CFR 160"103, g. 'HIPAA" means the Health lnsurance Portability and Accountability Act of 1996, Pub. L. 104-191, as modified by the American Recovery and Reinvestment Act of 2009 ("ARRA'), Sec. 13400 * 13424, H.R, 1 (2000) (HITECH Act). h. "HIPM Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and Part 164. i, "lndividual(s)" means the person(s) who is the subject of PHI and includes a per$on who qualifies as a personal representative in accordance with 45 CFR 164.502(9). j. "Minimum Necessary" means the least amount of PHI necessary to accomplish the purposeforwhich the PHI is needed. k. "Protected Health lnformation (PHl)" means individually identifiable health information created, received, maintained or transmitted by Business Associate on behalf of a Washington State Department of Corrections Kl4078 Attachment A Page 1 of 19 25RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS health care component of the Covered Entity that relates to the provision of health care to an lndividual; the past, present, or future physical or mental health or condition of an lndividual; or the past, present, or future payment for provision of health care to an lndividual. 45 CFR 160.103, PHI includes demographic information that identifies the lndividual or about which there is reasonable basis to believe can be used to identify the lndividual. 45 CFR 160,103. PHI is information transmitted or held in any form or medium and includes EPHI. 45 CFR 160.103. PHI does not include education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USCA 1232g(a)(4)(BXiv) or employment records held by a Covered Entity in its role as employer, "security lncidenf' means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system. m. "subcontractor' as used in this HIPAA Compliance section of the Agreement means a Business Associate that creates, reoeives, maintains, or transmits Protected Health lnformation on behalf of another Business Associate, n. "Use" includes the sharing, employment, application, utilization, examination, or analysis, of PHI within an entity that maintains such information. 2, Compliance. Business Associate shall perform all Agreement duties, activities and tasks in compliance with HIPM, the HIPAA Rules, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Otfice of Civil Rights. 3. Use and Disclosure of PHl. Business Associate is limited to the following permitted and required uses or disclosures of PHI: a. Duty to Prolect PHl. Business Associate shall ptotect PHI from, and shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health lnformation) with respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided for in this Agreement or as required by law, for as long as the PHt is within its possession and control, even after the termination or expiration of this Agreement. b. Minimum Necessary Standard. Business Associate shall apply the HIPAA Minirnum Necessary standard to any Use or disclosure of PHI necessary to achieve the purposes of this Agreement. See 45 CFR 164.514 (d)(2) through (dxs). c. Disclosure as Part of the Provision of Services. Business Associate shall only Use or disclose PHI as necessary to perform the services specified in this Agreement or as required by law, and shall not Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of lndividually ldentifiable Health lnforrnation) if done by Covered Entity, except for the specific uses and disclosures set forth below. Washington State Department of Corrections KL4W8 Attachment A Page 2 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS d, Use for Proper Management and Administration. Business Associate rnay Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. e. Disclosure for Proper Management and Administration, Business Associate may disclose PHI for the proper management and adrninistration of Business Associate or to carry out the legal responsibilities of the Business Associate, provlded the disclosures are required by law, or Business Associate obtains reasonable assurances frorn the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifios the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached. f, lmpermissible Use or Disclosure of PHl. Business Associate shall report to DOC in writing all Uses or disclosures of PHI not provided for by this Agreement within one (1) business day of becoming aware of the unauthorized Use or disclosure of PHl, including Breaches of unsecured PHI as required at 45 CFR 164,410 (Notification by a Business Associate), as well as any Security lncident of which it becomes aware. Upon request by DOC, Business Associate shall mitigate, to the extent practicable, any harmful effect resulting from the impermissible Use or disclosure, g. Failure to Cure, lf DOC learns of a pattern or practice of the Business Associate that constitutes a violation of the Business Associate's obligations under the terms of this Agreement and reasonable steps by DOC do not end the violation, DOC shall terminate this Agreement, if feasible. ln addition, lf Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate's obligations under the terms of their contract and reasonable steps by the Business Associate do not end the violation, Business Associate shall terminate the Subcontract, if feasible. h. Termination for Cause. Business Associate authorizes irnmediaie termination of this Agreement by DOC, if DOC determines that Business Associate has violated a material term of this Business Associate Agreement, DOC may, at its sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause. Consent to Audit. Business Associate shall give reasonable access to PHl, its internal practices, records, books, documents, electronic data and/or all other business information received from, or created or received by Business Associate on behalf of DOC, to the Secretary of DHHS andior to DOC for use in determining compliance with H I PAA privacy requi rernents. j. Obligations of Business Associate Upon Expiration or Termination, Upon expiration or termination of this Agreement for any reason, with respect to PHI received from DOC, Washlngton State Department of Cotrections KL4078 Attachment A Page 3 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of DOC, Business Associate shall: k, Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; l. Return to DOC or destroy the remaining PHI that the Business Associate or any Subcontractors stillmaintain in any form; m. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health lnformation) with respect to Electronic Protected Health lnfomation to prevent Use or disclosute of the PHl, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI; n. Not Use or disclose the PHI retained by Business Assoclate or any Subcontractors other than for the purpose$ for which such PHI was retained and subject to the same conditions set out in the "Use and Disclosure of PHl" section of this Agreement which applied prior to termination; and o. Return to DOC or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities. p. Survival, The obligations of the Business Associate under this section shall survive the termination or expiration of this Agreement. 4. lndividual Rights. Accounting of Disclosures. a. Business Associate shall document all di$closures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures. b. Within ten (10) business days of a request from DOC, Business Associate shall make available to DOC the information in Business Associate's possession that is necessary for DOC to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2XiiXG) and 164.528(bX1). c. At the request of DOC or in response to a request made directly to the Business Associate by an lndividual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by lndividuals for an accounting of disclosures of PHl. d. Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested. Washington State Depariment of Corrections K:L4O7B Attachment A Page 4 of 19 26RAD ATTAGHMENT A HIPAA AND DATA SECURITY REOUIREMENTS 5. Access. a, Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by DOC or the lndividual as necessary to satisfy DOC's obligations under 45 CFR 164.524 (Access of lndividuals to Protected Health lnformation). b. When the request is made by the lndividual to the Business Associate or if DOC asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164,524 (Access of lndividuals to Protected Health lnformation) on form, time and manner of access. When the request is rnade by DOC, the Business Associate shall provide the records to DOC within ten (10) business days. 6. Amendment. a, lf DOC amends, in whole or in part, a record or PHI contained in an lndividual's Designated Record Set and DOC has previously provided the PHI or record that is the subject of the arnendment to Business Associate, then DOC will inform Business Associate of the amendrnent pursuant to 45 CFR 16a.526(c)(3) (Amendment of Protected Health lnformation). b. Business Associate shall make any amendments to PHI in a Designated Record Set as direcied by DOC or as necessary to satisfy DOC's obligations under 45 CFR 164.526 (Amendment of Protected Health lnformation). 7. Subcontracts and other Third Party Agreements. ln accordance with 45 CFR 164.502(e)(1Xii), 164.504(eX1Xi), and 164.308(bX2), Business Associate shall ensure that any agents, Subcontractors, independent contractors or other third parties that create, receive, maintain, or transmit PHI on Business Associate's behalf, enter into a written contract that contalns the same terms, restrictlons, requirements, and conditions as the HIPAA compliance provisions in this Agreement with respect to such PHl. The same provisions must also be included in any contracts by a Business Associate's Subcontractor with its own business associates as required by 45 CFR 164.31a(a)(2)(b) and 164.504(e)(5). 8. Obligations. To the extent the Business Associate is to carry out one or more of DOC's obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of lndividually ldentifiable Health lnformation), Business Associate shall cornply with all requirernents that would apply to DOC in the performance of such obligation(s). 9. Liability, Within ten (10) business days, Business Associate must notify DOC of any complaint, enforcement or compliance action initiated by the Office for Civil Rights based on an allegation of violation of the HIPAA Rules and must inform DOC of the outcome of that action, Business Associate bears all responsibility for any penalties, fines or Warhington State Department of Correctlons Kl4078 Attachment A Page 5 of 19 26RAD ATTAGHMENT A HIPAA AND DATA SECURITY REOUIREMENTS sanctlons imposed against the Business Associate for violations of the HIPAA Rules and for any imposed against its Subcontractors or agents for which it is found liable. 1 0. Breach Notiflcatlon a. ln the event of a Breach of unsecured PHI or disclosure that cornpromises the privacy or security of PHI obtained from DOC or involving DOC clients, Business Associate will take all measures required by state or federal taw. b. Business Associate will notify DOC within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Agreement or not authorized by HIPM Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health lnforrnation as defined in 45 CFR 164,402 (Definitions). c. Business Associate will notify the DOC Contact shown on the cover page of this Agreement within one (1) business day by telephone or e-rnail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHl, type of Breach, origination and destination of PHl, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the narne, address, telephone nurnber, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the DOC Contact. Business Associate will coordinate and cooperate with DOC to provide a copy of its investlgation and other information requested by DOC, including advance copies of any notifications required for DOC review before disseminating and verification of the dates notifications were sent. d. lf DOC determines that Business Associate or its Subcontracto(s) or agent(s) is responsible for a Breach of unsecured PHI: (1) requiring notification of lndividuals under 45 CFR $ 164,404 (Notification to lndividuals), Business Associate bears the responsibility and costs for notifying the atfected lndividuals and receiving and responding to those lndividuals' questions or requests for additional informatlon; (2) requiring notification of the media under 45 CFR $ 164,406 (Notification to the media), Business Associate bears the responsibility and costs for notifying the media and receiving and responding to media questions or requests for additional information; (3) requiring notification of the U.S. Department of Health and Human Services Secretary under 45 CFR $ 104.408 (Notification to the $ecretary), Business Associate bears the responsibility and costs for notifying the Secretary and Washington Siato Department ol Corrections K14078 Attachment A Page 6 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS receiving and responding to the Secretary's questions or requests for additional information; and; (4) DOC will take appropriate remedial measures up to termination of this Agreement. 1 1. Miscellaneous Provisions. a. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or amended. b. lnterpretation. Any ambiguity in this Agreement shall be interpreted to perrnit compliance with the HIPAA Rules, Washington State Department of Cotrections K14078 Attachment A Page 7 of 19 26RAD I ATTACHMENT A HIPAA AND DATA SECURITV REOUIREMENTS Part2:. Data Security Requlrements Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions: a, "AE$" means the Advanced Enoyption Standard, a specification of Federal lnformation Processing Standards Publications for the encryption of electronic data issued by the National lnstitute of Standards and Technology (http://nvlpubs. nist. gov/nistpu bs/Fl PSiN lST. Fl PS, 1 97, pdfl. b. "Authorized Users(s)" means an individual or individuals with a business need to access DOC Confidential lnformation, and who has or have been authorized to do so. c. "Business Associate Agreement" means an agreernent between DOC and a contractor who is receiving Data covered under the Privacy and Security Rules of the Health lnsurance Portability and Accountability Act of 1996. The agreement establishes permitted and required uses and disclosures of protected health information (PHl) in accordance with HIPAA requirements and provides obligations for business associates to safeguard the information. d. "Category 3 Data" is Confidential information is information that is specifically protected from either release or disclosure by law. This includes, but is not limited to: 1. Personal information as defined in RCW 42.56.590 and RCW 19.255.10. 2. lnformation about public employees as defined in RCW 42.56.250. 3, Lists of individuals for commercial purposes as defined in RCW 42.56.070 4. lnformation about the infrastructure and security of computer and telecommunication networks as defined in RCW 42.56.420. e. "Category 4 Dafa" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences rnay arise in the event of any compromise of such data. Data classified as Category 4 includes but is not limited to data protected by: the Health lnsurance Portability and Accountability Act (HIPAA), Pub. L. 104-191 as amended by the Heatth lnformation Technology for Economic anij Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educatlonal Rights and Privacy Act (FERPA), 20 U.S.C. $12329; 34 CFR Part 99; lnternal Revenue Service Publication 1075 (https;/ir,vranv,irs.gov/pub/irs-pdf/p1075,pdf); Substance Abuse and Mental Health $ervices Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; and/or Criminal Justice lnformation Services, 28 CFR Part 20. Washington State Depalknent of Correctious KL4078 Attachmcnt A Page 8 of 19 26RAD ATTACHMENT A HIPAA AND DATA SEGURITY REOUIREMENTS f. "Cloud" rneans data storage on seryers hosted by an entity other than the Contractor and on a network outside the control of the Contractor, Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Ctoud storage can be divided between consumor grade storage for personal files and enterprise grade for companies and governmental entities, Examples of congurner grade storage would include iTunes, Dropbox, Box.com, and many other entities, Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace, g. "Encrypt" means to encode Confidential lnformation into a format that can only be read by those possessing a "key"; a password, digital certificate or other mechanism available only to authorized users. Enoyption must use a key length of at least 256 bits for symmetric keys, or 2M8 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AE$) must be used if available. h. "FedRAMP" means the Federal Risk and Authorization Management Program (see ranrvw,fedramp.gov), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Gloud computing products and services. "Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors. k, "Multi-factor Authentication" means controlling access to computers and other lT resources by requiring two or more pieces of evidence that the u$er is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PlN" means a personal identification number, a series of numbers which act ag a password for a device. Since PlNs are typically only four to six characters, PlNs are usually used in conjunction with another factor of authentication, such as a fingerprint. l, "Portable Device' means any computing device with a srnallform factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device, m. "Portable Media" means any machine readable media that may routinely be stored or moved independently of computing devices. Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, externa[ hard drives, and internal hard drives that have been removed from a computing device, Washington State Department of Correclions K14078 Attachment A Page9 ot19 25RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS n. "secute Area" means an area to which only authorized representatives of the entity possessing the Confidential lnformation have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk draweg within a room, as long as access to the Confidential lnformation is not available to unauthorized personnel. ln othenruise Secure Areas, such as an office with restricted access, the Data must be secured in such a way as to prevent access by non-authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non-authorized staff cannot access it. o. "Trusted Network" means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DOC Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data. p. "Unique User lD" means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system. q "Biometric identifier" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's retina or iris scan, fingerprint, voiceprint, DNA, or scan of hand or face geometry, except when such information is derived from: (i) Writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color; (ii) Donated organ tissues or parts, or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency; (iii) lnformation captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal health insurance portability and accountability act of 1996; or (iv) X-ray, roentgen process, computed tomography, magnetic resonance imaging (MRl), positron emission tomography (PET) scan, mammography, or other image or film of the human anatomy used to diagnose, develop a prognosis for, or treat an illness or other medical condition or to further validate scientific testing or screening. 2.Authority. The security requirements described in this document reflect the applicable requirements of Washington State Data Sharing Policy, WaTech SEC-08 (htlps://watech.wa.qovlpolicies/data-sharinq-policv'|, the terms and conditions set forth in this Agreement, and all applicable state and federal laws in its treatment of WA DOC Data. 3. Administrative Controls. The Contractor must have the following controls in place: a. A documented security policy governing the secure use of its computer network and systems, and which defines sanctions that may be applied to Contractor staff for Washington State Department of Correclion-q Ki4078 Attachment A Page 10 of 19 26RAD 4. WashingtonState Department of Corrections ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS violating that policy. b. Any data center $ecurity controls must meet or exceed those expected by the Federal lnformation Security Management Act (FISMA) for low to moderate impact systems as described in FIPS 199 and 200, and in the most cunent release of National lnstitute of Standards and Technology (NIST) Special Publications SP800- 53, including all other referenced Nl ST publications, c, Contractor warrants that all data collected, processed, routed, and/or stored by or through the service, or third-party service providers, remains at all times within the United Statos, d. lf the Data shared under this agreement is classified as Gategory 4, the Contractor must be aware of and compliant with the applicable legal or regulatory requirements for that Category 4 Data. e. lf Confidential lnformation shared under this agreement is classified as Category 4, the Contractor must have a documented risk asse$sment for the system(s) housing the Category 4 Dafa. Authorization, Authentication, and Acsess. ln order to ensure that access to the Data is limited to authorized statf, the Contractor must: a, Have documented policies and procedures governing access to systems with the shared Data. b. Restrict access through administrative, physical, and technical controls to authorized staff. c. Ensure that user accounts are unique and that any given user account logon lD and password combination is known only to the one employee to whom that account is assigned. For purposes of non-repudiation, it must always be possible to determine which employee performed a given action on a systern housing the Data based solely on the logon lD used to perform the action, d, Ensure that only authorized users are capable of accessing the Data, e. Ensure that an employee's access to the Data is removed immediately (1) Upon suspected cornpromise of the user credentials. (2) When their employment, or the contract under which the Data is made availabb to thern, is terminated. (3) When they no longer need access to the Data to fulfill the requirements of the contract. f. Have a process to periodically review and veriff that only authorized users have access to systems containing DOC Confidential lnformation. K14078 Attachment A Page 11 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS g. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Conhactor's neiwork, including: (1) A minimum length of B characters, and containing at least three of the followlng character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. (2) That a password does not contain a user's name, logon lD, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words- (4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. h. When accessing Confidential lnformation from an external location (the Data will traverse the lnternet or othenruise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: (1) Ensuring mitigations applied to the system don't allow end-user modification. (2) Not allowing the use of dial-up connections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network networks (using key lengths of 128 bits or greater) Algorithm modules validated by the National lnstitute of Standards and Technology (NIST) Crvptoqraohic Module Validation Proqram (CMVP) are required. The tratfic must be encrypted at alltimes while traversing any network, including the lnternet, which is not a Trusted Network. (5) Ensuring that the remote access system prompts for re-authentication or performs automated session termination after no more than 20 minutes of inactivity. (6) Ensuring use of Multi-factor Authentication to connect from the external end point to the internal end point. Authentication mechanisms must meet or exceed those described in the most recent version of NIST SP 800-63 for information requiring assurance level 3 or higher. One of the authentication factors should be provided by a device separate from the computer gaining access. (7) Ensuring all system and service accounts use Enterprise Active Directory or a similar centralized authentication and authorization mechanism. lf authentication methods such as SQL authentication are required by the system, Contractor uses credentials secured during transmission through encrypted sessions such as TLS1.2 (or greater) or lPSec, and in storage using a secure hash method validated !Vashington State Department of Corrections K14078 Attachment A Page 12 of 19 26RAD 5. ATTA,CHMENT A HlP,iqA AND DATA SECURITY REOUIREMENTS by the National lnstitute of Standards and Technotogy (NIST). Within 72 hours of a request from DOG, Contractor must provide documentation showing how the credentials are secured during alltransmissions using encrypted sessions such as TLS or lPSec, and in storage using a secure hash method validated by the National tnstitute of Standards and Technology (NIST). Passwords or PIN codes may meet a lesser standard ff used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: (1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor (2) Must not be comprised of all the same letter or number (111'11,22222, aaaaa, would not be acceptable) (3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable) j. lf the eontract specifically allows forthe storage of Confidential lnformation on a Mobile Device, passcodes used on the device must: (1) Be a minimum of six alphanurneric characters. (2) Contain at least three unique character classes (upper case, lower case, letter, number). (3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. k. Render the device unusable after a maximum of 10 failed logon attempts. Ensure the system/service supports single sign-on for state government employees, and external users by integrating the system's authentication mechanisms with the Washington State Enterprise Active Directory and $ecure Authentication Gateways (post listeners are typically used for processing the gateway host headers). m. Utilize application authentlcation controls that are consistent with those described in the most receni version of NIST SP 800-63 for information requiring assurance level 2 or higher. Protection of Data, The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a, Hard disk drives. For Data stored on localworkstation hard disks, access to the Data will be restricted to Authorized Use(s) by requiring logon to the localworkstation using a Unique User lD and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards, b. Network server disks. For Data stored on hard disks mounted on network seryers and made available through shared folders, access to the Data will be restricted to Washingion State Department of Cortections Kl4078 Attachment A Page 13 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User lD and Hardened Password or other authentioation mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, wlth access controlled through use of a key, card key, combination lock, or comparable rnechanism. For DOC Confidential lnformation stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise rneet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section B Data Disposition, may be deferred untilthe disks are retired, replaced, or otherwise taken out of the Secure Area. c, Optlcal discs (CDs or DVDs) In local workstation optical disc drives. Data provided by DOC on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be $tored in a Secure Area. Workstations which access DOC Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable rnechanism, d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers, Data provided by DOC on optical discs which will be attached to networkservers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only afterthe Authorized User has authenticated to the network using a Unique User lD and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e. Paper documents. Any paper records must be protected by storing the records in a Secure Area which is only accessible to authorized personnel. When not in use, such records must be stored in a Secure Area. f, Remote Access. Access to and use of the Dala over the State Governmental Network (SGN) or Secure Access Washington (SAW will be controlled by DOC staff who will issue authentication credentials (e,9. a Unique User lD and Hardened Password) to Authorized Users on Contractor's staff, Contractor will notifu DOC statf immediately whenever an Authorized User in possession of such credentials is terminated or otheruvise leaves the employ of the Contractor, and whenever an Authorlzed User'$ duties change such that the Authorized User no longer requires access to perform work for this Contract. g, Data storage on portable devices or media. (1) Except where otherwise specified herein, DOC Data shall not be stored by the Contractor on portable devices or media unless specificatly authorized within the Washington $taLe Department of Corre ctions Kl4078 Attachment A Page1,4of 19 26RAD ATTAGHMENT A HIPAA AND DATA $ECURITY REOUIREMENTS terrns and conditions of the Agreement. lf so authorized, the Data shall be given the following protections: (a) Encrypt the Data. (b) Control access to devices with a Unique User lD and Hardened Password or stronger authentication method such as a physicaltoken or biometrics, (c) Manually lock devices whenever they are left unattended and set devices to tock automatically after a period of inactivity, if this feature is availabte, Maximum period of inactivity is 20 minutes, (d) Apply administrative and physical security conhols to Portable Devices and Portable Media by: i. Keeping them in a Secure Area when not in use, ii. Uslng check-in/check-out procedures when they are shared, and iii, Taking frequent inventories. (2) When being transported outside of a Secure Area, Portabie Devices and Portable Media with DOC Confidential lnformation must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. h. Data stoted for backup purposes. (1) DOC Confidential lnformation may be stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. $uch storage is authorized until such time as that media would be reused during the course of normal backup operations. lf backup media is retired while DOC Confidential lnformation stillexists upon it, such media will be destroyed at that time in aceordance with the disposition requirements below in Section 8 Data Disposition. (2) Data may be stored on non-portable media (e,9. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. lf so, such media will be protected as otherwise described in this exhibit, lf this media is retired while DOC Confidential lnformation still exists upon it, the data witl be destroyed at that time in accordance with the disposition requirements below in Section 8 Data Disposition. i, Cloud storage. DOC Confidential lnformation requires protections equalto or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DOC nor the Contractor has control of the environrnent in which the Data is stored. For this reason: (1) DOC Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: Washington State Dcpartment of Corrections K14078 Attachment A Page 15 of 19 26RAD 6. ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS (a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed. (b) The Data witl be Encrypted while within the Contractor network. (c) The Data will remain Encrypted during transmission to the Cloud (d) The Data will remain Encrypted at all times while residing within the Cloud storage solution. (e) The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DOC. (f) The Data will not be downloaded to non-authorized systems, meaning systems that are not on either the DOC or Contractor networks. (g) The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within either the DOC or Contractor's network. (2) Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to all of the requirements within this exhibit; or, (b) The Cloud storage solution used is FedRAMP certified. (3) lf the Data includes protected health inforrnation covered bythe Health lnsurance Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. $ystem Protection, To prevent compromise of systems which contain DOC Data or through which that Data passes: a. $ystems containing DOC Data m.ust have allsecurity patches or hotfixes applied within 3 months of being rnade available, b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timefrarnes, c. Systems containing DOC Data shall have an Anti-Malware application, if available, installed. d. Anti-Malware software shall be kept up to date. The product, its anti-virus engine, and any malware database the system uses, will be no rnore than one update behind current. These anti-malware practices must meet or exceed those described in NIST sP80040. Washington State Department of Correctiors K14078 Attachment A Page 16 of 19 26RAD ATTACHMENT A HIPAA AND DATA SECUHITY REOUIREMENTS e. The architecture must provide continuous monitoring of both internal and external activity for anomalies and identify, report, and defend against security intrtrsions before data is compromised. f. Contractor shall conduct penetration tests at least once every 24 months, system vulnerability assessments at least monthly, and application vulnerability assessments prior to the production release of any changes to source code. g. Contractor has implemented applicationlsystem development practices consistent with the current version of NIST SPB00-64 for low to moderate impact systems, and warrants the software does not contain any of the Open Web Application Security project (OWASP) top 10 vulnerabilities - https://www.owasp.orq/index.phplMain Paqe h. Contractor has a practice of systematic collection, monitoring, alerting, maintenance, retention, and disposal of security event logs and application audit trails. Logs and audit trails are written to an area inaccessible to system users and are protected from editing. At a minimum the logs and audit trails will provide historical details on all transactions within the system that are necessary to reconstruct activities. lncluding recording; type of event, date, time, account identification and machine identifiers for each logged transaction. Audit and log files can be analyzed by type in order to find emerging issues or trends. Contractor has settings triggering an immediate notification to appropriate system administrators for severe incidents. Logs are secured against unauthorized changes. At a minimum, logs must be retained for a period of 6 months. 7. Data Segregation. a. DOC Data must be segregated or otherwise distinguishable from non-DOC data. This is to ensure that when no longer needed by the Contractor, all DOC Data can be identified for return or destruction. lt also aids in determining whether DOC Data has or may have been compromised in the event of a security breach. As such, one or more of the following methods will be used for data segregation. (1) DOC Data will be kept on media (e.9. hard disk, opticaldisc, tape, etc.) which will contain no non-DOC Data. And/or, (2) DOC Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to DOC Data. And/or, (3) DOC Data will be stored in a databasewhich will contain no non-DOC data. And/or, (4) DOC Data will be stored within a database and will be distinguishable from non- DOC data by the value of a specific field or fields within database records. (5) When stored as physical paper documents, DOC Data will be physically segregated from non-DOC data in a drawer, folder, or other container, b. When it is not feasible or practical to segregate DOC Data from non-DOC data, then both the DOC Data and the non-DOC data with which it is commingled must be protected as described in this exhibit. Washington State Department of Corrections Kr4078 Attachment A Page 17 of 19 26RAD 8. ATTACHMENT A HIPAA AND DATA SECUHITY REOUIREMENTS Data Disposltion. When the contracted work has been completed or when the Data is no longer needed, except as noted above in Section 5.b, Data shall be returned to DOC or destroyed. Media on which Data may be stored and associated acceptable methods of destruction are as follows: Notification of Compromise or Potential Compromise. Contractor shall implement incident response practices consistent with NIST SP 800-61. The actual compromise of DOC Data must be reported to the DOC Contact designated in the Agreement within three (3) business days of disoovery. lf no DOC Contact is designated in the Agreement, then the notification must be reported to the DOC Contracts and Legal Affairs office at docclacontracts@doc1.wa.gov. Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DOC. Data shared with Subcontractors. lf DOC Data provided under this Agreement is to be shared with a subcontractor, the Agreementwith the subcontractor must include allof the data security provisions within this Agreement and within any amendments, attachments, or exhibits within this Agreement. lf the Contractor cannot protect the Data as articulated within this Agreement, then the contract with the sub-Contractor must be submitted to the DOC Contact specified for this contract for review and approval. $ystem Audit Requirements, Contractor has completed a recent independent security audit by a SOC 2 Type 2 accredited firm of their development and operational practices, or that an independent security audit by an accredited firm will be completed within 6 months after contract execution, This audit must include vulnerability assessments, and 9. 10. 11. Washlngton State Department of Corrections K14078 Attachment A Page 18 of 19 26RAD Data stored on:Will be destroyed by: Server or workstation hard disks, or Removable media (e.9. floppies, USB flash drives, portable hard disks) excluding optlcal discs Using a "wipen utilig which will ovenirrrite the Data at least three (3) times using either random or single character data, or Degaussing sutficiently to ensure that the Data cannot be reconstructed, or Phvsically destrovino the disk Paper docurnents with sensitive or Confidential I nformation Recyeling through a contracted firm, provided the contract with the recycler assures that the confidentialitv of Data will be protected. Paper documents containing Confidential lnformation requiring special handling (e.9. protected health information) On-site shredding, pulping, or incineration Optical discs (e.9. CDs or DVDs)lncineration, shredding, or completely defacing the readable surface with a coarse abrasive Magnetic tape Degaussing, incinerating shreddino or crosscut 12. 12. Washington State Department of Corrections ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS penetration tests, and confirm compliance with the security requirements herein. The audit should include any specific data center facility where the service is deployed, and all failover facilities unless those facilities provide their own SOC 2 Type 2 audit. Disaster Recovery. Contractor shall document, test and maintain a disaster recovery plan including an alternate facility to assure the systern/service is recovered within 24 hours of a force majeure event. The recovery plan must protect against more than 24 hours of DOC data being lost. lnsurance Requlrements. lf this agreement involves the Contractor collecting, stoilng, creating, altering, processing, transmitting, routing, or handling any DOC Category 3 or Category 4 data, then Contractor shall obtain and maintain for the duration of the Agreement, at Contractor's expense, the fotlowing insurance coverages which the parties agree are unaffected by any limitation of liability language within this Agreement, a. Technology Professional Liability (errors and omissions) The Contractor shall maintain Technology Professional Liability (errors and omissions) insurance, to include coverage of claims involving infringement of intellectual property. This shall include but is not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of elecfonic information, release of private information, alteration of electronic information, extortion, network security, regulatory defense (including fines and penalties), and notification costs. The coverage lirnits must be at least $1,000,000 per covered claim without sublimit, and $2,000,000 annual aggregate, b. Grime and Employee Dishonesty The Contractor shall maintain Employee Dishonesty and (when applicable) Inside/Outside Money and $ecurities coverages for property owned by the State of Washington in the care, custody, and controlof Contractor, to include electronic theft and fraud protection. The coverage limits must be at least $1,000,000 per covered claim without sublimit, $2,000,000 annual aggregate. c. Cyber Risk Liability lnsurance The Contractor shall maintain coverage for Cyber Risk Liability, including information theft, computer and data loss replacement or restoration, release of private information, alteration of electronic information, notification costs, credit monitoring, forensic investigation, cyber extortion, crises management, public relations expenses, regulatory defense (lncluding fines and penalties), network security, and liability to third parties from failure(s) of contractorto handle, manage, store, and control personally identifiable information belonging to others. The policy must include full prior acts coverage. The coverage limits must be at least $1,000,000 per covered claim without sublimit, $2,000,000 annual aggregate, K]4078 Attachment A Page 19 of 19 25RAD