HomeMy WebLinkAbout120213_ca04W pso Consent Agenda
t JEFFERSON COUNTY PUBLIC HEALTH
615 Sheridan Street o Port Townsend o Washington o 98368
www.jeffersoncountypublichealth.org
November 15, 2013
JEFFERSON COUNTY
BOARD OF COUNTY COMMISSIONERS
AGENDA REQUEST
TO: Board of County Commissioners
Philip Morley, County Administrator
FROM: Jean Baldwin, Director
DATE: D(- C2r' -1V, - �x 2-0 I
SUBJECT: Agenda Item — Agency Agreement with Department of Social and
Health Services for Partnerships for Success; November 1, 2013 —
September 30, 2014; $53,912
STATEMENT OF ISSUE:
Jefferson County Public Health requests Board approval of the Agency Agreement with Department of Social
and Health Services for Partnerships for Success; November 1, 2013 — September 30, 2014; $53,912
ANALYSIS/ STRATEGIC GOALS /PRO'S and CON'S:
This contract will fund the enhancement for the current Prevention Redesign process. The contract will
cover the additional cost of a .5 FTE to work on coalition building to have strategic plan in place by next
spring. Ongoing implementation of the strategic plan will continue through the rest of the contract period.
Outcome measures will be collected when /if interventions are identified.
FISCAL IMPACT /COST BENEFIT ANALYSIS:
This contract represents new federal funding. Funding will cover the cost of additional hours for the work
on coalition building in order to have the strategic plan in place by next spring.
JCPH management request approval of the Agency Agreement with Department of Social and Health
Services for Partnerships for Success; November 1, 2013 — September 30, 2014; $53,912
REV
;z
Rftg',p' Morley, 11ou n Administrator:- - Date
COMMUNITY HEALTH PUBLIC HEALTH ENVIRONMENTAL HEALTH
DEVELOPMENTAL DISABILITIES WATER QUALITY
MAIN: (360) 385 -9400 ALWAYS WORKING FOR A SAFER AND MAIN: (360) 385 -9444
FAX: (360) 385 -9401 HEALTHIER COMMUNITY FAX: (360) 379 -4487
DSHS Central Contract Se Aces
6017CF: County Program Agreement (2-23-2012)
/3
e, erson o. imcut
David Alvamz, Chief vil DPA
Page I
DSHS Agreement Number
COUNTY
141,11, n Stat e
or
1363-90011
SC)CIAL&HEALTH
RIO _DEPA1+WV
SERVICES
PROGRAM AGREEMENT
Partnerships for Success
This Program Agreement is by and between the State of Washington
Administration or Division
Department of Social and Health Services (DSHS) and the County identified
Agreement Number
below, and is issued in conjunction with a County and DSHS Agreement On
County Agreement Number
General Terms and Conditions, which is incorporated by reference.
DSHS ADMINISTRATION
DSHS DIVISION
DSHS INDEX NUMBER
DSHS CONTRACT CODE
Behavioral Health and Service
Division of Behavioral Health
1223
1 OOOCC-63
Inte ration
and Recovery
DSHS CONTACT NAME AND TITLE
DSHS CONTACT ADDRESS
Steve Smothers
4500 10th Avenue SE
Prevention Services Lead
Lacey, WA '98503
DSHS CONTACT TELEPHONE
DSHS CONTACT FAX DSHS CONTACT E-MAIL
(360) 725-3767
(360) 438-8057 smothsw2dshs.wa,gov
COUNTY NAME
COUNTY ADDRESS
Jefferson County
615 Sheridan St
Port Townsend, WA 98368-
CO KTY FEDERAL EMPLOYER IDENTIFICATION
COUNTY CONTACT NAME
NUMBER
Julia Danskin
COUNTY CONTACT TELEPHONE
COUNTY CONTACT FAX
COUNTY CONTACT E -MAIL
�360) 385 -9420
(360) 385-9401
1 ,
I idanskina co, jefferson.wa.us
IS THE COUNTY A SUBRECIPIENT FOR PURPOSES OF THIS PROGRAM
NUMBERS
AGREEMENT?
rCFDA
93,243
Yes
PROGRAM AGREEMENT START DATE
PROGRAM AGREEMENT END DATE
IM P;Zn
MAXII MUM PROGRAM AGREEMENT AMOUNT
11/01/2013
1 09/30/2014
$53,921 M
EXHIBITS. When the box below is marked with an X, the following Exhibits are attached and are incorporated into this
County Program Agreement by reference:
Exhibits (specify)- Exhibit A - Data Security Requirements
No Exhibits.
The terms and conditions of this Contract are an integration and representation of the final, entire and exclusive
understanding Ibetwween the parties superseding and merging all previous agreements, writings, and communications, oral
or otherwise, regarding the subject matter of this Contract. The parties signing below represent that they have read and
understand this Contract, and have the authority to execute fts Contract, This Contract shall be binding on DSHS only
upon signature . . . . .............. . . . .... . . . . ...
COUNTY SIGNATURE(S)
PRINTED NAME(S) AND TITLE(S)
DATE(S) SIGNED
DSHS SIGNATURE
PRINTED NAME AND TITLE
DATE SIGNED
DBHR Contracts
DSHS Central Contract Se Aces
6017CF: County Program Agreement (2-23-2012)
/3
e, erson o. imcut
David Alvamz, Chief vil DPA
Page I
Definitions.
a. "Awards" means the total funding of all individual awards DSHS allocates to the County, and the
total of all awards in this Contract's Maximum Amount, which is itemized, per service, in Exhibit B.
lb. "BARS" means the Washington State Auditor's Office Budgeting, Accounting, and Reporting
System which includes the DSHS HRSA-RASA Supplementary Instructions and Fiscal Policy
Standards for Reimbursable Costs as used by DBHR.
c. "Behavioral Health Administrator or BHA" means the DSHS contact identified on page one of this
Contract.
d. THISA" means Behavioral Health and Service Integration Administration.
e. "Bollerplate Language" means the standard Contract language, including General and Special
terms, which will be common to all subcontracts issued by the County for provision of the services
required by this Contract.
f. "'Chemical Dependency" means an alcohol or drug addiction, or dependence on alcohol and one or
more other psychoactive chemicals.
g. "Community Prevention and Wellness Initiative" or "CPWI" means the DSHS substance abuse
prevention delivery system that focuses prevention services in high-need communities in
Washington State as selected by County and approved by DSHS.
h. "Contract Coordinator" means the person designated by the legislative authority of a County to
carry out administrative and oversight responsibilities of the County prevention programs.
1, "Contract Manager" means the DSHS contact identified on page one of this Contract.
j. "Data" means information that is disclosed or exchanged as described by this Contract.
K "DBHR" means the Division of Behavioral Health and Recovery or its successor.
I. "Ensure" as to this Contract means to make sure that something will happen or will be available
within the resources identified in Consideration.
m. "Media materials and publications" means:
News Release: A brief written announcement your agency provides to reporters highlighting key
events, research, results, new funding and programs, and other news.
Paid Media: Any advertising spaceltime that is purchased for prevention/coalition messages
(printed publications/newspapers, online, outdoor, on-screen, TV and radio).
Earned Media: Published news stories (print, broadcast or online) resulting from the Counties'
contacts with reporters.
Donated Media: Also known as public service announcements. Any free advertising space or time
from broadcast, print, outdoor, online, and other advertising vendors. Social Media: Also referred to
as new media: messages posted online on Facebook, Twitter, YouTube and similar sites.
n. "Performance-based Prevention System" or "PBPS" means the management information system
maintained by DSHS that collects planning, demographic, and prevention service data.
DSHS Central Contract Services
601 7CF Colunty Program Agreement (2-23-2012) Page 2
o. "Partnership for Success" or "PFS" means the federal grant funding officially titled the Strategic
Prevention Framework- Partnerships for Success (SPF-PFS) CFDA loo, '93.243 awarded to DSHS
by the Substance Abuse and Mental Health Services Administration (SAMHSA).
p. "Prevention Activity Data" means information input to PBPS to record all active prevention services
including outcome measures. This information will be used to verify services identified in A -19
invoices prior to payment and must be entered into PBPS by the close of business of the fifteenth
(15") of each month for prevention activities provided during the previous month.
q. "Prevention System Manager" (PSM) means the designee assigned by the BHA to manage day to
day responsibilities associated with this Contract.
2. Purpose.
The purpose of this Contract is to provide enhanced funding from the Partnership for Success (PFS)
grant award for substance abuse prevention programs and services to high-need communities currently
receiving funding from DSHS to implement the CPWI.
3. Statement of Work.
For the period November 1, 2013 through September 30, 2014, the County shall provide the services
and staff, and otherwise do all things necessary for or incidental to the performance of work, as set
forth below-,
a. CPWI Enhancement
The County shall use PFS funds to coordinate and implement prevention programs designed to
prevent or delay the misuse and abuse of alcohol, prescription drugs and marijuana. Prevention
programs and services include enhanced implementation of the CPWI.
(1) Provide CPWI services in accordance with the Key Objectives found in the Community Coalition
Guide located on the Athena Forum website which outlines the iminimal standards to participate
in the CPWI and ideal benchmarks that are possible with additional funding.
§IggLtheathenaforum. !sltes/defau�lt/fil�es/(,or,iit-nL�!��LD. , ifion%20GL de%20F
............................. . . . . . gi Ji
VNAL%200
gll/,L2()150/ 2013.pdf
(2) Submit an annual PFS budget with projected expenditures including salary and benefits for
DSHS funded prevention staff, program costs, training and travel to the Prevention System
Manager (PSM), within 30 days of when this Contract is executed. A template will be provided.
The PSM must approve the budget before services are implemented.
(3) Submit and update of CPWI Coalition's approved Strategic Plan that shall include an updated
logic model and an enhanced action plan for proposed services with PFS grant funds to the
PSM, within 30 days of when this Contract is executed. Action Plan and Logic Model templates
are available in the Community Coalition Guide. The updated plan shall demonstrate an
updated summary of needs assessment information, if necessary, to update the logic model and
action plan. The PSM must approve the updated plan before services are implemented.
(4) Enter approved programs into the PBPS prior to implementation based on the priorities, goals
and objectives described in the approved updated Strategic Plan. Cohort 3 approved programs
include the CPWI Coalition and may include other programs as negotiated with BHA or
designee.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 3
(5) Ensure sixty percent (unless negotiated with BHA or designee) of programs supported by DSHS
funds will be replications or adaptations of "Evidence-based Practice" substance abuse
prevention programs as identified in the PBPS.
(6) Ensure all of the programs supported by DSHS will meet the Center for Substance Abuse
Prevention's (CSAP) Principles of Effective Substance Abuse Prevention, found on the Athena
Forum Website.
b, Prevention Training
(1) The County shall participate in all required training events identified by DSHS and listed in the
DBHR Community Coalition Guide.
(a) In the absence of a strategic plan and for trainings not identified in the approved strategic
plan, all additional (non - required) training paid for by DSHS shall be approved by BHA or
designee prior to training and meet the approved goals and objectives in PBPS.
(b) The County shall ensure any requests for training are requested in writing and sent directly
to the PSM, a minimum of ten working days before the date of the proposed training.
Trainings shall relate to one of the following four categories.
i. Coalition building and community organization.
ii. Capacity building regarding prevention theory and practice.
iii. Capacity building for evidence based practice and environmental strategy
implementation, related to the goals and objectives of the coalition's approved strategic
plan.
iv. Capacity building in high need communities that meets overall goals and objectives of
CPI in order to expand CPWI efforts may be approved by BHA or designee upon
request.
(3) The County shall ensure training paid for by DSHS that requires travel follows state travel
reimbursement guidelines accessible at hftp:/Iwww,ofm.wa-gov/policy/l 0.90. htm,
(4) The County shall bill for training events on an A -19 per BARS code 22.7 and record training
events in the DSHS Performance Based Prevention System (PBPS) in accordance with the
monthly reporting requirements described in Section 2. d., Prevention Report Schedule / Due
Dates.
c, Background Checks, (RCW 43.43, WAC 388-877 & 388-877B)
(1) The County shall ensure a criminal background check is conducted for all staff members, case
managers, outreach staff members, etc. or volunteers who have unsupervised access to
children, adolescents, vulnerable adults, and persons who have developmental disabilities.
(2) When providing services to youth, the County shall ensure that requirements of WAC 388-06-
0170 are met.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 4
Media materials and publications developed with DSHS funds shall be submitted to the PSM for
approval prior to publication (DSHS will respond within 5 working days). DSHS must be cited as the
funding source in news releases, publications, and advertising messages created with or about
DSHS funding. The funding source shall be cited as: Washington State Department of Social and
Health Services. The DSHSIBHSIA logo may also be used in place of the above citation.
Exceptions: The County does not need to submit the following items to PSM:
(1) Newsletters and fact sheets.
(2) News coverage resulting from interviews with reporters. This includes online news coverage.
(3) Newspaper editorials or letters to the editor.
(4) Posts on Facebook, YouTube, Tumblr, Twitter and other social media sites.
(5) When a statewide media message is developed by DBHR is localized.
(6) When the current SAMHSA-sponsored media campaign is localized. (As of August 2013, this is
the "Talk Hear You" campaign." tttpL.//www.samhsa.g q��L k.Ln dfLa
_ _ _
(7) The County is still encouraged to submit copies of these items to PSM.
e, Reporting Requirements.
(1) PFS Grant Reporting Requirements
The County Shall report on all required PFS grant requirements as identified in the DSHS
Performance Base Prevention System (PBPS). Specific reporting elements shall be identified by
DSHS at a later date. DSHS reserves the right to add reporting requirements based on
requirements of PFS grant.
(2) Prevention Activity Data Reports
The County shall*
(a) Ensure that monthly prevention activities are reported in the DSHS PBPS in accordance
with the requirements and timelines set forth below.
(b) Ensure demographic information is provided for each participant in single events, mentoring,
environmental and recurring programs,
(c) Provide Community Coalition Coordination Reports on its efforts in the PBPS for each
month of the calendar year.
(d) Complete Prevention Reports according to the Schedule / Due Dates, below:
DSHS CentraG Contract Services
6017CF County Program Agreement (2-23-2012) Page 5
REPORTING
Report Due
Reporting
PERIOD
REPORT(s)
Dates
System
One-time
Programs approved by
. . ........
30 days after
DBHR for Year ending
execution of
PBPS
Reports
September 30, 2014
Contract
As r uested_
GPRA Measures
As re uested
PBPS
Prevention activity data
input for all active
services including
15" of each
community coordination
month for
PBPS
coalition efforts, services,
activities from the
participant information,
previous month
pre-tests, post-tests, and
assessments.
Monthly
15tfi of each
PBPS
Community Based
month for
Coordination (if
activities from the
applicable)
previous month
15 of each
PBPS
Training Report
month for
activities from the
previous month
(3) Outcome Measures
The County shall report on all required pre/post-tests in PBPS Program Selection Instruments
identified in the PBPS.
Special situations and exceptions regarding pre/post tests and Program Selection Instruments
identified in the P8PS include, but are not limited to, the following:
(a) The County may negotiate with the Prevention System Manager to reduce multiple
administrations of surveys to individual participants,
(b) Participants in recurring program groups in which the majority of participants are younger
than 10 years old on the date of that group's first service.
(c) Recurring programs that spend less than $1,000 of DSHS prevention funds each biennium.
(d) Programs that only provide single service events.
(e) Environmental/Media services.
(4) Performance Work Statement / Evaluation
(a) The County shall ensure program results show positive outcomes for at least half of the
participants in each program group.
L Positive outcomes means that at least half of the participants in a group report change
between pre and post-tests consistent with the positive outcome goal.
DSHS Central Contract Services
601 7CF County Prograrn Agreement (2-23-2012) Page 6
ii, Positive outcomes will be determined using the pre-test and post-test data reported in
the Performance Based Prevention System (PBPS).
iii. Survey results will be compared against the stated outcome for the program,
iv. Evaluation of PBPS data will occur on the 15th of the month following the final date of
service for each group.
(b) DSHS shall use the following protocol for evaluation:
Matched pre-test and post-test pairs will be used in the analysis.
ii. To allow for normal attendance drop-off, a 20% leeway will be given for missing post-
tests:
HL If there are missing post-tests for entered pre-tests in excess of 20% of pre-tests,
missing post-test will be counted as a negative outcome.
Example: there are 10 pre-tests and 7 post-tests. The denominator would be 8 and the
maximum numerator would be 7,
(c) Different groups receiving the same program will be clustered by school district.
i. In cases where multiple providers are serving the same school district, groups will be
clustered by school district and provider.
ii. The results of one provider in a given school district will not impact another provider in
the same district.
(d) In cases where the survey instrument selected for a given program includes more than one
scale, the scale that is most closely aligned with the outcome linked to the program in PBPS
will be used.
(e) Results for groups with services that span two contracting periods will be analyzed in the
contracting period that the post-test was administered.
if fewer than half of the participants in a group, within a given school district, report positive
change in the intended outcome:
L The County shall submit a Performance Improvement Plan (PIP) for the non-compliant
program to the DSHS CONTACT or designee within 45 days of notice by DSHS.
iL Reimbursement for the CSAP Category row on the A19 for that program will be held until
the PIP is approved by the DSHS CONTACT or their designee.
iii. If a second group within that same school district has fewer than half of the participants
report positive change in the intended outcome, then the following steps will be taken:
(A) In cases where there is no active non - compliant program, the Contractor shall
discontinue implementation of that program within the specified geography.
(B) In cases where the same programs as the non-compliant program are active and
continuing in the same school district, those groups will be allowed to complete the
expected number of sessions. No new groups will be started.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 7
(C) Following the conclusion of all groups completing the program, results will be
reviewed for those groups.
(D) If the results do not show positive change for each group, the County shall take the
following action:
1. In cases where the program is being delivered by a single provider i
(7) Audit requirements - 0 M B Circular A -133 audit requirements if applicable to the subcontractor
(8) Authorizing facility inspection
(9) Background Checks
(10) Conflict of interest
(11) Debarment and suspension certification
(12) Indemnification
(13) Nondiscrimination in employment
(14) Nondiscrimination in prevention activities
(15) Performance Based Contracts
(16) Providing data
(17) Records and reports
(18) Requirements outlined in the Data Sharing provision in the Contract
(19) Services provided in accordance with law and rule and regulation
(20) PBPS; data input and reconciliation
(21) Treatment of assets
(22) Unallowable use of federal funds
b, Subcontract Inspection
DSHS reserves the right to inspect any subcontract document.
c. Subcontractor Monitoring.
(1) On-Site Monitoring',
The County shall
(a) Conduct a subcontractor review which shall include at least one on-site visit, during the
Contract period, to each subcontractor site providing services to monitor compliance with
subcontract performance criteria for the purpose of documenting that the subcontractors are
fulfilling the requirements of the subcontract.
(b) Include written documentation of each on-site visit in the annual report on the
"Subcontractor On-site Form." A copy of the full report shall be kept on file by the County,
Hm��M
The County shall ensure that subcontractors have entered services funded under this Contract
in the PBPS,
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 9
(3) Additional Monitoring Activities
The County shall maintain records of additional monitoring activities in the County's
subcontractor file and make them available to DSHS upon request including any audit and any
independent documentation,
(4) Subcontractor monitoring, using a DSHS approved subcontract monitoring protocol, including
,annual on-site reviews of programs that directly serve children and/or families,
(5) The County shall obtain prior approval before entering into any subcontracting arrangement. In
addition, the County shall submit to the DSHS Program Manager identified on Page I of the
Contract at least one of the following for review and approval purposes:
(a) Copy of the proposed subcontract to ensure it meets all DSHS requirements; or
(b) Copy of the County's standard Contract template to ensure it meets all requirements and
approve only subcontracts entered into using that template; or
(c) Certify in writing that the subcontractor meets all requirements under the Contract and that
the subcontract contains all required language under the Contract, including any data
security, confidentiality and/or Business Associate language, as appropriate.
d. Subcontractor Termination Requirements.
When terminating a subcontract, the County shall withhold the final payment of any subcontract
until all required PBPS reporting is complete. This applies for all subcontractor closures,
Consideration.
Total consideration payable to the County for satisfactory performance of the work under this Contract
is up to a maximum of $53,921, including any and all expenses, and shall be based on the following:
a. The source of funds is the Partners for Success Grant. The Catalog of Federal Domestic
Assistance number is 93.243.
b, Reimbursable Costs
The County shall ensure all expenditures for services and activities under this Contract are
submitted on the A -19 invoice appropriate for PBPS entry.
c, The County shall use no more than eight (8) percent of the total PFS funds for administrative costs.
(1) Administrative costs shall be billed separately from direct prevention services as indicated on
the A -19 invoice.
(2) Administrative costs are defined in the IDSHS HRSA-DASA Supplementary Instructions and
Fiscal Policy Standards for Reimbursable Costs as used by DBHR.
The County shall manage the Contract to ensure that services are provided in a manner that
allocates the available resources over the life of the Contract,
DSHS Central Contract Services
601 7CF County Program Agreement (2-23-2012) Page 10
e. Period of Performance Service Costs
The County shall ensure that service costs incurred are within the period of performance of this
Contract.
f, DSHS reserves the right to reduce the PFS funds awarded in the Contract if the County
expenditures are below 60% of expected levels during the fiscal quarter. Expenditures will be
reviewed quarterly.
Appropriate rate is defined as the percentage of expenditures being roughly equal to the
percentage of time in the Contract that has passed.
IT. Billing and Payment-
a, Invoice System
The County shall submit invoices using State Form A-19 Invoice Voucher, or such other form as
designated by DSHS. Consideration for services rendered shall be payable upon receipt of properly
completed invoices which shall be submitted to the DSHS Contact Person stated on page one (1) of
this Contract, by the County, not more often than monthly. The invoices shall describe and
document to DSHS' satisfaction a description of the work performed, activities accomplished, the
progress of the project, and fees. The rates shall be in accordance with those set forth in the
Consideration Section of this Contract.
b. Timely Payment
Payment shall be considered timely if made by DSHS within thirty (30) days after receipt and
acceptance by the DSHS Contact Person of the properly completed invoices. Payment shall be
sent to the address designated by the County on page one (1) of this Contract. DSHS may, at its
sole discretion, withhold payment claimed by the County for services rendered if County fails to
satisfactorily comply with any term or condition of this Contract.
c. DSHS Obligation for Payment
DSHS shall not be obligated to reimburse the County for any services or activities, performed prior
to having a fully executed copy of this Contract.
IRR • .
The County assures that work performed and invoiced does not duplicate work to be charged to the
State of Washington under any other Contract or agreement with the County.
e, Claims for Payment
The County shall:
(1) Submit invoices for costs due and payable under this agreement that were incurred prior to the
expiration date within 90 days of the date services were provided.
(2) The County shall submit final billing for services provided during each fiscal year within 90 days
after the end of that fiscal year.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 11
MMNZMO�.
(1) Failure to Maintain Reporting Requirements
In the event the County or a subcontractor fails to maintain its reporting obligations under this
Contract, DSHS reserves the right to withhold reimbursements to the County until the
obligations are met.
g, Recovery of Costs Claimed in Error:
If the County claims and D S reimburses for expenditures under this Contract which DSHS later
finds were (1) claimed in error or (2) not allowable costs under the terms of the Contract, DSHS
shall recover those costs and the County shall fully cooperate with the recovery.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 12
Exhibit A — Data Security Requirements
Definitions, The words and phrases listed below, as used in this Exhibit, shall each have the following
definitions:
a. "Authorized User(s)" means an individual or individuals with an authorized business requirement to
access DSHS Confidential Information.
b. "Hardened Password" means a string of at least eight characters containing at least one alphabetic
character, at least one number and at least one special character such as an asterisk, ampersand
or exclamation point.
c. "Unique User ID" means a string of characters that identifies a specific User and which, in
conjunction with a password, passphrase or other mechanism, authenticates a user to an
information system.
2. Data Transport, When transporting DSHS Confidential Information electronically, including via email,
the Data will be protected by:
a. Transporting the Data within the (State Governmental Network) SGN or Contractor's internal
network, or;
b. Encrypting any Data that will be in transit outside the SGN or Contractor's internal network. This
includes transit over the public Internet.
3. Protection of Data, The Contractor agrees to store Data on one or more of the following media and
protect the Data as described.,
a. Hard disk drives, (Data stored on local workstation hard disks. Access to the Data will be
restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID
and Hardened Password or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards.
Network server disks. Data stored on hard disks mounted on network servers and made available
through shared folders. Access to the Data will be restricted to Authorized Users through the use of
access control lists which will grant access only after the Authorized User has authenticated to the
network using a Unique User ID and Hardened Password or other authentication mechanisms
which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted
to such servers must be located in an area which is accessible only to authorized personnel, with
access controlled through use of a key, card key, combination lock, or comparable mechanism.
For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as
long as the disks remain in a Secured Area and otherwise meet the requirements listed in the
above paragraph. Destruction of the Data as outlined in Section 5. Data Disposition may be
deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area.
c, Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS
on optical discs which will be used in local workstation optical disc drives and which will not be
transported out of a Secured Area. When not in use for the contracted purpose, such discs must be
locked in a drawer, cabinet or other container to which only Authorized Users have the key,
combination or mechanism required to access the contents of the container. Workstations which
access DSHS Data on optical discs must be located in an area which is accessible only to
authorized personnel, with access controlled through use of a key, card key, combination lock, or
comparable mechanism.
DSHS Central Contract Services
6017CF County Program Agreement (2-23-2012) Page 13
cl. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by
DSHS on optical discs which will be attached to network servers and which will not be transported
out of a Secured Area. Access to Data on these discs will be restricted to Authorized Users through
the use of access control lists which will grant access only after the Authorized User has
authenticated to the network using a Unique User ID and Hardened Password or other
authentication mechanisms which provide equal or greater security, such as biometrics or smart
cards. Data on discs attached to such servers must be located in an area which is accessible only
to authorized personnel, with access controlled through use of a key, card key, combination lock, or
comparable mechanism.
e. Paper documents. Any paper records must be protected by storing the records in a Secured Area
which is only accessible to authorized personnel. When not in use, such records must be storied in
a locked container, such as a file cabinet, locking drawer, or safe, to which only authorized persons
have access.
Remote Access, Access to and use of the Data over the State Governmental Network (SGN) or
Secure Access Washington (SAW) will be controlled by DSHS staff who will issue authentication
credentials (e.g. a Unique User ID and Hardened Password) to Authorized Users on Contractor
staff. Contractor will notify DSHS staff immediately whenever an Authorized User in possession of
such credentials is terminated or otherwise leaves the employ of the Contractor, and whenever an
Authorized User's duties change such that the Authorized User no longer requires access to
perform work for this Contract.
g. Data storage on portable devices or media.
(1) Except where otherwise specified herein, DSHS Data shall not be stored by the Contractor on
portable devices or media unless specifically authorized within the terms and conditions of the
Contract. If so authorized, the Data shall be given the following protections:
(a) Encrypt the Data with a key length of at least 128 bits
(b) Control access to devices with a Unique User ID and Hardened Password or stronger
authentication method such as a physical token or biometrics.
(c) Manually lock devices whenever they are left unattended and set devices to lock
automatically after a period of inactivity, if this feature is available. Maximum period of
inactivity is 20 minutes.
Physically Secure the portable device(s) and/or media by
(d) Keeping them in locked storage when not in use
(e) Using check-in/check-out procedures when they are shared, and
(f) Taking frequent inventories
(2) When being transported outside of a Secured Area, portable devices and media with DSHS
Confidential Information must be under the physical control of Contractor staff with authorization
to access the Data.
(3) Portable devices include, but are not limited to; smart phones, tablets, flash memory devices
(e.g. USIB flash drives, personal media players), portable hard disks, and
laptop/notebook/netbook computers if those computers may be transported outside of a
Secured Area.
DSHS Central Contract Services
601 7CF County Program Agreement (2-23-2012), Page 14
13
(4) Portable media includes, but is not limited to: optical media (e.g, CDs, DVDs), magnetic media
(e.g. floppy disks, tape), or flash media (e.g. CompactFlash, SID, MIVIC).
h. Data stored for backup purposes.
(1) DSHS data may be stored on portable media as part of a Contractor's existing, documented
backup process for business continuity or disaster recovery purposes. Such storage is
authorized until such time as that media would be reused during the course of normal backup
operations. If backup media is retired while DSHS Confidential Information still exists upon it,
such media will be destroyed at that time in accordance with the disposition requirements in
Section 5. Data Disposition
(2) DSHS Data may be stored on non-portable media (e.g, Storage Area Network drives, virtual
media, etc.) as part of a Contractor's existing, documented backup process for business
continuity or disaster recovery purposes. If so, such media will be protected as otherwise
described in this exhibit. If this media is retired while DSHS Confidential Information still exists
upon it, the data will be destroyed at that time in accordance with the disposition requirements in
Section 5. Data Disposition.
EOEEMM��
a. DSHS Data must be segregated or otherwise distinguishable from non-DSHS data. This is to
ensure that when no longer needed by the Contractor, all DSHS Data can be identified for return or
destruction. It also aids in determining whether DSHS Data has or may have been compromised in
the event of a security breach. As such, one or more of the following methods will be used for data
segregation.
b, DSHS Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no
non-DSHS data. And/or,
c. DSHS Data will be stored in a logical container on electronic media, such as a partition or folder
dedicated to DSHS Data. And/or,
d. DSHS Data will be stored in a database which will contain no noin-DSHS data. And/or,
a. DSHS Data will be stored within a database and will be distinguishable from non-DSHS data by the
value of a specific field or fields within database records.
f. When stored as physical paper documents, DSHS Data will be physically segregated from non-
DSHS data in a drawer, folder, or other container.
g. When it is not feasible or practical to segregate DSHS Data from non-DSHS data, then both the
DSHS Data and the non-DSHS data with which it is commingled must be protected as described in
this exhibit.
5. Data Disposition. When the contracted work has been completed or when no longer needed, except
as noted in Section 3. Protection of Data b. Network Server Disks above, Data shall be returned to
DSHS or destroyed. Media on which Data may Ibe stored, and associated acceptable methods of
destruction are as follows:
Data stored on: Will be destroyed by:
Server or workstation hard disks, or Using a "wipe" utility which will overwrite the Data at
least three (3) times using either random or single
DSHS Central Contract Services
6017CF County Program Agreement (2..23-2012) Page 15
......... . . ...
Removable media (e.g. floppies, USB flash drives,
character data, or
portable hard disks) excluding optical discs
Degaussing sufficiently to ensure that the Data cannot
be reconstructed, or
Phy—sically destroying the d is k
._.....-
d-. .. .... .
per documents with sensitive or Confidential
information
Recycling through a contracted firm provided the
contract with the recycler assures that the
confidentiality of Data will be protected.
Paper documents containing, Confidential Information
On-site shredding, pulping, or incineration
requiring special handling (e.g, protected health
information
Optical discs (e.g. CDs, or DVDs)
Incineration, shredding, or completely defacing the
. .. . .......
readable surface with a coarse abrasive
. ..... . . ....... ... ......... . .. ........ ............... ......
..........
Magnetic tape
Degaussing, incinerat.i22. or crosscut shredding
G. Notification of Compromise or Potential Compromise. The compromise or potential compromise of
DSHS shared Data must be reported to the DSHS Contact designated in the Contract within one (1)
business day of discovery. If no DSHS Contact is designated in the Contract, then the notification must
be reported to the DSHS Privacy Officer at dshsprivacyofficer@dsh!S.wa.gov. Contractor must also
take actions to mitigate the risk of loss and comply with any notification or other requirements imposed
by law or DSHS.
7. Data shared with Subcontractors. If DSHS Data provided under this Contract is to be shared with a
subcontractor, the Contract with the subcontractor must include all of the data security provisions within
this Contract and within any amendments, attachments, or exhibits within this Contract. If the
Contractor cannot protect the Data as articulated within this Contract, then the contract with the sub-
Contractor must be submitted to the DSHS Contact specified for this contract for review and approval.
DSHS CentrM Contract Services
60170 F County Program Agreement (2-23-2012) Page 16