Case Management System for the District Attorney’s Office

1 RFP # 22-0084 Sedgwick County...Working for you REQUEST FOR PROPOSAL RFP #22-0084 CASE MANAGEMENT SYSTEM (CMS) FOR THE DISTRICT ATTORNEY’S OFFICE October 31, 2022 Sedgwick County, Kansas (hereinafter referred to as “county”) is seeking a firm or firms to provide a case management system for the District Attorney’s Office. If your firm is interested in submitting a response, please do so in accordance with the instructions contained within the attached Request for Proposal. Responses are due no later than 1:45 pm CST, January 31, 2023. All contact concerning this solicitation shall be made through the Purchasing Department. Bidders shall not contact county employees, department heads, using agencies, evaluation committee members or elected officials with questions or any other concerns about the solicitation. Questions, clarifications and concerns shall be submitted to the Purchasing Department in writing. Failure to comply with these guidelines may disqualify the Proposer’s

response. Sincerely, Lee Barrier Purchasing Agent LB/lj SEDGWICK COUNTY, KANSAS DIVISION OF FINANCE DEPARTMENT Purchasing Department 100 N. Broadway Suite 610 Wichita, KS 67202 Phone: 316 660-7255 Fax: 316 660-1839 https://www.sedgwickcounty.org/finance/purchasing/ requests-for-bid-and-proposal/ https://www.sedgwickcounty.org/finance/purchasing/requests-for-bid-and-proposal/ https://www.sedgwickcounty.org/finance/purchasing/requests-for-bid-and-proposal/ 2 RFP # 22-0084 Sedgwick County...Working for you Table of Contents I. About this Document II. Background III. Project Objectives IV. Submittals V. Scope of Work VI. Sedgwick County’s Responsibilities VII. Proposal Terms A. Questions and Contact Information B. Minimum Firm Qualifications C. Evaluation Criteria D. Request for Proposal Timeline E. Contract Period and Payment Terms F. Insurance Requirements G. Indemnification H. Confidential Matters and Data Ownership I. Proposal Conditions VIII. Required Response Content IX. Response Form X. Sedgwick County Non-Employee Information Technology Usage Agreement XI. HIPAA Rules 3 RFP # 22-0084 Sedgwick County...Working for you I. About this Document This document is a Request for Proposal. It differs from a Request for Bid or Quotation in that the county is seeking a solution, as described on the cover page and in the following Background Information section, not a bid or quotation meeting firm specifications for the lowest price. As such, the lowest price proposed will not guarantee an award recommendation. As defined in Charter Resolution No. 68, Competitive Sealed Proposals will be evaluated based upon criteria formulated around the most important features of the product(s) and/or service(s), of which quality, testing, references, service, availability or capability, may be overriding factors, and price may not be determinative in the issuance of a contract or award. The proposal evaluation criteria should be viewed as standards that measure how well a vendor’s approach meets the desired requirements and needs of the county. Criteria that will be used and considered in evaluation for award are set forth in this document. The county will thoroughly review all proposals received. The county will also utilize its best judgment when determining whether to schedule a pre-proposal conference, before proposals are accepted, or meetings with vendors, after receipt of all proposals. A Purchase Order/Contract will be awarded to a qualified vendor submitting the best proposal. Sedgwick County reserves the right to select, and subsequently recommend for award, the proposed service(s) and/or product(s) which best meets its required needs, quality levels and budget constraints. The nature of this work is for a public entity and will require the expenditure of public funds and/or use of public facilities, therefore the successful proposer will understand that portions (potentially all) of their proposal may become public record at any time after receipt of proposals. Proposal responses, purchase orders and final contracts are subject to public disclosure after award. All confidential or proprietary information should be clearly denoted in proposal responses and responders should understand this information will be considered prior to release, however no guarantee is made that information will be withheld from public view. II. Background Sedgwick County, located in south-central Kansas, is one of the most populous of Kansas’ 105 counties with a population estimated at more than 514,000 persons. It is the sixteenth largest in area, with 1,008 square miles, and reportedly has the second highest per capita wealth among Kansas counties. Organizationally, the county is a Commission/Manager entity, employs nearly 2,500 persons, and hosts or provides a full range of municipal services, e.g. – public safety, public works, criminal justice, recreation, entertainment, cultural, human/social, and education. Sedgwick County makes up the 18th Judicial District of Kansas. It is the largest judicial district in the state by case volume. The Office of the District Attorney in the 18th Judicial District is the largest prosecutor’s office in the state. The office has 158 FTEs, including 61 attorneys. In 2021, the office filed 21,836 cases. This included 2,475 adult criminal cases; 17,541 traffic cases; 192 consumer cases; 478 care and treatment cases; 531 juvenile offender cases, and 619 child in need of care cases. Historically, the office has filed more cases annually and expects to do so in the years ahead as we emerge from the COVID-19 related backlogs and other temporary external hardships. Over 1,700 cases were placed on diversion during 2021 and supervised by office personnel. This is a combination of adult criminal, juvenile offender and traffic cases. Also in 2021, the office handled 500 appeals, opened over 200 inquisitions, and processed over 14 terabytes of discovery. Due to the immense volume of cases handled by the office, a sophisticated and technologically advanced case management system is required to manage the day-to-day functions of the office in the most efficient way possible. Justware is the case management system used by the office since 2009. The office relies heavily on Justware and its ability to manage case related data and documents. It also is used extensively to generate documents, both automatically and through manual processes. The system selected should provide enhanced capabilities in discovery tracking and reporting, digital evidence management tools, and electronic document filing capabilities. The chosen system will ideally serve as the case management system of the office for the next 10-15 years. The selected system will also be used by the Department of Corrections (DoC) and the Sedgwick County Counselor’s Office. DoC will use the system for pre-trial services. They serve approximately 1700 clients annually. 4 RFP # 22-0084 Sedgwick County...Working for you The local District Court is phasing out the use of Full Court and will be transitioning to Odyssey by Tyler Technologies. This transition is currently projected to occur in August 2023. Likewise, the Sedgwick County Sheriff’s Office, numerous other local law enforcement agencies, and Sedgwick County Emergency Communications will be transitioning to a new Computer Aided Dispatch (CAD), Record Management System (RMS), and Jail Management System (JMS) by Tyler Technologies. Any system selected must have the capacity to interface with the new court and sheriff systems. Additional interfaces will also likely be required. The District Attorney’s Office is committed to the use of technology to increase efficiencies and to effectively manage all functions of the office. To that end, we are seeking an innovative product to provide highly effective solutions. This product must provide the ability to electronically collaborate with partner agencies thereby minimizing duplicate data entry. The selected system must also be capable of effectively managing digital case files as the office transitions to a “less paper” document management process. Electronic discovery and digital evidence management are also required functions of any system selected through this RFP process. Ideally, vendors will show the ability to meet these needs through successful partnerships with other prosecutor’s offices. The following list of case types are currently handled by the District Attorney’s Office. The successful proposal will demonstrate the ability to manage all data, documents, and processes associated with each case type. • 3.02 Exhibits • Adult Diversion • Appeals • Asset Forfeiture • Child in Need of Care (CINC) • Competency • Consumer • Criminal • Detainers • Drug Court • Expungements • Extraditions • Fish and Game • Inquisitions • Juvenile Diversion • Juvenile Offender • Kansas Open Meetings Act (KOMA) and Kansas Open Records Act (KORA) • Law Enforcement Officer (LEO) Use of Force • Lack of Prosecution (LOP) • Parole/Clemency • Pawn Shop • Personnel records • Search Warrants • Traffic • Traffic Diversion • Truancy In addition to these items, the successful proposal would also need to demonstrate the ability to manage all data, documents, and processes for cases involving violations of the Sedgwick County Code and other resolutions of the Board of County Commissioners. III. Project Objectives Sedgwick County, Kansas (hereinafter referred to as “county”) is seeking a firm or firms to provide a prosecutor case management solution for the Office of the District Attorney, Department of Corrections, and the County Counselor’s Office. The following objectives have been identified for this contract: 1. Acquire a case management solution, meeting the parameters, conditions and mandatory requirements presented in the document. 2. Establish contract pricing with the vendor that has the best-proven “track-record” in performance, service and customer satisfaction. 3. Acquire a case management solution with the most advantageous overall cost to the county. 5 RFP # 22-0084 Sedgwick County...Working for you IV. Submittals Carefully review this Request for Proposal. It provides specific technical information necessary to aid participating firms in formulating a thorough response. Should you elect to participate, please email the entire document with supplementary materials to: Purchasing@sedgwick.gov SUBMITTALS are due NO LATER THAN 1:45 pm CST, TUESDAY, January 31, 2023. If there is any difficulty submitting a response electronically, please contact the Purchasing Technicians at purchasing@sedgwick.gov for assistance. Late or incomplete responses will not be accepted and will not receive consideration for final award. If you choose to send a hard copy of your proposal, Sedgwick County will not accept submissions that arrive late due to the fault of the U.S. Postal Service, United Parcel Service, DHL, FedEx, or any other delivery/courier service. Proposal responses will be acknowledged and read into record at Bid Opening, which will occur at 2:00 pm CST on the due date. No information other than the respondent’s name will be disclosed at Bid Opening. We will continue to have Bid Openings for the items listed currently. If you would like to listen in as these bids are read into the record, please dial our Meet Me line @ (316) 660-7271 at 2:00 pm. V. Scope of Work Items listed in this section are requirements to completion of services under this contract. Contractor shall furnish labor, parts, material and equipment necessary to perform the following: A. Project Requirements Successful proposals should offer solutions for items listed below. Items denoted by “M” are mandatory and items denoted with a “D” are desirable. Description 5.1 Implementation: Provide detailed information regarding the implementation plan and schedule. Discuss any required 3rd party software. M 5.2 Data migration: Provide a solution for data migration. Include details regarding responsibilities of the District Attorney, Corrections and the County Counselor’s Office; any limitations of the amount of data transferred; duration of any downtime while migration is occurring; and quality checks of migrated data. Discuss 3rd party software or organizations required for migration, if any. M 5.3 Licensing: Provide information regarding licensing and maintenance agreements. Provide a sample agreement. Provide policy regarding source code. M 5.4 Appearance features: Provide detailed information regarding system appearance options. This includes, but is not limited to, fonts, colors, light/dark options as well the ability to change how and where data is displayed. Discuss options at system, group and individual user levels. D 5.5 Dashboard: Provide information regarding dashboards, both at the user level and system wide. Include information on available data, crime mapping ability, alerts/notifications, user functions and ability to generate reports. Also, provide information regarding public access “portals” or other means of limited public access. This should include general statistical information as well as the ability to search and access some case specific information. M 5.6 Training: Provide detailed information regarding user and administrator training plans and schedules. This should include information regarding training materials provided as well as any end user help features within the system. Describe any test environments used for training and/or data verification. Include information on ability to upload fresh data in order to replicate current production environment. Discuss options for maintaining test environment during implementation and beyond. Provide samples of current training materials. Discuss any ongoing training opportunities. M mailto:Purchasing@sedgwick.gov mailto:purchasing@sedgwick.gov 6 RFP # 22-0084 Sedgwick County...Working for you 5.7 Data exchange: Provide solutions for data exchanges with various internal and external systems. This should include information regarding previously successful integrations with other systems. Integration requirements for successful proposals will include, but are not limited to: Tyler Technologies (Odyssey and Sedgwick County Sheriff CAD/RMS/JMS system), Tybera (EFlex), OnBase and Apptricity. Demonstrate the system’s ability to replicate raw data to Sedgwick County owned server that can be accessed utilizing SAP Business Objects. Discuss how imported data can be utilized to minimize system data entry. M 5.8 Archival storage: Discuss any ability to move data to an archived status. Provide information on use of “hot” vs. “cold” storage. Include details on ability to recall data for viewing and reporting. Provide information on cost savings for archived data. D 5.9 Remote and mobile access: Provide detailed information regarding any ability to access the system remotely. This should include both remote computer access as well as any applications available for mobile devices. Provide detailed information about functions/features that are available through remote/mobile access. Provide details regarding security features to prevent unauthorized access. M 5.10 Data history: Provide information regarding ability to retain, view, search and track party specific information. This should include, but is not limited to, party phone number and address. Provide information regarding any change log/tracking features. M 5.11 Data search: Provide detailed information regarding system search capabilities. This should include party, case, Soundex, keywords and phrase searches. Describe abilities to search for demographic information, date ranges, alias, agencies, badge number, phone number and bar number. Provide information regarding search abilities across and/or within case types, divisions and agencies. Discuss any ability to identify duplicate name records. M 5.12 Calendaring/Event scheduling: Demonstrate calendaring features and ability to synch with Microsoft Office calendar. Provide detailed information regarding automated event scheduling and notifications. Demonstrate capabilities of system to interface events from other case management systems. Include solutions for docket management and ability to manage scheduling of court dockets. Provide details on ability to pull daily, weekly or monthly and filter by attorney, event, judges, etc. both historical and in the future. M 5.13 Automated notifications/tasks: Provide details regarding the system’s ability to create automatic notifications and to automate tasks. Describe how the system can monitor events and notify individual users and/or groups of users at completion of event and to provide notification for deadlines based on events. Include capabilities to automate specific tasks based on events. M 5.14 Business rules: Provide detailed information regarding ability to create business rules to minimize manual data entry. This includes ability to automatically complete data entry, generate documents, send notifications/alerts, generate reports as well as validate processes. M 5.15 Attorney assignments: Provide details for ability to assign multiple attorneys/investigators to a single case and to designate a “primary” attorney/investigator. This should include information regarding ability to track attorney changes and maintain a history of all assigned attorneys/investigators. Provide information regarding the ability to do “batch” assignments/reassignments. Include any limits on the number of attorneys/investigators that can be assigned to a case. Include information on ability to track attorney “teams” and caseloads. M 5.16 Case type features: Propose solutions for tracking various data and documents associated with case types indicated in Section II. Include information regarding ability to relate/connect cases together across various case types. Successful proposals should demonstrate ability to offer customizable solutions with a high degree of flexibility. M 5.17 Agency specific number tracking: Propose solutions for tracking multiple case/event numbers from various agencies. This should include, but is not limited to: law enforcement case numbers, Kansas Disposition Arrest Report (KDAR), Kansas Juvenile Disposition Report (KJDR), court case numbers, Originating Agency Number (ORI), and any unique system ID number. Discuss capability to coordinate and track numbers associated with individual cases. Discuss any limitations on the number or type of associated agency numbers. M 7 RFP # 22-0084 Sedgwick County...Working for you 5.18 Agency drop down: Provide detailed information regarding if agencies (law enforcement, probation, prosecution, court) rosters can be assigned as well as marked active or inactive to filter choices available making data entry of case involved parties easier. D 5.19 Code table mapping: Provide details on mapping codes from District Court’s CMS system (Odyssey) to codes in database of system. Describe process and if system administrator will have ability to add, delete, merge, and modify codes. M 5.20 System security: Provide detailed information regarding system security and auditing features. This should include information regarding various levels of security within the system and how those are administered. Provide solutions for restricting access on group and individual levels as well as case levels and individual data elements. Provide detailed information regarding auditing tools within the system to include means of auditing at the system, case and user levels for all changes (add, delete, and edit). Provide solutions for handling “sealed” cases. M 5.21 Data security: Provide detailed information regarding data security. This should include information regarding system compliance with industry security standards such as CJIS. If system is cloud based, provide detailed information regarding data centers, frequency of backup and backup redundancy. Discuss the data recovery process and expected downtime as well as any potential loss of data in the event of power failure or other disaster. M 5.22 Charging/Complaint: Propose solutions for case initiation/charging process. How will the system handle alternative counts, modifiers/enhancers and co-defendant cases with multiple different counts? Discuss the ability for case information to be imported from partner agencies to minimize data entry. Include information regarding imported data validation processes. Provide details regarding automatic generation of charging documents. Demonstrate case copy features. M 5.23 Batch subpoena process: Provide solutions for automating the subpoena generation process. Please include details regarding automated document generation and processes. This should include ability to automatically generate various related documents such as, subpoenas, restitution packets, hearing notification letters and list of subpoenaed witnesses. Discuss solutions for dealing with various subpoena categories, service types and other variables associated with subpoena process. Propose solutions for validation, backup and manual processes in the event the automated process fails. Discuss options for automatic printing using a print service manager or scheduled batch print jobs. M 5.24 Charge tracking: Propose solutions for tracking charges assigned to a case. Include information regarding tracking of most serious and primary charge(s) on cases. Provide details regarding ability to track amended charges and full history of all charges during the life of a case. Include information about any limitations on the following: number of charges that can be assigned; number of characters available in a specific charge; number of subsections in a charge. Provide details regarding how statutes tables are maintained and revised. M 5.25 Case involvements: Provide details regarding system ability to automatically assign case involvement types. This includes any ability to assign default involvements based on case type and/or ability to automatically add involvement types based on events. M 5.26 Business/Party records: Provide solutions for tracking detailed demographic and contact information for business/party records. Include information regarding any ability to track special attributes, such as gang affiliations, deceased party, Giglio, transgender relationships, address types, etc. M 5.27 Dispositional features: Propose solutions for tracking various dispositions, sentencing information and jail credit. Demonstrate ability to handle wide range of dispositions, customizable by case type and disposition type. Describe how the system will generate dispositional reports and its ability to share this information with partner agencies. Describe any ability to auto generate dispositional documents, such as journal entries. M 5.28 Notes fields: Provide solutions for tracking notes related to cases and/or parties. Describe all narrative form fields available and ability to track changes to those fields. Provide detailed information regarding ability to search narrative fields within and across cases and parties. Include information regarding any character limitations. M 8 RFP # 22-0084 Sedgwick County...Working for you 5.29 Case copy feature: Provide solutions for copying case information from one case to another. This should include the ability to copy specific data fields as well as all case data, in order to eliminate duplicate data entry. D 5.30 Merge records features: Discuss any abilities to merge case records and parties. Include details on deletion of records and abilities to reuse/copy data from various records with the system. D 5.31 Auto deletion/retention features: Provide detail regarding any ability to automatically delete files/cases or mark for permanent retention base on events and/or statuses. D 5.32 Document creation and generation: Provide solutions for automated document generation. Include detailed information regarding how document templates are built/modified and how system data is populated in documents. Include solutions for both fully automated, event-based generation as well as user- initiated generation processes. Also include information regarding other systems, applications, databases, etc. that are used to generate documents. Provide information regarding available document types/formats that can be generated as well as any backup, export, and/or import processes available in case of lost or corrupt documents. M 5.33 Document and file storage: Provide solutions for document storage and imaging. This should include both documents that are generated within the system as well as documents generated externally. Include information regarding file/case size limitations. Provide detailed information on the process of moving external documents into system storage as well as imaging physical documents. Provide information regarding file types that can be stored in the system, including media files. Also, discuss document OCR search capabilities and processes. M 5.34 Direct scanning: Provide information regarding ability to scan documents directly into a case and/or name record in the system. Discuss the process and any limitations as well as any ability to OCR direct scanned documents. Include information regarding ability to pull statistics related to documents scanned. D 5.35 Electronic signatures: Discuss in detail system ability to utilize electronic signature and electronic notarization processes. Include information regarding system requirements and ability to interface with electronic signature devices. D 5.36 Timekeeping: Propose solutions for timekeeping related to specific cases and/or functions. Examples include, but are not limited to, tracking investigator time spent on a case or witness, attorney time spent working on a case, diversion coordinator contact time with clients and staff time spent on a KORA request. D 5.37 Financials: Provide solutions for tracking financial obligations, payments, payment scheduling and adjusting entries. Demonstrate ability to track a wide variety of fees and restitution. Provide detailed information on process of tracking restitution in joint and several scenarios. Include information on ability to interface with Point of Sale (POS) transactions and import data from both standard and virtual POS. Discuss possible solutions for internet payment options. Provide detailed information regarding any ability to interface with SAP enterprise software. Include information regarding capability to track office financial data that is not tied to a specific party or case. M 5.38 Search warrants: Provide solutions for tracking search warrants when there is no court case. Discuss ability to automatically link warrants at case creation. D 5.39 Discovery: Provide solutions for discovery management. Include information regarding all discovery specific features within the system. Discuss electronic submission from law enforcement agencies; process for reviewing and redacting discovery; foldering/organization structure; Bates stamping; receipting and tracking of when discovery is provided and when it is accessed by defense council. Discuss solutions for supplemental discovery and ability to detect duplicate files. Provide information regarding tracking discovery timelines. Specifically, discuss any ability to provide auto notifications and auto alerts for deadlines. Include detailed information regarding defense council access to discovery, how they access and how they can store for long-term access. Include any limitations on file types. M 5.40 Digital evidence: Provide solutions for handling, tracking, organizing and storing digital evidence. This should go beyond the discovery process and include ways attorneys can prepare, organize and present evidence in court. Discuss any features that enable transcription, photo enhancement and enlarging, OCR of documents, audio/video synchronization from multiple sources, GIS mapping, and file metadata extraction, for the purposes of organization and presentation. D 9 RFP # 22-0084 Sedgwick County...Working for you 5.41 Redaction: Provide solutions for redaction of documents from within the system. Describe any redaction tools or software that are “built in” or can be accessed from within the system. Provide detailed information on redaction capabilities and processes. D 5.42 Transcription: Provide solutions for transcription of audio/video. Include detailed information regarding system tools for transcription and processes associated with the use of those tools. D 5.43 Diversion: Provide solutions for tracking diversion program participants for adult criminal, juvenile and traffic diversion programs. This should include detailed information regarding diversion specific modules or tools. System must be able to track participant information as well as all associated obligations. This should include, but is not limited to, interview results, risk assessments, workflow, data collection, financial obligations and payments, substance abuse treatment, community service, reporting requirements, education/work information and restitution. Describe how compliance with obligations is tracked and provide information regarding any automated non-compliance notification capabilities. Include any reporting capabilities that could be used for diversion specific cases. M 5.44 Specialty courts: Provide solutions for tracking specialty court cases and participants. This includes tracking participant’s court dates and results, participant obligations, assigned attorney and caseworkers, treatment requirements and updates. Include details of any reporting capabilities that can be used for specialty court cases. D 5.45 Personnel/Human Resources functions: Provide details on any ability to provide personnel and Human Resources (HR) management functions for office staff. Include information on ability to electronically manage personnel files and maintain personal information of staff. Discuss ability to track certification hours of attorneys and investigators and maintain training logs. Provide detail on ability to partition personnel data in order to limit access. D 5.46 Probation function: Discuss any ability to track probation. Include information on tracking dates/term of probation, requirements and compliance. Discuss options for tracking treatment requirements and jail sanctions. D 5.47 Reporting: Propose solutions for data reporting needs. Provide details of standardized reports available in the system. Describe in detail the process of creating ad hoc reports within the system. Demonstrate the ability to create automated report scheduling processes. Demonstrate system’s ability to replicate raw data to Sedgwick County owned server that can be accessed utilizing SAP Business Objects. M 5.48 E-Filing: Discuss in detail capabilities to electronically file documents from within the system to the Kansas Courts electronic filing system (EFlex by Tybera). Include information regarding any automated or manual e-filing processes. Provide examples of similar successfully completed integrations. M 5.49 OnBase interface: Provide solutions for interfacing with OnBase. OnBase is currently used for long-term storage of various documents. Discuss the ability to use a “hot key” or other process within the system to pull back documents from OnBase. Include information regarding the use of the OnBase Application Enabler to pull indexing values from case or party record. Also, discuss options for converting OnBase documents for retention in CMS rather than OnBase. M 5.50 Apptricity Interface: Provide solutions for interfacing with Apptricity. This system is currently used for physical file tracking and inventory. It incorporates both bar code and RFID scanning ability. Discuss ability to import/track file location/assignment data. D 5.51 Active Directory: Provide solutions for integration with the Sedgwick County active directory and ability to synch with current user groups. M 5.52 Outside agency access: Discuss options for granting limited access to outside agencies. This should include the two-way exchange of information. Include details regarding the manner of access and any limitations on what information could be exchanged. Also, provide details regarding the ability to validate incoming data. D 5.53 Hardware standards: Provide detailed information regarding hardware specifications. Include both required specifications as well as any recommended specifications. M 10 RFP # 22-0084 Sedgwick County...Working for you 5.54 Helpdesk/Support: Provide detailed information regarding helpdesk and support requests. Include information regarding how requests are submitted, hours of availability and response time. Also, include information regarding the ability to implement “patch” solutions. M 5.55 Customizable help files: Provide details regarding ability to create customizable help files that are accessed within the system. Include information regarding the administrator’s ability to create/edit these help files. D 5.56 Cloud structure: If system is hosted offsite, provide information regarding host system structure. Include information on any 3rd party hosting partners, encryption systems, security compliance, disaster recovery as well as number and locations of datacenters. D 5.57 Responsibilities: Provide information outlining implementation responsibilities of vendor, Sedgwick County and the District Attorney’s Office. M 5.58 Releases/Upgrades: Provide detailed information regarding upgrades and releases, including schedules and associated costs to upgrade, if any. Also, discuss ability to implement “hot fixes”. M 5.59 Data/Code partitioning: Discuss in detail the ability to define contents of drop-down list throughout cases and parties. Describe process and if system administrator will have ability to filter choices available to users in particular fields. D 5.60 eCorrections Interface: Provide solutions for interfacing with Journal Technologies eCorrections, also known as eProbation. The system is in the process of being configured for DoC and is used for both juvenile and adult services. The interface would primarily be required for simple demographic information. D B. System Architecture and Design This subsection should include the following information: a. System Diagram Provide a diagram of the proposed system architecture. The diagram should include an overall representation of the servers, network, peripherals, workstations, mobiles, and interface points, as well as a representation of the system environments (Production, Test, Training, and Disaster Recovery). b. Proposed Hardware Configuration Provide a listing or description of hardware configuration(s) recommendations based on use experience. c. Performance and Reliability Describe any impact to systems (e.g. interference to normal operations, system shutdown) that will occur during server upgrades and/or expansions. How will the vendor ensure concurrent operation of all system components without degradation? Describe the system response times that will be guaranteed during the lifetime of the system (both during original warranty period and lifetime support). This is specifically referring to the transaction times related to commands. Describe how the vendor will measure and ensure system performance over the lifetime of the system. The county expects seven days a week, twenty-four-hour operation and availability with regard to the presented case management solution. Describe how the vendor will guarantee 99.999% availability both initially and during the life of any license and maintenance contract. What level of system availability is recommended for the case management solution? Describe how the vendor will guarantee this level of availability both initially and during the life of any license and maintenance contract. 11 RFP # 22-0084 Sedgwick County...Working for you d. System Failover and Restoration Provide a detailed description of the proposed backup environment. Do operations automatically failover to the backup environment in the event of a failure in the production environment? Describe any actions that must be taken by personnel to activate a backup environment. How much time is required until operations commence in the backup environment when operations in the production environment fail? What steps, degree of user intervention, and time is required to return operations to the primary environment? e. Network Compatibility What is the slowest wired network connection speed that is required to successfully support the system? What is the slowest wireless network connection speed that is required to successfully support the system? f. System Software Applications and Utilities Provide the name, company, and release level of any additional third-party software required to support the proposed solution. g. System Backup Describe the recommended approach for system backup. How will the proposer’s recommended backup process affect live operation? Are all system functions (inquiry and update) available during backup? If not, explain the level of availability of system functions during backup and approximate time to perform backup. Will the recommended approach enable full backup of the system? Can the full backup be performed unattended? Can full backup be scheduled to occur automatically? Can the system perform incremental backup (i.e. only data/files updated since last backup)? How long (estimated) will it take and what steps are involved to restore from a backup? h. Data Conversion Plan In this subsection please provide a Conversion Plan and approach – Data from legacy systems must be converted to the new system. The Data Conversion Plan must describe the strategy, approach, processes and reference the appropriate specifications to convert data from the county’s legacy systems to the new system. i. Deployment/Implementation In this subsection, the vendor must provide a detailed Deployment and Implementation plan, which documents the activities that must be performed to deploy the application to the production environment and implement within the County. The plan must detail elements related to the critical activities that need to be performed prior to launch. The plan must contain the detailed installation procedures, and consider the inter-application dependencies. The plan must include the step-by-step activities leading up to deployment as well as the post- deployment activities related to reporting and clean-up. Additionally, the plan must address the roles and responsibilities, Go/No-Go criteria and decision date, required resources, assumptions, and risks related to implementation and Go-live. 12 RFP # 22-0084 Sedgwick County...Working for you At a minimum, the deliverable must contain the following: 1. Deployment strategy and approach 2. Software installation procedures 3. Deployment/Conversion implementation detailed plan 4. Post deployment activities 5. Proposed scope, approach, schedule and team 6. Implementation phase entry and exit criteria 7. Implementation readiness approach (go/no- go criteria and checklist) C. Project Management Include the following information in this subsection: Describe the vendor’s approach to managing the implementation of the proposed system, addressing at a minimum the following components of project management: 1. Project communications 2. Schedule management 3. Issue management 4. Scope management 5. Risk management 6. Quality assurance Statement of Work that breaks down the system implementation by tasks and delineates vendor and the county’s responsibilities within each task. Tasks should include configuration, testing and interface development and deployment. Address project management services including creating and maintaining a detailed deployment plan, along with a detailed task list. Realistic and readable implementation project schedule that starts at contract signing. The schedule should describe tasks to be performed by the county as well as by the vendor. How will the vendor help the county or other external customers who interface with the county information systems identify potential changes in business processes because of changes in application software? D. Training In this subsection, the vendor should describe how they would provide the following types of training programs, along with appropriate documentation: A training program for County’s project implementation team that includes the training necessary to understand the overall system architecture, interface configurations, data import/export capabilities, and workflow configuration options, etc. A training program for application administrators that includes the training necessary to configure, tailor, monitor, and administer the technical and functional aspects of system. A training solution to support the training of end-users in the functionality of the various proposed system modules. To support the training of end users, the County envisions the use of a “train-the-trainer” approach. However, it is requested that all end users receive individual training. Post implementation training. Multimedia presentations of training made available following actual training (e.g., PowerPoint presentations, videos, etc.). A training program that accounts for end users on shift work and may not be available during normal training hours. 13 RFP # 22-0084 Sedgwick County...Working for you E. Cost of Work All costs for each item referred to in the proposal must be identified in this subsection. Costs must be unbundled and separately listed. Proposals that do not detail specific costs will be considered non- responsive. The vendor shall bear the onus of any cost related errors. All interface costs must be included. Note that the costs associated with interfaces shall include all costs associated with the development, testing, and deployment of the defined interface. List all systems and applications for which the system currently has interfaces in place. The county reserves the right to conduct negotiations with vendors on pricing and payment terms. Costs proposals should include the following components: Implementation Costs – Describe and list all costs that would be associated with implementation of the system, including but not limited to the following: 1. Installation of Hardware/Software 2. System Integration 3. Project Management 4. Training 5. Data Conversion 6. Travel 7. Any other costs (please describe) Optional Costs – Describe and list all optional cost items associated with the system. Total One-Time Costs – Present a summary of all one-time costs for the system. Recurring Costs – Provide a ten-year cost schedule that presents the annual cost for maintenance and service warranty. Include options to renew after ten years. Payment Schedule – Provide a proposed payment schedule. F. Architecture and IT Standards If web based, preferably written in HTML 5, not requiring Java, Reader, or Flash needs (vulnerable 3rd party apps) - if any, always the latest version. Vendor should provide a list of client requirements. Vendor should indicate data requirements - data growth rate per year (database size, attachments, binaries, backup sizes, etc.). How does this impact costs and services? Vendor should list client application deployment methods (please include how these applications will be updated). Vendor should list any included backup and recovery capabilities, objectives, and estimated timelines. Please include any known issues with backup and recovery systems on the market. Vendor should provide secure connections to data and be compliant with any regulatory requirements such as Health Insurance Portability and Accountability Act (HIPAA), Criminal Justice Information Services (CJIS), and Payment Card Industry (PCI) requirements. 14 RFP # 22-0084 Sedgwick County...Working for you Vendor should include interface diagram and security specifics. If not answered in previous question please list authentication and security methods for access to the system and system data. The software needs to be able to be supported on current technology standards and future / modern OS releases. Does this system stay up to date with modern software updates -- such as Windows OS or SQL versioning to the latest versions? Vendor should list Server and Client resource requirements (CPU, Memory, and Disk Space). Vendor should indicate server and application update practices (Include the answers to how to patch the application on the client and server). Vendor should list network connection requirements. If on-premise, vendor should list system external interface requirements. (Please include an interface diagram.) – Is there any remote connection into the on-premise system needed for support by the vendor? If not addressed in previous response, vendor should list authentication and security methods for access to the system and system data. Vendor should indicate backup methods recommended - any incompatibilities with backup systems on the market. Software should be compatible with modern antivirus clients. (List any needed exceptions or known problems.) G. Project Status Reporting Weekly written status reports shall be submitted to the Department Project Manager. These status reports should outline: 1. Overall summarization of the project progress; 2. Deliverables achieved; 3. Deliverables remaining, progress, and expected delivery on each; and 4. Issues and concerns affecting specific deliverables and the project schedule or any other aspect of the project.) H. Acceptance Testing The vendor will work with the department to create an acceptance-testing plan. Both parties shall agree to the plan in writing and the plan must be completed prior to county acceptance of the solution. I. Documentation The vendor shall provide system documentation (written or electronic) to the department. 15 RFP # 22-0084 Sedgwick County...Working for you J. User Training Describe any training to be provided by the vendor: 1. Identify who and how many resources require training. 2. Identify the timing of the training. 3. Indicate if training is to be provided at the Department’s site or off site. a. If on-site training is required, indicate if the vendor will be required to deliver training at multiple locations or at one central location. 4. Identify location of training facilities. 5. Describe the equipment and software to be provided at the training facility. 6. Identify any required content for training materials to be provided to trainees. 7. Identify any experience/skill requirements for the individual(s) delivering the training.) VI. Sedgwick County’s Responsibilities • Provide information, as legally allowed, in possession of the county, which relates to the county’s requirements or which is relevant to this project. • Designate a person to act as the County Contract Manager with respect to the work to be performed under this contract. • County reserves the right to make inspections at various points of the project. Contractor agrees to openly participate in said inspections and provide information to the county on the progress, expected completion date and any unforeseen or unexpected complications in the project. VII. Proposal Terms A. Questions and Contact Information Any questions regarding this document must be submitted in writing to Lee Barrier at Lee.barrier@sedgwick.gov by 5:00 pm CST, November 22, 2022. Any questions of a substantive nature will be answered in written form as an addendum and posted on the purchasing website at https://www.sedgwickcounty.org/finance/purchasing/requests-for-bid-and-proposal/ under the Documents column associated with this RFP number by 5:00 pm CST, January 3, 2023. Firms are responsible for checking the website and acknowledging any addenda on their proposal response form. B. Minimum Firm Qualifications This section lists the criteria to be considered in evaluating the ability of firms interested in providing the service(s) and/or product(s) specified in this Request for Proposal. Firms must meet or exceed theses qualifications to be considered for award. Any exceptions to the requirements listed should be clearly detailed in proposer’s response. Proposers shall: 1. Have a minimum of five (5) years’ experience in providing services similar to those specified in this RFP. 2. Have an understanding of industry standards and best practices. 3. Have experience in managing projects of comparable size and complexity to that being proposed. 4. Have knowledge of and comply with all currently applicable, and as they become enacted during the contract term, federal, state and local laws, statutes, ordinances, rules and regulations. All laws of the State of Kansas, whether substantive or procedural, shall apply to the contract, and all statutory, charter, and ordinance provisions that are applicable to public contracts in the county shall be followed with respect to the contract. 5. Municipal and county government experience is desired, however, the county will make the final determination based on responses received and the evaluation process. 6. Have the capacity to acquire all bonds, escrows or insurances as outlined in the terms of this RFP. 7. Provide project supervision (as required) and quality control procedures. 8. Have appropriate material, equipment and labor to perform specified services. 9. Park only in designated areas and display parking permit (if provided). 10. Wear company uniform or ID badge for identification purposes. mailto:Lee.barrier@sedgwick.gov https://www.sedgwickcounty.org/finance/purchasing/requests-for-bid-and-proposal/ 16 RFP # 22-0084 Sedgwick County...Working for you C. Evaluation Criteria The selection process will be based on the responses to this RFP. County staff will judge each response as determined by the scoring criteria below. Purchasing staff are not a part of the evaluation committee. Component Points a. Ability to provide a comprehensive, integrated solution to meet stated requirements. 40 b. Approach, methodology, and proposed schedule for solution. 25 c. Record of performance on similar projects, including customer retention, customer support during and after project implementation, and other feedback from references. 15 d. Total cost of ownership (software, annual maintenance and support, implementation services, training, hardware, database, resources required, etc.) 10 e. Firm’s economic and technical resources, stability, and longevity in the market. 10 Total Points 100 Assume the following cost proposals (examples only) A. $50,000.00 B. $38,000.00 C. $49,000.00 Company B with a total price of $38,000.00 is the low offer. Take the low offer and divide each of the other offers into the low offer to calculate a percentage. This percentage is then multiplied by the number of points available for the cost. In this case, 10 points are allocated to cost. A. $38,000.00 divided by $50,000.00 =.76 .76*10 7.6 points B. $38,000.00 divided by $38,000.00 =1.00 1.00*10 10 points C. $38,000.00 divided by $49,000.00= .77 .77*10 7.7 points Any final negotiations for services, terms and conditions will be based, in part, on the firm’s method of providing the service and the fee schedule achieved through discussions and agreement with the county’s review committee. The county is under no obligation to accept the lowest priced proposal and reserves the right to further negotiate services and costs that are proposed. The county also reserves the sole right to recommend for award the proposal and plan that it deems to be in its best interest. The county reserves the right to reject all proposals. All proposals, including supporting documentation shall become the property of Sedgwick County. All costs incurred in the preparation of this proposal shall be the responsibility of the firm making the proposals. Sedgwick County reserves the right to select, and subsequently recommend for award, the proposed service, which best meets its required needs, quality levels and budget constraints. D. Request for Proposal Timeline The following dates are provided for information purposes and are subject to change without notice. Contact the Purchasing Department at (316) 660-7255 to confirm any and all dates. Distribution of Request for Proposal to interested parties October 31, 2022 Questions and clarifications submitted in writing by 5:00 pm CST November 22, 2022 Addendum Issued by 5:00 pm CST January 3, 2023 Sealed Proposal due before 1:45 pm CST January 31, 2023 Evaluation Period January 31, 2023-March 17, 2023 Board of Bids and Contracts Recommendation March 21, 2023 Board of County Commission Award April 5, 2023 17 RFP # 22-0084 Sedgwick County...Working for you E. Contract Period and Payment Terms A contractual period will begin following Board of County Commissioners (BoCC) approval of the successful firm(s) and continue for a period of Ten (10) years. County may cancel its obligations herein upon thirty-day (30) prior written notice to the other party. It is understood that funding may cease or be reduced at any time, and in the event that adequate funds are not available to meet the obligations hereunder, either party reserves the right to terminate this agreement upon thirty (30) days prior written notice to the other. Payment will be remitted following receipt of monthly detailed invoice. Payment and Invoice Provisions https://www.sedgwickcounty.org/media/39239/payment_and_invoice_provisions.pdf F. Insurance Requirements Liability insurance coverage indicated below must be considered as primary and not as excess insurance. If required, contractor’s professional liability/errors and omissions insurance shall (i) have a policy retroactive date prior to the date any professional services are provided for this project, and (ii) be maintained for a minimum of three (3) years past completion of the project. Contractor shall furnish a certificate evidencing such coverage, with county listed as an additional insured including both ongoing and completed operations, except for professional liability, workers’ compensation and employer’s liability. Certificate shall be provided prior to award of contract. Certificate shall remain in force during the duration of the project/services and will not be canceled, reduced, modified, limited, or restricted until thirty (30) days after county receives written notice of such change. All insurance must be with an insurance company with a minimum BEST rating of A-VIII and licensed to do business in the State of Kansas (must be acknowledged on the bid/proposal response form). NOTE: If any insurance is subject to a deductible or self-insured retention, written disclosure must be included in your proposal response and also be noted on the certificate of insurance. It is the responsibility of contractor to require that any and all approved subcontractors meet the minimum insurance requirements. Workers’ Compensation: Applicable coverage per State Statutes Employer’s Liability Insurance: $500,000.00 Commercial General Liability Insurance (on form CG 00 01 04 13 or its equivalent): Each Occurrence $1,000,000.00 General Aggregate, per project $2,000,000.00 Personal Injury $1,000,000.00 Products and Completed Operations Aggregate $2,000,000.00 Automobile Liability: Combined single limit $500,000.00 Umbrella Liability: Following form for both the general liability and automobile ____ Required / ___X_ Not Required Each Claim Aggregate $1,000,000.00 $1,000,000.00 Professional Liability/ Errors & Omissions Insurance: ___ Required / ___X_ Not Required Each Claim Aggregate $1,000,000.00 $1,000,000.00 Pollution Liability Insurance: ____ Required / ___X_ Not Required Each Claim Aggregate $1,000,000.00 $1,000,000.00 https://www.sedgwickcounty.org/media/39239/payment_and_invoice_provisions.pdf 18 RFP # 22-0084 Sedgwick County...Working for you Technology Errors & Omissions Liability: The coverage shall include any obligations to indemnify for failure to perform professional services, with Minimum limits of $1,000,000 each claim and general aggregate. __X_ Required/ ____ Not Required Each Claim Aggregate $1,000,000.00 “Cyber/ Network Security and Privacy Liability Insurance in an amount of not less than $1,000,000 combined single limit to cover civil, regulatory and statutory damages, contractual damage, as well as data breach management exposure, and any loss of income or extra expense as a result of actual or alleged breach, violation or infringement of right to privacy, consumer data protection law, confidentiality or other legal protection for personal information, as well as confidential information of county or confidential information in county’s possession. __X_ Required/ ____ Not Required Each Claim Aggregate $1,000,000.00 $1,000,000.00 Special Risks or Circumstances: Entity reserves the right to modify, by written contract, these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances. IF CONTRACTOR IS PROVIDING CONSTRUCTION SERVICES: In addition to the above coverages, contractor shall also provide the following: Builder’s Risk Insurance: In the amount of the initial Contract Sum, plus the value of subsequent modifications and cost of materials supplied and installed by others, comprising the total value for the entire Project on a replacement cost basis without optional deductibles. Entity, contractor, and all Subcontractors shall be included as named insured’s. G. Indemnification To the fullest extent of the law, the provider, its subcontractor, agents, servants, officers or employees shall indemnify and hold harmless Sedgwick County, including, but not limited to, its elected and appointed officials, officers, employees and agents, from any and all claims brought by any person or entity whatsoever, arising from any act, error, or omission of the provider during the provider’s performance of the agreement or any other agreements of the provider entered into by reason thereof. The provider shall indemnify and defend Sedgwick County, including, but not limited to, its elected and appointed officials, officers, employees and agents, with respect to any claim arising, or alleged to have arisen from negligence, and/or willful, wanton or reckless acts or omissions of the provider, its subcontractor, agents, servants, officers, or employees and any and all losses or liabilities resulting from any such claims, including, but not limited to, damage awards, costs and reasonable attorney’s fees. This indemnification shall not be affected by any other portions of the agreement relating to insurance requirements. The provider agrees that it will procure and keep in force at all times at its own expense insurance in accordance with these specifications. 19 RFP # 22-0084 Sedgwick County...Working for you H. Confidential Matters and Data Ownership The successful proposer agrees all data, records and information, which the proposer, its agents and employees, which is the subject of this proposal, obtain access, remains at all times exclusively the property of Sedgwick County. The successful proposer agrees all such data, records, plans and information constitutes at all times proprietary information of Sedgwick County. The successful proposer agrees that it will not disclose, provide, or make available any of such proprietary information in any form to any person or entity. In addition, the successful proposer agrees it will not use any names or addresses contained in such data, records, plans and information for the purpose of selling or offering for sale any property or service to any person or entity who resides at any address in such data. In addition, the successful proposer agrees it will not sell, give or otherwise make available to any person or entity any names or addresses contained in or derived from such data, records and information for the purpose of allowing such person to sell or offer for sale any property or service to any person or entity named in such data. Successful proposer agrees it will take all reasonable steps and the same protective precautions to protect Sedgwick County's proprietary information from disclosure to third parties as with successful proposer's own proprietary and confidential information. Proposer agrees that all data, regardless of form that is generated as a result of this Request for Proposal is the property of Sedgwick County. I. Proposal Conditions https://www.sedgwickcounty.org/media/31338/proposal-terms-conditions.pdf General Contract Provisions https://www.sedgwickcounty.org/media/31337/general-contractual-provisions.pdf Mandatory Contract Provisions https://www.sedgwickcounty.org/media/31336/mandatory-contractual-provisions.pdf Independent Contractor https://www.sedgwickcounty.org/media/54780/independent-contractor-addendum.pdf Sample Contract https://www.sedgwickcounty.org/media/39236/sample-contract.pdf Federal Certifications Addendum Sedgwick County https://www.sedgwickcounty.org/media/59719/federal-certifications-addendum-updated-for-changes-to-ug-11-12-2020- no-signature-line.pdf Suspension and Debarment https://www.sedgwickcounty.org/finance/purchasing/suspension-and-debarment/ VIII. Required Response Content All proposal submissions shall include the following: 1. Firm profile: the name of the firm, address, telephone number(s), contact person, year the firm was established, and the names of the principals of the firm. 2. The firm’s relevant experience, notably experience working with government agencies. 3. At minimum, three (3) professional references, besides Sedgwick County, with email addresses, telephone numbers, and contact persons where work has been completed within the last three (3) years. 4. A disclosure of any personal or financial interest in any properties in the project area, or any real or potential conflicts of interest with members of the Sedgwick County Board of County Commissioners or county staff. 5. A description of the type of assistance that will be sought from county staff, including assistance required from the county to lessen the costs of this project. 6. Proof of insurance meeting minimum insurance requirements as designated herein. 7. Those responses that do not include all required forms/items may be deemed non-responsive. https://www.sedgwickcounty.org/media/31338/proposal-terms-conditions.pdf https://www.sedgwickcounty.org/media/31337/general-contractual-provisions.pdf https://www.sedgwickcounty.org/media/31336/mandatory-contractual-provisions.pdf https://www.sedgwickcounty.org/media/54780/independent-contractor-addendum.pdf https://www.sedgwickcounty.org/media/39236/sample-contract.pdf https://www.sedgwickcounty.org/media/59719/federal-certifications-addendum-updated-for-changes-to-ug-11-12-2020-no-signature-line.pdf https://www.sedgwickcounty.org/media/59719/federal-certifications-addendum-updated-for-changes-to-ug-11-12-2020-no-signature-line.pdf https://www.sedgwickcounty.org/finance/purchasing/suspension-and-debarment/ 20 RFP # 22-0084 Sedgwick County...Working for you IX. Response Form REQUEST FOR PROPOSAL RFP #22-0084 CASE MANAGEMENT SYSTEM (CMS) FOR THE DISTRICT ATTORNEY’S OFFICE The undersigned, on behalf of the proposer, certifies that: (1) this offer is made without previous understanding, agreement or connection with any person, firm, or corporation submitting a proposal on the same project; (2) is in all respects fair and without collusion or fraud; (3) the person whose signature appears below is legally empowered to bind the firm in whose name the proposer is entered; (4) they have read the complete Request for Proposal and understands all provisions; (5) if accepted by the county, this proposal is guaranteed as written and amended and will be implemented as stated; and (6) mistakes in writing of the submitted proposal will be their responsibility. NAME _______________________________________________________________________________________________ DBA/SAME ___________________________________________________________________________________________ CONTACT____________________________________________________________________________________________ ADDRESS____________________________________ CITY/STATE_____________________________ ZIP___________ PHONE______________________________________ FAX_________________________ HOURS_________________ STATE OF INCORPORATION or ORGANIZATION ______________________________________________________ COMPANY WEBSITE ADDRESS____________________________ EMAIL________________________________ NUMBER OF LOCATIONS_______________ NUMBER OF PERSONS EMPLOYED__________________________ TYPE OF ORGANIZATION: Public Corporation ________ Private Corporation________ Sole Proprietorship ________ Partnership________ Other (Describe): ____________________________________________________________________ BUSINESS MODEL: Small Business ________ Manufacturer ________ Distributor _________ Retail ___________ Dealer ________ Other (Describe): _______________________________________________________________________ Not a Minority-Owned Business: _______ Minority-Owned Business: ____________________________ (Specify Below) ____African American (05) _____ Asian Pacific (10) _____ Subcontinent Asian (15) ______ Hispanic (20) ____Native American (25) _____ Other (30) - Please specify_________________________________________________ Not a Woman-Owned Business: ______ Woman-Owned Business: _________ (Specify Below) _____Not Minority -Woman Owned (50) _____ African American-Woman Owned (55) _____Asian Pacific-Woman Owned (60) _____ Subcontinent Asian-Woman Owned (65) _____Hispanic Woman Owned (70) _____Native American-Woman Owned (75) ______Other – Woman Owned (80) – Please specify____________________________________________________________ ARE YOU REGISTERED TO DO BUSINESS IN THE STATE OF KS: ______Yes ______ No DUNS NUMBER:_________________________ SAM NUMBER:_________________________ INSURANCE REGISTERED IN THE STATE OF KS WITH MINIMUM BEST RATING OF A-VIII: ______Yes ______No ACKNOWLEDGE RECEIPT OF ADDENDA: All addendum(s) are posted to our RFB/RFP web page and it is the vendor’s responsibility to check and confirm all addendum(s) related to this document by going to www.sedgwickcounty.org/finance/purchasing.asp . NO.______, DATED ______________; NO.______, DATED_____________; NO.______, DATED_____________ In submitting a proposal, vendor acknowledges all requirements, terms, conditions, and sections of this document. Proposal submission format should be by order in which sections are listed throughout the document. All minimum and general requirements should be specifically addressed and detailed in proposer’s response. Exceptions to any part of this document should be clearly delineated and detailed. Signature _____________________________________________ Print Name____________________________________________ Dated ______________________________________________________________________________________________________ http://www.sedgwickcounty.org/finance/purchasing.asp 21 RFP # 22-0084 Sedgwick County...Working for you Non-employee personnel signature ______________________ Date _______________Company/Agency name Print ___________________ _____________________________ _____________________________________________________________________ Non-employee personnel name (Print) Purpose (State the reason you are signing this form) _____________________________ ___________________________________________________________________ Non-employee personnel phone number Sedgwick County Sponsor & phone number (Print employee name and department) Revision Date: 09/24/2009 Sedgwick County Non-Employee Information Technology Usage Agreement 1. Non-employee personnel have no expectation of privacy in any electronic communications, use of Sedgwick County property, or Internet access. Sedgwick County reserves the right to review, audit, or monitor any information technology used by non-employee personnel. 2. Non-employee personnel shall use only accounts authorized by the Sedgwick County Chief Information Officer (SCCIO). 3. Non-employee personnel may access only those resources for which they are specifically authorized. 4. Non-employee personnel are personally responsible for safeguarding their account and log-on information. Passwords shall adhere to the following. a. Passwords shall remain confidential. b. Passwords shall be changed at least every 90 days. c. Passwords shall be at least seven characters long. d. Passwords shall contain characters from at least three of the following four classes: (i) English upper case letters, A, B, (ii) English lower case letters, a, b, (iii) Westernized Arabic numerals, 0,1,2, and (iv) Non-alphanumeric ("special characters") such as punctuation symbols. e. Passwords shall not contain your user name or any part of your full name. f. Passwords shall never be displayed, printed, or otherwise recorded in an unsecured manner. 5. Non-employee personnel are not permitted to script their user IDs and/or passwords for log-on access. 6. Non-employee personnel are not permitted to allow another person to log-on to any computer utilizing their, if provided, personal account, nor are they permitted to utilize someone else's account to log-on to a computer. Authorized system or service accounts may be used by multiple authorized people. 7. Non-employee personnel may not leave their workstation logged onto the network while away from their area. Non-employee personnel may elect to lock the workstation rather than logging off when leaving for very short time periods. 8. All installed software must have been approved in writing in advance by the SCCIO. 9. Non-employee personnel shall execute only applications that pertain to their specific contract work. 10. Non-employee personnel shall promptly report log-on problems or any other computer errors to the Helpdesk (316-660-9811). 11. Non-employee personnel shall promptly notify the SCCIO if they have any reason to suspect a breach of security or potential breach of security. 12. Non-employee personnel shall promptly report anything that they deem to be a security loophole or weakness in the computer network to the SCCIO. 13. Non-employee personnel shall not install or use any type of encryption device or software on any Sedgwick County hardware, which has not been approved in writing in advance by the SCCIO. 14. Non-employee personnel shall not attach any device to the Sedgwick County network or attach any device to any device attached to the Sedgwick County Network without prior written approval in advance from the SCCIO. 15. Non-employee personnel may not remove any computer hardware, data or software from a Sedgwick County building for any reason, without prior written approval from the SCCIO. 16. Non-employee personnel shall not delete, disable, or bypass any authorized encryption device, or anti-virus or other software program, installed on Sedgwick County hardware. 17. Non-employee personnel shall not attach any network or phone cables to any Sedgwick County device without written approval from the SCCIO. 18. Non-employee personnel may not copy any data and/or software from any Sedgwick County resource for personal or unauthorized use. 19. Non-employee personnel may not utilize Sedgwick County computer systems or networks for any of the following reasons: a. Game playing; b. Internet surfing not required for their work activity; c. Non-related work activity; or d. Any illegal activity. e. Downloading of files from non-County resources. If files are needed for your work, contact Sedgwick County DIO IT personnel. 20. Non-employee personnel are prohibited from intercepting or monitoring network traffic by any means, including the use of network sniffers, unless authorized in writing in advance by the SCCIO. 21. Non-employee personnel may not give out any Sedgwick County computer information to anyone. Exception: other authorized non- employee personnel needing the information to complete authorized tasks and who have signed this agreement. Information includes but is not limited to: IP addresses, security configurations, etc. 22. All data storage media that does or did contain Sedgwick County data shall be erased or destroyed prior to disposal, according to existing Sedgwick County Standards.. 23. Non-employee personnel may not remove, modify, erase, destroy or delete any computer software without the written approval in advance of the SCCIO. Non-employee personnel may not modify any Sedgwick County computer data without the written approval in advance of the data owner. 24. Non-employee personnel shall not attempt to obtain, use or distribute Sedgwick County system or user passwords. 25. Non-employee personnel shall not attempt to obtain or distribute door passcodes/passkeys to secured rooms at any Sedgwick County facility for which they are not authorized. 26. All equipment issued to non-employee personnel will be returned in good condition to Sedgwick County upon termination of the Sedgwick County/non-employee Personnel relationship. 27. Non-employee personnel may not use Sedgwick County information technology to send or receive threatening, obscene, abusive, sexually explicit language or pictures. 28. Non-employee personnel are prohibited from causing Sedgwick County personnel to break copyright laws. 29. Use by non-employee personnel of any Sedgwick County information technology will acknowledge acceptance of the above-referenced policies. Any non-employee who violates any of these policies shall be subject to disciplinary action, including total removal from the Sedgwick County project as well as being subject to Kansas civil and criminal liability. Disciplinary action may include Sedgwick County requesting the non-employee be considered for demotion, suspension and termination. Anyone who is not a Sedgwick County employee that will access Sedgwick County information technology in the course of their work for Sedgwick County (“Non-employee personnel”) are required to sign this document before accessing any Sedgwick County information technology system. “Information technology” includes any computer, network, Internet access, electronic mail and voice message systems, facsimile devices, or other electronic systems used by Sedgwick County. 22 RFP # 22-0084 Sedgwick County...Working for you HIPAA RULES BUSINESS ASSOCIATE ADDENDUM DEFINITIONS 1.1 The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. Specific definitions: (a) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103. (b) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean Sedgwick County. (c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE Business Associate agrees to: 2.1 not Use or Disclose Protected Health Information other than as permitted or required by the Agreement or as Required By Law; 2.2 Use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information, to prevent Use or Disclosure of Protected Health Information other than as provided for by this Agreement; 2.3 report to covered entity any Use or Disclosure of Protected Health Information not provided for by the Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware, as further provided for in Par. 12.1, et seq.; 2.4 mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement; 2.5 in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information; 2.6 make available Protected Health Information in a Designated Record Set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524; 2.7 make any amendment(s) to Protected Health Information in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526 or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526; 23 RFP # 22-0084 Sedgwick County...Working for you 2.8 make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules; and 2.9 maintain and make available the information required to provide an accounting of Disclosures to the Covered Entity as necessary to satisfy covered entity’s obligations under 45 CFR 164.528. PERMITTED USES AND DISCLOSURES BY ASSOCIATE 3.1 Except as otherwise limited in this Agreement, Business Associate may only Use or Disclose Protected Health Information on behalf of, or to provide services to, Covered Entity for the purposes of the contractual relationship, if such Use or Disclosure of Protected Health Information would not violate the Privacy Rule if done by Covered Entity or the Minimum Necessary policies and procedures of the Covered Entity. SPECIFIC USE AND DISCLOSURE PROVISIONS 4.1 Except as otherwise limited in this Agreement, Business Associate may Use Protected Health Information for the proper management and administration of the Business Associate or to carry out the contractual or legal responsibilities of the Business Associate. 4.2 Business Associate may Use or Disclose Protected Health Information as Required By Law. 4.3 Business Associate agrees to make Uses and Disclosures and requests for Protected Health Information consistent with Covered Entity’s Minimum Necessary policies and procedures. 4.4 Business Associate may Disclose Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the Disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and Used or further Disclosed only as Required By Law or for the purposes for which it was Disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached. 4.5 Business Associate may provide Data Aggregation services relating to the Health Care Operations of the covered entity. 4.6 Business Associate may Use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with § 164.502(j)(1). OBLIGATIONS OF COVERED ENTITY 5.1 Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's Use or Disclosure of Protected Health Information. 5.2 Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to Use or Disclose Protected Health Information, to the extent that such changes may affect Business Associate's Use or Disclosure of Protected Health Information. 5.3 Covered Entity shall notify Business Associate of any restriction to the Use or Disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's Use or Disclosure of Protected Health Information. 24 RFP # 22-0084 Sedgwick County...Working for you PERMISSIBLE REQUESTS BY COVERED ENTITY 6.1 Covered Entity shall not request Business Associate to Use or Disclose Protected Health Information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity. If necessary in order to meet the Business Associate’s obligations under the Agreement, the Business Associate may Use or Disclose Protected Health Information for Data Aggregation, management and administrative activities, or contractual or legal responsibilities of Business Associate. TERM 7.1 Term. The Agreement shall be effective as of date of execution of the Agreement by the parties, and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, has been returned to Covered Entity or, at Covered Entity’s option, is destroyed, or, if it is infeasible to destroy Protected Health Information, the protections are extended to such information, in accordance with the termination provisions in this Agreement. MISCELLANEOUS 8.1 A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended. 8.2 The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the HIPAA Rules. 8.3 Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the HIPAA Rules. 8.4 In addition to any implied indemnity or express indemnity provision in the Agreement, Business Associate agrees to indemnify, defend and hold harmless the Covered Entity, including any employees, agents, or Subcontractors against any actual and direct losses suffered by the Indemnified Party(ies) and all liability to third parties arising out of or in connection with any breach of this Agreement or from any negligent or wrongful acts or omissions, including failure to perform its obligations under the HIPAA Rules, by the Business Associate or its employees, directors, officers, Subcontractors, agents, or other members of its workforce. Accordingly, upon demand, the Business Associate shall reimburse the Indemnified Party(ies) for any and all actual expenses (including reasonable attorney’s fees) which may be imposed upon any Indemnified Party(ies) by reason of any suit, claim, action, proceeding or demand by any third party resulting from the Business Associate’s failure to perform, Breach or other action under this Agreement. SECURITY RULE REQUIREMENTS 9.1 Business Associate agrees, to the extent any Protected Health Information created, received, maintained or transmitted by or in electronic media, also referred to as electronic protected health care information, as defined by 45 CFR § 160.103, that it will only create, maintain or transmit such information with appropriate safeguards in place. Business Associate shall therefore: implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health care information; ensure that any agent, including Subcontractors, to whom it provides such information shall agree to also implement reasonable and appropriate safeguards to protect the information; and report to the Covered Entity any Security Incident, as that term is defined by 45 CFR § 164.304, of which it becomes aware. 25 RFP # 22-0084 Sedgwick County...Working for you TERMINATION 10.1 Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not cured the breach or ended the violation within the time specified by Covered Entity. EFFECT OF TERMINATION 11.1 Upon termination of this Agreement for any reason, Business Associate shall return to Covered Entity or, if agreed to by Covered Entity, destroy all Protected Health Information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, that the Business Associate still maintains in any form. Business Associate shall retain no copies of the Protected Health Information. Provided however, Business Associate may retain Protected Health Information if necessary for management and administration purposes or to carry out its legal responsibilities after termination of the Agreement. Upon termination of this Agreement for any reason, Business Associate, with respect to Protected Health Information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall: retain only that Protected Health Information which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; return to Covered Entity or, if agreed to by Covered Entity, destroy the remaining Protected Health Information that the Business Associate still maintains in any form; continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information to prevent Use or Disclosure of the Protected Health Information, other than as provided for in this Section, for as long as Business Associate retains the Protected Health Information; not Use or Disclose the Protected Health Information retained by Business Associate other than for the purposes for which such Protected Health Information was retained and subject to the same conditions set out at in this Agreement which applied prior to termination; return to Covered Entity or, if agreed to by Covered Entity, destroy the Protected Health Information retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities; and provided, however, that nothing in this section 11.1 shall apply in the case of PHI remaining in its possession which Business Associate determines it is not feasible to return or destroy. Business Associate shall extend the protection of this Agreement to such PHI and limit further uses and disclosure of such PHI. The obligations of Business Associate under this Agreement shall survive the termination of this Agreement. 26 RFP # 22-0084 Sedgwick County...Working for you NOTIFICATION OF BREACH 12.1 To the extent Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, Uses, or Discloses Unsecured Protected Health Information, it shall, following the discovery of a Breach of such information, notify the Covered Entity of such Breach. Such notice shall include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by the Business Associate to have been, Used, accessed, acquired, or Disclosed during such Breach. The Business Associate shall provide the Covered Entity with any other available information that the Covered Entity is required to include in notification to the Individual under 45 C.F.R. § 164.404(c) at the time of the required notification to the Covered Entity, or as promptly thereafter as the information is available. 12.2 For purposes of this section, a Breach shall be treated as discovered by the Business Associate as of the first day on which such Breach is known to such Business Associate (including any person, other than the Individual committing the breach, that is an employee, officer, or other agent of such associate) or should reasonably have been known to such Business Associate (or person) to have occurred by the exercise of reasonable diligence. 12.3 Subject to section 12.4, all notifications required under this section shall be made without unreasonable delay and in no case later than 60 calendar days after the discovery of a Breach by the Business Associate involved in the case of a notification required under section 12.2. The Business Associate involved in the case of a notification required under section 12.2, shall have the burden of demonstrating that all notifications were made as required under this part, including evidence demonstrating the necessity of any delay. 12.4 If a law enforcement official determines that a notification or notice required under this section would impede a criminal investigation or cause damage to national security, such notification or notice shall be delayed in the same manner as provided under section 164.528(a)(2) of title 45, Code of Federal Regulations, in the case of a Disclosure covered under such section. If a law enforcement official states to the Business Associate that any notification or notice would impede a criminal investigation or cause damage to national security, the Business Associate shall: (a) If the statement is in writing and specifies the time for which a delay is required, delay such notification or notice for the time period specified by the official; or (b) If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification or notice temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in (a) is submitted during that time. PROHIBITION ON SALE OF ELECTRONIC HEALTH RECORDS OR PROTECTED HEALTH INFORMATION. 13.1 Except as provided in section 13.2, the Business Associate shall not directly or indirectly receive remuneration in exchange for any Protected Health Information of an Individual unless the Covered Entity has obtained from the Individual, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization that includes, in accordance with such section, a specification of whether the Protected Health Information can be further exchanged for remuneration by the entity receiving Protected Health Information of that Individual. 27 RFP # 22-0084 Sedgwick County...Working for you 13.2. Section 13.1 shall not apply in the following cases: (a) The purpose of the exchange is for public health activities (as described in section 164.512(b) of title 45, Code of Federal Regulations). (b) The purpose of the exchange is for research (as described in sections 164.501 and 164.512(i) of title 45, Code of Federal Regulations) and the price charged reflects the costs of preparation and transmittal of the data for such purpose. (c) The purpose of the exchange is for the treatment of the Individual, subject to any regulation that the Secretary may promulgate to prevent Protected Health Information from inappropriate access, Use, or Disclosure. (d) The purpose of the exchange is the health care operation specifically described in subparagraph (iv) of paragraph (6) of the definition of healthcare operations in section 164.501 of title 45, Code of Federal Regulations. (e) The purpose of the exchange is for remuneration that is provided by the Covered Entity to the Business Associate for activities involving the exchange of Protected Health Information that the Business Associate undertakes on behalf of and at the specific request of the Covered Entity pursuant to the Agreement. (f) The purpose of the exchange is to provide an Individual with a copy of the Individual's Protected Health Information pursuant to section 164.524 of title 45, Code of Federal Regulations. (g) The purpose of the exchange is otherwise determined by the Secretary in regulations to be similarly necessary and appropriate as the exceptions provided in subparagraphs (a) through