The URL can be used to link to this page

Home My WebLink AboutC17-357 Arapahoe County IGAIntergovernmental Agreement for GovPrime This Agreement (the "Agreement") is made by and between the Board of County Commissioners of the County of Arapahoe ("Arapahoe County") and the Board of County Commissioners of Eagle County (the "Subscribing County") as of i 10/24/2017 i WHEREAS, pursuant to Colorado Constitution, Article XIV, Section 18 and C.R.S. § 29-1-203, Arapahoe County and the Subscribing County have the legal authority to cooperate or contract with each other to provide any function, service, or facility lawfully authorized to each, and any such contract may provide for the sharing of costs, or other matters, for the purposes stated hereinafter; and WHEREAS, Arapahoe County has developed GovPrime to more effectively provide services to its clients; and WHEREAS, it is the advantage of both Parties and to the health, safety and welfare of the citizens of the respective Parties, for Arapahoe County to provide the GovPrime computing platform and other software applications to Subscribing County, enabling each Party to improve its public services; and WHEREAS, due to the complexity of sharing the GovPrime computing infrastructure (i.e., the platform), an agreement is warranted to cover the intellectual property, governance of the platform, data sharing, security, system and software support, and cost sharing of the platform and applications; and WHEREAS, this Agreement shall be considered an intergovernmental cooperation agreement pursuant to Section 19-1-203 C.R.S. for the purpose of sharing the listed software applications which shall be available for useby each Party on a cost-sharing basis according to the terms and conditions in this Agreement; and WHEREAS, this Agreement is entered into pursuant to, inter alfa, C.R.S. §§ 29-1-201, et seq., and Article XIV, Section 18 of the Colorado Constitution. NOW, THEREFORE, for and in consideration of the premises and other good and valuable consideration, the Parties agree as follows: 1. Purpose of Agreement. This Agreement defines the relationship between Arapahoe County, the pro- vider of the GovPrime computing platform and other software applications, and the Subscribing County. 1.1. The GovPrime platform is a cloud -based computing platform providing Software -as -a -Service ("SaaSl, 1.2. The goal of providing the applications within the GovPrime platform is to make software appli- cations avail ableto the Subscribing County for its da ily ope rations at a modest cost by leveraging common applications and the SaaS platform itself. 1.3. Arapahoe County may Provision (as defined below) application software on the GovPrime plat- form for use by the Subscribing County. A Services Agreement, attached to this Agreement, will C17-357 govern the use of any specific software modules Provisioned on the GovPrime platform for the Subscribing County. 2. Definitions. 2.1. Software -as -a -Service ("SaaS") is the capability of providing applications running on a cloud in- frastructure to the Subscribing County. The applications are accessible from various client devices through a thin client interface such as a Web browser or a program interface. The Subscribing County does not manage or control the underlying cloud infrastructure, including network, serv- ers, operating systems, storage or even individual application capabilities, except for limited user -specific application configuration settings. 2.2. Subscription is the grant of the right by Arapahoe County to a Subscribing County to use platform or application software. Such a grant does not include the transfer of ownership of the intellec- tual property unless the subscription agreement between the two counties expressly provides for that transfer. 2.3. Go Live is the point in time in which any subscribing user is accomplishing their work through an application using the GovPrime platform and described in an accompanying Services Agreement. In most cases this will coincide with users being given access to the production environment fol- lowing User Acceptance Testing. 2.4. Provision/Provisioning refers to the preparing of the hosted environment for use by the Subscrib- ing County. 2.5. Users refers to the Subscribing County's named users that have a user account which has access to the system of products that are hosted on the GovPrime platform. 2.5.1.User Accounts are to be used by a single person, not by a system or automation, and may not be shared between multiple people. A User Account only has to have access to the system to be counted toward the number of Users, regardless of whether they have logged into the system. 2.5. Billing Start Date. Collection of usage for the purpose of billing will start on the Go Live date for the subscribing county. 2.7. Designated Partner refers to third party provider of cloud services. 2.8. Data Breach means the unauthorized access by a non -authorized person(s) that results in the use, disclosure or theft of a Subscribing County's data in the subscribed software. 3. GovPrime Service. 3.1. GovPrime is a service provided by Arapahoe County to the Subscribing County for the sole pur- pose of creating a cloud -based platform for serving software applications to the Subscribing County. 3.2. The Subscribing County will execute a Services Agreement and a Statement of Work far Imple- mentation prior to being granted access to the GovPrime Service. These documents will be de- veloped individually with the Subscribing County from a standard template. 3.3. As the GovPrime SaaS platform is cloud -based, Arapahoe County will engage with a Designated Partner. The Designated Partner will host the GovPrime platform. 3.4. Arapahoe County will confirm that any Designated Partner follows required compliances to maintain the confidentiality and security of the data. These will include, but are not limited to, HIPAA, PH and FeclRamp compliance protocols. (See Attachment 1 for a list of the compliances provided by the selected cloud provider.) Notwithstanding the foregoing, Arapahoe County will not be liable for any breaches of these protocols caused by the third -party provider. 4. Scope of Services and Software -as -a -Service. 4.1. The GovPrime Service and any applications that run on the GovPrime platform are provided to the Subscribing County by this Agreement. 4.2. Arapahoe County developed the platform and the applications to improve the efficiency of its internal operations. By providing the platform and applications to the Subscribing County, it should be understood that Arapahoe County is not a commercial software vendor. Rather, Arap- ahoe County, having created the platform and applications and made the investment to develop these specific software packages, is offering them for use by the Subscribing County. 4.3. As with nearly all software packages, during use, flaws may become evident. Arapahoe County, as a user of the software, is interested in knowing about and providing remedies to these flaws. They should be reported as specified in the Support Services section of the Services Agreement. 4.4. Arapahoe County will implement the GovPrime platform in the cloud, Provisioning a Subscribing County as necessary. Any implementation of the application software will be covered by the Statement of Work for Implementation. 4.5. Arapahoe County shall be the owner of the GovPrime platform and any applications that it Pro- visions on that platform for the Subscribing County. By virtue of this Agreement, Arapahoe County is licensing the use of the GovPrime platform and any Provisioned applications to the Subscribing County and its Users. 5. Subscribing County Obligations. 5.1. All access by Users will be the responsibility of the Subscribing County through the use of Active Directory Services in the cloud. 5.2. Additional obligations of the Subscribing County are described below regarding Confidential In- formation, Security, Access and Insurance. 6. Term. 6.1. The Term of this Agreement shall be five (5) years, starting on the first day of any calendar quar- ter. At the end of the Term, the Agreement will automatically renew for another five (5) years ("Renewal Term"), unless the Subscribing County notifies Arapahoe County at least sixty (60) days prior to the end of the current term, pursuant to paragraph 14. 7. Termination. 7.1. If the Subscribing County terminates all Service Agreements with Arapahoe County, then this Agreement is terminated at that same time. Sixty (60) days' notice of termination is required under the Services Agreement. B. Compensation. 8.1. The costs associated with using the GovPrime SaaS platform and of using any Provisioned appli- cations will be specified in each individual Services Agreement. Arapahoe County shall provide the Subscribing County projected costs for an upcoming fiscal year (January 1— December 31) by June 1 of the year preceding the start of the upcoming fiscal year so that the Subscribing County can appropriately budget for the upcoming fiscal year. 9. Protection of Licensed Technology and Proprietary Rights. 9.1. Arapahoe County is the sole owner of the GovPrime platform and any software applications which run on that platform. The ownership of the software, the ability to modify it and the grant- ing of access to the GovPrime platform will be at all times the responsibility of Arapahoe County or its Designated Partner. 9.2. The Subscribing County and User are not permitted to use the software for any purpose other than that specified in the Services Agreement. 9.3. The Subscribing County shall not have the right to download the platform or application code from the GovPrime platform for use on any other platform and the Subscribing County and User shall not allow any other person or agency to use the software without the written consent of Arapahoe County. 10. Confidential information, Security and Access. 10.1. The GovPrime platform and any applications Provisioned on it will likely contain confiden- tial data. In order to maintain the confidentiality of this data the following applies: 10.1.1. The GovPrime platform will be hosted in a cloud provider that at a minimum adheres to HIPAA, PH and FeclRamp compliance protocols. Other compliance protocols may also be fol- lowed. 10.1.2. Arapahoe County will follow commercially reasonable and appropriate administrative, technical and organizational security measures to protect all data at rest and in transit to and from the platform and to safeguard against unauthorized access, disclosure or theft of the Subscribing County's data. This includes any application that is hosted on GovPrime and referenced in this Agreement and its subsequent amendments. Subscribing County data will be encrypted when in transit based on the browser used by the Subscribing County. Arapa- hoe County will designate appropriate browser(s) to be used with the platform so that the Subscribing County can utilize all of the functionality. Within the GovPrime platform and any applications, Subscribing County data will be encrypted at rest, wherever technically possi- ble. Where data is specifically identified as a specific data classification, such as P I I or HIPAA, Arapahoe County will establish compensating controls to meet generally accepted or man- dated practices. 10.1.3. Users must acknowledge the confidential nature of some or all of the data in the GovPrime system and in any of the Provisioned applications. In accordance with best prac- tices, Subscribing County and Arapahoe County Users are expected to adhere strictly to the HIPAA, P I I and Fed Ramp and other compliance protocols, depending on the data in the sys- tem. Subscribing Counties are expected to be familiar with all confidential data handling compliance protocols per the federal, state and local laws, and are expected to adhere to generally accepted best practices with data handling. If the Subscribing County is found to be using or accessing data inappropriately, it may lose access to the GovPrime platform and any Provisioned applications. 10.1.4. The Subscribing County is responsible for setting access rights and permissions for each of its Users through Active Directory Services and configuration settings in GovPrime. 10.2. Arapahoe County shall not be responsible for the misuse of data by the Subscribing County or any of the costs associated with the Subscribing County not following the prescribed compliance protocols. 10.3. Responsibilities in the Event of a Data Breach (See Section 11.2, Disclaimer of Warranties) 10.3.1. Arapahoe County shall immediately notify the Subscribing County in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident and/or Data Breach affecting Subscribing County's data. Arapahoe County may also need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external ex- pertise as mutually agreed upon. 10.3.2. In the case of a Data Breach originating from the Subscribing County, Arapahoe County will provide assistance to the Subscribing County for identification and resolution. However, the Subscribing County will have sole responsibility for any remediation actions necessary as a result of the Data Breach. Any associated costs for identifying and resolving such a breach that are incurred by Arapahoe County will be charged to the Subscribing County. 10.3.3. Arapahoe County shall promptly notify Subscribing County within 24 hours or sooner by telephone and email, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been a Data Breach. Arapahoe County shall (1) cooperate with the Subscribing County as reasonably requested by the Subscribing County to investigate and resolve the Data Breach; {2) promptly implement necessary re- medial measures as covered by the County's Cyber Liability insurance policy; and (3) docu- ment responsive actions taken related to the Data Breach, including any post -incident re- view of events and actions taken to make changes in business practices in providing the services, if necessary. 11. Indemnification and Limitation of Liability. 11.1. Assurances. 11.1.1. In any Claim that may arise from the performance of this Agreement, each Party shall seek its own legal representation and bear the costs associated with such representation, including judgments and attorney fees. In the case of delinquent payments, Arapahoe County may pursue legal action in court to secure its payment under this Agreement. 11.1.2. Subscribing County shall be solely responsible for all costs, fines and fees associated with any misuse by the employees of the Subscribing County of the services provided herein. 11.1.3. This Agreement does not, and is not intended to, impair, divest, delegate or contravene any constitutional, statutory, and/or other legal right, privilege, power, obligation, duty, or immunity of the Parties. Nothing in this Agreement shall be construed as a waiver of gov- ernmental immunity for either Party. 11.2. Disclaimer of warranties. 11.2.1. The services described in this Agreement and in the attached Services Agreement and Statement of Work for Implementation are provided on an "as is" and "as available" basis. Arapahoe County expressly disclaims all warranties of any kind, whether expressed or im- plied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose and non -infringement. 11.2.2. Arapahoe County makes no warranty that the Services will meet the Subscribing County's requirements; that the services will be uninterrupted, timely or error -free; nor does it war- rant that the results that may be obtained by the services will be accurate or reliable. 11.2.3. Any material or data downloaded or otherwise obtained through the use of the services is accessed at the Subscribing County's discretion and risk. The Subscribing County will be solely responsible for any damage to its computer system or loss of data that results from the downloading of any material. 11.3. Limitation of liability. In no event shall either Party be liable to the other Party or any other person, for any consequential, incidental, direct, indirect, special, and punitive or other damages arising out of this Agreement. 11.4. Dispute resolution. All disputes relating to the execution, interpretation, performance, or non-performance of this Agreement involving or affecting the Parties may first be submitted to Arapahoe County's Director of Information Technology and the Subscribing County's Administra- tor for possible resolution, Arapahoe County's Director of Information Technology and the Sub- scribing County's Administrator may promptly meet and confer in an effort to resolve such dis- pute. If they cannot resolve the dispute in five (5) business days, the dispute may be submitted to the signatories of this Agreement or their successors in office. The signatories of this Agree- ment may meet promptly and confer in an effort to resolve such dispute. 12. Insurance. Arapahoe County shall maintain Cyber Liability Insurance in the amount of $2,000,000 per occurrence or claim, $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as undertaken by Arapahoe County in this Agreement and shall include, but not be limited to, claims involving infringement of intellectual property, including but not limited to in- fringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of elec- tronic information, extortion and network security. The policy shall provide coverage for breach re- sponse costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations. 13. Suspension of GovPrime Services. Arapahoe County, through its Director of Information Technology, may immediately suspend GovPrime services for any of the following reasons: (i) requests by law enforcement or other governmental agencies; (ii) engagement by Subscribing County in fraudulent or illegal activities relating to the GovPrime services provided herein; (iii) breach of the terms and condi- tions of this Agreement; or (iv) security issues. The right to suspend GovPrime services is in addition to the right to terminate or cancel this Agreement according to the provisions in Section 6. Arapahoe County shall not incur any penalty, expense or liability if GovPrime services are suspended under this Section. 14. Notices. 14.1. Notices given under this Agreement shall be in writing and shall be personally delivered, sent by express delivery service, certified mail, or first class U.S. mail postage prepaid, and addressed to the person listed below. Notice will be deemed given on the date when one of the following first occur: (i) the date of actual receipt; (ii) the next business day when notice is sent express delivery service or personal delivery; or (iii) three days after mailing first class or certified U.S. mail. 14.2. If Notice is sent to Arapahoe County, it shall be addressed and sent to: Director, Arapahoe County Department of Information Technology, 5334 S. Prince Street, Littleton, Colorado 80120 and the Chairperson of the Arapahoe County Board of Commissioners, 5334 S. Prince Street, Littleton, Colorado 80120 14.3. If Notice is sent to Subscribing County, it shall be addressed to: Amanda Bay, Eagle County Government, POB 850, Eagle, CO 81631. 14.4. Either Party may change the individual to whom Notice is sent and/or the mailing address by notifying the other Party in writing of the change. 15. Notification of Legal Requests. Arapahoe County shall contact the Subscribing County upon receipt of any open records requests, electronic discovery, litigation holds, discovery searches and expert testi- monies related to the Subscribing County's Data under this contract or which in any way might rea- sonably require access to the data of the Subscribing County. Arapahoe County shall not respond to subpoenas, service of process and other legal requests related to the Subscribing County without first notifying the Subscribing County, unless prohibited by law from providing such notice. It shall be the responsibility of the Subscribing County to satisfy all record requests. 16. Non Appropriation. This Agreement shall not be construed to create a multiple fiscal -year direct or indirect debt or other financial obligation of the Parties within the meaning of Article X, Section 20 of the Colorado Constitution. Pursuant to C.R.S. § 29-1-110, as amended, the financial obligations of the Parties as set forth herein after the current fiscal year are contingent upon funds for that purpose being appropriated, budgeted and otherwise made available by the Parties' respective governing bodies. 17. Governmental Immunity. All activities performed under this Agreement are hereby declared to be governmental functions. The Parties to this Agreement and their personnel complying with or reasonably attempting to comply with this Agreement or any ordinance, order, rule or regulation enacted or promulgated pursuantto the provisions of this Agreement shall be deemed to be operating within the scope of their duties and responsibilities and in furtherance of said governmental functions. 18. No Waiver Under CGIA. Nothing in this Agreement shall be construed as a waiver by any Party of the protections afforded pursuant to the Colorado Governmental Immunity Act, Sections 24-10-101 et seq., C.R.S. ("CGIA") as same may be amended from time to time. Specifically, no Party to this Agreement waives the monetary limitations or any other rights, immunities or protections afforded by the CGIA or otherwise available at law. 19. Third Parties. This Agreement does not and shall not be deemed to confer upon any third party any right to claim damages to bring suit or other proceedings against the Parties to this Agreement. 20. Severability. In the event that any of the provisions of this Agreement shall be held to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall nevertheless con- tinue to be valid and enforceable as though the invalid or unenforceable parts had not been included therein. 21. Force Majeure. Any delays in, or failure of performance by, any Party of its obligations under this Agreement shall be excused if such delays or failure are a result of acts of God, fires, floods, strikes, labor disputes, accidents, regulations or orders of civil or military authorities, shortages of labor or materials or other causes, similar or dissimilar, that are beyond the control of such Party. 22. Modification. Except as stated herein, this Agreement may be modified or amended only by a duly authorized written instrument executed by the Parties hereto. 23. Waiver of Breach. A Party's waiver of another Party's breach of any term or provision of this Agree- ment will not operate or be construed as a waiver of any subsequent breach by any Party. 24. Authority. The Parties have taken all actions and secured all approvals necessary to authorize and complete this Agreement. The persons signing this Agreement on behalf of each Party have legal au- thority to sign this Agreement and bind the Parties to the terms and conditions contained herein. 25. Compliance with the taw. Each Party shall comply with all federal, state, and local ordinances, regu- lations, administrative rules, and requirements applicable to its activities performed under this Agree- ment. 25. No Assignment. Neither Party shall assign this Agreement. Either Party may terminate this Agreement if the other assigns this Agreement without the prior written consent of the other. 27. Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which, when taken together, shall be deemed the same instrument. Facsimile or photographic signatures of either Party to this Agreement or subsequent modifications thereto, shall be effective for all purposes. 28. Survival. The rights and obligations of the Parties shall survive the term of this Agreement to the extent that any performance is required under this Agreement after the expiration or termination of this Agreement. 29. Entire Agreement. This Agreement constitutes the entire agreement and understanding between the Parties and supersedes any prior agreement or understanding relating to the subject matter of this Agreement. 30. Governing Law/Forum/interpretation. This Agreement has been executed by the parties hereto on the day and yearfirst written above and shall be governed by the laws of the State of Colorado. Venue for any civil action relating to this Agreement shall be in Eagle County or Arapahoe County. If there is any conflict between the language of this Agreement and any exhibit or attachment, the language of this Agreement shall govern. 31. Amendments andAttochments. The intent of this agreement is to setup the basics of an agreement between the Parties, for one to many services. There should be an expectation of attachments and amendments that describe particular services. Where this document and an attachment or amend- ment for a particular service differ, the difference is for that individual service and should not be con- sidered for all services to which a party is subscribed. IN WITNESS WHEREOF, each party, by signature below of its authorized representative, hereby acknowl- edges that it has read this Agreement, understands it and agrees to be bound by its terms and conditions. COUNTY OF ARAPAHOE, STATE OF COLORADO, By and Through Its BOARD OF COUNTY COMMISSIONERS Attest: oe COUNr QPM C! By: o Clerk to the Board a COUNTY OF EAGLE, STATE OF COLORADO, By and Through Its'BOARD OF COUNTY COMMISSIONERS By: LO7 Allan H. Ryan, Chair Attest: By: Regina O'Brien, Clerk to the Board Attachment 1: List of Compliances supported in the Microsoft Azure Cloud • FERPA ■ PCI DSS Level 1, version 3.1 ■ DoD Provisional Authorizations at Impact Levels 5, 4 and 2- • FedRAMP • FIPS 140-2 • NIST 800-171 • Section 508 • HIPAA/HITECH ■ HITRUST • MARS -E