No preview available
HomeMy WebLinkAboutC22-172 CDPHE 23 FAA 00016Master Task Order Contract Number: 23 FAA 00016 Page 1 of 28 Version 02.24.2022 STATE OF COLORADO MASTER TASK ORDER CONTRACT COVER PAGE State Agency: Department of Public Health and Environment 4300 Cherry Creek Drive South Denver CO 80246 Contractor: Board of County Commissioners of Eagle County (a political subdivision of the state of Colorado) 500 Broadway Eagle CO 81631-0850 for the use and benefit of the Eagle County Public Health Agency 551 Broadway Eagle CO 81631 Master Task Order Contract Number: 23 FAA 00016 Master Task Order Contract Performance Beginning Date: The later of the Effective Date or July 1, 2022 Contract Authority: §§25-1.5-101 - 25-1.5-113, C.R.S. Initial Contract Expiration Date: June 30, 2027 The following exhibits are hereby incorporated: Exhibit 1 – Sample Task Order Principal Representatives: For the State: For Contractor: Lisa McGovern Chris Lindley Department of Public Health and Environment Eagle County Public Health Agency 4300 Cherry Creek Drive South 551 Broadway Denver CO 80246 Eagle CO 81631 lisa.mcgovern@state.co.us phgrants_contracts@eaglecounty.us Contract Purpose: The intent of this Master Task Order Contract (“Contract”) is to set forth the general terms and conditions between the Parti es and to define how the Parties will contract with each other in the future using the Task Order process as defined in this Master Task Order Contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 2 of 28 Version 02.24.2022 SIGNATURE PAGE THE PARTIES HERETO HAVE EXECUTED THIS CONTRACT Each person signing this Contract represents and warrants that he or she is duly authorized to execute this Contract and to bind the Party authorizing his or her signature. CONTRACTOR Board of County Commissioners of Eagle County (a political subdivision of the state of Colorado) for the use and benefit of the Eagle County Public Health Agency ______________________________________________ By: Signature ______________________________________________ Name of Person Signing for Contractor ______________________________________________ Title of Person Signing for Contractor Date: _________________________ STATE OF COLORADO Jared S. Polis, Governor Colorado Department of Public Health and Environment Jill Hunsaker Ryan, MPH, Executive Director ______________________________________________ By: Signature _____________________________________________ Name of Executive Director Delegate _____________________________________________ Title of Executive Director Delegate Date: _________________________ In accordance with §24-30-202, C.R.S., this Option is not valid until signed and dated below by the State Controller or an authorized delegate. STATE CONTROLLER Robert Jaros, CPA, MBA, JD _____________________________________________ By: Signature _____________________________________________ Name of State Controller Delegate _____________________________________________ Title of State Controller Delegate Effective Date:_____________________ DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 2022-04-12 Jeanne McQueeney Chair, Board of County Commissioners 2022-04-12 Procurement & Contracts Section Director ft Lisa McGovern Andi Hardy Controller 2022-04-25 Master Task Order Contract Number: 23 FAA 00016 Page 3 of 28 Version 02.24.2022 1. PARTIES This Contract is entered into by and between Contractor named on the Cover Page for this Contract (the “Contractor”), and the STATE OF COLORADO acting by and through the State agency named on the Cover Page for this Contract (the “State”). Contractor and the State agree to the terms and conditions in this Contract. 2. TERM AND EFFECTIVE DATE A. Effective Date This Contract shall not be valid or enforceable until the Effective Date. Th e State shall not be bound by any provision of this Contract before the Effective Date, and shall have no obligation to pay Contractor for any Work performed or expense incurred before the Effective Date or after the expiration or sooner termination of this Contract. B. Initial Term The Parties’ respective performances under this Contract shall commence on the Contract Performance Beginning Date shown on the Cover Page for this Contract and shall terminate on the Initial Contract Expiration Date shown on the Cover Page for this Contract (the “Initial Term”) unless sooner terminated or further extended in accordance with the terms of this Contract. C. Extension Terms - State’s Option The State, at its discretion, shall have the option to extend the performance under this Contract beyond the Initial Term for a period, or for successive periods, of one year or less at the same rates and under the same terms specified in the Contract (each such period an “Extension Term”). In order to exercise this option, the State shall provide written notice to Contractor in a form substantially equivalent to §20 “Sample Option Letter.” Except as stated in §2.D, the total duration of this Contract, including the exercise of any options to extend, shall not exceed five years from its Effective Date absent prior approval from the Chief Procurement Officer in accordance with the Colorado Procurement Code. D. End of Term Extension If this Contract approaches the end of its Initial Term, or any Extension Term then in place, the State, at its discretion, upon written notice to Contractor as provided in §14, may unilaterally extend such Initial Term or Extension Term for a period not to exceed two months (an “End of Term Extension”), regardless of whether additional Extension Terms are available or not. The provisions of this Contract in effect when such notice is given shall remain in effect during the End of Term Extension. The End of Term Extension shall automatically terminate upon execution of a replacement contract or modification extending the total term of the Contract. E. Early Termination in the Public Interest The State is entering into this Contract to serve the public interest of the State of Colorado as determined by its Governor, General Assembly, or Courts. If this Contract or any Task Order ceases to further the public interest of the State, the State, in its discretion, may terminate this Contract or that Task Order in whole or in part. A determination that this Contract should be terminated in the public interest shall not be equivalent to a State right to terminate for convenience. This subsection shall not apply to a termination of this Contract by the State for breach by Contractor, which shall be governed by §12.A.i. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 4 of 28 Version 02.24.2022 i. Method and Content The State shall notify Contractor of such termination in accordance with §14. The notice shall specify the effective date of the termination and whether it affects all or a portion of this Contract or a Task Order, and shall include, to the extent practicable, the public interest justification for the termination. A termination of all or a part of a Task Order shall not be interpreted to terminate this Contract or any other Task Order. ii. Obligations and Rights Upon receipt of a termination notice for termination in the public interest, Contractor shall be subject to the rights and obligations set forth in §12.A.i.a. iii. Payments If the State terminates this Contract or a Task Order in the public interest, the State shall pay Contractor an amount equal to the percentage of the total reimbursement payable under this Contract that corresponds to the percentage of Work satisfactorily completed and accepted under all terminated Task Orders, as determined by the State, less payments previously made. Additionally, if this Contract is less than 60% completed, as determined by the State, the State may reimburse Contractor for a portion of actual out-of-pocket expenses, not otherwise reimbursed under this Contract, incurred by Contractor which are directly attributable to the uncompleted portion of Contractor’s obligations, provided that the sum of any and all reimbursement shall not exceed the maximum amount payable to Contractor hereunder. 3. DEFINITIONS The following terms shall be construed and interpreted as follows: A. “Breach of Contract” means the failure of a Party to perform any of its obligations in accordance with this Contract, in whole or in part or in a timely or satisfactory manner. The institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within 30 days after the institution of such proceeding, shall also constitute a breach. If Contractor is debarred or suspended under §24-109-105, C.R.S. at any time during the term of this Contract, then such debarment or suspension shall constitute a breach. B. “Business Day” means any day in which the State is open and conducting business, but shall not include Saturday, Sunday or any day on which the State observes one of the holidays listed in §24-11-101(1), C.R.S. C. “Chief Procurement Officer” means the individual to whom the Executive Director has delegated his or her authority pursuant to §24-102-202, C.R.S. to procure or supervise the procurement of all supplies and Services needed by the State. D. “CJI” means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy, as amended and all Criminal Justice Records as defined under §24-72-302, C.R.S. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 5 of 28 Version 02.24.2022 E. “Contract” means this agreement, including all attached Exhibits, all documents incorporated by reference, all referenced statutes, rules and cited authorities, and any future modifications thereto. F. “Contract Funds” means the funds that have been appropriated, designated, encumbered, or otherwise made available for payment by the State under this Contract and all Task Orders. G. “CORA” means the Colorado Open Records Act, §§24-72-200.1, et. seq., C.R.S. H. “End of Term Extension” means the time period defined in §2.D. I. “Effective Date” means the date on which this Contract is approved and signed by the Colorado State Controller or designee, as shown on the Signature Page for this Contract. If this Contract is for a Major Information Technology Project, as defined in §24-37.5-102(2.6), C.R.S., then the Effective Date of this Contract shall be the later of the date on which this Contract is approved and signed by the State’s Chief Information Officer or authorized delegate or the date on which this Contract is approved and signed by the State Controller or authorized delegate, as shown on the Signature Page for this Contract J. “Exhibits” means the exhibits and attachments included with this Contract as shown on the Cover Page for this Contract. K. “Extension Term” means the time period defined in §2.C. L. “Federal Award” means an award of Federal financial assistance or a cost-reimbursement contract under the Federal Acquisition Regulations by a Federal Awarding Agency to the Recipient. “Federal Award” also means an agreement setting forth the terms and conditions of the Federal Award. The term does not include payments to a Contractor or payments to an Individual that is a beneficiary of a Federal program. M. “Federal Awarding Agency” means a Federal agency providing a Federal Award to a Recipient. [Insert Federal Awarding Agency's Full Legal Name and Acronym] is the Federal Awarding Agency for the Federal Award which is the subject of this Contract. N. “Goods” means any movable material acquired, produced, or delivered by Contractor as set forth in this Contract and shall include any movable material acquired, produced, or delivered by Contractor in connection with the Services. O. “Incident” means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, which are included as part of the Work, as described in §§24-37.5-401 et seq., C.R.S. Incidents include, without limitation (i) successful attempts to gain unauthorized access to a State system or State Information regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State’s knowledge, instruction, or consent. P. “Initial Term” means the time period defined in §2.B. Q. “Party” means the State or Contractor, and “Parties” means both the State and Contractor. R. “PCI” means payment card information including any data related to credit card holders’ names, credit card numbers, or the other credit card information as may be protected by state or federal law. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 6 of 28 Version 02.24.2022 S. “PII” means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. PII includes, but is not limited to, all information defined as personally identifiable information in §§24-72-501 and 24-73-101, C.R.S. T. “PHI” means any protected health information, including, without limitation any information whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. PHI includes, but is not limited to, any information defined as Individually Identifiable Health Information by the federal Health Insurance Portability and Accountability Act. U. “Project” means the Work that is included in a Task Order. V. “Recipient” means the State Agency shown on the first page of this Contract, for the purposes of the Federal Award. W. “Services” means the Services to be performed by Contractor as set forth in this Contract, and shall include any Services to be rendered by Contractor in connection with the Goods. X. “State Confidential Information” means any and all State Records not subject to disclosure under CORA. State Confidential Information shall include, but is not limited to, PII, PHI, PCI, Tax Information, CJI, and State personnel records not subject to disclosure under CORA. State Confidential Information shall not include information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished, or disclosed by the State to Contractor which (i) is subject to disclosure pursuant to CORA; (ii) is already known to Contractor without restrictions at the time of its disclosure to Contractor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Contractor to the State; (iv) is disclosed to Contractor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any S tate Confidential Information. Y. “State Fiscal Rules” means the fiscal rules promulgated by the Colorado State Controller pursuant to §24-30-202(13)(a), C.R.S. Z. “State Fiscal Year” means a 12 month period beginning on July 1 of each calendar year and ending on June 30 of the following calendar year. If a single calendar year follows the term, then it means the State Fiscal Year ending in that calendar year. AA. “State Records” means any and all State data, information, and records, regardless of physical form, including, but not limited to, information subject to disclosure under CORA. BB. Sub-Award” means a grant by the State (a Recipient) to Grantee (a Subrecipient) funded in whole or in part by a Federal Award. The terms and conditions of the Federal Award flow down to the Sub-Award unless the terms and conditions of the Federal Award specifically indicate otherwise DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 7 of 28 Version 02.24.2022 CC. “Subcontractor” means third-parties, if any, engaged by Contractor to aid in performance of the Work. DD. “Subrecipient” means a state, local government, Indian tribe, institution of higher education (IHE), or nonprofit organization entity that receives a Sub-Award from a Recipient to carry out part of a Federal program, but does not include an individual that is a beneficiary of such program. A Subrecipient may also be a recipient of other Federal Awards directly from a Federal Awarding Agency. EE. “Task Order” means a document issued in accordance with §4.B of this Contract that specifically describes the Work to be performed on a Project. FF. “Tax Information” means federal and State of Colorado tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation. Tax Information includes, but is not limited to all information defined as federal tax information in Internal Revenue Service Publication 1075. GG. “Uniform Guidance” means the Office of Management and Budget Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards, 2 CFR Part 200, commonly known as the “Super Circular,” which supersedes requirements from OMB Circulars A-21, A-87, A-89, A-102, A-110, A-122, and A-133, and the guidance in Circular A-50 on Single Audit Act follow-up. HH. “Work” means the Goods delivered and Services performed pursuant to this Contract and any Task Order(s) issued pursuant to this Contract. II. “Work Product” means the tangible and intangible results of the Work, whether finished or unfinished, including drafts. Work Product includes, but is not limited to, documents, text, software (including source code), research, reports, proposals, specifications, plans, notes, studies, data, images, photographs, negatives, pictures, drawings, designs, models, surveys, maps, materials, ideas, concepts, know-how, and any other results of the Work. “Work Product” does not include any material that was developed prior to the Effective Date that is used, without modification, in the performance of the Work. Any other term used in this Contract that is defined in an Exhibit shall be construed and interpreted as defined in that Exhibit. 4. STATEMENT OF WORK AND TASK ORDERS A. General Statement of Work It is the express intent of the Parties to: i. enter into a Master Task Order Contract for the purchase and delivery of health and environmental Services; ii. forth the terms and conditions under which these Services shall be performed by the Contractor. B. Task Orders The Parties expressly acknowledge that while this Contract authorizes the purchase of health and environmental Services pursuant to its terms and conditions, no specific purchase of Services is made by this Contract. The State may purchase health and environmental Services from the Contractor and the Contractor may provide health and environmental Services to the DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 8 of 28 Version 02.24.2022 State, under this Contract through a Task Order(s). A Task Order(s) incorporates by reference all the terms and conditions of this Contract. i. Task Order Development When the State and the Contractor mutually agree upon the Services to be purchased from and performed by, the Contractor, the Parties may enter into a Task Order, with an accompanying Statement of Work and Budget, for the purchase and delivery of those Services. The State's financial obligation to the Contractor for specific health and environmental Services accrues only upon the full execution, including approval by the State Controller or delegee, of a Task Order authorizing the Contractor to perform and deliver those Services and the Contractor’s performance of the Work described in that Task Order. ii. Task Order Issuance Upon negotiation and agreement by the Parties regarding the scope of the Project, the Task Order Maximum Amount, the time for performance and other applicable terms and conditions, a Task Order, in substantially the form attached herein as Exhibit 1, shall be prepared by the State. Following acceptance of the Task Order terms and conditions, which must include the negotiated Statement of Work and Budget, the total hours anticipated to adequately and successfully completing the Work, the hourly rate for each individual (and that individual’s position title) who will perform the Work, the Project plan. The authorized representatives of the Contractor will sign the Task Order. Upon signature by the State and the State Controller or delegee and delivery of a fully signed Task Order to the Contractor, the Contractor shall undertake performance of the specified Projects and will perform such Projects in a manner inspiring confidence that such Projects will be successfully completed within the time frame and price range agreed to in the Task Order. The Contractor may be required to provide the State with reports to include invoices of actual hours of service and a statement of the various Projects’ status. To ensure delivery of the Services required under this Contract, the State may elect to conduct an evaluation of the Contractor’s performance of the Work on a periodic basis. iii. Task Order Completion Performance of Work and payment for a Project shall be governed by the standards, procedures and terms set forth in this Contract and in the associated Task Order. The Contractor warrants that upon negotiation and acceptance of the Task Order, the Contractor’s performance will be successfully completed within the time frame and price stated in the Task Order. iv. Task Order Modifications Task Orders may be renewed, extended, and/or modified by way of the Contract amendment process outlined in the Task Order, in accordance with State fiscal rules. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 9 of 28 Version 02.24.2022 Any changes to this Contract must be made by written amendment pursuant to the terms and conditions of this Contract. v. Task Order Termination Regardless of the date of any deliverable or other end result of a Task Order, all Task Orders shall automatically terminate upon the date that this Contract expires or is terminated for any reason, unless the State directs otherwise in writing. 5. PAYMENTS TO CONTRACTOR A. Maximum Amount Payments to Contractor are limited to the unpaid, obligated balance of the Contract Funds. The State shall not pay Contractor any amount under this Contract that exceeds the Contract Maximum for that State Fiscal Year shown on the Cover Page for this Contract. B. Payment Procedures i. Invoices and Payment a. The State shall pay Contractor in the amounts and in accordance with the schedule and other conditions set forth in Exhibit C Budget attached to the Task Order. b. Contractor shall initiate payment requests by invoice to the State, in a form and manner approved by the State. c. The State shall pay each invoice within 45 days following the State’s receipt of that invoice, so long as the amount invoiced correctly represents Work completed by Contractor and previously accepted by the State during the term that the invoice covers. If the State determines that the amount of any invoice is not correct, then Contractor shall make all changes necessary to correct that invoice. d. The acceptance of an invoice shall not constitute acceptance of any Work performed or deliverables provided under this Contract. ii. Interest Amounts not paid by the State within 45 days after the State’s acceptance of the invoice shall bear interest on the unpaid balance beginning on the 45th day at the rate of 1% per month, as required by §24-30-202(24)(a), C.R.S., until paid in full; provided, however, that interest shall not accrue on unpaid amounts that the State disputes in writing. Contractor shall invoice the State separately for accrued interest on delinquent amounts, and the invoice shall reference the delinquent payment, the number of day’s interest to be paid and the interest rate. iii. Payment Disputes If Contractor disputes any calculation, determination or amount of any payment, Contractor shall notify the State in writing of its dispute within 30 days following the earlier to occur of Contractor’s receipt of the payment or notification of the determination or calculation of the payment by the State. The State will review the information presented by Contractor and may make changes to its determination based on this review. The calculation, determination or payment amount that results from the State’s review shall not be subject to additional dispute under this subsection. No payment subject to a dispute under this subsection shall be due until after the State has DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 10 of 28 Version 02.24.2022 concluded its review, and the State shall not pay any interest on any amount during the period it is subject to dispute under this subsection. iv. Available Funds-Contingency-Termination The State is prohibited by law from making commitments beyond the term of the current State Fiscal Year. Payment to Contractor beyond the current State Fiscal Year is contingent on the appropriation and continuing availability of Contract Funds in any subsequent year (as provided in the Colorado Special Provisions). If federal funds or funds from any other non-State funds constitute all or some of the Contract Funds the State’s obligation to pay Contractor shall be contingent upon such non -State funding continuing to be made available for payment. Payments to be made pursuant to this Contract shall be made only from Contract Funds, and the State’s liability for such payments shall be limited to the amount remaining of such Contract Funds. If State, federal or other funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may, upon written notice, terminate this Contract, in whole or in part, without incurring further liability. The State shall, however, remain obligated to pay for Services and Goods that are delivered and accepted prior to the effective date of notice of termination, and this termination shall otherwise be treated as if this Contract were terminated in the public interest as described in §2.E. v. Option to Increase Maximum Amount If the Signature and Cover Pages for this Contract show that the State has the Option to Increase or Decrease Maximum Amount, then the State, at its discretion, shall have the option to increase or decrease the statewide quantity of Goods and Services based upon the rates established in this Contract, and increase the maximum amount payable accordingly. In order to exercise this option, the State shall provide written notice to Contractor in a form substantially equivalent to §20 “Sample Option Letter.” Delivery of Goods and performance of Services shall continue at the same rates and terms as described in this Contract. The State may include and incorporate a revised budget with the option letter, as long as the revised budget does not unilaterally change rates or terms specified in the Contract. vi. Option to Increase Rates In the event the rates shown in the Exhibits are determined by a third party, the State, at its discretion, shall have the option to increase or decrease the rates shown in the Exhibits as the State determines is necessary to account for increases or decreases in the rates. In order to exercise this option, the State shall provide written notice to Contractor in a form substantially equivalent to §20 “Sample Option Letter,” and any new rates table or exhibit shall be effective as of the effective date of that notice unless the notice provides for a different date. 6. REPORTING – NOTIFICATION A. Quarterly Reports. In addition to any reports required pursuant to §17 or pursuant to any other Exhibit, for any contract having a term longer than three months, Contractor shall submit, on a quarterly basis, a written report specifying progress made for each specified performance measure and standard in this Contract. Such progress report shall be in accordance with the procedures developed and prescribed by the State. Progress reports shall be submitted to the State not DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 11 of 28 Version 02.24.2022 later than five Business Days following the end of each calendar quarter or at such time as otherwise specified by the State. B. Litigation Reporting If Contractor is served with a pleading or other document in connection with an action before a court or other administrative decision making body, and such pleading or document relates to this Contract or may affect Contractor’s ability to per form its obligations under this Contract, Contractor shall, within 10 days after being served, notify the State of such action and deliver copies of such pleading or document to the State’s principal representative identified on the Cover Page for this Contract. C. Performance Outside the State of Colorado or the United States, §24-102-206, C.R.S. To the extent not previously disclosed in accordance with §24-102-206, C.R.S., Contractor shall provide written notice to the State, in accordance with §14 and in a form designated by the State, within 20 days following the earlier to occur of Contractor’s decision to perform Services outside of the State of Colorado or the United States, or its execution of an agreement with a Subcontractor to perform, Services outside the State of Colorado or the United States. Such notice shall specify the type of Services to be performed outside the State of Colorado or the United States and the reason why it is necessary or advantageous to perform such Services at such location or locations, and such notice shall be a public record. Knowing failure by Contractor to provide notice to the State under this section shall constitute a breach of this Contract. This section shall not apply if the Contract Funds include any federal funds. 7. CONTRACTOR RECORDS A. Maintenance Contractor shall maintain a file of all documents, records, communications, notes and other materials relating to the Work (the “Contractor Records”). Contractor Records shall include all documents, records, communications, notes and other materials maintained by Contractor that relate to any Work performed by Subcontractors, and Contractor shall maintain all records related to the Work performed by Subcontractors required to ensure proper performance of that Work. Contractor shall maintain Contractor Records until the last to occur of: (i) the date three (3) years after the date this Contract expires or is terminated, (ii) final payment under this Contract is made, (iii) the resolution of any pending Contract matters, or (iv) if an audit is occurring, or Contractor has received notice that an audit is pending, the date such audit is completed and its findings have been resolved (the “Record Retention Period”). B. Inspection Contractor shall permit the State to audit, inspect, examine, excerpt, copy and transcribe Contractor Records during the Record Retention Period. Contractor shall make Contractor Records available during normal business hours at Contractor’s office or place of business, or at other mutually agreed upon times or locations, upon no fewer than two Business Days’ notice from the State, unless the State determines that a shorter period of notice, or no notice, is necessary to protect the interests of the State. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 12 of 28 Version 02.24.2022 C. Monitoring The State, in its discretion, may monitor Contractor’s performance of its obligations under this Contract using procedures as determined by the State. The State shall monitor Contractor’s performance in a manner that does not unduly interfere with Contractor’s performance of the Work. D. Final Audit Report Contractor shall promptly submit to the State a copy of any final audit report of an audit performed on Contractor’s records that relates to or affects this Contract or the Work, whether the audit is conducted by Contractor or a third party. 8. CONFIDENTIAL INFORMATION-STATE RECORDS A. Confidentiality Contractor shall keep confidential, and cause all Subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Contractor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this Contract, permitted by law or approved in Writing by the State.” Contractor shall provide for the security of all State Confidential Information in accordance with all policies promulgated by the Colorado Office of Information Security and all applicable laws, rules, policies, publications, and guidelines. If Contractor or any of its Subcontractors will or may receive the following types of data, Contractor or its Subcontractors shall provide for the security of such data according to the following: (i) the most recently promulgated IRS Publication 1075 for all Tax Information and in accordance with the Safeguarding Requirements for Federal Tax Information attached to this Contract as an Exhibit, if applicable, (ii) the most recently updated PCI Data Security Standard from the PCI Security Standards Council for all PCI, (iii) the most recently issued version of the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy for all CJI, and (iv) the federal Health Insurance Portability and Accountability Act for all PHI and the HIPAA Business Associate Agreement attached to this Contract if applicable. Contractor shall immediately forward any request or demand for State Records to the State’s principal representative. B. Other Entity Access and Nondisclosure Agreements Contractor may provide State Records to its agents, employees, assigns and Subcontractors as necessary to perform the Work, but shall restrict access to State Confidential Information to those agents, employees, assigns and Subcontractors who require access to perform their obligations under this Contract. Contractor shall ensure all such agents, employees, assigns, and Subcontractors sign agreements containing nondisclosure provisions at least as protective as those in this Contract, and that the nondisclosure provisions are in force at al l times the agent, employee, assign or Subcontractor has access to any State Confidential Information. Contractor shall provide copies of those signed nondisclosure provisions to the State upon execution of the nondisclosure provisions. C. Use, Security, and Retention Contractor shall use, hold and maintain State Confidential Information in compliance with any and all applicable laws and regulations in facilities located within the United States, and shall maintain a secure environment that ensures confidentiality of all State Confidential DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 13 of 28 Version 02.24.2022 Information wherever located. Contractor shall provide the State with access, subject to Contractor’s reasonable security requirements, for purposes of inspecting and monitoring access and use of State Confidential Information and evaluating security control effectiveness. Upon the expiration or termination of this Contract, Contractor shall return State Records provided to Contractor or destroy such State Records and certify to the State that it has done so, as directed by the State. If Contractor is prevented by law or regulation from returning or destroying State Confidential Information, Contractor warrants it will guarantee the confidentiality of, and cease to use, such State Confidential Information. D. Incident Notice and Remediation If Contractor becomes aware of any Incident, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Contractor can establish that none of Contractor or any of its agents, employees, assigns or Subcontractors are the cause or source of the Incident, Contractor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Contractor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State at no additional cost to the State. The State may, in its sole discretion and at Contractor’s sole expense, require Contractor to engage the Services of an independent, qualified, State-approved third party to conduct a security audit. Contractor shall provide the State with the results of such audit and evidence of Contractor’s planned remediation in response to any negative findings. E. Data Protection and Handling Contractor shall ensure that all State Records and Work Product in the possession of Contractor or any Subcontractors are protected and handled in accordance with the requirements of this Contract, including the requirements of any Exhibits hereto, at all times. F. Safeguarding PII If Contractor or any of its Subcontractors will or may receive PII under this Contract, Contractor shall provide for the security of such PII, in a manner and form acceptable to the State, including, without limitation, State non-disclosure requirements, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Contractor shall be a “Third-Party Service Provider” as defined in §24-73-103(1)(i), C.R.S. and shall maintain security procedures and practices consistent with §§24-73-101 et seq., C.R.S. 9. CONFLICTS OF INTEREST A. Actual Conflicts of Interest Contractor shall not engage in any business or activities, or maintain any relationships that conflict in any way with the full performance of the obligations of Contractor under this Contract. Such a conflict of interest would arise when a Contractor or Subcontractor’s employee, officer or agent were to offer or provide any tangible personal benefit to an employee of the State, or any member of his or her immediate family or his or her partner, related to the award of, entry into or management or oversight of this Contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 14 of 28 Version 02.24.2022 B. Apparent Conflicts of Interest Contractor acknowledges that, with respect to this Contract, even the appearance of a conflict of interest shall be harmful to the State’s interests. Absent the State’s prior written approval, Contractor shall refrain from any practices, activities or relationships that reasonably appear to be in conflict with the full performance of Contractor’s obligations under this Contract. C. Disclosure to the State If a conflict or the appearance of a conflict arises, or if Contractor is uncertain whether a conflict or the appearance of a conflict has arisen, Contractor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction in regard to the actual or apparent conflict constitutes a breach of this Contract. 10. INSURANCE Contractor shall obtain and maintain, and ensure that each Subcontractor shall obtain and maintain, insurance as specified in this section at all times during the term of this Contract. All insurance policies required by this Contract that are not provided through self-insurance shall be issued by insurance companies as approved by the State. A. Contractor Insurance The Contractor is a "public entity" within the meaning of the Colorado Governmental Immunity Act, §24-10-101, et seq., C.R.S. (the “GIA”) and shall maintain at all times during the term of this Contract such liability insurance, by commercial policy or self -insurance, as is necessary to meet its liabilities under the GIA. B. Subcontractor Requirements Contractor shall ensure that each Subcontractor that is a public entity within the meaning of the GIA, maintains at all times during the terms of this Contract, such liability insurance, by commercial policy or self-insurance, as is necessary to meet the Subcontractor’s obligations under the GIA. Contractor shall ensure that each Subcontractor that is not a public entity within the meaning of the GIA, maintains at all times during the terms of this Contract all of the following insurance policies: i. Workers’ Compensation Workers’ compensation insurance as required by state statute, and employers’ liability insurance covering all Contractor or Subcontractor employees acting within the course and scope of their employment. ii. General Liability Commercial general liability insurance covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: a. $1,000,000 each occurrence; b. $1,000,000 general aggregate; c. $1,000,000 products and completed operations aggregate; and d. $50,000 any one fire. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 15 of 28 Version 02.24.2022 iii. Automobile Liability Automobile liability insurance covering any auto (including owned, hired and non- owned autos) with a minimum limit of $1,000,000 each accident combined single limit. iv. Protected Information Liability insurance covering all loss of State Confidential Information, such as PII, PHI, PCI, Tax Information, and CJI, and claims based on alleged violations of privacy rights through improper use or disclosure of protected information with minimum limits as follows: a. $1,000,000 each occurrence; and b. $2,000,000 general aggregate. v. Professional Liability Insurance Professional liability insurance covering any damages caused by an error, omission or any negligent act with minimum limits as follows: a. $1,000,000 each occurrence; and b. $1,000,000 general aggregate. vi. Crime Insurance Crime insurance including employee dishonesty coverage with minimum limits as follows: a. $1,000,000 each occurrence; and b. $1,000,000 general aggregate. C. Additional Insured The State shall be named as additional insured on all commercial general liability policies (leases and construction contracts require additional insured coverage for completed operations) required of Contractor and Subcontractors. D. Primacy of Coverage Coverage required of Contractor and each Subcontractor shall be primary over any insurance or self-insurance program carried by Contractor or the State. E. Cancellation All commercial insurance policies shall include provisions preventing cancellation or non- renewal, except for cancellation based on non-payment of premiums, without at least 30 days prior notice to Contractor and Contractor shall forward such notice to the State in accordance with §14 within seven days of Contractor’s receipt of such notice. F. Subrogation Waiver All commercial insurance policies secured or maintained by Contractor or its Subcontractors in relation to this Contract shall include clauses stating that each carrier shall waive all rights of recovery under subrogation or otherwise against Contractor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 16 of 28 Version 02.24.2022 G. Certificates For each commercial insurance plan provided by Contractor under this Contract, Contractor shall provide to the State certificates evidencing Contractor’s insurance coverage required in this Contract within seven Business Days following the Effective Date. Contractor shall provide to the State certificates evidencing Subcontractor insurance coverage required under this Contract within seven Business Days following the Effective Date, except that, if Contractor’s subcontract is not in effect as of the Effective Date, Contractor shall provide to the State certificates showing Subcontractor insurance coverage required under this Contract within seven Business Days following Contractor’s execution of the subcontract. No later than 15 days before the expiration date of Contractor’s or any Subcontractor’s coverage, Contractor shall deliver to the State certificates of insurance evidencing renewals of coverage. At any other time during the term of this Contract, upon request by the State, Contractor shall, within seven Business Days following the request by the State, supply to the State evidence satisfactory to the State of compliance with the provisions of this §10. 11. BREACH OF CONTRACT In the event of a Breach of Contract, the aggrieved Party shall give written notice of breach to the other Party. If the notified Party does not cure the Breach of Contract, at its sole expense, within 30 days after the delivery of written notice, the Party may exercise any of the remedies as described in §12 for that Party. Notwithstanding any provision of this Contract to the contrary, the State, in its discretion, need not provide notice or a cure period and may immediately terminate this Contract in whole or in part or institute any other remedy in this Contract in order to protect the public interest of the State; or if Contractor is debarred or suspended under §24-109-105, C.R.S., the State, in its discretion, need not provide notice or cure period and may terminate this Contract in whole or in part or institute any other remedy in this Contract as of the date that the debarment or suspension takes effect. 12. REMEDIES A. State’s Remedies If Contractor is in breach under any provision of this Contract and fails to cure such breach, the State, following the notice and cure period set forth in §11, shall have all of the remedies listed in this section in addition to all other remedies set forth in this Contract or at law. The State may exercise any or all of the remedies available to it, in its discretion, concurrently or consecutively. i. Termination for Breach In the event of Contractor’s uncured breach, the State may terminate this entire Contract or any part of this Contract. Contractor shall continue performance of this Contract to the extent not terminated, if any. a. Obligations and Rights To the extent specified in any termination notice, Contractor shall not incur further obligations or render further performance past the effective date of such notice, and shall terminate outstanding orders and subcontracts with third parties. However, Contractor shall complete and deliver to the State all Work not cancelled by the termination notice, and may incur obligations as necessary to do so within this Contract’s terms. At the request of the State, Contractor shall assign to the State all of Contractor's rights, title, and interest in and to such terminated DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 17 of 28 Version 02.24.2022 orders or subcontracts. Upon termination, Contractor shall take timely, reasonable and necessary action to protect and preserve property in the possession of Contractor but in which the State has an interest. At the State’s request, Contractor shall return materials owned by the State in Contractor’s possession at the time of any termination. Contractor shall deliver all completed Work Product and all Work Product that was in the process of completion to the State at the State’s request. b. Payments Notwithstanding anything to the contrary, the State shall only pay Contractor for accepted Work received as of the date of termination. If, after termination by the State, the State agrees that Contractor was not in breach or that Contractor's action or inaction was excusable, such termination shall be treated as a termination in the public interest, and the rights and obligations of the Parties shall be as if this Contract had been terminated in the public interest under §2.E. c. Damages and Withholding Notwithstanding any other remedial action by the State, Contractor shall remain liable to the State for any damages sustained by the State in connection with any breach by Contractor, and the State may withhold payment to Contractor for the purpose of mitigating the State’s damages until such time as the exact amount of damages due to the State from Contractor is determined. The State may withhold any amount that may be due Contractor as the State deems necessar y to protect the State against loss including, without limitation, loss as a result of outstanding liens and excess costs incurred by the State in procuring from third parties replacement Work as cover. ii. Remedies Not Involving Termination The State, in its discretion, may exercise one or more of the following additional remedies: a. Suspend Performance Suspend Contractor’s performance with respect to all or any portion of the Work pending corrective action as specified by the State without entitling Contractor to an adjustment in price or cost or an adjustment in the performance schedule. Contractor shall promptly cease performing Work and incurring costs in accordance with the State’s directive, and the State shall not be liable for costs incurred by Contractor after the suspension of performance. b. Withhold Payment Withhold payment to Contractor until Contractor corrects its Work. c. Deny Payment Deny payment for Work not performed, or that due to Contractor’s actions or inactions, cannot be performed or if they were performed are reasonably of no value to the state; provided, that any denial of payment shall be equal to the value of the obligations not performed. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 18 of 28 Version 02.24.2022 d. Removal Demand immediate removal of any of Contractor’s employees, agents, or Subcontractors from the Work whom the State deems incompetent, careless, insubordinate, unsuitable, or otherwise unacceptable or whose continued relation to this Contract is deemed by the State to be contrary to the public interest or the State’s best interest. e. Intellectual Property If any Work infringes, or if the State in its sole discretion determines that any Work is likely to infringe, a patent, copyright, trademark, trade secret or other intellectual property right, Contractor shall, as approved by the State (i) secure that right to use such Work for the State and Contractor; (ii) replace the Work with non-infringing Work or modify the Work so that it becomes non-infringing; or, (iii) remove any infringing Work and refund the amount paid for such Work to the State. B. Contractor’s Remedies If the State is in breach of any provision of this Contract and does not cure such breach, Contractor, following the notice and cure period in §11 and the dispute resolution process in §13 shall have all remedies available at law and equity. 13. DISPUTE RESOLUTION A. Initial Resolution Except as herein specifically provided otherwise, disputes concerning the performance of this Contract which cannot be resolved by the designated Contract representatives shall be referred in writing to a senior departmental management staff member designated by the State and a senior manager designated by Contractor for resolution. B. Resolution of Controversies If the initial resolution described in §13.A fails to resolve the dispute within 10 Business Days, Contractor shall submit any alleged breach of this Contract by the State to the Procurement Official of the State Agency named on the Cover Page of this Contract as described in §24-102-202(3), C.R.S. for resolution in accordance with the provisions of §24- 106-109, C.R.S., and §§24-109-101.1 through 24-109-505, C.R.S. (the “Resolution Statutes”), except that if Contractor wishes to challenge any decision rendered by the Procurement Official, Contractor’s challenge shall be an appeal to the executive director of the Department of Personnel and Administration, or their delegate, under the Resolution Statutes before Contractor pursues any further action as permitted by such statutes. Except as otherwise stated in this Section, all requirements of the Resolution Statutes shall app ly including, without limitation, time limitations. 14. NOTICES AND REPRESENTATIVES Each individual identified as a Principal Representative on the Cover Page for this Contract shall be the principal representative of the designating Party. All notices requi red or permitted to be given under this Contract shall be in writing, and shall be delivered (A) by hand with receipt required, (B) by certified or registered mail to such Party’s principal representative at the address set forth below or (C) as an email with read receipt requested to the principal representative at the email address, if any, set forth on the Cover Page for this Contract. If a Party delivers a notice to DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 19 of 28 Version 02.24.2022 another through email and the email is undeliverable, then, unless the Party has been provided with an alternate email contact, the Party delivering the notice shall deliver the notice by hand with receipt required or by certified or registered mail to such Party’s principal representative at the address set forth on the Cover Page for this Contract. Either Party may change its principal representative or principal representative contact information, or may designate specific other individuals to receive certain types of notices in addition to or in lieu of a principal representative by notice submitted in accordance with this section without a formal amendment to this Contract. Unless otherwise provided in this Contract, notices shall be effective upon delivery of the written notice. 15. RIGHTS IN WORK PRODUCT AND OTHER INFORMATION A. Work Product Contractor assigns to the State and its successors and assigns, the entire right, title, and interest in and to all causes of action, either in law or in equity, for past, present, or future infringement of intellectual property rights related to the Work Product and all works based on, derived from, or incorporating the Work Product. Whether or not Contractor is under contract with the State at the time, Contractor shall execute applications, assignments, and other documents, and shall render all other reasonable assistance requested by the State, to enable the State to secure patents, copyrights, licenses and other intellectual property rights related to the Work Product. To the extent that Work Product would fall under the definition of “works made for hire” under 17 U.S.C.S. §101, the Parties intend the Work Product to be a work made for hire. i. Copyrights To the extent that the Work Product (or any portion of the Work Product) would not be considered works made for hire under applicable law, Contractor hereby assigns to the State, the entire right, title, and interest in and to copyrights in all Work Product and all works based upon, derived from, or incorporating the Work Product; all copyright applications, registrations, extensions, or renewals relating to all Work Product and all works based upon, derived from, or incorporating the Work Product; and all moral rights or similar rights with respect to the Work Product throughout the world. To the extent that Contractor cannot make any of the assignments required by this section, Contractor hereby grants to the State a perpetual, irrevocable, royalty-free license to use, modify, copy, publish, display, perform, transfer, distribute, sell, and create derivative works of the Work Product and all works based upon, derived from, or incorporating the Work Product by all means and methods and in any format now known or invented in the future. The State may assign and license its rights under this license. ii. Patents In addition, Contractor grants to the State (and to recipients of Work Product distributed by or on behalf of the State) a perpetual, worldwide, no-charge, royalty-free, irrevocable patent license to make, have made, use, distribute, sell, offer for sale, import, transfer, and otherwise utilize, operate, modify and propagate the contents of the Work Product. Such license applies only to those patent claims licensable by Contractor that are necessarily infringed by the Work Product alone, or by the combination of the Work Product with anything else used by the State. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 20 of 28 Version 02.24.2022 B. Exclusive Property of the State Except to the extent specifically provided elsewhere in this Contract, any pre-existing State Records, State software, research, reports, studies, photographs, negatives or other documents, drawings, models, materials, data and information shall be the exclusive property of the State (collectively, “State Materials”). Contractor shall not use, willingly allow, cause or permit Work Product or State Materials to be used for any purpose other than the performance of Contractor’s obligations in this Contract without the prior written consent of the State. Upon termination of this Contract for any reason, Contractor shall provide all Work Product and State Materials to the State in a form and manner as directed by the State. C. Exclusive Property of Contractor Contractor retains the exclusive rights, title, and ownership to any and all pre-existing materials owned or licensed to Contractor including, but not limited to, all pre-existing software, licensed products, associated source code, machine code, text images, audio and/or video, and third-party materials, delivered by Contractor under the Contract, whether incorporated in a Deliverable or necessary to use a Deliverable (collectively, “Contractor Property”). Contractor Property shall be licensed to the State as set forth in this Contract or a State approved license agreement: (i) entered into as exhibits to this Contract; (ii) obtained by the State from the applicable third-party vendor; or (iii) in the case of open source software, the license terms set forth in the applicable open source license agreement. 16. GOVERNMENTAL IMMUNITY Liability for claims for injuries to persons or property arising from the negligence of the Parties, their departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the Colorado Governmental Immunity Act, §24-10- 101, et seq., C.R.S.; the Federal Tort Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C. 1346(b), and the State’s risk management statutes, §§24-30-1501, et seq. C.R.S. No term or condition of this Contract shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, contained in these statutes. 17. STATEWIDE CONTRACT MANAGEMENT SYSTEM If the maximum amount payable to Contractor under this Contract is $100,000 or greater, either on the Effective Date or at any time thereafter, this §17 shall apply. Contractor agrees to be governed by and comply with the provisions of §24-106-103, §24-102-206, §24-106-106, and §24- 106-107, C.R.S. regarding the monitoring of vendor performance and the reporting of contract performance information in the State’s contract management system (“Contract Management System” or “CMS”). Contractor’s performance shall be subject to evaluation and review in accordance with the terms and conditions of this Contract, Colorado statutes governing CMS, and State Fiscal Rules and State Controller policies. 18. GENERAL PROVISIONS A. Assignment Contractor’s rights and obligations under this Contract are personal and may not be transferred or assigned without the prior, written consent of the State. Any attempt at assignment or transfer without such consent shall be void. Any assignment or transfer of Contractor’s rights and obligations approved by the State shall be subject to the provisions of this Contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 21 of 28 Version 02.24.2022 B. Subcontracts Contractor shall not enter into any subcontract in connection with its obligations under this Contract without the prior, written approval of the State. Contractor shall submit to the State a copy of each such subcontract upon request by the State. All subcontracts entered into by Contractor in connection with this Contract shall comply with all applicable federal and state laws and regulations, shall provide that they are governed by the laws of the State of Colorado, and shall be subject to all provisions of this Contract. C. Binding Effect Except as otherwise provided in §18.A, all provisions of this Contract, including the benefits and burdens, shall extend to and be binding upon the Parties’ respective successors and assigns. D. Authority Each Party represents and warrants to the other that the execution and delivery of this Contract and the performance of such Party’s obligations have been duly authorized. E. Captions and References The captions and headings in this Contract are for convenience of reference only, and shall not be used to interpret, define, or limit its provisions. All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits or other attachments, are references to sections, subsections, exhibits or other attachments contained herein or incorporated as a part hereof, unless otherwise noted. F. Counterparts This Contract may be executed in multiple, identical, original counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement. G. Entire Understanding This Contract represents the complete integration of all understandings between the Parties related to the Work, and all prior representations and understandings related to the Work, oral or written, are merged into this Contract. Prior or contemporaneous additions, deletions, or other changes to this Contract shall not have any force or effect whatsoever, unless embodied herein. H. Digital Signatures If any signatory signs this agreement using a digital signature in accordance with the Colorado State Controller Contract, Grant and Purchase Order Policies regarding the use of digital signatures issued under the State Fiscal Rules, then any agreement or consent to use digital signatures within the electronic system through which that signatory signed shall be incorporated into this Contract by reference. I. Modification Except as otherwise provided in this Contract, any modification to this Contract shall only be effective if agreed to in a formal amendment to this Contract, properly executed and approved in accordance with applicable Colorado State law and State Fiscal Rules. Modifications DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 22 of 28 Version 02.24.2022 permitted under this Contract, other than contract amendments, shall conform to the policies issued by the Colorado State Controller. J. Statutes, Regulations, Fiscal Rules, and Other Authority. Any reference in this Contract to a statute, regulation, State Fiscal Rule, fiscal policy or other authority shall be interpreted to refer to such authority then current, as may have been changed or amended since the Effective Date of this Contract. K. Severability The invalidity or unenforceability of any provision of this Contract shall not affect the validity or enforceability of any other provision of this Contract, which shall remain in full force and effect, provided that the Parties can continue to perform their obligations under this Contract in accordance with the intent of this Contract. L. Survival of Certain Contract Terms Any provision of this Contract that imposes an obligation on a Party after termination or expiration of the Contract shall survive the termination or expiration of this Contract and shall be enforceable by the other Party. M. Taxes The State is exempt from federal excise taxes under I.R.C. Chapter 32 (26 U.S.C., Subtitle D, Ch. 32) (Federal Excise Tax Exemption Certificate of Registry No. 84-730123K) and from State and local government sales and use taxes under §§39 -26-704(1), et seq., C.R.S. (Colorado Sales Tax Exemption Identification Number 98-02565). The State shall not be liable for the payment of any excise, sales, or use taxes, regardless of whether any political subdivision of the state imposes such taxes on Contractor. Contractor shall be solely responsible for any exemptions from the collection of excise, sales or use taxes that Contractor may wish to have in place in connection with this Contract. N. Third Party Beneficiaries Except for the Parties’ respective successors and assigns described in §18.A, this Contract does not and is not intended to confer any rights or remedies upon any person or entity other than the Parties. Enforcement of this Contract and all rights and obligations hereunder are reserved solely to the Parties. Any Services or benefits which third parties receive as a result of this Contract are incidental to this Contract, and do not create any rights for such third parties. O. Waiver A Party’s failure or delay in exercising any right, power, or privilege under this Contract, whether explicit or by lack of enforcement, shall not operate as a waiver, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise of such right, power, or privilege. P. CORA Disclosure To the extent not prohibited by federal law, this Contract and the performance measures and standards required under §24-106-107, C.R.S., if any, are subject to public release through the CORA. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 23 of 28 Version 02.24.2022 Q. Standard and Manner of Performance Contractor shall perform its obligations under this Contract in accordance with the highest standards of care, skill and diligence in Contractor’s industry, trade, or profession. R. Licenses, Permits, and Other Authorizations. Contractor shall secure, prior to the Effective Date, and maintain at all times during the term of this Contract, at its sole expense, all licenses, certifications, permits, and other authorizations required to perform its obligations under this Contract, and shall ensure that all employees, agents and Subcontractors secure and maintain at all times during the term of their employment, agency or subcontract, all license, certifications, permits and other authorizations required to perform their obligations in relation to this Contract. S. Indemnification i. Applicability This entire §18.S does not apply to Contractor if Contractor is a “public entity” within the meaning of the GIA. ii. General Indemnification Contractor shall indemnify, save, and hold harmless the State, its employees, agents and assignees (the “Indemnified Parties”), against any and all costs, expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the Indemnified Parties in relation to any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees in connection with this Contract. iii. Confidential Information Indemnification Disclosure or use of State Confidential Information by Contractor in violation of §8 may be cause for legal action by third parties against Contractor, the State, or their respective agents. Contractor shall indemnify, save, and hold harmless the Indemnified Parties, against any and all claims, damages, liabilities, losses, costs, expenses (including attorneys’ fees and costs) incurred by the State in relation to any act or omission by Contractor, or its employees, agents, assigns, or Subcontractors in violation of §8. iv. Intellectual Property Indemnification Contractor shall indemnify, save, and hold harmless the Indemnified Parties, against any and all costs, expenses, claims, damages, liabilities, and other amounts (including attorneys’ fees and costs) incurred by the Indemnified Parties in relation to any claim that any Work infringes a patent, copyright, trademark, trade secret, or any other intellectual property right. T. Media or Public Announcements The Contractor shall not make any news release, publicity statement, or other public announcement, either in written or oral form that concerns the Work provided under this Contract, without the prior written approval of the State. The Contractor shall submit a written request for approval to the State no less than ten (10) business days before the proposed date of publication. The State shall not unreasonably withhold approval of the Contractor’s written request to publish. Approval or denial of the Contractor’s request by the State, shall be DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 24 of 28 Version 02.24.2022 delivered to the Contractor in writing within six (6) business days from the date of the State’s receipt of Contractor’s request for approval. If required by the terms and conditions of a federal or state grant, the Contractor shall obtain the prior approval of the State and all necessary third parties prior to publishing any materials produced under this Contract. If required by the terms and conditions of a federal or state grant, the Contractor shall also credit the State and all necessary third parties with assisting in the publication of any materials produced under this Contract. It shall be the obligation of the Contractor to inquire of the State as to whether these requirements exist and obtain written notification from the State. U. Stop Work Order Upon written approval by the State Chief Procurement Officer or delegee, the State may, by written order to the Contractor, at any time, and without notice to any surety, require the Contractor to stop all or any part of the Work called for by any properly executed Task Order (“Stop Work Order”). This Stop Work Order shall be for a specified period after it is delivered to the Contractor. Any such Stop Work Order shall be identified specifically as a Stop Work Order issued pursuant to this §18.U. Upon receipt of such Stop Work Order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurring of costs allocable to the Project covered by the Stop Work Order during the period of Work stoppage. Before the Stop Work Order, or any written extension thereof expires, the State Procurement Officer or delegee shall either: i. Cancel the Stop Work Order; or ii. Terminate the Work covered by such Stop Work Order. If a Stop Work Order issued under this Contract is properly canceled, or the period of the Stop Work Order or any written extension thereof expires, the Contractor shall resume the Work. An appropriate adjustment shall be made in the delivery schedule or Contract price, or both, and the Contract shall be modified accordingly in writing pursuant to the terms of this Contract dealing with Contract modifications, if: i. The Stop Work Order results in increased time required for, or in the Contractor’s cost properly allocable to, the performance of any part of this Contract; and ii. The Contractor asserts a written claim for such an adjustment within thirty (30) days after the end of the period of Work stoppage. V. The Contractor’s performance shall be evaluated in accordance with the terms and conditions of this Contract, State law, including CRS §24-103.5-101, and State Fiscal Rules, Policies and Guidance. Evaluation of Contractor’s performance shall be part of the normal contract administration process and Contractor’s performance will be systematically recorded in the statewide Contract Management System. Areas of review shall include, but shall not be limited to quality, cost and timeliness. Collection of information relevant to the performance of Contractor’s obligations under this Contract shall be determined by the specific requirements of such obligations and shall include factors tailored to match the requirements of the Statement of Work of this Contract. Such performance information shall be entered into the statewide Contract Management System at intervals established in the Statement of DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 25 of 28 Version 02.24.2022 Work and a final review and rating shall be rendered within 30 days of the end of the Contract term. Contractor shall be notified following each performance and shall address or correct any identified problem in a timely manner. W. Should the final performance evaluation determine that Contractor demonstrated a gross failure to meet the performance measures established under the Statement of Work, the Executive Director of the Colorado Department of Personnel and Administration (Executive Director), upon request by the Colorado Department of Public Health and Environment and showing of good cause, may debar Contractor and prohibit Contractor from bidding on future contracts. Contractor may contest the final evaluation and result by: (i) filing rebuttal statements, which may result in either removal or correction of the evaluation (CRS §24-105- 102(6)), or (ii) under CRS §24-105-102(6), exercising the debarment protest and appeal rights provided in CRS §§24-109-106, 107, 201 or 202, which may result in the reversal of the debarment and reinstatement of Contractor, by the Executive Director, upon showing of good cause. X. If this Contract involves federal funds or compliance is otherwise federally mandated, the Contractor and its agents, employees, assigns and Subcontractors shall at all times during the term of this Contract strictly adhere to all applicable federal laws, state laws, executive orders and implementing regulations as they currently exist and may hereafter be amended. Without limitation, these federal laws and regulations include the Federal Funding Accountability and Transparency Act of 2006 (Public Law 109-282), as amended by §6062 of Public Law 110- 252, including without limitation all data reporting requirements required thereunder. This Act is also referred to as FFATA. 19. COLORADO SPECIAL PROVISIONS (COLORADO FISCAL RULE 3-3) These Special Provisions apply to all contracts except where noted in italics. A. STATUTORY APPROVAL. §24-30-202(1), C.R.S. This Contract shall not be valid until it has been approved by the Colorado State Controller or designee. If this Contract is for a Major Information Technolog y Project, as defined in §24-37.5-102(2.6), then this Contract shall not be valid until it has been approved by the State’s Chief Information Officer or designee. B. FUND AVAILABILITY. §24-30-202(5.5), C.R.S. Financial obligations of the State payable after the current State Fiscal Year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available. C. GOVERNMENTAL IMMUNITY. Liability for claims for injuries to persons or property arising from the negligence of the State, its departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the Colorado Governmental Immunity Act, §24-10-101, et seq., C.R.S.; the Federal Tort Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C. 1346(b), and the State’s risk management statutes, §§24-30-1501, et seq. C.R.S. No term or condition of this Contract shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions, contained in these statutes. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 26 of 28 Version 02.24.2022 D. INDEPENDENT CONTRACTOR. Contractor shall perform its duties hereunder as an independent contractor and not as an employee. Neither Contractor nor any agent or employee of Contractor shall be deemed to be an agent or employee of the State. Contractor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Contractor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Contractor or any of its agents or employees. Contractor shall pay when due all applicable employment taxes and income taxes and local head taxes incurred pursuant to this Contract. Contractor shall (i) provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law, (ii) provide proof thereof when requested by the State, and (iii) be solely responsible for its acts and those of its employees and agents. E. COMPLIANCE WITH LAW. Contractor shall comply with all applicable federal and State laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices. F. CHOICE OF LAW, JURISDICTION, AND VENUE. Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this Contract. Any provision included or incorporated herein by reference which conflicts with said laws, rules, and regulations shall be null and void. All suits or actions related to this Contract shall be filed and proceedings held in the State of Colorado and exclusive venue shall be in the City and County of Denver. G. PROHIBITED TERMS. Any term included in this Contract that requires the State to indemnify or hold Contractor harmless; requires the State to agree to binding arbitration; limits Contractor’s liability for damages resulting from death, bodily injury, or damage to tangible property; or that conflicts with this provision in any way shall be void ab initio. Nothing in this Contract shall be construed as a waiver of any provision of §24-106-109 C.R.S. H. SOFTWARE PIRACY PROHIBITION. State or other public funds payable under this Contract shall not be used for the acquisition, operation, or maintenance of computer software in violation of federal copyright laws or applicable licensing restrictions. Contractor hereby certifies and warrants that, during the term of this Contract and any extensions, Contractor has and shall maintain in place appropriate systems and controls to prevent such improper use of public funds. If the State determines that Contractor is in violation of this provision, the State may exercise any remedy available at law or in equity or under this Contract, including, without limitation, immediate termination of this Contract and any remedy consistent with federal copyright laws or applicable licensing restrictions. I. EMPLOYEE FINANCIAL INTEREST/CONFLICT OF INTEREST. §§24-18-201 and 24-50-507, C.R.S. The signatories aver that to their knowledge, no employee of the State has any personal or beneficial interest whatsoever in the service or property described in this Contract. Contractor DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 27 of 28 Version 02.24.2022 has no interest and shall not acquire any interest, direct or indirect, that would conflict in any manner or degree with the performance of Contractor’s Services and Contractor shall not employ any person having such known interests. 20. SAMPLE OPTION LETTER State Agency State of Colorado for the use & benefit of the Department of Public Health and Environment 4300 Cherry Creek Drive South Denver CO 80246 Task Order Contract Number: Insert CMS Number of the Master Task Order Contract Contractor: Insert Contractor's Full Legal Name, including "Inc.", "LLC", etc... Option Letter Number: Insert Contract Number Task Order Performance Beginning Date The later of the Task Order Effective Date or Month Day, Year Task Order Expiration Date Month Day, Year CONTRACT MAXIMUM AMOUNT TABLE Document Version Encumbrance Number Federal Funding Amount State Funding Amount Other Funding Amount Term Dates Total OPTIONS: A. Option to extend for an Extension Term B. Option to change the quantity of Goods under the Contract C. Option to change the quantity of Services under the Contract D. Option to modify Contract rates E. Option to initiate next phase of the Contract 2. REQUIRED PROVISIONS: A. For use with Option 1(A): In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option for an additional term, beginning Insert start date and ending on the current contract expiration date shown above, at the rates stated in the Original Contract, as amended. B. For use with Options 1(B and C): In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option to Increase/Decrease the quantity of the Goods/Services or both at the rates stated in the Original Contract, as amended. C. For use with Option 1(D): In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option to modify the Contract rates specified in Exhibit/Section Number/Letter. The Contract rates attached to this Option Letter replace the rates in the Original Contract as of the Option Effective Date of this Option Letter. D. For use with Option 1(E): In accordance with Section(s) Number of the Original Contract referenced above, the State hereby exercises its option to initiate Phase indicate which Phase: 2, 3, 4, etc, which shall begin on Insert start date and end on Insert ending date at the cost/price specified in Section Number. E. For use with all Options that modify the Contract M aximum Amount: The Contract Maximum Amount table on the Contract’s Signature and Cover Page is hereby deleted and replaced with the Current Contract Maximum Amount table shown above. 3. OPTION EFFECTIVE DATE: The effective date of this Option Letter is upon approval of the State Controller or , whichever is later. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Master Task Order Contract Number: 23 FAA 00016 Page 28 of 28 Version 02.24.2022 SIGNATURE PAGE STATE OF COLORADO Jared S. Polis, Governor Colorado Department of Public Health and Environment Jill Hunsaker Ryan, MPH, Executive Director ______________________________________________ By: Signature _____________________________________________ Name of Executive Director Delegate _____________________________________________ Title of Executive Director Delegate Date: _________________________ In accordance with §24-30-202, C.R.S., this Option is not valid until signed and dated below by the State Controller or an authorized delegate. STATE CONTROLLER Robert Jaros, CPA, MBA, JD _____________________________________________ By: Signature _____________________________________________ Name of State Controller Delegate _____________________________________________ Title of State Controller Delegate Option Effective Date:_____________________ --Signature Page End-- DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 3 Version 02.24.2022 EXHIBIT 1 – SAMPLE TASK ORDER State Agency State of Colorado for the use & benefit of the Department of Public Health and Environment 4300 Cherry Creek Drive South Denver CO 80246 Contractor Insert Contractor's Full Legal Name, including "Inc.", "LLC", etc... Master Task Order Contract Number Insert CMS Number of the Master Task Order Contract Task Order Number Insert CMS number or Other Contract Number Task Order Performance Beginning Date The later of the Task Order Effective Date or Month Day, Year Task Order Maximum Amount Initial Term State Fiscal Year 20xx $0.00 Extension Terms State Fiscal Year 20xx $0.00 State Fiscal Year 20xx $0.00 State Fiscal Year 20xx $0.00 State Fiscal Year 20xx $0.00 Total for All State Fiscal Years $0.00 Task Order Expiration Date Month Day, Year Except as stated in §2.D., the total duration of this Contract, including the exercise of any options to extend, shall not exceed 5 years from its Performance Beginning Date. Pricing/Funding Price Structure: Choose type Contractor Shall Invoice: Choose frequency Funding Source: Source $ Amount Source $ Amount Source $ Amount Miscellaneous: Authority to enter into this Contract exists in: C.R.S. 25-1.5-101 – C.R.S. 25-1.5-113 Law Specified Vendor Statute (if any): Enter Program specific Procurement Method: Select Solicitation Number (if any): Enter Solicitation # State Representative Enter Representative’s Name Title Division, Unit Colorado Department of Public Health and Environment 4300 Cherry Creek Drive South Denver, CO 80246 Email Contractor Representative Enter Contractor Representative’s Name Title Entity Name Address Address Email Exhibits and Order of Precedence The following Exhibits and attachments are included with this Contract: Exhibit A Additional Provisions Exhibit B Statement of Work Exhibit C Budget Exhibit D Federal Provisions Exhibit E HIPAA Business Associate Agreement (If ap plicable.) Enter any other exhibits in alphabetical order Contract Purpose Briefly describe the Task Order's purpose. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 2 of 3 Version 02.24.2022 In accordance with §4.B of the Master Task Order Contract referenced above, Contractor shall complete the following Project: 1. PROJECT DESCRIPTION Contractor shall complete the Project described in Exhibit B Statement of Work (SOW) that is attached hereto and incorporated herein (the “SOW”). All terminology used in this Task Order and the SOW shall be interpreted in accordance with the Master Task Order Contract unless specifically defined differently in this Task Order. The Statement of Work and Budget are incorporated herein, made a part hereof and attached hereto as “Exhibit B - Statement of Work” and Exhibit C - Budget. 2. PAYMENT The State shall pay Contractor the amounts shown in Exhibit C - Budget that is attached hereto and incorporated herein, in accordance with the requirements of the SOW and the Master Task Order Contract. The State shall not make any payment for a State Fiscal Year that exceeds the Task Order Maximum Amount shown above for that State Fiscal Year. 3. PERFORMANCE PERIOD Contractor shall complete all Work on the Project described in this Task Order by the Task Order Expiration Date stated above. Contractor shall not perform any Work described in the SOW prior to the Task Order Performance Beginning Date or after the Task Order Expiration Date stated above. 4. TASK ORDER EFFECTIVE DATE: The Effective Date of this Task Order is upon approval of the State Controller. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 3 of 3 Version 02.24.2022 THE PARTIES HERETO HAVE EXECUTED THIS CONTRACT Each person signing this Contract represents and warrants that he or she is duly authorized to execute this Contract and to bind the Party authorizing his or her signature. CONTRACTOR INSERT-Legal Name of Contractor ______________________________________________ By: Signature ______________________________________________ Name of Person Signing for Contractor ______________________________________________ Title of Person Signing for Contractor Date: _________________________ STATE OF COLORADO Jared S. Polis, Governor Colorado Department of Public Health and Environment Jill Hunsaker Ryan, MPH, Executive Director ______________________________________________ By: Signature _____________________________________________ Name of Executive Director Delegate _____________________________________________ Title of Executive Director Delegate Date: _________________________ In accordance with §24-30-202, C.R.S., this Option is not valid until signed and dated below by the State Controller or an authorized delegate. STATE CONTROLLER Robert Jaros, CPA, MBA, JD _____________________________________________ By: Signature _____________________________________________ Name of State Controller Delegate _____________________________________________ Title of State Controller Delegate Effective Date:_____________________________________ --Signature Page End-- DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 2 Version 02.24.2022 EXHIBIT A ADDITIONAL PROVISIONS To Master Task Order Contract Dated **/**/**** Task Order Routing Number ** *** ***** These provisions are to be read and interpreted in conjunction with the provisions of the Master Task Order Contract specifie d above. DELETE all BLUE text, CUSTOMIZE Red text and CHANGE Red text to Black after customization. Eliminate this information, all other information in red and any preprinted provisions that do not apply on your final versio n.  Delete inapplicable information, verify that all paragraphs are numbered correctly, and attach this exhibit to your contract.  Please do not modify the general format of this document (e.g., font type/size, margins, spacing, etc.) or the header on the top of this page 1.) 1. To receive compensation under the Contract, the Contractor shall submit a signed Monthly, Quarterly, or other schedule CDPHE Reimbursement Invoice Form. This form is accessible from the CDPHE internet website https://www.colorado.gov/pacific/cdphe/standardized-invoice-form-and-links and is incorporated and made part of this Contract by reference. CDPHE will provide technical assistance in accessing and completing the form. The CDPHE Reimbursement Invoice Form and Expenditure Details page must be submitted no later than forty-five (45) calendar days after the end of the billing period for which Services were rendered. Expendi tures shall be in accordance with the Statement of Work and Budget. If you prefer to include all of the submission options listed below, include the following. The Contractor shall submit the invoice using one of the following three methods. If you are limiting the option for submittal to one method, delete the previous sentence, choose the appropriate paragraph below and delete those that do not apply. Mail to: (Name & Position Title) (Division & Program) Colorado Department of Public Health and Environment (Mail Code) 4300 Cherry Creek Drive South Denver, Colorado 80246 Scan the completed and signed CDPHE Reimbursement Invoice Form into an electronic document. Email the scanned invoice with the Excel workbook containing the Expenditure Details page t o: (Name & Position Title), (Email address) Fax the completed and signed CDPHE Reimbursement Invoice Form and Expenditure Details page to: Attention: (Name & Position Title), (Fax number) Final billings under the Contract must be received by the State within a reasonable time after the expiration or termination of the Contract; but in any event no later than forty-five (45) calendar days from the effective expiration or termination date of the Contract. Unless otherwise provided for in the Contract, “Lo cal Match”, if any, shall be included on all invoices as required by funding source. The Contractor shall not use federal funds to satisfy federal cost sharing and matching requirements unless approved in writing by the appropriate federal agency. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 2 of 2 Version 02.24.2022 2. Time Limit For Acceptance Of Deliverables. a. Evaluation Period. The State shall have *** (**) calendar days from the date a deliverable is delivered to the State by the Contractor to evaluate that deliverable, except for those deliverables that have a different time negotiated by the State and the Contractor. b. Notice of Defect. If the State believes in good faith that a deliverable fails to meet the design specifications for that particular deliverable, or is otherwise deficient, then the State shall notify the Contractor of the failure or deficiencies, in writing, within *** (**) calendar days of: 1) the date the deliverable is delivered to the State by the Contractor if the State is aware of the failure or deficiency at the time of delivery; or 2) the date the State becomes aware of the failure or deficiency. The above time frame shall apply to all deliverables except for those deliverables that have a different time negotiated by the State and the Contractor in writing pursuant to the State’s fiscal rules. c. Time to Correct Defect. Upon receipt of timely written notice of an objection to a complet ed deliverable, the Contractor shall have a reasonable period of time, not to exceed *** (**) calendar days, to correct the noted deficiencies. If the Contractor fails to correct such deficiencies within *** (**) calendar days, the Contractor shall be in default of its obligations under this Task Order Contract and the State, at its option, may elect to terminate this Task Order. 3. Health Insurance Portability and Accountability Act (HIPAA) Business Associate Determination. The following two sections deal with HIPAA requirements – PLEASE consult with the department’s HIPAA officer to determine which paragraph applies to your procurement. If your Contractor is a Business Associate under HIPAA, include the following statement in your Additional Provisions, and DELETE the next paragraph. The State and the Contractor have determined that Contractor is a business associate under HIPAA. The Contractor hereby agrees to, and has an affirmative duty to, execute the State’s current HIPAA Business Associate Agreement which is attached hereto as Attachment A-*, and incorporated herein by this reference. This Business Associate Agreement shall be fully and properly executed by Contractor and returned to the State at the time Contractor signs the Task Order Contract of which this exhibit is a part. If your Contractor is NOT a Business Associate under HIPAA, include the following statement in your Additional Provisions, and DELETE the paragraph above. The State has determined that this Contract does not constitute a Business Associate relationship under HIPAA. 4. Add any program/divisional specific provisions, or delete. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 1 Version 02.24.2022 EXHIBIT B STATEMENT OF WORK To Original Contract Number ** *** ******** These provisions are to be read and interpreted in conjunction with the provisions of the contract specified above. This template is provided for contract Statements of Work (SOW). Use the CDPHE SOW Development Checklist to develop the content of this template. Instructions are provided in blue font and customizable text is in red. I. Entity Name: This section is OPTIONAL. Term: This section is OPTIONAL. II. Project Description: This section is REQUIRED. III. Definitions: This section is OPTIONAL. IV. Work Plan: This section is REQUIRED. Insert work plan table here. V. Key Personnel: This section is OPTIONAL. VI. Monitoring: This section is REQUIRED. CDPHE’s monitoring of this contract for compliance with performance requirements will be conducted throughout the contract period by the (title of responsible individual). Methods used will include a review of documentation determined by CDPHE to be reflective of performance to include progress reports (you may also list other types of documents or information that will be reviewed, for example “and invoices, site visit results and electronic data”). If you do not want to identify specific documents, complete the sentence with and other fiscal and programmatic documentation as applicable. Performance evaluations are optional for interagency agreements (Colorado state departments and IHEs). If conducting evaluations of these entities, delete these instructions. If not conducting evaluations of these entities, delete these instructions and the following 2 sentences. The Contractor’s performance will be evaluated at set intervals and communicated to the contractor. A Final Contractor Performance Evaluation will be conducted at the end of the life of the contract. VII. Resolution of Non-Compliance: This section is REQUIRED. The Contractor will be notified in writing within (?) calendar days of discovery of a compliance issue. Within (?) calendar days of discovery, the Contractor and the State will collaborate, when appropriate, to determine the action(s) necessary to rectify the compliance issue and determine when the action(s) must be completed. The action(s) and time line for completion will be documented in writing and agreed to by both parties. If extenuating circumstances arise that requires an extension to the time line, the Contractor must email a request to the (title of responsible individual) and receive approval for a new due date. The State will oversee the completion/implementation of the action(s) to ensure time lines are met and the issue(s) is resolved. If the Contractor demonstrates inaction or disregard for the agreed upon compliance resolution plan, the State may exer cise its rights under the provisions of this contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 2 Version 02.24.2022 EXHIBIT C BUDGET Contractor Name Program Contact Name, Title, and Email Budget Period Fiscal Contact Name, Title, and Email Project Name Contract (CT or PO) Number Expenditure Categories Personal Services - Salaried Employees Position Title Description of Work Annual Salary Fringe Percent of Time on Project Total Amount Requested from CDPHE Total Personal Services (including fringe benefits) $0.00 Personal Services - Hourly Employees Position Title Description of Work Hourly Wage Hourly Fringe Total # Hours on Project Total Amount Requested from CDPHE Total Personal Services (including fringe benefits) $0.00 Supplies & Operating Expenses Item Description of Item Rate Quantity Total Supplies & Operating Expenses $0.00 Travel DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 2 of 2 Version 02.24.2022 Item Description of Item Rate Quantity Total Travel $0.00 Contractual (payments to third parties or entities) Item Description of Item Rate Quantity Total Contractual SUB-TOTAL BEFORE INDIRECT $0.00 $0.00 Indirect Item Description of Item Total Amount Requested from CDPHE Total Indirect $0.00 TOTAL $0.00 DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 4 Version 02.24.2022 Exhibit D Federal Provisions - Enter title of project or program from NOA For the purposes of this Exhibit only, Contractor is also identified as “Subrecipient.” This Contract has been funded, in whole or in part, with an award of Federal funds. In the event of a conflict between the provisions of these Supplemental Provisions for Federal Awards, the Special Provisions, the Contract or any attachments or exhibits incorporated into and made a part of the Contract, the Supplemental Provisions for Federal Awards shall control. In the event of a conflict between the Supplemental Provisions for Federal Awards and the FFATA Supplemental Provisions (if any), the FFATA Supplemental Provisions shall control. 1) Federal Award Identification. a. Subrecipient: Match name on contract. b. Subrecipient DUNS number: Enter DUNS # c. The Federal Award Identification Number (FAIN) is Enter FAIN #. d. The Federal award date is Date issued. e. The subaward period of performance start date is Enter project period start date and end date is Enter project period through date. f. Federal Funds: Federal Budget Period Total Amount of Federal Funds Awarded Amount of Federal Funds Obligated to CDPHE mm/dd/yy - mm/dd/yy Total Federal Funds Awarded Amount of Financial Assistance from the NOA g. Federal award title of project or program: Enter title of project or program from NOA. h. The name of the Federal awarding agency is: Enter full name of federal awarding agency and the contact information for the awarding official is Enter name & contact info of Federal Project Officer; the name of the pass-through entity is the State of Colorado, Department of Public Health and Environment (CDPHE), and the contact information for the CDPHE official is Enter Grantee (CDPHE) Project Director. i. The Catalog of Federal Domestic Assistance (CFDA) number is Enter CFDA # and the grant name is Enter title of grant if applicable or N/A. j. This award Choose “ is” or “is not” for research & development. k. Subrecipient Choose “ is” or “is not” required to provide matching funds. In the event the Subrecipient is required to provide matching funds, Section 8 of this Attachment applies. l. The indirect cost rate for the Federal award (including if the de minimis rate is charged per 2 CFR §200.414 Indirect (F&A) costs) is pre-determined based upon the State of Colorado and CDPHE cost allocation plan. 2) Subrecipient shall at all times during the term of this contract strictly adhere to the requirements under the Federal Award listed above, and all applicable federal laws, Executive Orders, and implementing regulations as they currently exist and may hereafter be amended. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 2 of 4 Version 02.24.2022 3) Any additional requirements that CDPHE imposes on Subrecipient in order for CDPHE to meet its own responsibility to the Federal awarding agency, including identification of any required financial and performance reports, are stated in the Exhibits. 4) Subrecipient’s approved indirect cost rate is as stated in the Exhibits. 5) Subrecipient must permit CDPHE and auditors to have access to Subrecipient’s records and financial statements as necessary for CDPHE to meet the requirements of 2 CFR §200.331 Requirements for pass-through entities, §§ 200.300 Statutory and National Policy Requirements through §200.309 Period of performance, and Subpart F—Audit Requirements of this Part. 6) The appropriate terms and conditions concerning closeout of the subaward are listed in Section 16 of this Attachment. 7) Performance and Final Status. Subrecipient shall submit all financial, performance, and other reports to CDPHE no later than 45 calendar days after the period of performance end date or sooner termination of this Contract containing an evaluation and review of Subrecipient’s performance and the final status of Subrecipient’s obligations hereunder. 8) Matching Funds. Subrecipient shall provide matching funds as stated in the Exhibits. Subrecipient shall have raised the full amount of matching funds prior to the Effective Date and shall report to CDPHE regarding the status of such funds upon request. Subrecipient’s obligation to pay all or any part of any matching funds, whether direct or contingent, only extends to funds duly and lawfully appropriated for the purposes of this Contract by the authorized representatives of the Subrecipient and paid into the Subrecipient’s treasury or bank account. Subrecipient represents to CDPHE that the amount designated as matching funds has been legally appropriated for the purposes of this Contract by its authorized representatives and paid into its treasury or bank account. Subrecipient does not by this Contract irrevocably pledge present cash reserves for payments in future fiscal years, and this Contract is not intended to create a multiple-fiscal year debt of the Subrecipient. Subrecipient shall not pay or be liable for any claimed interest, late charges, fees, taxes or penalties of any nature, except as required by Subrecipient’s laws or policies. 9) Record Retention Period. The record retention period previously stated in this Contract is replaced with the record retention period prescribed in 2 CFR §200.333. 10) Single Audit Requirements. If Subrecipient expends $750,000 or more in Federal Awards during Subrecipient’s fiscal year, Subrecipient shall procure or arrange for a single or program-specific audit conducted for that year in accordance with the provisions of Subpart F-Audit Requirements of the Uniform Guidance, issued pursuant to the Single Audit Act Amendments of 1996, (31 U.S.C. 7501-7507). 2 CFR §200.501. 11) Contract Provisions. Subrecipient shall comply with and shall include all of the following applicable provisions in all subcontracts entered into by it pursuant to this Contract: a. Office of Management and Budget Circulars and The Common Rule for Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments, as applicable; b. when required by Federal program legislation, the “Davis-Bacon Act”, as amended (40 U.S.C. 3141-3148) as supplemented by Department of Labor Regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”); c. when required by Federal program legislation, the Copeland “Anti-Kickback” Act (40 U.S.C. 3145), as supplemented by Department of Labor regulations (29 CFR Part 3, “Contractors and Subcontractors on Public Building of Public Work Financed in Whole or in Part by Loans or Grants from the United States”). d. 42 U.S.C. 6101 et seq., 42 U.S.C. 2000d, 29 U.S.C. 794 (regarding discrimination); e. the “Americans with Disabilities Act” (Public Law 101-336; 42 U.S.C. 12101, 12102, 12111 - 12117, 12131 - 12134, 12141 - 12150, 12161 - 12165, 12181 - 12189, 12201 - 12213 and 47 U.S.C. 225 and 47 U.S.C. 611); f. when applicable, the Contractor shall comply with the provisions of the “Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments” (Common Rule); g. The Federal Funding Accountability and Transparency Act of 2006 (Public Law 109-282), as amended by §6062 of Public Law 110-252, including without limitation all data reporting requirements required there under. This Act is also referred to as FFATA. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 3 of 4 Version 02.24.2022 h. Contractor shall comply with the provisions of Section 601 of Title VI of the Civil Rights Act of 1964, as amended. i. Except as otherwise provided under 41 CFR Part 60, all contracts that meet the definition of “federally assisted construction contract” in 41 CFR Part 60-1.3 comply with the equal opportunity clause provided under 41 CFR 60-1.4(b), in accordance with Executive Order 11246, “Equal Employment Opportunity: (30 FR 12319, 12935, 3 CFR Part, 1964-1965 Comp., p. 339), as amended by Executive Order 11375, “Amending Executive Order 11246 Relating to Equal Employment Opportunity,” and implementing regulations at 41 CFR part 60, “Office of Federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor. j. where applicable, Contract Work Hours and Safety Standards Act (40 U.S.C. 3701-3708). k. if the Federal award meets the definition of “funding agreement” under 37 CFR § 401.2 (a) and the recipient or subrecipient wishes to enter into an agreement with a small business firm or nonprofit organization, comply with the requirements of 37 CFR Part 401, “Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements,” and any implementing regulations issued by the awarding agency. l. the Clean Air Act (42 U.S.C. 7401-7671q.) and the Federal Water Pollution Control Act (33 U.S.C. 1251- 1387), as amended. m. if applicable, comply with the mandatory standards and policies on energy efficiency contained within the State of Colorado’s energy conservation plan issued in compliance with the Energy Policy and Conservation Act, 42 U.S.C. 6201. n. the Contractor and all principals are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from covered transactions by any federal department or agency; the Contractor and all principals shall comply with all applicable regulations pursuant to Executive Order 12549 (3 CFR Part 1986 Comp., p. 189) and Executive Order 12689 (3 CFR Part 1989 Comp., p. 235), Debarment and Suspension; and, o. the Contractor shall comply where applicable, the Byrd Anti-Lobbying Amendment (31 U.S.C. 1352). 12) Compliance. Subrecipient shall comply with all applicable provisions of The Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), including but not limited to these Supplemental Provisions for Federal Awards. Any revisions to such provisions automatically shall become a part of these Supplemental Provisions, without the necessity of either party executing any further instrument. CDPHE may provide written notification to Subrecipient of such revisions, but such notice shall not be a condition precedent to the effectiveness of such revisions. 13) Procurement Procedures. Subrecipient shall use its own documented procurement procedures which reflect applicable State, local, and Tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in the Uniform Guidance, including without limitation, §§200.318 through 200.326 thereof. 14) Certifications. Unless prohibited by Federal statutes or regulations, CDPHE may require Subrecipient to submit certifications and representations required by Federal statutes or regulations on an annual basis (2 CFR §200.208). Submission may be required more frequently if Subrecipient fails to meet a requirement of the Federal award. Subrecipient shall certify in writing to CDPHE at the end of the Contract that the project or activity was completed or the level of effort was expended. 2 CFR §200.201(b)(3). If the required level of activity or effort was not carried out, the amount of the Contract must be adjusted. 15) Event of Default. Failure to comply with the Uniform Guidance or these Supplemental Provisions for Federal Awards shall constitute an event of default under the Contract pursuant to 2 CFR §200.339 and CDPHE may terminate the Contract in accordance with the provisions in the Contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 4 of 4 Version 02.24.2022 16) Close- Out. Subrecipient shall close out this Contract within 45 days after the End Date. Contract close out entails submission to CDPHE by Subrecipient of all documentation defined as a deliverable in this Contract, and Subrecipient’s final reimbursement request. If the project has not been closed by the Federal awarding agency within 1 year and 45 days after the End Date due to Subrecipient’s failure to submit required documentation that CDPHE has requested from Subrecipient, then Subrecipient may be prohibited from applying for new Federal awards through the State until such documentation has been submitted and accepted. 17) Erroneous Payments. The closeout of a Federal award does not affect the right of the Federal awarding agency or CDPHE to disallow costs and recover funds on the basis of a later audit or other review. Any cost disallowance recovery is to be made within the record retention period. EXHIBIT END DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 8 Version 02.24.2022 [TO BE DELETED IF NOT APPLICABLE] Exhibit E HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement (“Agreement”) between the State and Contractor is agreed to in connection with, and as an exhibit to, the Contract. For purposes of this Agreement, the State is referred to as “Covered Entity” and the Contractor is referred to as “Business Associate”. Unless the context clearly requires a distinction between the Contract and this Agreement, all references to “Contract” shall include this Agreement. 1. PURPOSE Covered Entity wishes to disclose information to Business Associate, which may include Protected Health Information ("PHI"). The Parties intend to protect the privacy and security of the disclosed PHI in compliance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub. L. No. 104-191 (1996) as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) enacted under the American Recovery and Reinvestment Act of 2009 (“ARRA”) Pub. L. No. 111–5 (2009), implementing regulations promulgated by the U.S. Department of Health and Human Services at 45 C.F.R. Parts 160, 162 and 164 (the “HIPAA Rules”) and other applicable laws, as amended. Prior to the disclosure of PHI, Covered Entity is required to enter into an agreement with Business Associate containing specific requirements as set forth in, but not limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal Regulations (“C.F.R.”) and all other applicable laws and regulations, all as may be amended. 2. DEFINITIONS The following terms used in this Agreement shall have the same meanings as in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. The following terms used in this Agreement shall have the meanings set forth below: a. Business Associate. “Business Associate” shall have the same meaning as the term “business associate” at 45 C.F.R. 160.103, and shall refer to Contractor. b. Covered Entity. “Covered Entity” shall have the same meaning as the term “covered entity” at 45 C.F.R. 160.103, and shall refer to the State. c. Information Technology and Information Security. “Information Technology” and “Information Security” shall have the same meanings as the terms “information technology” and “information security”, respectively, in §24-37.5-102, C.R.S. Capitalized terms used herein and not otherwise defined herein or in the HIPAA Rules shall have the meanings ascribed to them in the Contract. 3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE a. Permitted Uses and Disclosures. i. Business Associate shall use and disclose PHI only to accomplish Business Associate’s obligations under the Contract. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 2 of 8 Version 02.24.2022 ii. To the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with any and all requirements of Subpart E that apply to Covered Entity in the performance of such obligation. iii. Business Associate may disclose PHI to carry out the legal responsibilities of Business Associate, provided, that the disclosure is Required by Law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that: A. the information will remain confidential and will be used or disclosed only as Required by Law or for the purpose for which Business Associate originally disclosed the information to that person, and; B. the person notifies Business Associate of any Breach involving PHI of which it is aware. iv. Business Associate may provide Data Aggregation Services relating to the Health Care Operations of Covered Entity. Business Associate may de-identify any or all PHI created or received by Business Associate under this Agreement, provided the de-identification conforms to the requirements of the HIPAA Rules. b. Minimum Necessary. Business Associate, its Subcontractors and agents, shall access, use, and disclose only the minimum amount of PHI necessary to accomplish the objectives of the Contract, in accordance with the Minimum Necessary Requirements of the HIPAA Rules including, but not limited to, 45 C.F.R. 164.502(b) and 164.514(d). c. Impermissible Uses and Disclosures. i. Business Associate shall not disclose the PHI of Covered Entity to another covered entity without the written authorization of Covered Entity. ii. Business Associate shall not share, use, disclose or make available any Covered Entity PHI in any form via any medium with or to any person or entity beyond the boundaries or jurisdiction of the United States without express written authorization from Covered Entity. d. Business Associate's Subcontractors. i. Business Associate shall, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors who create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to safeguarding PHI. ii. Business Associate shall provide to Covered Entity, on Covered Entity’s request, a list of Subcontractors who have entered into any such agreement with Business Associate. iii. Business Associate shall provide to Covered Entity, on Covered Entity’s request, copies of any such agreements Business Associate has entered into with Subcontractors. e. Access to System. If Business Associate needs access to a Covered Entity Information Technology system to comply with its obligations under the Contract or this Agreement, DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 3 of 8 Version 02.24.2022 Business Associate shall request, review, and comply with any and all policies applicable to Covered Entity regarding such system including, but not limited to, any policies promulgated by the Office of Information Technology and available at http://oit.state.co.us/about/policies. f. Access to PHI. Business Associate shall, within ten days of receiving a written request from Covered Entity, make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.524. g. Amendment of PHI. i. Business Associate shall within ten days of receiving a written request from Covered Entity make any amendment to PHI in a Designated Record Set as directed by or agreed to by Covered Entity pursuant to 45 C.F.R. 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.526. ii. Business Associate shall promptly forward to Covered Entity any request for amendment of PHI that Business Associate receives directly from an Individual. h. Accounting Rights. Business Associate shall, within ten days of receiving a written request from Covered Entity, maintain and make available to Covered Entity the information necessary for Covered Entity to satisfy its obligations to provide an accounting of Disclosure under 45 C.F.R. 164.528. i. Restrictions and Confidential Communications. i. Business Associate shall restrict the Use or Disclosure of an Individual’s PHI within ten days of notice from Covered Entity of: A. a restriction on Use or Disclosure of PHI pursuant to 45 C.F.R. 164.522; or B. a request for confidential communication of PHI pursuant to 45 C.F.R. 164.522. ii. Business Associate shall not respond directly to an Individual’s requests to restrict the Use or Disclosure of PHI or to send all communication of PHI to an alternate address. iii. Business Associate shall refer such requests to Covered Entity so that Covered Entity can coordinate and prepare a timely response to the requesting Individual and provide direction to Business Associate. j. Governmental Access to Records. Business Associate shall make its facilities, internal practices, books, records, and other sources of information, including PHI, available to the Secretary for purposes of determining compliance with the HIPAA Rules in accordance with 45 C.F.R. 160.310. k. Audit, Inspection and Enforcement. i. Business Associate shall obtain and update at least annually a written assessment performed by an independent third party reasonably acceptable to Covered Entity, which evaluates the Information Security of the applications, infrastructure, and processes that interact with the Covered Entity data Business Associate receives, manipulates, stores and DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 4 of 8 Version 02.24.2022 distributes. Upon request by Covered Entity, Business Associate shall provide to Covered Entity the executive summary of the assessment. ii. Business Associate, upon the request of Covered Entity, shall fully cooperate with Covered Entity’s efforts to audit Business Associate’s compliance with applicable HIPAA Rules. If, through audit or inspection, Covered Entity determines that Business Associate’s conduct would result in violation of the HIPAA Rules or is in violation of the Contract or this Agreement, Business Associate shall promptly remedy any such violation and shall certify completion of its remedy in writing to Covered Entity. l. Appropriate Safeguards. i. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to prevent use or disclosure of PHI other than as provided in this Agreement. ii. Business Associate shall safeguard the PHI from tampering and unauthorized disclosures. iii. Business Associate shall maintain the confidentiality of passwords and other data required for accessing this information. iv. Business Associate shall extend protection beyond the initial information obtained from Covered Entity to any databases or collections of PHI containing information derived from the PHI. The provisions of this section shall be in force unless PHI is de-identified in conformance to the requirements of the HIPAA Rules. o. Safeguard During Transmission. i. Business Associate shall use reasonable and appropriate safeguards including, without limitation, Information Security measures to ensure that all transmissions of PHI are authorized and to prevent use or disclosure of PHI other than as provided for by this Agreement. ii. Business Associate shall not transmit PHI over the internet or any other insecure or open communication channel unless the PHI is encrypted or otherwise safeguarded with a FIPS- compliant encryption algorithm. p. Reporting of Improper Use or Disclosure and Notification of Breach. i. Business Associate shall, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under §24-73- 103, C.R.S. ii. Such notice shall include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. iii. Business Associate shall, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify Covered Entity of such DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 5 of 8 Version 02.24.2022 incident. iv. Business Associate shall have the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay. q. Business Associate’s Insurance and Notification Costs. i. Business Associate shall bear all costs of a Breach response including, without limitation, notifications, and shall maintain insurance to cover: A. loss of PHI data; B. Breach notification requirements specified in HIPAA Rules and in §24-73-103, C.R.S.; and C. claims based upon alleged violations of privacy rights through improper use or disclosure of PHI. ii. All such policies shall meet or exceed the minimum insurance requirements of the Contract or otherwise as may be approved by Covered Entity (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured status, and notice of cancellation). iii. Business Associate shall provide Covered Entity a point of contact who possesses relevant Information Security knowledge and is accessible 24 hours per day, 7 days per week to assist with incident handling. iv. Business Associate, to the extent practicable, shall mitigate any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this Agreement. r. Subcontractors and Breaches. i. Business Associate shall enter into a written agreement with each of its Subcontractors and agents, who create, receive, maintain, or transmit PHI on behalf of Business Associate. The agreements shall require such Subcontractors and agents to report to Business Associate any use or disclosure of PHI not provided for by this Agreement, including Security Incidents and Breaches of Unsecured Protected Health Information, on the first day such Subcontractor or agent knows or should have known of the Breach as required by 45 C.F.R. 164.410. ii. Business Associate shall notify Covered Entity of any such report and shall provide copies of any such agreements to Covered Entity on request. s. Data Ownership. i. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 6 of 8 Version 02.24.2022 ii. Upon request by Covered Entity, Business Associate immediately shall provide Covered Entity with any keys to decrypt information that the Business Association has encrypted and maintains in encrypted form, or shall provide such information in unencrypted usable form. t. Retention of PHI. Except upon termination of this Agreement as provided in Section 5, below, Business Associate and its Subcontractors or agents shall retain all PHI throughout the term of this Agreement, and shall continue to maintain the accounting of disclosures required under Section 3.h, above, for a period of six years. 4. OBLIGATIONS OF COVERED ENTITY a. Safeguards During Transmission. Covered Entity shall be responsible for using appropriate safeguards including encryption of PHI, to maintain and ensure the confidentiality, integrity, and security of PHI transmitted pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules. b. Notice of Changes. i. Covered Entity maintains a copy of its Notice of Privacy Practices on its website. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission to use or disclose PHI, to the extent that it may affect Business Associate’s permitted or required uses or disclosures. ii. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. 164.522, to the extent that it may affect Business Associate’s permitted use or disclosure of PHI. 5. TERMINATION a. Breach. i. In addition to any Contract provision regarding remedies for breach, Covered Entity shall have the right, in the event of a breach by Business Associate of any provision of this Agreement, to terminate immediately the Contract, or this Agreement, or both. ii. Subject to any directions from Covered Entity, upon termination of the Contract, this Agreement, or both, Business Associate shall take timely, reasonable, and necessary action to protect and preserve property in the possession of Business Associate in which Covered Entity has an interest. b. Effect of Termination. i. Upon termination of this Agreement for any reason, Business Associate, at the option of Covered Entity, shall return or destroy all PHI that Business Associate, its agents, or its Subcontractors maintain in any form, and shall not retain any copies of such PHI. ii. If Covered Entity directs Business Associate to destroy the PHI, Business Associate shall certify in writing to Covered Entity that such PHI has been destroyed. iii. If Business Associate believes that returning or destroying the PHI is not feasible, Business DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 7 of 8 Version 02.24.2022 Associate shall promptly provide Covered Entity with notice of the conditions making return or destruction infeasible. Business Associate shall continue to extend the protections of Section 3 of this Agreement to such PHI, and shall limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. 6. INJUNCTIVE RELIEF Covered Entity and Business Associate agree that irreparable damage would occur in the event Business Associate or any of its Subcontractors or agents use or disclosure of PHI in violation of this Agreement, the HIPAA Rules or any applicable law. Covered Entity and Business Associate further agree that money damages would not provide an adequate remedy for such Breach. Accordingly, Covered Entity and Business Associate agree that Covered Entity shall be entitled to injunctive relief, specific performance, and other equitable relief to prevent or restrain any Breach or threatened Breach of and to enforce specifically the terms and provisions of this Agreement. 7. LIMITATION OF LIABILITY Any provision in the Contract limiting Contractor’s liability shall not apply to Business Associate’s liability under this Agreement, which shall not be limited. 8. DISCLAIMER Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement or the HIPAA Rules will be adequate or satisfactory for Business Associate’s own purposes. Business Associate is solely responsible for all decisions made and actions taken by Business Associate regarding the safeguarding of PHI. 9. CERTIFICATION Covered Entity has a legal obligation under HIPAA Rules to certify as to Business Associate’s Information Security practices. Covered Entity or its authorized agent or contractor shall have the right to examine Business Associate’s facilities, systems, procedures, and records, at Covered Entity’s expense, if Covered Entity determines that examination is necessary to certify that Business Associate’s Information Security safeguards comply with the HIPAA Rules or this Agreement. 10. AMENDMENT a. Amendment to Comply with Law. The Parties acknowledge that state and federal laws and regulations relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide procedures to ensure compliance with such developments. i. In the event of any change to state or federal laws and regulations relating to data security and privacy affecting this Agreement, the Parties shall take such action as is necessary to implement the changes to the standards and requirements of HIPAA, the HIPAA Rules and other applicable rules relating to the confidentiality, integrity, availability and security of PHI with respect to this Agreement. ii. Business Associate shall provide to Covered Entity written assurance satisfactory to Covered Entity that Business Associate shall adequately safeguard all PHI, and obtain written assurance satisfactory to Covered Entity from Business Associate’s Subcontractors and agents that they shall adequately safeguard all PHI. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 8 of 8 Version 02.24.2022 iii. Upon the request of either Party, the other Party promptly shall negotiate in good faith the terms of an amendment to the Contract embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, or other applicable rules. iv. Covered Entity may terminate this Agreement upon 30 days’ prior written notice in the event that: A. Business Associate does not promptly enter into negotiations to amend the Contract and this Agreement when requested by Covered Entity pursuant to this Section; or B. Business Associate does not enter into an amendment to the Contract and this Agreement, which provides assurances regarding the safeguarding of PHI sufficient, in Covered Entity’s sole discretion, to satisfy the standards and requirements of the HIPAA, the HIPAA Rules and applicable law. v. Amendment of Appendix. The Appendix to this Agreement may be modified or amended by the mutual written agreement of the Parties, without amendment of this Agreement. Any modified or amended Appendix agreed to in writing by the Parties shall supersede and replace any prior version of the Appendix. 11. ASSISTANCE IN LITIGATION OR ADMINISTRATIVE PROCEEDINGS Covered Entity shall provide written notice to Business Associate if litigation or administrative proceeding is commenced against Covered Entity, its directors, officers, or employees, based on a claimed violation by Business Associate of HIPAA, the HIPAA Rules or other laws relating to security and privacy or PHI. Upon receipt of such notice and to the extent requested by Covered Entity, Business Associate shall, and shall cause its employees, Subcontractors, or agents assisting Business Associate in the performance of its obligations under the Contract to, assist Covered Entity in the defense of such litigation or proceedings. Business Associate shall, and shall cause its employees, Subcontractor’s and agents to, provide assistance, to Covered Entity, which may include testifying as a witness at such proceedings. Business Associate or any of its employees, Subcontractors or agents shall not be required to provide such assistance if Business Associate is a named adverse party. 12. INTERPRETATION AND ORDER OF PRECEDENCE Any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules. In the event of an inconsistency between the Contract and this Agreement, this Agreement shall control. This Agreement supersedes and replaces any previous, separately executed HIPAA business associate agreement between the Parties. 13. SURVIVAL Provisions of this Agreement requiring continued performance, compliance, or effect after termination shall survive termination of this contract or this agreement and shall be enforceable by Covered Entity. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308 Task Order Contract Number: 23 FAA 00016 Page 1 of 1 Version 02.24.2022 APPENDIX TO HIPAA BUSINESS ASSOCIATE AGREEMENT This Appendix (“Appendix”) to the HIPAA Business Associate Agreement (“Agreement”) is s an appendix to the Contract and the Agreement. For the purposes of this Appendix, defined terms shall have the meanings ascribed to them in the Agreement and the Contract. Unless the context clearly requires a distinction between the Contract, the Agreement, and this Appendix, all references to “Contract” or “Agreement” shall include this Appendix. 1. PURPOSE This Appendix sets forth additional terms to the Agreement. Any sub-section of this Appendix marked as “Reserved” shall be construed as setting forth no additional terms. 2. ADDITIONAL TERMS a. Additional Permitted Uses. In addition to those purposes set forth in the Agreement, Business Associate may use PHI for the following additional purposes: i. Reserved. b. Additional Permitted Disclosures. In addition to those purposes set forth in the Agreement, Business Associate may disclose PHI for the following additional purposes: i. Reserved. c. Approved Subcontractors. Covered Entity agrees that the following Subcontractors or agents of Business Associate may receive PHI under the Agreement: i. Reserved. d. Definition of Receipt of PHI. Business Associate’s receipt of PHI under this Contract shall be deemed to occur, and Business Associate’s obligations under the Agreement shall commence, as follows: i. Reserved. e. Additional Restrictions on Business Associate. Business Associate agrees to comply with the following additional restrictions on Business Associate’s use and disclosure of PHI under the Contract: i. Reserved. f. Additional Terms. Business Associate agrees to comply with the following additional terms under the Agreement: i. Reserved. DocuSign Envelope ID: 95E30E38-69EB-4293-AB83-D5EC23F73308