REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
April 29, 2025
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Master Agreement With Protenus, Inc. for Use of a Web-Based Healthcare and Compliance Analytics Platform License and Business Associate Agreement
End
RECOMMENDATION(S)
Recommendation
1. Approve Master Agreement with Protenus, Inc., including non-standard terms, for the use of a web-based healthcare and compliance analytics platform license for patient privacy monitoring software, in the amount of $506,000, for the period of April 29, 2025 through April 28, 2030.
2. Approve non-financial Health Insurance Portability and Accountability Act Business Associate Agreement with Protenus, Inc., to maintain regulatory compliance by safeguarding the County’s electronic Protected Health Information that is transferred, processed, and stored by Protenus, Inc., effective April 29, 2025 and continuing until terminated by either party.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The cost of $506,000 is funded by State Medi-Cal, Federal Medicare, private insurances, and other departmental revenue. Funding sources may change in the future, pending any legislative activity related to the repeal and/or replacement of the Affordable Care Act. Adequate appropriation and revenue have been included in the Arrowhead Regional Medical Center (ARMC) 2024-25 budget and will be included in future recommended budgets.
BACKGROUND INFORMATION
This Master Agreement (“Agreement”) will allow ARMC to have access to Protenus, Inc.’s (Protenus) web-based healthcare and compliance analytics platform licenses with Artificial Intelligence (AI) capabilities that are utilized for patient privacy monitoring. Protenus monitors ARMC’s Electronic Health Record (EHR) system Epic (Epic) charting and reports suspicious activity for privacy compliance pertaining to the Health Insurance Portability and Accountability Act (HIPPA), and for further investigations. Protenus is uniquely designed to be utilized with EHR systems for hospitals to monitor patient information access. Protenus will provide the initial implementation, monitoring and maintenance, case review and triage, and privacy health checkup of patient records.
The Agreement is Protenus’ standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standards, Protenus would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The County is required to indemnify Protenus against third party claims relating to (i) breach of any representation or warranty under the Agreement; (ii) breaches of the confidentiality and security obligations in the Agreement; (iii) fraud, willful misconduct, gross negligence or criminal acts; (iv) rights relating to any third-party software, system, technology, solution, or platform used by the County; and (v) any action or inaction by the County in connection with the County’s use of the Protenus solution.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Protenus, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time-limited, or expense-limited could be brought against Protenus without such limitations and the County could be responsible to defend and reimburse Protenus for costs, expenses, and damages, which could exceed the total Agreement amount.
2. The Agreement has modified insurance terms not including the County as an additional named insured to the policies.
• The County standard contract requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department.
• Potential Impact: The modification to the additional insured provision limits the County’s ability to recover losses for certain types of claims, which could result in expenses that exceed the total Agreement amount.
3. Protenus’ maximum liability to the County is limited to $200,000, excluding Protenus’ indemnification obligations and claims arising from Protenus’ gross negligence, willful misconduct and violation of law.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Agreement amount, leaving the County financially liable for the excess.
4. The County may not terminate the Agreement for convenience.
• The County standard contract gives the County the right to terminate the contract, for any reason, with a 30-day written notice of termination, without any obligation other than to pay amounts for services rendered and expenses reasonably incurred prior to the effective date of termination.
• Potential Impact: The County can only terminate the Agreement during the term for an uncured breach by Protenus. Any attempted termination by County without cause could result in payment liability for the full Agreement amount, which could result in payment liability where no funds are available due to lack of allocation or loss of funding.
ARMC recommends the approval of the Agreement, including non-standard terms, to provide for the safety, health and social services needs of County residents by ensuring ARMC has the necessary software to meet County healthcare needs.
PROCUREMENT
The Purchasing Department supports this non-competitive procurement of Protenus based on the specialized credentials such as technologically advanced capabilities with artificial intelligence and specialization in healthcare analytics which other vendors do not offer. Protenus has no application redundancy, which allows for an application running on multiple hardware installations to respond in a consistent manner from any of those hardware installs in case one fails. Protenus is uniquely suited to be utilized for Epic as it allows ARMC Compliance, and Innovation and Technology Security personnel to review and audit system accesses with high accuracy rates with immediate reporting of any privacy concern.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on March 13, 2025; Purchasing (Veronica Pedace, Buyer III, 387-2198) on December 17, 2024; Innovation and Technology (Robert Pittman, Chief Information Security Officer, 388-5510) on April 17, 2025; Risk Management (Gregory Ustaszewski, Staff Analyst II, 386-9008) on January 7, 2025; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on March 13, 2025; Finance (Jenny Yang, Administrative Analyst, 387-4884) on March 20, 2025; and County Finance and Administration (Valerie Clay, Deputy Executive Officer, 387-5423) on March 20, 2025.