REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF THE COUNTY OF SAN BERNARDINO
AND RECORD OF ACTION
May 19, 2020
FROM
WILLIAM L. GILBERT, Director, Arrowhead Regional Medical Center
SUBJECT
Title
Agreement with Epic Systems Corporation for Hosting Services for Arrowhead Regional Medical Center’s Electronic Health Record System
End
RECOMMENDATION(S)
Recommendation
Approve a Hosting Services Agreement with Epic Systems Corporation with an estimated cost not to exceed $13,217,200, for the period beginning July 1, 2020 through the earlier of December 31, 2026 and sixty months after the Technical Go Live, for the complete hosting of a fully integrated Electronic Health Records system for Arrowhead Regional Medical Center.
(Presenter: William L. Gilbert, Director, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of the recommendation will not result in the use of Discretionary General Funding (Net County Cost), as the annual cost not to exceed $2,413,200 is funded by State Medi-Cal, Federal Medicare, private insurances, and other departmental revenue. Funding sources may change in the future pending any legislative activity related to the repeal and/or replacement of the Affordable Care Act. Sufficient appropriation and revenue are included in the Arrowhead Regional Medical Center (ARMC) 2020-21 budget and will be included in future recommended budgets.
The estimated annual cost for each year is as follows:
|
Year |
Fiscal Year |
Estimated Annual Amount |
|
1 |
FY 20-21 |
$2,002,700 |
|
2 |
FY 21-22 |
$2,078,800 |
|
3 |
FY 22-23 |
$2,157,800 |
|
4 |
FY 23-24 |
$2,239,800 |
|
5 |
FY 24-25 |
$2,324,900 |
|
6 |
FY 25-26 |
$2,413,200 |
BACKGROUND INFORMATION
Approval of this recommendation, will allow ARMC to establish a fully certified remote hosting option for the Epic Systems Corporation (Epic) electronic health record with complete backup and disaster recovery capabilities, as required by Centers for Medicare and Medicaid Services Conditions of Participation and enforced by The Joint Commission. The hosting agreement will provide ARMC with a robust server hardware platform and a certified support services team for the Epic health record software, along with the redundancy and backup systems included in case of an emergency or disaster. ARMC does not currently have the on-site capacity or capability to provide these services.
On August 6, 2019, (Item No. 9) the Board of Supervisors (Board) approved Agreement #19-557 with Epic with an estimated 5-year cost not to exceed $29,738,425 beginning August 6, 2019 with no termination date, for the purchase, installation and maintenance of a fully integrated Electronic Health Records system at ARMC.
Epic’s Hosting Services Agreement is its standard commercial license, as negotiated by the County, which contains terms that differ from the standard County contract. The non-standard terms include the following:
1. Without the County’s consent, Epic may assign the contract to (i) Epic Parent, (ii) any Owned Entity as of the Effective Date, and (iii) any directly or indirectly wholly-Owned Entity that is not incorporated in a country that is the subject of a then-current OFAC sanctions program.
• The County must approve any assignment of the contract.
• Potential Impact: Epic may assign the contract without the County’s approval. This could allow the contract to be assigned to a business with which the County is legally prohibited from doing business with due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge.
2. County is obligated not to disclose the information claimed by Epic to be its confidential information, including not disclosing the non-redacted versions of the Hosting Services Agreement.
• The County standard contract does not require the County to maintain the confidentiality of agreement terms or a contractor’s information.
• Potential Impact: The County is obligated to maintain the confidentiality of information that Epic deems confidential. The County may incur liability from failing to disclose information pursuant to a California Public Records Act request or open public meetings requirements (Brown Act and County Sunshine Ordinance). This liability may be offset by the indemnification obligations that Epic has agreed to undertake. In addition, the County could be deemed in breach of contract and incur liability to Epic for disclosure of Epic’s information, regardless of whether the disclosure is intentional or inadvertent, which could exceed the contract amount.
3. County agrees to defend or settle, and to indemnify and to hold Epic harmless from, any third-party claim brought against Epic alleging that the County’s data infringes any patent, copyright or trademark and any claim arising out of the County’s use or inability to use any of the services, including if caused by Epic’s negligence.
• The County standard contract does not require the County to indemnify or defend a Contractor.
• Potential Impact: By agreeing to indemnify Epic, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Epic without such limitations and the County would be responsible to defend and reimburse Epic for costs, expenses, and damages, which could exceed the total contract amount.
4. Epic will have no obligation to indemnify the County for a breach of Protected Health Information (PHI) that occurs during any calendar quarter that the County fails to timely submit a self-evaluation report to Epic, submits a self-evaluation indicating that the County has failed to comply with its security obligations under the contract, or submits a false or inaccurate self-evaluation.
• Neither the County standard contract nor the County standard Business Associate Agreement requires the County to comply with information security or reporting obligations in order to be indemnified by a contractor for breach of PHI.
• Potential Impact: If the County fails to meet its security and reporting obligations, even if a breach of PHI is caused by Epic, Epic will have no obligation to cover the County’s costs and expenses related to a breach of County PHI, which could exceed the total contract amount.
5. If a breach of unsecured Protected Health Information (PHI) is caused solely by County’s failure to comply with its security obligations, the County will indemnify Epic for fines and penalties imposed by a governing authority for a violation of applicable state or federal data privacy laws; (ii) reasonable out-of-pocket expenses incurred by Epic for hiring an outside auditor to complete a risk assessment, and identifying and notifying patients; and (iii) statutory, compensatory, and direct damages paid to a third party for a claim arising from the breach.
• Neither the County standard contract nor the County standard Business Associate Agreement requires the County to indemnify a contractor for breach of PHI resulting from County’s failure to comply with information security or reporting obligations.
• Potential Impact: If County fails to meet its security and reporting obligations, and a breach of Epic’s hosting service results, the County will be liable for all fines, penalties, costs and expenses related to a breach of any affected PHI on the Epic hosting service, which could exceed the total contract amount.
6. The contract does not require Epic to meet the County insurance standards, including Cyber Liability coverage.
• The County standard contract requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department.
• Potential Impact: The County has no assurance that Epic will be financially responsible for claims that may arise from the County’s use of the hosting service, which could result in expenses to the County that exceed the total contract amount.
7. Both Epic’s and the County’s aggregate liability for claims under the contract is limited to the greater of one million dollars ($1,000,000) and the fees paid by the County in the eighteen (18) months prior to the date the claim was filed, excluding third party claims for bodily injury, property damage, and indemnity obligations. Epic’s liability related to a breach of County’s PHI for any claim made when County has failed to meet its security and reporting obligations is limited to one hundred dollars ($100).
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the contract amount leaving the County financially liable for the excess.
8. Neither party will commence any action for any matter arising under the contract after the later of twenty-four months after the date the action first arises or the third anniversary date of the Agreement.
• The County standard contract does not include a limit on the time to bring action.
• Potential Impact: Limiting the time period in which to bring suit amounts to a waiver of the Statute of Limitations for claims and shortens the period of time in which the County may file a lawsuit under the contract.
9. Payment terms are monthly in advance within 45 days of invoice date, the payment date specified in the invoice, or the date payment is due as otherwise specified in the Agreement. Epic may charge an administrative fee for past due uncontested amounts.
• County standard payment terms are Net 60 days with no interest or late payment penalties.
• Potential Impact: County standard processing time is 60 days or more. Failing to make payments by the due date will result in a material breach of the contract, which would allow Epic to terminate the contract and seek other legal remedies, including restricting access to read-only, suspending access to the service and charging the County late payment penalties in the form of administrative fees, which would exceed the contract amount.
10. The term of the contract is the period beginning on the date that the County signs the agreement and ending on the earlier of sixty (60) months after the Technical Go Live or seventy-eight (78) months from the date that the County signs the agreement.
• County Policy 11-04 limits the maximum contract period to 5 years unless approved by the Board.
• Potential Impact: The term of the contract is not fixed and may bind the County for up to 6-½ years.
11. There is no termination for convenience without penalty. County may terminate the contract without cause with ninety (90) days advance written notice and payment of the Early Termination Fee.
• The County standard contract gives the County the right to terminate the Contract, for any reason, with a thirty (30) day written notice of termination without any obligation other than to pay amounts for services rendered and expenses reasonably incurred prior to the effective date of termination.
• Potential Impact: Upon any termination by either party regardless of cause, the County is required to pay an early termination fee, which could result in payment liability where no funds are available due to lack of allocation or loss of funding.
12. Venue is San Bernardino County if Epic institutes the legal action and in Dane County, Wisconsin if the County institutes legal action.
• The County standard contract requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in Dane County, WI may result in additional expenses that exceed the amount of the contract.
After review of responses to RFP, an evaluation committee identified Epic as the vendor with the highest score based on the criteria. ARMC recommends approval of this contract, including the non-standard terms, and recommends utilizing Epic’s Hosting platform.
PROCUREMENT
On August 6, 2019 (Item No. 9) the Board approved an agreement with Epic to provide ARMC with an Electronic Health Record system. As part of the original proposal, Epic proposed the hosting of the software. It was requested by County Counsel that due to the number of non-standard terms, ARMC release an RFP for Hosting.
On July 26, 2019, RFP No. AGENCY20 - PURC - 3456 for a new Electronic Health Record Hosting and Managed Support Services at ARMC was released through the County of San Bernardino Electronic Procurement (ePro) network. Two companies submitted proposals. Of the two companies only one met the minimal requirements, with many of the same non-standard terms. It was determined it was in the best interest of the county to cancel the RFP and re-negotiate with Epic, based on the original RFP. Purchasing concurs with the non-competitive justifications specialized credentials and functionalities.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, County Counsel, 387-5455) on April 13, 2020; Purchasing Department (Jackie Ambrose, Lead Buyer, 387-2463) on April 24, 2020; ARMC Finance Budget Officer (Chen Wu, ARMC Finance Budget Officer, 580-3165) on April 27, 2020; Finance (Yael Verduzco, Administrative Analyst, 387-5285) on April 30, 2020; and County Finance and Administration (Matthew Erickson, Chief Financial Officer, 387-5423) on May 4, 2020.