REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
June 10, 2025
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Agreement with Baseline IT Consulting, and Service Agreement and Health Insurance Portability and Accountability Act Business Associate Agreement with Rubrik, Inc. for the Purchase of the Rubrik Software
End
RECOMMENDATION(S)
Recommendation
1. Approve Agreement with Baseline IT Consulting, for the purchase of the Rubrik Software, in the not to exceed amount of $1,481,101, for the period of June 10, 2025 through June 9, 2030.
2. Approve non-financial Service Agreement with Rubrik, Inc., including non-standard terms, for the subscription to Rubrik cloud platform providing data backup and recovery for the period beginning June 10, 2025 and continuing until the last subscription period expires.
3. Approve non-financial Health Insurance Portability and Accountability Act Business Associate Agreement with Rubrik, Inc., including non-standard terms, for the period beginning June 10, 2025 and continuing until all obligations have been met or termination of the Service Agreement.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Improve County Government Operations.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The cost of $1,481,101 is funded by State Medi-Cal, Federal Medicare, private insurances, and other departmental revenue. Funding sources may change in the future pending any legislative activity related to the repeal and/or replacement of the Affordable Care Act. Adequate appropriation and revenue have been included in the Arrowhead Regional Medical Center (ARMC) 2024-25 budget and will be included in future recommended budgets.
BACKGROUND INFORMATION
The Agreement with Baseline IT Consulting (Baseline) will allow ARMC to subscribe to Rubrik Software (Rubrik), a backup and recovery solution. Rubrik offers a security cloud platform that integrates data protection, threat analytics, and recovery capabilities. Rubrik will provide ARMC a resilient protection system for archived data. The system is designed to provide cybersecurity safeguards from ransomware and unknown security threats.
The non-financial Service Agreement (Agreement) is Rubrik’s standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standard terms, Rubrik would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The County is required to indemnify Rubrik against third-party claims that County’s Data violates a third party’s rights, but not to the extent that such indemnity results in a waiver of the County’s sovereign immunity.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Rubrik, the County could be responsible to defend and reimburse Rubrik for costs, expenses, and damages, which could exceed the total Agreement amount.
2. The Agreement does not include certain standard County insurance requirements, including the waiver of subrogation.
• The County standard contract requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department.
• Potential Impact: No waiver of subrogation may allow Rubrik’s insurer to bring suit against the County, which could result in expenses that exceed the total Agreement amount.
3. Rubrik’s maximum liability to the County is limited to $500,000, excluding Rubrik’s indemnification obligation, or claims arising from Rubrik’s gross negligence or willful misconduct.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Agreement amount leaving the County financially liable for the excess.
4. The County may not terminate the Agreement for convenience. In addition, the County agrees to a non-cancelable payment obligation and non-refundable fees.
• County Policy 11-05 requires that the County have the right to terminate the contract, for any reason, with a 30-day written notice of termination without any obligation other than to pay amounts for services rendered and expenses reasonably incurred prior to the effective date of termination.
• Potential Impact: The County can only terminate the Agreement during the term for an uncured breach by Rubrik. Any attempted termination by County without cause could result in payment liability for the full Agreement amount, which could result in payment liability where no funds are available due to lack of allocation or loss of funding.
5. Venue for disputes arising under the Agreement is in Santa Clara, California.
• County Policy 11-05 requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in Santa Clara, California may result in additional expenses that exceed the amount of the Agreement.
The Business Associate Agreement (BAA) is Rubrik’s standard contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standard terms, Rubrik would not agree to all County standard terms. The non-standard and missing terms include the following:
1. Rubrik does not agree to provide appropriate liability insurance coverage.
• The County standard BAA requires the Business Associate (BA) to provide appropriate liability insurance coverage to cover claims and demands made for loss to any person arising from the breach of the security, privacy, or confidentiality obligations of BA under the BAA and under HIPAA provisions.
• Potential Impact: The County has no assurance that Rubrik will be financially responsible for claims that may arise under the BAA, which could result in expenses to the County that exceed the total the total amount of the underlying purchase contract.
2. Rubrik’s liability to the County under the BAA is limited to $500,000, excluding Rubrik’s indemnification obligation, or claims arising from Rubrik’s gross negligence or willful misconduct.
• The County standard BAA does not include a limitation of liability.
• Potential Impact: Costs and expenses related to breach caused by Rubrik could exceed the liability cap and the Agreement amount leaving the County financially liable for the excess.
ARMC recommends approval of the agreement, including the non-standard terms, to improve ARMC operations by aiding efforts to secure and protect data.
PROCUREMENT
On January 17, 2025 Request For Proposals No. ARMC125-ARMC-5707 for Rubrik Backup Solution was released through the County’s Electronic Procurement (ePro) network. Five proposals were received in response to the RFP. Of the four proposals received, one was deemed unresponsive as the proposal did not include information requested in the RFP.
Evaluation of the proposals was completed by a committee comprised of representatives from Information Technology. Proposals were evaluated based on the criteria of qualification, experience, technical, cost, references and presentation. The evaluation committee determined that Baseline best met ARMC’s needs and recommended them for a contract.
The company names and locations of all proposers who submitted a proposal in response to the RFP are provided below.
|
Proposer |
Locations |
|
Assured Data Protection, Inc. |
Herndon, VA |
|
Baseline IT Consulting |
San Diego, CA |
|
eNoah iSolutions, Inc. |
Westlake Village, CA |
|
Nth Generation Computing, Inc. |
San Diego, CA |
|
vPrime Tech Inc |
Houston, TX |
On April 24, 2025, a tentative award letter was sent to Baseline IT Consulting. On that same day, the unsuccessful agencies were notified in writing that they may protest the qualification review by submitting a formal protest letter to the Purchasing Department (Purchasing) within 10 calendar days of the non-selection letters. No protests were received.
Purchasing approves this procurement based on the formal, competitive solicitation referenced above.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387- 5455) on May 2, 2025; Purchasing (Veronica Pedace, Buyer III, 387-2464) on May 6, 2025; Risk Management (Stephanie Pacheco, Staff Analyst II, 386-9039) on May 12, 2025; Innovation and Technology Department (Lynn Fyhrlund, Chief Information Officer, 388-5501) on May 7, 2025; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on May 16, 2025; Finance (Jenny Yang, Administrative Analyst, 387-4884) on May 20, 2025; and County Finance and Administration (Valerie Clay, Deputy Executive Officer, 387- 5423) on May 20, 2025.