REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
April 21, 2026
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Approval of Service Agreements and Business Associate Agreements for Clinical Data Performance Platform
End
RECOMMENDATION(S)
Recommendation
1. Approve Data Management Service Agreement with Fivos, Inc., including non-standard terms, for access to the Fivos, Inc.'s PATHWAYS clinical data performance platform, in the amount of $14,088, for the first year and subscription fees of $2,272 per procedure registry annually thereafter, for the contract term beginning on the date of execution and automatically renewing annually thereafter, unless terminated sooner by either party after the first year.
2. Approve Non-Financial Business Associate Agreement with Fivos, Inc. to ensure the security of protected health information pursuant to the Health Insurance Portability and Accountability Act.
3. Approve Patient Safety Organization Service Agreement with Society for Vascular Surgery Patient Safety Organization, LLC, for access to medical record data for four registries held by Fivos. Inc., in the amount of $909 per procedure registry for an annual total of $3,636, commencing on the effective date and automatically renewing from year to year thereafter.
4. Approve Non-Financial Business Associate Agreement with Society for Vascular Surgery Patient Safety Organization, LLC to ensure the security of protected health information for a one-year term, commencing on the effective upon execution by both parties and shall automatically renew from year to year thereafter.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Promote and Fulfill the Countywide Vision.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost).
The initial one-year cost is $17,694, which includes $14,088 for Fivos and $3,636 for Society for Vascular Surgery Patient Safety Organization, LLC (SVS). Costs in future years, if renewed, are subject to annual budget appropriation. These costs are funded by State Medi-Cal, Federal Medicare, private insurance, and other departmental revenue. Funding sources may change in the future pending any legislative activity related to the repeal and/or replacement of the Affordable Care Act. Adequate appropriation and revenue have been included in the Arrowhead Regional Medical Center (ARMC) 2025-26 budget and will be included in future recommended budgets.
BACKGROUND INFORMATION
The Data Management Service Agreement (DMSA) with Fivos, Inc. (Fivos), including non-standard terms, for access to the Fivos PATHWAYS® clinical data performance platforms, which will provide ARMC with real-time data collection and reporting for long-term outcomes assessment. These platforms capture data for the Society of Vascular Surgery Vascular Quality Initiative® (SVS VQI®) registries, including both procedure and follow-up data. The data forms were designed by vascular surgeons and contain detailed data to allow analyses of root causes for different outcomes, including patient case mix, pre-operative management, and details of surgical technique. All data can be downloaded and saved.
The agreements with Fivos and SVS will provide ARMC with the tools for diagnosing patients considered high-risk for traditional carotid surgery. Transcarotid Artery Revascularization (TCAR) is a minimally invasive procedure designed to treat carotid artery disease and reduce the risk of stroke. It involves stenting the carotid arteries through a small incision in the neck, thereby improving blood flow to the brain. The data that is provided through this platform will assist in identifying potential methods for treatment.
The DMSA with Fivos includes four procedure registries, as follows:
• Carotid Artery Stent Registry
• Peripheral Vascular Intervention Registry
• Lower Extremity Amputation Registry
• Venous Stent Registry
Fivos’ Business Association Agreement (BAA) is intended to protect the privacy and provide for the security of Personal Health Information (PHI) disclosed to or used by Fivos in compliance with the Health Insurance Portability and Accountability Act (HIPAA). The BAA will allow Fivos to perform or provide functions, activities or services to the County that require Fivos to create, access, receive, maintain, and/or transmit information that includes or may include protected health information, as defined by the HIPAA Rules, to provide such functions, activities or services.
The Patient Safety Organization Service (PSO) Agreement with Society for Vascular Surgery Patient Safety Organization, LLC, (SVS) will provide ARMC with access to medical record data held by FIVOS through its technology platform. The SVS VQI® is a collaboration of the Society for Vascular Surgery Patient Safety Organization (SVS PSO), 18 regional quality improvement groups organized under the SVS PSO, and FIVOS, its commercial technology partner.
The BAA with SVS is intended to protect the privacy and provide for the security of Personal Health Information (PHI) disclosed to or used by SVS in compliance with HIPAA. The BAA will allow SVS to perform or provide functions, activities or services to the County that require SVS to create, access, receive, maintain, and/or transmit information that includes or may include PHI, as defined by the HIPAA Rules, to provide such functions, activities or services.
The Data Management Service Agreement (DMS Agreement) is Fivos’ standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standards, Fivos would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The DMS Agreement is silent on governing law.
• The County standard contract requires California governing law.
• Potential Impact: Having no specified governing law in the DMS Agreement results in uncertainty over which state’s laws will govern the interpretation of the DMS Agreement and leads to ambiguity in the interpretation of the DMS Agreement terms. Fivos is a Delaware corporation headquartered in New Hampshire. The DMS Agreement could be interpreted under any state law depending on where the claim is brought, including Delaware, New Hampshire, or California. Any questions, issues or claims arising under the DMS Agreement could require the County to hire outside counsel competent to advise on the applicable state law, which may result in fees that exceed the total DMS Agreement amount.
2. There is no provision in the DMS Agreement addressing each party’s responsibility for paying attorneys’ fees.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: County Counsel cannot advise on whether and to what extent any State law, other than California, may affect a party’s requirement to pay the prevailing party’s attorneys’ fees and costs in a legal action where no specific provision is provided in the DMS Agreement.
3. Fivos’ maximum liability to the County is limited to the greater of $2 million or the limits of insurance, except for damages arising from Fivos’ gross negligence, willful misconduct or violation of law.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the DMS Agreement amount leaving the County financially liable for the excess. County Counsel cannot advise on whether and to what extent any State law, other than California, may limit or expand the exclusion of limits to the extent prohibited by applicable law.
4. There is no stated venue in the DMS Agreement.
• County Policy 11-05 requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Fivos is a Delaware corporation having its headquarters in Grafton County, New Hampshire. Having no express venue in the DMS Agreement means that the Delaware or Grafton County, New Hampshire venue could be applied to disputes arising under the DMS Agreement, which may result in additional expenses that exceed the amount of the DMS Agreement.
The Fivos BAA is Fivos’ standard Business Associate Agreement, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standards, Fivos would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The County is required to indemnify Fivos against all claims caused by the acts or omissions of the County, its officers, employees, agents, and subcontractors with respect to the use, access, maintenance or disclosure of the County’s PHI.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Fivos, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time-limited, or expense-limited could be brought against Fivos without such limitations and the County could be responsible to defend and reimburse Fivos for costs, expenses, and damages, which could exceed the totalFivosBAA amount.
2. Fivos does not agree to provide appropriate liability insurance coverage.
• The County standard BAAt requires the Business Associate to provide appropriate liability insurance coverage to cover claims and demands made for loss to any person arising from the breach of the security, privacy, or confidentiality obligations of Business Associate under the BAA and under HIPAA provisions.
• Potential Impact: The County has no assurance that Fivos will be financially responsible for claims that may arise under the Fivos BAA, which could result in expenses to the County that exceed the total the total amount of the underlying purchase contract.
3. Fivos’ liability to the County under the Fivos BAA is limited to $1 million.
• The County standard BAA does not include a limitation of liability.
• Potential Impact: Costs and expenses related to breach caused by Fivos could exceed the liability cap and the DMS Agreement amount, leaving the County financially liable for the excess.
The PSO Agreement is SVS’s standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standards, SVS would not agree to all County standard terms. The non-standard and missing terms include the following:
1. SVS’s maximum liability to the County is limited to $1 million, except for damages arising from SVS’s gross negligence, willful misconduct or violation of law.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the PSO Agreement amount, leaving the County financially liable for the excess. County Counsel cannot advise on whether and to what extent any State law, other than California, may limit or expand the exclusion of limits to the extent prohibited by applicable law.
2. There is no stated venue in the PSO Agreement.
• County Policy 11-05 requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: SVS is a Delaware corporation having its headquarters in Cook County, Illinois. Having no express venue in the PSO Agreement means that Delaware or Cook County, Illinois, venue could be applied to disputes arising under this PSO Agreement, which may result in additional expenses that exceed the amount of the PSO Agreement.
The SVS BAA is SVS’s standard BAA, which includes terms that differ from the standard County contract and omits certain County standard contract terms. While the parties negotiated certain contract terms to County standards, SVS would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The County is required to indemnify SVS against all claims caused by the acts or omission of the County, its officers, employees, agents, and subcontractors with respect to the use, access, maintenance or disclosure of the County’s PHI.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify SVS, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time-limited, or expense-limited could be brought against SVS without such limitations and the County could be responsible to defend and reimburse SVS for costs, expenses, and damages, which could exceed the total BAA amount.
2. SVS does not agree to provide appropriate liability insurance coverage.
• The County standard BAA requires the Business Associate to provide appropriate liability insurance coverage to cover claims and demands made for loss to any person arising from the breach of the security, privacy, or confidentiality obligations of Business Associate under the BAA and under HIPAA provisions.
• Potential Impact: The County has no assurance that SVS will be financially responsible for claims that may arise under the SVS BAA, which could result in expenses to the County that exceed the total the total amount of the underlying purchase contract.
3. SVS’s liability to the County under the SVS BAA is limited to $1 million.
• The County standard Business AA does not include a limitation of liability.
• Potential Impact: Costs and expenses related to breach caused by SVS could exceed the liability cap and the PSO Agreement amount leaving the County financially liable for the excess.
ARMC recommends approval of the Agreements with Fivos and SVS, including the non-standard terms, to allow ARMC to access the patient data contained in the SVS through the Fivos technology platform. This Agreements will auto renew to allow the ongoing use of this software licenses to give ARMC access to the platform, providing patients with enhanced healthcare encounters and advanced level of care.
PROCUREMENT
The Purchasing Department supports this non-competitive procurement based on functional specifications. The platform provided by Fivos and patient data accessed through SVS would impact ARMC’s ability to advance the level of care and service to its patients.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on March 31, 2026; Risk Management (Stephanie Mead, Staff Analyst II Trainee, 386-9039) on February 26, 2026; Purchasing (Veronica Pedace, Buyer III, 387-2464) on March 31, 2026; Innovation and Technology Department (Lynn Fyhrlund, Chief Information Officer, 388-5501) on April 2, 2026; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on March 31, 2025; and County Finance and Administration (Jenny Yang, Administrative Analyst, 387-4884) on March 7, 2026.