REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
January 24, 2023
FROM
WILLIAM L. GILBERT, Director, Arrowhead Regional Medical Center
SUBJECT
Title
Agreements with Forward Advantage, Inc. and Imprivata, Inc. for Privileged Access Management Software Service and Single Sign-On Software
End
RECOMMENDATION(S)
Recommendation
1. Approve Agreement with Forward Advantage, Inc. for Imprivata Privileged Access Management Software and Service in the amount of $118,224 for a period of three years from January 24, 2023 through January 23, 2026.
2. Approve End User License Agreement with Imprivata, Inc., including non-standard terms, to license the Imprivata Privileged Access Management Software and Service as purchased from Forward Advantage, Inc.
3. Authorize the Director, or the Information Management Director, of Arrowhead Regional Medical Center to electronically accept the Imprivata, Inc. terms and conditions of the End User License Agreement for the period beginning upon download of the software through January 23, 2026.
4. Approve Agreement with Forward Advantage, Inc. for single sign-on software licenses, in the amount of $341,855, for a total of two years from March 29, 2023 through March 28, 2025.
(Presenter: William L. Gilbert, Director, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The cost of $118,224 for the Privileged Access Management software and $341,855 for the single sign-on software licenses are funded by State Medi-Cal, Federal Medicare, private insurances, and other departmental revenue. Funding sources may change in the future pending any legislative activity related to the repeal and/or replacement of the Affordable Care Act. Adequate appropriation and revenue have been included in the Arrowhead Regional Medical Center (ARMC) 2022-23 budget and will be included in future recommended budgets.
BACKGROUND INFORMATION
Approval of the Agreement with Forward Advantage, Inc. (Forward Advantage) for Privileged Access Management (PAM) software and service will enable ARMC to provide privileged access and authentication to ARMC software systems for more efficient and secure patient care. PAM is a solution that secures the most sensitive software systems and accounts that have administrative privileges and helps to protect ARMC systems from unauthorized access through simplified password management and integrated multifactor authentication.
Although the PAM software is sold by Forward Advantage, the software is licensed under an End User License Agreement (EULA) with Imprivata, Inc. (Imprivata) as Imprivata is the developer of the PAM software. Therefore, a separate agreement with Imprivata is included for approval in Recommendation No. 2. Additionally, in the process of downloading the PAM software, the vendor requires electronic acceptance of the EULA through January 23, 2026. Therefore, ARMC requests authorization in Recommendation No. 3 for the Hospital Director or the ARMC Information Management Director to accept the electronic terms.
Approval of the Agreement with Forward Advantage for single sign-on software in Recommendation No. 4 will provide ARMC with a secure verification system through which a badge or smart card replaces the need to enter a username and password to login to the hospital’s system.
The PAM software is a new County purchase for ARMC; however, the single sign-on software is currently being utilized by the hospital. On February 13, 2018 (Item No. 10), the Board of Supervisors (Board) approved agreement No. 18-519 with Forward Advantage in the amount of $688,885 for the purchase of single sign-on software and smart card reader to replace the previous username and password log-in system at ARMC, for the period of February 13, 2018 through February 12, 2021. The agreement was subsequently amended three times by the Board to provide software maintenance and technical support, implement authentication system to electronically prescribe controlled substances, and integrate the single-sign on system with the electronic health record, Epic. These amendments increased the contract from $688,885 to $1,259,630 and extended the term for a total period from February 13, 2018 through March 23, 2023.
The EULA is Imprivata’s standard commercial agreement, which includes terms that differ from the standard County contract and omits certain County standard contract terms. The EULA is a non-negotiable clickwrap accepted upon download of the software. The non-standard and missing terms include the following:
1. Governing law is the State of Massachusetts.
• The County standard contract requires California governing law.
• Potential Impact: The EULA will be interpreted under Massachusetts law. Any questions, issues or claims arising under this contract will require the County to hire outside counsel competent to advise on Massachusetts law, which may result in fees that exceed the total agreement amount.
2. Imprivata may assign the EULA without notice to the County and without the County’s approval.
• In the County standard contract the County must approve any assignment of the contract.
• Potential Impact: Imprivata could assign the EULA to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge. Should this occur, the County would be out of compliance with the law until it becomes aware of the assignment and terminates the EULA. County Counsel cannot advise on whether and to what extent Massachusetts law may permit or restrict a party’s right to assign without an express provision in the agreement.
3. There is no provision in the EULA addressing each party’s responsibility for paying attorneys’ fees.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: County Counsel cannot advise on, whether and to what extent, Massachusetts law may affect a party’s requirement to pay the prevailing party’s attorneys’ fees and costs in a legal action where no specific provision is provided in the agreement.
4. The County is required to indemnify Imprivata against all claims, governmental enforcement proceedings arising from the County’s failure to comply with all applicable biometric and privacy laws, rules, regulations and orders. The County is additionally required to indemnify Imprivata against claims arising from the County’s failure to comply with applicable export and import regulations.
• The County standard contract does not include any indemnification or defense by the County of a Contractor.
• Potential Impact: By agreeing to indemnify Imprivata, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Imprivata without such limitations and the County would be responsible to defend and reimburse Imprivata for costs, expenses, and damages, which could exceed the total agreement amount. County Counsel cannot advise on, whether and to what extent, Massachusetts law may limit or expand this agreement term.
5. The EULA does not require Imprivata to meet the County’s insurance standards as required pursuant to County Policy 11-07.
• The County Policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and set forth in the County standard contract.
• Potential Impact: The County has no assurance that Imprivata will be financially responsible for claims that may arise from the County’s use of the software, which could result in expenses to the County that exceed the total agreement amount.
6. Imprivata’s maximum liability to the County is limited to the fees paid and payable by the County during the 12 months prior to the claim, excluding claims for personal injury.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the agreement amount leaving the County financially liable for the excess. County Counsel cannot advise on, whether and to what extent, Massachusetts law may limit or expand the exclusion of limits to the extent prohibited by applicable law.
7. The County may not terminate the EULA for convenience. In addition, the County agrees to a non-cancelable payment obligation and non-refundable fees.
• The County standard contract gives the County the right to terminate the Contract, for any reason, with a 30-day written notice of termination without any obligation other than to pay amounts for services rendered and expenses reasonably incurred prior to the effective date of termination.
• Potential Impact: The County can only terminate the EULA during the term of an uncured breach by Imprivata. Any attempted termination by County without cause would result in payment liability for the full agreement amount, which could result in payment liability where no funds are available due to lack of allocation or loss of funding.
8. There is no stated venue in the EULA.
• The County standard contract requires the venue for disputes be the Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Imprivata is located in Middlesex County, Massachusetts. Having no express venue in the agreement means that Middlesex County venue could be applied to disputes arising under the EULA, which may result in additional expenses that exceed the amount of the agreement.
ARMC recommends approval of the Forward Advantage Agreement for PAM, the Imprivata EULA and the Forward Advantage Agreement for single sign-on software to provide for the safety, health and social services needs of county residents by protecting access to ARMC systems, patient accounts and healthcare records.
PROCUREMENT
Purchasing supports the non-competitive procurement of both PAM software and single sign-on software to ensure there are no lapses in hospital network access security due to timing constraints to complete a Request for Proposals (RFP) and complete hospital-wide implementation, which combined can take between two and three years. Prior to the end of the termination dates for the agreements, the ARMC will complete a formal RFP for both software services.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on December 13, 2022; Purchasing (Ariel Gill, Buyer III, 777-0722) on December 19 2022; Risk Management (Victor Tordesillas, 386-8623) on December 28, 2022; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on December 29, 2022; Finance (Jenny Yang, Administrative Analyst, 387-4884) on December 29, 2022; and County Finance and Administration (Valerie Clay, Deputy Executive Officer, 387-5423) on January 4, 2023.