HomeMy WebLinkAboutItem 05 Origmi RiskLLC AGENDA ITEM SUMMARY Meeting Date: 1/19/2021
Meeting Type: Regular Meeting
Staff Contact/Dept.: Tom Mugleston
Staff Phone No: 541-726-3724
Estimated Time: Consent Calendar
S P R I N G F I E L D
C I T Y C O U N C I L
Council Goals: Provide Financially
Responsible and
Innovative Government
Services
ITEM TITLE: ORIGAMI RISK LLC CONTRACT
ACTION
REQUESTED:
Authorize City Manager to negotiate and execute a cooperative purchasing contract
with Origami Risk LLC for Risk Management Information System (RMIS)
Services.
ISSUE
STATEMENT:
Multnomah County has engaged Origami Risk for Risk Management Information
System (RMIS) services and established a cooperative purchasing provisions in
their contract. The City wishes to negotiate and sign a contract with Origami Risk
LLC.
ATTACHMENTS: Attachment 1 – Council Briefing Memorandum
Attachment 2 – C2709 Origami Risk Purchase Order
Attachment 3 – City of Springfield Contract 08Jan2021
Attachment 4 – 4-4822 RFP for RMIS
Attachment 5 – 4-4822 RMIS – Addendum 1
Attachment 6 – 4-4822 Origami Risk Proposal
Attachment 7 – 44-3077 Executed
Attachment 8 – 1259 SOW
DISCUSSION/
FINANCIAL
IMPACT:
The risks faced by the City are increasing in complexity and expense. The City
currently employs 1.5 FTE to administer more than 2 million dollars in annual
insurance premiums, incidents and claims. By implementing RMIS, the City will
increase the efficiency of managing incidents and claims without adding personnel
and provide City management with enhanced decision-making information.
Implementation will also position us to take advantage of future gains in predictive
analytics, improving our ability to prevent rather than respond to risks. RMIS
technology solution will also aid the city in recovering approximately $10,000 to
$20,000 annually in city property damage losses which have not previously been
sought due to the lack of staff.
The Origami Risk product provides the following key functions:
• Incident and Claims Management automation
• Automated transfer of information with third-party administrators (TPA)
• Enterprise Risk Management (ERM) system automation
• Insurance policy and internal cost allocation management
• Federal and State OSHA and Medicare reporting automation
Ongoing costs have been approved by the budget committee. We will be seeking
special budget authorization to use reserves for year-one implementation. Three-
year total equals $231,020.
M E M O R A N D U M City of Springfield
Date: 1/19/2021
To: Nancy Newton COUNCIL
From: Chaim Hertz - Human Resources Director and
Tom Mugleston – Risk Manager
BRIEFING
Subject: ORIGAMI RISK LLC CONTRACT MEMORANDUM
ISSUE: Multnomah County has engaged Origami Risk for Risk Management Information
System (RMIS) services and established a cooperative purchasing provisions in their contract.
The City wishes to negotiate and sign a contract with Origami Risk LLC.
COUNCIL GOALS/
MANDATE:
Provide Financially Responsible and Innovative Government Services
BACKGROUND:
The risks and regulatory requirements faced by the City are rapidly increasing in complexity and
expense. The City currently employs 1.5 FTE to administer more than 2 million dollars in
annual insurance premiums, incidents and claims.
The City currently struggles to be able to report on the root causes of incidents and potential
losses. We can report on what is happening with claims and losses, but lack the sophistication to
report on why they occur. Without this ability to understand and report on the root causes of
incidents and claims, our prevention efforts will be impotent. We need to move from a reactive
to a proactive stance.
The City’s incident tracking and claims processes are handled manually via spreadsheets. This
limits the number of claims we can track and manage. As a result we pass claims processing for
small claims on to our carriers resulting in larger premiums. By implementing RMIS, the City
will increase the efficiency of managing incidents and claims without adding personnel. RMIS
technology solution will also aid the city in recovering approximately $10,000 to $20,000
annually in city property damage losses which have not previously been sought due to the lack
of staff.
Looking to the future, implementation will also position us to take advantage of future gains in
predictive analytics, improving our ability to prevent rather than respond to losses.
Origami risk is widely recognized as an industry leader and the best of like systems at workflow
automation which allows the system to perform manual and repetitive processes.
The OrgamiRisk product will provide the following key functions and benefits:
• Incident and Claims Management
o Incident and claims intake via web-portal should reduce initial employee claim
submission from 30+ minutes to under 10 minutes.
o Workflow notification and tracking of supervisory responsibilities
o Root cause analysis
o Automated transfer of information with third-party administrators (TPA)
o Automated drafting of claims letters to claimants and insurers.
Attachment 1, Page 1 of 2
MEMORANDUM 1/14/2021 Page 2
• Enterprise Risk Management (ERM) system
o This component will support Executive Team efforts to identify and develop
mitigation and response plans to address potential risks faced by the City.
o Root causes of potential losses can be combined with root cases of actual losses
to present a comprehensive picture of threats facing the city and possible actions
that could be taken.
• Insurance policy and internal cost allocation management
o This component automates the process of allocating insurance premium, claim
costs, and retained costs to departments. This is currently a laborious and not
well understood process. We hope to gain transparency and ease of
administration.
• Federal and State OSHA and Medicare reporting automation
o Tracking and reporting on regulatory requirements currently results in handling
data multiple times and is prone to errors and wasted time. System automations
will allow us to spend time handling data once and then the system can
automatically prepare and submit data for us.
Ongoing costs have been approved by the budget committee. We will be seeking special budget
authorization to use reserves for year-one implementation. Costs are summarized as follows:
• Year 1 – $119,220
• Year 2 – $56,900
• Year 3 – $56,900
• Total $231,020
We are excited to see the financial savings in claims, as well as the proactive reduction in threats
that RMIS will bring the City.
RECOMMENDED ACTION: Authorize City Manager to Negotiate and execute a cooperative
purchasing contract with Origami Risk LLC for Risk Management Information System (RMIS)
Services.
Attachment 1, Page 2 of 2
City of Springfield Cooperative Agreement
225 Fifth Street Purchase Order
Springfield, Oregon 97477
Phone: 541-726-3622 P.O Number C2709
Fax: 541-726-3782
This purchase is placed against the following Price Agreement:
State of Oregon (ORCPP) Price Agreement #
NPPGov Price Agreement #
Sourcewell (NJPA) Price Agreement
Other: Cooperative Purchasing Agreement - Multnomah County Contract 4400003077
QTY UNIT
PRICE TOTAL
-
119,220
55,900
55,900
-
-
-
-
-
-
-
-
-
-
-
SUBTOTAL 231,020
PAYMENT DETAILS SHIPPING & HANDLING -
Voucher OTHER
G/L Account # TOTAL 231,020$
A/P Code #
Credit Card
Name
CC#
Exp.
Authorized by Date
[The P.O. number must appear on all related
correspondence, shipping papers, and
invoices]
7070-02100-7000-611008
201
DESCRIPTION
Origami Risk - See attached agreement & pricing terms
Year 1
Year 2
Year 3
Tom Mugleston1/1/2021
TermsF.O.B. Point Shipped VIA RequisitionerP.O. Date
N/A
N/A
N/A
N/AN/AN/A
Attachment 2, Page 1 of 1
Page i
DRAFT - STATEMENT OF WORK
This Statement of Work (“SOW”) describes services to be performed by Origami Risk LLC (“Origami”) for the City of
Springfield, OR (“Client”).
WHEREAS, Origami entered into an agreement to provide and implement a risk management information
system (RMIS), dated June 21, 2017 (the “Multnomah Contract”); and
WHEREAS, Origami and Client wish to enter into an agreement for Origami to provide Client with a risk
management information system (RMIS) as set forth in this SOW on the same terms and conditions as the Multnomah
Contract.
AGREEEMENT
Except as otherwise modified herein, Origami grants use of the RMIS system to the Client under the terms and conditions
of the Multnomah Contract, and Exhibits thereto, which are hereby incorporated by this reference herein.
MODIFICATIONS TO MULTNOMAH CONTRACT
1. Any reference to Multnomah Contract in the Multnomah Contract shall instead be deemed to refer to Client for
the purposes of this SOW. To the extent that this SOW conflicts with any provision of the Multnomah Contract,
the provisions of this SOW shall govern.
2. The parties agree that this SOW will apply to the services provided to the Client and Exhibits 3 and 4 of the
Multnomah Contract shall be replaced in their entirety by this SOW (including the Pricing Detail attached hereto
as Exhibit A).
This SOW shall become effective upon signature of both parties (the “Effective Date”). Unless earlier terminated or
extended, this SOW shall expire three years after the Effective Date. However, such expiration shall not extinguish or
prejudice either party’s right to enforce this SOW with respect to: (a) any breach of a warranty; or (b) any default or defec t
in performance that has not been cured. This SOW may be extended if Origami issues a quote to the Client to extend this
SOW and the Client issues a purchase order to extend the SOW. This SOW may continue to be extended thereafter using
the aforementioned process until either party elects not to extend the SOW.
PROJECT SCOPE
Provide and implement Origami’s Risk Management Information System (RMIS) (the “Service”) to help ensure accurate
and consistent tracking and reporting of Client’s claims, incidents, policies, locations and exposures.
Project Priorities: The immediate priorities focus on the following areas:
(i) Convert and load data from TPA
Origami will convert the Client’s TPA data and import into the Service. This process requires the receipt of
timely and accurate data from the TPA vendor and requires collaboration between Origami and Client to evaluate
and resolve data anomalies uncovered throughout the conversion process.
(ii) Incident Collection
Origami will work with Client to configure and deploy the standard incident collection features of the Service to
empower Client’s professionals at locations throughout the hierarchy to report incidents directly. Origami and
Client will collaborate on the layout of the question sets for each type of incident along with any workflows which
may be triggered by the creation or edit of such incident records.
(iii) Risk Collection & Scoring Workflows
Attachment 3, Page 1 of 13
Page ii
Origami will work with Client to configure and deploy the standard Risk Register Collection workflow features
along with Risk Assessment workflow features of the Service to empower Client’s professionals at locations
throughout the hierarchy to contribute in order to improve the efficiency and quality of Client’s risk identification
process. This standard functionality within the system includes the ability to assign responsible parties and
distribute emails with links instructing users in the field to fill in appropriate information.
CLIENT ROLES AND RESPONSIBILITIES
Client will identify a System Administrator (“Client SA”) who will be responsible for working with Origami to implement
the Service and to provide ongoing production support to Client’s Users. The Client SA and, from time to time, other
Client employees will be available to provide timely direction and feedback as needed by Origami to complete the
Origami tasks in this SOW. The Client SA will also be responsible for setting up, assigning security rights, and
maintaining user IDs for all Users.
Client will have final responsibility for decisions regarding the configurations or customizations (such as forms,
dashboards, interfaces, reports, workflows and data flows) created by or for Client or Client’s users in the Service. For all
such configurations and customizations, Client shall be responsible for quality assurance to ensure that such
configurations and customizations operate as intended (including functionality, usability and data access rights), and
Origami shall not be responsible for any damages caused by any such configurations or customizations.
LICENSES
Base Functionality
Functionality Selected Description
RMIS Yes Includes functionality related to risk management, including incidents, claims, insurance
policy management, locations, certificates of insurance, safety, and risk management portal.
Enterprise Risk Management
(ERM)
Yes Includes ERM functionality.
* Origami offers other base functionality (e.g., Claims Adjudication and Policy Underwriting and Issuance) not included under this SOW.
User Licenses
License Quantity Description
Claims Adjusting
User
0 These licenses have access to all the features and capabilities of the Service under the base functionality
selected above, including those features utilized for adjusting claims such as check writing, setting reserves
and calculating indemnity benefits. These licenses have access to Extended Functionality features to the
extent selected below.
Full User 5 These licenses have access to all the capabilities and features of the Service under the base functionality
selected above, except those features utilized for adjusting claims such as check writing, setting reserves and
calculating indemnity benefits. These licenses can track payments made by the Client. These licenses have
access to Extended Functionality features to the extent selected below.
Limited Access
User
7 These licenses have access to the dashboard, reports pre-configured for them, and limited access to ERM,
claims and incident areas of the Service under the selected base functionality. Limited Access Users do not
have access to Administration features or Extended Functionality features.
Non-Named-User Access Licenses
License Selected Quantity Description
Enterprise Wide
Record Entry
Yes Up to 1,000
records added per
year
These licenses are not named licenses and have access only to enter records either by
(1) an anonymous collection portal, by clicking an anonymous collection link
generated via Origami’s administration features (“Portal Data Entry”) or (2) granting
access to a URL sent from the Service as a Data Entry Event email notification,
giving time limited access to a single record (“Grant Access”).
Enterprise Values
Collection
No 0 Users These licenses allow representatives in the field to enter data through the Service’s
online platform pertaining to information necessary for renewal submissions, such as
TIV, Square Footage, COPE information, or other such asset and exposure data.
Attachment 3, Page 2 of 13
Page iii
Extended Functionality Licenses
License Selected Quantity Description
API Access No N/A This license provides access to Origami’s web service REST APIs using calls.
Includes access for up to 5,000 calls per day. API calls may be made concurrently,
subject to reasonable limitation when needed to preserve system performance.
Requires a minimum of five (5) Full Users and/or Claims Adjusting Users.
Secure Email No Up to 0 Secure
Emails sent per
month
This license provides secure email functionality, which provides password protected
hosting for email communications from and to the Service.
OCR Scanning No Not Included This license provides optical character recognition (OCR) functionality for mapping
specified data from scanned documents to data fields within the Service.
Certificate of
Insurance Tracking
No 0 Insureds over
initial 100
This license provides certificate of insurance tracking for third party insureds, such as
tenants, vendors, contractors or customers. The first 100 insureds are provided at no
additional cost, and this license provides the ability to track certificates for more than
100 insureds.
SMS Messaging No 0 SMS Messages
(over initial 500)
This license provides the ability to send SMS messages as workflow actions within
the Service’s administration features. The first 500 messages per year are provided
at no additional cost, and this license provides the ability to send more than 500
messages per year.
Two Factor
Authentication
No 0 2FA Messages
(over initial 500)
This license provides the ability to send SMS and/or email messages to users to
validate their identity before logging in from a new device and/or once every 30 days
from the same device. The first 500 messages per year are provided at no additional
cost, and this license provides the ability to send more than 500 messages per year.
Mobile Forms App Yes Not Included Origami’s Mobile Forms App may be used by any named user for no additional
license fee, but service hours are required for configuration.
Mobile Claimant
App
No Not Included Origami’s Mobile Claimant App may be used by any named user for no additional
license fee, but service hours are required for configuration. Requires a minimum of
three (3) Claims Adjusting Users.
Workers’
Compensation
Solutions*
No Jurisdictions: None This license includes the following Origami Compliance solutions (this functionality
is only available to Claims Adjusting Users):
• Automated EDI FROI/SROI State Reporting via Mitchell
• Indemnity Benefits Rates
• Workers’ Compensation State Forms
ODG Integration
User*
No 0 Users This license provides integration with ODG’s Return to Work guidelines. Only
Claims Adjusting Users and Full Users may utilize this feature. This feature queries
ODG’s RTW and treatment guidelines based on WC claim diagnosis codes.
Tableau* No 0 Users This license allows Origami users to access Tableau within the Origami environment,
providing enhanced data visualization.
eSignature
Integration*
No 0 Envelopes This license provides the ability to tag mail merge documents with electronic
signature fields, authenticating through a third-party eSignature tool.
* By purchasing this license, Client will need to agree to certain vendor terms and conditions to be provided by Origami.
License Notes:
1. Origami adds generally available features from time to time that may require configuration prior to use. If Client
requests Origami’s assistance in this configuration, Professional Services hours may be applied for any such
configuration.
2. In addition to the generally available features, Origami may occasionally deploy new functionality that will require
an Extended Functionality License similar to those listed in the Extended Functionality License section above. These
features may require additional fees based on record volume, number of additional users accessing the new features,
or some other incremental cost driver. Client may agree to add such an Extended Functionality License in a separate
Statement of Work.
Attachment 3, Page 3 of 13
Page iv
HOSTING
Origami will provide data hosting for up to 5,000 claims and incidents. In addition, Origami will provide 50GB of
searchable file attachment hosting. Additional hosting is available at any time during the term of this SOW as set forth in
the Pricing section below.
Origami will host the application and data in a secure internet accessible environment. Origami will backup Client data at
periodic intervals each day.
IMPLEMENTATION PROCESS
Implementation is the process of configuring the Service for use by Client including system settings, supporting Client in
loading data, training users, and other work identified in this section of the SOW. The implementation phase is completed
when Client is able to utilize the Service platform for the purposes described in the Project Scope above, referred to by
Origami as being Live in the system. Origami will manage the overall implementation process, including scheduling and
leading meetings, communicating with the team, follow up documentation, and maintaining the project schedule through
the Go-Live date. Upon Go-Live, Origami will move Client from its staging environment to its live production
environment, and continued use of Origami’s staging environment after Go-Live will incur additional hosting fees.
Client’s provision of timely and accurate specifications, direction and feedback is essential to the implementation.
Origami provides implementation for a fixed price based on reasonable estimates from Client and Client’s continued and
uninterrupted effort toward Go-Live. Both parties understand that time is of the essence with regard to the
implementation and agree to use reasonable and good faith efforts to promptly complete the implementation. If necessary,
Client will be allowed up to one implementation “pause” not to exceed 30 days. Any additional pauses in implementation
or failures to meet the obligations above will result in the conversion of the implementation to a time and expense
engagement, effective upon email notice from Origami to Client and billed monthly as incurred at Origami’s bundled
hourly rate set forth below after crediting Client for any remaining unused portion of the fixed price. Origami may pause
and reallocate its resources as reasonable in the event of significant delays.
System Configuration
Origami will:
• Configure Claim and Incident (with mobile) forms for Workers Compensation, Property, Auto Liability, General
Liability, and APD.
• Configure 1 Location form layout
• Configure up to 1 Contact form layout
• Deploy standard 1 Policy form layout
• Configure up to 4 User Security Profiles. Client will be trained to create additional security profiles if needed.
• Configure CMS-111 Monthly and Quarterly Interfaces for 1 RRE ID.
• Up to 5 workflows setup by Origami and training provided on how client can create more workflows.
• Up to 5 Mail Merge Templates and training provided on how client can create more.
• Up to 12 hours to configure default dashboards using standard Origami dashboard widgets. Client will be trained
on adding/updating dashboards.
• Up to 20 hours to configure reports using standard Origami RMIS templates and/or the custom template design
tool. Client will be trained on adding/updating reports.
o Including OSHA 300 and 300A Forms
• Up to 20 hours to configure site quarterly inspection, root cause analysis form, and corrective action form.
• Up to 40 hours to configure allocation process.
• Up to 40 hours for configure ERM
o Configure 1 Objectives form
o Configure 1 Risks form and workflows
o Configure 1 Controls form and workflows
o Configure 1 Governance form
o Configure 1 Indicators form
Attachment 3, Page 4 of 13
Page v
o Configure 1 Action Plans form and workflows
o Configure up to (2) Factors, (1) Methodologies, and (1) Lens
Client will:
• Provide specifications, direction, and feedback as needed by Origami in a timely manner.
• Configure additional default dashboards, fields, forms, user roles, distribution lists, reports and other features as
needed by Client.
Convert Legacy System: None
Loading Other Supported Risk Data via Data Import Center
Origami will:
• Provide training and support to Client on the Data Import Center
Client will:
• Provide, or arrange to provide, spreadsheets containing Client’s risk data in the format supported by the Service’s
Data Import Center.
• Utilize the Service’s standard Data Import Center tools to import the above risk data.
Loading Carrier / TPA Claims Data for Data Processing
Origami will:
• Provide Client with text for data request letters suitable for requesting necessary data from each of the sources
named below.
• Convert and load the initial system data from the sources named below
Client will:
• Arrange for claims and one-time transactions data to be sent to Origami from Risk Pool Claims System (CIS)
• Arrange for claims and one-time transactions data to be sent to Origami from SAIF
Configuring Automated Interfaces, Imports & Extracts To / From 3rd Party Systems
Origami will:
• Implement import routines and schedules required to accommodate imports listed below.
• Implement export routines and schedules required to accommodate exports listed below.
Client will:
• Arrange for data to be delivered in the agreed upon format, on the agreed upon schedule from PeopleSoft (HR
Data).
• Coordinate any action required by CIS (Risk Pool) to receive and utilize data feeds coming from Origami in the
agreed upon format, on the agreed upon schedule.
Configuration of Incident Intake Process
Origami will:
• Configure the Enterprise Portal Data Entry Screens to accurately mirror Client’s existing process.
• Build the workflow in the Service for proper email notification, mail merge document distribution and task
creation according to Client’s business rules.
Client will:
• Provide screen shots of existing intake forms currently in use.
Attachment 3, Page 5 of 13
Page vi
• Work with Origami to identify opportunities to improve on current intake forms and process.
• Specify the workflows and individuals required for event triggered emails, tasks and mail merge
Configuration of Allocations
Origami will:
• Configure a list of cost elements within the system utilizing standard tools and the information provided by Client
below.
• Build formulas within the standard Allocation tools utilizing the information provided by Client below.
Client will:
• Provide a list of cost elements to be allocated.
• For each cost element above, provide documented explanation of the formula for allocation
Training
Origami will:
• Provide 12 hours of training to Client in year 1 of this SOW and provide additional training each subsequent year
as needed. Professional Service hours will be eroded for training in future years. Training will be provided at
Client offices or online at Client’s request. Training can be provided in one session or several on mutual
agreement between Client and Origami. Travel & Expenses associated with any on-site training will be pre-
approved by Client and billed as incurred.
Client will:
• Provide Origami with guidance about the employees to be trained and any training requirements or a preferred
approach.
• If training is to be provided in Client office, provide appropriate meeting space and internet access so Origami can
perform the training and also provide for transportation and other expenses for Client employees who attend the
training.
PROJECT MANAGEMENT OPTION SELECTED:
Origami is founded on a set of ITERATIVE processes from top to bottom. These contemporary tenets are the foundation
of Origami’s ability to deliver better service and faster and more accurate implementations. Origami also maintains a set
of best practices, tools and experts for our clients who require a more TRADITIONAL approach to managing their
implementation project. The selection below indicates the project management model included within this SOW:
This SOW includes:
Included Iterative Project Management
Not Included Traditional Project Management
Iterative Project Management - Included
Origami will:
o Schedule and lead initial kickoff call or meeting
o Maintain schedule with key deliverables and expected dates
o Lead status calls twice per month
o Maintain project status document containing priority list, open items and changes which may impact timeline
o Coordinate all activity within Origami to complete Origami’s tasks on the project schedule and assign project
management as shared role of team members
o The Service’s administrative tools and screens serve as documentation of the implementation for Client’s System
Administrator to reference.
o UAT test plan for critical items (dependent on Client input and test cases provided)
Client will:
o Participate in status calls and working meetings
Attachment 3, Page 6 of 13
Page vii
o Coordinate all activity within Client’s organization to complete Client’s tasks on the project schedule
o Coordinate all activity of Client’s 3rd party providers required to complete tasks on the project schedule
Traditional Project Management – Not Included
If included, in addition to the responsibilities listed in Iterative Project Management above, Origami will designate a
Project Manager to provide a specified number of hours of project management during the Implementation. This Project
Manager will (1) manage the Origami tasks listed in Iterative Project Management above, (2) coordinate meetings and
discussions with stakeholders as needed to maintain project progress, and (3) maintain a library of written artifacts and
documentation including:
o Formal project kickoff agenda
o Communication plan
o Formal stakeholder analysis
o Project charter
o Collaboration website
o Detailed work breakdown structure
o Weekly project status calls, agenda, meeting notes
o Detailed issues and risks log
o Action items list
o Detailed project plan
o On site agendas
o Change control management
o Executive steering committee status call agenda (as
needed)
o Origami governance decision management document
o Executive project dashboard
o Lessons learned analysis
ONGOING SUPPORT
After the Implementation is completed or Client is using the Service in production for greater than 30 days, this section of
the SOW describes Origami services through the remainder of the term of this SOW. If the parties agree that certain parts
of the Service will go Live before others, this section will apply to each part upon going Live.
Carrier / TPA Claims Data Ongoing Processing
Origami will:
Process the claim data updates received from Client data providers as follows:
• CIS (Risk Pool): Claims and Snapshot Financial Transactions, Monthly
• SAIF: Claims and Snapshot Financial Transactions, Monthly
Client will:
• Use tools in the Service to resolve exceptions, if any, such as missing locations, incomplete code maps, and other
exceptions, which may occur in the update as a result of data errors or missing data from data providers.
• Notify Carrier / TPA of data exceptions when appropriate to have data corrected at source.
Maintenance of Automated Interfaces, Imports & Extracts To / From 3rd Party Systems
Origami will:
• Maintain import routines and schedules required to accommodate imports from third party systems listed below:
▪ PeopleSoft (HR Interface)
▪ CMS-111 Quarterly and Monthly Imports
• Maintain export routines and schedules required to accommodate exports to third party systems listed below:
▪ CMS-111 Quarterly and Monthly Exports
▪ CIS (Risk Pool) Incident Export
Client will:
• Ensure the ongoing performance of import and export responsibilities of each 3rd party system.
Professional Services
Attachment 3, Page 7 of 13
Page viii
This SOW includes up to 40 hours of Professional Services in the first year, up to 30 hours in the second year, and up to
30 hours in the third year. Professional Services include any work performed by Origami professionals on behalf of
Client. Examples include:
• Helpdesk support for users
• Additional user training
• General assistance utilizing the Service
• Configuration of features for Client’s use
• Maintenance of screens and system configurations as workflows evolve
• Configuration of customized reports
• Maintenance or modification of any import or export scripts
• Attendance in meetings
• Project management tasks and administration
PRICING AND INVOICE SCHEDULE
The price for the licenses and services listed above in this SOW is $130,720 for the first year, $55,900 for year two, and
$55,900 for year three of this SOW. Exhibit B provides a detailed breakdown of the components of the price.
As an accommodation to the Client, Origami is providing a discount on the implementation fees of $11,500 in year 1
bringing the amount for year one to $119,220.
Payment for Year 1 will be invoiced and due upon execution of this SOW. Payments for Year 2 and 3 are due annually
upfront on the anniversary date of this SOW.
If needed, additional services can be purchased through an addendum to this SOW. All fees are subject to state sales tax,
where applicable. All travel costs and expenses will be pre-approved by Client in writing and billed to Client as incurred.
ADDITIONAL PRICING:
1. If Client requires additional hosting during the term of this SOW, additional hosting fees will apply as follows:
- Current annual fee for hosting of up to 5,000 Claims / Incidents = $7,500
- Annual fee for hosting of 5,001-10,000 Claims / Incidents = $10,000
- Current annual hosting fee includes 50GB of searchable File Attachment hosting
- Additional searchable File Attachment hosting is $2,500 per 50GB per year
- Additional non-searchable File Attachment hosting is $1,000 per 100GB per year
2. Additional Professional Service hours will be invoiced as incurred at Origami’s unbundled rate listed within Exhibit B.
Bundled hours (minimum of 10) may be added prior to the start of each contract year at Origami’s bundled rate listed
within Exhibit B.
3. Additional users, additional licenses or additional use beyond that which is listed above in the Licenses section of this
SOW shall require additional fees. Origami shall invoice Client, and Client shall pay for any additional licenses, hosting,
service hours or other usage in excess of what is specified in this SOW.
STATEMENT OF WORK APPROVAL
The undersigned agree to this Statement of Work.
ORIGAMI RISK LLC CITY OF SPRINGFIELD, OR
Attachment 3, Page 8 of 13
Page ix
By: __________________________________ By: __________________________________
Name: _______________________________ Name: _______________________________
(Print Name) (Print Name)
Title: ________________________________
Date: ________________________________
Title: _________________________________
Date: ________________________________
Attachment 3, Page 9 of 13
Page x
EXHIBIT B
PRICING DETAIL
Year 1 Year 2 Year 3 Comments
Licensing
RMIS Software License $10,000 $10,000 $10,000 Annual RMIS and ERM Licenses
Ongoing future releases are included in the license fees
Hosting, Network,
Storage, and IT
Operations
$7,500 $7,500 $7,500 Up to 5,000 claim and incident records
Includes 50 GB of file Searchable Storage
User Licensing $12,100 $12,100 $12,100 • 5 Full Users with Admin Access for No Additional Charge
• 7 Limited Access Users without Admin Access
Enterprise Portal Entry $5,000 $5,000 $5,000 License for 1,000 Records for Enterprise wide users (Portal
or Grant Access) including:
• Incident Entry
• Corrective Actions
• Risk Updates/Entry (ERM)
Data Services
Data Integrations $18,000 $15,000 $15,000 Data Interfaces
• Monthly – Risk Pool Claims Summary Data and
Snapshot Transaction (CIS)
• Monthly – SAIF Claims Summary Data and Snapshot
Transactions
• Daily HR Employee Details Interface (PeopleSoft)
• CMS-111 Monthly and Quarterly Interface for 1 RRE
ID
• Extract City County Insurance Services (CIS) of
Incidents.
Professional Services
Implementation Fee $69,7200 $0 $0 332 hours - See above for deliverables
• 40 hours for ERM configuration
• 32 hours for report and dashboard setup (including
OSHA 300 and 300a forms).
• 16 hours for training and documentation
• 30 hours for cost of risk allocation
• 20 hours for setup of quarterly inspection, root cause
analysis & corrective action forms
• 50 hours from project management
• Remaining hours are for general setup: hierarchy,
screens, workflows, security, branding, etc.
Ongoing Support $8,400 $6,300 $6,300 40 Annual Support Hours in Year 1 and 30 Annual Support
Hours in Years 2 and 3
• Helpdesk support for users / Additional user training /
Attendance in meetings
• General assistance utilizing the system
• Configuration of features and customized reports for
Client’s use
• Maintenance of screens and system configurations as
workflows evolve
• Maintenance or modification of any import or export
scripts
Year 1 Discount ($11,500) Discount is based on total services and may be modified
based on increase or decrease of these services.
Total $119,220 $55,900 $55,900
Attachment 3, Page 10 of 13
Page xi
EXHIBIT C
SERVICE LEVEL AGREEMENT (SLA)
SYSTEM AVAILABILITY
Origami Risk will be available 99.5% of the time, excluding unavailability as a result of any Excluded Event (the
“Availability Requirement”). This includes holidays, weekends, and non-business hours. It does not include planned
downtime. In normal circumstances, Origami Risk will schedule downtime between 8:00 PM CT and 7:00 AM CT.
Origami Risk will post system availability statistics quarterly.
“Excluded Event” means (i) scheduled maintenance windows of which Client is notified at least 24 hours in advance and
which occur outside of normal business hours; (ii) scheduled repairs of not more than two hours duration in any one week
period of which Client is notified at least four hours in advance and which occur outside of normal business hours; (iii)
critical repairs including security updates where advance notice cannot be reasonably provided; (iv) interruptions caused
by transmission errors, Internet service providers, vandalism, user error or other factors beyond Origami’s or its direct
service providers’ reasonable control; or (v) interruptions caused by any act or omission of Client (including any
employee, contractor, agent, customer, investor, consultant or third party user of Client or any of Client’s affiliates who
uses or accesses the service), including any failure or delay in the performance of its obl igations or failure of Client’s
equipment or non-Origami software. The Availability Requirement applies only to Origami’s production environment
and not to Origami’s staging environment.
Service Credits:
In the event there is a material failure of Origami’s service to meet the Availability Requirement (a “Service Level
Failure”) in any calendar month, then Client shall have the following sole and exclusive remedy: Origami will
provide Client with a service credit on the next annual invoice equal to the pro-rated charges for one (1) full day
of the affected services (i.e., 1/30 of the monthly fee, assuming a thirty (30) day month) for each day during
which there was a Service Level Failure in such calendar month (a “Service Credit”). For clarity, such Service
Credit shall not include credit for hosting fees, data processing fees, professional services fees or any other
prepaid bundled fees other than licensing fees.
If Client believes that it is entitled to receive Service Credits, Client shall notify Origami in writing within seven
business days after the applicable calendar month with a description of the Service Level Failure and the date and
time of such Service Level Failure. If Client does not notify Origami within such timeframe, then Client shall be
deemed to have waived all claims with respect to such Service Level Failure (but not to any future Service Level
Failure). Origami will make all determinations regarding Service Credits in its reasonable discretion.
For any given month, Client shall in no event be entitled to receive a Service Credit that exceeds 100% of its
monthly license fees for such month. Client agrees that Service Credits are the sole and exclusive remedy for any
Service Level Failure.
BACKUP AND RECOVERY
Origami currently backs up transactions every 15 minutes via incremental backups. A differential database backup is
performed nightly and a full backup is performed weekly. Backups are stored off site via Amazon S3, which has multiple
redundancy and 99.999999999% durability and 99.99% availability of objects over a given year. Periodic database
restore tests are performed to validate that backups are valid. Origami retains weekly backups for a minimum of six
months.
NOTICES
Two email subscription options are available to each Origami Risk user. These determine the type of communication that
they will receive from Origami Risk.
• Emergency: Receive emails concerning outages and other system problems
Attachment 3, Page 11 of 13
Page xii
• Maintenance: Receive emails concerning scheduled maintenance on the system.
In addition, any Origami Risk user can visit http://status.origamirisk.com/ to view the current system status.
SERVICE REQUESTS
Origami Risk will respond to service related incidents or issues within the following time frames:
Urgent Requests
An urgent request for service concerns a new development that significantly affects a major business task with no
workaround. Client will request urgent support by sending an email to support@origamirisk.com with the word “Urgent”
in the subject line. An urgent request made between 7:00 AM CT and 8:00 PM CT will typically be responded to
immediately, and Client may also call any member of the Origami Risk support team directly. If Client does not receive a
prompt response, Client may escalate by contacting any Origami Risk service or support employee or manager via contact
information provided to Client. The target resolution time for an urgent issue is as soon as possible.
Normal Requests
A normal request for service is any service request that is not urgent. A normal service request will typically be
responded to within one business day. Client will request support by sending an email to support@origamirisk.com.
Client may also call or email any member of the Origami Risk support team directly.
SECURITY
Any access to Origami Risk requires a unique user id and password. Passwords must adhere to standard password
security rules including minimum length and complexity. Origami Risk uses a role-based security model. Client is
responsible for assigning and maintaining role, location, and coverage security for users. Client’s system administrators
can use the tools in Origami Risk to review and change security rights, edit the user profile, and reset the password. User
passwords are encrypted in the Origami database using a SHA-256 hash algorithm.
System locks out user after five login attempts with an incorrect password. An administrative user must then reset the
user’s password and unlock the user account.
Origami Risk uses TLS v1.2 or higher for all communications over https. Origami databases are fully encrypted using
256-bit AES encryption.
Claim, Transaction, and Notes data sent to the Origami Risk SFTP site must be encrypted using at least 128 bits. Origami
uses Open PGP for file encryption and can provide an encryption key to be used by the client. Origami Risk will keep the
files on a secured files system in encrypted format except during the import process. When the import process is
completed, unencrypted files are removed from the system.
Attachment 3, Page 12 of 13
Page xiii
EXHIBIT D
MULTNOMAH COUNTY CONTRACT
Attachment 3, Page 13 of 13
REQUEST FOR PROPOSALS
RFP No: 4000004822
RFP Title: Risk Management Information System
Issue Date: July 1, 2016 Proposals Due: August 5, 2016
Not Later Than 4:00 PM
LATE PROPOSALS SHALL NOT BE
CONSIDERED
Refer Questions to:
Patricia Bride
Phone: (503) 988-7541
Email: Patricia.Bride@multco.us
Submit Proposals to:
Multnomah County Purchasing
501 SE Hawthorne Blvd, Suite 125
Portland, OR 97214
Pre-Proposal Conference: There will not be a pre-proposal conference for this Solicitation.
This RFP is issued under the provisions of the Oregon Revised Statutes Chapters 279A, 279B, and
Multnomah County PCRB public contracting rules. All proposers are charged with presumptive
knowledge of the cited authorities. Submission of a valid proposal by any proposer shall constitute
admission of such knowledge on the part of such proposer.
PROPOSERS ARE STRONGLY ENCOURAGED TO CAREFULLY READ THE ENTIRE
SOLICITATION.
Electronic copies of this RFP and attachments, if any, can be obtained from the Multnomah
County Purchasing Website at: http://www.multcopurch.org.
All Proposal documents shall be submitted in hard copy. Electronic or facsimile submissions
shall be rejected.
Attachment 4, Page 1 of 27
TABLE OF CONTENTS
PART TITLE PAGE #
PART 1 Procedural Information
Section 1.0 RFP Organization 4
Section 1.1 Procurement Timetable 4
Section 1.2 Pre-proposal Conference 4
Section 1.3 Protests 4
Section 1.4 Realistic Proposals 5
Section 1.5 Clarification of Responses 5
Section 1.6 Rejection of Proposals 5
Section 1.7 Cost of Preparation of Response 6
Section 1.8 Confidentiality 6
Section 1.9 References 6
Section 1.10 Publicity 6
Section 1.11 Cancellation 6
Section 1.12 Disputes 6
Section 1.13 Collusion 6
Section 1.14 Certification Regarding Conflict of Interest 6
Section 1.15 Local Purchasing Preference 7
Section 1.16 Sustainable Purchasing 7
Section 1.17 EEO Certification Requirement 7
Section 1.18 Invoices 7
Section 1.19 Payment 8
Section 1.20 Pre-award Risk Assessment 8
PART 2 Service Description, Funding and Contracting Information
Section 2.0 Purpose and Overview 8
Section 2.1 Introduction and Program History 8
Section 2.2 Goals, Values and Other Important Considerations 9
Section 2.3 Funding 9
Section 2.4 Scope of Services 9
Section 2.5 Contract Negotiation 9
Section 2.6 Contract Award 9
Section 2.7 Contract Term 9
Section 2.8 Compensation and Method of Payment 9
Section 2.9 Cooperative Purchasing 10
Section 2.10 Insurance Requirements 10
PART 3 Proposal Evaluation, Questions and Instructions
Section 3.0 Proposal Evaluation Criteria and Scoring 10
Section 3.1 Proposal Questions Instructions 11
Attachment 4, Page 2 of 27
Section 3.2 Proposal Questions – General Vendor Information 11
Section 3.3 Proposal Questions – System Functionality 12
Section 3.4 Proposal Questions – Responsible Business Practices 15
PART 4 Proposal Submission Instructions
Section 4.0 Joint Proposals 16
Section 4.1 Multiple or Alternate Proposals 16
Section 4.2 Proposal Instructions and Content 17
Section 4.3 Maximum Page Limit 17
Section 4.4 Proposal Content 17
Section 4.5 Proposal Binding 17
Section 4.6 Proposal Packaging 17
Section 4.7 Proposal Copies and Submission 17
Section 4.8 Minimum Requirements 17
Section 4.9 Proposer Checklist and Submittals 17
PART 5 Attachments and Electronic References
Attachment 1 Proposer Representations and Certifications 19
Attachment 2 Sample County Contract 21
Attachment 4, Page 3 of 27
PART 1 – PROCEDURAL INFORMATION
1.0 RFP ORGANIZATION
This RFP is organized into five parts:
Part 1, Procedural Information: Provides an overview of the procurement process and conditions.
Part 2, Service Description, Funding, and Contracting Information: Provides a general description of the
services to be performed; delineates responsibilities; defines deliverables (as applicable), funding and
contracting terms.
Part 3, Proposal Questions and Evaluation Criteria: Describes questions to be answered and how
proposals will be evaluated by the County.
Part 4, Proposal Submission Instructions: Describes the required format, instructions for submitting
proposals, and minimum requirements.
Part 5, Attachments and Electronic References: Provides additional information and forms necessary to
complete the proposal submission.
1.1 PROCUREMENT TIMETABLE
Activity Section Scheduled Date/Time
Date Issued Cover page July 1, 2016
Questions or protests of
specifications due to Purchasing in
writing
1.3.1 July 15, 2016
Purchasing response to written
questions
1.3.1 July 21, 2016
Proposal submittal deadline Cover page August 5, 2016
Proposal evaluation period August 11 – August 19, 2016
Proposed oral evaluation period Week of September 6, 2016
Provider selection September 12, 2016
Contract start date To be negotiated
Multnomah County reserves the right to deviate from this schedule.
1.2 PRE-PROPOSAL CONFERENCE
No pre-proposal conference is scheduled for this solicitation.
1.3 PROTESTS
1.3.1 Protest of Specifications
Any Proposer requiring clarification of the provisions of this RFP must submit specific questions in writing to
the County Procurement Analyst listed on the cover page of this RFP. Any Proposer protesting any provision
in this RFP must submit protest(s) in writing to the County’s assigned Procurement Analyst listed on the
cover page of this RFP. Any protest must address the requirement, provision or feature of this RFP or its
attachments, including but not limited to the contract, that the potential Proposer believes is ambiguous,
unclear, unfair, contrary to law or likely to limit competition. The purpose of this deadline is to allow the
County time to correct any term or condition in this RFP and/or contract that may be unlawful, improvident,
unduly restrictive of competition, or otherwise inappropriate. By allowing corrections before opening
Proposals, the County intends to avoid or minimize much of the waste inherent in protests and in the possible
rejection of all Proposals. Failure of a Proposer to protest in accordance with this section shall be deemed
acceptance of the terms of this RFP and contract, and a waiver of Proposer’s rights to later contend that
either the RFP or contract is ambiguous, unclear, unfair, contrary to law or likely to limit competition.
The deadline for submitting questions or protests is 4:00 P.M. on the date listed in the timeline. If Multnomah
County determines that additional information or clarification is necessary, such information or clarification will
be supplied in addenda that will be sent by e-mail or mail to all persons or firms that have received the
Attachment 4, Page 4 of 27
notification of solicitation from Purchasing, registered on the Purchasing website for this solicitation, or who
signed-in at the pre-proposal conference (if held). Available addenda may also be downloaded from the
Purchasing website www.multcopurch.org. All such addenda shall have the same binding effect as though
contained in the main body of the Request for Proposals. Oral instructions or oral information concerning the
specifications from County managers, employees or agents to prospective Proposers shall not bind
Multnomah County.
Addenda:
The County Purchasing Manager shall issue any addendum no later than five (5) calendar days prior to the
closing date. After closing date, any claims or misunderstanding in regard to the nature, quality or description
of the service(s) or item(s) to be supplied by this RFP will be considered waived.
After closing, Multnomah County reserves the right to issue Addenda to all Proposers who submitted
proposals, or to those Proposers determined to be in the Competitive Range, if applicable, in order to
communicate program requirements and arrangements and other information as determined necessary by
the County.
1.3.2 Protests of Intent to Award
The following procedure applies to Proposers who wish to protest a disqualification of proposal or award of
contract:
1. All protests must be in writing and physically received by the Purchasing Manager no later than 4:00
P.M. on the fifth (5th) working day after the postmarked notice of intent to award or disqualification.
Address protests to:
PROTEST OF AWARD OR DISQUALIFICATION TO RFP NO. 4000004822
ATTN: Purchasing Manager
Multnomah County Purchasing
501 SE Hawthorne Blvd Suite 125
Portland OR 97214
2. Proposers may protest only deviations from laws, rules, regulations, or procedures. Protests must
specify the grounds for the protest including the specific citation of law, rule, regulation, or procedure
upon which the protest is based. The judgment used in scoring by individual evaluators is not grounds
for protest. Disagreement with the judgment of evaluators may not be protested.
Protests not filed within the time specified in paragraph 1, above, or which fail to cite the specific law,
rule, regulation, or procedure upon which the protest is based shall be dismissed.
1.4 REALISTIC PROPOSALS
It is the expectation of the County that proposers can fully satisfy the obligations of the proposal in the
manner and timeframe defined within the proposal. Proposals must be realistic and must represent the best
estimate of time, materials and other costs including the impact of inflation and any economic or other factors
that are reasonably predictable.
Multnomah County shall bear no responsibility or increased obligation for a Proposer’s failure to accurately
estimate the costs or resources required to meet the obligations defined in the proposal.
1.5 CLARIFICATION OF RESPONSES
Multnomah County reserves the right to request clarification of any item in a Proposer's proposal or to
request additional information prior to evaluation necessary to properly evaluate a particular proposal. All
requests for clarification and responses shall be in writing and issued through the assigned Procurement
Analyst from Purchasing. Except for requests and responses related to a clarification necessary to evaluate
whether a proposal has met minimum requirements, all requests for clarification and responses shall be
provided to each evaluator.
1.6 REJECTION OF PROPOSALS
Multnomah County reserves all rights regarding this solicitation, including but not limited to the right to:
Attachment 4, Page 5 of 27
1. Cancel this solicitation at any time and not award a contract;
2. Award a contract in part;
3. Reject any and all proposals in whole or in part; and
4. To waive technical defects, minor irregularities and omissions if, in its judgment, the best interests of
the County will be served.
1.7 COST OF PREPARATION OF RESPONSE
Costs incurred by any Proposer in preparation of a response to this Request for Proposal shall be the
responsibility of the Proposer.
1.8 CONFIDENTIALITY
Multnomah County is required to disclose non-exempt public documents pursuant to ORS 192.410-192.505.
ORS 192.502(4) exempts the County from disclosing information submitted in response to a solicitation
where the information is such that it “should reasonably be considered confidential.”
A Proposer who determines that information within a proposal meets the statutory requirement and desires
that such information remain confidential shall mark the bottom of the pages containing such information with
the word “CONFIDENTIAL.”
If a Proposer marks every page of a proposal as “CONFIDENTIAL”, the statutory requirement is not met; any
proposal so marked will not be deemed to have been submitted in confidence, and upon request, the entire
proposal will be disclosed.
The County will keep properly marked information confidential unless ordered to release the information and
materials by the District Attorney pursuant to ORS 192.460.
After award, the contract executed by the County and the successful Proposer will be a public document
subject to disclosure. No part of the contract can be designated as confidential.
1.9 REFERENCES
The County reserves the right to investigate references including customers other than those listed in the
Proposer’s submission. Investigation may include past performance of any Proposer with respect to its
successful performance of similar projects, compliance with specifications and contractual obligations, its
completion or delivery of a project on schedule, and its lawful payment to employees and workers or any
other criteria as determined by Multnomah County.
1.10 PUBLICITY
Any publicity giving reference to this project, whether in the form of press releases, brochures, photographic
coverage, or verbal announcement, shall be done only after prior written approval of Multnomah County
Purchasing and the Public Affairs Office.
1.11 CANCELLATION
Multnomah County reserves the right to cancel this solicitation any time before execution of a resulting
contract by both parties if cancellation is deemed to be in Multnomah County's best interest. In no event shall
Multnomah County have any liability for the cancellation of this solicitation.
1.12 DISPUTES
In case of any doubt or differences of opinions regarding the items or service to be furnished hereunder, or
the interpretation of the provisions of the RFP, the decision of Multnomah County shall be final and binding
upon all parties.
1.13 COLLUSION
A Proposer, submitting a proposal hereby certifies that no officer, agent, or employee of Multnomah County
has a financial interest in this proposal; that the proposal is made in good faith without fraud, collusion, or
connection of any kind with any other Proposer and that the Proposer is competing solely on its own behalf
without connection or obligation to any undisclosed person or firm.
1.14 CERTIFICATION REGARDING CONFLICT OF INTEREST
Proposers are required to certify (in the Proposer Representations and Certifications Attachment) whether the
Proposer is or is not aware of any potential organizational conflict of interest (COI). If the Proposer is aware
Attachment 4, Page 6 of 27
of a conflict, then Proposer is required to provide a disclosure statement in its proposal describing all relevant
information concerning any past, present, or planned interests bearing on whether it (including its chief
executives and any directors, or any proposed consultant or subcontractors) may have a potential
organizational conflict of interest. Proposers responding to this solicitation are required to disclose any such
business or financial relationships. The disclosure statement must identify and address any actual or potential
organizational COI within the Proposer’s entire organization, including parent company, sister companies,
affiliates, and subsidiaries. In addition to identifying potential organizational COI, the disclosure statement
shall describe how any such conflict can be avoided, neutralized, or mitigated. Also, all contractors shall
disclose any actual or potential COI. The County Attorney will determine a proposer’s eligibility for award
based on the information provided in the disclosure statement.
1.15 LOCAL PURCHASING PREFERENCE
Multnomah County desires to employ local businesses in the purchase or lease of any personal property,
public improvements or services to support the local economy in the State of Oregon so that residents benefit
from local employment opportunities that are generated. Therefore, Multnomah County shall prefer goods or
services that have been manufactured or produced by an Oregon business if price, fitness, availability, and
quality are otherwise identical.
1.16 SUSTAINABLE PURCHASING
In 2010, Multnomah County initiated a new Sustainable Purchasing and Social Equity Policy that
demonstrates support for our sustainability goals by integrating environmental stewardship and social equity,
as well as fiscal responsibility, into the procurement process. The County seeks to partner with suppliers who
demonstrate a commitment to these considerations. Examples of such practices include but are not limited
to: resource conservation, waste reduction, minimized paper use, and use of alternative transportation
methods among other sustainable best practices.
The County recognizes that suppliers can take multiple paths, ranging from simple to complex, to help
support these goals. The list below is meant to guide Proposers as they describe their sustainable practices
within their RFP responses.
1. Comprehensive energy conservation measures;
2. Renewable energy use;
3. Water conservation measures;
4. Waste management and reduction plans;
5. Alternative fuels and transportation plans;
6. Sustainable purchasing;
7. Supplier diversity;
8. Fair trade and labor policies; and
9. Community engagement and support for underserved populations.
1.17 EEO CERTIFICATION REQUIREMENT
Contracts in excess of $75,000 which originate from this RFP are subject to the County’s Equal Employment
Opportunity (EEO) requirements, as outlined in PCRB 60-0040 and the sample Multnomah County contract
attached to this RFP.
1.18 INVOICES
All invoices shall be prepared on contractor's letterhead or standard invoice form and shall include:
1. Contractor's name and address and a phone number for questions about the invoice;
2. Contractor's invoice number;
3. Invoice date;
4. Multnomah County contract number; and,
5. Any additional information required in Exhibit 1 of the finalized contract.
Attachment 4, Page 7 of 27
1.19 PAYMENT
It is the County’s Policy to make recurrent contract payments to contractors via electronic payment. The
contractor(s) selected under this solicitation will accept electronic payment from the County and comply with
County’s procedure for electronic payment.
County shall pay the invoice within 30 calendar days unless otherwise provided in Exhibit 1 of the finalized
contract.
1.20 PRE-AWARD RISK ASSESSMENT
Successful proposers whose contract award includes federal funding (as identified by a Catalog of Federal
Domestic Assistance number) will be subject to a Pre-Award Risk Assessment (which includes an evaluation
of financial stability, quality of financial /management systems, experience with federal funds, reports and
findings from audits) completed by Multnomah County (if one has not been submitted in the last year) prior to
the issuance of a contract. Contractors who fail to submit the required documents will not be eligible for a
contract from the County.
PART 2 – SERVICE DESCRIPTION, FUNDING AND CONTRACTING INFORMATION
2.0 PURPOSE AND OVERVIEW
The Multnomah County Department of Risk Management is seeking Proposers from whom it may purchase a
Risk Management Information System (RMIS). Services are intended to assist County staff in tracking,
reporting, and analyzing risks and incidents for the County.
The County is primarily interested in Software as a Service (SaaS) or a hosted solution, but would be open to
hosting a solution if it is materially beneficial to the County.
2.1 INTRODUCTION AND PROGRAM HISTORY
The Finance & Risk Management division of the Multnomah County Department of Community Management
is seeking proposers from whom it can purchase a hosted or Software-as-a-Service (SaaS) Risk
Management software solution to replace its existing solution (a blend of COTS and homegrown software).
Multnomah County has approximately 766,000 residents and is the most populous of Oregon’s 36 counties.
It includes the cities of Portland, Fairview, Gresham, Maywood Park, Troutdale and Wood Village. It is also
the smallest county in Oregon at 456 square miles. The county has about 5,600 employees and provides
services for seniors and disabled people, animal services, assessment and taxation, bridges, community
justice, courts, elections, health, jails, libraries, marriage licenses and passports, school and community
partnerships. Additional information about the County is available on our website: http://www.multco.us.
Risk Management is assigned Multnomah County’s responsibilities of guiding the organization through loss
prevention and loss control initiatives, insurance claims administration, and purchasing insurance. Risk
Management consists of eight team members that provide these services to nine County Departments with
over 6000 employees and approximately 130 owned and leased buildings.
General Liability and workers’ compensation insurance claims are administered by TPA’s with self insured
retentions of $1 million. Property coverage is administered in house, per internal administrative procedure,
until the $100K retention is met. Other coverages such as pollution, medical malpractice and cyber liability
vary regarding administration, coverage and retention. The County receives over 11,000 contractor
insurance certificates a year, and has over 24,000 contractors/business partners, and in FY 2014-15:
• Logged 565 incidents, resulting in 184 workers’ compensation claims with annual average losses
exceeding $1million.
• Logged 238 liability claims, with annual average losses exceeding $1 million.
Operating as a self-insured employer for workers’ compensation, the Risk Management Section is assigned
the role of loss prevention consultant to County Departments assisting with loss mitigation training, hazard
assessments, driver license tracking and safety consultation among the many functions provided.
Additional information about the Division of Risk Management is available at https://multco.us/finance.
Attachment 4, Page 8 of 27
2.2 GOALS, VALUES AND OTHER IMPORTANT CONSIDERATIONS
The County seeks to achieve the following goals by implementing a Risk Management Information System:
• Improved accuracy in loss and incident data collection
• Improved ability to analyze loss data for prevention practices and risk financing
• Improved loss reporting to departments for identifying trends or spikes in losses
• Ability to self-administer property loss claims, giving better service to departments
• Ability to provide insurance policy gap analysis
• Increased accuracy in contractor certificate insurance tracking by reducing opportunities for manual
data input errors
2.3 FUNDING
Multnomah County Risk Management has budgeted for the software, hardware and implementation costs
associated with this solicitation.
2.4 SCOPE OF SERVICES
The desired software solution is expected to support all of the key functions of the Risk Management Division
including standard functionality for any Risk Management Information System. Unique/additional features will
be considered on a case by case basis.
The expected scope of work includes the software and potentially the implementation services, including data
conversion, training, configuration assistance, and potential development of custom interfaces. A detailed
scope of work will be developed once this solicitation is awarded.
The county reserves the right at time of contracting to select what functionalities outlined in the solicitation are
necessary to be purchased and implemented. The intent of this solicitation is to evaluate all general and
industry standard functionalities available to the County for a Risk Management Information System.
2.5 CONTRACT NEGOTIATION
The County will initiate contract negotiations with the responsive and responsible Proposer with the highest
scoring proposal. Multnomah County may, at its option, elect to negotiate general contract terms and
conditions, services, pricing, implementation schedules, and such other terms as the County determines are
in the County’s best interest. If negotiations fail to result in a contract, the County reserves the right to
terminate the negotiations and initiate contract negotiations with the next highest scoring responsive and
responsible Proposer. This process may continue until a contract agreement is reached.
2.6 CONTRACT AWARD
Through this RFP process, the County is seeking to award one contract. An award, as determined by the
County, will be made to the responsible Proposer whose Proposal the County determines is most
advantageous to the County based on the evaluation process and evaluation factors described in this RFP.
The County reserves the right to select Proposers who have submitted a proposal scoring fewer points than a
higher scoring proposal, based on the Proposer’s ability to best meet the County’s programmatic needs. If a
Proposer who has submitted a proposal that has scored fewer points is recommended for selection, the
Board of County Commissioners must approve the award.
Multnomah County strongly encourages the participation of Minority-Owned, Women-Owned, and
Emerging Small Businesses and Organizations in providing these services.
2.7 CONTRACT TERM
Fixed term with options. The contract term shall be five (5) years. The County shall have the option to
renew this contract for three (3) additional one (1) year period(s).
2.8 COMPENSATION AND METHOD OF PAYMENT
Compensation method for services, software, support/subscriptions, etc will be subject to negotiation once
the County has selected a Proposer.
Attachment 4, Page 9 of 27
2.9 COOPERATIVE PURCHASING
Other public agencies may establish contracts or price agreements directly with the awarded contractor under
the terms, conditions and prices of the original contract Pursuant to ORS 279A.215 and agreement by the
selected Contractor to extend the terms, conditions and prices of the original contract.
2.10 INSURANCE REQUIREMENTS
The Proposer awarded a Contract as a result of this RFP will be required to provide the insurance described
in Exhibit 2 of the attached Multnomah County Services Contract.
Minimum insurance requirements:
Type of Insurance Per Occurrence Aggregate
Professional Liability $1,000,000 $2,000,000
Cyber Liability $2,000,000 $4,000,000
Commercial General Liability $1,000,000 $2,000,000
Technology Errors & Omissions $2,000,000 $4,000,000
Commercial Automobile Liability $1,000,000 N/A
Worker's Compensation Required per ORS 656.017; not less than $500,000
PART 3 – PROPOSAL EVALUATION, QUESTIONS AND INSTRUCTIONS
3.0 PROPOSAL EVALUATION AND SCORING
Evaluation of proposals received in response to the RFP will be conducted comprehensively, fairly and
impartially. Structured quantitative scoring methods will be used to maximize the objectivity of the evaluation.
The evaluation committee of designated reviewers shall review and evaluate proposals. The committee will
be composed of individuals with experience in, knowledge of, and program responsibility for program service
and financing.
Each evaluator shall independently assign a score to each evaluation criterion based on the written
proposals. The evaluators shall meet at a Proposal Evaluation Session and will share their key findings from
each Proposal individually. After sharing their findings, each evaluator shall be given an independent
opportunity to revise their draft scores and to finalize them. Final scoring by each evaluator will then be
summed.
The written proposal is to be divided into five sections, with points allocated as follows:
Section RFP Section Description Possible Points
1 3.2 Vendor Qualifications, Services & Support 200
2 3.3 System Functionality 500
3 3.4 Sustainability & Social Equity 250
4 Cost Proposal 50
EVALUATION PROCESS FOR WRITTEN RESPONSE AND PRODUCT DEMONSTRATION
There will be a two-step evaluation process for this RFP. First, each evaluator shall independently assign a
score to each evaluation criterion based on the written proposals. Then the evaluators shall meet at a
Proposal Evaluation Session and share their key findings from the proposals. After sharing their findings,
each evaluator shall be given an independent opportunity to revise their draft scores and to finalize them.
Final scoring by each evaluator will then be summed. The four (4) Proposers with the highest scores will be
invited to a product demonstration. The County reserves the right to invite more or fewer proposers to the
product demonstration.
In the second part of the evaluation process, Proposers will be asked to give a scripted product
demonstration. The County will provide a written script for the Proposers to use during this demonstration.
Attachment 4, Page 10 of 27
Unless specific evaluation criteria are provided in the solicitation, the same criteria used to evaluate the
written responses will be used to evaluate the product demonstration. No additions, deletions or substitutions
may be made to written proposals during the product demonstrations. Each evaluator shall independently
assign a score to each evaluation criterion based on the scripted demonstration.
The written evaluation scores and the scripted demonstration scores will be considered independent of each
other and will not be combined. Written scores will determine who is in competitive range for scripted
demonstrations. It is intended that the top scoring scripted demonstration will be awarded the contract,
barring the need for a BAFO process as outlined below.
OPTIONAL DISCUSSIONS AND BEST AND FINAL OFFER (BAFO) PROPOSALS
The County may, at its sole discretion, engage in oral or written discussions with some or all Proposers
regarding their Proposals. The County may conduct discussions for the following purposes:
1. Identifying content considered deficient;
2. Seeking additional information or clarification; or
3. Any other purpose to permit the County to obtain the best Solution.
3.1 PROPOSAL QUESTIONS INSTRUCTIONS
All Proposers must complete the questions under Sections 3.2, 3.3 and 3.4. Proposers failing to achieve 70%
of the total points will not be considered further for an award under this procurement.
Example: Proposer A submits a proposal and receives the following scores from the three evaluators:
Evaluator A: 78 Points
Evaluator B: 81 Points
Evaluator C: 60 Points
Total Points: 219 Points
(Minimum necessary: 100 possible points x 3 evaluators x 70% = 210 Points)
As a result, Proposer A has met the minimum requirements to provide these services, since their total point score
of 219 exceeds the minimum number of points required to qualify, 210.
If the total points earned had been less than 210 points, then Proposer A would not have been considered
further for an award under this RFP.
3.2 GENERAL VENDOR INFORMATION
Proposer Name
DBA Names
Company Headquarters Address
Local/Product Site Address
Website
Primary Point of Contact
Secondary Point of Contact
Office Phone Number
Mobile Phone Number
Email Address
Year of Incorporation
Primary Area of Business/Expertise
Gross Revenue for FY 2014 or FY 2015, if available, in US dollars
Provide a brief overview and history of your company
How many developers and analysts are dedicated to this product?
What is the annual R&D budget for this product?
How many live installations currently in the public sector?
How many implementations of this product has your organization performed?
Of these, how many were for public sector entities?
How many employees/consultants do you have who are experienced implementing this product?
Does this product require subcontractors to implement and/or provide post-installation support? If so,
Attachment 4, Page 11 of 27
provide a list of subcontractors utilized.
When did your company release its first RMIS to the market?
How do you address ever-changing related laws/requirements?
How often does your company conduct regular audits or assessments of your privacy program and
policy?
Claim information includes Personally Identifiable Information (PII); do individuals with access to the
database regularly attend and successfully complete training? How often?
Describe your company’s incident detection process. How quickly will the County be notified of an
incident affecting County data? What is the notification process in the event of a potential and confirmed
data breach?
If utilizing subcontractors:
1) Are non-disclosure agreements in place and current for each subcontractor?
2) What services are provided by the subcontractor(s)?
3) What level and frequency do your subcontractor(s) have access to data contained in the
system?
Does your company assess technical security controls? If so, what methods are used? Are assessments
conducted in house or outsourced to a third party? How are the results utilized, addressed and
protected?
Describe your Service Level Agreement. What is your system availability/up time guarantee?
Does your company provide a sandbox environment?
How often does your company release product updates or upgrades?
What is your process for communicating and implementing system patches, upgrades and other
maintenance requirements?
Does your company utilize its own servers or does it contract with at third party such as Amazon or
Rackspace?
Describe how security vulnerabilities are addressed.
Describe the data back-up process.
Provide a brief description of your security protocols/architecture.
How does the system support encryption of information in transit and at rest?
3.3 SYSTEM FUNCTIONALITY
3.3.1 General:
Provide a detailed description of the proposed solution. Include a list of the proposed solution’s software
components with an outline of the major functions and features for each module.
Describe how the proposed solution handles the following functionality (Be sure to include examples,
illustrations and diagrams as appropriate):
• Incident/Claim Intake
• Claims administration
• Policy management
• Exposure tracking
• Incident and Claim reporting
• Litigation management
• Property tracking
• Property loss control/risk control
• Standard reporting
• Ad hoc report writing
• Advanced reporting
• Fleet tracking
• Tracking Certificates of Insurance
• Reserve setting
• Diary entries and updates
• Payment procedures /Vendor 1099/Claim expenses/Check writing
Attachment 4, Page 12 of 27
• Document management
• Mail merge
• Automatic notifications/correspondence
• Custom fields
• Adjuster notes
• Workflow and Tasks
Identify all of the line of businesses available with the solution
3.3.2 Administration
Does the proposed solution provide a multi level delegation of authority? If so, how many levels?
Does the proposed solution provide a means of configuring company organizational structure and
business process as needed by the County?
Does the proposed solution provide the ability to search records by historical data, i.e. previous name?
Does the proposed solution provide for single sign on capability?
Can the proposed solution be configured to prevent the transmission of selected documents such as
medical records?
Can the proposed solution be configured to encrypt all outgoing email from the system?
Does the proposed solution have electronic signature capability? If so, is a third-party product required?
Does the proposed system track or allow for recording of employee safety incidents and loss control
measures implemented?
Does the proposed system have the ability to track employee safety training, certifications and drivers
license information?
3.3.3 Claim Management
Describe the claimant master data the proposed solution manages.
Does the proposed solution have the ability to invoice at-fault party and create payment coupons?
Can an event/incident be entered in the system even if it never becomes a claim?
Does the proposed solution support OSHA reporting? If so, how are changes in reporting requirements
handled?
What mandatory reports can be generated by the proposed solution?
What other functionality does the proposed system have for 1st Party Property Claims and 3rd Party
Liability Claims that has not been already covered?
Does the proposed system separate internal vs. external claims? If so, please describe.
3.3.4 User Experience
Describe the proposed solutions ability to create dashboards, graphs, etc.
Does the solution allow the user to configure their home screen?
Does the proposed solution provide the ability to track how long claims have been open? If so, can it also
track claims that have been re-opened?
What are the proposed solutions search capabilities?
How does the proposed solution support anonymous data entry (i.e. web forms)?
Does the proposed solution allow for end user configuration of data entry templates?
Is the proposed system accessible from standard web browsers without the installation of plug in or
additions by the end user?
Describe the proposed solutions usability features, such as wizards, links, tools/tips etc.
Describe the mobile capabilities and OS platforms in the marketplace.
Does the proposed system validate street addresses as information is entered?
Does the proposed solution provide offline capability? If so, describe how this works.
Does the proposed solution provide the ability to bundle all claim information, including attachments, into
a file to send via email?
3.3.5 Finance
Does the proposed solution provide the ability to print/void checks? If so, how does the proposed solution
handle check reprints (i.e. printer jams)?
Does the proposed solution provide the ability to pay bills for claims in a “Closed” status? If so, please
Attachment 4, Page 13 of 27
explain.
How does the proposed solution track and export 1099 data (i.e. multiple entities with the same tax ID
number)?
Describe the proposed solutions ability to track claims costs.
Does the proposed solution have the ability to invoice an at-fault party and create payment coupons?
Describe the proposed solutions ability to keep a detailed payment history and reconciliation feature.
Does the proposed solution have the ability to notify the end user when at-fault party payments are in
arrears?
Describe how the proposed solution tracks uncollectable debt.
3.3.6 Document Management
Describe the proposed solution ability to attach documents to claims and events.
Describe how the proposed solution preserves metadata.
Does the proposed solution allow for text search within the body of the document attached to the
system?
Describe the proposed solutions ability to apply retention requirements according to business rules.
Does the proposed solution provide the ability to track insurance certificates? If so, does the proposed
solution provide an alert to the end user of upcoming expirations?
3.3.7 Workflow
Does the proposed solution allow for configuration of workflow? If so, what methods can be utilized for
this task (i.e. rules-based routing, sequential and parallel routing)?
Does the proposed system allow for a workflow to be assigned to an individual document?
Does the proposed solution provide the ability to create and assign tasks? Can the end user assign tasks
to others?
Does the proposed solution provide triggers? If so, what types?
Does the proposed solution support multi-path branching in workflows?
3.3.8 Integration
Describe the proposed solutions ability to integrate with other could based solutions.
Describe the proposed solutions ability to integrate with Microsoft Office, Google or both.
Describe your approach to data conversion.
Describe the proposed solutions ability to interface with external systems such as web services.
Is your firm willing to work with a System Integrator of County choosing?
3.3.9 Implementation, Training and Support
Provide a project plan that covers all major activities and dependencies necessary to completion of the
project.
Describe the recommended staffing that the County should provide in order to ensure a successful
implementation.
Identify the major risks associated with implementing the proposed system and describe the actions you
would recommend to minimize them.
Describe the training your company provides to support your proposed solution.
Describe how the end user will get support with browser compatibility and configuration issues.
Describe your company’s recommendations for delivering the training.
Is there an online knowledge base or customer support forum?
Has the proposed system been integrated with Workday Finance and Human Resources? If so, where
challenges encountered in the process and how were those challenges met?
3.3.10 Pricing
Provide an outline of your product pricing structure.
What is the base cost to utilize your platform and minimum capabilities that base cost provides?
What modules does the proposed system offer as additional purchases that may be of interest to the
County, given the information provided in this proposal?
Attachment 4, Page 14 of 27
3.4 RESPONSIBLE BUSINESS PRACTICES - 25% of total points
Our vendors are an integral part of the societies and communities in which they operate. Their influence
extends to the employees they depend upon, the environment from which they draw their resources and
the marketplace in which they participate. Multnomah County seeks to conduct business with vendors
who demonstrate responsible business practices through sustainable innovations. We are focused on the
triple bottom line of sustainability; Environmental Considerations, Social Equity and Economic Impact.
The Triple Bottom Line provides a framework for all of us to work together to create a stronger community
with the goods and services we oversee.
The County has an interest in measures used by its vendors to ensure sustainable operations with
minimal adverse impact on the environment. The County seeks to do business with vendors who
demonstrate community and environmental stewardship along with workplace diversity.
3.4.1 Environmental Considerations - 10% of total points
Does your organization purchase energy efficient light bulbs and encourage others to do the same?
Does your organization promote energy saving practices such as turning off lights in rooms not being used?
Do you provide bus passes for clients or employees? Do you encourage your clients and employees to use
public transportation? Do you capture metrics on the effectiveness of using public transport?
Please describe your organization’s plan to reduce waste.
Please describe any measures you have taken to reduce or minimize or reduce energy consumption in your
data center.
Please highlight any aspects of your application architecture that reduce energy consumption through sharing
or reusing resources across multiple customers, such as virtualization or multi-tenant architecture.
Economic Impact
Do you encourage a healthy workplace with healthy eating, anti-tobacco policies and resources, exercise,
flexible work schedules, and/or other approaches?
Please provide details of specific benefit, programs and policies that you have implemented to encourage a
healthy workplace.
Please describe how you support your employees to ensure they succeed.
Provide details of policies and programs that you have implemented, such as professional development
opportunities, mentoring programs etc.
3.4.2 Social Equity - 10% of total points
The County is committed to extending contracting opportunities to businesses that demonstrate social
equity in the areas of workforce diversity, utilization of State of Oregon certified Minority, Women and
Emerging Small Businesses (MWESBs), business practices, and health insurance and other benefits for
employees. In order to promote economic growth, the County seeks to maximize the participation of
diverse consultants, partners, contractors, and suppliers throughout the duration of the project. Ten
percent (10%) of the total possible points to be awarded in this solicitation have been assigned to the
Social Equity criteria below.
1. Workforce Diversity
A. Describe in detail how your (agency/business/ organization) develops an internal diverse
workforce.
B. How do you approach internal on-the-job training, mentoring, technical training and/or
professional development opportunities addressing diversity?
C. Describe the process(es) used to recruit women and minorities.
D. What types of projects or initiatives have been implemented?
Attachment 4, Page 15 of 27
2. Minority, Women and Emerging Small Business (MWESB)
MWESB Contracting and Past Performance:
A. Within the past 24 months, have you awarded contracts or conducted business with State
of Oregon certified MWESB businesses? If yes:
B. List the State of Oregon MWESB businesses that your agency/organization/ business
conducted business with during the past 24 months.
C. Identify the total volume and total overall percentage of contracts awarded to MWESB
businesses during the past 24 months.
D. Describe any innovative or successful measures undertaken to work with MWESB
businesses during the past 24 months.
E. Describe any mentoring, technical or other business development services your
agency/organization/ business provided to previous or current MWESB sub-consultants or
partners, or will provide in relation to the goods or services in this solicitation.
3. Business Practices
A. Describe in detail how your agency/business/ organization include diverse suppliers,
vendors and subcontractors in the conduct of your business and supply chain. Please
provide specific examples.
B. Describe in detail the efforts and activities under taken by your business or organization to
create economic and social benefits for current or future generations. Please provide
specific examples. (Non-applicable for agencies)
3.4.3 Economic Impacts and a Healthy Workplace | 5% of total points
The County values the community as a whole and calls out those providing and receiving services
should have a positive economic impact from the delivery of services that is long term and
positively changes our hierarchical systems to incorporate those who are most affected by
inequities.
It is the County’s desire to create full and equal access to opportunities for all people that enable
them to attain their full potential. We pay particular attention to the development of income and
wealth for communities most affected by inequities.
A. Describe in detail your cultural competency and diversity training, and the expectations of
recruited staff that will be working with diverse populations to ensure program values and
goals are met.
B. What economic impact innovations for cultural and ethnic minority populations can your
agency integrate into the delivery of goods and/or services? How do these economic
impact innovations go beyond industry best practices? Please provide specific examples
and demonstrate how you will deliver and track these innovations.
C. How does your agency improve economic impact by incorporating equity values, manage
diversity and systematically involve consumers, families and communities in all aspects of
policy and service delivery?
PART 4 – INSTRUCTIONS FOR SUBMITTING PROPOSALS
4.0 JOINT PROPOSALS
The County will consider joint proposals from new and existing providers. Joint proposals may take the form
of partnerships, general contractor/subcontractor arrangements or entities formed by new and existing
providers. If any such arrangement is proposed, a written memorandum of understanding between the parties
must be submitted with the Proposal setting forth the business and service delivery agreements between the
parties.
4.1 MULTIPLE OR ALTERNATE PROPOSALS
Attachment 4, Page 16 of 27
Multiple or alternate proposals shall not be accepted unless specifically provided for in this section. In the
event alternate proposals are not accepted and a proposer submits alternate proposals, but clearly indicates
a primary proposal, it shall be considered for award as though it were the only proposal submitted by the
proposer.
4.2 PROPOSAL INSTRUCTIONS AND CONTENT
Proposals must be printed, computer generated or typewritten, single spaced, space-and-a-half or double-
spaced, on 8.5” x 11” paper. All pages should be numbered. Margins should be at least ½ inch on all sides.
Font size can be no smaller than 10. Proposals using smaller font sizes or smaller margins may be rejected.
In support of the County’s sustainability goals regarding environmental impact and the disposal of paper, it is
the County’s preference that proposals be printed on both sides of the paper, rather than on one side only.
When proposal format instructions limit the number of pages to be submitted, the page count is based on the
quantity of numbered pages. Example: The RFP proposal response to the program question is limited to a
page count of not more than 12 pages. This equates to not more than 6 sheets of paper that are printed on
each side, or 12 pages printed on only one side.
4.3 MAXIMUM PAGE LIMIT
While no maximum page limit is specified for this solicitation, proposers are encouraged to be as concise and
clear as possible in order to minimize the overall length of their submissions.
4.4 PROPOSAL CONTENT
Proposers must respond to all the questions listed under Part 3, – Proposal Evaluation, Questions and
Instructions. For each item, restate the question and use the same numbering and letter sequence as found
in the RFP and then provide your response. Responses must be on the forms provided for by Multnomah
County where applicable.
4.5 PROPOSAL BINDING
Proposals must be stapled in the left upper corner. Do not use spiral bindings, glue or place in notebooks or
use other methods of binding the proposal. If the document is too thick to be held with a single staple, secure
the document with a metal clip that can be easily removed for copying purposes.
4.6 PROPOSAL PACKAGING
Proposals shall be submitted in a sealed envelope appropriately marked with the Proposal title, RFP number,
and the name and address of the Proposer. If the requested copies do not fit into an envelope, enclose all
copies in a box, seal it and attach a sheet of paper with the following information to the top of the box: (1)
Proposal title, (2) RFP number, and (3) the name and address of the Proposer. Please use the minimum
amount of tape necessary to seal the box.
4.7 PROPOSAL COPIES AND SUBMISSION
Proposers must submit one 1 original complete copy of the proposal to: Multnomah County Purchasing, 501
SE Hawthorne Blvd, Suite 125 Portland, OR 97214, no later than 4:00 p.m. on the proposal due date
specified on the cover page of this proposal. PROPOSALS MUST BE TIME STAMPED AT THE
PURCHASING BID DESK BY THE STATED DEADLINE. LATE PROPOSALS WILL NOT BE
CONSIDERED.
In addition to the above hard-copy of the proposal, Proposer may submit one USB drive containing an
electronic copy of the proposal. Electronic copy of the proposal must match hard-copy versions of the
proposal. All electronic files must be in PDF format. Clearly label electronic media with proposal number, and
name of proposer.
4.8 MINIMUM REQUIREMENTS
4.8.1 Proposer Representations and Certifications
All Proposers are to submit a SIGNED Proposer Representations and Certifications [Attachment 1], and it will
not count against the total page limitation. Failure to sign a completed Proposer Representations and
Certifications form may result in rejection of the proposal.
4.8.2 At the time of proposal submission, Proposers must meet the following minimum requirements.
Attachment 4, Page 17 of 27
Failure to provide any of the required documents or meet any of the below requirements shall result in
rejection of the proposal.
1. The Proposal response must be received by Multnomah County Purchasing no later than 4:00
P.M. local Portland time on the proposal submission deadline.
4.8.3 At the time of Contracting, Proposers must meet the following minimum requirements. Failure to
provide any of the required documents or meet any of the below requirements shall result in cancellation of
the contract.
1. Proposers must be legal entities, currently registered to do business in the State of Oregon (per
ORS 60.701).
2. Proposers must submit verification that all insurance requirements are met.
3. Proposers must complete a Pre-Award Risk Assessment (Section 1.20) if federal funds are used for
this procurement.
Attachment 4, Page 18 of 27
ATTACHMENT 1
Proposer Representations and Certifications
FAILURE OF THE PROPOSER TO COMPLETE AND SIGN THIS FORM MAY RESULT IN REJECTION OF THE
SUBMITTED OFFER
The undersigned, having full knowledge of the specifications for the goods or services specified herein, offers and agrees
that this offer shall be irrevocable for at least 30 calendar days after the date offers are due or as stated in the solicitation,
and if accepted, to furnish any and/or all goods or services as described herein at the prices offered and within the time
specified.
PROPOSER NAME:
ADDRESS: City, State, Zip
TELEPHONE NO:
STATE OF
INCORPORATION: DATE OF INCORPORATION:
BUSINESS
DESIGNATION:
Corporation Sole Proprietor Partnership
S. Corporation Non-Profit Government
Other: _____________________________
OREGON MWESB
CERTIFICATION NUMBER:
Minority Owned
Woman Owned
Emerging, Small
N/A
ASSURANCES - The Proposer attests that:
1. The person signing this offer has the authority to submit an offer and to represent Proposer in all phases of this
procurement process;
2. The information provided herein is true and accurate;
3. The Proposer is a resident proposer, as described in ORS 279A.120, of the State of ______________, [insert State]
and has not discriminated against any minority, women, or emerging small business enterprises certified under ORS
200.055 or a business enterprise that is owned or controlled by or that employs a disabled veteran as defined in ORS
408.225 in obtaining any required subcontracts, in accordance with ORS 279A.110;
4. "Resident bidder" means a bidder that has paid unemployment taxes or income taxes in this state during the 12
calendar months immediately preceding submission of the bid, has a business address in this state and has stated in
the bid whether the bidder is a "resident bidder". ORS 279A.120 (1) (][b);
5. Any false statement may disqualify this offer from further consideration or because of contract termination; and
6. The Proposer will notify the Department Contracts Officer within 30 days of any change in the information provided on
this form.
CERTIFICATION REGARDING DEBARMENT, SUSPENSION AND OTHER RESPONSIBILITY MATTERS - The
Proposer certifies to the best of its knowledge and belief that neither it nor any of its principals:
1. Are presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from
submitting bids or proposals by any federal, state or local entity, department or agency;
2. Have within a five-year period preceding the date of this certification been convicted of fraud or any other criminal
offense in connection with obtaining, attempting to obtain, or performing a public (federal, state, or local) contract,
embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, or receiving
stolen property;
3. Are presently indicted for or otherwise criminally charged with commission of any of the offenses enumerated in
paragraph 2. of this certification;
4. Have, within a five-year period preceding the date of this certification had a judgment entered against contractor or its
principals arising out of the performance of a public or private contract;
5. Have pending in any state or federal court any litigation in which there is a claim against contractor or any of its
principals arising out of the performance of a public or private contract; and
Attachment 4, Page 19 of 27
6. Have within a five-year period preceding the date of this certification had one or more public contracts (federal, state,
or local) terminated for any reason related to contract performance.
7. Compliance with Tax Law. Contractor shall pay all taxes owed to a public body, as defined in ORS 174.109, and
attests to compliance with the tax laws of this state or a political subdivision of this state including, but not limited to
ORS 305.620, and ORS chapters 316, 317, and 318. Contractor will continue to comply with the tax laws of this state
or a political subdivision of this state during the term of this contract. Failure to comply with this contract term is a
default for which County may terminate the contract and seek damages and other relief available.
CERTIFICATION REGARDING CONFLICT OF INTEREST
“Organizational conflict of interest” means that, because of other activities or relationships with other persons or firms, a
Contractor or Consultant (including its principal participants, directors, proposed consultants or subcontractors) would be
unable or potentially unable to render impartial, technically sound assistance or advice to Multnomah County; or the
Contractor’s or Consultant’s objectivity in performing the Work would or might be otherwise impaired. The Proposer
certifies to the best of its knowledge and believe that neither it nor any of its principal participants and agents:
1. Has any relationships with any firms or individuals that are or appear to be an organizational conflict of interest.
2. Has or has had the following relationships with the specific firm(s)/individual(s), identified below, which may be
determined to be an organizational conflict of interest. I understand that based on the information provided by
Proposer, Multnomah County may exclude the Proposer from further consideration and may withdraw its selection if
the real or apparent organizational conflict of interest cannot be avoided or mitigated. Proposer further certifies that
the degree and extent of the relationship of the Proposer with these named firm(s)/individual(s) have been fully
disclosed below.
_____________________________________________________________________________________________
_____________________________________________________________________________________________
_____________________________________________________________________________________________
_____________________________________________________________________________________________
___________________________________________________________________________________
Where Proposer is unable to certify to any of the statements in this certification, Proposer shall attach an explanation to their
offer. The inability to certify to all of the statements may not necessarily preclude Proposer from award of a contract under
this procurement.
SIGNATURE OF AUTHORIZED PERSON
Signature: Date:
Print Name & Title:
Contact Person for this Procurement:
Phone: Email:
Attachment 4, Page 20 of 27
ATTACHMENT 2
SAMPLE COUNTY CONTRACT
MULTNOMAH COUNTY SERVICES CONTRACT
Contract Number: [insert contract number]
This contract (“Contract”) is between MULTNOMAH COUNTY (“County”) and [insert contractor name] (“Contractor”),
referred to collectively as the “Parties.”
CONTRACTOR ADDRESS: [insert]
CITY, STATE, ZIP: [insert]
The Parties agree as follows:
Effective Date and Termination Date. The effective date of this Contract shall be [insert date] or the date on which all
Parties have signed this Contract, whichever is later. Unless earlier terminated as provided below, the termination date
shall be [insert date].
Statement of Work. Contractor shall perform the work described in Exhibit 1 (“Work”).
Payment for Work. County agrees to pay Contractor in accordance with Exhibit 1.
Contract Documents. This Contract includes the following Standard Terms and Conditions and the terms and conditions
contained in the following attached documents:
[Guidance: Below is the recommended format for detailing any exhibits to the contract. Exhibits 1-11 are established and
may not be re-numbered/re-named. Exhibit name and number indicated below must match the name and number on the
corresponding exhibit. Exhibits not used and out of sequence must be noted as intentionally omitted.]
Exhibits
Exhibit Number Description
1 Statement of Work, Compensation, Payment, and Renewal Terms
2 Insurance Requirements
3 Certification Statement for Corporation or Independent Contractor
4 Worker’s Compensation Exemption Certificate
5 NOT USED
6 Invoice/Budget Forms
7 Criminal History Background Authorization
8 Accounts Payable Electronic Payment Authorization
[Insert As
Needed]
[Insert additional exhibits as needed]
Attachments
[Guidance: Below is the recommended format for detailing any attachments to the contract. Attachment H is established,
and may not be re-lettered/re-named. Attachment name and letter, indicated below, must match the name and letter on
the corresponding attachment.]
Attachment Letter Description
F Post Federal Award Requirements Standards
H Health Insurance Portability and Accountability Act of 1996 (HIPAA) Business Associate Agreement
Attachment 4, Page 21 of 27
MULTNOMAH COUNTY SERVICES CONTRACT
Contract Number: [insert contract number]
CONTRACTOR SIGNATURE
I have read this Contract including the attached Exhibits and Attachments. I understand the Contract and agree
to be bound by its terms.
Signature: Title:
Name (print): Date:
MULTNOMAH COUNTY SIGNATURE
This Contract is not binding on the County until signed by the Chair or the Chair’s designee.
County Chair or Designee: Date:
Department Director Review (optional):
Director or Designee: Date:
County Attorney Review:
Reviewed: JENNY M. MADKOUR, COUNTY ATTORNEY FOR MULTNOMAH COUNTY, OREGON
By Assistant County Attorney: Date:
Attachment 4, Page 22 of 27
STANDARD TERMS AND CONDITIONS
1. Time is of the Essence. Time is of the essence in the performance of this Contract.
2. Subcontracts and Assignment. Contractor shall not subcontract any of the Work required by this Contract or assign or
transfer any of its interest in this Contract, without the prior written consent of County.
3. No Third Party Beneficiaries. County and Contractor are the only Parties to this Contract and are the only Parties entitled
to enforce its terms. Nothing in this Contract gives or provides any benefit or right, whether directly, indirectly, or otherwise,
to third persons unless such third persons are individually identified by name in this Contract and expressly described as
intended beneficiaries of this Contract.
4. Successors in Interest. The provisions of this Contract shall be binding upon and inure to the benefit of the Parties and
their successors and approved assigns, if any.
5. Early Termination. This Contract may be terminated as follows:
a. County and Contractor, by mutual written agreement, may terminate this Contract at any time.
b. County in its sole discretion may terminate this Contract for any reason on 30 days written notice to Contractor.
c. Either County or Contractor may terminate this Contract in the event of a breach of the Contract by the other. Prior
to such termination the party seeking termination shall give to the other party written notice of the breach and intent
to terminate. If the party committing the breach has not entirely cured the breach within 15 days of the date of the
notice, then the party giving the notice may terminate the Contract at any time thereafter by giving a written notice
of termination.
d. Notwithstanding section 5(c), County may terminate this Contract immediately by written notice to Contractor upon
denial, suspension, revocation or non-renewal of any license, permit or certificate that Contractor must hold to
provide services under this Contract.
6. Payment on Early Termination. Upon termination pursuant to section 5, payment shall be made as follows:
a. If terminated under 5(a) or 5(b) for the convenience of the County, the County shall pay Contractor for Work
performed prior to the termination date if such Work was performed in accordance with the Contract.
County shall not be liable for direct, indirect or consequential damages. Termination shall not result in a waiver of
any other claim County may have against Contractor.
b. If terminated under 5(c) by the Contractor due to a breach by the County, then the County shall pay the Contractor
for Work performed prior to the termination date if such Work was performed in accordance with the Contract.
c. If terminated under 5(c) or 5(d) by the County due to a breach by the Contractor, then the County shall pay the
Contractor for Work performed prior to the termination date provided such Work was performed in accordance with
the Contract less any setoff to which the County is entitled.
7. Remedies. In the event of breach of this Contract the Parties shall have the following remedies:
a. If terminated under 5(c) by the County due to a breach by the Contractor, the County may complete the Work either
itself, by agreement with another Contractor, or by a combination thereof. If the cost of completing the Work
exceeds the remaining unpaid balance of the total compensation provided under this Contract, then the Contractor
shall pay to the County the amount of the reasonable excess.
b. In addition to the remedies in sections 5 and 7 for a breach by the Contractor, the County also shall be entitled to
any other equitable and legal remedies that are available.
c. If the County breaches this Contract, Contractor’s remedy shall be limited to termination of the Contract and receipt
of Contract payments to which Contractor is entitled.
8. Access to Records. Contractor shall retain, maintain and keep accessible all records relevant to this Contract (“Records”)
for a minimum of six (6) years, following Contract termination or full performance or any longer period as may be required by
applicable law, or until the conclusion of any audit, controversy or litigation arising out of or related to this Contract,
whichever is later. Contractor shall maintain all financial Records in accordance with generally accepted accounting
principles. All other Records shall be maintained to the extent necessary to clearly reflect actions taken. During this record
retention period, Contractor shall permit the County’s authorized representatives access to the Records at reasonable times
and places for purposes of examination and copying.
9. Ownership of Work. For purposes of this Contract, “Work Product” means all services Contractor delivers or is required to
deliver to County pursuant to this Contract. “Contractor Intellectual Property” means any intellectual property owned by
Contractor and developed independently from services.
Attachment 4, Page 23 of 27
County shall have no rights in any pre-existing Contractor Intellectual Property provided to County by Contractor in the
performance of this Contract except to copy, use and re-use any such Contractor Intellectual Property for County use only.
However, all Work Product created by the Contractor as part of Contractor’s performance of this Contract shall be the
exclusive property of the County. All Work Product authored by Contractor under this Contract shall be deemed “works
made for hire” to the extent permitted by the United States Copyright Act. To the extent County is not the owner of the
intellectual property rights in such Work Product, Contractor hereby irrevocably assigns to County any and all of its rights,
title and interest in such Work Product. Upon County’s reasonable request, Contractor shall execute such further documents
and instruments reasonably necessary to fully vest such rights in County. Contractor forever waives any and all rights
relating to such Work Product created under this Contract, including without limitation, any and all rights arising under 17
USC § 106A or any other rights of identification of authorship or rights of approval, restriction or limitation on use or
subsequent modifications.
If intellectual property rights in the Work Product are Contractor Intellectual Property, Contractor hereby grants to County an
irrevocable, non-exclusive, perpetual, royalty-free license to use, make, reproduce, prepare derivative works based upon,
distribute copies of, perform and display the Contractor Intellectual Property, and to authorize others to do the same on
County’s behalf. If this Contract is terminated prior to completion, and the County is not in default, County, in addition to any
other rights provided by this Contract, may require the Contractor to transfer and deliver all partially completed Work
Product, reports or documentation that the Contractor has specifically developed or specifically acquired for the performance
of this Contract.
10. Compliance with Applicable Law. Contractor shall comply with all federal, state, and local laws applicable to the Work
under this Contract, and all regulations and administrative rules established pursuant to those laws, including, without
limitation ORS 279B.020 and the following:
a. Pursuant to ORS 279B.220, Contractor shall (1) make payment promptly, as due, to all persons supplying to the
Contractor labor or material for the performance of the Work provided for in the Contract; (2) pay all contributions or
amounts due the Industrial Accident Fund from the Contractor or subcontractor incurred in the performance of the
Contract; (3) not permit any lien or claim to be filed or prosecuted against the state or a county, school district,
municipality, municipal corporation or subdivision thereof, on account of any labor or material furnished; and (4) pay
to the Department of Revenue all sums withheld from employees under ORS 316.167.
b. Pursuant to ORS 279B.225, Contractor shall, if providing lawn and landscape maintenance services, shall salvage,
recycle, compost or mulch yard waste material at an approved site, if feasible and cost-effective.
c. In accordance with ORS 279B.230, Contractor shall promptly, as due, make payment to any person, copartnership,
association or corporation furnishing medical, surgical and hospital care services or other needed care and
attention, incident to sickness or injury, to the employees of the Contractor, of all sums that the Contractor agrees to
pay for the services and all moneys and sums that the Contractor collected or deducted from the wages of
employees under any law, contract or agreement for the purpose of providing or paying for the services. All subject
employers working under the Contract warrant they are either employers that will comply with ORS 656.017 or
employers that are exempt under ORS 656.126.
d. Pursuant to ORS 279B.235, Contractor shall not employ any person for more than 10 hours in any one day, or 40
hours in any one week, except in cases of necessity, emergency, or where the public policy absolutely requires it.
The laborer shall be paid at least time and a half pay when: (i) overtime is in excess of eight hours a day or 40
hours in any one week when the work week is five consecutive days, Monday through Friday; (ii) overtime is in
excess of 10 hours a day or 40 hours in any one week when the work week is four consecutive days, Monday
through Friday; and (iii) Work is performed on Saturday and any legal holiday specified in a collective bargaining
agreement or ORS279B.020. The requirement to pay at least time and a half for all overtime worked in excess of 40
hours in any one week, shall not apply to individuals who are excluded under ORS 653.010 to 653.261 or under 29
U.S.C. sections 201 to 219 from receiving overtime.
11. Compliance with Tax Law. Contractor shall pay all taxes owed to a public body, as defined in ORS 174.109, and attests to
compliance with the tax laws of this state or a political subdivision of this state including, but not limited to ORS 305.620, and
ORS chapters 316, 317, and 318. Contractor will continue to comply with the tax laws of this state or a political subdivision of
this state during the term of this contract. Failure to comply with this contract term is a default for which County may
terminate the contract and seek damages and other relief available.
12. Indemnity. Contractor shall defend, save, hold harmless, and indemnify County and its officers, employees and agents from
and against all claims, suits, actions, losses, damages, liabilities, costs and expenses of any nature whatsoever, including
attorneys fees, resulting from, arising out of, or relating to the activities of Contractor or its officers, employees,
subcontractors, or agents under this Contract. Contractor shall have control of the defense and settlement of any claim that
is subject to this section. However, neither Contractor nor any attorney engaged by Contractor shall defend the claim in the
name of County or any department of County, nor purport to act as legal representative of County or any of its departments,
without first receiving from the Multnomah County Attorney’s Office authority to act as legal counsel for County, nor shall
Contractor settle any claim on behalf of County without the approval of the Multnomah County Attorney’s Office. County
may, at its election and expense, assume its own defense and settlement.
Attachment 4, Page 24 of 27
13. Insurance. Contractor shall provide insurance in accordance with Exhibit 2.
14. Waiver. The failure of the County to enforce any provision of this Contract shall not constitute a waiver by the County of that
or any other provision. Waiver of any default under this Contract by County shall not be deemed to be a waiver of any
subsequent default or a modification of the provisions of this Contract.
15. Governing Law/Venue. The provisions of this Contract shall be construed in accordance with the laws of the State of
Oregon and ordinances of Multnomah County, Oregon. Any legal action involving any question arising under this Contract
must be brought in Multnomah County, Oregon. If the claim must be brought in a federal forum, then it shall be brought and
conducted in the United States District Court for the District of Oregon.
16. Severability. If any term or provision of this Contract is declared by a court of competent jurisdiction to be illegal or in
conflict with any law, the validity of the remaining terms and provisions shall not be affected, and the rights and obligations of
the Parties shall be construed and enforced as if the Contract did not contain the particular term or provision held invalid.
17. Merger Clause. This Contract and the attached exhibits constitute the entire agreement between the Parties. All
understandings and agreements between the Parties and representations by either party concerning this Contract are
contained in this Contract. No waiver, consent, modification or change in the terms of this Contract shall bind either party
unless in writing signed by both Parties. Any written waiver, consent, modification or change shall be effective only in the
specific instance and for the specific purpose given.
18. Anti-discrimination Clause. Contractor shall not discriminate based on race, religion, color, sex, marital status, familial
status, national origin, age, mental or physical disability, sexual orientation, gender identity, source of income, or political
affiliation in programs, activities, services, benefits or employment. Contractor shall not discriminate against minority-owned,
women-owned or emerging small businesses. Contractor shall include a provision in each subcontract requiring
subcontractors to comply with the requirements of this clause.
19. EEO Compliance. Contractor agrees that if, at any time under the term of this Contract, it has employees and will earn more
than $75,000 as a result of this Contract, Contractor will not:
a. Discriminate against employees or applicants based on race, color, religion, sex, familial status, national origin, age,
mental or physical disability, sexual orientation, gender identity, or source of income;
b. Solicit or consider employment recommendations based on factors other than personal knowledge or records of
job-related abilities or characteristics;
c. Coerce the political activity of any person;
d. Deceive or willfully obstruct anyone from competing for employment;
e. Influence anyone to withdraw from competition for any position so as to improve or injure the employment prospects
of any other person;
f. Give improper preference or advantage to anyone so as to improve or injure the employment prospects of that
person or any other employee or applicant.
20. Non-appropriation Clause. If payment for Work under this Contract extends into the County's next fiscal year, County’s
obligation to pay for such Work is subject to approval of future appropriations to fund this Contract by the Board of County
Commissioners of Multnomah County, Oregon.
21. Warranties. Contractor represents and warrants to County that: (a) Contractor has the power and authority to enter into and
perform the Contract; (b) the Contract, when executed and delivered, shall be a valid and binding obligation of Contractor
enforceable in accordance with its terms; and (c) Contractor’s performance under the Contract shall be in a good and
workmanlike manner and in accordance with professional standards applicable to the Work.
22. Federal Funds Subrecipient. If this Contract is a subaward (making Contractor a subrecipient of Federal funds), the
Catalog of Federal Domestic Assistance (CFDA) number(s), title(s) and amount(s) of the Federal funds are shown below
along with other required information about the Federal award per CFR200, Subpart D – Post Federal Award Requirements
Standards for Financial and Program Management, Section §200.331 (see Attachment F). Contractor shall conduct an audit
as described under 2 CFR 200.500-521 (which replaces OMB Circular A-133) if such an audit is required by Federal
regulations. If there is a change to funding for this Contract that adds Federal funding or changes existing funding to Federal,
Contractor will be notified via a certified letter within 30 days.
CFDA # Program Title Program Amount
[enter number or not
applicable]
[enter title or not applicable] [enter number or not applicable]
a. Contractor agrees to use, document, and maintain accounting policies, practices and procedures, and cost
allocations, and to maintain fiscal and other records pertinent to this Contract consistent with Generally Accepted
Accounting Principles (GAAP), Office of Management and Budget (OMB) Uniform Administrative Requirements,
Attachment 4, Page 25 of 27
Cost Principles and Audit Requirements for Federal Awards (2 CFR Chapter I, Chapter II, Parts 200, 215, 220,225,
and 230), Oregon Administrative Rules, County financial procedure in the Countywide Contractor’s Fiscal Policies
and Procedures Manual located at: http://web.multco.us/finance/fiscal-compliance. Accounting records shall be up-
to-date and shall accurately reflect all revenue by source, all expenses by object of expense and all assets,
liabilities, and equities consistent with the Generally Accepted Accounting Principles, Oregon Administrative Rules,
and County procedures. Reports and fiscal data generated by the Contractor under this Contract shall be
accessible to County upon request.
b. Contractor shall be subject to a County fiscal compliance review to monitor compliance with the County’s financial
reporting and accounting requirements. The review shall be completed periodically, as described in the Countywide
Contractor’s Fiscal Policies and Procedures Manual. If Contractor’s corporate headquarters are out of state,
Contractor agrees to pay travel costs incurred by County to conduct fiscal review. These costs include, but are not
limited to, transportation to corporate headquarters, lodging, and meals.
c. Contractor, if it is a state, local government or non-profit organization and a subrecipient of Federal funds, shall
meet audit requirements of Office of Management and Budget (OMB) Uniform Administrative Requirements “Audits
of States, Local Governments, and Non-Profit Organizations” (2 CFR Chapter I, Chapter II, Parts 200, 215, 220,
225, and 230), Subpart F (formerly OMB Circular A-133 December 25, 2014 and earlier).
d. Contractor agrees that audits must be conducted by Certified Public Accountants who satisfy the independence
requirements outlined in the rules of the American Institute of Certified Public Accountants ( Rule 101 of the AICPA
Code of Professional Conduct, and related interpretation and rulings), the Oregon State Board of Accountancy, the
independence rules contained within Government Auditing Standards (2003 Revision), and ruled promulgated by
other Federal, State, and local government agencies with jurisdiction over Contractor. Those rules require that the
Certified Public Accountant be independent in thought and action with respect to organizations who engage them to
express an opinion on Financial Statements or to perform other services that require independence.
e. Limited Scope and Full Audits, including the Management Letter associated with the audit, if issued, and all
specifications identified in the County’s Fiscal Policies and Procedure Manual shall be submitted to the County
within thirty (30) days from the date of the report, but in no case later than nine (9) months after the end of the
Contractor’s fiscal year. Failure to submit required audits and Management Letter by specified deadlines shall be
cause for withholding of Contract payments until audits are submitted.
Attachment 4, Page 26 of 27
MULTNOMAH COUNTY SERVICES CONTRACT
Contract Number: [insert contract number]
EXHIBIT 1: STATEMENT OF WORK, COMPENSATION, PAYMENT, AND RENEWAL TERMS
1. Contractor shall perform the following Work:
[Enter information]
2. The maximum payment under this Contract, including expenses, is $[enter total amount].
3. Contractor shall be paid for Work on the following basis:
[Enter information]
4. Contractor shall submit invoices for Work as follows: *
[Enter information]
5. In addition to the payment provided for in Section 3, County will pay expenses on the following
terms and conditions:
[Enter information]
6. The Contract may be renewed on the following basis [optional]:
[Enter information]
*County shall have the right to withhold from payments due Contractor such sums as are necessary in
County’s sole opinion to protect County from any loss, damage, or claim which may result from Contractor’s
failure to perform in accordance with the terms of the Contract or failure to make proper payment to suppliers
or subcontractors. County shall not be obligated to pay Contractor until it has inspected and affirmatively
accepted Contractor’s Work.
Attachment 4, Page 27 of 27
A D D E N D U M # 1
July 21, 2016
Address all questions to:
Patricia Bride
Multnomah County Central Purchasing
501 SE Hawthorne Blvd., Suite 125
Portland, OR 97214
503-988-7541
E-mail: Patricia.Bride@multco.us
RFP NO: 4000004822
TITLE: Risk Management Information System
CLOSING DATE: August 5, 2016 / NOT LATER THAN 4:00 p.m.
This Addendum is issued to the above referenced to Request for Proposal to make the following
changes, additions, deletions, and/or clarifications:
1. Clarification Many questions have been asked requesting more specific information that we
are unable to answer at this time. The intent of the written portion of the RFP is
to obtain high level information about the product and services the proposers
product can provide. The first scoring process should provide us with a list of
the most advantageous proposers who can meet the needs of the County now
and in the future.
Scope of work and specific pricing will be addressed at different times in this
process and/or will be negotiated at time of contracting. This will include the
integration of the selected solution to other systems utilized within the County.
The pricing requested in the written portion of this RFP is intended to get an
idea of the basic pricing structure for the proposed solution. Specific pricing is
not being requested at this time. Please reference Section 3.3.10 for specific
questions about pricing.
Additional products and services are not being requested at this time. We thank
you for your interest and inquiries; however, we are not ready to address
services outside of what has been requested in the RFP at this time.
Multnomah County has recently completed and awarded our Enterprise
Resource Planning System. We received specific questions as to interface and
functionality that we are unable to answer due to these new systems that will be
brought online over the next couple of years. This will involve developing new
Attachment 5, Page 1 of 2
business processes as systems are brought online and will likely interact with
the RIMS we are requesting in this RFP. We would anticipate that the awarded
proposer will work closely with our internal management teams to address
functions and interfacing that will come with bringing the RIMS online.
2. Clarification
Question: Whether companies from Outside USA can apply for this?
Answer: Yes
3. Clarification Question: Whether we need to come over there for meetings?
Answer: No
4. Clarification Question: Can we perform the tasks (related to RFP) outside USA?
Answer: Yes
5. Clarification Question: Can we submit the proposals via email?????
Answer: No. The County does not accept electronic submission of proposals at
this time.
6. Clarification Question: I was reviewing the 2017 County Budget and did not see the money
set aside for this bid. Can you let me know where in the budget this is outlined.
If it is not itemized, what is the expectation of the county for implementation
costs upfront and then subscription costs going forth annually?
Answer: The purchase of the RMIS system is not itemized in the budget. We
are asking Proposers to submit pricing as a scored component of the RFP
response. This should include implementation costs as well as subscription
fees.
7. Clarification Question: How many RMIS Users are anticipated?
Answer: We think there will be 10-15 users; however, it is unknown at this time
as business process development will dictate user count.
8. Clarification Question: Do you have an existing RMIS?
Answer: No
c: C. O’Donnell
L. Russell
P. Bride
File
Attachment 5, Page 2 of 2
Attachment 6, Page 1 of 83
Attachment 6, Page 2 of 83
Attachment 6, Page 3 of 83
Attachment 6, Page 4 of 83
Attachment 6, Page 5 of 83
Attachment 6, Page 6 of 83
Attachment 6, Page 7 of 83
Attachment 6, Page 8 of 83
Attachment 6, Page 9 of 83
Attachment 6, Page 10 of 83
Attachment 6, Page 11 of 83
Attachment 6, Page 12 of 83
Attachment 6, Page 13 of 83
Attachment 6, Page 14 of 83
Attachment 6, Page 15 of 83
Attachment 6, Page 16 of 83
Attachment 6, Page 17 of 83
Attachment 6, Page 18 of 83
Attachment 6, Page 19 of 83
Attachment 6, Page 20 of 83
Attachment 6, Page 21 of 83
Attachment 6, Page 22 of 83
Attachment 6, Page 23 of 83
Attachment 6, Page 24 of 83
Attachment 6, Page 25 of 83
Attachment 6, Page 26 of 83
Attachment 6, Page 27 of 83
Attachment 6, Page 28 of 83
Attachment 6, Page 29 of 83
Attachment 6, Page 30 of 83
Attachment 6, Page 31 of 83
Attachment 6, Page 32 of 83
Attachment 6, Page 33 of 83
Attachment 6, Page 34 of 83
Attachment 6, Page 35 of 83
Attachment 6, Page 36 of 83
Attachment 6, Page 37 of 83
Attachment 6, Page 38 of 83
Attachment 6, Page 39 of 83
Attachment 6, Page 40 of 83
Attachment 6, Page 41 of 83
Attachment 6, Page 42 of 83
Attachment 6, Page 43 of 83
Attachment 6, Page 44 of 83
Attachment 6, Page 45 of 83
Attachment 6, Page 46 of 83
Attachment 6, Page 47 of 83
Attachment 6, Page 48 of 83
Attachment 6, Page 49 of 83
Attachment 6, Page 50 of 83
Attachment 6, Page 51 of 83
Attachment 6, Page 52 of 83
Attachment 6, Page 53 of 83
Attachment 6, Page 54 of 83
Attachment 6, Page 55 of 83
Attachment 6, Page 56 of 83
Attachment 6, Page 57 of 83
Attachment 6, Page 58 of 83
Attachment 6, Page 59 of 83
Attachment 6, Page 60 of 83
Attachment 6, Page 61 of 83
Attachment 6, Page 62 of 83
Attachment 6, Page 63 of 83
Attachment 6, Page 64 of 83
Attachment 6, Page 65 of 83
Attachment 6, Page 66 of 83
Attachment 6, Page 67 of 83
Attachment 6, Page 68 of 83
Attachment 6, Page 69 of 83
Attachment 6, Page 70 of 83
Attachment 6, Page 71 of 83
Attachment 6, Page 72 of 83
Attachment 6, Page 73 of 83
Attachment 6, Page 74 of 83
Attachment 6, Page 75 of 83
Attachment 6, Page 76 of 83
Attachment 6, Page 77 of 83
Attachment 6, Page 78 of 83
Attachment 6, Page 79 of 83
Attachment 6, Page 80 of 83
Attachment 6, Page 81 of 83
Attachment 6, Page 82 of 83
Attachment 6, Page 83 of 83
MULTNOMAH COUNTY CONTRACT
Contract Number: 4400003077
Exhibit 1: Confidentiality, Privacy, and Security
This Exhibit 1: CONFIDENTIALITY, PRIVACY, AND SECURITY is attached and incorporated into the Origami Risk Software Subscription
Agreement (“Contract”). A breach of this Exhibit 1 is a Material Default. For purposes of this Exhibit 1, “Contractor” shall mean Origami
Risk LLC.
1.Public Records Law. As a custodian of Records under
ORS 192.410(1), and the public body responsible under
ORS 192.430(2) and ORS 192.450(2) with responding to public
records requests, County must respond to public records
requests concerning Records – which includes the Contract and
related documentation. If Contractor asserts that any Records,
including some or all of the Contract, disclosed hereunder meets
the statutory requirements under the Public Rec ords Law for
one or more exemptions and wishes that an exemption be
asserted to prevent public disclosure of any Record, it will:
(i) notify County of its assertion; (ii) identify with adequate
specificity the Records to which it asserts an exemption applies
and the basis for such assertion; and (iii) as commercially
practical, mark with the words “DISCLOSURE EXEMPT” all
Records containing information that it desires not be publicly
disclosed. In the event of a Proceeding that occurs at
Contractor’s request or seeks disclosure of a Record which
Contractor believes is exempt, County will have complete
control over the defense of the application of the exemption and
Contractor will bear the legal fees and costs associated with
such defense. In such event, Contractor acknowledges and
agrees that County will bear no liability related to any disclosure
pursuant to the Public Records Law or Loss associated with
such defense. Any disclosure by either Party of a Record, in
whole or in part, will not be a breach of the Contract if such
disclosure was pursuant to a request under the Public Records
Law that is required based on court order, reasonable
interpretation of the Public Records Law, related case law,
public record orders of the Oregon Attorney General, or the
Attorney General’s then current edition of the Public Records
and Meetings Manual.
2.Confidentiality.
a.“Confidential Information” means the non-public
information of either Party relating to its business activities ,
operations, financial affairs, technology, marketing or sales
plans, or other information marked “PROPRIETARY” or
“CONFIDENTIAL” or “DISCLOSURE EXEMPT”, that is
disclosed to, and received by, the other Party under this
Contract. “Confidential Information” does not include Protected
Data (which, for purposes of this Exhibit 1, has the same
definition as “Client Data” under the Contract).
b.The Parties acknowledge and agree: (i) to exercise
the same degree of care and protection, but no less than a
reasonable degree of care and protection, over the other Party’s
Confidential Information and Protected Data as each Party
exercises with respect to its own similar information; (ii) that all
Confidential Information disclosed pursuant to the Contract
should be considered confidential and proprietary; (iii) not to use
any Confidential Information or Protected Data during the Term
and for two years thereafter for any purpose other than as
permitted under the Contract; (iv) not to disclose or provide any
Confidential Information or Protected Data to any third-party,
except as expressly authorized in writing or required by law;
(v) not to remove or destroy any proprietary markings on the
Confidential Information or Protected Data; and (vi) to return or
destroy all of the other Party’s Confidential Information and
Protected Data on the expiration or termination of the Contract,
unless prohibited by law or otherwise provided in the Contract .
As requested, a Party shall certify to the other the destruction of
any of the other’s Confidential Informa tion or Protected Data, as
applicable, within its possession or control.
c.The Contract does not require the Parties to protect
information that: (i) was known or readily ascertainable by
proper means before being disclosed; (ii) is or becomes
available to the general public without fault or action of either
Party; (iii) is disclosed to either Party by a third-party that
breaches no confidentiality obligation through that disclosure;
(iv) is developed independently by either Party without reference
to or use of Confidential Information; or (v) is required to be
disclosed by law or to a government authority.
d.Disclosure by either Party of Confidential Information
or Protected Data to its professional advisors, employees,
agents, affiliates, subsidiaries, subcontractors, and consultants
is authorized only to the extent: (i) such disclosure is necessary
to enable the performance of its obligations under the Contract ;
and (ii) such parties receiving Confidential Information are
comparably bound to safeguard and keep confidential such
information.
3.Information Security. Each Party acknowledges and
agrees it has implemented appropriate risk management
techniques, including administrative, technical, and physical
safeguards, to protect and ensure continuity of access to
Information Systems and Records. Without limitation, the
technical safeguards will incorporate industry recognized
system hardening techniques. The Parties will at least annually
audit their safeguards to help ensure all Information Systems
within their respective control and involved in storing, using, or
transmitting Protected Data, are secure and protect the data
from unauthorized disclosure, modification, or destruction.
Where a Party, or their employees, agents, third-party
processors, or permitted subcontractors , have access to the
other Party’s Information System(s), Records, or facilities, the
Party with such access will comply with the following:
a.Security Undertaking. Without limiting the
obligation of confidentiality described in this Exhibit 1 at
Section 2, the Parties will be responsible for establishing and
maintaining an information security program that is compliant
with all relevant federal and state laws and otherwise designed
to: (i) ensure the security and confidentiality of the Information
System(s); (ii) protect against any anticipated threats or hazards
to the security or integrity of the Information System(s);
(iii) protect against unauthorized access, modification, or use of
the Information System(s); (iv) ensure the proper disposal of
data stored or exchanged on the Information System(s); and
(v) ensure that all employees, agents, permitted subcontractors
Multnomah County Contract # 44000003077
1 of 49
EXECUTED
Attachment 7, Page 1 of 49
of Contractor, and third-party processors, if any, comply with all
of the foregoing.
b.Access Controls. Each Party will take necessary
and reasonable precautions to appropriately limit access by their
respective employees, agents, affiliates, subcontractors, and
other representatives to the other Party’s Information Systems.
If Contractor will have access to County premises, Contractor
will employ such precautions to also limit access to County
premises, including promptly notifying County in the event a
representative assigned to a County project has been
terminated, and assisting County with the recovery of any data,
access credentials, or technology in a Contractor
representative’s possession following termination or completion
of the services.
c.SaaS Hosting Protected Data. The following
provisions apply if the SaaS will or may host Protected Data.
i.Audit by Contractor. No more than annually,
Contractor, at its own expense, will conduct a SOC 2 or
equivalent audit of Contractor’s information security program
and provide such audit findings to County upon formal written
request.
ii.Audit Findings. In the event that Contractor’s
SOC 2 audit report contains a qualified opinion from the auditor
based on certain specified deficiencies in Contractor’s controls
or security posture, then Contractor will promptly remediate any
such deficiencies.
iii.Access to County Data. Contractor will log
access by County Users to the Origami application and allow
County to set permissions for each such County User’s ability to
access Protected Data. Access reports will be made available
to County upon request.
iv.Admin Logging. Contractor will log which
administrators of Contractor have access to Protected Data at
any given time. Such reports will be made available to County
upon request.
4.Service Continuity. Contractor must have a business
continuity plan in place and must evaluate the IT disaster
recovery portion of such plan at least annually. The plan must
address procedures for response to emergencies and other
business interruptions. Specifically, the plan must demonstrate
that, in the event of a disaster or other service or business
interruption, Contractor has provided for: (i) backing up and
storing data at a location sufficiently remote from the facilities at
which Information System(s) are hosted in case of loss of that
data at the primary site; (ii) rapid restoration, relocation, or
replacement of resources associated with County Information
System(s); (iii) short and long-term restoration, relocation, or
replacement of resources that will ensure t he smooth
continuation of operations related to County Information
System(s); and (iv) reviewing, testing, and adjusting the plan
based on its at least annual evaluation .
5.Access to Protected Data. In the event Contractor will
have access to County Protected Data, whether in electronic or
paper form, Contractor agrees to institute and maintain
safeguards or restrictions that are designed to:
a.restrict and control access to facilities housing
County Information Systems or paper documents containing
Protected Data, or hosting SaaS used to process Protected
Data, including establishing and observing procedures for
tracking access and chain of custody thereof;
b.limits access to Protected Data to only the minimum
data necessary to accomplish the intended purpose of the
access;
c.limits the access, use, disclosure, and dissemination
of data to authorized purposes and to those authorized
individuals that need access to Protected Data; and
d.requires that all individuals prior to receiving access
to Protected Data submit to and pass a criminal history records
check.
Contractor does not permit its employees to use their personal
portable computing devices (that are not owned by Contractor)
to store Protected Data or access Contractor’s internal system
network in the provision of services, and Contractor has an
internal policy that prohibits any such storage or access.
6.Security Breach. In the event of an actual or suspected
security breach involving its Information System(s) and resulting
in unauthorized access to or disclosure of Protected Data,
Contractor will promptly (and in any event within five days of
discovery) notify County of the breach or suspected breach
upon learning of such breach and will comply with all applicable
breach notification laws. Contractor agrees to cooperate with
County in the investigation and remedy of any such breach,
including, without limitation, complying with any law concerning
unauthorized access or disclosure, as may be reasonably
requested by County. Contractor will promptly reimburse County
for the costs of any breach notifications, expenses, or other fees,
including any state or federal fines associated with a breach of
Protected Data while in Contractor’s possession or control and
due to a breach by Contractor of this Agreement. Contractor will
send any applicable notifications regarding a security breach to
the following notification email address: IT.Security@multco.us.
7.Right of Audit by County. County will have the right to
review Contractor’s information security program prior to the
Effective Date and from time to time during the Term. Contractor
may complete an audit questionnaire provided by County, which
must be returned to County within 45 days of the date Contractor
received the questionnaire.
8.Response to Orders and Requests for Data. If either
Party receives a subpoena, warrant, or other legal order,
demand or request (collectively, a “Request”) seeking Records
or any data of the other Party, the Party receiving the Request
will promptly provide a copy of the Request to the other Party
along with copies of Records or data in their possession that the
Party believes are responsive to the Request. In the event of a
Request the Parties agree to consult, cooperate, and
collaborate with each other in their responses.
Multnomah County Contract # 44000003077
2 of 49
EXECUTED
Attachment 7, Page 2 of 49
Updated April 2015 JCO Exhibit 2 – Multnomah County Services Contract
EXHIBIT 2
MULTNOMAH COUNTY SERVICES CONTRACT
Contract No. 4400003077
INSURANCE REQUIREMENTS
Contractor shall at all times maintain in force at Contractor’s expense, each insurance noted below: **
Workers’ Compensation insurance in compliance with ORS 656.017, which requires subject employers to provide workers’ compensation
coverage in accordance with ORS Chapter 656 or CCB (Construction Contractors Board) for all subject workers. Contractor and all
subcontractors of Contractor with one or more employees must have this insurance unless exempt under ORS 656.027(See Exhibit
4).
Employer’s Liability Insurance with coverage limits of not less than $500,000 must be included.
THIS COVERAGE IS REQUIRED. If Contractor does not have coverage, and claims to be exempt, attach Exhibit 4 in lieu of Certificate.
Out-of-state Contractors with one or more employees working in Oregon in relation to this contract must have Workers’ Compensation
coverage from a state with extraterritorial reciprocity, or they must obtain Oregon specific Workers’ Compensation coverage. ORS 656.126.
Professional Liability insurance covering any damages caused by error, omission or any negligent acts of the Contractor, its sub-
contractors, agents, officers, or employees performance under this Contract. Combined single limit per occurrence shall not b e less than
$1,000,000. Annual aggregate limit shall not be less than $2,000,000.
If this box is checked the limits shall be $X,000,000 per occurrence and $X,000,000 in annual aggregate
Required by County Not required by County (Needs Risk Manager’s Approval)
Commercial General Liability insurance with coverages satisfactory to the County, on an occurrence basis, with a combined single limit
of not less than $1,000,000 each occurrence for Bodily Injury and Property Damage, with an annual aggregate limit of $2,000,000.
Coverage may be written in combination with Automobile Liability Insurance (with separate limits).
If this box is checked the limits shall be $X,000,000 per occurrence and $X,000,000 in annual aggregate.
If this box is checked the State of Oregon shall also be named as an Additional Insured.
Required by County Not required by County (Needs Risk Manager’s Approval)
Commercial Automobile Liability covering all owned, non-owned, or hired vehicles. This coverage may be written in combination with
the Commercial General Liability Insurance (with separate limits). Combined single limit per occurrence shall not be less than $1,000,000.
If this box is checked the limits shall be $X,000,000 per occurrence.
If this box is checked the State of Oregon shall also be named as an Additional Insured.
Required by County Not required by County (Required if vendor is transporting and/or driving as part of performing the
duties specified in the contract)
Cyber Liability This errors and omissions insurance shall include coverage for third party claims and losses including with respect to
network risks (such as data breaches, transmission of virus/malicious code; unauthorized access or criminal use of third part y, ID/data
theft) and invasion of privacy regardless of the type of media involved in the loss of private information (such as computers, paper files and
records, or voice recorded tapes), covering collection, use, access, etc. of personally identifiable information., direct lia bility, as well as
contractual liability for violation of privacy policy, civil suits and sublimit for regulatory defense/indemnity for payment of fines and penalties.
Combined single limit per occurrence shall not be less than $5,000,000. Annual aggregate limit shall not be less than $5,000,000.
The retroactive coverage date shall be no later than the effective date of this contract.
Contractor shall maintain an extended reporting period for not less than two (2) years after termination of this contract.
Required by County
Additional Requirements: Coverage must be provided by an insurance company authorized to do business in Oregon or rated A - or better by
Best’s Insurance Rating. Contractor shall pay all deductibles and retentions. Contractor’s coverage will be primary in the event of loss.
Tail Coverage - If any of the liability insurance coverages shown are on a "claims made" basis, "tail" coverage will be required at the completion
of the Contract for a duration of 24 months, or the maximum time period reasonably available in the marketplace. Contractor shall furnish
certification of "tail" coverage as described or continuous "claims made" liability coverage for 24 months following Contract completion.
Continuous "claims made" coverage will be acceptable in lieu of "tail" coverage provided i ts retroactive date is on or before the effective date of
the Contract. If continuous "claims made" coverage is used, Contractor shall keep the coverage in effect for duration of not less than 24 months
from the end of the Contract. This will be a condition of Final Acceptance.
Multnomah County Contract # 44000003077
3 of 49
EXECUTED
Attachment 7, Page 3 of 49
Updated April 2015 JCO Exhibit 2 – Multnomah County Services Contract
Certificate of Insurance Required: Contractor shall furnish a current Certificate of Insurance to the County. Contractor shall provide
renewal Certificates of Insurance upon request. Contractor shall promptly notify the County of any change in insurance coverage
that would result in the requirements of this exhibit not being met.
The County must be listed as an Additional Insured by Endorsement (or by policy language based on written contract) on any General
Liability Policy on a primary and non-contributory basis. Such coverage will specifically include products and completed operations
coverage. The Certificate shall state the following in the description of operations: “Additional Insured Form (include form number) at tached.
This form is subject to policy terms, conditions and exclusions.” Certificate holder should be: Multnomah County Risk Management, 501
SE Hawthorne Ave. Suite 400, Portland, OR 97214.
Where in the County to send your Certificate of Insurance. Risk Management has an email address that all insurance certificates should be
sent to: insurance@multco.us. Additional originals, hard copies, or faxes are not necessary.
Completed by:_________Ken Scholes_______________
Contract Originator
Multnomah County Contract # 44000003077
4 of 49
EXECUTED
Attachment 7, Page 4 of 49
Multnomah County Contract # 44000003077
5 of 49
EXECUTED
Attachment 7, Page 5 of 49
Multnomah County Contract # 44000003077
6 of 49
EXECUTED
Attachment 7, Page 6 of 49
Multnomah County Contract # 44000003077
7 of 49
EXECUTED
Attachment 7, Page 7 of 49
Multnomah County Contract # 44000003077
8 of 49
EXECUTED
Attachment 7, Page 8 of 49
Multnomah County Contract # 44000003077
9 of 49
EXECUTED
Attachment 7, Page 9 of 49
Multnomah County Contract # 44000003077
10 of 49
EXECUTED
Attachment 7, Page 10 of 49
Multnomah County Contract # 44000003077
11 of 49
EXECUTED
Attachment 7, Page 11 of 49
Multnomah County Contract # 44000003077
12 of 49
EXECUTED
Attachment 7, Page 12 of 49
Multnomah County Contract # 44000003077
13 of 49
EXECUTED
Attachment 7, Page 13 of 49
EXECUTED
Attachment 7, Page 14 of 49
Multnomah County Contract # 44000003077
15 of 49
EXECUTED
Attachment 7, Page 15 of 49
Multnomah County Contract # 44000003077
16 of 49
EXECUTED
Attachment 7, Page 16 of 49
Multnomah County Contract # 44000003077
17 of 49
EXECUTED
Attachment 7, Page 17 of 49
Multnomah County Contract # 44000003077
18 of 49
EXECUTED
Attachment 7, Page 18 of 49
Multnomah County Contract # 44000003077
19 of 49
EXECUTED
Attachment 7, Page 19 of 49
Multnomah County Contract # 44000003077
20 of 49
EXECUTED
Attachment 7, Page 20 of 49
Multnomah County Contract # 44000003077
21 of 49
EXECUTED
Attachment 7, Page 21 of 49
Multnomah County Contract # 44000003077
22 of 49
EXECUTED
Attachment 7, Page 22 of 49
Multnomah County Contract # 44000003077
23 of 49
EXECUTED
Attachment 7, Page 23 of 49
EXECUTED
Attachment 7, Page 24 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
General Requirements X
The ability to offer role based
security
Non-
functional/tech X
Confirmed. Origami provides for role-based
security control of access to all areas and
features of the system, including access to
specific modules, screens, forms, fields, data-
sets, records, and functions. Logins are
associated with data access roles as well as
system feature roles.
The ability to offer field-
based security
Non-
functional/tech X Confirmed.
The ability to create and use
user defined fields Functional X
Confirmed. Origami provides the ability to
implement any uniquely desired field labels,
client-defined database fields and tables, well
as client-defined UI screens, business rules,
and workflows based on built-in or client-
defined data elements.
Exhbit 3A: Functional
Requirements
Multnomah County Contract # 44000003077
25 of 49
EXECUTED
Attachment 7, Page 25 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to have a
calendar reminder push of
upcoming tasks Functional X
Confirmed. Origami provides a diary function,
referred to as “Tasks”. Tasks are stored as a
separate data type that can be attached to an
object in any module, and can also stand
alone as a to-do item unrelated to any other
object.
Assigned tasks appear on a user's
homepage, and can be configured to trigger
automated reminders sent via email to the
assigned system user. In addition, Origami
delivers a robust "Tasks" module and related
Report templates for management of tasks
across many users, categories, status, date
ranges, etc. Tasks can also be grouped by
projects.
Tasks also appear on the detail page of the
related record, and can be displayed in an
expanded list view of related notes, or viewed
individually in full detail.
Workflows for automatic creation and
assignment of Tasks may be created and
managed via on-screen tools.
Origami provides the ability to store Tasks as
“Appointment” records, with a start and stop
time, and viewable in a built-in calendar view.
This calendar view is useful for displaying
upcoming legal hearings or any scheduled
events for the logged in user, as well for
other users whose schedules are shared with
the logged in user, based on a client’s unique
The ability to have adjuster
notes Functional X
Risk Management/Adjusters need
to be able to document activities
associated with a claim or
incident. This can include phone
calls, investigation notes,
reminders to follow up on specific
items, etc.
Confirmed. Adjuster Notes can easily be
attached to Claim records in Origami, with
rich-text formatting options, note templates
for ease of note entry, and folders and
categories to keep notes organized.
Multnomah County Contract # 44000003077
26 of 49
EXECUTED
Attachment 7, Page 26 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to attach any type
of document needed to any
record (audio, video, photos,
documents, etc)Functional X
A record would be a user defined
incident, accident, or claim. We
could take an incident notification
form, document the incident,
assign it an incident number, if the
incident turns into a claim, then
the same incident number would
follow it. I'm not sure who settled
on "record" but the concept is the
same. A record would be any
incident or accident, workers
comp injury, etc that we want to
track. The ability to attach any
type of document, such as photos,
voicemails as mp3's, recorded
statements under oath, etc, just
follows. We want to be able to
store any file we need to use as
evidence or supporting
documentation in one place,
rather than having to keep both a
virtual and paper file of an
incident.
Confirmed. Any type of electronic file can be
attached to virtually any type of record in
Origami.
Documents, photographs, emails, and letters
and notes attached to incident and claim
records may easily be organized into specific
folders or categorized with client-defined
labels as desired by the County, and security
rights can be configured to that only
appropriate users may view specific types of
attachments.
Ability to generate invoices to
make claims payments
through Accounts Payable Functional X
Unallocated claims expenses that
won't be paid by the TPA need a
billing process in order to pay for
items through the Risk fund. The
invoice would be processed like
any other invoice by Accounts
Payable. Interface or manual
payment: both are possible.
Confirmed. More detail would be required to
implement this, but it would most likely be
accomplished by tracking these payments
with a specific payment category, and
creating a custom report template for the
invoices.
Multnomah County Contract # 44000003077
27 of 49
EXECUTED
Attachment 7, Page 27 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to generate and
store forms and letters used
in repeatable processes
(mail merges)Functional X
Confirmed. Origami provides clients the
ability to create their own letter and form
templates in Microsoft Word and PDF format
with full mail-merge functionality for dynamic
population of data from the related Claim file
or any other type of record. These letters and
forms are viewable and editable before
printing and/or saving in Origami as
attachments related to Claims or other types
of records.
Additionally, Origami Risk maintains a fully up-
to-date & compliant library of official state
forms via our partnership with ClaimWire. All
fields in state forms are mapped to the
appropriate fields from the Origami database,
for dynamic population of all values wherever
possible when a form is opened in Origami.
Besides dynamic population of database
values into client-defined and official state
letters and forms when launched manually,
Origami also provides the ability to
automatically generate fully populated letters
and forms based on event and notification
triggers, for advanced workflows designed to
minimize effort related to correspondence.
Multnomah County Contract # 44000003077
28 of 49
EXECUTED
Attachment 7, Page 28 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to do mail merges
(or mail merge-like
functionality)Functional X
I currently have to export
insurance data from SRM, into
exel, and run a mail merge in
word. The problem with this
process is that I have to track
information in 5 or 6 different
places to verify the information
that I have is accurate to avoid
sending cert requests to vendors
that have already supplied them
but, because of the peculiarities of
SRM am unable to update their
contracts. It is essential that the
entire cert from notifications, to
SRM updates be able to be
handled in one place from start to
finish. Otherwise it's just creating
another step in a process that
already has too many steps.
Confirmed. The aforementioned mail-merge
functionality for letters and forms may use
any data stored in the Origami database
regardless of the original source of the data
or whether is was imported via an automated
feed or entered manually.
The ability to import address
info from ECC for these
letters Functional X
any RMIS will
not be able to
connect to SAP
in real time and
go out and grab
addresses, so
this
requirement is
more
addressing a
general data
Agreed. The RMIS can import the
data nightly to make sure that the
ECC vendor informaiton it has on
file for correspondence is up to
date. I wouldn't think this should
be too much of an issue.
Confirmed. This would be easily
accomplished using Origami’s Data Import
Center for manual imports, or an automated
import process could be configured and
maintained.
Multnomah County Contract # 44000003077
29 of 49
EXECUTED
Attachment 7, Page 29 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to build business
rules into the system
(workflow)Functional X
Confirmed. Origami includes a powerful
business rules engine. Data Entry Events
and/or Notification Triggers may be
configured in the system to notify users of
any client-defined conditions, or to
automatically perform a great variety of
actions or data updates, in order to enable
any desired workflows.
The ability to create user
definable dashboards based
on assigned roles to provide
relevant information based
on the user’s roles and
responsibilities within the
system Functional X
Confirmed. Origami provides powerful and
flexible dashboard reporting functionality.
Each user has the ability to create
dashboards to meet their desired sets of
metrics, Key Performance Indicators (KPIs),
and other data relevant to the user’s job. Risk
Managers, Supervisors, and other team
leaders can easily add lists of tasks, recently
viewed and/or specific sets of Claims and
Incidents, as well as attractive charts and
graphs depicting loss trends, effectiveness of
safety measures, and countless other
analytics.
The ability to receive
documents via email and
automatically attach to
correct claim number if claim
number is in subject line (or
have some other automated
document attachment
method)Functional
Confirmed. New inbound email messages
with the claim number in the subject line
between <> characters, as well as messages
received in response to messages originally
sent from Origami may automatically be
associated with the relevant claim record.
Multnomah County Contract # 44000003077
30 of 49
EXECUTED
Attachment 7, Page 30 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to incorporate
electronic signatures by
claimants, and employees to
minimize hard copy handling
of forms during the claims
process Functional
Confirmed. Origami supports integration with
DocuSign for Electronic Signature
capabilities. The system may be configured
to work with the County's existing DocuSign
licensing, or Origami Risk may provide
licensing for specific volumes of DocuSign
"envelopes" for an additional fee.
For task reminders the ability
to have user specify both
date and time for both
delivery (document was sent
to X on Y date) and for
upcoming task window time Functional
Confirmed. Tasks in Origami may be
scheduled for a specific Date and Time, and
completed Tasks are time-stamped with the
actual time of completion.
The ability to have “private
notes” to protect the
contents of discoverable
information from non-
interested parties while still
acknowledging the existence
of that information in the
system Functional
Confirmed. Any record type in Origami,
including notes, may be configured to be
accessible to a limited number of system
users based on their unique user account
and/or their security role. Similarly, notes
meeting a specific criteria may be
automatically filtered from any search results
and from any data extracts.
The ability to provide
electronic approval of
claim/reserve processing
that interfaces with any
system used by CFO (clarify)Functional
At what point in
the reserve
processing
process will the
interface need
to occur? What
needs to be
passed from
RMIS?
It doesn't have to be "real time"
but does need to be "as of" dates.
The CAFR process requires the
CFO to get this information.
Reserves, Actuarials, Excess
Premium Allocations, Budget
Allocations, all of this type of
information needs to be able to be
communicated into the CFO's
system.
Confirmed. This would be accomplished by
using the data validation tools available in
data import and export processes.
Multnomah County Contract # 44000003077
31 of 49
EXECUTED
Attachment 7, Page 31 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk ResponseThe ability to interface with
TPA’s (Corvel for workers
comp and Farrell & Assoc for
general liability) for
payments/checks/drafts Functional
Confirmed. Origami Risk routinely configures
automated data feeds from carriers and
TPA’s on behalf of our clients.
Data Analysis/Reporting
The ability for users to run ad
hoc reports with filtering Reporting X
Confirmed. Confirmed. An overview of Ad
Hoc reports and graphs in Origami is
attached as Appendix C to this proposal.
The ability to save ad hoc
reports for future use Reporting X Confirmed.
The ability to export report
data to Excel for further
manipulation Reporting X
Confirmed. Origami supports the ability to
produce perfectly-formatted exports to Excel
from all reports, as well as directly from most
system screens.
The ability to export reports
to other formats (PDF, Word,
etc)Reporting X
Confirmed. Reports in Origami include the
option to export data to Excel, Word, and
PDF formats.
Multnomah County Contract # 44000003077
32 of 49
EXECUTED
Attachment 7, Page 32 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to forecast or
trend data Reporting X
Would it be
acceptable to
export data
from the RMIS
and do
forecasting and
trending using
another tool?
No, this really can't be created
using another tool. This is the tool.
The ability to have all of our loss
information in one central location
to include statistical modeling and
predictive analytics is a key
benefit of a RMIS system.
Otherwise we're only purchasing a
claims management program.
The RMIS needs to be able to
track incidents, the number of
incidents that turn into claims, to
be able to statistically show what
types of incidents turn into claims
and what the costs associated
with thos claims are. Tying, the
incident tracking, claims
management, location info, asset
info, workers comp info, financial
info, etc, altogether to get
accurate data and trend analysis
is critical for developing longterm
loss prevention strategies. It
really needs to be integrated into
the RMIS, not an additional
statistical modeling tool.
Confirmed. Many of the reports in Origami
are focused on targeted trending and
forecasting, based on historical values and
loss data, with the ability to easily apply
custom filters, grouping and sorting,
formulas, and other options.
Origami provides over 75 pre-defined
Standard Report Templates, which are fully
pre-formatted to optimally display data as it
pertains to each report.
Origami also allows clients to define their own
Custom Report Templates, which maybe
formatted and configured to display any
combination of fields from the database, as
well as calculated values, in any style and
arrangement desired. Reports based on
custom templates may be scheduled and/or
delivered to any individual or distribution
group(s) via email.
There is no limit to the number of Custom
Report Templates the County could create,
starting either from scratch or from one of the
provided “Starter Templates”.
Built-in analytics Reporting
Confirmed. Origami provides many built-in
analytics throughout the system, primarily in
the Dashboard and Reports modules, but
also within each specific area such as
Claims, Locations, Policies, etc.
Multnomah County Contract # 44000003077
33 of 49
EXECUTED
Attachment 7, Page 33 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability to generate
graphical representations of
data (pie charts, graphs, etc)Reporting X
Confirmed. Origami provides the ability to
generate built-in graphs and charts in many
Dashboard widgets and Report templates, as
well as with an Ad Hoc graphing too. See
Appendix C for more detail.
The ability to schedule
reports to be sent
automatically to a person or
group of people Reporting
Confirmed. Reports and Dashboards may be
scheduled individually or as part of a report
package to be delivered to a specified
recipient or distribution group.
The ability to provide loss
development factor reporting Reporting
Confirmed. Origami provides the ability to
create and edit multiple Loss Development
Factor formulas for reporting purposes.
SecurityThe ability to comply with all
Multnomah County system
and data security policies
and practices
Non-
functional/tech X
Confirmed. More detail provided in Technical
and Non-Functional Requirements section
below.
Inventory/Asset
drawing a distinction
between inventory and
assets Functional X
Confirmed. Inventory in Origami is typically
tracked as a specific type of Value within
Locations module, along with other Values
such as Building Square Footage, TIV, etc.
Assets may also be associated with
Locations, but they are tracked as a separate
data type in a dedicated module.
associating a property type
with in-force insurance for
that property type Functional X
Confirmed. Origami’s Policy management
features track active policies related to
“Named Insureds”, which may be specific
Locations, entire Territories, or specific
contacts.
Multnomah County Contract # 44000003077
34 of 49
EXECUTED
Attachment 7, Page 34 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
drawing a distinction
between capital assets
(purchase price >$10K) and
non-capital Functional X
Confirmed. This could be accomplished by
tracking a simple Boolean field to properly
distinguish between the two asset types. The
field could be automatically populated based
on the value of the relevant record.
The ability to retire an asset
either on a schedule or at will Functional X
Confirmed. This could be accomplished with
a date-field to track retirement date, and an
automated business rule to calculate the date
value, while also allowing for manual editing
of the date value.
Ability to store electronic
copies of
documents/certifications and
associate it with an asset Functional X
Confirmed. Any type of electronic file can be
attached to virtually any type of record in
Origami.
This includes documents and certifications
associated with Asset records.
Training & CertificationsThe ability to track
certifications and continuing
education requirements
(both the status of existing
certifications and upcoming
needed
certifications/requirements)Functional X
Confirmed. Origami provides the ability to
track status of current, expiring, or expired
training and certification requirements for
County employees, with unique sets of
requirements based on an employees
specific profile.
Ability to track associated
records such as respirator fit
tests and audiograms.Functional X
Confirmed. This would be configured as a
specific type certification, by adding client-
defined fields to track the pertinent data
elements in each case.Ability to store electronic
copies of
documents/certifications and
associate it with an
employee Functional X
Confirmed. Origami allows any type of image
or document file to be associated with any
type of record, including employee
certifications.
Multnomah County Contract # 44000003077
35 of 49
EXECUTED
Attachment 7, Page 35 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
Ability to import current SAP
training and attendance logs
for employees Functional X
As discussed,
cannot be a real
time SAP
interface
Agreed, this can be a scheduled
automatic export/import of data.
Confirmed. The imported SAP training and
attendance log data would serve as the basis
for each employee’s compliance status with
regard to their applicable requirements.
Ability to send email alerts to
employees and supervisor
alerting them of expirations
on a scheduled basis (30
day, 60 day, 90 days for Functional X
Confirmed. This is standard functionality of
the employee training and certification
module.
Ability to export updated
training information to other
systems Functional
Confirmed. Origami supports the export of
any data stored in the system, provided the
user triggering the export has the proper
user/role permissions.
Driver Safety Program
The ability to track driver
history of complaints,
warrants, citations,
suspensions, accidents,
incidents, and associated
claims costs by driver,
accident type and
preventability Functional
Confirmed. This would be configured using
the aforementioned employee training and
certification module. Other records related to
the employee, such as complaints, accidents,
claims, incidents, etc., would be displayed
within separate grids on the same employee
detail screen.
The ability to track accidents
by user specified types and
causes and be able to
present and track costs and
trends.Functional
Confirmed. Origami provides clients the
ability to maintain their own unique sets of
values in code tables related to any type of
records, including accident attributes such as
Type and Cause.The ability to track Vehicle
Accident Review Committee
(VARC) determinations of
preventability, additional
training, and completion Functional
Confirmed. This would likely be configured as
a client-defined child-record related either to
the Employee or Vehicle record, or to both.
The ability to sort the above
data and export to other
formats for presentation and Functional
Confirmed. This is standard functionality of
Origami.
Multnomah County Contract # 44000003077
36 of 49
EXECUTED
Attachment 7, Page 36 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk ResponseThe ability to track drivers
license information by State,
Class, Endorsements,
Restrictions, Expiration Date,
Medical Certification
Expiration Date Functional
Confirmed. This would likely be configured as
a combination of built-in and client-defined
fields in the Employee record, for specific
profiles of employees who drive County
vehicles.
Audit
the ability to provide a
system audit log detailing
user actions and access
Non-
functional/tech X
Yes, Origami logs all login activity, as well as
all changes performed in the system, with
details of what changed as well as when and
by whom the changes were applied.
Remote Claim Reporting
The ability to have platform-
agnostic remote access
(phone as well as computer)Functional X
Confirmed. The Origami system is built on a
modern web-based technology platform
accessible via any current web browser
(Internet Explorer, Safari, Chrome, Firefox,
etc.) on either PC or Macintosh computers,
as well as on iOS and Android mobile
devices.
The ability to have a dynamic
single source report (One
URL for incident reporting
capture, etc)Functional X
Confirmed. Origami provides an optional
“Enterprise Data Entry Portal” which allows
any employee or affiliate of a client to submit
reports of new incidents, as well as other
types of data, without the need for individually
named user accounts.
This optional portal designed to allow for
submissions by a large population of people
is accessible via a dynamic URL generated
by Origami which can be shared throughout
the client’s organization. It is used only for
data entry, and does not include access to
view or update any existing data in the
system.
Multnomah County Contract # 44000003077
37 of 49
EXECUTED
Attachment 7, Page 37 of 49
Requirement Category Need Comment/Que Add'l info Origami Risk Response
The ability for the system to
dynamically respond to user
input (if user says X, system
presents one set of
questions, then drills down
as other answers are given;
if user says Y, it presents
another, etc)Functional X
Confirmed. The Custom Forms design
feature of Origami supports the notion of
“reflexive questions”. This allows for a screen
to initially display only a limited set of
questions and fields, with additional
questions and fields appearing depending on
answers and values entered by the user.
The ability to import and
export data from/to external
systems, including but not
Non-
functional/tech X
Confirmed. This is standard functionality of
Origami.
Multnomah County Contract # 44000003077
38 of 49
EXECUTED
Attachment 7, Page 38 of 49
Multnomah County Contract # 44000003077
39 of 49
EXECUTED
Attachment 7, Page 39 of 49
Multnomah County Contract # 44000003077
40 of 49
EXECUTED
Attachment 7, Page 40 of 49
Multnomah County Contract # 44000003077
41 of 49
EXECUTED
Attachment 7, Page 41 of 49
MULTNOMAH COUNTY CONTRACT
Exhibit 6: Business Associate Agreement
This EXHIBIT 6: BUSINESS ASSOCIATE AGREEMENT is attached and incorporated into the Multnomah County
Contract (“Contract”). A breach of this Exhibit 6 is a Material Default.
1. General. For purposes of this Contract,
Contractor is County’s Business Associate and will
comply with the obligations set forth below and under
HIPAA. Contractor and County agree to amend this
Contract if necessary to allow County to comply with
the requirements of HIPAA and its implementing
regulations.
2. Definitions. Terms used, but not otherwise
defined in this section or Schedule A, will have the
same meaning as those terms in 45 CFR 160.103,
164.103, 164.402 and 164.501. A reference to a
regulation means the section as in effect or as
amended, and for which compliance is required.
a.“Breach” is defined in 45 CFR 164.402 and
includes the unauthorized acquisition, access, use, or
disclosure of PHI that compromises the security or
privacy of such information.
b.“Designated Record Set” is defined in
45 CFR 164.501.
c.“Individual” is defined in 45 CFR 160.103
and includes a person who qualifies as a personal
representative in accordance with 45 CFR 164.502(g).
d.“Privacy Rule” means the standards for
privacy at 45 CFR Part 160 and Part 164, subpart A
and E.
e.“Required by Law ” is defined in 45 CFR
164.103.
f.“Secretary” means the Secretary of the U.S.
Department of Health and Human Services (HHS) or
designee.
g.“Security Rule” means the Standards for
Security of Individually Identifiable Health Information
at 45 CFR Part 160 and Part 164, subpart A and C.
h.“Transaction Rule” means the standards
and rules regarding electronic data interchange (EDI)
found in 45 CFR Part 162, subpart S, that require
Covered Entities and Business Associates that
electronically transmit data to use certain data
transmission protocol standard formats.
i.“Unsecured PHI” means PHI that is not
secured through the use of a technology or
methodology specified by the Secretary in guidance or
as otherwise defined in 45 CFR 164.402.
3. Contractor’s Obligations.
a.Contractor agrees to not use or disclose PHI
other than as permitted or required by this Contract or
as Required by Law. Contractor further agrees to use
or disclose PHI only on behalf of, or to provide services
to, County in fulfilling Contractor’s obligations under
this Contract, and to not make uses or disclosures that
would violate the Privacy Rule if done by County or
violate the minimum necessary standard as described
below.
b.When using, disclosing, or requesting PHI,
Contractor agrees to make reasonable efforts to limit
the PHI disclosed to the minimum necessary to
accomplish the intended purpose of the use, disclos ure
or request, in accordance with 45 CFR 164.514(d),
with the following exceptions:
i.disclosures to or requests by a health
care provider for treatment;
ii.disclosures made to the Individual
about his or her own PHI;
iii.uses or disclosures authorized by the
Individual;
iv.disclosures made to the Secretary in
accordance with the Privacy Rule ;
v.uses or disclosures that are Required
by Law; and
vi.uses or disclosures that are required
for compliance with the Transaction Rule.
c.Contractor is directly responsible for
compliance with the requirements of the Privacy Rule
and Security Rule to the extent applicable to
Contractor.
d.Contractor agrees to use appropriate
safeguards to prevent use or disclosure of the PHI
other than as provided for by this Contract.
e.Contractor agrees to implement
administrative, physical, and technical safeguards that
reasonably and appropriately protect the
confidentiality, integrity, and availability of the
electronic PHI that it creates, receives, maintains, or
transmits on behalf of County as required by 45 CFR
164 Subpart C.
f.Contractor agrees to notify County as soon
as practicable but not later than within five days of any
Multnomah County Contract # 44000003077
42 of 49
EXECUTED
Attachment 7, Page 42 of 49
known or suspected incident or complaint involving
PHI, including use or disclosure of PHI in violation of or
not provided for by this Contract of which it becomes
aware.
Notwithstanding the foregoing, the
Parties acknowledge and agree that this section
constitutes notice by Contractor to County of the
ongoing existence and occurrence of security incidents
that are “unsuccessful” and do not represent risks to
PHI, such as “pings” on a firewall.
g.Contractor will promptly notify County of a
Breach of Unsecured PHI of which Contractor (or
Contractor’s employee, subcontractor, officer or agent)
knows. Contractor’s notification to County must:
i.Be in writing and provide an
individual’s contact information if needed for County’s
follow up communications.
ii.Be made to County without
unreasonable delay and no later than 30 calendar days
after discovery of the Breach. A Breach is considered
discovered as of the first day on which the Breach is
known, or reasonably should have been known, to
Contractor, subcontractor of Contractor, or any
employee, officer or agent of Contractor, other than the
individual committing the Breach.
iii.Include the Individuals whose
Unsecured PHI has been, or is reasonably believed to
have been, the subject of a Breach and the types of
PHI involved.
iv.Include the date of the Breach and
date of discovery of the Breach.
v.Include description of what Contractor
is doing to investigate the Breach, to mitigate loss, and
to protect against any further or future Breaches .
vi.Provide all information necessary for
County to notify impacted Individuals under 45 CFR
164.404 without unreasonable delay after Contractor’s
discovery of the Breach.
vii.Provide any and all information,
including preparation of reports or notices, needed for
County to provide notification required under 45 CFR
164.406 and 164.408, as required or requested by
County.
h.Contractor agrees to mitigate, to the extent
practicable and without unreasonable delay, any
harmful effect that is known to Contractor of a use or
disclosure of PHI or Breach of Unsecured PHI by
Contractor in violation of the requirements of this
Contract or HIPAA.
i.Contractor agrees to ensure that any agent,
including a subcontractor, to whom it provides PHI
received from, or created or received by Contractor on
behalf of County, agrees in writing to the same
restrictions and conditions that apply through this
Contract to Contractor with respect to such information
in accordance with 45 CFR 164.502(e)(1)(ii) and
164.308(b)(2).
j.Contractor agrees to provide access to PHI
about an Individual contained in a Designated Record
Set within the time, manner, form and format specified
in Individual’s or County’s request as necessary to
satisfy County’s obligations under 45 CFR 164.524. If
an Individual requests access to information directly
from Contractor, Contractor agrees to forward the
request to County within five working days of receipt.
County will be responsible for any denials of requested
PHI.
k.Contractor agrees to make any
amendments to PHI in a Designated Record Set that
County directs or agrees to pursuant to 45 CFR
164.526 within the time and manner spe cified in
County’s request. Contractor will not respond directly
to requests from Individuals for amendments to their
PHI in a Designated Record Set. Contractor agrees to
forward the request to County within five business days
of receipt.
l.Contractor agrees to make internal
practices, books and records, including policies and
procedures and PHI, relating to the use and disclosure
of PHI received from, or created, maintained or
received by Contractor on behalf of County available to
County or Secretary upon request of County or
Secretary, in a time and manner designated by County
or the Secretary for purposes of the Secretary
determining County’s compliance with HIPAA.
m.Contractor agrees to document disclosures
of PHI and information related to such disclosures as
required for County to respond to a request by an
Individual for an accounting of disclosure of PHI in
accordance with 45 CFR 164.528. Contractor will
make available, at a minimum, the following
information: (i) the date of the disclosure; (ii) the name
of the entity or person who received the PHI, and if
known, the address of such entity or person ; (iii) a brief
description of the PHI disclosed; and (iv) a brief
statement of the purpose of such disclosure which
includes an explanation of the basis for such
disclosure. Contractor agrees to implement an
appropriate record keeping process to comply with this
section.
n.Contractor agrees to provide County or an
Individual, as applicable and within the time and
manner specified in the request from County or
Individual, information under Section 3(m) of this
Exhibit 5, to permit County to respond to a request by
an Individual for an accounting of disclosure of PHI in
accordance with 45 CFR 164.528.
Multnomah County Contract # 44000003077
43 of 49
EXECUTED
Attachment 7, Page 43 of 49
o.Contractor must forward to County within
five working days of receipt any request for restrict ed
or confidential communications as described under
45 CFR 164.522 received from an Individual.
Contractor must process such request in the time and
manner directed by County.
p.If Contractor conducts in whole or part
electronic transactions on behalf of County for which
HHS has established standards, Contractor will comply
and require its subcontractors and agents to comply,
with each applicable requirement of the Transactions
Rule and of any operating rules adopted by HHS with
respect to the standard transactions.
4. Termination.
a.Upon termination of this Contract for any
reason, Contractor will extend the protections of this
Contract to any PHI that Contractor is required to retain
under any provision of this Contract. The terms of this
Contract will remain in effect until all of the PHI
provided by County to Contractor, or created or
received by Contractor on behalf of County, is
destroyed or returned to County; or, if it is infeasible to
return or destroy PHI as agreed upon by County,
protections are extended to such information, in
accordance with the terminati on provisions in this
section.
b.To avoid ambiguity, the obligations of
Contractor under this Section 4 of Exhibit 5 will survive
termination of the Contract.
Multnomah County Contract # 44000003077
44 of 49
EXECUTED
Attachment 7, Page 44 of 49
MULTNOMAH COUNTY CONTRACT
Attachment 1 to Exhibit 6: Electronic Protected Health Information
Guidance
Pursuant to the Business Associate Agreement, Contractor shall have systems, procedures and safeguards to protect
Protected Health Information from unpermitted access or disclosure. This Schedule applies to PHI in electronic and
hard copy/paper form.
Contractor shall review the HIPAA Security Rule and the guidance and framework of NIST Special Publication 800 -53
Rev.4 to implement controls, practices and procedures that will safeguard the PHI created, maintained, received or
transmitted by Contractor on behalf of County or to provide a service to County.
In the event it assists Contractor, the following describes some of County’s suggested best practices that Contractor
may wish to consider. It is not an exhaustive list of all controls, practices and procedures that Contractor should
consider and implement.
1. Access to PHI.
a.General. Access to PHI, in all forms and formats, equipment, systems, networks, applications, and media
is limited to only those employees of Contractor and permitted subcontractor s performing services on behalf of, or to,
County.
i.Process is defined for granting and terminating access.
ii.The list of approved employees and permitted subcontractors is reviewed and updated at least once
per quarter.
b.Physical Access.
i.PHI is stored in a secure facility or area which has appropriate physical controls to limit access (e.g.
locks or access cards).
ii.Physical access to such areas is granted only to those employees of Contractor and permitted
subcontractors performing tasks on behalf of County and is monitored 24 hours per day/7 days per week by Contractor.
iii.Guests and visitors are escorted in secure areas.
c.Electronic Access.
i.Each employee accessing electronic PHI must have a unique account and password.
ii.Contractor prohibits guest accounts which are shared or not tied to an employee.
iii.Employees shall be advised that accounts and passwords cannot be s hared under any circumstances.
iv.Employees must be locked out of their accounts after multiple unsuccessful attempts.
v.Contractor must require employees to have complex passwords and not permit passwords that are
solely words found in the dictionary.
vi.Contractor must force an employee to change their password at a reasonable interval.
vii.Contractor periodically reviews accounts and disab les them when access is no longer required to
perform tasks on behalf of County.
d.Personal Devices.
i.Employees must use passwords on all personal devices that access PHI.
ii.Employees must employ anti -virus software and operating system service packs as they are released
on such personal devices.
Multnomah County Contract # 44000003077
45 of 49
EXECUTED
Attachment 7, Page 45 of 49
iii.Employees must never store PHI on personal devic e, even if password protected.
iv.Deploy mobile device management on personal devices to allow Contractor to remotely wipe any
access to PHI in the event the device is lost or stolen.
2. Restrictions for electronic PHI on Uses of Portable Devices or Media.
a.PHI is not stored, processed, or downloaded on any portable device or storage media without encryption.
Portable devices include without limitation laptops, notebooks, smartphones, USB/jump drives.
b.Laptops are deployed with full disk encryption.
3. Transportation and Transmission of PHI.
a.All data containing PHI must be encrypted when transmitted, such as through VPN, encrypted/secured FTP,
TLS, SSL, or HTTPS.
b.All access and communication to or from the Internet must occur through an actively managed I nternet
firewall.
c.PHI transported in hard copy/paper format must be carried in locked bags and never left unattended, such
as in cars.
4. Software Controls.
a.Employ virus protection on systems or networks which store, process or transmit PHI.
b.Perform real time or periodic scans on all systems or networks which store, process or transmit PHI.
5. Security Training, Awareness, and Sanctions . Ensure all employees that access PHI receive training on
their obligations under this Agreement and the HIPAA Security Rule. Contractor should consider sanctions for any
employee that violates the Contractor’s policies, procedures or obligations under this Agreement or HIPAA.
6. Violations and Audit.
a.Implement technical features or controls to rec ord security-relevant activity.
b.Require employees to immediately report known or suspected incidents, breaches and complaints involving
PHI to Contractor’s privacy and/or security officer.
c.Periodically review activity logs, investigate and resolve incidents identified.
7. Disposal of Files or Media Which Contain PHI.
a.Hard Copy/Paper Format. Physically destroyed such that the PHI is rendered essentially unreadable,
indecipherable, and otherwise cannot be reconstructed via shred ding, burning, or pulverizing.
b.Electronic Format. Fully remove PHI from electronic media prior to reuse or disposal by clearing (using
software or hardware products to overwrite media with non -sensitive data) or purging (degaussing or exposing the
media to a strong magnetic field in order to disrupt the recorded magnetic domains) the PHI.
8. Risk Assessment and Risk Management Plan (see also NIST Special Publication 800-300 Rev.1 and/or
ONC Security Assessment Tool).
a.Prior to creating, receiving, maintaining or transmitting PHI on behalf of County or to provide a service to
County, conduct an accurate and thorough enterprise -wide assessment of the potential risks and vulnerabilities to
confidentiality, integrity, and availability of PHI.
b.Update the assessment as reasonably neces sary in response to environmental and operational changes
affecting the security of PHI not less than once every two years.
c.Maintain and implement an ongoing risk management plan to reduce the identified risks pursuant to the
assessment to reasonable and appropriate levels.
Multnomah County Contract # 44000003077
46 of 49
EXECUTED
Attachment 7, Page 46 of 49
Deborah Kafoury
County Chair
EXECUTED
Attachment 7, Page 47 of 49
EXHIBIT 8
MULTNOMAH COUNTY SERVICES CONTRACT
Contract No. 44000003077
Certification Statement for Corporation or Independent Contractor
NOTE: Contractor Must Complete A or B below:
A. CONTRACTOR IS A CORPORATION, LIMITED LIABILITY COMPANY, OR A PARTNERSHIP.
I certify under penalty of perjury that Contractor is a (check one):
Corporation Limited Liability Company Partnership Non-Profit Corporation authorized
to do business in the State of
Oregon
Signature:
Title: Date:
B. CONTRACTOR IS A SOLE PROPRIETOR WORKING AS AN INDEPENDENT CONTRACTOR.
Contractor certifies under penalty of perjury, that the following statements are true:
1.If CONTRACTOR is providing services under this Contract for which registration is required under ORS
Chapter 671 (architects and landscape contractors) or 701 (construction contractors), CONTRACTOR has
registered as required by law.
2.CONTRACTOR is free to determine and exercise control over the means and manner of providing the
service, subject to the right of the County to specify the desired results.
3.CONTRACTOR is responsible for obtaining all licenses or certifications necessary to provide the services.
4.CONTRACTOR is customarily engaged in providing services as an independent business. CONTRACTOR
is customarily engaged as an independent contractor if at least three of the following statements are true.
NOTE: Check all that apply. You must check at least three (3) to establish that you are an independent
contractor.
A. CONTRACTOR’s services are primarily carried out at a location that is separate from
CONTRACTOR’s residence or primarily carried out in a specific portion of the residence which
is set aside as the location of the business.
B. CONTRACTOR bears the risk of loss related to the services provided under this Contract.
C. CONTRACTOR provides services to two or more persons within a 12-month period or
Contractor routinely engages in business advertising solicitation or other marketing efforts
reasonably calculated to obtain new contracts for similar services.
D. CONTRACTOR makes a significant financial investment in the business.
CONTRACTOR has authority to hire additional persons to provide the services and has
authority to fire such persons.
Contractor
Signature: Date:
Multnomah County Contract # 44000003077
48 of 49
September 26, 2017Robert G. Petrie III, President and CEO
X
EXECUTED
Attachment 7, Page 48 of 49
Exhibit 9 – Equal Employment Opportunity Certification Statement
Every Contractor executing a contract for more than $75,000 must complete this Exhibit.
Equal Employment Opportunity (EEO) means eliminating barriers to ensure that all employees are cons idered
for the employment of their choice and have the chance to perform to their maximum potential. EEO practices
include, but are not limited to, fairness at work, hiring based on merit and promotion based on talent. It concerns
all aspects of employment including recruitment, pay and other rewards, career development and work conditions.
All County Contractors signing new contracts with the County must complete this form. A Contractor who signs
Part 1 and later adds employees during the period of performance of any County Contract must immediately notify
the County of the change in status and submit an updated form with Part 2 signed. Failure to submit an updated
form may result in termination of all existing contracts.
CERTIFICATION
I certify under penalty of perjury that [check Part 1 or Part 2]:
Part 1: Contractor has no employees. Should Contractor hire employees at a later date during the term of
the contract, Contractor will immediately notify the Department that issued the contract and submit an updated
Certification with Part 2 completed.
—OR—
Part 2: Contractor has employees. Contractor, as an Equal Opportunity Contractor, does not:
1.Discriminate against employees or applicants based on race, color, religion, sex, familial status, national
origin, age, mental or physical disability, sexual orientation, gender identity, or source of income;
2.Solicit or consider employment recommendations based on factors other than personal knowledge or
records of job-related abilities or characteristics;
3.Coerce the political activity of any person;
4.Deceive or willfully obstruct anyone from competing for employment;
5.Influence anyone to withdraw from competition for any position so as to improve or injure the employment
prospects of any other person;
6.Give improper preference or advantage to anyone so as to improve or injure the employment prospects of
that person or any other employee or applicant.
Contractors Signature:
Company Name:
Signature:
Title:
Date:
Multnomah County Contract # 44000003077
49 of 49
EXECUTED
Attachment 7, Page 49 of 49
Attachment 8, Page 1 of 8
Attachment 8, Page 2 of 8
Attachment 8, Page 3 of 8
Attachment 8, Page 4 of 8
Attachment 8, Page 5 of 8
Attachment 8, Page 6 of 8
Attachment 8, Page 7 of 8
Attachment 8, Page 8 of 8