Governor and Executive Council Agenda item PDF - 2026-03-04 - agenda 9

Meeting Date

2026-03-04

Attachment Kind Label

Agenda item PDF

Attachment Relation

cross_meeting_reference

Agenda Numbers

9

Agency Names

Department Of Transportation

Parent Meeting Title

Governor and Executive Council meeting - 2026-03-04

Lori A. Shibinette

Commissioacr

Heather M. Moquin

Chief Executive Officer

STATE OF NEW HAMPSHIRE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

NEW HAMPSHIRE HOSPITAL

36 CLINTON STREET, CONCORD, NH 03301

603-271-5300 1-800-852-3345 Ext 5300

Fax: 603-271-5395 TDD Access: 1-800-735-2964

www.dhbs.ah.gov

August 10, 2020

His Excellency, Governor Christopher T. Sununu

and the Honorable Council

State House

Concord, New Hampshire 03301

REQUESTED ACTION

Authorize the Department of Health and Human Services. New Hampshire Hospital, to

enter into a contract with Norris, Inc. (VC#174010), Saco, Maine in the amount of $120,000 for

the provision of inspecting, testing, preventative maintenance, and repairs for life safety systems

at New Hampshire Hospital and seven satellite buildings located at the Hugh J. Gallen State

Office Complex, with the option to renew for up to four (4) additional years, effective upon

Governor and Council approval through June 30, 2024. 70% General Funds, 30% Other Funds

(Provider and Intra-Agency).

05-95-94-940010-8410-048-500226 HEALTH AND SOCIAL SERVICES, DEPT. OF HEALTH

AND HUMAN SERVICES, HHS: NEW HAMPSHIRE HOSPITAL, NEW HAMPSHIRE

HOSPITAL, NHH-FACILITY/PATIENT SUPPORT

State

Fiscal Year

Class /

Account Class Title Job Number Total Amount

2021 048-500226

Contractual Maint.

Bulld-Grnds 94024000 $30,000

2022 048-500226 Contractual Maint.

Build-Grnds 94024000 $30,000

2023 048-500226 Contractual Maint.

Build-Grnds 94024000 $30,000

2024 048-500226

Contractual Maint.

Build-Grnds 94024000 $30,000

Total $120,000

EXPLANATION

The purpose of this request is to maintain proper operation of life safety systems located

within the New Hampshire Hospital building and seven satellite buildings located at the Hugh J.

Gallen State Office Complex through the provision of inspections, testing, preventative

maintenance, and repairs of the fire detection, security alarm, nurse call and duress call systems.

The Contractor will inspect, test, conduct preventative maintenance, and provide

corrective or emergency repairs to maintain proper operating condition of the life safety systems

to ensure safety and provide protection for the patients, staff and visitors at New Hampshire

Hospital and the seven satellite buildings at the Hugh J. Gallen State Office Complex

77»e Department of Health and Human Services' Mission is to join communities and families

in providing opportunities for citizens to achieve health and independence.

His Excellency, Governor Christopher T. Sununu

and the Honorable Council

The Department will monitor contracted services using the following reporting

requirements:

• The Contractor will present a written summary of the work performed and problems

discovered before leaving the premises after each scheduled or emergency call.

• The Contractor will provide the Department with a complete written report documenting

completed tests and inspections and describing any problems discovered no later than 30

days after each service call.

• The Contractor will provide a 'not to exceed' estimate for parts and labor before starting

corrective or repair work.

The Department selected the Contractor through a competitive bid process using a

Request for Proposals (RFP) that was posted on the Department's website from 5/15/2020

through 6/16/2020. The Department received one (1) response that was reviewed and scored by

a team of qualified individuals. The Scoring Sheet is attached.

As referenced in Exhibit A, Revisions to Standard Contract Provisions. Section 1.

Revisions to Form P-37, General Provisions, Subsection 1.1 of the attached contract, the parties

have the option to extend the agreement for up to four (4) additional years, contingent upon

satisfactory delivery of services, available funding, agreement of the parties, and Govemor and

Council approval.

Should the Govemor and Executive Council not approve this request, New Hampshire

Hospital may not be in compliance with Joint Commission requirements and the New Hampshire

Life Safety Code as required^ by the Bureau of Health Facilities. In addition, patients and

employees at the hospital and satellite locations could be at risk due to inadequately maintained

life safety systems.

Area served: Concord.

In the event that the Other Funds become no longer available, additional General Funds

will not be requested to support this program.

Respectfully submitted.

LOTi A. Shibinette

Commissioner

New Hampshire Department of Health and Human Services

Office of Business Operations

Contracts & Procurement Unit

Scoring Sheet

Fire Alarm and Ufa Safety System

Testing and Maintenance Services

RFP Name

RFP-2021.NHH-01-FiREA

RFP Number Reviewer Names

John Wheeler

Maximum Actual

2

' Allen CoenBidder Name Pass/Fall Points Points

Norrls inc 100 02 Daniel Rinden

FORM NUMBER P-37 (version 12/11/2019)

Subject:_Fire Alarm and Life Safety SystcmTesting and Maintenance Services (RFP-2021-NHH-0I-FIREA-01)

Notice: This agreement and all of its attachments shall become public upon submission to Governor and #

Executive Council for approval. Any information that is private, confidential or proprietary must

be clearly identified to the agency and agreed to in writing prior to signing the contract.

AGREEMENT

The State of New Hampshire and the Contractor hereby mutually agree as follows:

GENERAL PROVISIONS

1.1 State Agency Name

New Hampshire Department of Health and Human Services

1.2 State Agency Address

129 Pleasant Street

Concord.NH 033OI-3857

1.3 Contractor Name

Norris, Inc.

1.4 Contractor Address

42 Industrial Park Rd.

Saco, ME 04072

1.5 Contractor Phone

Number

(800)370-3473

1.6 Account Number

05-095-094-9400-

841000000-94024000

1.7 Completion Date

June 30, 2024

1.8 Price Limitation

$120,000

1.9 Contracting Officer for State Agency

Nathan D. White, Director

1.10 State Agency Telephone Number

(603)271-9631

1.11 Contractor Signature 1.12 Name and Title of Contractor Signatory

1.13 State Agency S ignkure 1.14 Name and Title of State Agency Signatory

1.15 Approval by the N.H. Department of Administration, Division of Personnel (if applicable)

By: Director, On:

1.16 Approval by the Attorney General (Form, Substance and Execution) (if applicable)

08/17/20

1.17 Approval by the Governor and Executive Council (f applicable)

O&C Item number: G&C Meeting Date:

Contractor Initials

Date

2. SERVICES TO BE PERFORMED. The State of New

Hampshire, acting through the agency identified in block l.l

("State"), engages contractor identified in block 1.3

("Contractor") to perform, and the Contractor shall perform, the

work or sale of goods, or both, identified and more particularly

described in the attached EXHIBIT B which is incorporated

herein by reference ("Services").

3. EFFECTIVE DATE/COMPLETION OF SERVICES.

3.1 Notwithstanding any provision of this Agreement to the

contrary, and subject to the approval of the Governor and

E.xecutive Council of the State of New Hampshire, if applicable,

this Agreement, and all obligations of the parties hereunder, shall

become effective on the date the Governor and Executive

Council approve this Agreement as indicated in block 1.17,

unless no such approval is required, in which case the Agreement

shall become effective on the date the Agreement is signed by

the State Agency as shown in block 1.13 ("Effective Date").

3.2 If the Contractor commences the Services prior to the

Effective Date, all Services performed by the Contractor prior to

the Effective Date shall be performed at the sole risk of the

Contractor, and in the event that this Agreement does not become

effective, the State shall have no liability to the Contractor,

including without limitation, any obligation to pay the

Contractor for any costs incurred or Services performed.

Contractor must complete all Services by the Completion Date

specified in block 1.7.

4. CONDITIONAL NATURE OF AGREEMENT.

Notwithstanding any provision of this Agreement to the

contrary, all obligations of the State hereunder, including,

without limitation, the continuance of payments hereunder, are

contingent upon the availability and continued appropriation of

funds affected by any state or federal legislative or executive

action that reduces, eliminates or otherwise modifies the

appropriation or availability of funding for this Agreement and

the Scope for Services provided in EXHIBIT B, in whole or in

part. In no event shall the State be liable for any payments

hereunder in excess of such available appropriated funds. In the

event of a reduction or termination of appropriated funds, the

State shall have the right to withhold payment until such funds

become available, if ever, and shall have the right to reduce or

terminate the Services under this Agreement immediately upon

giving the Contractor notice of such reduction or termination.

The State shall not be required to transfer funds from any other

account or source to the Account identified in block 1.6 in the

event funds in that Account are reduced or unavailable.

5. CONTRACT PRICE/PRICE LIMITATION/

PAYMENT.

5.1 The contract price, method of payment, and terms of payment

are identified and more particularly described in EXHIBIT C

which is incorporated herein by reference.

5.2 The payment by the State of the contract price shall be the

only and the complete reimbursement to the Contractor for all

expenses, of whatever nature incurred by the Contractor in the

performance hereof, and shall be the only and the complete

compensation to the Contractor for the Services. The State shall

have no liability to the Contractor other than the contract price.

5.3 The State reserves the right to offset from any amounts

'otherwise payable to the Contractor under this Agreement those

liquidated amounts required or permitted by N.H. RSA 80:7

through RSA 80:7-c or any other provision of law.

5.4 Notwithstanding any provision in this Agreement to the

contrary, and notwithstanding unexpected circumstances, in no

event shall the total of all payments authorized, or actually made

hereunder, exceed the Price Limitation set forth in block 1.8.

6. COMPLIANCE BY CONTRACTOR WITH LAWS

AND REGULATIONS/ EQUAL EMPLOYMENT

OPPORTUNITY.

6.1 In connection with the performance of the Services, the

Contractor shall comply with all applicable statutes, laws,

regulations, and orders of federal, state, county or municipal

authorities which impose any obligation or duty upon the

Contractor, including, but not limited to, civil rights and equal

employment opportunity laws. In addition, if this Agreement is

funded in any part by monies of the United States, the Contractor

shall comjjly with all federal executive orders, rules, regulations

and statutes, and with any rules, regulations and guidelines as the

State or the United States issue to implement these regulations.

The Contractor shall also comply with all applicable intellectual

property laws.

6.2 During the term of this Agreement, the Contractor shall not

discriminate against employees or applicants for employment

because of race, color, religion, creed, age, sex, handicap, sexual

orientation, or national origin and will take affinnative action to

prevent such discrimination.

6.3. The Contractor agrees to permit the State or United States

access to any of the Contractor's books, records and accounts for

the purpose of ascertaining compliance with all rules, regulations

and orders, and the covenants, terms and conditions of this

Agreement.

7. PERSONNEL.

7.1 The Contractor shall at its own expense provide all personnel

necessar>' to perform the Services. The Contractor warrants that

all personnel engaged in the Services shall be qualified to

perform the Services, and shall be properly licensed and

otherwise authorized to do so under all applicable laws.

7.2 Unless otherwise authorized in writing, during the term of

this Agreement, and for a period of six (6) months after the

Completion Date in block 1.7, the Contractor shall not hire, and

shall not permit any subcontractor or other person, firm or

corporation with whom it is engaged in a combined elTort to

perform the Services to hire, any person vvho is a State employee

or official, who is materially involved in the procurement,

administration or performance of this Agreement. This

provision shall survive termination of this Agreement.

7.3 The Contracting Officer specified in block 1.9, or his or her

successor, shall be the State's representative. In the event of any

dispute concerning the interpretation of this Agreement, the

Contracting Officer's decision shall be final for the State.

Contractor Initials

Date

8. EVENT OF DEFAULT/REMEDIES.

8.1 Any one or more of the following acts or omissions of the

Contractor shall constitute an event of default hereundcr ("Event

of Default");

8.1.1 failure to perform the Services satisfactorily or on

schedule;

8.1.2 failure to submit any report required hereunder; and/or

8.1.3 failure to perform atiy other covenant, term or condition of

this Agreement.

8.2 Upon the occurrence of any Event of Default, the State may

take any one, or more, or all, of the following actions;

8.2.1 give the Contractor a written notice speci lying the Event of

Default and requiring it to be remedied within, in the absence of

a greater or lesser specification of time, thirty (30) days from the

date of the notice; and if the Event of Default is not timely cured,

terminate this Agreement, effective two (2) days after giving the

Contractor notice of termination;

8.2.2 give the Contractor a written notice specifying the Event of

Default and suspending all payments to be made under this

Agreement and ordering that the portion of the contract price

which would otherwise accrue to the Contractor during the

period from the date of such notice until such time as the State

determines that the Contractor has cured the Event of Default

shall never be paid to the Contractor;

8.2.3 give the Contractor a written notice specifying the Event of

Default and set off against any other obligations the State may

owe to the Contractor any damages the State suffers by reason of

any Event of Default; and/or

8.2.4 give the Contractor a written notice specifying the Event of

Default, treat the Agreement as breached, terminate the

Agreement and pursue any of its remedies at law or in equity, or

both.

8.3. No failure by the State to enforce any provisions hereof after

any Event of Default shall be deemed a waiver of its rights with

regard to that Event of Default, or any subsequent Event of

Default. No express failure to enforce any Event of Default shall

be deemed a waiver of the right of the State to enforce each and

all of the provisions hereof upon any further or other Event of

Default on the part of the Contractor.

9. TERMINATION.

9.1 Notwithstanding paragraph 8, the State may, at its sole

discretion, terminate the Agreement for any reason, in whole or

in part, by thirty (30) days written notice to the Contractor that

the State is exercising its option to terminate the Agreement.

9.2 In the event of an early termination of this Agreement for

any reason other than the completion of the Services, the

Contractor shall, at the State's discretion, deliver to the

Contracting.Offlcer, not later than fifteen (15) days after the date

of termination, a report ("Termination Report") describing in

detail all Services performed, and the contract price earned, to

and including the date of termination. The form, subject matter,

content, and number of copies of the Termination Report shall

be identical to those of any Final Report described in the attached

EXHIBIT B. In addition, at the State's discretion, the Contractor

shall, within 15 days of notice of early termination, develop and

submit to the State a Transition Plan for services under the

Agreement.

10. DATA/ACCESS/CONFIDENTIALITY/

PRESERVATION.

10.1 As used in this Agreement, the word "data" shall mean all

information and things developed or obtained during the

performance of, or acquired or developed by reason of, this

Agreement, including, but not limited to, all studies, reports,

files, formulae, surveys, maps, charts, sound recordings, video

recordings, pictorial reproductions, drawings, analyses, graphic

representations, computer programs, computer printouts, notes,

letters, memoranda, papers, and documents, all whether

finished or unfinished.

10.2 All data and any property which has been received from

the State or purchased with funds provided for that purpose

under this Agreement, shall be the property of the State, and

shall be returned to the State upon demand or upon termination

of this Agreement for any reason.

10.3 Confidentiality of data shall be governed by N.H. RSA

chapter 91 -A or other existing law. Disclosure of data requires

prior written approval of the State.

11. CONTR/VCTOR'S RELATION TO THE STATE. In the

performance of this Agreement the Contractor is in all respects

an independent contractor, and Is neither an agent nor an

employee of the State. Neither the Contractor nor any of its

officers, employees, agents or members shall have authorit>' to

bind the State or receive any benefits, workers' compensation or

other emoluments provided by the State to its employees.

12. ASSIGNMENT/DELEGATION/SUBCONTRACTS.

12.1 The Contractor shall not assign, or otherwise transfer any

interest in this Agreement without the prior written notice, which

shall be provided to the State at least fifteen (15) days prior to

the assignment, and a written consent of the State. For purposes

of this paragraph, a Change of Control shall constitute

assignment. "Change of Control" means (a) merger,

consolidation, or a transaction or series of related transactions in

which a third party, together with its affiliates, becomes the

direct or indirect owner of fifty percent (50%) or more of the

voting shares or similar equity interests, or combined voting

power of the Contractor, or (b) the sale of ail or substantially all

of the assets of the Contractor.

12.2 None of the Services shall be subcontracted by ihe

Contractor without prior written notice and consent of the State.

The State is entitled to copies of all subcontracts and assignment

agreements and shall not be bound by any provisions contained

in a subcontract or an assignment agreement to which it is not a

party.

13. INDEMNIFICATION. Unless otherwise c.xcmptcd by law,

the Contractor shall indemnify and hold harmless the State, its

officers and employees, from and against any and all claims,

liabilities and costs for any personal injury or property damages,

patent or copyright infringement, or other claims asserted against

the Slate, its officers or employees, which arise out of (or which

may be claimed to arise out oO the acts or omission of the

Contractor Initials

Date

Contractor, or subcontractors, including but not limited to the

negligence, reckless or intentional conduct. The State shall not

be liable for any costs incurred by the Contractor arising under

this paragraph 13. Notwithstanding the foregoing, nothing herein

contained shall be deemed to constitute a waiver of the sovereign

immunity of the State, which immunity is hereby reserved to the

State. This covenant in paragraph 13 shall sur\'ive the

termination of this Agreement.

14. INSURANCE. >

14.1 The Contractor shall, at its sole expense, obtain and

continuously maintain in force, and shall require any

subcontractor or assignee to obtain and maintain in force, the

following insurance:

14.1.1 commercial general liability insurance against all claims

of bodily injury, death or property damage, in amounts of not

less than $1,000,000 per occurrence and $2,000,000 aggregate

or excess; and

14.1.2 special cause of loss coverage form covering all property

subject to subparagraph 10.2 herein, in an amount not less than

80% of the whole replacement value of the property.

14.2 The policies described in subparagraph 14.1 herein shall be

on policy forms and endorsements approved for use in the Stale

of New Hampshire by the N.H. Department of Insurance, and

issued by insurers licensed in the State of New Hampshire.

14.3 The Contractor shall furnish to the Contracting Officer

identified in block 1.9, or his or her successor, a certificate(s) of

insurance for all insurance required under this Agreement.

Contractor shall also furnish to the Contracting Officer identified

in block 1.9, or his or her successor, certificate(s) of insurance

for all rcnewal{s) of insurance required under this Agreement no

later than ten (10) days prior to the expiitition date of each

insurance policy. The certificatc(s) of insurance and any

renewals thereofshall be attached and arc incorporated herein by

reference.

15. WORKERS' COMPENSATION.

15.1 By signing this agreement, the Contractor agrees, certifies

and warrants that the Contractor is in compliance with or exempt

from, the requirements ofN.H. RSA chapter 281-A ("Workers'

Compensation").

15.2 To the extent the Contractor is subject to the requirements

of N.H. RSA chapter 281-A, Contractor shall maintain, and

require any, subcontractor or assignee to secure and maintain,

payment of Workers' Compensation in connection with

activities which the person proposes to undertake pursuant to this

Agreement. The Contractor shall furnish the Contracting Officer

identified in block 1.9, or his or her successor, proof of Workers'

Compensation in the manner described in N.H. RSA chapter

281-A and any applicable renewal(s) thereof, which shall be

attached and are incorporated herein by reference. The State

shall not be responsible for payment of any Workers'

Compensation premiums or for any other claim or benefit for

Contractor, or any subcontractor or employee of Contractor,

which might arise under applicable State of New Hampshire

Workers' Compensation laws in connection with the

performance of the Services under this Agreement.

16. NOTICE. Any notice by a party hereto to the other party

shall be deemed to have been duly delivered or given at the time

of mailing by certified mail, postage prepaid, in a United States

Post Office addressed to the parties at the addresses given in

blocks 1.2 and 1.4, herein.

17. AMENDMENT. This Agreement may be amended, waived

or discharged only by an instrument in writing signed by the

parties hereto and only after approval of such amendment,

waiver or discharge by the Governor and Executive Council of

the State ofNew Hampshire unless no such approval is required

under the circumstances pursuant to State law, rule or policy.

18. CHOICE OF LAW AND FORUM. This Agreement shall

be governed, interpreted and construed in accordance with the

laws of the State of New Hampshire, and is binding upon and

inures to the benefit of the parties and their respective successors

and assigns. The wording used in this Agreement is the wording

chosen by the parties to express their mutual intent, and no rule

of construction shall be applied against or in favor of any party.

Any actions arising out of this Agreement shall be brought and

maintained in New Hampshire Superior Court which shall have

exclusive jurisdiction thereof.

19. CONFLICTING TERMS, in the event of a conflict

between the terms of this P-37 form (as modified in EXHIBIT

A) and/or attachments and amendment thereof, the terms of the

P-37 (as modified in EXHIBIT A) shall control.

20. THIRD PARTIES. The parties hereto do not intend to

benefit any third parties and this Agreement shall not be

construed to confer any such benefit.

21. HEADINGS. The headings throughout the Agreement are

for reference purposes only, and the words contained therein

shall in no way be held to explain, modify, amplify or aid in the

interpretation, construction or meaning of the provisions of this

Agreement.

22. SPECIAL PROVISIONS. Additional or modifying

provisions set forth in the attached EXHIBIT A are incorporated

herein by reference.

23. SEVERABILITV. In the event any of the provisions of this

Agreement are held by a court of competent jurisdiction to be

contrary to any state or federal law, the remaining provisions of

this Agreement will remain in full force and effect.

24. ENTIRE AGREEMENT. This Agreement, which may be

executed in a number of counterparts, each of which shall be

deemed an original, constitutes the entire agreement and

understanding between the parties, and supersedes all prior

agreements and understandings with respect to the subject matter

hereof.

Contractor initials

Date

sr

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT A

REVISIONS TO STANDARD CONTRACT PROVISIONS

1. Revisions to Form P-37, General Provisions

1.1. Paragraph 3, Effective Date/Completion of Services, is amended by adding

subparagraph 3.3 as follows;

3.3. The parties may extend the Agreement for up to four (4) additional years

from the Completion Date, contingent upon satisfactory delivery of

services, available funding, agreement of the parties, and required

governmental approval.

1.2. Paragraph 12, Assignment/Delegation/Subcontracts, is amended by adding

subparagraph 12.3 as follows:

12.3. Subcontractors are subject to the same contractual conditions as the

Contractor and the Contractor is responsible to ensure subcontractor

compliance with those conditions. The Contractor shall have written

agreements with all subcontractors, specifying the work to be performed

and how corrective action shall be managed if the subcontractor's

performance is inadequate. The Contractor shall manage the

subcontractor's performance on an ongoing basis and take corrective

action as necessary. The Contractor shall annually provide the State with

a list of all subcontractors provided for under this Agreement and notify

the State of any inadequate subcontractor performance.

RFP-2021-NHH-01-FIREA-01 Exhibit A • Revisions to Standard Contract Provisions Contractor Initials '

curt)HHS/i2ioi9 Dale

%New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT B ^

Scope of Services

1. Statement of Work

1.1.The Contractor shall provide services in this agreement to New Hampshire

Hospital, which includes, but is not limited to, the primary hospital facility and.

seven satellite buildings on the grounds at Hugh J. Gallen State Office Complex,

36 Clinton Street, Concord, New Hampshire, listed below;

1.1.1. Howard Recreational Building

1.1.2. Pond Place

1.1.3. Bayberry House

1.1.4. Yellow House

1.1.5. Brick House

1.1.6. Grey House

1.1.7. Cottage House

1.2. For the purposes of this agreement, all references to days shall mean business

days, unless otherwise indicated as calendar days.

1.3. Testing

1.3.1. Fire Detection Systems

1.3.1.1. The Contractor will inspect and test equipment used for Fire

Detection Systems (See Exhibit B-1, Equipment List), which

must include:

1.3.1.1.1. Testing and inspecting each component of the fire alarm

detection system in accordance with the appropriate

codes and standards of the National Fire Protection

Association (2013 NFPA 72, National Fire Alarm and

Signaling Code).

1.3.1.1.2. Visual inspection of each piece of equipment listed in

Exhibit B-1, Equipment List to ensure that each is in

proper condition according the manufacturer's

specifications.

1.3.1.1.3. Testing each Hochiki Fire Alarm Node to ensure that each

is working properly, according to the manufacturer's

specifications.

1.3.1.1.4. Testing the pre-action of each heat detector to ensure that

a proper activation signal is transmitted to and received

at the main fire alarm panel and at the appropriate pre-

action sprinkler system valve.

RFP-2021-NHH-01-FtREA-01 Exhibit B Scope of Services Contractor Initials

Norris, Inc. Date,

New Hampshire Department of Health and Human Services ^^33

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBITS

1.3.1.1.5. Testing each heat detector to ensure that each is working

properly, according to the manufacturer's specifications.

1.3.1.1.6. Testing each smoke detector to ensure that a proper

activation signal is transmitted to and received at the main

fire alarm panel.

1.3.1.1.7. Testing each duct smoke detector by the introduction of

test smoke into each unit's chamber to ensure that it

activates the smoke damper and:

1.3.1.1.8. Visually confirming that the proper operation of each

smoke damper associated with each duct smoke detector

by opening access doors on the ducts and ensuring the

damper closes upon activation re-opens upon resetting of

the smoke detector.

1.3.1.1.9. Confirming and documenting that each duct smoke

detector activated for each associated smoke damper.

1.3.1.1.10. Reporting problems with dampers or with locating specific

dampers associated with a duct smoke detector to New

Hampshire Hospital's Life Safety Shop Manager.

1.3.1.1.11.Testing each pull station to ensure that a proper activation

signal is transmitted to and received at the main fire alarm

panel, with the correct address and location.

1.3.1.1.12. Reporting deficiencies identified through fire alarm pull

station tests to New Hampshire Hospital's Life Safety

Shop Manager.

1.3.1.1.13. Testing each audio/visual (AA/) unit to ensure that proper

activation of light and sound has occurred for each unit.

1.3.1.1.14. Testing each visual unit to ensure that proper activation

of light has occurred for each unit.

1.3.1.1.15. Testing each magnetic door holder to ensure that the door

releases and closes on its own.

1.3.1.1.16. Testing each roll-up door to ensure that the door releases

and closes on its own.

1.3.2. Pharmacy Security Alarm System

1.3.2.1. The Contractor will perform a visual inspection of each piece

of equipment listed in Exhibit B-1 - Equipment List for the

pharmacy security alarm system ensuring proper working

condition.

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials

Norris, Inc. Dale.

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBITS

1.3.2.2. The Contractor will test the pharmacy security alarm system

to ensure that each initiating device activates and operates

properly.

1.3.2.3. The Contractor will test each door sensor to ensure proper

activation according the manufacturer's specifications.

1.3.2.4. The Contractor will test each motion sensor to ensure proper

activation according to the manufacturer's specifications.

1.3.3. Nurse Call System

1.3.3.1. The Contractor will perform a visual Inspection of each piece

of equipment for the nurse call system listed in Exhibit B-1,

Equipment List to ensure that each is in proper condition.

1.3.3.2. The Contractor will test the nurse call system to ensure that

each initiating device within the nurse call system to ensure

that each initiating device activates and operates properly.

1.3.4. Duress Alarm System

1.3.4.1. The Contractor will perform a visual inspection of each piece

of equipment for the duress alarm system listed in Exhibit B-

1, Equipment List and ensure proper operation of each

component of the system.

1.3.4.2. The Contractor will test each piece of equipment within the

Duress Alarm system to ensure that each initiating device

activates and operates properly.

1.4. Corrective or Emergency Maintenance: Repairs and Replacements of Life Safety

Equipment

1.4.1. The Contractor will perform corrective maintenance or emergency

repairs for life safety systems during or after testing, including

peripheral devices and fire alarm control panels, and all equipment

listed in Exhibit B-1, Equipment List.

1.4.2. Corrective maintenance, includes, but is not limited to:

1.4.2.1. Cleaning smoke detectors as necessary, to mitigate the dust

buildup with in the detector to prevent false alarms.

1.4.2.2. Replacing batteries in applicable equipment, as needed or

required by manufacturer's specification or other standard.

1.4.2.3. Replacing parts, as needed or required by manufacturer's

specification or other standard.

1.4.3. The Contractor must obtain approval from the Department prior to

repairing and/or replacing parts and must:

1.4.3.1. Provide a 'not to exceed' estimate of parts and labor before

starting any work. ^

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials.

Norris, Inc. Date,

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT B

1.4.3.2. Be willing to use parts that the Department purchases directly

from a supplier whenever possible.

1.4.3.3. Ensure that materials used are at the Contractor's cost by

invoice.

1.4.4. The Contractor must provide a detailed description for each

necessary repair within twenty-four (24) hours of testing, including

identifying any replacement part(s) required to restore the equipment

to working order.

1.4.5. The Contractor must complete all corrective repairs no later than one

(1) business day from the date approval for the repair by the

Department.

1.4.6. The Contractor must complete each emergency repair no later than

twenty-four (24) hours after notification of or approval for the repair.

1.4.7. In the event that an emergency repair cannot be completed within

twenty-four (24) hours), the Contractor must notify the Department.

Notification must include:

1.4.7.1. The reason why the repair cannot be completed.

1.4.7.2. An estimated date and time for the equipment to be placed

by in service.

1.5. Inspection and Testing Schedule

1.5.1. The Contractor will complete inspection and testing of the life safety

systems described in Exhibit B-1, Equipment List on a schedule as

follows:

1.5.1.1. Inspect and Test 25% of the equipment listed in Exhibit 8-1,

Equipment List within the APS Building. The seven satellite

buildings will be tested once annually.

1.5.1.2. Schedule visits to inspect and test equipment at least two

weeks prior to the equipment's inspection and testing due

date.

1.5.1.3. Contact the New Hampshire Hospital's Life Safety Shop

Manager at least five (5) business days in advance of each

scheduled visit to confirm the visit and to obtain any

information on the equipment' condition in order to prepare

for the visit.

1.5.1.4. Ensure that each piece of equipment is inspected and tested

no later than one (1) year from the most recent date of

inspection and testing.

1.6. General Inspection and Testing Requirements

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor initials

Norris, Inc. Page4 of9 Date, aki

5r

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTestIng and Maintenance Services

EXHIBIT B

1.6.1. The Contractor will notify the Department's designee upon arrival at

any testing location or building before conducting any business.'

1.6.2. The Contractor will furnish all labor, materials, tools, equipment,

diagnostic manuals, software and training necessary to properly

inspect, test, service and repair the life safety systems in Section 1

Statement of Work, Subsection 1.3 Testing, Paragraphs 1.3.1 through

1.3.4. Only authorized licensed dealers shall be used to install or

upgrade the Hochiki fire alarm software installed within APS fire alarm

system.

1.6.3. The Contractor will perform the appropriate inspection, testing, and

preventative maintenance in accordance with each systems' and

equipment manufacturers' specifications, to include complete system

performance evaluation, adjustment, calibration, and testing of the

components for the Systems in Section 1 Statement of Work.

Subsection 1.3 Testing, Paragraphs 1.3.1 through 1.3.4.

1.6.4. The Contractor will inspect, test and perform preventative

maintenance to ensure proper operation of all detection and

protection systems in Section 1 Statement of Work, Subsection 1.3

Testing, Paragraphs 1.3.1 through 1.3.4. and to minimize emergency

unscheduled maintenance requirements on the listed equipment in

Exhibit B-1, Equipment List.

1.6.5. The Contractor will complete each inspection, test, or preventative

maintenance without the assistance of Department personnel.

1.6.6. The Contractor will provide field-training while on site, which includes

conducting service activities for Department employees, as requested.

1.6.7. The Contractor will provide at the conclusion of the Installation the

operations and maintenance data for new parts that are installed.

1.6.8. The Contractor will ensure the equipment requiring inspection, testing,

or preventative maintenance will only be out of service for one hour.

1.6.9. The Contractor will ensure each approved repair is completed during

the first service call, or the next calendar day if parts must be obtained

to make the repair.

1.6.10. The Contractor will ensure the fire detection systems and the duress

alarm system are active and in operable condition 100% of the time.

1.6.11. The Contractor shall document any discrepancies found between the

lists of equipment in Exhibit B-1, Equipment List and the equipment

actually installed, and notify the Department of the discrepancy.

1.7. Safety Requirements

1.7.1. The Contractor must utilize safety and health training, positive

reinforcement techniques, identification, evaluation and correction of

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials

Norris, Inc. Date ^*1 uf

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT B

hazards and unsafe work procedures and performance to achieve

regulatory compliance.

1.7.2. The Contractor must provide Personal Protective Equipment specific

to tasks for personnel on the jobsite.

1.7.3. The Contractor must be aware of and participate in the NHH

procedures for natural disasters, fire and emergency situations,

including safe locations, exit routes, and methods for accounting for

employees.

1.8. Requirements for Software and Parts

1.8.1. The Contractor will maintain a reasonable inventory of parts to provide

for routine preventative maintenance and repairs,,and use new

materials, unless installation of a used part is approved in advance by

the Department.

1.8.2. The Contractor will ensure that each replacement component that is

of the same manufacturer, type and quality as that being replaced,

unless the Department approves installation of an equivalent part,

and;

1.8.2.1. The quality of the substitute item matches the part that is

replaced and is:

1.8.2.1.1. Listed with Underwriters Laboratory.

1.8.2.1.2. Compatible for use with associated equipment.

1.8.3. The Contractor agrees that the Department reserves the right to reject

any replacement item.

1.8.4. The Contractor will provide any specialized tools and/or instruments

required to test and/or analyze the systems.

1.9. Warranty

1.9.1. Except as otherwise specified, all new parts and labor shall be

guaranteed by the Contractor against defects resulting from the use of

inferior materials, equipment or workmanship for one (1) year from the

date of acceptance of work by the Department.

1.9.2. If, within any guarantee period, repairs or changes are required in

connection with guaranteed work, which in the opinion of the

Department is rendered necessary as a result of the use of materials,

equipment or workmanship which are inferior, defective, or not In

accordance with the terms of the Contract, the Contractor shall,

promptly upon receipt of notice from the Commissioner, and at his

own expense:

1.9.2.1. Place in satisfactory condition in every particular, all such

guaranteed work, and shall correct all defects therein.

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials

Norris, Inc. Date.

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT B

1.9.2.2. Make good all damage to the building or site, or equipment

or contents thereof, which in the opinion of the Contract

Administrator, is the result of the use of materials, equipment

or workmanship which are inferior, defective, or not in

accordance with the terms of the Contract.

1.9.2.3. Make good any work or material, or the equipment and

contents of said building or site disturbed in fulfilling any such

guarantee.

1.10. Staffing

1.10.1. The Contractor will provide staff with necessary training and

certification from the National Institute for Certification in Engineering

Technologies (NICET) - Inspection and Testing for Fire Alarm

Systems (l&TFAS). The Contractor must;

1.10.1.1. Provide all supervision, labor, and transportation necessary

for the successful completion of the work described in this

RFP.

1.10.1.2. Ensure, at the request of the Department, that each

employee performing work in patient care areas have

documentation of a criminal background check, to be

completed at the expense of the Contractor, which

demonstrates no criminal offenses for the employee.

1.10.1.3. Ensure each employee is available to complete a 30-minute

NHH orientation regarding patient confidentiality and

boundaries.

1.10.1.4. Ensure compliance with the New Hampshire Hospital Safety

Guidelines.

1.10.1.5. Employ a sufficient number of trained technicians such that

calls of any emergency nature can be answered promptly,

with the technician arriving at the job site no later than three

(3) hours after the call is placed.

1.10.1.6. Employ qualified mechanics who are trained, fully skilled and

competent to perform the scope of work in this RFP.

1.11. License and Permits

1.11.1. The Contractor shall maintain all the necessary licenses, permits,

and/or certifications required by Federal, State, County, and Municipal

laws, ordinances, rules, and regulations for the life of the contract.

The Contractor will notify the Department immediately of loss or

suspension of any such licenses, permits, and/or certifications.

2. Exhibits Incorporated

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials

Norris, Inc. Date

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTestIng and Maintenance Services

EXHIBIT B

2.1. The Contractor shal! use and disclose Protected Health Information in compliance

with the Standards for Privacy of Individually Identifiable Health Information

(Privacy Rule) (45 CFR Parts 160'and 164) under the Health Insurance Portability

and Accountatiility Act (HIPAA) of 1996, and in accordance with the attached

Exhibit I, Business Associate Agreement, which has been executed by the parties.

2.2.The Contractor shall manage all confidential data related to this Agreement in

accordance with the terms of Exhibit K. DHHS Information Security Requirements.

2.3.The Contractor shall comply with all Exhibits D through K, which are attached

hereto and incorporated by reference herein.

3. Reporting Requirements

3.1.The Contractor will present a written summary of the work performed and

problems discovered after each scheduled or emergency call and obtain the

signature of a Department administrator on the written summary before leaving

the job site.

3.2.The Contractor will provide the Department with a complete written report

documenting tests and inspections completed and any problems discovered

within 15 days after each visit.

4. Performance Measures

4.1.The Department will monitor Contractor performance by the Contractor's

adherence to completing work as scheduled and meeting reporting requirements.

4.2.The Contractor shall actively and regularly collaborate with the Department to

enhance contract management, improve results, and adjust program delivery and

policy based on successful outcomes.

4.3.The Contractor may be required to provide other key data and metrics to the

Department, Including service data.

4.4. Where applicable, the Contractor shall collect and share data with the Department

in a format specified by the Department.

5. Additional Terms

5.1. Impacts Resulting from Court Orders or Legislative Changes

5.1.1. The Contractor agrees that, to the extent future state or federal

legislation or court orders may have an impact on the Services

described herein, the State has the right to modify Service priorities

and expenditure requirements under this Agreement to achieve

compliance therewith.

5.2. Credits and Copyright Ownership

^ 5.2.1. All documents, notices, press releases, research reports and other

materials prepared during or resulting from the performance of the

services of the Contract shall include the following statement; "The

preparation of this (report, document etc.) was financed under a

RFP-2021-NHH-01-FIREA-01 Exhibit B Scope of Services Contractor Initials

Norris. Inc. Date,

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety SystemTesting and Maintenance Services

EXHIBIT B

Contract with the State of New Hampshire, Department of Health and

Human Services, with funds provided in part by the State of New

Hampshire and/or such other funding sources as were available or

required, e.g., the United States Department of Health and Human

Services."

5.2.2. All materials produced or purchased under the contract shall have

prior approval from the Department before printing, production,

distribution or use.

5.2.3. The Department shall retain copyright ownership for any and all

original materials produced, including, but not limited to:

5.2.3.1. Brochures.

5.2.3.2. Resource directories.

5.2.3.3. Protocols or guidelines.

5.2.3.4. Posters.

5.2.3.5. Reports.

5.2.4. The Contractor shall not reproduce any materials produced under the

contract without prior written approval from the Department.

6. Records

6.1. The Contractor shall keep records that include, but are not limited to:

6.1.1. Books, records, documents and other electronic or physical data

evidencing and reflecting all costs and other expenses incurred by the

Contractor in the performance of the Contract, and all income

received or collected by the Contractor.

6.1.2. All records must be maintained in accordance with accounting

procedures and practices, which sufficiently and properly reflect all

such costs and expenses, and which are acceptable to the

Department, and to include, without limitation, all ledgers, books,

records, and original evidence of costs such as purchase requisitions

and orders, vouchers, requisitions for materials, inventories,

valuations of in-kind contributions, labor time cards, payrolls, and

other records requested or required by the Department.

RFP-2021-NHH-01-FtREA-01 Exhibit 8 Scope of Services Contractor Initials

Norris. Inc. Date I 2^2.0

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety System Testing and Maintenance

Exhibit B-1

EQUIPMENT LIST

LIST OF FIRE DETECTION EQUIPMENT APS BUILDING:

Item Quantity

APS Building (APS)

Hochiki Fire Alarm Nodes 7

Heat detectors 190

Preaction Heat Detectors 606

Smoke detectors 503

Duct smoke detectors 163

Pull Stations 55

AudioA/lsual units 140

Visual Units 42

Magnetic door holders 64

LIST OF SECURITY ALARM EQUIPMENT APS BUILDING:

Item Quantity

Digital Monitoring Products 7000 Series Thlnline 1

Agualite Keypads 2

Door Sensors 3

Motion Sensors 0

NURSE CALL EQUIPMENT - APS -1 & J UNITS:

Item Quantity Equipment Number Location

Tektone Master Term. 2 NC415AV i & J Units

Speakers 49 5120-9416 1 & J Units

Stations 14 5001-9330 I & J Units

Stations 26 5001-9331 1 & J Units

Stations 3 5001-9435 1 & J Units

Stations 9 5001-9332 1 & J Units

Stations 41 5001-9660 1 & J Units

Stations 1 5001-9092 1 & J Units

Stations 3 5001-9505 1 & J Units

Stations 3 5001-9014 1 & J Units

Status Lamps 7 5001-9279 1 & J Units

Status Lamps 39 5001-9375 1 & J Units

Status Lamps 6 5001-9378 1 S J Units

Stations 33 SF338 1 S J Units

Power Amplifier 1 5100-9411 1201

128 Point CPU 1 5011-9092 1201

RFP-2021-NHH-01-FIREA^1

Norris, Inc.

Exhibit B-1 Equipment List

Page l of 2

Contractor Initials

Date

wr

New Hampshire Department of Health and Human Service's

Fire Alarm and Life Safety System Testing and Maintenance

Exhibit B-1

NURSE CALL EQUIPMENT - APS - UNITS C, D, E, F, G & H: DUKANE PROCARE 2000

Item Number

Master Station 6

Central Equipment & Termination Assembly 6

Gal! Only Buttons 252

Gail and Cancel Key Enabled Station 96

Corridor Lights 156

NURSE CALL EQiPMENT- APS - ISU UNIT

Ascom Telllqence Master Station 1

Sub Master Station 3

Key Switch 14

Cancel Pad 14

Patient Room Button 14

Patient Bath Button 18

Dome Lights 15

LIST OF DURESS ALARM EQUIPMENT APS BUILDING:

Item Number.

DSX-Maxsys Control Communicator 1

Push Button. Key Reset Activators 37

RFP-2021-NHH-01 -FIREA-01

Norris, Inc.

Exhibit B-1 Equipment List

Contractor Initials

Date

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety System Testing and Maintenance Services

EXHIBIT C

Payment Terms

1. This Agreement is funded by:

1.1. 70% General funds.

1.2. 30% Other funds (Provider and Intra-Agency).

2. For the purposes of this Agreement:

2.1. The Department has identified the Contractor as a Contractor in

accordance with 2 CFR 200.330.

2.2. The Department has identified this Contract as NON-R&D, in accordance

with 2 CFR §200.87.

3. Payment for Life Safety Systems testing and maintenance services shall be

made as follows:

3.1. The Department shall reimburse the Contractor up to twenty-five percent

(25%) of the annual cost for each life safety system listed in Section 4,

Tabel 4.1, Subsection 4.1.1 below, in accordance with the inspection and

testing schedule referenced in Exhibit A, after completion and approval by

the Department for the activities in the scope of work.

•3.2. The Department shall reimburse the Contractor for corrective or

emergency repairs based on the actual expenditures for labor and parts,

in accordance with Exhibit A Section 3, Scope of Services, at the rates in

Section 4, Table 4.1, Subsection 4,1.2 below.

3.3. The Department will reimburse the Contractor up to $2,000 per State

Fiscal Year for cost of parts incurred during routine maintenance and

repairs, as approved by the Department.

3.4. The Contractor shall submit a quarterly invoice for testing costs for each

system in Section 4, Table 4.1 below, within thirty (30) days from the of

the completed inspection.

3.5. The Contractor shall submit individual invoices for corrective or

emergency repair work according to Section 4, Table 4.1 below, within

thirty (30) days from the date of service.

3.6. The State shall make payment to the Contractor within sixty (60) days of

receipt of each invoice approved by the Department for services provided

pursuant to this Agreement.. 4. Payment for Life Safety Systems testing and maintenance services shall be

made per the rate schedule in Table 4.1, below:

Norris, Inc. Exhibit C Contractor Initials.

RFP-2020-NHH-01-FiREA-01 Date ^l\oll-OZx}

Rev. 01/08/19 '

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety System Testing and Maintenance Services

EXHIBIT C

Table 4.1

Service Tvoe: Amount

4.1.1 Annual Testiha Cost:

Annual Testing Cost for Fire Detection Systems: $20,441

Annual Testing Cost for Pharmacy Security Systems: $952

Annual Testing Cost for Nurse Call System: $2,550

Annual Testing Cost for Duress Call System: $952

Total Annual Testing Cost for all 4 systems above: $24,895

4.1.2 Corrective and Emeraencv Repair Hourlv Labor Rates:

A. Scheduled Repair Service, Labor Cost per hour: $135

B. Emergency Services Calls (during normal business hours'), Labor

Cost per hour: $203

C. Emergency Service Calls (outside of normal business hours'),

Labor Cost per hour: ' $203

'Normal business hours are from 7:00 am to 3:30 PM, Monday

through Friday, excluding holidays for State Employees

(http://www. admin, state, nh. us/hr/index. html).

5. In lieu of hard copies, all invoices may be assigned an electronic signature and

emailed to NHHFinancialServices@dhhs.nh.qov. or invoices may be mailed to:

New Hampshire Hospital

Financial Services

36 Clinton Street

Concord, NH 03301

6. The State shall make payment to the Contractor within thirty (30) days of receipt

of each invoice, subsequent to approval of the submitted invoice and if sufficient

funds are available, subject to Paragraph 4 of the General Provisions Form

Number P-37 of this Agreement.

Norris, Inc.

RFP-2020-NHH-01-FIREA-01

Rev. 01/08/19

Exhibit C

pl^Contraclor Initials

Date 6/W2X)ZJ

5^

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety System Testing and Maintenance Services

EXHIBIT C

7. The final invoice shall be due to the State no later than forty (40) days after the

contract completion date specified in Form P-37. General Provisions Block 1.7

Completion Date.

8. The Contractor must provide the services in Exhibit B, Scope of Services, in

compliance with funding requirements.

9. The Contractor agrees that funding under this Agreement may be withheld, In

whole or in part in the event of non-compliance with the terms and conditions of

Exhibit B, Scope of Services.

10. Notwithstanding-anything to the contrary herein, the Contractor agrees that

funding under this agreement may be withheld, in whole or in part, in the event

of non-compliance with any Federal or State law, rule or regulation applicable

to the services provided, or if the said services or products have not been

satisfactorily completed in accordance with the terms and conditions of this

agreement.

11. Notwithstanding Paragraph 17 of the General Provisions Form P-37, changes

limited to adjusting amounts within the price limitation and adjusting

encumbrances between State Fiscal Years and budget class lines through the

Budget Office may be made by written agreement of both parties, without

obtaining approval of the Governor and Executive Council, if needed and

justified.

12. Audits

12.1. The Contractor is required to submit an annual audit to the Department if

any of the following conditions exist: '

12.1.1. Condition A - The Contractor expended $750,000 or more in

federal funds received as a subrecipient pursuant to 2 CFR Part

200, during the most recently completed fiscal year.

12.1.2. Condition B - The Contractor is subject to audit pursuant to the

requirements of NH RSA 7:28, lll-b, pertaining to charitable

organizations receiving support of $1,000,000 or more.

12.1.3. Condition C - The Contractor is a public company and required

by Security and Exchange Commission (SEC) regulations to

submit an annual financial audit.

12.2. If Condition A exists, the Contractor shall submit an annual single audit

performed by an independent Certified Public Accountant (CPA) to the

Department within 120 days after the close of the Contractor's fiscal year,

conducted in accordance with the requirements of 2 CFR Part 200,

Subpart F of the Uniform Administrative Requirements, Cost Principles,

and Audit Requirements for Federal awards,

jOp—-Norris. fnc. Exhibit C Contractor Initials

RFP-2020-NHH-0l-FIReA-01 Date

Rev. 01/08/19

New Hampshire Department of Health and Human Services

Fire Alarm and Life Safety System Testing and Maintenance Services

EXHIBIT C

12.3. If Condition 8 or Condition C exists, the Contractor shall submit an annual

financial audit performed by an independent CPA within 120 days after

the close of the Contractor's fiscal year.

13. In addition to, and not in any way in limitation of obligations of the Contract, it is

understood and agreed by the Contractor that the Contractor shall be held liable

for any state or federal audit exceptions and shall return to the Department all

payments made under the Contract to which exception has been taken, or which

have been disallowed because of such an exception.

Norris. Inc. Exhibit C Contractor Initials

RFP-2020-NHH-01-FIREA-01 Date_

Rev. 01/08/19

New Hampshire Department of Health and Human Services

Standard Exhibits D-H

The parties agree that the Department's Standard Exhibits D through Exhibit H are not applicable to this

Agreement.

Remainder of page intentionally left blank.

Exhibit K Contractor Initials j» j

DHHS information Security Requirements Date

New Hampshire Department of Health and Human Services

Exhibit I

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

BUSINESS ASSOCIATE AGREEMENT

The Contractor identified in Section 1.3 of the General Provisions of the Agreement agrees to

comply with the Health Insurance Portability and Accountability Act. Public Law 104-191 and

with the Standards for Privacy and Security of individually Identifiable Health Information, 45

CFR Parts 160 and 164 applicable to business associates. As defined herein, "Business

Associate" shall mean the Contractor and subcontractors and agents of the Contractor that

receive, use or have access to protected health information under this Agreement and "Covered

Entity" shall mean the State of New Hampshire, Department of Health and Human Services.

(1) Definitions.

a. "Breach" shall have the same meaning as the term "Breach" in section 164.402 of Title 45,

Code of Federal Regulations.

b. "Business Associate" has the meaning given such term in section 160.103 of Title 45, Code

of Federal Regulations.

c. "Covered Entity" has the meaning given such term in section 160.103 of Title 45,

Code of Federal Regulations.

d. "Desionated Record Set" shall have the same meaning as the term "designated record set"

in 45 CFR Section 164.501.

e. "Data AoareQation" shall have the same meaning as the term "data aggregation" in 45 CFR

Section 164.501.

f. "Health Care Operations" shall have the same meaning as the term "health care operations"

in 45 CFR Section 164.501.

g. "HITECH Act" means the Health Information Technology for Economic and Clinical Health

Act, TitleXIII, Subtitle D, Part 1 & 2 of the American Recovery and Reinvestment Act of

2009.

h. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law

104-191 and the Standards for Privacy and Security of individually identifiable Health

Information, 45 CFR Parts 160,162 and 164 and amendments thereto.

i. "Individual" shall have the same meaning as the term "individual" in 45 CFR Section 160.103

and shall include a person who qualifies as a personal representative in accordance with 45

CFR Section 164.501(g).

j. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health

Information at 45 CFR Parts 160 and 164, promulgated under HIPAA by the United States

Department of Health and Human Services.

k. "Protected Health Information" shall have the same meaning as the term "protected health

information" in 45 CFR Section 160.103, limited to the information created or received by

Business Associate from or on behalf of Covered Entity.

3/2014 Exhibit I Contractor Initials

Health Insurance Portability Actncaiiii iitdUidHUQ rtjiiauiMky «

Business Associate Agreement W L/'2 OPage lot 6 Date

New Hampshire Department of Health and Human Services

Exhibit I

5r:

I. "Required bv Law" shall have the same meaning as the term "required by law" in 45 CFR

Section 164.103.

m "Secretary" shall mean the Secretary of the Department of Health and Human Services or

his/her destgnee.

n. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected

Health Information at 45 CFR Part 164. Subpart C, and amendments thereto.

0. "Unsecured Protected Health Information" means protected health information that is not

secured by a technology standard that renders protected health information unusable,

unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by

a standards developing organization that is accredited by the American National Standards

Institute.

p. Other Definitions - All terms not otherwise defined herein shall have the meaning

established under 45 C.F.R. Parts 160, 162 and 164, as amended from time to time, and the

HITECH

Act.

(2) Business Associate Use and Disclosure of Protected Health Information.

a. Business Associate shall not use. disclose, maintain or transmit Protected Health

Information (PHI) except as reasonably necessary to provide the services outlined under

Exhibit A of the Agreement. Further, Business Associate, including but not limited to all

its directors, officers, employees and agents, shall not use. disclose, maintain or transmit

PHI in any manner that would constitute a violation of the Privacy and Security Rule.

b. Business Associate may use or disclose PHI:

I. For the proper management and administration of the Business Associate;

II. As required by law. pursuant to the terms set forth in paragraph d. below; or

III. For data aggregation purposes for the health care operations of Covered

Entity.

c. To the extent Business Associate is permitted under the Agreement to disclose PHI to a

third party, Business Associate must obtain, prior to making any such disclosure, (i)

reasonable assurances from the third party that such PHI will be held confidentially and

used or further disclosed only as required by law or for the purpose for which it was

disclosed to the third party; and (ii) an agreement from such third party to notify Business

Associate, in accordance with the HIPAA Privacy, Security, and Breach Notification

Rules of any breaches of the confidentiality of the PHI, to the extent it has obtained

knowledge of such breach.

d. The Business Associate shall not, unless such disclosure is reasonably necessary to

provide services under Exhibit A of the Agreement, disclose any PHI in response to a

request for disclosure on the basis that it is required by law, without first notifying

Covered Entity so that Covered Entity has an opportunity to object to the disclosure and

to seek appropriate relief. If Covered Entity objects to such disclosure, the Business

3/2014 Exhibit I Contractor Initials.

Health Insurance Portability Act

BusinessAssocialeAgreement aA.

Date I

New Hampshire Department of Health and Human Services

Exhibit I

Associate shall refrain from disclosing the PHI until Covered Entity has exhausted all

remedies.

e. If the Covered Entity notifies the Business Associate that Covered Entity has agreed to

be bound by additional restrictions over and above those uses or disclosures or security

safeguards of PHI pursuant to the Privacy and Security Rule, the Business Associate

shall be bound by such additional restrictions and shall not disclose PHI in violation of •

such additional restrictions and shall abide by any additional security safeguards.

(3) Obligations and Activities of Business Associate.

a. The Business Associate shall notify the Covered Entity's Privacy Officer immediately

after the Business Associate becomes aware of any use or disclosure of protected

health information not provided for by the Agreement including breaches of unsecured

protected health information and/or any security incident that may have an impact on the

protected health information of the Covered Entity.

b. The Business Associate shall immediately perform a risk assessment when it becomes

aware of any of the above situations. The risk assessment shall include, but not be

limited to:

0 The nature and extent of the protected health information involved, including the

types of identifiers and the likelihood of re-identification;

o The unauthorized person used the protected health information or to whom the

disclosure was made;

o Whether the protected health information was actually acquired or viewed

0 The extent to which the risk to the protected, health information has been

mitigated.

The Business Associate shall complete the risk assessment within 48 hours of the

breach and immediately report the findings of the risk assessment in writing to the

Covered Entity.

c. The Business Associate shall comply with all sections of the Privacy, Security, and

Breach Notification Rule.

d. Business Associate shall make available all of its internal policies and procedures, books

and records relating to the use and disclosure of PHI received from, or created or

received by the Business Associate on behalf of Covered Entity to the Secretary for

purposes of determining Covered Entity's compliance with HIPAA and the Privacy and

Security Rule.

e. Business Associate shall require all of its business associates that receive, use or have

access to PHI under the Agreement, to agree in writing to adhere to the same

restrictions and conditions on the use and disclosure of PHI contained herein, including

the duty to return or destroy the PHI as provided under Section 3 (I). The Covered Entity

shall be considered a direct third party beneficiary of the Contractor's business associate

agreements with Contractor's intended business associates, who will be receiving PHI

3/2014 Exhibit I Contractor Initials

Health Insurance Portability Act

Business Associate Agreement a

Oate_lll__fr

New Hampshire Department of Health and Human Services

Exhibit i

pursuant to this Agreement, with rights of enforcement and indemnification from such

business associates who shall be governed by standard Paragraph #13 of the standard

contract provisions (P-37) of this Agreement for the purpose of use and disclosure of

protected health information.

f. Within five (5) business days of receipt of a written request from Covered Entity,

Business Associate shall make available during normal business hours at its offices all

records, books, agreements, policies and procedures relating to the use and disclosure

of PHI to the Covered Entity, for purposes of enabling Covered Entity to determine

Business Associate's compliance with the terms of the Agreement.

g. Within ten (10) business days of receiving a written request from Covered Entity,

Business Associate shall provide access to PHI in a Designated Record Set to the

Covered Entity, or as directed by Covered Entity, to an individual in order to meet the

requirements under 45 CFR Section 164.524.

h. Within ten (10) business days of receiving a written request from Covered Entity for an

amendment of PHI or a record about an individual contained in a Designated Record

Set, the Business Associate shall make such PHI available to Covered Entity for

amendment and incorporate any such amendment to enable Covered Entity to fulfill its

obligations under 45 CFR Section 164.526.

I. Business Associate shall document such disclosures of PHI and information related to

such disclosures as would be required for Covered Entity to respond to a request by an

individual for an accounting of disclosures of PHI in accordance with 45 CFR Section

164.528.

j. Within ten (10) business days of receiving a written request from Covered Entity for a

request for an accounting of disclosures of PHI, Business Associate shall make available

to Covered Entity such information as Covered Entity may require to fulfill Its obligations

to provide an accounting of disclosures with respect to PHI In accordance with 45 CFR

Section 164.528.

k. In the event ariy Individual requeMs access to, amendment of, or accounting of PHI

directly from the Business Associate, the Business Associate shall within two (2)

business days forward such request to Covered Entity. Covered Entity shall have the

responsibility of responding to forwarded requests. However, If forwarding the

Individual's request to Covered Entity would cause Covered Entity or the Business

Associate to violate HIPAA and the Privacy and Security Rule, the Business Associate

shall Instead respond to the individual's request as required by such law and notify

Covered Entity of such response as soon as practicable.

I. Within ten (10) business days of termination of the Agreement, for any reason, the

Business Associate shall return or destroy, as specified by Covered Entity, all PHI

received from, or created or received by the Business Associate in connection with the

Agreement, and shall not retain any copies or back-up tapes of such PHI. If return or

destruction is not feasible, or the disposition of the PHI has been otherwise agreed to in

the Agreement. Business Associate shall continue to extend the protections of the

Agreement, to such PHI and limit further uses and disclosures of such PHI to those

purposes that make the return or destruction infeasible, for so long as Business

3/2014 Exhibit I Contractor Initials.

Heallh insurance Portability Act

Business Associate Agreement f-.

Dale_Whf2^

New Hampshire Department of Health and Human Services

Exhibit I

'4^.

Associate maintains such PHI. If Covered Entity, in its sole discretion, requires that the

Business Associate destroy any or all PHI, the Business Associate shall certify to

Covered Entity that the PHI has been destroyed.

(4) Obligations of Covered Entitv

a. Covered Entity shall notify Business Associate of any changes or limitation(s) in its

Notice of Privacy Practices provided to individuals in accordance with 45 CFR Section

164.520, to the extent that such change or limitation may affect Business Associate's

use or disclosure of PHI.

b. Covered Entity shall promptly notify Business Associate of any changes in, or revocation

of permission provided to Covered Entity by individuals whose PHI may be used or

disclosed by Business Associate under this Agreement, pursuant to 45 CFR Section

164.506 or 45 CFR Section 164.508.

c. Covered entity shall promptly notify Business Associate of any restrictions on the use or

disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522,

to the extent that such restriction may affect Business Associate's use or disclosure of

PHI.

(5) Termination for Cause

In addition to Paragraph 10 of the standard terms and conditions (P-37) of this

Agreement the Covered Entity may Immediately terminate the Agreement upon Covered

Entity's knowledge of a breach by Business Associate of the Business Associate

Agreement set forth herein as Exhibit I. The Covered Entity may either immediately

terminate the Agreement or provide an opportunity for Business Associate to cure the

alleged breach within a timeframe specified by Covered Entity. If Covered Entity

determines that neither termination nor cure Is feasible. Covered Entity shall report the

violation to the Secretary.

(6) IVIiscellaneous

a. Definitions and Regulatory References. All terms used, but not otherwise defined herein,

shall have the same meaning as those terms in the Privacy and Security Rule, amended

from time to time, A reference in the Agreement, as amended to include this Exhibit I, to

a Section In the Privacy and Security Ruie means the Section as in effect or as

amended.

b. Amendment. Covered Entity and Business Associate agree to take such action as is

necessary to amend the Agreement, from time to time as is necessary for Covered

Entity to comply with the changes in the requirements of HIPAA, the Privacy and

Security Rule, and applicable federal and state law.

c. Data Ownership. The Business Associate acknowledges that it has no ownership rights

with respect to the PHI provided by or created on behalf of Covered Entity.

d. Interpretation. The parties agree that any ambiguity in the Agreement shall be resolved

to permit Covered Entity to comply with HIPAA, the Privacy and Security Rule.

3/2014 Exhibit I Contractor (nilials

Health Insurance Portability Act

Business Associate Agreement

Date. 02^

New Hampshire Department of Health and Human Services

Exhibit I

SedreQation. If any term or condition of this Exhibit I or the application thereof to any

person(s) or circumstance is held invalid, such invalidity shall not affect other terms or

conditions which can be given effect without the invalid term or condition; to this end the

terms and conditions of this Exhibit I are declared severable.

Survival. Provisions In this Exhibit I regarding the use and disclosure of PHI, return or

destruction of PHI, extensions of the protections of the Agreement in section (3) I. the

defense and indemnification provisions of section (3) e and Paragraph 13 of the

standard terms and conditions (P-37), shall survive the termination of the Agreement.

IN WITNESS WHEREOF, the parties hereto have duly executed this Exhibit I.

Department of Health and Human Services

The State

S Ik^C ■

Name of the Confractor

Ignature of Authorized ReoSignature of Authorized Representative

Name of Authorized Representative

CC 0Title of Authorized Representative

S h

Date

Signature'of Authorized ReF|resentative

h.

Name of Authorized Representative

Title of Authorized Representative

Date

3/2014 Exhibit I

Health Inauranca Portability Act

Buaineaa Associate AQreemenl

Contractor Initials i

Da(e_

New Hampshire Department of Health and Human Services

Exhibit J

CERTIFICATION REGARDING THE FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY

ACT {FFATAI COMPLIANCE

The Federal Funding Accountability and Transparency Act (FFATA) requires prime awardees of individual

Federal grants equal to or greater than $25,000 and awarded on or after October 1, 2010, to report on

data related to executive compensation and associated first-tier sub-grants of $25,000 or more. If the

initial award is below $25,000 but subsequent grant modifications result in a total award equal to or over

$25,000, the award is subject to the FFATA reporting requirements, as of the date of the award.

In accordance with 2 CFR Part 170 (Reporting Subaward and Executive Compensation Information), the

Department of Health and Human Services (DHHS) must report the following information for any.

suliaward or contract award subject to the FFATA reporting requirements:

1. Name of entity

2. Amount of award

3. Funding agency

4. NAICS code for contracts / CFDA program number for grants

5. Program source

6. Award title descriptive of the purpose of the funding action

7. Location of the entity

8. Principle place of performance

9. Unique identifier of the entity (DUNS #)

10. Total compensation and names of the top five executives if:

10.1. More than 80% of annual gross revenues are from the Federal govemment, and those

revenues are greater than $25M annually and

10.2. Compensation information is not already available through reporting to the SEC.

Prime grant recipients must submit FFATA required data by the end of the month, plus 30 days, in which

the award or award amendment is made.

The Contractor identified in Section 1.3 of the General Provisions agrees to comply with the provisions of

The Federal Funding Accountability and Transparency Act, Public Law 109-282 and Public Law 110-252,

and 2 CFR Part 170 (Reporting Subaward and Executive Compensation Information), and further agrees

to have the Contractor's representative, as identified in Sections 1.11 and 1.12 of the General Provisions

execute the following Certification:

The below named. Contractor agrees to provide needed information as outlined above to the NH

Department of Health and Human Services and to comply with all applicable provisions of the Federal

Financial Accountability and Transparency Act.

Date

Contractor Name: jJ /w C

Name:

P/2-—Exhibit J - Certification Regarding the Federal Funding Coritractor Initials '

Accountability And Transparency Act (FFATA) Compliance A ///•?/ •? •

cu/OHHs;iJ0713 Date *•'*/

New Hampshire Department of Health and Human Services.

Exhibit J

FORMA

As the Contractor identified in Section 1.3 of the General Provisions, I certify that the responses to the

below listed questions are true and accurate.

1. The DUNS number for your entity is:

2. In your business or organization's preceding completed fiscal year, did your business or organization

receive (1) 80 percent or more of your annual gross revenue in U.S. federal contracts, subcontracts,

loans, grants, sub-grants, and/or cooperative agreements; and (2) $25,000,000 or more in annual

gross revenues from U.S. federal contracts, subcontracts, loans, grants, subgrants, and/or

cooperative agreements?

X NO YES

If the answer to #2 above is NO, stop, here

If the answer to #2 above is YES, please answer the following:

3. Does the public have access to information about the compensation of the executives in your

business or organization through periodic reports filed under section 13(a} or 15(d) of the Securities

Exchange Act of 1934 (15 U.S.C.78m(a). 78o(d)) or section 6104 of the Internal Revenue Code of

1986?

NO YES

If the answer to #3 above is YES, stop here

If the answer to #3 above is NO. please answer the following:

4. The names and compensation of the five most highly compensated officers in your business or

organization are as follows:

Name:

Name:

Name:

Name:

Name:

Amount:

Amount;

Amount:

Amount:

Amount

CU/CHHS;i 10713

Exhibit J - Certitlcatlon Regarding the Federal Funding

Accountability And Transparency Act (FFATA) Complianco

Contractor InitialsIrh.

Date M 102X

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

A. Definitions

The following terms may be reflected and have the described meaning in this document:

1. "Breach" means the loss of control, compromise, unauthorized disclosure,

unauthorized acquisition, unauthorized access, or any similar term referring to

situations where persons other than authorized users and for an other than

authorized purpose have access or potential access to personally identifiable

information, whether physical or electronic. With regard to Protected Health

Information," Breach" shall have the same meaning as the term "Breach" in section

164.402 of Title 45, Code of Federal Regulations.

2. "Computer Security Incident" shall have the same meaning "Computer Security

Incident" in section two (2) of NIST Publication 800-61, Computer Security Incident

Handling Guide. National Institute of Standards and Technology, U.S. Department

of Commerce.

3. "Confidential Information" or "Confidential Data" means all confidential information

disclosed by one party to the other such as all medical, health, financial, public

assistance benefits and persona) information including without limitation. Substance

Abuse Treatment Records, Case Records, Protected Health Information and

Personally Identifiable Information.

Confidential Information also includes any and all information owned or managed by

the State of NH - created, received from or on behalf of the Department of Health and

Human Services (DHHS) or accessed in the course of performing contracted

services - of which collection, disclosure, protection, and disposition is governed by

state or federal law or regulation. This information includes, but is not limited to

Protected Health Information (PHI). Personal Information (PI), Personal Financial

Information (PFI), Federal Tax Information (FTI), Social Security Numbers (SSN),

Payment Card Industry (PCI), and or other sensitive and confidential information.

4. "End User" means any person or entity (e.g., contractor, contractor's employee,

business associate, subcontractor, other downstream user, etc.) that receives

DHHS data or derivative data in accordance with the terms of this Contract.

5. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and the

regulations promulgated thereunder.

6. "Incident" means an act that potentially violates an explicit or implied security policy,

which includes attempts (either failed or successful) to gain unauthorized access to a

system or its data, unwanted disruption or denial of service, the unauthorized use of

a system for the processing or storage of data; and changes to system hardware,

firmware, or software characteristics without the owner's knowledge, instruction, or

consent. Incidents include the loss of data through theft or device misplacement, toss

or misplacement of hardcopy documents, and misrouting of physical, or electronic

vs. Last update 10/09/18 Exhibit K Contfactorlnitiais '

DHHS Information

Security Requirements £il /, jt-? » -TjhPage 1 of9 Date

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

mail, all of which may have the potential to put the data at risk of unauthorized

access, use, disclosure, modification or destruction.

7. "Open Wireless Network" means any network or segment of a network that is

not designated by the State of New Hampshire's Department of Information

Technology or delegate as a protected network (designed, tested, and

approved, by means of the State, to transmit) will be considered an open

network and not adequately secure for the transmission of unencrypted PI, PFI,

PHI or confidential DHHS data.

8. "Personal Information" (or "PI") means information which can be used to distinguish

or trace an individual's identity, such as their name, social security number, personal

information as defined in New Hampshire RSA 359-C:19, biometric records, etc.,

alone, or when combined with other personal or identifying information which is linked

or linkable to a specific Individual, such as date and place of birth, mother's maiden

name, etc.

9. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health

Information at 45 C.F.R. Parts 160 and 164, promulgated under HIPAA by the United

States Department of Health and Human Services.

10. "Protected Health Information" (or "PHI") has the same meaning as provided in the

definition of "Protected Health Information" in the HIPAA Privacy Rule at 45 C.F.R. §

160.103.

11. "Security Rule" shall mean the Security Standards for the Protection of Electronic

Protected Health Information at 45 C.F.R. Part 164, Subpart C. and amendments

thereto.

12. "Unsecured Protected Health Information" means Protected Health Information that is

not secured by a technology standard that renders Protected Health Information

unusable, unreadable, or indecipherable to unauthorized individuals and is

developed or endorsed by a standards developing organization that is accredited by

the American National Standards Institute.

I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR

A. Business Use and Disclosure of Confidential Information.

1. The Contractor must not use. disclose, maintain or transmit Confidential Information

except as reasonably necessary as outlined under this Contract. Further, Contractor,

including but not limited to all its directors, officers, employees and agents, must not

use, disclose, maintain or transmit PHI in any manner that would constitute a violation

of the Privacy and Security Rule.

2. The Contractor must not disclose any Confidential Information in response to a

vs. Last update 10/09/18 Exhibit K Contractor Initials

DHHS Information

Security Requirements) j

Date ^ /'Zcg-i

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

request for disclosure on the basis that it is required by law, in response to a

subpoena, etc., without first notifying DHHS so that DHHS has an opportunity to

consent or object to the disclosure.

3. If DHHS notifies the Contractor that DHHS has agreed to be bound by additional

restrictions over and above those uses or disclosures or security safeguards of PHI

pursuant to the Privacy and Security Rule, the Contractor must be bound by such

additional restrictions, and must not disclose PHI in violation of such additional

restrictions and must abide by any additional security safeguards.

4. The Contractor agrees that DHHS Data or derivative there from disclosed to an End

User must only be used pursuant to the terms of this Contract.

5. The Contractor agrees DHHS Data obtained under this Contract may not be used for

any other purposes that are not Indicated in this Contract.

6. The Contractor agrees to grant access to the data to the authorized representatives

of DHHS for the purpose of inspecting to confirm compliance with the terms of this

Contract.

II. METHODS OF SECURE TRANSMISSION OF DATA

1. Application Encryption. If End User is transmitting DHHS data containing

Confidential Data between applications, the Contractor attests the applications have

been evaluated by an expert knowledgeable in cyber security and that said

application's encryption capabilities ensure secure transmission via the internet.

2. Computer Disks and Portable Storage Devices. End User may not use computer disks

or portable storage devices, such as a thumb drive, as a method of transmitting DHHS

data.

3. Encrypted Email. End User may only employ email to transmit Confidential Data if

email is encrypted and being sent to and being received by email addresses of

persons authorized to receive such information.

4. Encrypted Web Site. If End User is employing the Web to transmit Confidential

Data, the secure socket layers (SSL) must be used and the web site must be

secure. SSL encrypts data transmitted via a Web site.

5. File Hosting Services, also known as File Sharing Sites. End User may not use file

hosting services, such as Dropbox or Google Cloud Storage, to transmit

Confidential Data.

6. Ground Mail Service. End User may only transmit Confidential Data via cert/f/ed ground

mail within the continental U.S. and when sent to a named individual.

7. Laptops and PDA. If End User is employing portable devices to transmit

Confidential Data said devices must be encrypted and password-protected.

8. Open Wireless Networks. End User may not transmit Confidential Data via an open

vs. Ust update 10/09/18 Exhibit K Contractorinitials.

DHHS Infofmation

Security Requirementsirity Requirements a /;

Dale

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

wireless network. End User must employ a virtual private network (VPN) when

remotely transmitting via an open wireless network.

9. Remote User Communication. If End User is employing remote communication to

access or transmit Confidential Data, a virtual private network (VPN) must be

installed on the End User's mobile device(s) or laptop from which information will be

transmitted or accessed.

10. SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. If

End User is employing an SFTP to transmit Confidential Data, End User will

structure the Folder and access privileges to prevent inappropriate disclosure of

information. SFTP folders and sub-folders used for transmitting Confidential Data will

be coded for 24-hour auto-deletion cycle (i.e. Confidential Data will be deleted every 24

hours).

11. Wireless Devices. If End User is transmitting Confidential Data via wireless devices, all

data must be encrypted to prevent inappropriate disclosure of information.

RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS

The Contractor will only retain the data and any derivative of the data for the duration of this

Contract. After such time, the Contractor will have 30 days to destroy the data and any

derivative in whatever form it may exist, unless, otherwise required by law or permitted

under this Contract. To this end, the parties must:

A. Retention

1. The Contractor agrees it will not store, transfer or process data collected in

connection with the services rendered under this Contract outside of the United

States. This physical location requirement shall also apply in the implementation of

cloud computing, cloud service or cloud storage capabilities, and includes backup

data and Disaster Recovery locations.

2. The Contractor agrees to ensure proper security monitoring capabilities are in

place to detect potential security events that can impact State of NH systems

and/or Department confidential Information for contractor provided systems.

3. The Contractor agrees to provide security awareness and education for its End

Users in support of protecting Department confidential information.

4. The Contractor agrees to retain all electronic and hard copies of Confidential Data

in a secure location and identified in section IV. A.2

5. The Contractor agrees Confidential Data stored in a Cloud must be in a

FedRAMP/HITECH compliant solution and comply with all applicable statutes and

regulations regarding the privacy and security. All servers and devices must have

currently-supported and hardened operating systems, the latest anti-viral, antl-

hacker, anti-spam, anti-spyware, and anti-malware utilities. The environment, as a

vs. Last update 10/09/18 Exhibit K Conlractorlnilials

DHHS Infocmatlon

Security Requirements /))j.

Daie ^

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

whole, must have aggressive Intrusion-detection and firewall protection.

6. The Contractor agrees to and ensures its complete cooperation with the State's

Chief Information Officer in the detection of any security vulnerability of the hosting

infrastructure.

B. Disposition

1. If the Contractor will maintain any Confidential Information on its systems (or its

sub-contractor systems), the Contractor will maintain a documented process for

securely disposing of such data upon request or contract termination: and will

obtain written certification for any State of New Hampshire data destroyed by the

Contractor or any subcontractors as a part of ongoing, emergency, and or disaster

recovery operations. When no longer in use, electronic media containing State of

New Hampshire data shall be rendered unrecoverable via a secure wipe program

in accordance with industry-accepted standards for secure deletion and media

sanitization, or otherwise physically destroying the media (for example,

degaussing) as described in NISI Special Publication 800-88, Rev 1, Guidelines

for Media Sanitization, National Institute of Standards and Technology, U. S.

Department of Commerce. The Contractor will document and certify in writing at

time of the data destruction, and will provide written certification to the Department,

upon request. The written certification will include all details necessary to

demonstrate data has been properly destroyed and validated. Where applicable,

regulatory and professional standards for retention requirements will be jointly

evaluated by the State and Contractor prior to destruction.

2. Unless othenA^ise specified, within thirty (30) days of the termination of this

Contract, Contractor agrees to destroy ail hard copies of Confidential Data using a

secure method such as shredding.

3. Unless otherwise specified, within thirty (30) days of the termination of this

Contract, Contractor agrees to completely destroy all electronic Confidential Data

by means of data erasure, also known as secure data wiping.

IV. PROCEDURES FOR SECURITY

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and any

derivative data or files, as follows:

1. The Contractor will maintain proper security controls to protect Department

confidential information collected, processed, managed, and/or stored in the delivery

of contracted services,

2. The Contractor will maintain policies and procedures to protect Department

confidential information throughout the information lifecycle, where applicable, (from

creation, transformation, use, storage and secure destruction) regardless, of the

media used to store the data (i.e.. tape, disk, paper, etc.).

vs. Last update 10/09/18 Exhibit K Contractor Initials

DHHS Information

Security Requirements Bib 17^2^ Date_f_j_

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

3. The Contractor will maintain appropriate authentication and access controls to

contractor systems that collect, transmit, or store Department confidential information

where applicable.

4. The Contractor will ensure proper security monitoring capabilities are in place to

detect potential security events that can impact State of NH systems and/or

Department confidential information for contractor provided systems!^

5. The Contractor will provide regular security awareness and education for its End

Users in support of protecting Department confidential information.

6. If the Contractor will be sut)-contracting any core functions of the engagement

supporting the services for State of New Hampshire, the Contractor will maintain a

program of an internal process or processes that defines specific security

expectations, and monitoring compliance to security requirements that at a minimum

match those for the Contractor, including breach notification requirements.

7. The Contractor will work with the Department to sign and comply with all applicable

State of New Hampshire and Department system access and authorization policies

and procedures, systems access forms, and computer use agreements as part of

obtaining and maintaining access to any Department system(s). Agreements will be

completed and signed by the Contractor and any applicable sub-contractors prior to

system access being authorized.

8. If the Department determines the Contractor is a Business Associate pursuant to 45

CFR 160.103, the Contractor will execute a HIPAA Business Associate Agreement

(BAA) with the Department and is responsible for maintaining compliance with the

agreement.

9. The Contractor will work with the Department at its request to complete a System

Management Survey. The purpose of the survey is to enable the Department and

Contractor to monitor for any changes in risks, threats, and vulnerabilities that may

occur over the life of the Contractor engagement. The survey will be completed

annually, or an alternate time frame at the Departments discretion with agreement by

the Contractor, or the Department may request the survey be completed when the

scope of the engagement between the Department and the Contractor changes.

10. The Contractor will not store, knowingly or unknowingly, any State of New Hampshire

or Department data offshore or outside the boundaries of the United States unless

prior express written consent is obtained from the Information Security Office

leadership member within the Department.

11. Data Security Breach Liability. In the event of any security breach Contractor shall

make efforts to investigate the causes of the breach, promptly take measures to

prevent future breach and minimize any damage or loss resulting from the breach.

The State shall recover from the Contractor all costs of response and recovery from

vs. Laslupdale 10/09/18 Exhibit K Contractor Initials

DHHS Information

Security Requirements lo y-i

Date

/*»

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

the breach, including but not limited to: credit monitoring services, mailing costs and

costs associated with website and telephone call center services necessary due to

the breach.

12. Contractor must, comply with all applicable statutes and regulations regarding the

privacy and security of Confidential Information, and must in all other respects

maintain the privacy and security of PI and PHI at a level and scope that is not less

than the level and scope of requirements applicable to federal agencies, including,

but not limited to, provisions of the Privacy Act of 1974 (5 U.S.C. § 552a), DHHS

Privacy Act Regulations (45 C.F.R. §5b). HIPAA Privacy and Security Rules (45

C.F.R. Parts 160 and 164) that govern protections for individually identifiable health

information and as applicable under State law.

13. Contractor agrees to establish and maintain appropriate administrative, technical, and

physical safeguards to protect the confidentiality of the Confidential Data and to

prevent unauthorized use or access to it. The safeguards must provide a level and

scope of security that is not less than the level and scope of security requirements

established by the State of New Hampshire, Department of Information Technology.

Refer to Vendor Resources/Procurement at https://www.nh.gov/doit/vendor/index.htm

for the Department of Information Technology policies, guidelines, standards, and

procurement information relating to vendors.

14. Contractor agrees to maintain a documented breach notification and incident

response process. The Contractor will notify the State's Privacy Officer and the

State's Security Officer of any security breach immediately, at the email addresses

provided in Section VI. This includes a confidential information breach, computer

security incident, or suspected breach which affects or includes any State of New

Hampshire systems that connect to the State of New Hampshire network.

15. Contractor must restrict access to the Confidential Data obtained under this

Contract to only those authorized End Users who need such DHHS Data to

perform their official duties in connection with purposes identified in this Contract.

16. The Contractor must ensure that all End Users:

a. comply with such safeguards as referenced in Section IV A. above,

implemented to protect Confidential Information that is furnished by DHHS

under this Contract from loss, theft or inadvertent disclosure.

b. safeguard this information at all times.

c. ensure that laptops and other electronic devices/media containing PHI, PI, or

PFI are encrypted and password-protected.

d. send emails containing Confidential Information only if encrypted and being

sent to and being received by email addresses of persons authorized to

receive such information.

vs. Last upda(e 10/09/18 Exhibit K Contractor Initials

DHHS Information

Security Requirements a);

Dale_£w2£^

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

e. limit disclosure of the Confidential Information to the extent permitted by law.

f. Confidential Information received under this Contract arid individually

Identifiable data derived from DHHS Data, must be stored in an area that is

physically and technologically secure from access by unauthorized persons

during duty hours as well as non-duty hours (e.g., door locks, card keys,

biometric identifiers, etc.).

g. only authorized End Users may transmit the Confidential Data, Including any

derivative files containing personally identifiable Information, and in alt cases,

such data must be encrypted at all times when in transit, at rest, or when

stored on portable media as required in section IV above.

h. in all other instances Confidential Data must be maintained, used and

disclosed using appropriate safeguards, as determined by a risk-based

assessment of the circumstances involved.

i. understand that their user credentials (user name and password) must not be

shared with anyone. End Users will keep their credential information secure,

This applies to credentials used to access the site directly or Indirectly through

a third party application.

Contractor Is responsible for oversight and compliance of their End Users. DHHS

reserves the right to conduct onsile inspections to monitor compliance with this

Contract, including the privacy and security requirements provided in herein. HIPAA,

and other applicable laws and Federal regulations until such time the Confidential Data

is disposed of In accordance with this Contract.

V. LOSS REPORTING

The Contractor must notify the State's Privacy Officer and Security Officer of any

Security Incidents and Breaches immediately, at the email addresses provided in

Section VI.

The Contractor must further handle and report Incidents and Breaches involving PHI In

accordance with the agency's documented Incident Handling and Breach Notification

procedures and in accordance with 42 C.F.R. §§ 431.300 - 306. In addition to. and

notwithstanding. Contractor's compliance with all applicable obligations and procedures,

Contractor's procedures must also address how the Contractor will;

1. Identify Incidents:

2. Determine if personally identifiable information is involved in Incidents; '

3. Report suspected or confirmed Incidents as required in this Exhibit or P-37;

4. Identify and convene a core response group to determine the risk level of Incidents

and determine risk-based responses to Incidents; and

V5. Last update 10/09/18 Exhibit K Contractor Initials Pj^DHHS Information

Security Requirements,/i) / I.

Date ^

New Hampshire Department of Health and Human Services

Exhibit K

DHHS Information Security Requirements

5. Determine whether Breach notification is required, and, if so, identify appropriate

Breach notification methods, timing, source, and contents from among different

options, and bear costs associated with the Breach notice as well as any mitigation

measures.

Incidents and/or Breaches that implicate PI must be addressed and reported, as

applicable. In accordance with NH RSA 359-C:20.

VI. PERSONS TO CONTACT

A. DHHS Privacy Officer:

DHHSPrivacyOfficer@dhhs.nh.gov

B. DHHS Security Officer:

DHHSInformationSecurityOffice@dhhs.nh.gov

V5. Lastupdaie1(V09/18 Exhibit K Contractof Initials

DHHS information

Security Requirements i

pate t^l^l'T.CZc

State of New Hampshire

Department of State

CERTIFICATE

I, William M. Gardner, Secretary of State of the State of New Hampshire, do hereby certify that NORRIS. INC. is a Maine Profit

Corporation registered to do business in New Hampshire as NORRIS ALARM AND SOUND on June 20, 1996. I further certify

that all fees and documents required by the Secretary of Slate's otilce have been received and is in good standing as far as this

office is concerned.

Business ID: 250598

Certificate Number 0004929249

y

O

d

IN TESTIMONY WHEREOF,

I hereto set my hand and cause to be alllxed

the Seal of the State of New Hampshire,

this 11th day of June A.D. 2020.

William M. Gardner

Secretary of State

CERTIFICATE OF AUTHORITY

1, Joseph E. Lynch, hereby certify that;

1.1 am a duly elected Clerk/Secretary/Officer of Norris Inc.

2. The following is a true copy of a vote taken at a meeting of the Board of Directors/shareholders, duly called and

held on March 1, 2020, at which a quorum of the Directors/shareholders were present and voting.

VOTED: That. Peter Reed

is duly authorized on behalf of Norris, Inc. to enter into contracts or agreements with the State

of New Hampshire and any of its agencies or departments and further is authorized to execute any and all

documents, agreements and other instruments, and any amendments, revisions, or modifications thereto, which

may in his/her judgment be desirable or necessary to effect the purpose of this vote.

3.1 hereby certify that said vote has not been amended or repealed and remains in full force and effect as of the

date of the contract/contract amendment to which this certificate is attached. This authority remains valid for

thirty (30) days from the date of this Certificate of Authority. I further certify that it is understood that the State of

New Hampshire will rely on this certificate as evidence that the person(s) listed above currently occupy the

position(s) indicated and that they have full authority to bind the corporation. To the extent tljat there are any

limits on the authority of any listed individual to bind the corporation in coiitracts \^th^^^late cff Nev^ampshire,all such limitations are expressly stated herein. Jt/ L

Dated: 08/06/2020

Signature of Elected Officer

Name: Joseph E. Lynch

Title: CEO/Clerk

Rev. 03/24/20

yXCORD-

MINUSEC-01

CERTIFICATE OF LIABILITY INSURANCE

JRIOS

DATE (MMrtXjmrYY)

8/7/2020

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS

CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES

BELOW THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING iNSURER(S), AUTHORIZED

REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER.

IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed.

If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement A statement onthis r.firtlflr.ate does not confer rlqhts to tho certificate holder In lieu of such endorsement(s).

PRODUCER

Mesirow Insurance Services, Inc.

353 N Clark St 11th Floor

Chicago, IL 60654

CONTACT

K?.''nV E.t): (312) 595-6200 wc. no):

INSURER(S) AFFORDING COVERAGE NAICF

INSURER A: Zurich Amerlcah Insurance Comoanv 18535

INSURED

Norris, Inc.

2257 West Broadway

South Portland, ME 04106

INSURER a American Guarantee and Liability Insurance Company26247

iNSURERC:AmGUARb Insurance ComDanv 42390

INSURER E:

INSURER F:

COVERAGES CERTIFtCATE NUMBER: REVISION NUMBER:

THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIODINDICATED. NOTWITHSTANDING ANY REQUIREMENT. TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO VWICH THIS

CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.

INSR

JJB. TYPE OF INSURANCE

ADOt

JUSO.

COMMERCIAL GENERAL UABIUTY

CLAIMS-MADE | X | OCCUR

GENT AGGREGATE LIMIT APPLIES PER:

POLICY LOC

OTHER:

SUBR

WVD

E0L1027448

POLICY NUMBER

POUCYEFF I POUCYEXPiMM/ODrrrYYi immiod/yyyyi

5/1/2020 5/1/2021

EACH OCCURRENCE

DAMAGE TO RENTED

£BEMlS£S.l£Aificuaenc.e}_

MED EXP fAnv on» pytonl

PERSONAL A AOV INJURY

GENERAL AGGREGATE

PRODUCTS - COMP/OP AGG

1,000,000

300,000

5,000

1,000,000

2,000,000

2,000,000

AUTOMOBILE LiABlUTY

X ANY AUTO

OWNED

AUTOS ONLY

Al?l^ ONLY

COMBINED SINGLE LIMIT

<Ea acddecH)

1,000,000

BAP5547738 5/1/2020 5/1/2021 BODILY INJURY (Per peiton)

SCHEDULED

AUTOS BODILY INJURY (Par accldenil..RTY DAMAGE

(Per accidemi

UMBRELLA LtAB

EXCESS UAB

OCCUR.

CLAIMS-MADE

EACH OCCURRENCE 10,000,000

AUC0193910 5/1/2020 5/1/2021 AGGREGATE

10,000,000

OED X RETENTION S

WORKERS COMPENSATION

AND EMPLOYERS' UABIUTY

ANY PROPRIETOR/PARTNER/EXECUTIVE

I.....r/rAAn I

OFFICER/MEMBER EXCLUDED?

(Mandaloiy In NH|

If yes. desuiM under

DESCRIPTION OF OPERATIONS below

T > N

E

MIWC01S233 5/1/2020 5/1/2021

V PER

^ STATUTE

OTH-

FR

E.L. EACH ACCIDENT

1,000,000

E.L. DISEASE • EA EMPLOYEE 1,000,000

E.L. DISEASE-POLICY LIMIT

1,000,000

OESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORO 101. Addttlonal RemerVe Schedule, mey be attached W^reepaee li requljd) _ u.,

New Hampshire Department of Health and Human Services is an additional Insured wregarding the Commercial General Liability wrhen required by wnttencontracL

Now Hampshire Department of Health and Human Services

129 Pleasant Street

Concord, NH 03301

1

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE

THE EXPIRATION DATE THEREOF. NOTICE WILL BE DELIVERED IN

ACCORDANCE WITH THE POLICY PROVISIONS.

AUTHORIZED REPRESENTATIVE

ACORD 25(2016/03)

The ACORO name and logo are registered marks of ACORD