To: Board of Supervisors
From: Dr. Ori Tzvieli, Interim Health Services Director
Report Title: Contract #23-873 with Imprivata, Inc.
☒Recommendation of the County Administrator ☐ Recommendation of Board Committee
RECOMMENDATIONS:
APPROVE and AUTHORIZE the Interim Health Services Director, or designee, to execute on behalf of the County a Master Cloud Services Agreement with Imprivata, Inc., a corporation, in an amount not to exceed $52,859, for electronic health record threat detection software and services for Contra Costa Health (CCH) for the period from December 1, 2024 through November 30, 2027.
FISCAL IMPACT:
This Contract will result in contractual service expenditures of up to $52,859 over a 3-year period and will be funded 100% by Hospital Enterprise Fund I revenues.
BACKGROUND:
CCH Information Technology unit is further developing the organization from a security perspective to report and respond to unauthorized use of Epic, CCH's electronic health record system. Imprivata's FairWarning Platform is an analytics and insider threat detection platform that provides patient data privacy intelligence and drug diversion analytics that ingests hundreds of data sources and applies data logic and machine learning to identify potential breaches of protected information. CCH has been utilizing this application since 2017 to monitor activities within Epic and generate alerts of suspicious actions that may indicate Health Insurance Probability and Accountability Act of 1996 (HIPAA) violations.
On July 11, 2017, the Board of Supervisors approved a Master Purchase Agreement and related Order Form with FairWarning Inc., in an amount not to exceed $222,637 for the purchase of licenses, software, support, and (on-premises system implementation) for the period from July 11, 2017 through November 30, 2020.
On December 1, 2020, Imprivata Inc., acquired FairWarning, Inc., and the County began issuing Purchase Orders (to Imprivata) through the service period of November 30, 2024 (PO #031042). This Contractor was approved by the Public Works Department's Purchasing Division on November 25, 2024. A summary of service contract deliverables includes County’s access to the cloud hosted Imprivata software and services. This Contract was approved by Health Services Personnel to ensure there is no conflict with labor relations.
Under this Contract #23-873, the parties will execute the Imprivata Master Cloud Services Agreement (MSA) (including the County's (HIPAA) Business Associate Addendum) to migrate from an on-premises application to a cloud/SaaS application. Under the MSA, each party's liability is limited in aggregate to the amount paid to Imprivata over the twelve (12) month period preceding the claim giving rise to the liability. Under the Contract, the County is obligated to indemnify Imprivata for third-party claims arising out of the County’s unauthorized use of the cloud services, infringing a third party’s intellectual property rights, and placing County data in Imprivata’s cloud system that is violative of any law.
Approval of this new Contract #23-873 allows the Contractor to provide services through November 30, 2027. The division is requesting a retroactive start date due to delays that ensued in November 2024 due to internal process adjustments, staffing changes, and extended contract negotiations critical to securing mutually agreeable terms, safeguarding institutional interests, and ensuring alignment with current operational goals and compliance standards.
CONSEQUENCE OF NEGATIVE ACTION:
If this Contract is not approved, the department will be unable to track potential records misuse and unauthorized access to Protected Health Information that may indicate a HIPAA violation. Violations such as this could be detrimental to the County’s operational and financial standing.