To: Board of Supervisors
From: Dr. Grant Colfax, Health Services Director
Report Title: Purchase Order with Trace3, LLC
☒Recommendation of the County Administrator ☐ Recommendation of Board Committee
RECOMMENDATIONS:
APPROVE and AUTHORIZE the Purchasing Agent, or designee, to execute on behalf of the Health Services Director, a purchase order with Trace3, LLC in an amount not to exceed $1,280,000 for the purchase of Rubrik data protection platform support services for the period from March 1, 2026 through March 1, 2029.
FISCAL IMPACT:
This purchase order will result in expenditures of up to $1,280,000 over a three-year period and will be funded by Hospital Enterprise Fund I revenues.
BACKGROUND:
Rubrik data security and protection platform, secure backup, threat detection, and rapid data recovery across on‑premise, cloud, and SaaS environments. As an authorized reseller, Trace3, LLC also provides specialized implementation and optimization services to ensure the Rubrik platform is fully aligned with the County’s operational and security needs. Contra Costa Health (CCH) has utilized Rubrik since 2017 to protect critical data from cyberattacks, accidental loss, and ransomware. The platform enables secure backups, monitors for unusual activity, and supports rapid system recovery, reducing downtime, safeguarding patient information, and supporting compliance with healthcare security and privacy regulations.
To ensure continued support and long‑term viability of the Rubrik enterprise platform, the County issued Request for Proposals (RFP) to identify the most qualified vendor. Following evaluation, on April 17, 2026 Trace3, LLC was selected and awarded the contract based on their expertise and capability to meet CCH’s data protection requirements.
This purchase remains subject to the existing Rubrik End User License and Limited Warranty Agreement dated June 28, 2017, as well as the Rubrik Product Warranty and Support Services Policy dated November 18, 2016, both established between Contra Costa County and Rubrik, Inc.
CONSEQUENCE OF NEGATIVE ACTION:
Failure to implement Rubrik leaves CCH vulnerable to data loss, extended downtime, and costly recovery efforts during a cyberattack or system failure. It increases the risk of compliance violations, potential exposure of sensitive patient information, and disruptions to essential services. Overall, it significantly weakens CCH’s ability to quickly recover and protect critical data.