To: Board of Supervisors
From: Dr. Grant Colfax, Health Services Director
Report Title: Purchase Order with Tach Tech
Recommendation: Recommendation of the County Administrator
RECOMMENDATIONS:
APPROVE and AUTHORIZE the Purchasing Agent, or designee, to execute on behalf of the Health Services Director, a purchase order with Tach Tech, in an amount not to exceed $302,125 to renew Palo Alto Networks firewall threat prevention software and support, subject to the applicable Palo Alto Networks service and support terms and conditions for the period from August 18, 2026 through August 17, 2027.
FISCAL IMPACT:
Approval of this purchase will result in expenditures of up to $302,125 and will be funded by Hospital Enterprise Fund I revenues.
BACKGROUND:
Palo Alto firewalls secure Contra Costa Health’s (CCH) network by regulating traffic and protecting against unauthorized access. They also support secure remote access and site-to-site connectivity used by CCH employees, partners, and vendors. This renewal continues security subscriptions and support for CCH’s existing Palo Alto firewall and management environment, including premium support, Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Prisma Access Agent subscriptions, and Panorama management/log collection support.
On March 11, 2025, the Board of Supervisors approved agenda item C.54 to execute a purchase order with Tach Tech in an amount not to exceed $242,700 for the period of April 30, 2025 through August 16, 2026.
Tach Tech has served as CCH’s reseller for Palo Alto Networks products and support for multiple years. The proposed renewal is for one year, from August 18, 2026 through August 17, 2027, at a total cost not to exceed $302,125. Delays were encountered due to additional evaluation of alternative/cooperative purchasing options requested by Public Works Purchasing due to the increase in renewal pricing. This contractor was approved by the Public Works Department’s Purchasing Division on August 20, 2026.
CONSEQUENCE OF NEGATIVE ACTION:
If this action is not approved, CCH’s Palo Alto security subscriptions and support will not be renewed, increasing exposure of CCH devices and servers to security vulnerabilities, potential exploits, and potential to affect secure remote access and site-to-site connectivity used by CCH vendors and partners.