Title
a. Authorize the Deputy Purchasing Agent for Natividad Medical Center (NMC) or his designee to execute an Agreement, with a retroactive start date of October 1, 2016, with CynergisTek, Inc., for the provision of Information Security, Assessment and Consulting services and containing non-standard risk terms regarding indemnification and limited warranty, in the amount of $457,200, for the period of October 1, 2016 through September 30, 2019.
b. Authorize the Deputy Purchasing Agent for NMC or his designee to execute up to three (3) future amendments to the Agreement which do not significantly alter the scope of work and do not cause an increase of more than ten percent ($45,720) of the original Agreement cost.
Report
RECOMMENDATION:
It is recommended the Board of Supervisors:
a. Authorize the Deputy Purchasing Agent for Natividad Medical Center (NMC) or his designee to execute an Agreement, with a retroactive start date of October 1, 2016, with CynergisTek, Inc. for the provision of Information Security, Assessment and Consulting services and containing non-standard risk terms regarding indemnification and limited warranty, in the amount of $457,200, for the period of October 1, 2016 through September 30, 2019.
b. Authorize the Deputy Purchasing Agent for NMC or his designee to execute up to three (3) future amendments to the Agreement which do not significantly alter the scope of work and do not cause an increase of more than ten percent ($45,720) of the original Agreement cost.
SUMMARY/DISCUSSION:
CynergisTek, Inc. is a top-ranked information security and privacy consulting firm focused on healthcare. CynergisTek, Inc. offers an array of solutions that help organizations measure privacy and security programs against regulatory requirements and assist in developing a best practice approach to risk management
NMC is required to meet specific information security regulatory requirements, such as the Health Insurance Portability and Accountability Act (HIPAA). This includes routine review of the hospital’s information security risk and security posture. Testing of both technical and human systems, such a social engineering attacks, are needed to educate hospital staff and stay ahead of emerging threats.
NMC has determined that a managed services Agreement, in conjunction with NMC IT staff, is the most feasible means to meet these needs. NMC has investigated various vendors and has selected CynergisTek, Inc. based on health care expertise, reputation, cost and value. This relationship will also provide insight and guidance to hospital staff and strengthen native IT security skillsets.
The anticipated start date of this Agreement was October 1, 2016. Negotiations delayed the ability to present this item to the Board of Supervisors in September, as planned. Therefore, NMC request approval for the retroactive start date.
OTHER AGENCY INVOLVEMENT:
County Counsel has reviewed and approved this Agreement as to legal form, and reviewed as to risk provisions. The Auditor-Controller has reviewed and approved as to payment provisions. The Agreement was reviewed by NMC’s Finance Committee on August 25, 2016, and Board of Trustees on September 2, 2016.
FINANCING:
The total cost for this Agreement is not to exceed $457,200, of which $114,300 was included in the Fiscal Year 2016-17 Adopted Budget. Funding for future years of the Agreement will be included in those budgets, as appropriate. There is no impact to the General Fund.
Prepared by: Ari Entin, Chief Information Officer, 783-2564
Approved by: Gary R. Gray, DO, Chief Executive Officer, 783-2504
Attachments:
CynergisTek, Inc. Agreement
CynergisTek, Inc. Spend Sheet
Attachments are on file with the Clerk of the Board