Loading...
HomeMy WebLinkAbout09717ORDINANCE NO. 9717 AN ORDINANCE APPROVING A DATA USE AGREEMENT BETWEEN THE PUEBLO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT AND THE CITY OF PUEBLO AND AUTHORIZING THE MAYOR TO EXECUTE SAID AGREEMENT BE IT ORDAINED BY THE CITY COUNCIL OF PUEBLO, that: SECTION 1. The Data Use Agreement between Pueblo Department of Public Health and Environment and the City of Pueblo, a copy of which is attached hereto and incorporated herein by this reference, having been approved as to form by the City Attorney is hereby approved. The Mayor is authorized to execute and deliver said Agreement in the name of the City of Pueblo and the City Clerk is directed to attest same. SECTION 2. The officers and staff of the City are authorized and directed to perform any and all acts consistent with this Ordinance and the attached Agreement which are necessary or appropriate to effectuate the transactions described therein. SECTION 3. This Ordinance shall become effective on the date of final action by the Mayor and City Council. Action by City Council: Introduced and initial adoption of Ordinance by City Council on May 26, 2020 . Final adoption of Ordinance by City Council on June 8, 2020 . President of City Council Action by the Mayor: ☒ Approved on June 10, 2020 . ☐ Disapproved on based on the following objections: Mayor Action by City Council After Disapproval by the Mayor: ☐ Council did not act to override the Mayor's veto. ☐ Ordinance re-adopted on a vote of , on ☐ Council action on __________________failed to override the Mayor’s veto. President of City Council ATTEST City Clerk City Clerk’s Office Item # R-9 Background Paper for Proposed Ordinance COUNCIL MEETING DATE: May 26, 2020 TO: President Dennis E. Flores and Members of City Council CC: Mayor Nicholas A. Gradisar VIA: Brenda Armijo, City Clerk FROM: Barb Huber, Fire Chief SUBJECT: AN ORDINANCE APPROVING A DATA USE AGREEMENT BETWEEN THE PUEBLO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT AND THE CITY OF PUEBLO AND AUTHORIZING THE MAYOR TO EXECUTE THE SAME SUMMARY: The proposed Ordinance approves a data sharing agreement between the City of Pueblo and the Pueblo Department of Public Health and Environment. PREVIOUS COUNCIL ACTION: Not applicable to this Ordinance. BACKGROUND: The Pueblo Fire Department will be working in conjunction with the Pueblo Police Department to provide the Pueblo Department of Public Health and Environment data related to the use of opioids within the City. This will be used in the future for targeted interventions. FINANCIAL IMPLICATIONS: Not applicable to this Ordinance. BOARD/COMMISSION RECOMMENDATION: Not applicable to this Ordinance. STAKEHOLDER PROCESS: Not applicable to this Ordinance. ALTERNATIVES: None. RECOMMENDATION: City Administration recommends approval of the Ordinance. Attachments: Agreement Data Use Agreement THIS DATA USE AGREEMENT (the "Agreement") with an effective date of cane Ri 2. O20 is between City of Pueblo, a Colorado municipal corporation ("City") and the Pueblo Department of Public Health and Environment ("PDPHE"). WHEREAS, PDPHE desires to receive and use only Limited Data Set or other data set, as defined or otherwise identified herein, from City; and WHEREAS, the City is willing to provide requested data to PDPHE subject to the terms and conditions of this agreement. NOW THEREFORE, in consideration of the mutual covenants and premises herein contained, the parties agree as follows: 1. Definitions. The following terms as used in this Agreement shall have the following meaning: "Limited Data Set" is Protected Health Information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: A. Names; B. Postal address information, other than town or city, state, and zip code; C. Telephone numbers; D. Fax numbers; E. Electronic mail addresses; F. Social security numbers; G. Medical record numbers; H. Health plan beneficiary numbers; I. Account numbers; J. Certificate/license numbers; K. Vehicle identifiers and serial numbers, including license plate numbers; L. Device identifiers and serial numbers; M. Web Universal Resource Locators (URLs); N. Internet Protocol (IP) address numbers; O. Biometric identifiers, including finger and voice prints; and P. Full face photographic images and any comparable images. "Confidential Information" means Personal Identifying Information as defined pursuant to § 24-73-101, C.R.S., and Protected Health Information and Electronic Protected Health Information as those terms are defined in the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act and the regulations issued thereunder (collectively, the "Privacy Regulations"). "De-Identified Data"means health information which is not individually identifiable health information and has been de-identified to meet the standards required pursuant to 45 C.F.R. § 164.514. "PDPHE Requested Fire Department Data Set" means Calls for Service (OD calls, zip code, date, and time) and Narcan Use (Date, condition upon arrival, condition upon departure, primary impression, age, zip code) 2. Limited Data Sets. The City will disclose PDPHE Requested Fire Department Data Set to PDPHE. The data sets will be submitted to PDPHE by the 10th of each month by email in an Excel file to PDPHE at data@pueblocounty.us. PDPHE represents and warrants that transmission of the PDPHE Requested Fire Department Data Set in the manner requested and to said site complies with the Privacy Regulations. Prior to any use, PDPHE shall assure that any such data qualifies as Limited Data Set as herein defined. PDPHE shall be solely responsible for and liable for such determination. In accordance with the Privacy Regulations, PDPHE shall not use and shall return to City any such data that does not qualify as Limited Data Set and shall use all appropriate reasonable safeguards to prevent the use or disclosure of such unqualifying data. In addition, any use shall be subject to the following terms and conditions: (a) Use of Limited Data Set. PDPHE may use and disclose the Limited Data Set only for purposes of the Pueblo County Partnership for Data Project which use PDPHE represent and warrants is a qualifying purpose under the Privacy Regulations for use of Limited Data Set, and PDPHE shall not use or disclose the Limited Data Set in any manner that would constitute a violation of the Privacy Regulations if used or disclosed by the City. PDPHE agrees not to use the Limited Data Set in such a way as to identify any individual and further agrees not to contact any individual. PDPHE shall limit the use or receipt of the Limited Data Set to the organizations participating in the Pueblo County Partnership for Data Project who have executed an agreement required pursuant to below Section 5. (b) Safeguards against Misuse of Information. PDPHE shall use all appropriate reasonable safeguards to prevent the use or disclosure of the Limited Data Set other than as permitted under this Agreement. The PDPHE shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Limited Data Set. (c) Reporting of Disclosures of Protected Health Information. The PDPHE shall, within ten (10) calendar days of becoming aware of any use or disclosure of the Limited Data Set in violation of the Agreement, report any such disclosure to Pueblo Fire Chief, Pueblo Fire Department, 151 Bonforte Blvd Pueblo, CO 81003; with copy to: City Attorney,City of Pueblo, 1 City Hall Place, 3rd Floor, Pueblo CO 81003. (d) Liability and Indemnification. PDPHE shall be liable to the City and to the extent permitted by law shall indemnify and hold the City harmless from and against any and all liability and costs, including court costs, attorneys' and consultancy fees, created by a breach of this Agreement by PDPHE, its agents, subcontractors or organizations participating in the Pueblo County Partnership for Data Project. No term or condition of this Agreement may be construed or interpreted as a waiver, express or implied, or any of the immunities, rights, benefits, protections or other provisions for the parties, of the Colorado Governmental Immunity Act, C.R.S. § Section 24-10-101 et seq. (e) Notice of Request for Data. The PDPHE agrees to notify the City within three (3) business days of the PDPHE's receipt of any request or subpoena for the Limited Data Set or other Protected Health Information. If the City decides to challenge the validity of or assume responsibility for responding to such request or subpoena, the PDPHE shall cooperate fully with the City in connection therewith. (f) Injunction. PDPHE acknowledges and agrees that the City will suffer irreparable damage upon the PDPHE's breach of this Agreement and that damages would be an inadequate remedy for such breach. The PDPHE acknowledges and agrees that the City may seek an action for an injunction to enforce the terms of this Agreement against the PDPHE, in addition to any other remedy the City may have of law or in equity. (g) Ownership of Information. PDPHE acknowledges that,as between the PDPHE and the City, the Limited Data Set furnished to the PDPHE under this Agreement by City shall be and remain the sole property of the City, including any and all forms of the same developed by the PDPHE in the course of its fulfillment of its obligations under this Agreement. 3. De-Identified Data. To the extent PDPHE may prepare De-Identified Data based upon the Limited Data Set requested by PDPHE, PDPHE shall assure that any such data qualifies as De- Identified Data as herein defined. PDPHE shall be solely responsible for and liable for such determination and use. 4. Police Department Data Set. The City will disclose to PDPHE monthly drug related referrals, arrests by category of drug and zip code, and calls for service (call, OD call, zipcode, date and time). The data sets will be submitted to PDPHE by the 10th of each month by email in an Excel file to PDPHE at data@pueblocounty.us. 5. Disclaimer of Warranty. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ALL DATA SET PROVIDED BY CITY UNDER THIS AGREEMENT ARE PROVIDED "AS IS" WITH ALL FAULTS, AND CITY DISCLAIMS ANY AND ALL EXPRESS OR IMPLIED REPRESENTATIONS AND WARRANTIES WITH RESPECT TO ANY DATA SET, INCLUDING ANY EXPRESS OR IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, NON- INFRINGEMENT, OR THAT ANY DATA SET WILL OPERATE ERROR FREE, UNINTERRUPTED OR BE FREE OF VIRUSES. THE ENTIRE RISK AS TO THE SELECTION, SATISFACTION,QUALITY AND PERFORMANCE AND USE OF THE DATA SET SHALL BE WITH PDPHE. 6. Data Breach. In the event of a breach of Confidential Information that PDPHE may have pursuant to this Agreement, PDPHE shall report such breach to City immediately, but in no event more than five (5) days after discovering the breach. A breach shall be treated as discovered at the point when any member of the PDPHE's workforce, contractors, agents, officials or organizations participating in the Pueblo County Partnership for Data Project is aware, or would be aware by exercising reasonable diligence, of the breach. A full written report will be provided to City no later than ten (10) business days from the date PDPHE becomes aware of the Breach. (a) Any written report shall include, at a minimum: (a) the identification of the data has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the breach; (b) a description of what happened, including the date of the breach and the date of discovery of the breach; (c) a description of the types of data that were involved in the breach; (d) steps individuals should take to protect themselves from potential harm resulting from the Breach; (e) the identity of who made the non-permitted access, use or disclosure and who received the non-permitted access, use or disclosure, (f) a description of the PDPHE's investigation and response to the breach, (g) actions taken to prevent any further non-permitted access, uses or disclosures, and (h) actions taken to mitigate any deleterious effect of the non-permitted access, use or disclosure. PDPHE will provide additional information to City as requested. (b) Mitigation and Cooperation. PDPHE shall mitigate, at PDPHE's sole cost and expense, any harmful effect that is known to it for the breach or use or disclosure of Confidential Information by PDPHE in violation of this Agreement. City shall ensure a breach risk assessment is conducted to determine whether Confidential Information has been compromised and notification to affected Individuals is required. PDPHE shall cooperate with City in the investigation of the event, conducting a breach risk assessment, and notification of Individuals as required by the Privacy and Security Regulations. City may delegate any or all aspects of the investigation, breach risk assessment, and notification of individuals to PDPHE. (c) Notification Costs Related to Breach of PHI. In the event of a breach of Confidential Information caused by PDPHE, the costs related to notifying the affected Individuals shall be borne by PDPHE. Such costs, if appropriate and reasonable under the circumstances, may include the actual cost of notification, setting-up and managing a toll- free number, and credit monitoring. 7. Agreements by Third Parties. PDPHE shall obtain and maintain an agreement with each organization participating in the Pueblo County Partnership for Data Project who shall receive or have access to the Limited Data Set or other data provided by City under this Agreement. Pursuant to such agreement, each organization shall agree to be bound by the same restrictions, terms, conditions of use that apply to PDPHE pursuant to this Agreement. PDPHE shall ensure that such organization agree to implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of the Limited Data Set and other data provided by City under this Agreement. 8. Term. This Agreement will begin on the Effective Date and will continue until December 31, 2021 (the "Term") unless sooner terminated pursuant to the terms of this Agreement. Limited Data Set or other data provided by City to PDPHE in accordance with this Agreement must be destroyed upon termination. This Agreement may not be extended or renewed, and the parties must enter into a new data use agreement upon termination of this Agreement. (a) Termination. PDPHE reserves the right to terminate this Agreement upon thirty (30) days prior written notice to City if City materially fails to fulfill the terms of the Agreement or materially violates its conditions. The City may terminate this Agreement at any time. (b) Data contained in a Limited or De-Identified Data Set shall not be subject to obligations to return such data to City and the obligations and liabilities set forth in the above Section 2, 3, 6 and 7 pertaining to such Limited Data Set or other data provided by City will survive any termination or expiration of the Agreement. 9. Additional Provisions. (a) Force majeure. Any delays in or failure of performance by any party of its obligations under this Agreement shall be excused if such delays or failure are a result of acts of electrical outage, strike, natural disaster, or any other event beyond the control of the party, which makes performance impossible or impractical. (b) Amendment to Comply with Law. PDPHE and the City agree to amend this Agreement to the extent necessary to allow either party to comply with the Privacy Standards,the Standards for Electronic Transactions(45 C.F.R. Parts 160 and 164)and the Security Standards (45 C.F.R. Part 164) (collectively, the "Standards") promulgated or to be promulgated by the Secretary of the Department of Health and Human Services, and with other changes in law. PDPHE agrees that it will fully comply with all such Standards and that it will agree to amend this Agreement as may be required to maintain compliance with the Standards. (c) Section Captions. The captions of the paragraphs are set forth only for the convenience and reference of the Parties and are not intended in any way to define, limit or describe the scope or intent of this Agreement. (d) Integrations, Severability, Amendment, and Counterparts. This Agreement represents the entire agreement between the Parties and supersedes all prior discussions and written agreements or understandings. This Agreement may be amended only by an instrument in writing signed by the Parties. If any provision of this Agreement is held invalid or unenforceable, no other provision shall be affected by such holding, and all of the remaining provisions of this Agreement shall continue in full force and effect. This Agreement may be executed in multiple counterparts, each of which shall be deemed an original, and all of which together constitute one and the same agreement. (e) No Third Party Beneficiaries. Nothing in this Agreement is intended, nor should it be construed, to create any rights, claims, or benefits or assume any liability for or on behalf of any third party. (f) Waiver of Breach. A waiver by any party to this Agreement of the breach of any term or provision of this Agreement shall not operate or be construed as a waiver of any subsequent breach by either party. (g) Authority of Signers. Each person signing this Agreement on behalf of a party represents and warrants that he or she has the requisite power and authority to enter into, execute, and deliver this Agreement on behalf of such party and that this Agreement is a valid and legally binding obligation of such party enforceable against it in accordance with its terms. (h) Attorney's Fees and Costs of Collections. In the event that it becomes necessary for the City to bring any action or proceeding to enforce any provision of this Agreement, to recover damages for breach of this Agreement, or to seek specific performance of this Agreement, the City shall be entitled to collect its reasonable attorneys fees, costs of suit, and costs of collection as part of the judgment in such action or proceeding. (i) Certain Provisions Survive Expiration and Termination. The obligations and liabilities of PDPHE set forth in Sections Section 2, 3, 6 and 7 of this Agreement shall survive any termination or expiration of the Agreement. (j) Governing Law and Venue. This Agreement shall be governed by the laws of the State of Colorado. Venue for any action arising under this Agreement or for the enforcement of this Agreement shall be in a state court with jurisdiction located in Pueblo County, Colorado. (k) Assignment. Except as otherwise expressly provided in this Agreement, this Agreement shall not be assigned by PDPHE. (1) Notices. Any notices required pursuant to this Agreement shall be in writing and sent by mail or by facsimile addressed as identified below: City: Pueblo Fire Chief, Pueblo Fire Department, 151 Bonforte Blvd., Pueblo, CO 81003; Pueblo Police Chief, Pueblo Police Department,200 S. Main Street, Pueblo, CO 81003; with copy to: City Attorney, City of Pueblo, 1 City Hall Place, 3rd Floor, Pueblo CO 81003 PDPHE: Pueblo Department of Public Health and Environment, Randy Evetts, Public Health Director, 101 W 9th St., Pueblo, CO 81003 Executed at Pueblo, Colorado, the day and year first above written. PUEBLO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT By: L //AP I Rangy Evetts, ublic Health Director CITY OF PUEBLO, A COLORADO MUNICIPAL CORPORATION, _24emater...isay ATTEST: By: Nicholas A. Gradisar, Mayor auvvt,c,- 6re_ncio, rm�'