HomeMy WebLinkAbout10139
City Clerk’s Office Item # R-7
Background Paper for Proposed
Ordinance
COUNCIL MEETING DATE: March 14, 2022
TO: President Heather Graham and Members of City Council
CC: Nicholas A. Gradisar, Mayor
VIA: Marisa Stoller, City Clerk
FROM: Barbara Huber, Fire Chief – Fire Department
SUBJECT: AN ORDINANCE APPROVING A DATA USE AGREEMENT BETWEEN THE
PUEBLO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT AND THE
CITY OF PUEBLO AND AUTHORIZING THE MAYOR TO EXECUTE SAID
AGREEMENT
SUMMARY:
This ordinance approves a data use agreement between the Public Health Department of Pueblo
and the City of Pueblo.
PREVIOUS COUNCIL ACTION:
None.
BACKGROUND:
As part of an ongoing program/grant the City will provide the County with call data as part of a
targeted outreach program.
FINANCIAL IMPLICATIONS:
None.
BOARD/COMMISSION RECOMMENDATION:
Not applicable.
STAKEHOLDER PROCESS:
Not applicable.
ALTERNATIVES:
None.
RECOMMENDATION:
Approval of the Ordinance.
Attachment:
Agreement
ORDINANCE NO. 10139
AN ORDINANCE APPROVING A DATA USE AGREEMENT
BETWEEN THE PUEBLO DEPARTMENT OF PUBLIC
HEALTH AND ENVIRONMENT AND THE CITY OF PUEBLO
AND AUTHORIZING THE MAYOR TO EXECUTE SAID
AGREEMENT
BE IT ORDAINED BY THE CITY COUNCIL OF PUEBLO, that:
SECTION 1.
The Data Use Agreement between Pueblo Department of Public Health and
Environment and the City of Pueblo, a copy of which is attached hereto and incorporated
herein by this reference, having been approved as to form by the City Attorney is hereby
approved.
SECTION 2.
The Mayor is authorized to execute and deliver said Agreement in the name of
the City of Pueblo and the City Clerk is directed to attest same.
SECTION 3.
The officers and staff of the City are authorized to perform any and all acts
consistent with this Ordinance and the attached Agreement which are necessary or
appropriate to implement the transactions described therein.
SECTION 4.
This Ordinance shall become effective on the date of final action by the Mayor and
City Council.
Action by City Council:
Introduced and initial adoption of Ordinance by City Council on March 14, 2022 .
Final adoption of Ordinance by City Council on March 28, 2022 .
President of City Council
Action by the Mayor:
☒ Approved on March 30, 2022 .
□ Disapproved on based on the following objections:
_
Mayor
Action by City Council After Disapproval by the Mayor:
□ Council did not act to override the Mayor's veto.
□ Ordinance re-adopted on a vote of , on
□ Council action on _______ failed to override the Mayor’s veto.
President of City Council
ATTEST
City Clerk
Data Use Agreement
THIS DATA USE AGREEMENT (the "Agreement") with an effective date of
M M c $ .2-0-22- is between City of Pueblo, a Colorado municipal corporation
("City") and the Pueblo Department of Public Health and Environment ("PDPHE").
WHEREAS, PDPHE desires to receive and use only Limited Data Set or other data set, as
defined or otherwise identified herein, from City; and
WHEREAS, the City is willing to provide requested data to PDPHE subject to the terms
and conditions of this agreement.
NOW THEREFORE, in consideration of the mutual covenants and premises herein
contained, the parties agree as follows:
1. Definitions. The following terms as used in this Agreement shall have the following
meaning:
"Limited Data Set" is Protected Health Information that excludes the following direct
identifiers of the individual or of relatives, employers, or household members of the
individual:
A. Names;
B. Postal address information, other than town or city, state, and zip code;
C. Telephone numbers;
D. Fax numbers;
E. Electronic mail addresses;
F. Social security numbers;
G. Medical record numbers;
H. Health plan beneficiary numbers;
I. Account numbers;
J. Certificate/license numbers;
K. Vehicle identifiers and serial numbers, including license plate numbers;
L. Device identifiers and serial numbers;
M. Web Universal Resource Locators (URLs);
N. Internet Protocol (IP) address numbers;
O. Biometric identifiers, including finger and voice prints; and
P. Full face photographic images and any comparable images.
"Confidential Information" means Personal Identifying Information as defined pursuant
to § 24-73-101, C.R.S., and Protected Health Information and Electronic Protected Health
Information as those terms are defined in the Health Insurance Portability and
Accountability Act of 1996 and the Health Information Technology for Economic and
Clinical Health Act and the regulations issued thereunder (collectively, the "Privacy
Regulations").
"De-Identified Data"means health information which is not individually identifiable health
information and has been de-identified to meet the standards required pursuant to 45 C.F.R.
§ 164.514.
"PDPHE Requested Fire Department Data Set"means Calls for Service(OD calls,zipcode,
date, and time) and Narcan Use (Date, condition upon arrival, condition upon departure,
primary impression, age, zipcode)
2. Limited Data Sets. The City will disclose PDPHE Requested Fire Department Data Set
to PDPHE. The data sets will be submitted to PDPHE by the 15th of each month by email in an
Excel file to PDPHE at data q pt cblocounty.us. PDPHE represents and warrants that transmission
of the PDPHE Requested Fire Department Data Set in the manner requested and to said site
complies with the Privacy Regulations. Pi for to any use, PDPHE shall assure that any such data
qualifies as Limited Data Set as herein defined. PDPHE shall be solely responsible for and liable
for such determination. In accordance with the Privacy Regulations, PDPHE shall not use and
shall return to City any such data that does not qualify as Limited Data Set and shall use all
appropriate reasonable safeguards to prevent the use or disclosure of such unqualifying data. In
addition, any use shall be subject to the following terms and conditions:
(a) Use of Limited Data Set. PDPHE may use and disclose the Limited Data Set
only for purposes of the Pueblo County Partnership for Data Project which use PDPHE
represent and warrants is a qualifying purpose under the Privacy Regulations for use of
Limited Data Set, and PDPHE shall not use or disclose the Limited Data Set in any manner
that would constitute a violation of the Privacy Regulations if used or disclosed by the City.
PDPHE agrees not to use the Limited Data Set in such a way as to identify any individual
and further agrees not to contact any individual. PDPHE shall limit the use or receipt of
the Limited Data Set to the organizations participating in the Pueblo County Partnership
for Data Project who have executed an agreement required pursuant to below Section 5.
(b) Safeguards against Misuse of Information. PDPHE shall use all appropriate
reasonable safeguards to prevent the use or disclosure of the Limited Data Set other than
as permitted under this Agreement. The PDPHE shall implement administrative, physical,
and technical safeguards that reasonably and appropriately protect the confidentiality,
integrity, and availability of the Limited Data Set.
(c) Reporting of Disclosures of Protected Health Information. The PDPHE shall,
within ten (10) calendar days of becoming aware of any use or disclosure of the Limited
Data Set in violation of the Agreement, report any such disclosure to Pueblo Fire Chief,
Pueblo Fire Department, 151 Bonforte Blvd Pueblo, CO 81003; with copy to: City
Attorney, City of Pueblo, 1 City Hall Place, 3rd Floor, Pueblo CO 81003.
(d) Liability and Indemnification. PDPHE shall be liable to the City and to the
extent permitted by law shall indemnify and hold the City harmless from and against any
and all liability and costs, including court costs, attorneys' and consultancy fees, created
by a breach of this Agreement by PDPHE, its agents, subcontractors or organizations
participating in the Pueblo County Partnership for Data Project. No term or condition of
this Agreement may be construed or interpreted as a waiver, express or implied, or any of
the immunities, rights, benefits, protections or other provisions for the parties, of the
Colorado Governmental Immunity Act, C.R.S. § Section 24-10-101 et seq.
(e) Notice of Request for Data. The PDPHE agrees to notify the City within three
(3) business days of the PDPHE's receipt of any request or subpoena for the Limited Data
Set or other Protected Health Information. If the City decides to challenge the validity of
or assume responsibility for responding to such request or subpoena, the PDPHE shall
cooperate fully with the City in connection therewith.
(f) Injunction. PDPHE acknowledges and agrees that the City will suffer
irreparable damage upon the PDPIIE's breach of this Agreement and that damages would
be an inadequate remedy for such breach. The PDPHE acknowledges and agrees that the
City may seek an action for an injunction to enforce the terms of this Agreement against
the PDPHE, in addition to any other remedy the City may have of law or in equity.
(g) Ownership of Information. PDPHE,acknowledges that, as between the PDPHE
and the City, the Limited Data Set furnished to the PDPHE under this Agreement by City
shall be and remain the sole property of the City, including any and all forms of the same
developed by the PDPHE in the course of its fulfillment of its obligations under this
Agreement.
3. De-Identified Data. To the extent PDPHE may prepare De-Identified Data based upon
the Limited Data Set requested by PDPHE, PDPHE shall assure that any such data qualifies as De-
Identified Data as herein defined. PDPHE shall be solely responsible for and liable for such
determination and use.
4. Police Department Data Set. The City will disclose to PDPHE monthly drug related
referrals, arrests by category of drug and zip code, and calls for service (call, OD call, zipcode,
date and time). The data sets will be submitted to PDPHE by the 15th of each month by email in
an Excel file to PDPHE at data@pueblocounty.us.
5. Disclaimer of Warranty. TO THE MAXIMUM EXTENT PERMITTED BY
APPLICABLE LAW, ALL DATA SET PROVIDED BY CITY UNDER THIS AGREEMENT
ARE PROVIDED "AS IS" WITH ALL FAULTS, AND CITY DISCLAIMS ANY AND ALL
EXPRESS OR IMPLIED REPRESENTATIONS AND WARRANTIES WITH RESPECT TO
ANY DATA SET, INCLUDING ANY EXPRESS OR IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, NON-
INFRINGEMENT, OR THAT ANY DATA SET WILL OPERATE ERROR FREE,
UNINTERRUPTED OR BE FREE OF VIRUSES. THE ENTIRE RISK AS TO THE
SELECTION, SATISFACTION, QUALITY AND PERFORMANCE AND USE OF THE DATA
SET SHALL BE WITH PDPHE.
6. Data Breach. In the event of a breach of Confidential Information that PDPHE may
have pursuant to this Agreement, PDPHE shall report such breach to City immediately, but in no
event more than five (5) days after discovering the breach. A breach shall be treated as discovered
at the point when any member of the PDPHE's workforce, contractors, agents, officials or
organizations participating in the Pueblo County Partnership for Data Project is aware, or would
be aware by exercising reasonable diligence, of the breach. A full written report will be provided
to City no later than ten (10)business days from the date PDPHE becomes aware of the Breach.
(a) Any written report shall include, at a minimum: (a) the identification of the
data has been, or is reasonably believed to have been, accessed, acquired, or disclosed
during the breach; (b) a description of what happened, including the date of the breach and
the date of discovery of the breach; (c) a description of the types of data that were involved
in the breach; (d) steps individuals should take to protect themselves from potential harm
resulting from the Breach; (e) the identity of who made the non-permitted access, use or
disclosure and who received the non-permitted access, use or disclosure, (f) a description
of the PDPHE's investigation and response to the breach, (g) actions taken to prevent any
further non-permitted access, uses or disclosures, and (h) actions taken to mitigate any
deleterious effect of the non-permitted access, use or disclosure. PDPHE will provide
additional information to City as requested.
(b) Mitigation and Cooperation. PDPHE shall mitigate, at PDPHE's sole cost and
expense, any harmful effect that is known to it for the breach or use or disclosure of
Confidential Information by PDPHE in violation of this Agreement. City shall ensure a
breach risk assessment is conducted to determine whether Confidential Information has
been compromised and notification to affected Individuals is required. PDPHE shall
cooperate with City in the investigation of the event, conducting a breach risk assessment,
and notification of Individuals as required by the Privacy and Security Regulations. City
may delegate any or all aspects of the investigation, breach risk assessment, and
notification of individuals to PDPHE.
(c) Notification Costs Related to Breach of PHI. In the event of a breach of
Confidential Information caused by PDPHE, the costs related to notifying the affected
Individuals shall be borne by PDPHE. Such costs, if appropriate and reasonable under the
circumstances, may include the actual cost of notification, setting-up and managing a toll-
free number, and credit monitoring.
7. Agreements by Third Parties. PDPHE shall obtain and maintain an agreement with
each organization participating in the Pueblo County Partnership for Data Project who shall receive
or have access to the Limited Data Set or other data provided by City under this Agreement.
Pursuant to such agreement, each organization shall agree to be bound by the same restrictions,
terms, conditions of use that apply to PDPHE pursuant to this Agreement. PDPHE shall ensure
that such organization agree to implement reasonable and appropriate safeguards to protect the
confidentiality, integrity, and availability of the Limited Data Set and other data provided by City
under this Agreement.
8. Term. This Agreement will begin on the Effective Date and will continue until
December 31, 2024 (the "Term") unless sooner terminated pursuant to the terms of this
Agreement. Limited Data Set or other data provided by City to PDPHE in accordance with this
Agreement must be destroyed upon termination. This Agreement may not be extended or renewed,
and the parties must enter into a new data use agreement upon termination of this Agreement.
(a) Termination. PDPHE reserves the right to terminate this Agreement upon thirty
(30) days prior written notice to City if City materially fails to fulfill the terms of the
Agreement or materially violates its conditions. The City may terminate this Agreement at
any time.
(b) Data contained in a Limited or De-Identified Data Set shall not be subject to
obligations to return such data to City and the obligations and liabilities set forth in the
above Section 2, 3, 6 and 7 pertaining to such Limited Data Set or other data provided by
City will survive any termination or expiration of the Agreement.
9. Additional Provisions.
(a) Force majeure. Any delays in or failure of performance by any party of its
obligations under this Agreement shall be excused if such delays or failure are a result of
acts of electrical outage, strike, natural disaster, or any other event beyond the control of
the party, which makes performance impossible or impractical.
(b) Amendment to Comply with Law. PDPHE and the City agree to amend this
Agreement to the extent necessary to allow either party to comply with the Privacy
Standards, the Standards for Electronic Transactions (45 C.F.R. Parts 160 and 164)and the
Security Standards (45 C.F.R. Part 164) (collectively, the "Standards") promulgated or to
be promulgated by the Secretary of the Department of Health and Human Services, and
with other changes in law. PDPHE agrees that it will fully comply with all such Standards
and that it will agree to amend this Agreement as may be required to maintain compliance
with the Standards.
(c) Section Captions. The captions of the paragraphs are set forth only for the
convenience and reference of the Parties and are not intended in any way to define, limit
or describe the scope or intent of this Agreement.
(d) Integrations, Severability, Amendment, and Counterparts. This Agreement
represents the entire agreement between the Parties and supersedes all prior discussions
and written agreements or understandings. This Agreement may be amended only by an
instrument in writing signed by the Parties. If any provision of this Agreement is held
invalid or unenforceable, no other provision shall be affected by such holding, and all of
the remaining provisions of this Agreement shall continue in full force and effect. This
Agreement may be executed in multiple counterparts, each of which shall be deemed an
original, and all of which together constitute one and the same agreement.
(e) No Third Party Beneficiaries. Nothing in this Agreement is intended, nor
should it be construed, to create any rights, claims, or benefits or assume any liability for
or on behalf of any third party.
(0 Waiver of Breach. A waiver by any party to this Agreement of the breach of
any term or provision of this Agreement shall not operate or be construed as a waiver of
any subsequent breach by either party.
(g) Authority of Signers. Each person signing this Agreement on behalf of a party
represents and warrants that he or she has the requisite power and authority to enter into,
execute, and deliver this Agreement on behalf of such party and that this Agreement is a
valid and legally binding obligation of such party enforceable against it in accordance with
its terms.
(h) Attorney's Fees and Costs of Collections. In the event that it becomes necessary
for the City to bring any action or proceeding to enforce any provision of this Agreement,
to recover damages for breach of this Agreement, of to seek specific performance of this
Agreement, the City shall be entitled to collect its reasonable attorneys fees, costs of suit,
and costs of collection as part of the judgment in such action or proceeding.
(i) Certain Provisions Survive Expiration and Termination. The obligations and
liabilities of PDPHE set forth in Sections Section 2, 3, 6 and 7 of this Agreement shall
survive any termination or expiration of the Agreement.
(j) Governing Law and Venue. This Agreement shall be governed by the laws of
the State of Colorado. Venue for any action arising under this Agreement or for the
enforcement of this Agreement shall be in a state court with jurisdiction located in Pueblo
County, Colorado.
(k) Assignment. Except as otherwise expressly provided in this Agreement, this
Agreement shall not be assigned by PDPHE.
(1) Notices. Any notices required pursuant to this Agreement shall be in writing
and sent by mail or by facsimile addressed as identified below:
City: Pueblo Fire Chief, Pueblo Fire Department, 151 Bonforte Blvd., Pueblo,
CO 81003;
Pueblo Police Chief, Pueblo Police Department, 200 S. Main Street, Pueblo,
CO 81003;
with copy to: City Attorney, City of Pueblo, 1 City Hall Place, 3rd Floor, Pueblo
CO 81003
PDPHE: Pueblo Department of Public Health and Environment,
Randy Evetts, Public Health Director, 101 W 9th St., Pueblo, CO 81003
Executed at Pueblo, Colorado, the day and year first above written.
PUEBLO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT
B riii
Randy Evetts, 'u,lic ealth Director
CITY OF PUEBLO, A COLORADO MUNICIPAL CORPORATION,
l,..e:s 7
ATTEST:
By: Nicholas A. Gradisar, Mayor CT‘ri