Vendor Relations & Contracting-FINAL 8.29 · Vendor Relations & HMIS Contracting ... •...

Deal or No Deal: ManagingVendor Relations &HMIS Contracting

Michelle Hayes, Cloudburst Consulting GroupJeff Ward, El Paso Coalition for the Homeless

September 17, 2007

HMIS Grant Administration & Project Management Training – The U.S. Department of Housing and Urban Development 2

Learning Objectives

1. To understand the common provisions ofHMIS software and managementcontracts.

2. To understand the opportunities and risksinherent in HMIS contracting.


Overview

• Types of Contracts• Source Documentation• Definitions• Disclaimer• Uses of HMIS Grant Funding• Local Procurement Practices• HMIS Management Contracts• Contracting Pitfalls


Types of Contracts

• HMIS Software Contracts– Hosting– Software Licensing– Service/Support Contracts– Software Development*

• HMIS Management Contracts– Project Management– Implementation support – system

administration/technical assistance/training– Reporting, performance measurement, analytics

*Note- HMIS software development is not an eligible use of HMIS grant funds and thereforewill not be covered in this training.


Source Documentation

• Requests were made for input from HMISsolution providers and several communitiesthat have either developed their ownsoftware in-house or use a local softwaredeveloper

• Review of existing sample HMIS vendorcontracts

• Information from the private sector– www.CIO.com– www.wikipedia.com


Definitions for Presentation

• For the purpose of this training:

– Vendor/Licensor refers to the entity that isproviding the service or software (i.e., HMISSoftware Vendor)

– Client/Licensee refers to the purchaser ofservice (i.e., CoC or HMIS Grant AdministratingOrganization)

– Contract/Agreement refers to the legally bindingdocument for provision of a product or servicethat includes terms and conditions, fee schedule,services, etc.


Disclaimer

• The presenters are not lawyers and informationprovided in this presentation is intended to providebest practice examples

• Note of caution – No community or vendor shouldexecute a contract without appropriate legalrepresentation

• Each CoC, HMIS Implementation, SoftwareApplication, Vendor Organization, etc. isDIFFERENT—the recommendations containedherein may not apply to all scenarios and areintended to cover the broad view of contractcomponents


Reminder – Uses of HMIS Grant Funding

• Eligible Costs:– Purchasing/licensing HMIS software– Leasing or purchasing computer equipment– Staffing– Services (customization, hosting/technical services,

training by third parties, etc.)– Space & Operations

• Ineligible costs:– HMIS planning – includes all costs incurred prior to

implementation of new or replacement HMIS software– Development of new software– Replacement of state and local government funding of an

existing HMIS• If SHP funds are used to fund vendor contracts

(i.e., software or service), the contract should notexceed the terms of the SHP grant agreement


Eligible Uses of HMIS Grant Funds –Software

• Purchase or licensing of “off-the-shelf” HMISsoftware is eligible use– Software/application should already be “developed”,

include necessary reports like APR and AHAR andbe in use by other CoCs for HMIS

– Additional customization of the software/applicationis eligible (adding fields, response categories, localreports, etc.)

• Software development (i.e., building newsoftware or making non-HMIS software “HMIScompliant”) is not an eligible use


Eligible Uses of HMIS Grant Funds –Replacement Software

• Purchase of replacement software orapplication licensing fees is an eligible cost– HMIS grant funds should not pay for more than

one HMIS software or application licensing feeat a time

– Migration of data from one system to anothermay be eligible for specific circumstances asapproved by HUD Headquarters

• Costs related to planning for replacementsoftware (i.e., software research, RFPprocess, vendor demonstrations, etc) arenot eligible


Procurement Practices

• Federal procurement requirements:– Grantees must have a written procurement

policy and procedures for spending– Procedures:

• Ensure that unnecessary purchases are not made• Determine the most economical and practical

procurement• Solicitation for goods and services must meet

requirements outlined in 24 CFR 85.36 (publicagencies) or 24 CFR 84.40-48 (non-profitorganizations)


Procurement Practices (cont.)

• Local, agency or CoC procurement policiesfor purchase of software licensing/servicesmay apply when developing a contract andmay require:– Formal, advertised, competitive bid process (i.e.,

Request for Proposals);– Minimum number of bids (i.e., at least 3);– Procurement from a specified list of vendors;

and/or– Authorization procedures from a higher authority

before executing a contract.


Key HMIS Contract Provisions

• General terms and conditions• Services (i.e., what you are purchasing-

licensing, hosting, etc.)• Infrastructure requirements (i.e., local

requirements for hardware/software)• Terms of payment/costs• Other conditions (i.e., boilerplate

components)


General Terms and Conditions – Duration

• Definitions and terms• Start Date

– Typically tied to contract date with softwaresetup/delivery within a stated time

– Consider penalty or escrow provision to assuretimely deployment

• Duration– Consider alignment with grant cycle (12,18, 24

months)– Warning against long term contracts (>24

months) without annual review ofterms/conditions for re-negotiation

– Many contracts found to have automatic one-year renewal clause with a 30-day writtencancellation policy


General Terms and Conditions –Termination

• Termination or Suspension of Service byVendor/Licensor– Non-payment (can also affect service

availability)– To protect the integrity of system

• Termination by Client/Licensee– Cancellation typically requires at least XX days

written notice– May require payment of full terms of contract

upon premature cancellation unless otherwisespecified

– May request suspension due to security threat,breach, etc.


General Terms and Conditions –Termination (cont.)

• To protect your community in the event oftermination of contract, ensure theseprovisions are included:– Provision for delivery of data/equipment– Cost of download and media storage– Timeframe for data transfer– Data validation protocol– Data, hardware, media storage, and equipment

disposal protocols

• Note: Early termination may requirepayment of full contract value before clientcan obtain copy of database


General Terms and Conditions – SpecialConsiderations

• Vendor may maintain the right to merge or sellbusiness without the client approval or consent– Client could request the right to 30-day notification of

intent to sell with disclosure of purchasing party

• Limitations of Actions - no action arising out ofcontract can be brought more than 2 years after thecause of action has occurred

• Limitations on further use/distribution of 3rd partyproprietary information - i.e., no further copying,distribution, etc. of AIRS taxonomy terms/structure

• If vendor is required to meet HIPAA compliance – itis typically addressed through a separate BusinessAssociate Agreement and may not be included inthe general software contract


Services*

• Features and Functionality• Continuity of Service• Access and Limitations of Use• Ownership of Data• Hosting• Security and Maintenance• Data Storage/Backup• Data Recovery• Training and Technical Support

*commonly appears as Exhibit attachment to standard contracts andmay be named “Service Level Agreement”


Services – Features and Functionality

• Will differ with each application• May be included as a separate exhibit and

describe:– Modular functionality– Application components (client tracking, service

tracking, etc.)– Reporting specifications

• Compliance with current HUD and/or local reportingspecifications (i.e., APR, AHAR, etc)

• Define payment and time frame for compliance forchanges

– Add on features• Housing management• Information and Referral• 3rd party reporting software• Other


Services – Continuity of Service

• Contract should define appropriate responsetimes and protocol for scheduled andunscheduled outages, after which penaltieskick in– Available service times

• Specified client access time to application• Regular scheduled maintenance (typically two-hour

window nightly when servers can be updated; patchesloaded; backups scheduled)

– Service Outage/downtime• Definition: at least XX minutes during which the

application is not available and unscheduled• Notification of non-routine maintenance• Remedies for excessive outage/downtime

– Proration of fees, financial penalty, credit, etc.


Services – Access

• Access controls– Levels of access– User authentication– Workstation authentication (PKI or IP Filtering)

• Policies/protocols for client management of enduser access rights– Minimum training requirements, background checks, user

privacy agreements, etc.• Licensing for ASP is typically limited to one license

per user and prohibits sharing of licensing• Ability to receive a copy of database (i.e., for

aggregate reporting outside of HMIS product)– Protocol for requesting a copy of the database at any time

• Non-interference with pre-scheduled vendormaintenance and upgrades


Services – Limitations of Use

• Typical clauses that protect the intellectualproperty of the vendor application development– Limit use by or for the benefit of anyone other than

the client or licensee– Prohibition to re-license, sell rights to access,

transfer or assign rights to access or use– Prohibition from modification, duplication, translation,

reverse engineering, or creating derivative worksbased on the application or its source code

– Prohibition from unauthorized access to, use orduplication of any of the source code

– Compliance with applicable laws, intellectualproperty and copyright laws


Services – Ownership of Data

• Vendor assures ownership to Client; Clientto participating agencies

• May also specify Client/licensee grantsaccess to vendor for use for systemadministration, technical support, auditing,research, and compliance with applicablelegal and regulatory requirements


Services – Hosting

• Options: In-house or through professionalhosting facility

• Specifications– 24/7 monitoring and management of hardware,

O/S, web server and/or database server– Back-up services and power source (i.e., UPC)– Minimum Internet bandwidth and IP

specifications– Servers may not be used for illegal purposes or

in support of illegal causes– Physical security specifications


Services – Security and Maintenance

• Physical security of locations where dataare stored/accessed– locked room/cage– limited access by pass-card or key-code

• System Security (O/S, Application and/orWeb Server)– Compliance with minimum specifications of

HMIS Standards (firewall, encryptiontransmission, PKI, etc.)

– Regular maintenance protocols for O/S, webserver and/or application upgrades, patches, etc.

• Specifications for notification of breach,security violation, or other malicious act byboth parties


Services – Data Storage and Backup

• Data storage– Server location– Access to servers– Media format– Segregation (i.e., stored on same server as other

databases)

• Data backup– Regular backup schedule (daily, etc) and media format– Location for storage of regular (daily) backups– Length and location of prior backups (i.e., maintain daily

copy for 7 consecutive days and then re-write; maintainmaster weekly/monthly backup)

– Data mirroring via replication offsite or “hot backup” onsite– Test your backup protocols regularly


Services – Data Recovery

• In the event of loss of service, data, corruption,natural disaster, etc.– BE PREPARED WITH APLAN THAT HAS BEEN TESTED

• Backups: Secure the most recent backup copy ofthe data (mirrored site)

• Location: Reinstate hosting site or establish serviceat an alternate site/server (hot-site)

• Server: Bring new server online and restore data• Test the restored server/data• Allow limited access for brief period of time to test

use, access, etc.• Open to full access upon validation of use test


Services – Training

• Standard services offered– Start up– Ongoing– Upgrades/customizations

• Cost and offerings for optional training


Services – Technical Support

• Standard Support– Point of contact – service representative /

vendor liaison– Hours of availability of service– Customer service request tracking system and

period of response/resolution– Customer service request escalation protocol– System maintenance and Internet service

support– Regular application releases and updates


Services – Technical Support (cont.)

• Product/Application Specific– Definitions of roles and responsibilities

• Could include job description and qualification of HMISsystem administrator/super user and/or client vendorcontact; grievance officer

– Standard support available to HMIS staff– Help desk for end users– Explicit term of support for the product/version (i.e.,

2 years before it becomes unsupported or ineligiblefor upgrades)


Infrastructure Requirements

• Hardware• Software• Communication and escalation protocols• Roles and responsibilities• Organizational preparedness – what needs

to be in place prior to obtaining access?


Terms of Payment and Cost

• Standard fees, charges, fee schedule– Definition of what is included in base price, version

upgrades (minor/major), add-ons, etc.

• Licensing specifications and cost– Dedicated/concurrent– Minimum agency requirements (i.e., at least one per

agency – no sharing, etc.)

• Fee Schedule• Licensor reserves the right to increase the monthly

service fees annually by no more than XX%• Consider using a benchmarking clause in long-term

contracting that gives buyers the right to havevendor’s prices reviewed by a third-party auditor–prices found to be noncompetitive are enough torequire re-negotiation


Other Provisions – Standards Compliance

• Data Standards Compliance– Not enough to simply say “be compliant with HMIS

Data and Technical Standards”– Need to define whether expenses incurred by vendor

to maintain compliance are passed on to the client orwhether they are absorbed by vendor and distributedvia ongoing updates within period of contract

– Define window of time in which the vendor must becompliant (i.e., within XX days of publication of finalnotice)

• Industry Standards Compliance– Maintaining currency with prevailing industry

standards


Other Provisions

• Escrow Agreements– The client has a right to request escrow of

application source code and documentation with avendor of their choice

– Recommended quarterly escrow– Provides some protection if vendor goes out of

business

• Arbitration– Under the laws of the state of vendor organization– Most require that disputes regarding validity of

agreement be submitted to, determined, and settledby formal arbitrator and rules of the AmericanArbitration Association (AAA)


Other Provisions (cont.)

• Confidentiality– Client and/or agency confidentiality protocol

• Typically the responsibility of licensee/client and mayrequire vendor staff to sign specific client/user/agencyconfidentiality protocols

– Compliance with present and future federal,state and local laws and regulation regardingconfidentiality of client records contained in ortransmitted by vendor


HMIS Management Contracts

• Contracts with organizations/individuals responsiblefor the management of the HMIS and may include:– Training– Policy and procedure development– Technical support– Backup and recovery– Compliance monitoring– Reporting– Risk management– Other community level data needs

• HMIS management contract components will mirrormany of the specifications of the vendor contractsincluding general terms, services, suspension, andtermination clauses, etc.


HMIS Management Contracts:Qualifications

• Implementing software in another industry doesnot necessarily prepare you for HMIS – eachagency is diverse and has unique needs

• Strong project management and “soft skills” arejust as important as the technical skillsnecessary to implement the system

• Past performance managing like or similarprojects with verifiable references

• Same due diligence as selecting a softwareproduct should be applied in selecting an HMISmanagement entity


HMIS Management Contracts: Governance

• CoC is responsible for the HMISimplementation – it is important to define therelationship between CoC and HMISadministering agency (and HMIS granteewhen different than HMIS administeringagency). This should include:– Relationship with CoC– Decision making authority– Communication protocols– Ownership of data and authority over data– Public relations approval process– Financial requirements – Match?


HMIS Management Contracts: Deliverables

• Consider performance based contractingwith incentives/penalties clauses– Very important to detail the specifications of

deliverables required under the contractincluding the detailed descriptions, deadlines,penalties, etc.

– Contract deliverables or scope of work should bereviewed and revised annually

– Performance should be monitored on regularbasis through reporting specifications orprogress reports to the CoC


What to do if you need to sever ties with avendor

• The best answer is what NOT to do– Don’t act in haste- over a series of weeks or months,

communicate your expectations, why they are notbeing met and what you intend to do about it.

– Create a paper trail.– If the vendor is responsible for creating or

maintaining any business-critical data or services-don’t fire them before you're sure you have alldocumentation, copies of data, etc.

– Try not to be too public about voicing displeasureand shopping for a replacement vendor—disgruntledIT systems or personnel can sabotage even the bestintentions.

Source: CIO.com http://www.cio.com/article/pring/118600 June 11, 2007


Contracting Pitfalls

• BEWARE OF VAPORWARE!!!!• Do not just sign on the dotted line without…

– Understanding what you are purchasing; and– Conducting a thorough legal review.

• Be specific as to what you mean. Simplyincluding a clause “must be compliant withHMIS Data and Technical standards” is notenough.

• Overambitious schedules– If it seems too good to be true – it probably is. Be

realistic, learn “realities” from other implementations– Protect yourself with incentives/penalties on meeting

deliverables within deadline


Contracting Pitfalls (cont.)

• You get what you pay for…the leastexpensive or “free” option may havealternate costs and may not deliver whatyou expected.

• Conversion from one system to another isthe last resort– Is it really the software? Most communities don’t

consider HMIS software absolutely perfect.– Loss of time and momentum should be

considered.– Resources ($) to convert to a new software are

not an eligible use of HMIS grant funds.– Software transition should be your last resort!


Discussion Questions

• What experiences have you had?• What challenges have you encountered?• What are the lessons you learned that

others should know about?• If you already have a contract, what would

you change?• What would you do differently now that you

didn’t know then?• If you are in the process of developing a

contract, what would you ask someone withmore experience?

Vendor Relations & Contracting-FINAL 8.29 · Vendor Relations & HMIS Contracting ... •...

Documents

Transcript of Vendor Relations & Contracting-FINAL 8.29 · Vendor Relations & HMIS Contracting ... •...