Executed Copy of Contract_City of Somerville — File 24-1655

1 Outreach Partner Provider Agreement (Date of Template: December 2023) AGREEMENT BY AND BETWEEN AND THE UNIVERSTIY OF MASSACHUSETTS BY AND THROUGH ITS UNIVERSITY OF MASSACHUSETTS CHAN MEDICAL SCHOOL This Agreement is entered into this day of , 20 , by and between located at (Entity) and the University of Massachusetts by and through its University of Massachusetts Chan Medical School by and through its ForHealth Consulting at UMass Chan, Health Care Finance Solutions located at 333 South Street, Shrewsbury, MA 01545 (UMass Chan). WHEREAS, the federal government reimburses the Commonwealth of Massachusetts for a certain percentage of expenditures made in accordance with the Commonwealth’s federally approved Supplemental Nutrition Assistance Program Outreach Plan (SNAP Outreach Plan); WHEREAS, the Department of Transitional Assistance (DTA) administers the SNAP Outreach Plan for the Commonwealth; WHEREAS, DTA has engaged UMass Chan to handle the administrative aspects of disbursing these funds to the Entities and monitoring the delivery of allowable SNAP Outreach services; WHEREAS, under the agreement between UMass Chan and DTA, UMass Chan must, among other things, assist the Entity in identifying outreach services and claiming outreach City of Somerville 1st October 24 City of Somerville 93 Highland Avenue, Somerville, MA 02143 Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

2 Outreach Partner Provider Agreement (Date of Template: December 2023) funds that are eligible for federal reimbursement under the SNAP Outreach Plan and UMass Chan must enter into agreements with Entities governing the disbursement of funds as well as delivering and monitoring of outreach services; WHEREAS, under the agreement between DTA and UMass Chan, UMass Chan is authorized to retain, as compensation for its services, five percent (5%) of the federal funds transferred to UMass Chan for disbursement to the Entity; WHEREAS, each Entity who has incurred costs and submitted a claim for reimbursement is entitled to receive fifty percent (50%) of approved expenditures less the 5% UMass Chan administrative fee; and NOW THEREFORE, the Entity and UMass Chan hereby enter into this Agreement as follows: Purpose of Agreement: The purpose of this Agreement is to set forth the terms and conditions under which the Entity must complete SNAP enrollment and outreach activities and under which UMass Chan must monitor such services and disburse funds to the Entity for eligible outreach services. A. Entity Responsibilities Project Requirements 1. The Entity shall coordinate with UMass Chan to develop the annual budget based on eligible funding sources for all allowable outreach services, by the due date advised each year to be included in the State’s SNAP Outreach Plan. Barring unforeseen circumstances, budgets must be submitted through DTA’s Partner Activity Tracking Hub (PATH) system. The annual Entity budget is subject to United States Department of Agriculture’s (USDA) Food & Nutrition Service (FNS) review and approval. 2. The Entity will receive from UMass Chan a Statement of SNAP Outreach Reimbursement Project Standards within 30 days following notification to UMass Chan of USDA/FNS approval of the SNAP Outreach Plan. The Entity must provide to UMass Chan written acknowledgment of its approved Annual Entity Client Engagement Number, Quality Application Approval Rate, Quality Application Approval Rate Rules, and Entity Budget within 7 days of receipt. Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

3 Outreach Partner Provider Agreement (Date of Template: December 2023) 3. The Entity shall work with UMass Chan to maintain a working knowledge of outreach services that are eligible for federal reimbursement under the SNAP Outreach Plan. See SNAP Outreach resource materials. 4. The Entity shall provide SNAP outreach activities in accordance with the federally approved SNAP Outreach Plan, provided however, the Entity will not be reimbursed for SNAP application and outreach activities prior to the effective date of the Agreement. 5. Program deliverables and due dates: a) Initial budgets are due on or before April 1st for the upcoming federal fiscal year. Budgets not received by the due date will not be included in the state plan authorizing services starting on October 1st. b) Budgets for new Entities starting after October 1st, will be accepted at any time, but may require state plan amendment and will require approval before services can begin. c) Each year and if the rate changes, the Entity must provide UMass Chan with a federally approved indirect cost rate letter, if applying an indirect cost rate of more than 10%. d) The Entity must sign and submit to UMass Chan a W-9/Vendor Identification Form annually. e) Claims are due on or before the 10th day after the quarter ends (or prior business day if the 10th is a non-working day). i. Q1 due date – January 1st to January 10th ii. Q2 due date – April 1st to April 10th iii. Q3 due date – July 1st to July 10th iv. Q4 due date – October 1st to October 10th f) Claims submitted after the due date may be processed as retroactive (retro) claims, resulting in delayed payments. Retro claims are due as follows: i. Retro Q1– by March 10th ii. Retro Q1 and/or Q2 – by June 10th iii. Retro Q1, Q2 and/or Q3 – by September 10th iv. End of Year Claim (not typical) – by November 1st Retro claims will not be accepted after November 1st. 6. Ongoing Performance deliverables: a) The Entity must secure permission to exchange information with DTA by way of a signed Permission to Share Information (PSI) form for each client and keep records on file as per Section A.22-27, below. The Entity must make these documents available to DTA/UMass Chan if requested during a PSI audit review (to occur at least annually), or at any other time. Failure to provide requested documentation may result in corrective action, revocation of access, and/or termination of this Agreement. b) The Entity will use DTA Connect to inform DTA that the PSI form has been Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

4 Outreach Partner Provider Agreement (Date of Template: December 2023) signed and to submit SNAP applications, recertifications, interim reports, case assistance (maintenance) to DTA on behalf of clients served. Barring unforseen circumstances, all outreach activities must be completed on DTA Connect. c) The Entity must work to meet the Client Engagement Number (applications, recertifications, interim reports and case assistance) as provided by the Entity in the budget for the respective federal fiscal year. d) The Entity must maintain an approval rating of 50% or more as established in the Statement of SNAP Outreach Reimbursement Project Standards. The approval rating is based on the number of applications, recertifications and/or interim reports entered through DTA Connect and approved for SNAP benefits. e) Entities with approval ratings below the standard may be subject to performance improvement strategies, such as training, and technical assistance to help the Entity meet the required rating. 7. Nondiscrimination: a) The Entity must operate in compliance with all nondiscrimination laws, regulations, instructions, policies, and guidelines. In addition, the Entity must compile data, maintain records, and submit reports as required to permit effective enforcement of nondiscrimination laws, regulations, policies, instructions, and guidelines. b) The Entity must comply with state and federal law and ensure that individuals served under this contract are not discriminated against based on race, color, national origin, age, sex, religious creed, disability, and political beliefs. c) While all program staff are encouraged to attend the Civil Rights Training, at a minimum, the Entity’s Program Director or designee(s) must attend the mandatory training offered by DTA/UMass Chan annually and, in turn, train each staff working on the project. d) The Entity must display the most current version of the ‘And Justice for All’ Poster in a prominent location(s). e) The Entity must comply with USDA non-discrimination statement requirements (https://www.fns.usda.gov/fns-instruction-113-1). 8. The Entity will ensure that all staff involved with the SNAP Outreach program participate in UMass Chan/DTA sponsored mandatory* and/or optional training as appropriate to their role and responsibilities. Examples of training: a) Onboarding trainings, if applicable; b) DTA’s PATH and DTA Connect systems; c) SNAP Outreach budget process; d) SNAP Outreach claims and reimbursement process; e) Annual Civil Rights Training; and f) Permission to Share Information (PSI) training. *Entity will be informed of mandatory training and due dates as applicable. Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

5 Outreach Partner Provider Agreement (Date of Template: December 2023) 9. UMass Chan will support the Entity with contracts, budget, claims, and PATH System and DTA will support the Entity with SNAP Outreach SNAP 101, DTA Connect access and training. The Entity will request technical assistance and/or training as needed. System Access Requirements 10. The Entity’s authorized signatory must complete and sign the DTA Connect/Partner Activity Tracking Hub (PATH) Service Agreement and DTA Connect/Partner Activity Tracking Hub (PATH) Security Administrator Designation Form. If there is a change in the authorized signatory or security administrator, these forms must be updated within 5 business days of the change. 11. The Security Administrator(s) (SA) must ensure that information provided to DTA for all Entity user(s) accessing DTA system(s) is current and accurate. The SA must notify DTA if a user’s access must be terminated or updated within 5 business days of the change. The Entity will be subject to user access audits. Unauthorized access or failure to inform could result in revocation of user or Entity’s system access or termination of this Agreement for cause. 12. UMass Chan will provide the Entity with login credentials for the UMass Chan Secure File Transfer System (SFTS). Information containing Personal Information (PI), as defined in Section N, or other sensitive information must be exchanged with UMass Chan/DTA via SFTS or secure email. Claiming Requirements 13. As per section 5.e). within 10 days of each quarter end, the Entity will submit a quarterly claim (invoice) documenting the reimbursement eligible expenditures that were incurred during the claim period. Barring extenuating circumstances that warrant another method of submission, all claims must be submitted through the PATH system. The Entity must include documentation of staff time spent on SNAP outreach activities in accordance with USDA requirements and guidance provided by UMass Chan to the Entity. 14. The Entity will check the application listing in the PATH system for accuracy of all applications, recertifications, and interim reports. If applications, recertifications and /or interim reports were completed outside of DTA Connect, the Entity will enter this information into the PATH system under List client and validate the entry. If unable to enter information into the PATH system due to extenuating circumstances, the Entity will provide UMass Chan, as part of the invoice, a separate list by calendar month of SNAP applications, recertifications, and interim reports submitted in the preceding quarter. This list must include: Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

6 Outreach Partner Provider Agreement (Date of Template: December 2023) a. Description of the specific SNAP Outreach activity (applications, recertifications, and interim reports); b. Date of the allowable SNAP Outreach activity; c. Name of the applicant or recipient who received an allowable SNAP Outreach activity; and d. The Social Security Number (SSN) or Assessed Persons ID (APID), if no SSN is available, for the applicant or recipient of SNAP Outreach activity. 15. The Entity shall include in the invoice only those expenses for services that meet the requirements for reimbursement. Reimbursement eligible expenses include: a. Allowable expenditures for eligible outreach services in accordance with the approved SNAP Outreach Plan and guidance. b. Claimed expenditures that relate to application and outreach activities and the time spent on SNAP outreach activities in accordance with USDA requirements and guidance for the applicable quarter. c. Funding used for outreach services from allowable sources and which are not being used to provide a match for other federal funding by the Entity or the original funding source. d. Expenses supported by accurate and detailed records that verify the delivery and costs of outreach services. Examples of detailed records may include but are not limited to cost calculations, itemized receipts, invoices, purchase orders, time sheets and/or payroll records, payment summary, and expense or disbursement ledger with all allowable (invoiced) expenses. 16. The Entity shall exclude from the invoice all expenses for services that are not eligible for reimbursement, such as: a. Services that are reimbursed by, or eligible to be reimbursed by, other federal funds/programs/grants; b. Services that are provided for the Entity to qualify for matching funds for federal funds/programs/grants; c. Services that are provided pursuant to funds donated from an individual or other Entity, if the results of such donation have a direct benefit to said individual or Entity; and d. The value of services rendered by volunteers and the value of goods contributed by third parties. 17. The Entity shall submit to UMass Chan with each invoice, as entered on the PATH system, a completed Certification of SNAP Outreach Project Expenditures and SNAP Quarterly Outreach Invoice Cover Letter, signed by an authorized signatory of the Entity, in accordance with guidance provided by UMass Chan. Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

7 Outreach Partner Provider Agreement (Date of Template: December 2023) 18. The Entity shall provide clarification and/or supporting documentation as requested by UMass Chan during the claims review process for any rejected invoice. If unable to resolve claims discrepancies within the claims review period, claims will be processed retroactively with the next quarter. 19. As per section 5.f). the Entity may submit a retro claim(s) documenting reimbursement eligible expenditures that were incurred during the allowable claim period(s). Retro claims must meet requirements in sections A.13-17 and require a Retro Certification of SNAP Outreach Project Expenditures and Retro SNAP Quarterly Outreach Invoice Cover Letter and may require additional supporting documentation or clarification as part of the review. Barring extenuating circumstances that warrant another method of submission, retro claims must be submitted through the PATH system. 20. The Entity shall communicate regularly with the UMass Chan Contract Officer identified in Section H., Agreement Management and Supervision, of this Agreement on the progress of the invoice relative to activities performed under the terms of this Agreement. 21. The Entity shall ensure that reimbursed funds received under this Agreement are used to supplement the capacity of or enhance the SNAP Outreach program or add additional services and not to supplant existing services. Record Retention and Monitoring for access by UMass, State or FNS 22. The Entity shall maintain auditable records and accounts of the reimbursement eligible SNAP Outreach services detailed in the SNAP Outreach claim that substantiate the delivery of services and expenditures. Examples of detailed records may include but are not limited to: a) Itemized receipts, invoices, and purchase orders b) Time sheets and/or payroll records c) A payment summary, expense/ disbursement ledger with all allowable (invoiced) costs clearly identified under appropriate headings. 23. The Entity shall keep records in a cost-effective and easily retrievable format and in a storage area that meets recognized industry standards for physical and environmental security. 24. The Entity must make records available to UMass Chan/DTA upon request. Records may be requested and reviewed at any time for monitoring audit purposes. 25. The Entity shall maintain all such records for a period of seven years or longer, as specified in this section. The seven-year period must begin on the first day that the Entity signs the contract and requests payment for services; Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

8 Outreach Partner Provider Agreement (Date of Template: December 2023) 26. If any litigation, claim, negotiation, audit, or other action involving the records is commenced prior to the expiration of the applicable retention period, the Entity shall retain all records until completion of the action and resolution of all issues resulting from the action, or until the end of the applicable retention period, whichever is later. 27. The Entity shall cooperate with UMass Chan and DTA monitoring activities, such as site visits (virtual or in-person) and an annual review related to the SNAP Outreach Reimbursement Project. In addition, the Entity shall allow auditors from UMass Chan, DTA, the federal government, and/or other appropriate oversight agencies access to all records pertaining to revenue and expenditures specific to projects outlined in this Agreement. Such access may include, but is not limited to, on-site visit or virtual/annual review, request to upload documentation via SFTS and reproduction of records at reasonable expense. 28. The Entity shall submit to UMass Chan each year a copy of the Entity’s annual audit report. 29. In accordance with 2 CFR §200 et seq, Subpart F, a non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. 30. The Entity must comply with all security and confidentiality requests as deemed necessary by DTA or UMass Chan to ensure compliance with program requirements and as noted in Section K. of this Agreement, Data Management. Any failure to comply with such request could result in termination of this Agreement for cause. 31. If the Entity needs to enter into an ‘inactive’ status due to a lack of funding, staffing issues, or other reason, the Entity must inform UMass Chan and DTA. Inactive status means that an Entity has a current signed entity agreement with UMass Chan but is not participating in the SNAP Outreach project for a temporary time frame, or until the contract is terminated and/or expires (see section I). B. Conflict of Interest 1. The Entity must not allow any employee, vendor, or subcontractor to participate in any decision related to this Agreement or to services provided under this Agreement that affects or may affect his/her personal financial interest or that of any family member or business partner. 2. The Entity must not employ or compensate any employee of the Commonwealth during the term of this Agreement unless such arrangement or Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

9 Outreach Partner Provider Agreement (Date of Template: December 2023) decision is permitted under the provisions of M.G.L. c. 268A. 3. The Entity must not employ any former Commonwealth employees during the term of this Agreement except as allowed by M.G.L. c. 268A. C. Reporting Requirements The Entity agrees to prepare any additional reports requested by UMass Chan/DTA that are reasonably necessary to acquire or facilitate for the acquisition of federal reimbursement. D. Confidentiality 1. The Entity acknowledges that in the performance of this Agreement it may acquire or have access to “personal data” and become a “holder” of such personal data as defined in the Fair Information Practices Act, M.G.L. c. 66A, or other information deemed confidential by the Commonwealth. 2. The Entity must comply with all applicable federal and state laws, rules, and regulations relating to the privacy and security of personal information and/or confidential information, including 7 CFR 272.1(c), M.G.L. c. 66A and M.G.L. c. 93H. E. UMass Chan Responsibilities UMass Chan will: 1. Coordinate with the Entity to identify allowable outreach activities and funding sources and to develop a budget by the due date to be included in the State’s SNAP Outreach Plan. 2. Within 30 days of notification of USDA/FNS approval of the SNAP Outreach Plan, UMass Chan will provide the Entity with a Statement of SNAP Outreach Reimbursement Project Standards. 3. Assist the Entity in developing a working knowledge of SNAP Outreach requirements and services that are eligible for reimbursement. 4. In coordination with DTA, provide the Entity with training and technical assistance related to: a) Onboarding trainings, if applicable; b) DTA’s PATH and DTA Connect systems; c) SNAP Outreach budget process; d) SNAP Outreach claims and reimbursement process; Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

10 Outreach Partner Provider Agreement (Date of Template: December 2023) e) Annual Civil Rights Training; f) PSI training; and g) Other necessary training(s). 5. Provide the Entity with login credentials for the UMass Chan Secure File Transfer System (SFTS) and provide training and technical assistance. 6. Review each invoice to ensure that: a) expenditures were allowed and incurred in the claim quarter; b) reimbursement eligible funding sources were used; c) cover letter and certification of expenditures were submitted; and d) supporting documents were provided (as applicable). 7. Work with the Entity to address any problems or errors identified during the claims review process and to examine and review policies to avoid problems with future invoices. If unable to resolve claims discrepancies within the claims review period, UMass Chan will process the claim retroactively with the next quarter. 8. Provide the Entity with a total of the costs that are not submitted to the federal government for reimbursement, with a written explanation for the non- inclusion. 9. Work with DTA to ensure that the Entity’s request for reimbursement is included in the claim that the State submits to the federal government for SNAP Outreach reimbursement. 10. Monitor the Entity Application Approval Rate. Notify DTA and the Entity if the Quality Application Approval Rate falls below the standard. 11. Conduct an annual program and fiscal review (virtual or in-person) to ensure compliance with SNAP Outreach services and contract requirement. 12. For monitoring purposes, and in coordination by DTA, conduct random document reviews of the Entity to ensure accuracy of claims and maintenance of appropriate records. 13. In coordination with DTA, implement performance-improvement strategies, such as, but not limited to, trainings and technical assistance, corrective action with the goal improvement, if warranted, a probationary period to implement changes discussed with the Entity, and contract termination, if warranted. 14. Provide the Entity with reminders of due dates, deliverables, and track compliance and mandatory training attendance. 15. In coordination with DTA, UMass Chan will work with the Entity that needs to Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

11 Outreach Partner Provider Agreement (Date of Template: December 2023) enter into an ‘inactive’ status or terminated status due to a lack of funding, staff transitions and/or other factors. UMass Chan will complete the following process: a) UMass Chan and DTA will schedule a phone conversation and/or meeting to determine why the organization wants to become inactive/terminate the contract. b) UMass Chan will secure written acknowledgement of inactive/termination plan from the Entity. c) UMass Chan and DTA will use the following checklist to track steps for inactive/terminated Entity: i. UMass Chan will remove the Entity from all active partner distribution and tracking lists and marketing materials; ii. UMass Chan will encourage the Entity to submit a claim by the end of the current quarter (if applicable). iii. DTA will suspend DTA Connect and PATH system privileges within 30 days of the report of inactive or terminated status; iv. DTA will inform the appropriate Community Liaison the Entity is no longer active; and v. UMass Chan and DTA will deactivate the Entity in UMass Chan/DTA systems. d) UMass Chan and DTA will inform the Entity of the process for resuming SNAP Outreach service or new contract requirements, when applicable. F. Payment Procedure 1. UMass Chan will distribute to the Entity an amount equal to 95% of the federal funds that have been received by the Commonwealth that are attributable to the services provided by the Entity and listed on the Entity’s quarterly SNAP outreach claim (invoice) and will retain 5% of such funds as compensation for its services. UMass Chan will work with DTA, EOHHS, and USDA to make payments within 90 days after the quarter claims are processed. 2. If any expenditures listed on the Entity’s quarterly outreach invoice are not reimbursed by the federal government, UMass Chan will notify the Entity of the non-reimbursed amount and, to the extent known by UMass Chan, the reason for the non-reimbursement. 3. All payments and reimbursements are subject to availability of federal funds. G. Disallowance Procedure Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

12 Outreach Partner Provider Agreement (Date of Template: December 2023) 1. In the event that a review by DTA, UMass Chan, the federal government, or any other oversight agency determines that the Entity did not provide services in accordance with the terms specified in this Agreement, applicable state and/or federal laws, and/or if for any other reason the federal government takes steps to recover funds that it believes it paid in error (disallowance), the Entity agrees to return the disallowed funds to UMass Chan within 60 days after notification by UMass Chan, or to make other repayment provisions satisfactory to UMass Chan and agreed to by UMass Chan in writing. 2. The Entity agrees to return the disallowed funds to UMass Chan as described in Section G.1 above, even if the disallowance occurs after the termination of this Agreement. 3. The Entity authorizes UMass Chan to reduce or withhold future payments to the Entity if necessary to recover disallowed funds. H. Agreement Management and Supervision 1. UMass Chan designates Jayna Mistry as its Contract Officer to be responsible for managing and administering this Agreement. 2. The Entity designates __________________________as its Contract Officer to be responsible for all Agreement management and supervision. 3. Each party must notify the other within 10 business days after any change to its Contract Officer. I. Termination 1. This Agreement must be in effect from the date it is executed until September 30, 2028, unless this Agreement is amended or terminated earlier in accordance with the provisions of this Section I. 2. Either party may terminate this Agreement without cause by giving written notice to the other party’s Contract Officer at least 30 calendar days prior to the effective date of termination. 3. In the event of an elimination or reduction in the Entity’s funding, the Entity may terminate this Agreement by providing written notice of termination to the UMass Chan Contract Officer at least 14 calendar days prior to the effective date of termination, unless funding circumstances necessitate a shorter notice period. 4. Either party may terminate this Agreement for cause by giving written notice to the other party’s Contract Officer at least three calendar days prior to the Andi Benvenuto Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

13 Outreach Partner Provider Agreement (Date of Template: December 2023) effective date of termination if the other party fails to fulfill its responsibilities under this Agreement. Such written notice must state the circumstances of the other party’s failure. Such written notice may, but is not required to, provide the other party with an opportunity to cure the breach. J. Diversity, Equity and Inclusion Commitment UMASS Chan and DTA are committed to increasing opportunities and creating a culture that values and embraces contributions from all people with different backgrounds, experiences, and perspectives. This agreement between UMASS Chan and the Entity is an agreed upon commitment that will provide opportunities and services in alignment with the state’s efforts towards diversity, equity, and inclusion (DEI) for all. Accordingly, as part of this continuous effort and program improvement towards DEI alignment, SNAP Outreach partners must demonstrate a commitment to such efforts in the services they provide. K. Data Management 1. Definitions a. “Breach”: must mean the acquisition, access, use, or disclosure of Personal Information in a manner not permitted under this Agreement, M.G.L. c. 93H, or other applicable state or federal privacy and security laws. b. “Custodian”: must mean the individual designated by the Entity to oversee the Entity’s compliance with this section of the Agreement, Data Management. The Entity designates as custodian of the Personal Information and must notify UMass Chan within two business days if the custodianship is transferred to another person. c. “Data Management Agreement” (“DMA”): must mean Section K, the data management section of the Agreement. d. “Discovers”: must mean the first day on which a use or disclosure of Personal Information not permitted under this Agreement, a Breach, or a Security Incident is known to the Entity (including any person, other than the individual committing the Breach, who is an employee, officer, or other agent of the Entity), or should reasonably have been known to the Entity, to have occurred. e. “Personal Information” or “PI”: must mean: x “personal information” as defined in M.G.L. c. 93H or other applicable states’ security breach notification laws; x “personal data” as defined in M.G.L. c. 66A; Nora Williams Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

14 Outreach Partner Provider Agreement (Date of Template: December 2023) x “information” obtained from a SNAP applicant or recipient household as used in 7 CFR 272.1(c); x Third party data and any other individually identifiable information that is treated as confidential under the law; and must refer to any information in any medium (whether oral, written, or electronic) that the Entity creates, receives, maintains, uses, discloses, transmits or is otherwise permitted access to in the performance of its services pursuant to this Agreement. f. “Security Incident”: must mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. 2. Obligations and Activities of Entity a) The Entity acknowledges and agrees that it is functioning as UMass Chan's subcontractor pursuant to this Agreement by performing services UMass Chan is obligated to perform. b) The Entity agrees not to access, create, receive, maintain, use, disclose, or transmit Personal Information other than for the purposes specified in this Agreement, as permitted or required by this DMA, or applicable state and federal laws. The Entity further agrees that it must make all reasonable effort to use or disclose, request, maintain, or access no more than the minimum amount of Personal Information permitted under this Agreement and DMA than is necessary to perform the services under this Agreement. c) The Entity agrees to comply with all applicable state and federal laws and regulations relating to the confidentiality, privacy, and security of Personal Information, as well as any applicable state policies, standards, or rules governing the Entity’s use, disclosure, and maintenance of any PI under this Agreement. This includes, but is not limited to, 7 CFR 272.1(c), M.G.L. c. 66A and c. 93H; 201 CMR 17; and the Massachusetts Executive Office of Technology Services and Security (EOTSS) Enterprise Information Security Policies and Standards or applicable successor policies and requirements;. d) The Entity further agrees that it must comply with all other privacy and security obligations applicable to any PI under this Agreement based on UMass Chan or DTA having entered into an agreement with a third party (including, but not limited to, the Social Security Administration or the Massachusetts Department of Revenue) to obtain or access the data. Such agreements may include a written compliance acknowledgment or confidentiality agreement. The Entity must comply with other privacy Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

15 Outreach Partner Provider Agreement (Date of Template: December 2023) and security obligations required by the third party for access to data from the third party or to any system or database containing any such data or through which such data could be accessed. e) The Entity agrees to implement a comprehensive information security program at least as stringent as 201 Code of Massachusetts Regulations 17.00, as amended, including but not limited to: (1) Designating one or more employees to maintain the comprehensive information security program. (2) Identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing Personal Information, and evaluating and improving, where necessary, the effectiveness of the Entity’s current safeguards for limiting such risks, including but not limited to: x ongoing training for individuals authorized to access the Personal Information, including but not limited to employees (including temporary and contract employees) (collectively “employees”), officers, independent contractors, and agents (employees, officers, independent contractors, and agents must collectively be referred to in this DMA as “individuals with access”); x compliance with policies and procedures by individuals with access; and x means for detecting and preventing security systems failures. (3) Developing and implementing security policies applicable to individuals with access, including but not limited to the storage, access, and transportation of records containing Personal Information outside of business premises owned or controlled by the Entity, including remote access to Personal Information. (4) Imposing disciplinary measures, including but not limited to termination of access to Personal Information, for violations of the Entity’s comprehensive information security program rules by individuals with access. (5) Preventing terminated employees or other individuals with access from accessing records containing Personal Information. (6) Taking reasonable steps to select and retain subcontractors capable of maintaining appropriate security measures to protect Personal Information consistent with this DMA and ensuring that each agent Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

16 Outreach Partner Provider Agreement (Date of Template: December 2023) or subcontractor that the Entity engages to create, receive, maintain, use, disclose, or transmit Personal Information under the subcontract agrees in writing to the same restrictions and conditions that apply to the Entity throughout this DMA. (7) Implementing reasonable restrictions upon physical access to records containing Personal Information, and storage of such records and data in locked facilities, storage areas, or containers. (8) Regular monitoring of the Entity’s comprehensive information security program to ensure it is operating in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of Personal Information; and upgrading physical, administrative, and technical safeguards as necessary to limit risks. (9) Reviewing the scope of the Entity’s security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing Personal Information. (10) Documenting responsive actions taken in connection with any incident involving a Breach or Security Incident, and mandatory post-incident review of events and actions taken, if any, to make changes in business practices relating to protection of Personal Information. f. The Entity agrees to implement reasonable administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic Personal Information that it creates, receives, maintains, uses, discloses, transmits, or otherwise has access to on behalf of UMass Chan or DTA. Such safeguards must include at a minimum the following: (1) Secure user authentication protocols. (2) Secure access control measures restricting access to records and files with Personal Information to those who need such information to perform job duties, and then only to the minimum necessary to perform such duties, as well as the assignment of unique identifications and passwords that are designed to maintain the integrity of the security of the access controls. (3) Encryption of all data-in-motion and data-at-rest meeting standards set forth in http://csrc.nist.gov/publications/nistpubs/800- 111/SP800-111.pdf (NIST Special Publication 800-111 entitled “Guide to Encryption Technologies for End-User Devices”), as that document may be amended or updated from time to time. Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

17 Outreach Partner Provider Agreement (Date of Template: December 2023) (4) No storage of Personal Information on portable media or devices that may be transported off the Entity’s premises except when copying data onto storage media for secure transport to UMass Chan, DTA, or the Entity’s backup facility, and then only in encrypted format as described in Section f(3) immediately above. (5) Continuous monitoring of the Entity’s systems for unauthorized use of or access to Personal Information. (6) Continuous updating of firewall protection and operating system security patches designed to maintain the integrity of the Personal Information. (7) Updated versions of system security agent software, which must include malware protection and updated patches and virus definitions, or a version of such software that can still be supported with updated patches and virus definitions and is set to receive the most current security updates on a regular basis. (8) Education and training of individuals with access on the proper use of the information security system and the importance of Personal Information security. (9) No remote access to the Personal Information, unless pursuant to Entity’s comprehensive written information security plan for such access. (10) If UMass Chan gives the Entity access to any UMass Chan, DTA, or other data owner’s database, system, or information technology resource, the Entity must comply with all UMass Chan, DTA, or other data owner’s policies, processes, and mechanisms established for access. The Entity must maintain and make available at the request of UMass Chan a current list of individuals with access to such database(s) and changes thereto, including but not limited to changes requiring a termination or modification of any password, user ID, or other access mechanisms. (11) No hosting or maintaining any Personal Information outside the United States. g. The Entity agrees to furnish UMass Chan upon request a description of the steps it has taken to protect the security of the Personal Information and must allow authorized representatives of UMass Chan access to the premises where Personal Information is stored or accessed, for purposes Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

18 Outreach Partner Provider Agreement (Date of Template: December 2023) of inspecting privacy and security arrangements. h. The Entity agrees to document disclosures of Personal Information, as required to provide an accounting of disclosures of Personal Information, only as prescribed by applicable state or federal requirements. i. The Entity agrees to verbally report to UMass Chan's Privacy Officer by telephone (508-856-TEAM) and in writing by email ([email removed]), within three business days of when the Entity Discovers any Breach, nonpermitted use or disclosure of Personal Information, or Security Incident. Notice must include: (i) the date(s) of occurrence of the Breach, nonpermitted use or disclosure, or Security Incident; (ii) nature of such incident(s); (iii) date of Discovery of such incident(s); (iv) nature and extent of Personal Information involved; (v) nature of unauthorized persons who received Personal Information; (vi) the number of individuals involved; (vii) the harmful effects of the incident known to the Entity and steps the Entity has taken or plans to take to mitigate risk of harm from such incident(s); and (viii) any other information necessary to complete a risk assessment. When, despite all reasonable efforts by the Entity to timely obtain the information required for such notice, circumstances beyond the control of the Entity necessitate additional time, the Entity must provide the above information to UMass Chan as soon as possible and without unreasonable delay, but in no event later than 30 calendar days from the date on which it Discovers the Breach, nonpermitted use or disclosure, or Security Incident; provided that the Entity must provide verbal notice of the Breach, nonpermitted use or disclosure, or Security Incident, and all information then available within three business days of Discovery of the incident and the additional information as soon thereafter as it is available. (1) The Entity agrees to retrieve, to the extent possible, any Personal Information used or disclosed in the nonpermitted manner; mitigate, to the extent possible, the risk to the Personal Information resulting from the nonpermitted use or disclosure; and take any further action required by any applicable state or federal law concerning the privacy and security of the Personal Information. (2) The Entity agrees to cooperate and provide access to information necessary for UMass Chan and the Entity to determine the scope of the unauthorized use, disclosure, or Security Incident and to fulfill any mitigation or notification obligation. If the data owner, DTA, or UMass Chan determines that the Entity’s breach triggers Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

19 Outreach Partner Provider Agreement (Date of Template: December 2023) individual notification, the Entity agrees to assist UMass Chan. The Entity further agrees to comply with its obligations under M.G.L. c. 93H and other state and federal security breach statutes, as applicable, but in no case must the Entity provide notice directly to individuals, any applicable government agency, or any media outlets. (3) The Entity agrees to reimburse UMass Chan for reasonable costs incurred associated with notification and mitigation, to the extent that such costs are due to the Entity’s: (a) failure to meet its responsibilities under, or in violation of, any provision of this DMA or this Agreement; (b) violation of law; (c) negligence; and (d) any activity or omission of its employees, agents, other individuals with access, or subcontractors resulting in or contributing to an incident triggering such notice or mitigation. j. The Entity agrees to ensure that each agent or subcontractor that it may engage on its behalf that will have access to Personal Information received from, created or received by the Entity pursuant to this Agreement, agrees in writing to the same restrictions and conditions that apply through this DMA to the Entity. The Entity is solely responsible for its agents’ and subcontractors’ compliance with this and all other provisions in this DMA and must not be relieved of any obligation because the PI was in the possession of its agents or subcontractors. k. The Entity agrees to report to UMass Chan's Privacy Officer, by telephone and in writing by email, as described in Section i above, within two business days of receipt, any instance where an individual or an individual’s legal representative makes a request of either the Entity or a subcontractor or agent of the Entity: (a) for a copy of the Personal Information pertaining to that individual; (b) that the Personal Information be disclosed to a third party; (c) that the Personal Information be amended; or (d) for a list of disclosures made by the Entity of the Personal Information pertaining to that individual. The Entity must respond as directed by UMass Chan. l. The Entity agrees to report to the UMass Chan Privacy Officer, by telephone and in writing by email, as described in Section i above, any instance in which the Personal Information is subpoenaed or becomes the subject of a court or administrative order or other legal process, whether or not the Personal Information is in the Entity’s physical custody. In no event must the Entity’s reporting obligations under this paragraph be delayed beyond two business days preceding the return date in the subpoena or legal process, or two business days from obtaining such request for data, whichever is shorter. The Entity must not respond Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F

20 Outreach Partner Provider Agreement (Date of Template: December 2023) to such legal process unless so authorized by UMass Chan and in accordance with applicable state or federal law requirements. m. The Entity acknowledges that it has no ownership rights in the Personal Information or in any data derived or extracted from the Personal Information. n. Upon termination or expiration of this Agreement or as otherwise applicable, the Entity must properly dispose of all Personal Information as follows, or as otherwise instructed in writing by UMass Chan: (1) Paper documents containing Personal Information must be either redacted, burned, pulverized, or shredded so that personal data cannot practicably be read or reconstructed; (2) Electronic media and other non-paper media containing Personal Information must be destroyed or erased so that Personal Information cannot practicably be read or reconstructed meeting standards set forth in http://csrc.nist.gov/publications/nistpubs/800- 88/NISTSP800-88_with- errata.pdf (NIST Special Publication 800- 88 entitled “Guidelines for Media Sanitization”), as that document may be amended or updated from time to time; and (3) The Entity must attest in writing to UMass Chan within 30 days of the termination or expiration of this Agreement that all the Personal Information was returned or destroyed in compliance with the above- listed requirements, including a description of the steps taken. UMass Chan: SIGNATURE: PRINT NAME: Patti Onorato PRINT TITLE: Deputy Executive Vice Chancellor for Operations ENTITY: SIGNATURE: PRINT NAME: PRINT TITLE: Katjana Ballantyne Mayor of City of Somerville Docusign Envelope ID: 6B4E7E5C-7CEE-4E96-AF43-00E63CBA668F