122436 O5 - BCBS Response_.pdf

TECHNICAL Proposal Response for

RFP 122436 O5

Administrative Support Services for the State of Nebraska Employee Health Care Prescription Drug Benefit Plans

Self-Funded Pharmacy Administration

Effective Date July 1, 2026

Submitted Online To:

State of Nebraska (State), Department of Administrative Services

(DAS), Materiel Division, State Purchasing Bureau (SPB)

TECHNICAL RESPONSE TABLE OF CONTENTS RFP 122436 O5

TECHNICAL PROPOSAL

Table of Contents & Proposal Evaluation Criteria

SECTION

Main RFP Subsection(s) Noting

Requirement

1-SIGNED FORMS

Contractual Agreement Form…………………………

ATTACHMENT A Intent to Propose Form…..………

Non-Disclosure Agreement……………………………

ATTACHMENT B Business Associate Agreement..

Addenda…………………………………………………..

(See RFP SECTIONS I – VI below for initialed sections.)

• RFP 122436 O5 Contractual Agreement Form

• Certificate of Authority for Ron Rowe

• Intent to Propose Form

• Non-Disclosure Agreement for Data File Access

• Business Associate Agreement (Revised)

• Unsigned Redlined Business Associate Agreement for Identification of Revisions

• Addendum 1 – June 26, 2025

• Addendum 2 – July 9, 2025

2-CORPORATE OVERVIEW

1-Overview………………………………………………..

2-Personnel Management Approach………………...

3-Subcontractors………………………………………..

4-Community Investment & Support………………...

• Corporate Overview Items (VI.A.1.a – VI.A.1.h)

• Proposed Personnel Approach (VI.A.1.i)

• Subcontractor List (VI.A.1.j)

• Statewide Support

3-RFP SECTIONS I. – VI. (Initialed)………

• Section I Procurement Procedure

• Section II Terms and Conditions

• Section III Vendor Duties

• Section VI Payment

• Section V Project Description and Scope of Work

• Section VI Solicitation Response Instructions

SECTION

Main RFP Subsection(s) Noting

Requirement

4-TECHNICAL RESPONSE

1-Understanding of Project Requirements…………

2-Developmental Approach……………………………

3-Technical Requirements……………….……………

4-ATTACHMENT C1 Questionnaire…...……………..

5-Formulary Disruption Analysis…………………….

6-Network Disruption Analysis……………………….

7-Attachment D Performance Guarantees………….

8-Detailed Project Work Plan………...………………..

9-Deliverables/Due Dates………………………………

• Understanding of Project Requirements (VI.A.2(a))

• Proposed Developmental Approach (VI.A.2(b))

• Technical Requirements (VI.A.2(c))

• Attachment C1 Questionnaire (VI.A.2(d))

• Formulary Disruptions on PDL25 and PDL10 (Ques.

D.3; VI.A.2(e))

• Network Disruption Reports (Ques. F.14; VI.A.2(f))

• Pharmacy Operational Guarantees (VI.A.2(g))

• Detailed Project Work Plan (VI.A.2(h))

• Deliverables and Due Dates (VI.A.2(i))

10-BENEFIT PLANS & RECOMMENDATIONS……...

• Regular PPO Plan

• Consumer-Focused Plan (HDHP)

• Wellness PPO Plan

• Pharmacy Benefit Recommendations & Deviations

EXHIBITS

Description

A…………………………………………………………..

B…………………………………………………………..

C…………………………………………………………..

RFP Deviations (I.G.)

Sample Pharmacy Administrative Services Agreement

(II.A)

BCBSNE Financial Statements (VI.A.1.b)

D…………………………………………………..………

E…………………………………………………………..

F…………………………………………………………...

G…………………………………………………………..

H…………………………………………………………..

I……………………………………………………………

J…………………………………………………………...

K…………………………………………………………..

L…………………………………………………………..

M…………………………………………………………..

N…………………………………………………………..

O…………………………………………………………..

P…………………………………………………………...

Q…………………………………………………………..

R…………………………………………………………..

S…………………………………………………………...

T…………………………………………………………..

U…………………………………………………………..

SOC1 & SOC2 Report and Certification (VI.A.1.b)

Account Management Organizational Chart

Sample Pharmacy Communication Materials (Ques.

J.11 Confirmations Tab)

Sample Benefit Booklet (Ques. J.11, Confirmations

Tab)

Sample Pharmacy Directory – Lincoln NE – 15 Mile

Radius (Ques. J.11, Confirmations Tab)

Sample Request Letters for Clinical Programs (Ques.

J.11, Confirmations Tab)

Sample EOB (Ques. J.11, Confirmations Tab)

Sample Client Reporting (Ques. K1)

Formulary Change Templates (Ques. K.1)

Sample Rx Preauthorization Report (Ques. E.3 & E.4)

Sample Adherence Report (Ques. K1)

Sample Rx Operational Performance Guarantees

Summary (Ques. K.4)

Sample RXDC D3-D8 Reports (Ques. L.5)

Account Team Performance Assessment (Ques. B.5)

Formulary Files PDL25 and PDL10 (Ques. D.1)

Sample Guided Health Report (Ques. E.3 & E.4)

Pharmacy GeoAccess Report (Ques. F.5)

Specialty Drug List (Que. H.5)

V…………………………………………………………...

W…………………………………………………………..

Oncology Split Fill List (Ques. H.18)

HIPAA Assessment Proof (Table of Contents) (Ques.

H.2, Confirmations Tab)

SOLICITATION EVALUATION CRITERIA

SOLICITATION NUMBER: 122436 O5

Administrative Support Services for the State of Nebraska Employee Health Care Prescription Drug Benefit Plans

Opening Date: July 18, 2025

Mandatory Requirements The solicitation responses will first be examined to determine if all mandatory requirements listed below have been addressed to warrant further evaluation. Responses not meeting mandatory requirements will be excluded from further evaluation. The mandatory requirement items are as follows:

Contractual Agreement Form signed manually in ink or by DocuSign.

Corporate Overview;

Completed Sections II through IV;

Completed Technical Response, including, but not limited to;

Completed Attachment C – Confirmations & Questionnaire;

Completed Formulary Disruption Analysis as requested in Questionnaire Tab D.3;

Completed Network Disruption Analysis as requested in Questionnaire Tab F.14;

Completed Attachment A - Intent to Propose Form;

Completed Attachment B - Business Associate Agreement;

Completed Attachment D - Performance Guarantee Sheet; and Completed Cost Sheet.

Evaluation Criteria All responses to this solicitation, which fulfill all mandatory requirements, will be evaluated. Each category will have a maximum possible point potential. Areas that will be addressed and scored during the evaluation include:

Evaluation Criteria Possible Points

Part 1 Corporate Overview 25

Part 2 Technical Response 55

Part 3 Cost 20

Total Points without Vendor Demonstrations 100

Vendor Demonstrations, (if required) 20

Total Points with Vendor Demonstrations 120

Part 3 – Cost Cost points should be calculated as follows, accounting for cost realism and reasonableness:

1. Establish lowest realistic cost submitted – lowest cost submitted receives the maximum points.

2. To assign points to all others, the following formula should be followed:

Lowest Cost Submitted ÷ Cost Submitted x Maximum Possible Cost Points = Cost Points to Award (see samples below)

Formula Sample Sample Sample

Lowest Cost Submitted $100,000 $100,000 $100,000

÷ Cost Submitted $100,000 $200,000 $150,000 x Maximum Possible Cost Points 20 20 20

= Points To Award 20.00 10.00 13.33

Acknowledged

122436 O5 Prescription Drug Benefits Plan

CONTRACTUAL AGREEMENT FORM

By signing this Contractual Agreement Form, the bidder guarantees compliance with the provisions stated in this solicitation and agrees to the terms and conditions unless otherwise indicated in writing and certifies that bidder is not owned by the Chinese Communist Party.

THIS FORM MUST BE SIGNED MANUALLY IN INK OR BY DOCUSIGN

COMPANY: Blue Cross and Blue Shield of Nebraska, Inc.

ADDRESS: 1919 Aksarben Drive, Omaha NE 68180

PHONE: (402) 982-6013

EMAIL: Ron.Rowe@nebraskablue.com

BIDDER NAME & TITLE:

Ron Rowe, Executive Vice President and Chief Revenue Officer

SIGNATURE:

DATE:

VENDOR COMMUNICATION WITH THE STATE CONTACT INFORMATION

(IF DIFFERENT FROM ABOVE)

NAME: Bradley Smith

TITLE: Senior Sales Executive – Large Group

PHONE: (402) 880-5406

EMAIL: Bradley.Smith@nebraskablue.com

BIDDER MUST COMPLETE THE FOLLOWING

Per Nebraska’s Transparency in Government Procurement Act, Neb. Rev Stat § 73-603, DAS is required to collect statistical information regarding the number of contracts awarded to Nebraska Vendors. This information is for statistical purposes only and will not be considered for contract award purposes.

__X__ NEBRASKA VENDOR AFFIDAVIT: Bidder hereby attests that bidder is a Nebraska Vendor.

“Nebraska Vendor” shall mean any bidder who has maintained a bona fide place of business and at least one employee within this state for at least the six (6) months immediately preceding the posting date of this Solicitation. All vendors who are not a Nebraska Vendor are considered Foreign Vendors under Neb. Rev Stat § 73-603 (c).

_____ I hereby certify that I am a Resident disabled veteran or business located in a designated enterprise zone in accordance with Neb. Rev. Stat. § 73-107 and wish to have preference, if applicable, considered in the award of this contract.

_____ I hereby certify that I am a blind person licensed by the Commission for the Blind & Visually Impaired in accordance with Neb. Rev. Stat. § 71-8611 and wish to have preference considered in the award of this contract.

Docusign Envelope ID: 22EDC2A2-35FE-49A3-B3A7-77AEC10A689A

7/16/2025 mailto:Ron.Rowe@nebraskablue.com

Kory Nogosek Senior Director, Associate General Counsel E-mail: Kory.Nogosek@nebraskablue.com

Phone: (402) 982-8936

1919 Aksarben Drive P.O. Box 3248 Omaha, NE 68180-0001 nebraskablue.com

CERTIFICATE

OF OFFICER’S AUTHORITY

I, Kory Nogosek, Senior Director, Associate General Counsel at Blue Shield of Nebraska, Inc., a Nebraska corporation (the “Company”) hereby certify:

That Mr. Ron Rowe is the Chief Revenue Officer of the Company (the “Officer”);

That the Officer, by virtue of the authority delegated by the Board of Directors of the Company at a meeting of the Board of Directors, at which a quorum was present, is empowered and authorized to act in the name of and on behalf of the Company, to bind the Company, to sign and execute certain documents and instruments in the name and on behalf of the Company as may be required in the ordinary course of business, including the execution and delivery of responses to Requests for Proposals; and

That such authority has not been modified, rescinded or revoked and is in full force and effect as of the date hereof.

Executed this ___ day of June, 2025.

Docusign Envelope ID: 9E85B201-B578-4486-B749-C3A9D220EC6C

16th

Attachment A

Solicitation Number: 122436 O5

INTENT TO PROPOSE

Date: 6/9/2025

To: Monica Casarez, Segal (mcasarez@segalco.com)

From: Tracie Pettijohn, Inter-Plan & RFP Program Manager

Name and Title

Re:

State of Nebraska – Administrative Support Services for the State of Nebraska Employee Health Care Prescription Drug Benefit Plans – RFP # 122436 O5

Non-Disclosure Agreement

Authorized signer Name and Title:

Ron Rowe, EVP and Chief Revenue Officer

Email: Ron.Rowe@nebraskablue.com

Phone: 402.982.6013

Company Name: Blue Cross and Blue Shield of Nebraska

Company Address: 1919 Aksarben Drive

Omaha, NE 68180

Designated contact to receive secure data for this RFP

Name and Title: Tracie Pettijohn, Inter-Plan & RFP Program Manager

Email: Tracie.Pettijohn@nebraskablue.com

Phone 402.819.4242 (Teams Directory)

In order that the State of Nebraska may assess potential vendor interest, please indicate Yes or No below and return to mcasarez@segalco.com. Thank you.

Our company intends to propose: Yes/No If No, reason for declining:

Administrative Support Services for the State of Nebraska Employee Health Care Prescription Drug Benefit Plans – RFP # 122436 O5

Yes

Declining to respond will not eliminate the vendor from future consideration for jobs with the State of Nebraska.

Initialed:______________ Ron Rowe

EVP & Chief Revenue Officer

Blue Cross and Blue Shield of

Nebraska, Inc.

Docusign Envelope ID: B4A5F5E3-EA4B-4BED-9315-88752C431B02 mailto:mcasarez@segalco.com mailto:Ron.Rowe@nebraskablue.com mailto:Tracie.Pettijohn@nebraskablue.com mailto:mcasarez@segalco.com

Mutual Confidentiality and Non-Disclosure Agreement

THIS MUTUAL CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT (the

“Agreement”), is entered into on June 12, 2025 (the “Effective Date”), by and between Blue

Cross and Blue Shield of Nebraska, on behalf of itself and its subsidiaries and affiliates

(“Company”) and The Segal Group, Inc., on behalf of itself and its subsidiaries and affiliates

(“Segal”). Company and Segal may be referred to individually as a “Party” and collectively as the “Parties”.

WHEREAS, in connection with various bids, proposals or other replies (each a “Proposal”) that

Company intends to submit to Segal in response to various competitive Requests For

Proposal/Requests for Information and/or similar requests related to analyzing Company’s services on behalf of one or more of Segal’s clients (each a “Client”), the Parties will need to exchange certain data and information pertaining to their respective businesses (the “Purpose”).

WHEREAS, the Parties desire to protect the confidentiality of Confidential Information (as defined herein) exchanged.

NOW, THEREFORE, the Parties hereto agree as follows:

1. Definitions.

a. Client Information. Client Information will be defined as any information and data related to the Client, which may include personally identifiable information and/or individually identifiable health information, pertaining to a Client’s employees, participants and/or beneficiaries.

All Client Information is and shall remain the sole and exclusive property of the

Client. No right or license, either express or implied, to Client Information is granted to either Party pursuant to this Agreement. For the avoidance of doubt, Company may not de-identify, de-compile, aggregate, use, disclose, or otherwise exploit any Client Data for any purpose other than preparing its Proposal

(including, for the avoidance of doubt, populating any data warehouse and conducting statistical analyses).

b. Service Provider Information. Service Provider information is any information relating to one of Client’s other service providers that would qualify as

Confidential Information if it was disclosed directly by such service provider to the receiving Party.

All Service Provider Information is and shall remain the sole and exclusive property of the applicable service provider. No right or license, either express or implied, to Service Provider Information is granted to either Party pursuant to this

Agreement.

c. Confidential Information. Confidential Information will be defined as proprietary or confidential information, nonpublic information, trade secrets, designs and other data including, but not limited to, the disclosing Party’s financial information projections, sales and marketing information, client information and contracts personnel information, management systems, strategic plans, financial information and other information about the Party’s business, industry, products and services, plans, specifications, operation methods, techniques, manuals, know-how and other intellectual property, in written or other tangible form, or orally, necessary to effectuate the Purpose.

Confidential Information also includes Client Information and Service Provider

Information. Except as set forth above, all Confidential Information is and shall remain the sole and exclusive property of the disclosing Party. No right or license, either express or implied, is granted to the receiving Party pursuant to this Agreement.

d. Exclusions. Confidential Information will not include information which: (i) is or becomes a part of the public domain through no fault of the receiving Party; (ii) is disclosed by the disclosing Party without restriction on disclosure; (iii) is independently developed by the receiving Party without reliance on the disclosing

Party’s Confidential Information; or (iv) is required to enforce a Party’s rights hereunder.

2. Use and Disclosure of Confidential Information. With respect to disclosing Party’s

Confidential Information, the receiving Party agrees to:

a. Maintain such Confidential Information in confidence, using at least the same standard of care with respect to the Confidential Information that it uses in maintaining the confidentiality of its own Confidential Information, which shall be a reasonable standard of care;

b. Not use or disclose such Confidential Information for any reason other than the

Purpose or as explicitly permitted herein, without the express permission of the disclosing Party;

c. Not misappropriate or use Confidential Information in order to intentionally damage the disclosing Party’s or service provider’s business or reputation or otherwise gain a competitive advantage over the disclosing Party or service provider;

d. Only disclose, or otherwise make available, Confidential Information to those of its affiliates, shareholders, directors, officers, employees, agents and representatives (“Representatives”) who have a legitimate need to know the

Confidential Information in furtherance of the Purpose and have been made aware of the obligations of this Agreement and their responsibility for complying with those obligations. The receiving Party acknowledges that it is fully responsible for a breach of this Agreement by its Representatives;

e. Notify the disclosing Party, in writing, immediately upon the occurrence of any unauthorized use, disclosure or release of Confidential Information of which it is aware;

3. Additional Permitted Disclosures.

a. Use of Host Website. In certain instances, Segal may conduct a competitive RFP process electronically through the use of a third party hosted website (“Host

Website”) retained by Segal. Prior to requesting that any of Company’s

Confidential Information be uploaded onto the Host Website, Segal will ensure that the Host Website Provider entered into a confidentiality and non-disclosure agreement with Segal no less restrictive than this Agreement.

b. Freedom of Information Laws. If Client is a public entity, it may be subject to certain freedom of information laws (collectively, “FOIL”). If Segal receives notice of a permissible FOIL request related to the RFP, Segal may release copies of

Company’s Proposal and any attachments thereto. If Company believes that any information contained in its Proposal constitutes proprietary or trade secret information that is exempt from FOIL, Company will clearly identify the information that it believes to be exempt from disclosure; however, Company may not designate its entire Proposal, line-item prices, and/or total proposal prices as proprietary or trade secrets. Neither Segal nor Client shall have any responsibility or liability for the release of any proprietary or trade secret information that is not clearly marked. Company will have sole responsibility for defending its designation of proprietary/trade secret information if a third party challenges the designation.

c. Other Disclosures Required by Law. A receiving Party may disclose Confidential

Information that is required to be disclosed pursuant to a subpoena or other legal process, provided that to the extent not prohibited by applicable law, the receiving Party gives the disclosing Party a reasonable opportunity to contest the disclosure and/or seek any available protections for the Confidential Information.

4. Cybersecurity. Each Party maintains procedures, consistent with industry standards and as required by law, to ensure the security of all data maintained on its information technology systems. In addition, each Party shall maintain a business continuity/disaster recovery program, consistent with industry standards and as required by law. Each Party agrees to provide the other Party with any reasonably requested information related to its information security protocols and disaster recovery program. Such information will constitute Confidential Information and be subject to the Party’s obligations under this

Agreement.

5. Return of Information. Upon the request of the disclosing party, the Receiving Party shall immediately return to the disclosing Party any Confidential Information in written or other tangible form. Notwithstanding the foregoing, Segal may retain archival copies of any Confidential Information received in order to memorialize its services for Client and as required by its then-existing document retention and business continuity programs.

Any Confidential Information so retained will be maintained in accordance with Segal’s obligations hereunder.

6. Term. The receiving Party’s obligations hereunder shall remain in effect for so long as it maintains Confidential Information in any form.

7. Indemnification. Company shall and does hereby agree to indemnify, defend and hold harmless Segal, Client and their respective officers, directors, employees and shareholders from and against any and all claims, demands, losses, costs, expenses, liabilities, damages, penalties, and reasonable attorney fees and costs incurred as a result of any breach or failure of Company or Company’s Representatives to perform any of the representations, warranties and agreements contained in this Agreement that pertain to Client Information.

8. Injunctive Relief. The receiving Party acknowledges that a failure by the receiving Party or its Representatives to comply with the terms of this Agreement may cause irreparable damage to the disclosing Party and that, in addition to any other legal remedies or equitable relief available to the disclosing Party for the breach of this Agreement, the disclosing Party may seek, from a court of appropriate jurisdiction, specific performance to prevent, inhibit or enjoin any action taken by the receiving Party or its Representatives in breach hereof.

9. Governing Law. Without limiting the disclosing Party’s ability to seek injunctive relief under Section 8, any disputes between the Parties hereto are subject to mediation in accordance with the Judicial Arbitration and Mediation Service (“JAMS”) as a condition precedent to the commencement of any legal proceeding hereunder. Except to the extent superseded by federal law, the validity, interpretation, enforceability, and performance of this Agreement will be governed by the laws of the State of New York.

Unless otherwise agreed by the Parties, any dispute, controversy or claim arising out of or to enforce the terms of this Agreement may be brought in the appropriate federal or state court in the State of New York, New York County. THE PARTIES AGREE TO

WAIVE ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION, SUIT, OR PROCEEDING

ARISING OUT OF THIS AGREEMENT.

10. Notices. Any notices or other communications under this Agreement will be in writing and will be given to the Parties by hand, by electronic mail, nationally recognized overnight courier service or by express, registered or certified mail, postage prepaid, return receipt requested, at the addresses set forth below:

If to Company, to: If to Segal, to:

Blue Cross and Blue Shield of Nebraska The Segal Group 1919 Aksarben Drive Omaha, Nebraska 68180 United States

66 Hudson Blvd E 20th floor New York, New York 10001 United States

Attention: Ron Rowe Attention: General Counsel Ron.Rowe@nebraskablue.com Contract_Notice@segalco.com

Copy to:

Monica Casarez mcasarez@segalco.com

11. General

a. Entire Agreement; Modification of Agreement. This Agreement constitutes the entire agreement between the Parties regarding the exchange of Confidential

Information. No modification or amendment hereto will be valid unless it is in writing and signed by the Parties.

b. Severability and Waiver. If any provision of this Agreement is found to be illegal or otherwise unenforceable, that provision will be severed and the remainder of this Agreement will remain in full force and effect. No consent to or waiver of any default hereunder will be effective unless in writing and no such consent or waiver will be construed as a consent to or waiver of any default in the future or of any other default hereunder.

c. No Third Party Beneficiaries. This Agreement is made and entered into solely for the benefit and protection of the Parties hereto, their successors and permitted assigns, and, except as specifically set forth herein, does not confer any rights or privileges upon any third parties.

d. Counterparts. This Agreement may be executed in any number of counterparts, each of which when so executed and delivered shall be an original, but such counterparts shall constitute one and the same instrument.

[Execution Page Follows]

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

THE SEGAL GROUP, INC. BLUE CROSS AND BLUE SHIELD OF

NEBRASKA

By: [r5mgjz6_____________________] By: [7rzyhhv_____________________]

Name: [fkqrl34_____________________] Name: [46tiahp_____________________]

Title: [zsgigjd_____________________] Title: [cawfgzd_____________________]

Date: [xm6254w_________] Date: [pvuv1fz_________]

If second signature is required: By:

Name:

Title:

Date:

Title ID

Non-Disclosure Agreement (Blue Cross and Blue Shield of Nebraska and Segal) 6d2cafd2-51f8-4a00-bd57-dcf1d7d08e0f

Contracts signed by:

Date / Time: Jun 12, 2025 at 4:42 PM EDT

IP Address: 208.87.234.202

Edg/137.0.0.0

Date / Time: Jun 12, 2025 at 6:48 PM EDT

IP Address: 174.74.8.49

Attachment B

STATE OF NEBRASKA

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) amends and is made a part of all Services Agreements (as defined below) between Blue Cross and Blue Shield of Nebraska, Inc. (“Business Associate”) and State of Nebraska (“Company”) on behalf of the Group Health Plans sponsored by Company (the “Plan”). This Agreement is effective _______________ or upon the effective date of the underlying Services Agreement, whichever is later (“Effective Date”). This Agreement supersedes and replaces any prior Business Associate Agreements between the parties.

1. Definitions.

a. Catch-all definitions. The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Covered Entity, Data Aggregation, Designated Record Set, Disclose or Disclosure, Electronic Protected Health Information, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Protected Health Information or PHI, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Other capitalized terms used but not otherwise defined in this Agreement shall have the meaning ascribed in the HIPAA Rules.

b. Specific definitions.

(1) “Business Associate” shall generally have the same meaning as the term "Business Associate" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean the party identified above as Business Associate.

(2) “Business Associate Functions” means functions performed by Business Associate on behalf of the Plan in the course of providing or arranging for plan administration services which involve the creation, receipt, maintenance or transmission of PHI by Business Associate or its agents or Subcontractors. It is anticipated that the services provided by Business Associate will be performed as part of the Plan's “health care operations” as defined in the HIPAA Rules.

(3) “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended at the time the section is to be applied.

(4) “Individual” shall generally have the same meaning ascribed in the HIPAA Rules and shall refer only to Individuals who are covered persons under the Plan.

(5) “Services Agreements” means all agreements whether now in effect or hereafter entered into, between Company and Business Associate for the performance of Business Associate Functions by Business Associate on behalf of the Plan.

Docusign Envelope ID: B4A5F5E3-EA4B-4BED-9315-88752C431B02

2. Purpose. The Plan is a Covered Entity under HIPAA. The HIPAA Rules require the Plan to obtain, and Business Associate to provide, satisfactory written contractual assurances before Business Associate may create, receive, maintain, or Disclose PHI to perform Business Associate Functions on behalf of the Plan. This Agreement is entered into to provide the contractual assurances required under the HIPAA Rules.

3. Obligations of Business Associate. As an express condition of performing Business Associate Functions, Business Associate agrees to:

a. Not Use or Disclose PHI other than as permitted or required by this Agreement or as otherwise Required by Law.

b. Use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent Use or Disclosure of PHI other than as provided for in this Agreement.

c. Report to the Plan's designated privacy official, without unreasonable delay but in no event more than three (3) business days after discovery by Business Associate, any Use or Disclosure of PHI not provided for by this Agreement of which Business Associate becomes aware, including any Breach of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware, together with any remedial or mitigating action taken or proposed to be taken with respect thereto. If Business Associate does not have available complete information in satisfaction of 45 CFR 164.410(c) within three (3) business days of discovery of the impermissible Use or Disclosure, Business Associate shall provide all information it has at such time and immediately update the Plan with additional information as it becomes available through prompt investigation. This Agreement serves as Business Associate's notice to the Plan that attempted but unsuccessful Security Incidents regularly occur and that no further notice will be made by Business Associate unless there has been a successful Security Incident or attempts or patterns of attempts that Business Associate determines to be suspicious.

Business Associate shall cooperate with the Plan in mitigating any harmful effects of any impermissible Use or Disclosure. In the case of a Breach as determined to exist in the sole discretion of the Plan which was due solely to a violation of this Agreement by Business Associate, Business Associate shall pay for the reasonable costs of investigation, mitigation and notification to affected Individuals. As an alternative to Business Associate reimbursing Company and the Plan for the costs of notification, the Plan may elect to have Business Associate directly provide the notifications to Individuals for breaches caused by Business Associate, provided that Company and the Plan shall have final approval of all content of notifications to Individuals.

d. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to substantially similar restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

e. Within ten (10) business days of request by an Individual or notification by the Plan, make available to the Individual such Individual's PHI maintained by Business

Associate in a Designated Record Set in accordance with 45 CFR 164.524. The parties agree that Individuals will be directed to Business Associate to make all requests for access to PHI. Business Associate will provide such access according to its own procedures for such access in accordance with the requirements of 45 CFR 164.524. If the requested PHI is maintained in one or more Designated Record Sets electronically and if the Individual requests an electronic copy of such PHI, Business Associate must provide the Individual with access to PHI in the electronic form and format requested by the Individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to between Business Associate and the Individual. Business Associate shall provide the requested information directly to the Individual, along with a notice to the Individual that a copy of the individual's request has been furnished to the Plan and that the Plan may provide additional information to the Individual in response to the request.

If the Individual's request covers records not maintained by Business Associate, Business Associate shall notify the Plan within three (3) days of the request. The Plan will be responsible for providing access or otherwise responding directly to the Individual pursuant to the HIPAA Rules with respect to PHI not in the possession of Business Associate or an agent or subcontractor of Business Associate. Business Associate may charge the Individual reasonable fees related to this access, as determined by Business Associate, but only in such amounts as permitted by the HIPAA Rules. The Plan authorizes Business Associate to require payment of such fees from the Individual prior to releasing any records.

f. Business Associate agrees to receive requests for amendment and amend PHI as required by 45 CFR 164.526 on the Plan's behalf for as long as such information is maintained by Business Associate. The parties agree that Individuals will be directed to Business Associate to make all such requests for amendment of PHI. Business Associate will amend such PHI according to its own procedures for such amendment in accordance with the requirements of 45 CFR 164.526. If the Individual's request covers records not maintained by Business Associate, Business Associate shall notify the Plan within three (3) days of such request. The Plan will be responsible for amending or otherwise responding directly to the Individual pursuant to the HIPAA Rules with respect to PHI not in the possession of Business Associate or an agent or contractor of Business Associate. Business Associate shall notify the Plan of any amendments made to PHI.

g. Business Associate agrees to process all requests for disclosure accounting by Individuals for as long as such information is maintained by Business Associate.

Individuals will be directed to Business Associate to make all such requests.

Business Associate will provide the accounting that is required under 45 CFR

164.528 on the Plan's behalf directly to the Individual. Business Associate will provide such accounting according to its own procedures for such accounting in accordance with the requirements of 45 CFR 164.528.

Business Associate shall notify the Plan within three (3) days of any request made by an Individual for a disclosure accounting. The Plan will be responsible for responding directly to the Individual (or the Individual's personal representative) pursuant to 45 CFR 164.528 with respect to disclosures of PHI by persons or entities other than Business Associate or a subcontractor or agent of Business Associate.

Business Associate shall provide directly to the Individual the requested accounting of disclosures made by Business Associate or a subcontractor or agent of Business Associate, along with a notice to the Individual that a copy of the Individual's request has been furnished to the Plan and that the Plan may provide additional information to the Individual in response to the request.

h. Make its internal practices, books and records relating to this Agreement available to the Secretary of HHS for purposes of determining the Plan's and Business Associate's compliance with the HIPAA Rules.

i. So that the Plan may meet its obligations to evaluate requests for restrictions and confidential communications in connection with the disclosure of PHI under 45 CFR 164.522, Business Associate and the Plan agree that, to the extent that communications are within the control of Business Associate, Business Associate will perform these evaluations on behalf of the Plan. Business Associate will evaluate such requests according to its own procedures for such requests, in accordance with the requirements of 45 CFR 164.522, and shall implement such appropriate operational steps as are required by its own procedures. Such evaluation will not relieve the Plan of any additional and independent obligations to evaluate restrictions or implement confidential communications where requested by an Individual. Accordingly, Business Associate will evaluate requests for restrictions and requests for confidential communications and will respond to these requests as appropriate under Business Associate's procedures. The Plan agrees that it will not agree to such restriction or request that would affect Business Associate without the approval of Business Associate, so that Business Associate can determine whether it can reasonably administer the request.

j. So that the Plan may meet its obligation to evaluate complaints from Individuals regarding their privacy rights or privacy practices of the Plan or Business Associate, the parties agree that Individuals shall be directed to submit any such complaint to Business Associate for review and evaluation. Business Associate will evaluate such complaints according to its own procedures for complaints and shall implement appropriate operation steps as are required by its own procedures. The Privacy Officer of the Plan shall cooperate with Business Associate in the evaluation of any such complaint. Business Associate shall provide a copy of all complaints to the Plan within three (3) days of receipt by Business Associate. If the complaint appears to involve handling of PHI by the Plan, Plan Sponsor, or other Business Associate of the Plan, Business Associate shall notify the Plan, and it shall be the Plan's responsibility to review and evaluate the complaint.

k. Limit the Uses and Disclosures of, or requests for, PHI for purposes described in this Agreement to the Minimum Necessary to perform the required Business Associate Functions. Business Associate shall comply with any additional requirements for the determination of Minimum Necessary as are required from time to time by the HIPAA Rules, as amended, or through additional guidance published by the Secretary.

l. To the extent Business Associate is expressly obligated under the Services Agreements to carry out one or more of the Plan's obligations(s) under Subpart E of

45 CFR Part 164, comply with the requirements of Subpart E that apply to the Plan in the performance of such obligation(s).

m. Except for the specific Uses and Disclosures for the Business Associate's own management and administration or to carry out the legal responsibilities of Business Associate, Business Associate shall not Use or Disclose PHI in a manner that would violate the HIPAA Rules if done by the Plan.

4. Permitted Uses and Disclosures of PHI. Business Associate shall only Use or Disclose PHI as follows:

a. Business Associate may Use or Disclose PHI as Required by Law. Business Associate agrees to follow the current law covering the use and disclosure of PHI related to substance abuse and reproductive health.

b. Business Associate may Use or Disclose PHI as necessary to carry out Business Associate Functions.

c. Business Associate may Use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

d. Business Associate may Disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the Disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is Disclosed that the information will remain confidential and be Used or further Disclosed only as Required by Law or for the purposes for which it was Disclosed to the person, and the person notifies Business Associate in writing of any instances of which it is aware in which the confidentiality of the information has been breached or compromised.

e. If specifically identified as a Business Associate Function in the Services Agreements, Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity.

f. If de-identification is listed as a Business Associate Function in the Services Agreements, or if Business Associate is expressly permitted to de-identify PHI and use data thus de-identified for its own uses in the Services Agreements, Business Associate may Use PHI to de-identify the information in accordance with 45 CFR 164.514(a)-(c). Business Associate may use de-identified data only for the purposes specified in the Services Agreements.

5. Responsibilities of the Plan. The Plan agrees to:

a. Notify Business Associate promptly of any restriction on the Use or Disclosure of PHI that the Plan has agreed to or is required to abide by under 45 CFR 164.522, to the extent such restriction may affect Business Associate's Use or Disclosure of PHI.

b. Notify Business Associate of any changes in, or revocation of, the permission by an Individual to Use or Disclose PHI, to the extent that such changes may affect Business Associate's Use or Disclosure of PHI.

c. Provide Business Associate with a copy of any amendment to PHI which is accepted by Covered Entity under 45 CFR 164.526 which Covered Entity believes will apply to PHI maintained by Business Associate in a Designated Record Set.

d. Not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Plan, with exception for any Data Aggregation services permitted under Section 4.

6. Compliance with Electronic Transactions Rule. If Business Associate conducts in whole or part electronic Transactions (as defined in 45 CFR 160.103) on behalf of Covered Entity for which the Secretary of HHS has established standards, Business Associate will comply, and will require any Subcontractor involved with the conduct of such Transactions to comply, with each applicable requirement of the Electronic Transactions Rule at 45 CFR Parts 160 and 162 and of any operating rules adopted by the Secretary of HHS with respect to Transactions.

7. Supervening Law. Upon the enactment of any law or regulation affecting the Use or Disclosure of PHI, or the publication of any decision of a court of the United States or of this state relating to any such law, or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, the parties agree to amend this Agreement in such manner as is necessary to comply with such law or regulation. If the parties are unable to agree on an amendment within thirty (30) days, either party may terminate the Services Agreements on not less than thirty (30) days’ written notice to the other.

8. Liability and Indemnification. Each party shall be responsible for the acts and omissions of its own agents, employees and contractors. Notwithstanding the foregoing, and notwithstanding any limitation of liability or disclaimer of damages in the Services Agreements or elsewhere, to the extent that the Secretary determines that Business Associate is acting as an agent of the Plan under the Services Agreements or this Agreement, Business Associate shall indemnify Company and the Plan for any fines, civil monetary penalties or monetary resolutions incurred by Company or the Plan, plus reasonable attorneys' fees of Company and the Plan, arising out of or relating to the actions or omissions of Business Associate which constitute a breach of this Agreement by Business Associate. This indemnification is in addition to any additional indemnification provided by Business Associate in the Services Agreement.

9. Term and Termination.

a. Term. This Agreement shall become effective on the Effective Date and shall continue in effect until all obligations of the parties have been met, including return or destruction of all PHI in Business Associate’s possession (or in the possession of Business Associate’s agents and Subcontractors), unless sooner terminated as provided herein. It is expressly agreed that the terms and conditions of this Agreement designed to safeguard PHI shall survive expiration or other termination of the Services Agreements and shall continue in effect until Business Associate has performed all obligations under this Agreement and has either returned or destroyed all

PHI.

b. Termination. Company may immediately terminate this Agreement and the Services Agreements, if Company and/or the Plan makes the determination that Business Associate has breached a material term of this Agreement. Alternatively, Company may choose to provide Business Associate with written notice of the existence of an alleged material breach, and afford Business Associate an opportunity to cure the alleged material breach upon mutually agreeable terms.

Failure to take reasonable steps to cure the breach is grounds for the immediate termination of this Agreement.

c. Business Associate Obligations Upon Termination. Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from the Plan, or created, maintained, or received by Business Associate on behalf of the Plan, shall:

(i) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities or as to which Business Associate reasonably determines such PHI is technically incapable of being returned or destroyed;

(ii) Return to the Plan or, if not provided for in the Services Agreements, destroy the PHI retained under 8.c.(i) that the Business Associate maintains in any form;

(iii) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information retained by Business Associate to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

(iv) Not Use or Disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at Sections 4.c. and 4.d. which applied prior to termination; and

(v) Return to the Plan or, if not provided for in the Services Agreements, destroy the PHI retained by Business Associate under Section 8.c.(i) when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities, except where Business Associate reasonably determines such PHI is not technically capable of being returned or destroyed.

10. Miscellaneous.

a. Applicability. For purposes of this Agreement, and as applicable to the Business Associate Functions of Business Associate under the Services Agreements covered by this Agreement, references to the Plan shall include the named Plan and all other group health plans subject to HIPAA and sponsored by Company that participate in an organized health care arrangement.

b. Survival. The respective rights and obligations of Business Associate and the Plan or Company hereunder shall survive termination of this Agreement according to the terms hereof and the obligations imposed on the Plan or Company and Business Associate under the HIPAA Rules.

c. Interpretation; Amendment. This Agreement shall be interpreted and applied in a manner consistent with the Plan's and Business Associate's obligations under the HIPAA Rules. All amendments shall be in writing and signed by both parties, except that this Agreement shall attach to additional Services Agreements entered into between the parties in the future without the necessity of amending this Agreement each time. This Agreement is intended to cover the entire Business Associate relationship between the parties, as amended, from time to time, through Services Agreements or other means.

d. Waiver. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events.

e. No Third-Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies or obligations.

IN WITNESS WHEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf.

Company:

State of Nebraska

Signature:

Printed Name:

Title:

Date Signed:

Business Associate:

Blue Cross and Blue Shield of Nebraska Inc.

Signature:

Printed Name: Ron Rowe

Title: Executive Vice President and Chief Revenue Officer

Date Signed:

DOCS/1204654.1

7/16/2025

Attachment B

STATE OF NEBRASKA

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) amends and is made a part of all Services Agreements (as defined below) between ________________________(“Blue Cross and Blue Shield of Nebraska, Inc. (“Business Associate”) and State of Nebraska (“Company”) on behalf of the Group Health Plans sponsored by Company (the “Plan”). This Agreement is effective _______________ or upon the effective date of the underlying Services Agreement, whichever is later (“Effective Date”).

This Agreement supersedes and replaces any prior Business Associate Agreements between the parties.

1. Definitions.

a. Catch-all definitions. The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Covered Entity, Data Aggregation, Designated Record Set, Disclose or Disclosure, Electronic Protected Health Information, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Protected Health Information or PHI, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Other capitalized terms used but not otherwise defined in this Agreement shall have the meaning ascribed in the HIPAA Rules.

b. Specific definitions.

(1) “Business Associate” shall generally have the same meaning…