2.Att A.Draft Contract (DMS-2122-027 Dental)_FINAL 4.25.22.pdf

4050 Esplanade Way Tallahassee, FL 32399-0950

Ron DeSantis, Governor J. Todd Inman, Secretary

ATTACHMENT A

DRAFT CONTRACT

FOR

GROUP DENTAL INSURANCE

DMS-21/22-027

BETWEEN

STATE OF FLORIDA

DEPARTMENT OF MANAGEMENT SERVICES

AND

<<INSERT CONTRACTOR NAME>>

RFP No.: DMS-21/22-027 Attachment A: Draft Contract Page 2 of 45

Table of Contents Definitions

1.1 Definitions

CONTRACT DOCUMENTS

2.1 Rules of Interpretation

2.2 Hierarchy of Documents

Term, Scope, and Payments

3.1 Term

3.1.1 Initial term

3.1.2 Renewals

3.2 Department’s Right to Terminate for Convenience

3.3 Scope of Work

3.4 Modifications and Changes

3.5 Department’s Right to Suspend Work

3.6 Department’s Obligation to Supply Data to Contractor

3.7 Bills for Travel

3.8 Payments

3.9 Appropriations

3.10 Non-Exclusive Contract

Contract Administration

4.1 Ownership of Deliverables and Retention of Records

4.2 Contractor Obligations

4.2.1 General

4.2.2 Major Organizational Changes

4.2.3 Subcontractors

4.2.4 Background Screening, Record Retention, and Warranty of Security

4.2.5 Work Locations, No Offshoring of Data

4.2.6 E-Verify

4.2.7 Scrutinized Companies – Termination by the Department

4.2.8 Removal or Replacement of Employees and Subcontractors for Cause

4.2.9 Employment of State Workers

4.3 Healthcare Providers are Separate Independent Contractors

4.4 Acceptance of Deliverables

4.5 Warranty

Audit Rights Diversity Liquidated Damages

7.1 Generally

7.2 Implementation Delays

7.3 Failure to Meet Performance Guarantees

Insurance

8.1 Insurance Coverage

8.2 Performance Bond

Events of Default and Remedies

9.1 Contractor Events of Default

9.2 Department Remedies in the Event of Default

9.3 Department Events of Default

9.4 Contractor Remedies in the Event of Default

9.5 Rights Cumulative, No Waiver

Transition Services General Provisions

Attachment A: Draft Contract Page 3 of Page 45

11.1 Advertising

11.2 Assignment, Acquisition by Third Party

11.3 Change of Statute or Regulation or Governmental Restrictions

11.4 Compliance with Laws, Including HIPAA

11.5 Contract Administrator

11.6 Contract Managers

11.7 Dispute Resolution, Governing Law and Venue

11.8 Entire Contract

11.9 Execution in Counterparts

11.10 Force Majeure, Notice of Delay and No Damages for Delay

11.11 Further Assurances

11.12 Indemnification

11.13 Defense of Third-Party Claims

11.13.1 Notice of Claims

11.13.2 Department as Real Party in Interest

11.13.3 Contractor as Real Party in Interest

11.13.4 Cooperation in the Defense of Administrative and/or Legal Actions

11.13.5 Administrative Proceedings

11.13.6 Support and Communication with Contractor’s Legal Affairs Department

11.14 Right of Setoff

11.15 Independent Contractor Status

11.16 Inspection at Contractor Site

11.17 Intellectual Property

11.18 Lobbying and Integrity

11.19 Loss of Data

11.20 Notices

11.21 Cooperation with the Inspector General

11.22 Public Records

11.22.1 Access to Public Records

11.22.2 Redacted Copies of Confidential Information

11.22.3 Request for Redacted Information

11.22.4 Indemnification

11.22.5 Contractor as Agent

11.23 Rights to Records

11.24 Taxes

11.25 Waiver

11.26 Warranty of Authority

11.27 Warranty of Ability to Perform

11.28 Severability

11.29 Organizational Conflicts of Interest

11.30 Best Pricing Clause

11.31 Convicted Vendor, Discriminatory Vendor, Antitrust Violator Vendor, and Suspended Vendor Lists

11.32 Section 508 Compliance

Attachment A: Draft Contract Page 4 of Page 45

ATTACHMENTS:

ATTACHMENT 1: AFFIDAVITS

ATTACHMENT 2: ADMINISTRATIVE REQUIREMENTS

ATTACHMENT 3: PERFORMANCE GUARANTEES

ATTACHMENT 4: PLAN DESIGN

ATTACHMENT 5: ENROLLMENT FILE LAYOUT AND SCHEDULE

ATTACHMENT 6: PRICING

ATTACHMENT 7: PRIVACY, SECURITY, AND CONFIDENTIALITY BUSINESS ASSOCIATE

AGREEMENT

ATTACHMENT 8: APPROVED SUBCONTRACTORS (IF APPLICABLE)

THIS SPACE INTENTIONALLY LEFT BLANK

Attachment A: Draft Contract Page 5 of Page 45

Contract This Contract is entered between STATE OF FLORIDA, DEPARTMENT OF MANAGEMENT SERVICES (“Department”), an agency of the State of Florida, with offices at 4050 Esplanade Way, Tallahassee, Florida 32399-0950, and {Insert Contractor Name} (“Contractor” or “Service Provider”), with offices at {Insert Contractor Address}, each, a “Party” and collectively referred to herein as the “Parties”.

WHEREAS, the Contractor responded to the Department’s Request for Proposals (RFP) No.:

DMS-21/22-027 for Group Dental Insurance (Services); and

WHEREAS, the Parties wish to enter into this Contract in accordance with the terms and conditions of the RFP.

NOW THEREFORE, in consideration of the promises and mutual covenants set forth herein, the Parties agree as follows:

DEFINITIONS

1.1 Definitions

The following capitalized terms used in this Contract (including the Attachments thereto) have the meanings ascribed below:

“Account Management Team” means the individuals required by Attachment 2:

Administrative Requirements, II. Account Management, AR-5.

{Insert Name}, Account Management, Client Consultant {Insert Name}, Account Management, Back-up for {Insert Name above}, Client Consultant {Insert Name}, Account Management, Director, Client Services {Insert Name}, Implementation, Client Acquisition Consultant {Insert Name}, Account Executive/Sales {Insert Name}, Executive Sponsor

Changes to the individuals listed above shall be sent to the Department in writing, and will not require a Contract amendment.

“Business Day” means any day of the week excluding weekends and holidays observed by State agencies pursuant to subsection 110.117(1), Florida Statutes (F.S.).

“Calendar Day” means any day in a month, including weekends and holidays.

“Claim(s)” means an application for payment of or reimbursement for health care expenses incurred by Participants, which is filed in accordance with Contractor’s and/or Department’s requirements.

“Confidential Information” means information that is confidential, proprietary, trade secret, or otherwise not subject to public disclosure pursuant to section 24, Article I of the Florida Constitution (such exemptions may be found in Chapter 119, Florida Statutes, or any other Florida law, federal law, or regulation that serves to exempt information from public disclosure).

Attachment A: Draft Contract Page 6 of Page 45

“Contract” means this agreement between the Department and Contractor consisting of, in order of precedence, the following documents:

1. This agreement and its attachments, in the following order of precedence:

a. Attachment 1: Affidavits;

b. Attachment 2: Administrative Requirements;

c. Attachment 3: Performance Guarantees;

d. Attachment 4: Plan Design;

e. Attachment 5: Enrollment File Layout and Schedule;

f. Attachment 6: Pricing;

g. Attachment 7: Privacy, Security, and Confidentiality Business Associate

Agreement;

h. RFP No.: DMS-21/22-027 and all addenda, in reverse order of posting on the

Vendor Information Portal; and

i. Attachment 8: Approved Subcontractors (if applicable).

In the event of conflict between this Contract document and the Attachments, the Attachments will control.

2. The General Contract Conditions - PUR 1000 form, which is incorporated by reference, and available at the weblink listed below. The Parties agree that the following provisions of the PUR 1000 are not applicable to this Contract: 2-13, 16- 23, 25-29, 31-32, 34-38, 44-45, 47).

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Co ntract_Conditions.pdf

If the Contract terms are inconsistent with the Plan Design or any applicable federal or state statute, administrative rule or regulation; then the provisions of the Plan Design or statute, rule, or regulation will control.

“Contract Administrator” means the person designated pursuant to section 11.5 of this Contract.

“Contract Manager” means those persons designated pursuant to section 11.6 of this Contract.

“Data” or “State of Florida Data” means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions (including any that it is exempt; confidential; or Protected Health Information protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. §§ 160 and 164, the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and the regulations promulgated thereunder, or section 110.123(9), F.S.), that is received by the Contractor, or created by the Contractor, in the performance of the Services under the Contract. State of Florida Data may be in any form, including but not limited to, storage media, computer memory, in transit, presented on a display device, or in physical media such as paper, film, microfilm, or microfiche. State of Florida Data includes the original form of the State of Florida Data and all metadata associated with the State of Florida Data.

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Contract_Conditions.pdf https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Contract_Conditions.pdf

Attachment A: Draft Contract Page 7 of Page 45

“Department” means the Florida Department of Management Services or its designee. The Department reserves the right to contract with a third-party contractor to assume responsibility for the Department’s administration of the Contract.

“Deliverables” mean those services, items and/or materials provided, prepared, and delivered to the Department in the course of performance under this Contract by the Contractor.

“Division” means the Department’s Division of State Group Insurance (DSGI).

“Effective Date” means the date the Contract is fully executed by all Parties, and therefore signals the start of implementation and transition activities.

“Eligible Dependents” means a Dependent of a Subscriber, as defined by the Florida Administrative Code (F.A.C.) and statutes.

“Final Implementation Plan” means the written description provided by the Contractor, as approved by the Department, of the schedule of actions necessary to implement the Services and begin fulfilling the Contract in a timely manner.

“HIPAA” refers to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 together with the provisions of the Health Information Technology for Economic and Clinical Health Act (the HITECH Act). The Contractor shall comply with HIPAA.

“Implementation Date” means January 1, 2023, at 12:00 A.M., Eastern Time (EST), the anticipated first date Services are provided to Participants.

“Implementation Period” means the period between the Effective Date and the Implementation Date.

“Participants” means all Subscribers and their enrolled Eligible Dependents.

“People First” means enterprise-wide suite of services used by the State to manage human capital including the administration of human resources, benefits, payroll, and staffing.

People First is the State’s system of record for Plan eligibility.

“Performance Guarantees” means specific measurement indicators assigned to Contract tasks representing timeliness and quality of task output.

“Plan”, “Plan Design”, and “Coverage Tier” means the group dental insurance Plan Design as specified in Attachment 4: Plan Design.

“Plan Year” means the calendar year (January 1st to December 31st).

“Program” means the State Group Insurance Program defined in sections 110.123(3) and 110.12315, F.S.

“Protected Health Information” is defined in HIPAA at 45 CFR 160.103, and as used in this Agreement also refers to the term “Protected Health Information,” as defined in the HITECH Act.

“RFP” means the Request for Proposals No.: DMS-21/22-027, Group Dental Insurance, including all attachments and addenda to the Request for Proposals.

Attachment A: Draft Contract Page 8 of Page 45

“Secretary” means the Secretary of the Department or his or her designee.

“Services” means supplemental group dental benefits insurance services to be performed by Contractor as specified in this Contract, including the requirements of the Attachments to this Contract. The term “Services” includes but is not limited to, all Deliverables and any unspecified service that is inherent in proper delivery of a specified service or Deliverable.

During the term of the Contract, the Department will have the right to add or delete services and products. If the Department elects to add services or products, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract.

“State” means the State of Florida.

“Subcontractor” means the Contractor’s Department-approved subcontractors and agents that deliver the Services required by this Contract. The term “Subcontractor” shall not include dental care providers or other health care providers that have contracted with the Contractor to participate in Contractor’s provider networks under this Contract for any purpose.

“Subscriber”, “Enrollee”, or “Member” means the enrolled employee, retiree, surviving spouse, or Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA) participant that is the primary insured, as defined in Florida law.

CONTRACT DOCUMENTS

2.1 Rules of Interpretation

The following rules of interpretation shall apply, unless otherwise indicated:

a. Reference to, and the definition of, any document (including any attachments) shall be deemed a reference to such document as it may be amended, supplemented, revised or modified;

b. The table of contents and section headings and other captions are for the purpose of reference only and do not limit or affect the content, meaning or interpretation of the text;

c. Defined terms in the singular shall include the plural and vice versa and the masculine, feminine or neutral-genders shall include all genders;

d. The words “hereof,” “herein,” “hereunder,” and words of similar import, shall refer to this Contract as a whole and not to any particular provision of this Contract;

e. The words “include,” “includes” and “including” are deemed to be inclusive and followed by the phrase “without limitation”;

f. Any reference to a governmental entity or person shall include the governmental entity’s or person’s authorized successors and assigns; and

g. The words “quarterly,” “on a quarterly basis,” “quarterly meeting” or other similar terms mean, unless otherwise stated herein, once every three (3) months, beginning January 1, 2023.

2.2 Hierarchy of Documents

The Contract sets forth the entire understanding between the Parties. In the event that any of the Contract documents conflict, the conflict will be resolved in the order of precedence as listed in the definition of the term “Contract” in section 1.1. However, if the Contract terms

Attachment A: Draft Contract Page 9 of Page 45 are inconsistent with the Plan Design or any applicable federal or state statute, administrative rule, or regulation; then the provisions of the Plan Design or statute, rule, or regulation will control.

TERM, SCOPE, AND PAYMENTS

3.1 Term

3.1.1 Initial term

For the initial term, Services will commence on the Effective Date and end after 11:59:59 P.M. (EST), on December 31, 2025, unless extended, terminated or renewed as provided herein. The Parties acknowledge that the Plan will not be implemented and administered under this Contract until January 1, 2023. While pre-implementation services will be required, premium payments from Subscribers will be made only in accordance with section 3.8 of the Contract.

3.1.2 Renewals

The Department, at its sole option and discretion, may renew the Contract for up to three (3) additional years at the same prices as those specified in this Contract or lower negotiated prices. Such renewal will be binding on Contractor and may be in one (1) year or multiple-year increments at the Department’s sole option. Renewal in whole or in part shall be at the sole discretion of the Department and shall be contingent upon the Department’s determination that Contractor has satisfactorily performed its obligations under the Contract. The Department shall also consider whether Contractor has been subject to any performance violations, financial consequences, and/or liquidated damages in complying with any of the Contract requirements. Any renewal shall be in writing and signed by both Parties.

The Contractor shall not charge any costs for renewing the Contract. The renewal is subject to appropriations by the legislature and is contingent upon the availability of funds.

This Contract may be extended in accordance with section 287.057(13), F.S.

3.2 Department’s Right to Terminate for Convenience

The Department, by sixty (60) Calendar Days advanced written notice to Contractor, may terminate the Contract for any reason or no reason at all when the Department determines in its sole discretion that it is in the Department’s interest to do so. The Contractor shall not perform any Services after the effective date of the termination, except as necessary to complete the continued portion of the Contract, if any. The Contractor will not be entitled to recover any lost profits, consequential or indirect damages, or any other damages other than the payment amounts due for performance until the effective date of termination. If this Contract is terminated for convenience prior to January 1, 2023, the Department shall reimburse Contractor for direct costs actually incurred for Services authorized by the Department and satisfactorily performed prior to the notice of termination.

Attachment A: Draft Contract Page 10 of Page 45

3.3 Scope of Work

The Contractor will provide all labor, materials, and supplies necessary to provide the Services as described in this Contract and the Attachments, including but not limited to, providing all reports listed in Attachment 2: Administrative Requirements in the prescribed format and frequency, as well as to the intended recipient by the due date. The Contractor agrees to periodic reviews by the Department on Contractor’s performance to improve delivery of the Services. Corrective work to comply with the requirements of this Contract will be performed by the Contractor at its expense, and Contractor will not be entitled to any compensation for such corrective work.

3.4 Modifications and Changes

The Department, by written change order, may unilaterally require changes altering, adding to, or deducting from the Services, products, or Contract specifications, provided that such changes are within the general scope of the Contract. If Services or products are added, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract. The Department may make an equitable adjustment in the Contract price or delivery date if changes to Contract specifications affect the cost or time of performance. Such equitable adjustments require the written consent of the Contractor, which shall not be unreasonably withheld. If the Parties fail to agree to an equitable adjustment, such dispute must be resolved pursuant to the Dispute Resolution procedures identified in section 11.7.

The Contract, including its Attachments, contains all the terms and conditions agreed upon by the Parties, which shall govern all transactions under the Contract. Other than as specified above, the Contract may only be modified or amended upon mutual written agreement of the Department and Contractor. No oral agreements or representations shall be valid or binding upon the Department or Contractor. Contractor may not unilaterally modify the terms of the Contract by incorporating terms onto Contractor’s order or fiscal forms or other documents forwarded by Contractor for payment. The Department’s acceptance of Service or processing of documentation on forms furnished by Contractor for approval or payment will not constitute amendment to this Contract or waiver of a default.

3.5 Department’s Right to Suspend Work

The Department may in its sole discretion suspend any or all Services under the Contract, at any time, when in the best interests of the Department to do so. The Department will provide Contractor written Notice outlining the particulars of suspension. Examples of the reason for suspension include, but are not limited to, budgetary constraints, declaration of emergency, or other like circumstances. After receiving a suspension Notice, the Contractor will comply with the Notice.

3.6 Department’s Obligation to Supply Data to Contractor

The Department shall supply all eligibility and personnel data and information necessary for Contractor to provide the Services.

Attachment A: Draft Contract Page 11 of Page 45

3.7 Bills for Travel

Bills for travel expenses are not permitted under this Contract.

3.8 Payments

The Contractor agrees to perform all the Services for the compensation and financial arrangements set forth in this Contract and Attachment 6: Pricing. No additional compensation will be allowed. The Parties agree that payments under this Contract shall be made in accordance with this section of the Contract and section X, Payment Specifications, of Attachment 2: Administrative Requirements.

The Parties agree that payments under this Contract shall be made monthly in accordance with the enrollment information maintained by People First, the State’s self-service, secure, web-based human resource information system and enterprise-wide suite of human resource services. Contractor shall not invoice or bill the Department. Payments will be made to Contractor via electronic funds transfer (EFT) and by State-determined due dates. Contractor must complete a direct deposit authorization form. Payments from Contractor to the State shall be made via EFT and by State-determined due dates.

On a monthly basis, DSGI will verify the calculation of premium payments due to Contractor based on contracted premium rates and Member enrollment. People First maintains and updates the State’s system of records and will calculate the premium due using its eligibility and enrollment system. People First will make adjustments based on updated information.

Generally, People First will forward the enrollment Data to Contractor via an eligibility and enrollment file, the layout of which is found in Attachment 5: Enrollment File Layout and Schedule Attachment, by the 10th day of each calendar month. DSGI will subsequently make premium payments to Contractor no sooner than the 15th day of each calendar month and no later than the 30th day of each calendar month.

Upon conclusion of the annual open enrollment period, People First will provide Contractor with enrollment data for all Members enrolled at that time for the next Plan Year’s coverage to allow Contractor to meet all necessary Service requirements and Performance Guarantees.

All payments to the State shall be made separately by EFT from any payment balances due from the State. The netting of payments related to the Contract is prohibited.

Employee-paid premiums are generally deducted from the Subscribers’ paychecks.

Payroll deductions must be processed as even-numbered premium amounts. If a Subscribers’ calculated monthly premium is odd, the system will add or subtract one (1) penny from the premium deducted. Disregarding the dollar amount, if the odd numbered premium is more than fifty (50) cents per month, one (1) penny is added to the amount deducted. Disregarding the dollar amount, if the odd numbered premium is less than fifty

(50) cents per month, one (1) penny is subtracted from the amount deducted. Amounts resulting from this addition or reduction will not be considered an overpayment or underpayment. Neither Contractor nor the State nor the Participant will collect any amount of excess premium that may accumulate from this process.

Attachment A: Draft Contract Page 12 of Page 45

Rate increases are subject to the approval of the Department. An appropriate premium rate adjustment may be made via Contract amendment. Without the Department’s approval, the premium rates shall not be different than those specified in Attachment 6:

Pricing of the Contract.

In consideration of the Department’s internal requirements and open enrollment, premium rate changes must be approved by the Department prior to July 1st of any Plan Year.

Premium rate changes submitted after this date or submitted prior to this date but without time for a reasonable review period will not be considered.

3.9 Appropriations

The State of Florida’s performance and obligation to pay under this contract is contingent upon an annual appropriation by the Legislature. No Department funds will be expended on this Contract.

3.10 Non-Exclusive Contract

Nothing herein is intended to assure the Contractor that it is the only vendor providing these Services to the State, nor does it prohibit the State from procuring these services from additional vendors during the term of the Contract.

CONTRACT ADMINISTRATION

4.1 Ownership of Deliverables and Retention of Records

All Deliverables, papers, documents, materials, work and other items prepared by Contractor and provided to the State for purposes of the Contract are the property of the Department and shall be available to the Department at any time. The Department has the right to use the same without restriction and without any additional payments to Contractor other than that specifically provided by the Contract. The Contractor does not waive its rights in any Deliverables not prepared specifically for the Department that are also provided to other clients of Contractor for substantially the same purpose as they are provided to the Department, however, Contractor hereby grants a license to the Department to use such documents. Data deemed proprietary, trade secret, or otherwise confidential may be subject to further restrictions in compliance with Florida Statutes and federal laws and regulations.

Contractor shall retain sufficient documentation to substantiate claims for payment under the Contract, and all other records (including electronic files), papers, and documents, which were made for purposes of the Contract. Such records shall include all records in all types of media and all formats maintained by the Contractor directly relating to the Services.

Contractor shall retain all such records, papers, and documentation in compliance with record retention schedules published by the State of Florida Department of State. Prior to the destruction of any such records, papers, or documentation, Service Provider will consult with and obtain the prior written approval of the Department.

Additionally, in accordance with section 216.1366, F.S., the Department is authorized to inspect the: (a) financial records, papers, and documents of the Contractor that are directly related to the performance of the Contract or the expenditure of state funds; and (b) programmatic records, papers, and documents of the Contractor which the Department

Attachment A: Draft Contract Page 13 of Page 45 determines are necessary to monitor the performance of the Contract or to ensure that the terms of the Contract are being met. The Contractor shall provide such records, papers, and documents requested by the Department within ten (10) Business Days after the request is made.

4.2 Contractor Obligations

4.2.1 General

Contractor will provide any and all labor, materials, and supplies necessary to perform the Services in the manner prescribed by this Contract. Contractor will meet or exceed the Service requirements set forth in Attachment 2: Administrative Requirements and Attachment 3: Performance Guarantees.

4.2.2 Major Organizational Changes

The Parties agree that in order for efficient and effective communication to occur, clear lines of authority and areas of responsibility need to be identified for each Party. Each Party agrees to promptly notify the other in writing in the event of any material change in personnel, address, or phone number.

Contractor recognizes and agrees that award of the Contract was predicated upon features of Contractor's business organization as represented by Contractor in their response to the RFP. If Contractor transfers or sells fifty percent (50%) or more of its equity shareholder interests or allows a sale of substantially all of its assets, the Contractor shall notify the Department in writing no less than thirty (30) Calendar Days prior to such transfer or sale.

4.2.3 Subcontractors

Contractor is responsible for the acts or omissions of all Subcontractors, if any, it uses in the provision of the Services during the term of the Contract. The Department will have no liability of any kind for Subcontractor demands, loss, damage, negligence, or any expense relating, directly or indirectly, to Subcontractors.

Contractor will not subcontract any of the Services or enter into any subcontracts or change approved Subcontractors set forth in Attachment 8: Approved Subcontractors (including their key personnel and/or location of processes for the Services) without the express written consent of the Department. In seeking such consent, the Contractor will provide the Department prior notice of at least sixty

(60) Calendar Days or, in case of an emergency, as soon as practical. Each approved Subcontractor will be subject to the same terms and conditions as outlined in this Contract. For purposes of this section, dental care providers are not considered to be Subcontractors. The Contractor shall not utilize any volunteers in the performance of Services.

Attachment A: Draft Contract Page 14 of Page 45

4.2.4 Background Screening, Record Retention, and Warranty of Security

All of Contractor employees, Subcontractors and agents performing work under the Contract must comply with all security and administrative requirements of the Department.

4.2.4.1 Background Screening

In addition to any background screening required by the Contractor as a condition of employment, the Contractor warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for, each of its employees, subcontractor personnel, independent Contractors, leased employees, volunteers, licensees, or other person, hereinafter referred to as “Person” or “Persons,” operating under their direction who directly perform Services under the Contract, whether or not the Person has access to State of Florida Data, as well as those who have access, including indirect access, to State of Florida Data, whether or not they perform services under the Contract. The Contractor warrants that all Persons will have passed the Background Screening described herein prior to, but no longer than five (5) year’s before, they gain access to State of Florida Data or begin performing services under the Contract. The look-back period for such background screenings shall be for a minimum of six (6) years where six (6) years of historical information is available.

“Access” means to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage or the ability to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage.

Access to a computer system or network includes local and remote access.

“Data” or “State of Florida Data” is as defined in section 1.1. The minimum background check process must include a check of the following databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners, or a comparable standard:

• Social Security Number Trace; and

• Criminal Records (Federal, State and County criminal felony and misdemeanor, national criminal database for all states which make such data available); The Contractor agrees that each Person has been screened as a prior condition for performing services or having access to State of Florida Data.

The Contractor is responsible for any and all costs and expenses in obtaining and maintaining the criminal background screening information for each Person described above. The Contractor will maintain, or cause to be maintained, documentation of the screening in the Person’s employment file.

The Contractor will abide by all applicable laws, rules, and regulations including, but not limited to, the Fair Credit Reporting Act and/or any equal

Attachment A: Draft Contract Page 15 of Page 45 opportunity laws, rules, regulations, or ordinances. The Department may require the Contractor to exclude the Contractor’s employees, agents, representatives, or subcontractors based on the background check results.

The Department may refuse access to, or require replacement of, any Contractor, employee, Subcontractor, or Subcontractor employee, or agent for cause, including, but not limited to, technical or training qualifications, quality of work, change in security status, or non-compliance with the Department’s security or other requirements. Such approval shall not relieve the Contractor of its obligation to perform all work in compliance with the Contract. The Department may reject and bar from any facility for cause any of the Contractor’s employees, subcontractors, or agents.

4.2.4.2 Disqualifying Offenses

If at any time it is determined that a person has been found guilty of a misdemeanor or felony offense as a result of a trial or has entered a plea of guilty or nolo contendere, regardless of whether adjudication was withheld, within the last six (6) years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, the Contractor is required to immediately remove that person from any position with Access to State of Florida Data or directly performing services under the Contract. The disqualifying offenses are:

(a) Computer-related crimes;

(b) Information Technology crimes;

(c) Fraudulent practices;

(d) False pretenses;

(e) Frauds;

(f) Credit card crimes;

(g) Forgery;

(h) Counterfeiting;

(i) Violations involving checks and drafts;

(j) Misuse of medical or personnel records;

(k) Felony theft; and

(l) Identity Theft.

If the Contractor finds a Disqualifying Offense for a Person within the last six

(6) years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing Services under the Contract or have Access to State of Florida Data.

The Contractor will consider the following factors only in making the determination: i.) nature and gravity of the offense, ii.) the amount of time that lapsed since the offense, iii.) the rehabilitation efforts of the person and iv.)

relevancy of the offense to the job duties of the Person. If the Contractor determines that the Person should be allowed Access to State of Florida Data, then Contractor shall maintain all criminal background screening information and the rationale for such Access in the Person’s employment file.

Attachment A: Draft Contract Page 16 of Page 45

The Contractor shall require all Persons to self-report within three (3) Business Days of adjudication to the Contractor any adjudication of guilt as described above for the Disqualifying Offenses. The Contractor shall immediately disallow that Person Access to any State of Florida Data or Services under the Contract. Additionally, the Contractor shall require that the Person complete an annual certification that he or she has not received an adjudication of guilt as described above for the Disqualifying Offenses and shall maintain that certification in the employment file.

4.2.4.3 Refresh Screening

The Contractor will ensure that all background screening will be refreshed every five (5) years from the time initially performed for each Person during the Term of the Contract.

4.2.4.4 Annual Certification

The Contractor is required to submit the attached Affidavit of Warranty of Security to the Department by December 31st of each Contract year.

4.2.4.5 Duty to Provide Secure Data

The Contractor will maintain the security of State of Florida Data including, but not limited to, a secure area around any display of such State of Florida Data or State of Florida Data that is otherwise visible. The Contractor will also comply with all HIPAA and Rule Chapter 60GG-2, F.A.C., requirements and any other state and federal rules and regulations, as well as industry standards, regarding security of information. State of Florida Data cannot be disclosed to any person or entity that is not directly approved to participate in the Services provided under this Contract.

The Contractor shall not use, or otherwise disseminate, sell, copy or make available to any person or entity, Data relating to any aspect of performance of the Services, without prior written authorization of the Department. This requirement shall survive the termination of the Contract.

4.2.4.6 Department’s Ability to Audit Screening Compliance and Inspect Locations

The Department reserves the right to audit the Contractor’s background screening process upon two (2) Business Days’ prior written notice to the Contractor during the Term of the Contract. The Department will have the right to inspect the Contractor’s working area, computer systems, and/or location upon five (5) Business Days’ prior written notice to the Contractor to ensure that Access to the State of Florida Data is secure and in compliance with the Contract and all applicable state and federal rules and regulations.

4.2.4.7 Record Retention

The Contractor shall retain a list of all Persons with Access to Data, including a statement confirming that each Person has passed the Background

Attachment A: Draft Contract Page 17 of Page 45

Screening required herein. Such a statement shall not include the substance of the screening results, only that the Person has passed the screening.

The Contractor shall create a written policy for the protection State of Florida Data, including a policy and procedure for Access to State of Florida Data.

The Contractor shall document and record, with respect to each instance of Access to State of Florida Data:

1) The identity of all individual(s) who Accessed State of Florida Data in any way, whether those individuals are authorized Persons or not;

2) The duration of the individual(s)’ Access to State of Florida Data, including the time and date at which the Access began and ended;

3) The identity, form, and extent of State of Florida Data accessed, including, but not limited to, whether the individual Accessed partial or redacted versions of State of Florida Data, read-only versions of State of Florida Data, or editable versions of State of Florida Data; and

4) The nature of the Access to State of Florida Data, including whether State of Florida Data was edited or shared with any other individual or entity during the duration of the Access, and, if so, the identity of the individual or entity.

The Contractor shall retain the written policy and information required in this section for the duration of this Contract and a period of no less than five (5) years from the date of termination of this Contract and any Contract extensions. The written policy and information required in this section shall be included in the Department’s audit and screening abilities as defined in section 4.2.4.6. The written policy and information required in this section shall also be subject to immediate disclosure upon written or oral demand at any time by the Department or its designated agents or auditors.

Failure to compile, retain, and disclose the written policy and information as required in this section shall be considered a breach of the Contract. The resulting damages to the Department from a breach of this section are by their nature impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining such damages will be numerous, complex, and unreasonably burdensome to prove. The Parties acknowledge that these financial consequences are liquidated damages, exclusive of any other right to damages, not intended to be a penalty, and solely intended to compensate for unknown and unascertainable damages. The Contractor therefore agrees to credit the Department the sum of $5,000 per event, for each breach of this section.

4.2.4.8 Indemnification

The Contractor agrees to defend, indemnify, and hold harmless the Department, the State of Florida, its officers, directors, and employees for any claims, suits, or proceedings related to a breach of section 4 of this Contract.

The Contractor will include credit monitoring services at its own cost for those

Attachment A: Draft Contract Page 18 of Page 45 individuals affected or potentially affected by a breach of this section for a period of one (1) year following the breach.

4.2.5 Work Locations, No Offshoring of Data

Contractor, including its employees, subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other persons operating under their direction, are prohibited from (i) performing any Services under the Contract outside of the U.S., or (ii) sending, transmitting, or accessing any State of Florida Data, outside of the U.S. The Parties agree that a violation of this provision will:

(a) result in immediate and irreparable harm to the Department, entitling the Department to immediate injunctive relief, provided, however, this shall not constitute an admission by the Contractor to any liability for damages under subsection (c) below or any claims, liability, or damages to a third party, and is without prejudice to the Contractor in defending such claims.

(b) entitle the Department to a credit of $50,000 per violation, with a cumulative total cap of $500,000 per event. This credit is intended only to cover the Department’s internal staffing and administrative costs of investigations and audits of the transmittal of State of Florida Data outside the U.S.

(c) entitle the Department to recover damages, if any, arising from a breach of this section and beyond those covered under subsection (b).

(d) constitute an Event of Default not subject to the dispute resolution provisions in section 11.7 (“Dispute Resolution, Governing Law and Venue”) of this Contract.

The credits in subsection (b) are a reasonable approximation of the internal costs for investigations and audits from a violation. The credits are in the nature of liquidated damages and not intended to be a penalty on the Contractor. By executing this Contract, Contractor acknowledges and agrees the costs intended to be covered by subsection (b) are not readily ascertainable and will be difficult to prove. Contractor agrees that it will not argue, and is estopped from arguing, that such costs are a penalty or otherwise unenforceable. For purposes of determining the amount of credits due hereunder, a group of violations relating to a common set of operative facts (e.g., same location, same time period, same offshore entity) shall be treated as a single violation. The credits will be paid to the Department as prescribed by the Department, and are exclusive of any other right to damages.

4.2.5.1 Contactor’s Responsibility to Notify Department

For purposes of sections 4.2.5.1 through 4.2.5.3, the following definitions apply:

“Breach” means a confirmed event that compromises the confidentiality, integrity, or availability of information or State of Florida Data, or unauthorized access of State of Florida Data in electronic form containing personal information. Additional requirements related to breaches of HIPAA information are covered in Attachment 7: Privacy, Security, and Confidentiality Business Associate Agreement.

Attachment A: Draft Contract Page 19 of Page 45

“Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information technology security policies, acceptable use policies, or standard security practices. An imminent threat of violation refers to a situation in which the state agency has a factual basis for believing that a specific incident is about to occur.

Notwithstanding any provision of this Contract to the contrary, the Contractor shall notify the Department as soon as possible and in all events immediately upon discovering any Breach or Incident regarding State of Florida Data; any unauthorized access of State of Florida Data (even by persons or companies with authorized access for other purposes); any unauthorized transmission of State of Florida Data; or any credible allegation or suspicion of a material violation of the above. This notification is required whether the event affects one Participant or the entire population. The notification shall be clear and conspicuous and include a description of the following:

(a) The incident in general terms.

(b) The type of personal information that was subject to the unauthorized

Access and acquisition.

(c) The number of individuals who were, or potentially have been, affected by the Breach or Incident.

(d) The actions taken by the Contractor to protect the State of Florida Data information from further unauthorized Access. However, the description of those actions in the written notice may be general so as not to further increase the risk or severity of the Breach.

Upon becoming aware of an alleged Breach or Incident, the Contractor shall set up a conference call (via a telephone call and email) with the Department’s Contract Manager and any necessary parties. The conference call invitation shall contain a brief description of the nature of the event.

When possible, a thirty (30) minute notice shall be given to allow Department personnel to be available for the call. If the designated time is not practical for the Department, an alternate time for the call shall be scheduled. All available information shall be shared on the call. The Contractor shall answer all questions based on the information known at that time and shall answer additional questions as additional information becomes known. The Contractor shall provide the Department with final documentation of the incident including all actions that took place. If the Contractor becomes aware of a Breach or Incident outside of normal business hours, the Contractor shall notify the Department’s Contract Manager as soon as possible, and in all events, within twenty-four (24) hours.

The Contractor’s failure to perform the obligations in this section shall also be an Event of Default, and will entitle the Department to recover any other damages it incurs arising from a failure to perform the obligations in this section (including any actual out-of-pocket expenses incurred by the Department to investigate and remediate the violation) and/or to pursue injunctive relief.

Attachment A: Draft Contract Page 20 of Page 45

4.2.5.2 Contractor’s Responsibility to Notify Participants

The Contractor shall, at its sole expense, notify all Participants whose information was contained in the State of Florida Data that was accessed in the Breach, unauthorized access or transmission caused by the Contractor or its Subcontractors no later than thirty (30) Calendar Days after the determination of a Breach or reason to believe a Breach occurred. If the Contractor cannot identify the specific persons whose data may have been accessed, such notice shall be provided to all persons whose data reasonably may have been accessed. Nothing in this section will alter or replace the application of section 501.171, F.S., as to the Contractor’s obligations and liability for Breaches concerning personal information.

4.2.5.3 Credit Monitoring and Notification

The Service Provider shall include credit monitoring services at its own cost for those Participants affected or potentially affected by an alleged Breach for no less than a period of one (1) year following the Breach.

The Contractor shall provide the Florida Office of the Attorney General, Department of Legal Affairs written notice of a Breach that affects five hundred (500) or more Participants as soon as practicable, or within thirty

(30) Calendar Days after the determination of the Breach or reason to believe a Breach has occurred. The Contractor shall provide the Department a copy of the written notice to the Department of Legal Affairs. If a Breach impacts more than one thousand (1,000) Participants at a single time, the Contractor shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S. Code Section 1681a (p), of the timing, distribution, and content of the notices required pursuant to sections 4.2.5.1 (“Contractor’s Responsibility to Notify Department”) and 4.2.5.2 (“Contractor’s Responsibility to Notify Participants”) of this Contract.

4.2.6 E-Verify

The Contractor and its subcontractors have an obligation to utilize the U.S.

Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees hired in accordance with section 448.095, F.S. By executing this Contract, the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees in accordance with section 448.095, F.S. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, F.S., and maintain a copy of such affidavit for the duration of the Contract. The Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager within five (5) days of Contract execution.

This section serves as notice to the Contractor regarding the requirements of section 448.095, F.S., specifically sub-paragraph (2)(c)1, and the Department’s obligation to terminate the Contract if it has a good faith belief that the Contractor

Attachment A: Draft Contract Page 21 of Page 45 has knowingly violated section 448.09(1), F.S. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one (1) year after the date of such termination.