9. Attachment H - Data Use Agreement.pdf

RFP No.: DMS-24/25-312 Attachment H: Data Use Agreement Page 1 of 4

ATTACHMENT H: DATA USE AGREEMENT

This Data Use Agreement (“Agreement”) is made this day of 2025, by and between (Vendor), and the State of Florida, Department of Management Services (“Department”).

The Vendor warrants and represents that it intends to submit a Proposal in response to the Department’s solicitation entitled RFP No.: DMS-24/25-312, Medicare Advantage and Prescription Drug Plan (RFP). In order to respond to the RFP, the Department will provide Vendor with access to certain individually identifiable health information (Protected Health Information) contained in Attachment I : Census File. The Department will provide this Protected Health Information in a limited data set in accordance with 45 C.F.R. § 164.514(e)(1). See section 1.8, Notice of Intent to Submit a Proposal and Data Use Agreement, of the RFP for instructions on how to obtain this file and data.

As a condition for its receipt and access to the Protected Health Information, Vendor agrees as follows:

1. Vendor shall comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act of 2009, and all other applicable requirements of law relating to the Protected Health Information.

2. Vendor shall not use or disclose the Protected Health Information for any purposes other than to respond to this RFP.

3. Vendor must use appropriate safeguards to prevent the unauthorized use or disclosure of the Protected Health Information.

4. Vendor shall not disclose, publish, release, transfer, or disseminate any Protected Health Information except as authorized by law and permitted by this Agreement.

5. Vendor shall be liable for any violations by any of its employees who are provided or given access to Protected Health Information and for any access by unauthorized persons.

6. Vendor shall abide by the following procedures in handling the Department’s Protected Health Information:

a. Vendor will password protect the Protected Health Information upon receipt thereof.

b. Vendor shall only allow its authorized employees to access the Protected Health Information.

c. Vendor will inform all employees who have access to the Protected Health Information that:

i. The employee is not to share the password or the Department’s Protected

Health Information with any unauthorized person;

ii. If the Vendor does not submit a Proposal to the RFP, the employee will, by the time Proposals to the RFP are due, delete the Department’s Protected Health Information from any laptop, desktop, or any other electronic system under

Attachment H: Data Use Agreement Page 2 of 4 their control and will destroy any paper copies of the Protected Health Information;

iii. At the end of the solicitation process, the employee will delete the Department’s Protected Health Information from any laptop, desktop, or any other electronic system under their control and will destroy any paper copies of the Protected Health Information; and

iv. The employee must confirm to Vendor that he or she have so deleted or destroyed the Protected Health Information.

d. Files and passwords will be provided separately to each employee.

e. Vendor shall maintain a list of persons granted access (“Access List”) to the Department’s Protected Health Information. Persons expected to have access to the Department’s Protected Health Information are to be listed in the chart on page 4 of this attachment. If at any time the Vendor intends to provide access to a person not listed on the Access List provided to the Department, the Vendor must provide an updated Access List to the Department’s Procurement Officer, including the additional person to be provided access, prior to the provision of access to such person. Vendor has a continuing obligation to update the Access List.

7. Vendor must not identify, attempt to identify, nor contact the person who is the subject of the Protected Health Information.

8. Vendor shall report to the Department any unauthorized access, use, or disclosure of Protected Health Information within three (3) Calendar Days of discovery thereof.

9. Vendor shall make its internal practices, books, and records relating to its use and disclosure of the Protected Health Information available to the Secretary of the U.S.

Department of Health and Human Services or its authorized delegate for purposes of determining the Department’s compliance with applicable law. Vendor shall immediately notify the Department upon receipt by Vendor of any such request and shall provide the Department with copies of any such materials.

10. If Vendor submits a Proposal in response to this RFP, Vendor shall destroy the Protected Health Information, including any copies, remaining in its possession within the later of five (5) Business Days of the Department’s notice of an intended award in connection with this solicitation or the conclusion of any legal proceeding or protest regarding the procurement. At that time, Vendor shall provide to the Procurement Officer a final Access List and a certification that it has complied with this destruction requirement.

If Vendor does not submit a Proposal in response to this RFP, the Vendor shall destroy the Protected Health Information, including any copies, by the time Proposals are due. At that time, the Vendor shall provide to the Procurement Officer a complete Access List and certification that the vendor has complied with this destruction requirement on or before the due date of Proposals.

11. Vendor's employees who access the Protected Health Information must agree to the restrictions set forth herein prior to obtaining access to the Protected Health Information.

Attachment H: Data Use Agreement Page 3 of 4

12. In the event the Department suffers any losses, damages, liabilities, expenses or costs (including by way of example only, attorney’s fees and disbursements) that are attributable, in whole or in part, to any failure by Vendor or any employee of Vendor to comply with the requirements of this Agreement, Vendor shall hold harmless and indemnify the Department and the State of Florida from and against any such losses, damages, liabilities, expenses and/or costs.

13. Vendor acknowledges that the disclosure of the Protected Health Information may cause irreparable harm to the Department and agrees that the Department may obtain an injunction to prevent the disclosure, copying, or other impermissible use of the Protected Health Information. The Department’s rights and remedies hereunder are cumulative, and the Department expressly reserves any and all rights, remedies, claims, and actions that it may have now or in the future to protect the Protected Health Information and/or to seek damages for Vendor’s failure to comply with the requirements of this Agreement.

14. This Agreement shall be governed by the laws of the State of Florida. Vendor consents to personal jurisdiction in Florida state court, and exclusive venue shall be in Leon County, Florida.

15. The individual signing below warrants and represents that they are fully authorized to bind Vendor to the terms and conditions specified in this Agreement.

Legal Name of Vendor:

Name of Authorized Representative:

(Print Name)

Title of Authorized Representative:

Signature of Authorized Representative:

Date:

Date of Signature

Address:

Enter Street or PO Address

Enter City, State and ZIP Code

Telephone No: ( ) -

E-mail Address (the individual who will receive the link to access the Protected Health Information):

Attachment H: Data Use Agreement Page 4 of 4

VENDOR’S EMPLOYEES WHO WILL BE GIVEN ACCESS TO THE

PROTECTED HEALTH INFORMATION

(Vendors may submit separate, scanned pages of employees’ signatures)

Printed Name, Address of Individual

Signature of Individual Date