Att 15 - Non-Disclosure Agreement (NDA).docx

Non-Disclosure Agreement State of Alaska (Note: Do not modify this form)

This Non-Disclosure Agreement ("Agreement") applies to RFP# 2025-0200-0177 / 02-101-25, for Pharmacy Benefit Manager Services, and is made effective upon signature of the Agreement. The Agreement is between the State of Alaska, Department of Administration, Division of Retirement and Benefits (“State”), and the company named at the end of this document (“Recipient”).

Background Information

A. The State is in the process of evaluating certain potential services to be provided by Recipient related to Pharmacy Benefit Manager Services to assist in the administration of the State’s AlaskaCare Health Plans.

B. The data and information that the State expects to provide to Recipient for use in evaluating Recipient’s proposal to provide the Services is confidential and not public data and the parties desire to enter into a Confidentiality Agreement to set forth their respective duties and obligations regarding the State's data and information.

Provisions

In consideration of the foregoing Background Information, which is incorporated by this reference as if fully re-written herein and the mutual covenants and provisions set forth herein, the receipt and sufficiency of which is hereby acknowledged, the parties hereto agree as follows:

Confidential Information. As used in this Agreement, "Confidential Information" shall mean any and all technical and non-technical information about the State, including, but not limited to data and information processed by the State in connection with evaluating the Services. The term shall also include all "protected health information" (as defined by 45 C.F.R. § 160.103) and any other personally identifiable information ("PII") regarding any individual who is, or may become, eligible for the State's Plan (including, but not limited to, such Plan's pharmacy benefit). The Recipient hereby agrees to abide by the State's determination that such information is Confidential Information and that the same is of a special and unique nature and value, important and material, that it gravely affects the effective and successful conduct of the business and that it may include personal identification information or other information of the State or State employees and their dependents that is to be maintained as confidential.

Preservation of Confidentiality. All Confidential Information (a) supplied by any employee, agent, consultant, or independent contractor of the State ("State Representatives") to the Recipient or any employee, agent, officer, director, shareholder, independent contractor or representative of the Recipient (collectively, the "Recipient Representatives"), (b) obtained by the Recipient or any Recipient Representatives from any documents, meetings or telephone conversations with any State Representatives or from books or records of the State, (c) obtained by the Recipient or any Recipient Representatives or in any other manner including through hosting the software evaluation on Recipient's website, or (d) jointly or individually developed by the State and/or Recipient shall be protected and maintained by the Recipient on a confidential basis and the Recipient shall not use any of the Confidential Information for any purposes (other than as permitted by this Agreement). The Recipient shall refrain from directly or indirectly disclosing any of the Confidential Information to any person, firm, fund, or entity, or knowingly making any Confidential Information available to any others for any use (other than as permitted by this Agreement). Failure to mark any of the Confidential Information as confidential or proprietary shall not affect its status as Confidential Information. In furtherance and not in limitation of the foregoing provisions, the Recipient shall:

Restrict disclosure of the Confidential Information only to those of the persons as may be absolutely necessary;

Advise all persons to whom Confidential Information is disclosed of the strict obligations of confidentiality hereunder; and Take such steps to protect the confidentiality of the Confidential Information as may be taken to protect the Recipient's own confidential materials, but in no event shall the Recipient use less than a reasonable degree of care.

In addition to the foregoing, Recipient agrees to use reasonable and appropriate administrative, physical and technological safeguards to: (i) prevent use or disclosure of the Confidential Information other than as provided for by this Agreement; and (ii) implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Confidential Information. Recipient represents and warrants that it has implemented, and during the term of this Agreement shall maintain, comprehensive written privacy and security policies and procedures and the necessary administrative, technical and physical safeguards appropriate to the size and complexity of Recipient's operations and the nature and scope of its activities.

Report of Breach. Recipient shall promptly notify the State of a breach of any Confidential Information within forty-eight (48) hours of when Recipient discovers such breach. A breach shall be treated as discovered by Recipient as of the first day on which such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, Recipient Representative or other agent of Recipient. Recipient's notification shall be in writing and, if the Confidential Information is protected health information (“PHI”) or PII, shall include identification of each individual whose PHI or PII has been, or is reasonably believed by Recipient to have been, subject to the breach. Recipient shall include the following information in its notification of breach to the State:

A description of the breach, including the date of the breach and the date of the discovery of the breach, if known;

A description of the types of Confidential Information that was involved in the breach (such as whether full name, social security number, date of birth, home address, account number, credit card numbers, diagnosis, disability code or other types of PHI or PII were involved);

Any steps that individuals should take to protect themselves from potential harm resulting from the breach;

A description of what Recipient is doing to investigate the breach, to mitigate the harm to individuals and to protect against further breaches; and Contact procedures for Individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an email address, web site, or postal address.

If some of the information listed in (a) – (e) above is not known to Recipient when it notifies the State of a breach, Recipient shall provide such information to the State as soon as it becomes available to Recipient, but in no event not later than thirty (30) days after Recipient discovers such breach. Recipient shall also provide such assistance and further information regarding the breach to the State as reasonably requested by the State in order for the State to timely meet its notice obligations to individuals, and/or governmental agencies, as applicable, under any law or regulation requiring notification of breaches of PHI or PII.

Recipient Representatives. Recipient agrees to ensure that any Recipient Representative to whom it provides Confidential Information agrees in writing to the same restrictions and conditions that apply through this Agreement to Recipient with respect to Confidential Information. Such written agreement shall also require the Recipient Representative to implement reasonable and appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Confidential Information that it receives. Recipient, and not the State, is solely responsible for Recipient Representatives' uses and disclosures of Confidential Information.

Ownership of Information. All information learned or developed pursuant to this Agreement shall be "Confidential Information" as defined in this Agreement and shall be the property of the State, excluding Recipient’s internal analysis of the Confidential Information which does not contain PHI or PII. Recipient shall not use the Confidential Information or internal analysis for any purposes other than responding to RFP# 2025-0200-0177 / 02-101-25.

Information Not Covered Under This Agreement. This Agreement shall not apply to specific information if:

The information is or later becomes generally available to the public, except as a result of an unauthorized disclosure, including unauthorized disclosure by the Recipient or Recipient Representatives;

The State gives its prior written consent to the disclosure of information or the waiver of any provision of this Agreement; or The information is disclosed to the Recipient by a third party (except an employee or former employee of Recipient or its affiliates) who is not under a legal restriction not to so disclose such information.

Fulfillment of Purpose. When requested by the State, the Recipient shall:

Return all documents, copies of documents, computer records, and other means of recording or storing Confidential Information in Recipient's or Recipient Representatives' possession to the State within five (5) calendar days of the State’s request or, at Recipient's option, destroy all such items;

Certify in writing to the State that the Recipient has so complied; and Not use or disclose the Confidential Information or transact business in any manner based upon the Confidential Information.

Representations and Warranties. The Recipient represents, warrants, and covenants to the State that it is entering into this Agreement with the knowledge that this Agreement (including, specifically, this Section 8) is a substantive and material inducement to the State to engage in the evaluation of the Recipient's services, and that no disclosure would be made to the Recipient or the Representatives by the State but for the existence of this Agreement.

Indemnification of State. The Recipient shall indemnify and hold the State harmless from and against all liability, loss, cost, or expense (including attorneys' fees and costs) which the State may sustain or incur by reason of the breach of any agreements, representations, warranties, or covenants of or relating to Recipient or any of the Recipient Representatives contained in this Agreement or by reason of the enforcement by the State of any such agreements, representations, warranties, or covenants set forth herein. Without limiting the foregoing, in the event of a breach of PHI or PII or similar breach or wrongful disclosure as defined by an applicable law or regulation requiring notification or other remedial action due to the breach or wrongful disclosure of PHI, PII, or other personal or financial information ("Breach Law") that arose out of or related to Recipient's or Recipient Representatives' acts and omissions, Recipient shall indemnify the State against all costs and expenses incurred by the State that are associated with complying with the notification requirements under the Breach Law. Such indemnification shall include all costs related to notifying individuals or any other entity required to be notified by the Breach Law, any remediation necessitated by the breach, any fines or penalties arising out of the breach, and any other actions required or that are customary in the industry to be taken pursuant to the Breach Law (including, without limitation, credit or identity monitoring for affected individuals).

Insurance to be Secured by the Recipient. The Recipient shall maintain professional liability insurance, and comprehensive general commercial liability insurance, including coverage to protect against any errors or omissions of the Recipient and Recipient's Representatives, crime/dishonesty insurance relating to Recipient and Recipient's Representatives and workers' compensation insurance, if required by applicable law.

Term. This Agreement may be terminated by the State on five days prior written notice to the Recipient.

Printed Name of Authorized Representative

Title

Signature

Date

Offeror Name